- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] ice: fix memory leak in aRFS after reset
by Yin Tirui 30 Apr '25

30 Apr '25

From: Grzegorz Nitka <grzegorz.nitka(a)intel.com> stable inclusion from stable-v6.6.84 commit 5d30d256661fc11b6e73fac6c3783a702e1006a3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLKM CVE: CVE-2025-21981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 23d97f18901ef5e4e264e3b1777fe65c760186b5 ] Fix aRFS (accelerated Receive Flow Steering) structures memory leak by adding a checker to verify if aRFS memory is already allocated while configuring VSI. aRFS objects are allocated in two cases: - as part of VSI initialization (at probe), and - as part of reset handling However, VSI reconfiguration executed during reset involves memory allocation one more time, without prior releasing already allocated resources. This led to the memory leak with the following signature: [root@os-delivery ~]# cat /sys/kernel/debug/kmemleak unreferenced object 0xff3c1ca7252e6000 (size 8192): comm "kworker/0:0", pid 8, jiffies 4296833052 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 0): [<ffffffff991ec485>] __kmalloc_cache_noprof+0x275/0x340 [<ffffffffc0a6e06a>] ice_init_arfs+0x3a/0xe0 [ice] [<ffffffffc09f1027>] ice_vsi_cfg_def+0x607/0x850 [ice] [<ffffffffc09f244b>] ice_vsi_setup+0x5b/0x130 [ice] [<ffffffffc09c2131>] ice_init+0x1c1/0x460 [ice] [<ffffffffc09c64af>] ice_probe+0x2af/0x520 [ice] [<ffffffff994fbcd3>] local_pci_probe+0x43/0xa0 [<ffffffff98f07103>] work_for_cpu_fn+0x13/0x20 [<ffffffff98f0b6d9>] process_one_work+0x179/0x390 [<ffffffff98f0c1e9>] worker_thread+0x239/0x340 [<ffffffff98f14abc>] kthread+0xcc/0x100 [<ffffffff98e45a6d>] ret_from_fork+0x2d/0x50 [<ffffffff98e083ba>] ret_from_fork_asm+0x1a/0x30 ... Fixes: 28bf26724fdb ("ice: Implement aRFS") Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka(a)intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_arfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/ice/ice_arfs.c b/drivers/net/ethernet/intel/ice/ice_arfs.c index cca0e753f38f..d7e0116f6773 100644 --- a/drivers/net/ethernet/intel/ice/ice_arfs.c +++ b/drivers/net/ethernet/intel/ice/ice_arfs.c @@ -510,7 +510,7 @@ void ice_init_arfs(struct ice_vsi *vsi) struct hlist_head *arfs_fltr_list; unsigned int i; - if (!vsi || vsi->type != ICE_VSI_PF) + if (!vsi || vsi->type != ICE_VSI_PF || ice_is_arfs_active(vsi)) return; arfs_fltr_list = kcalloc(ICE_MAX_ARFS_LIST, sizeof(*arfs_fltr_list), -- 2.22.0

2 1

[PATCH OLK-5.10] ice: fix memory leak in aRFS after reset
by Yin Tirui 30 Apr '25

30 Apr '25

From: Grzegorz Nitka <grzegorz.nitka(a)intel.com> mainline inclusion from mainline-v6.14-rc7 commit 23d97f18901ef5e4e264e3b1777fe65c760186b5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLKM CVE: CVE-2025-21981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Fix aRFS (accelerated Receive Flow Steering) structures memory leak by adding a checker to verify if aRFS memory is already allocated while configuring VSI. aRFS objects are allocated in two cases: - as part of VSI initialization (at probe), and - as part of reset handling However, VSI reconfiguration executed during reset involves memory allocation one more time, without prior releasing already allocated resources. This led to the memory leak with the following signature: [root@os-delivery ~]# cat /sys/kernel/debug/kmemleak unreferenced object 0xff3c1ca7252e6000 (size 8192): comm "kworker/0:0", pid 8, jiffies 4296833052 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 0): [<ffffffff991ec485>] __kmalloc_cache_noprof+0x275/0x340 [<ffffffffc0a6e06a>] ice_init_arfs+0x3a/0xe0 [ice] [<ffffffffc09f1027>] ice_vsi_cfg_def+0x607/0x850 [ice] [<ffffffffc09f244b>] ice_vsi_setup+0x5b/0x130 [ice] [<ffffffffc09c2131>] ice_init+0x1c1/0x460 [ice] [<ffffffffc09c64af>] ice_probe+0x2af/0x520 [ice] [<ffffffff994fbcd3>] local_pci_probe+0x43/0xa0 [<ffffffff98f07103>] work_for_cpu_fn+0x13/0x20 [<ffffffff98f0b6d9>] process_one_work+0x179/0x390 [<ffffffff98f0c1e9>] worker_thread+0x239/0x340 [<ffffffff98f14abc>] kthread+0xcc/0x100 [<ffffffff98e45a6d>] ret_from_fork+0x2d/0x50 [<ffffffff98e083ba>] ret_from_fork_asm+0x1a/0x30 ... Fixes: 28bf26724fdb ("ice: Implement aRFS") Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka(a)intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_arfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/ice/ice_arfs.c b/drivers/net/ethernet/intel/ice/ice_arfs.c index 6560acd76c94..632f16ffee40 100644 --- a/drivers/net/ethernet/intel/ice/ice_arfs.c +++ b/drivers/net/ethernet/intel/ice/ice_arfs.c @@ -510,7 +510,7 @@ void ice_init_arfs(struct ice_vsi *vsi) struct hlist_head *arfs_fltr_list; unsigned int i; - if (!vsi || vsi->type != ICE_VSI_PF) + if (!vsi || vsi->type != ICE_VSI_PF || ice_is_arfs_active(vsi)) return; arfs_fltr_list = kzalloc(sizeof(*arfs_fltr_list) * ICE_MAX_ARFS_LIST, -- 2.22.0

2 1

[PATCH OLK-6.6] HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check
by Yin Tirui 30 Apr '25

30 Apr '25

From: Karol Przybylski <karprzy7(a)gmail.com> stable inclusion from stable-v6.6.76 commit ae730deded66150204c494282969bfa98dc3ae67 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBL8 CVE: CVE-2024-57993 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 50420d7c79c37a3efe4010ff9b1bb14bc61ebccf ] syzbot has found a type mismatch between a USB pipe and the transfer endpoint, which is triggered by the hid-thrustmaster driver[1]. There is a number of similar, already fixed issues [2]. In this case as in others, implementing check for endpoint type fixes the issue. [1] https://syzkaller.appspot.com/bug?extid=040e8b3db6a96908d470 [2] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622 Fixes: c49c33637802 ("HID: support for initialization of some Thrustmaster wheels") Reported-by: syzbot+040e8b3db6a96908d470(a)syzkaller.appspotmail.com Tested-by: syzbot+040e8b3db6a96908d470(a)syzkaller.appspotmail.com Signed-off-by: Karol Przybylski <karprzy7(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/hid/hid-thrustmaster.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/hid/hid-thrustmaster.c b/drivers/hid/hid-thrustmaster.c index cf1679b0d4fb..6c3e758bbb09 100644 --- a/drivers/hid/hid-thrustmaster.c +++ b/drivers/hid/hid-thrustmaster.c @@ -170,6 +170,14 @@ static void thrustmaster_interrupts(struct hid_device *hdev) ep = &usbif->cur_altsetting->endpoint[1]; b_ep = ep->desc.bEndpointAddress; + /* Are the expected endpoints present? */ + u8 ep_addr[1] = {b_ep}; + + if (!usb_check_int_endpoints(usbif, ep_addr)) { + hid_err(hdev, "Unexpected non-int endpoint\n"); + return; + } + for (i = 0; i < ARRAY_SIZE(setup_arr); ++i) { memcpy(send_buf, setup_arr[i], setup_arr_sizes[i]); -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS 1/2] driver core: Probe devices asynchronously instead of the driver
by Yin Tirui 30 Apr '25

30 Apr '25

From: Alexander Duyck <alexander.h.duyck(a)linux.intel.com> mainline inclusion from mainline-v5.19-rc1 commit ef0ff68351be4fd83bec2d797f0efdc0174a55a4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP35K CVE: CVE-2022-49385 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Probe devices asynchronously instead of the driver. This results in us seeing the same behavior if the device is registered before the driver or after. This way we can avoid serializing the initialization should the driver not be loaded until after the devices have already been added. The motivation behind this is that if we have a set of devices that take a significant amount of time to load we can greatly reduce the time to load by processing them in parallel instead of one at a time. In addition, each device can exist on a different node so placing a single thread on one CPU to initialize all of the devices for a given driver can result in poor performance on a system with multiple nodes. This approach can reduce the time needed to scan SCSI LUNs significantly. The only way to realize that speedup is by enabling more concurrency which is what is achieved with this patch. To achieve this it was necessary to add a new member "async_driver" to the device_private structure to store the driver pointer while we wait on the deferred probe call. Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Reviewed-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Alexander Duyck <alexander.h.duyck(a)linux.intel.com> Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/base/base.h | 2 ++ drivers/base/bus.c | 23 +++-------------------- drivers/base/dd.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 48 insertions(+), 20 deletions(-) diff --git a/drivers/base/base.h b/drivers/base/base.h index 2d270b8c731a..92803ce31257 100644 --- a/drivers/base/base.h +++ b/drivers/base/base.h @@ -64,6 +64,7 @@ struct driver_private { * binding of drivers which were unable to get all the resources needed by * the device; typically because it depends on another driver getting * probed first. + * @async_driver - pointer to device driver awaiting probe via async_probe * @device - pointer back to the struct device that this structure is * associated with. * @dead - This device is currently either in the process of or has been @@ -78,6 +79,7 @@ struct device_private { struct klist_node knode_driver; struct klist_node knode_bus; struct list_head deferred_probe; + struct device_driver *async_driver; struct device *device; u8 dead:1; }; diff --git a/drivers/base/bus.c b/drivers/base/bus.c index 5f1966081c42..07876b6aac57 100644 --- a/drivers/base/bus.c +++ b/drivers/base/bus.c @@ -611,17 +611,6 @@ static ssize_t uevent_store(struct device_driver *drv, const char *buf, } static DRIVER_ATTR_WO(uevent); -static void driver_attach_async(void *_drv, async_cookie_t cookie) -{ - struct device_driver *drv = _drv; - int ret; - - ret = driver_attach(drv); - - pr_debug("bus: '%s': driver %s async attach completed: %d\n", - drv->bus->name, drv->name, ret); -} - /** * bus_add_driver - Add a driver to the bus. * @drv: driver. @@ -654,15 +643,9 @@ int bus_add_driver(struct device_driver *drv) klist_add_tail(&priv->knode_bus, &bus->p->klist_drivers); if (drv->bus->p->drivers_autoprobe) { - if (driver_allows_async_probing(drv)) { - pr_debug("bus: '%s': probing driver %s asynchronously\n", - drv->bus->name, drv->name); - async_schedule(driver_attach_async, drv); - } else { - error = driver_attach(drv); - if (error) - goto out_unregister; - } + error = driver_attach(drv); + if (error) + goto out_unregister; } module_add_driver(drv->owner, drv); diff --git a/drivers/base/dd.c b/drivers/base/dd.c index 432a5645bac3..b69691f5d217 100644 --- a/drivers/base/dd.c +++ b/drivers/base/dd.c @@ -928,6 +928,30 @@ int device_driver_attach(struct device_driver *drv, struct device *dev) return ret; } +static void __driver_attach_async_helper(void *_dev, async_cookie_t cookie) +{ + struct device *dev = _dev; + struct device_driver *drv; + int ret = 0; + + __device_driver_lock(dev, dev->parent); + + drv = dev->p->async_driver; + + /* + * If device has been removed or someone has already successfully + * bound a driver before us just skip the driver probe call. + */ + if (!dev->p->dead && !dev->driver) + ret = driver_probe_device(drv, dev); + + __device_driver_unlock(dev, dev->parent); + + dev_dbg(dev, "driver %s async attach completed: %d\n", drv->name, ret); + + put_device(dev); +} + static int __driver_attach(struct device *dev, void *data) { struct device_driver *drv = data; @@ -964,6 +988,25 @@ static int __driver_attach(struct device *dev, void *data) return 0; } /* ret > 0 means positive match */ + if (driver_allows_async_probing(drv)) { + /* + * Instead of probing the device synchronously we will + * probe it asynchronously to allow for more parallelism. + * + * We only take the device lock here in order to guarantee + * that the dev->driver and async_driver fields are protected + */ + dev_dbg(dev, "probing driver %s asynchronously\n", drv->name); + device_lock(dev); + if (!dev->driver) { + get_device(dev); + dev->p->async_driver = drv; + async_schedule(__driver_attach_async_helper, dev); + } + device_unlock(dev); + return 0; + } + device_driver_attach(drv, dev); return 0; -- 2.22.0

2 2

[PATCH openEuler-1.0-LTS] mpage: fix softlockup in mpage_readahead()
by Zheng Qixing 30 Apr '25

30 Apr '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBYXQD CVE: NA --------------------------- When using null_blk with a large readahead window, calling madvise to trigger readahead can lead to system softlocks. This occurs because the CPU can remain in the mpage_readpages loop for extended periods without rescheduling, preventing other processes from running. Add a cond_resched() call at the beginning of each loop iteration to allow the CPU to schedule other tasks when necessary, avoiding potential softlocks during heavy readahead operations. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- fs/mpage.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/mpage.c b/fs/mpage.c index fb2ff971c66b..d67a2bae0b87 100644 --- a/fs/mpage.c +++ b/fs/mpage.c @@ -394,6 +394,7 @@ mpage_readpages(struct address_space *mapping, struct list_head *pages, for (page_idx = 0; page_idx < nr_pages; page_idx++) { struct page *page = lru_to_page(pages); + cond_resched(); prefetchw(&page->flags); list_del(&page->lru); if (!add_to_page_cache_lru(page, mapping, -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] arp: use RCU protection in arp_xmit()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit a42b69f692165ec39db42d595f4f65a4c8f42e44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8P CVE: CVE-2025-21762 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- arp_xmit() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF. Fixes: 29a26a568038 ("netfilter: Pass struct net into the netfilter hooks") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-5-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/arp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c index fccf246e4263..638e6e91441b 100644 --- a/net/ipv4/arp.c +++ b/net/ipv4/arp.c @@ -639,10 +639,12 @@ static int arp_xmit_finish(struct net *net, struct sock *sk, struct sk_buff *skb */ void arp_xmit(struct sk_buff *skb) { + rcu_read_lock(); /* Send it off, maybe filter it using firewalling first. */ NF_HOOK(NFPROTO_ARP, NF_ARP_OUT, - dev_net(skb->dev), NULL, skb, NULL, skb->dev, + dev_net_rcu(skb->dev), NULL, skb, NULL, skb->dev, arp_xmit_finish); + rcu_read_unlock(); } EXPORT_SYMBOL(arp_xmit); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 90b2f49a502fa71090d9f4fe29a2f51fe5dff76d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5W CVE: CVE-2025-21761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ovs_vport_cmd_fill_info() can be called without RTNL or RCU. Use RCU protection and dev_net_rcu() to avoid potential UAF. Fixes: 9354d4520342 ("openvswitch: reliable interface indentification in port dumps") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-6-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/openvswitch/datapath.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index 9143d4ee1c33..2dac3aaa8520 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c @@ -1873,6 +1873,7 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, { struct ovs_header *ovs_header; struct ovs_vport_stats vport_stats; + struct net *net_vport; int err; ovs_header = genlmsg_put(skb, portid, seq, &dp_vport_genl_family, @@ -1889,12 +1890,15 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, nla_put_u32(skb, OVS_VPORT_ATTR_IFINDEX, vport->dev->ifindex)) goto nla_put_failure; - if (!net_eq(net, dev_net(vport->dev))) { - int id = peernet2id_alloc(net, dev_net(vport->dev), gfp); + rcu_read_lock(); + net_vport = dev_net_rcu(vport->dev); + if (!net_eq(net, net_vport)) { + int id = peernet2id_alloc(net, net_vport, GFP_ATOMIC); if (nla_put_s32(skb, OVS_VPORT_ATTR_NETNSID, id)) - goto nla_put_failure; + goto nla_put_failure_unlock; } + rcu_read_unlock(); ovs_vport_get_stats(vport, &vport_stats); if (nla_put_64bit(skb, OVS_VPORT_ATTR_STATS, @@ -1912,6 +1916,8 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, genlmsg_end(skb, ovs_header); return 0; +nla_put_failure_unlock: + rcu_read_unlock(); nla_put_failure: err = -EMSGSIZE; error: -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] net: Fix CVE-2025-21763
by Dong Chenchen 30 Apr '25

30 Apr '25

Fix CVE-2025-21763 Eric Dumazet (1): neighbour: use RCU protection in __neigh_notify() Li Zetao (1): neighbour: delete redundant judgment statements net/core/neighbour.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] mm: zswap: handle incorrect attempts to load large folios
by Tong Tiangen 30 Apr '25

30 Apr '25

From: Yosry Ahmed <yosryahmed(a)google.com> mainline inclusion from mainline-v6.11-rc1 commit c63f210d4891f5b1b1057a0d7c91d2b0d15431d1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC3A3N Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Zswap does not support storing or loading large folios. Until proper support is added, attempts to load large folios from zswap are a bug. For example, if a swapin fault observes that contiguous PTEs are pointing to contiguous swap entries and tries to swap them in as a large folio, swap_read_folio() will pass in a large folio to zswap_load(), but zswap_load() will only effectively load the first page in the folio. If the first page is not in zswap, the folio will be read from disk, even though other pages may be in zswap. In both cases, this will lead to silent data corruption. Proper support needs to be added before large folio swapins and zswap can work together. Looking at callers of swap_read_folio(), it seems like they are either allocated from __read_swap_cache_async() or do_swap_page() in the SWP_SYNCHRONOUS_IO path. Both of which allocate order-0 folios, so everything is fine for now. However, there is ongoing work to add to support large folio swapins [1]. To make sure new development does not break zswap (or get broken by zswap), add minimal handling of incorrect loads of large folios to zswap. First, move the call folio_mark_uptodate() inside zswap_load(). If a large folio load is attempted, and zswap was ever enabled on the system, return 'true' without calling folio_mark_uptodate(). This will prevent the folio from being read from disk, and will emit an IO error because the folio is not uptodate (e.g. do_swap_fault() will return VM_FAULT_SIGBUS). It may not be reliable recovery in all cases, but it is better than nothing. This was tested by hacking the allocation in __read_swap_cache_async() to use order 2 and __GFP_COMP. In the future, to handle this correctly, the swapin code should: (a) Fall back to order-0 swapins if zswap was ever used on the machine, because compressed pages remain in zswap after it is disabled. (b) Add proper support to swapin large folios from zswap (fully or partially). Probably start with (a) then followup with (b). [1]https://lore.kernel.org/linux-mm/20240304081348.197341-6-21cnbao@gmail.co… Link: https://lkml.kernel.org/r/20240611024516.1375191-3-yosryahmed@google.com Signed-off-by: Yosry Ahmed <yosryahmed(a)google.com> Acked-by: Barry Song <baohua(a)kernel.org> Cc: Barry Song <baohua(a)kernel.org> Cc: Chengming Zhou <chengming.zhou(a)linux.dev> Cc: Chris Li <chrisl(a)kernel.org> Cc: David Hildenbrand <david(a)redhat.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Nhat Pham <nphamcs(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/zswap.c mm/page_io.c [context conflict because of a large number of zswap patchs are not merged, mainly include: 1. 5b297f70bb2 "mm: zswap: inline and remove zswap_entry_find_get()", 2. 796c2c23e14e "zswap: replace RB tree with xarray", 3. 66447fd036a5 "mm/zswap: cleanup zswap_load()"] Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- mm/page_io.c | 1 - mm/zswap.c | 14 ++++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/mm/page_io.c b/mm/page_io.c index 839a3b0a90f0..63817e97b472 100644 --- a/mm/page_io.c +++ b/mm/page_io.c @@ -521,7 +521,6 @@ void swap_read_folio(struct folio *folio, bool synchronous, delayacct_swapin_start(); if (zswap_load(folio)) { - folio_mark_uptodate(folio); folio_unlock(folio); } else if (data_race(sis->flags & SWP_FS_OPS)) { swap_read_folio_fs(folio, plug); diff --git a/mm/zswap.c b/mm/zswap.c index 491487925192..dcf44712f0bf 100644 --- a/mm/zswap.c +++ b/mm/zswap.c @@ -1419,6 +1419,17 @@ bool zswap_load(struct folio *folio) if (zswap_never_enabled()) return false; + /* + * Large folios should not be swapped in while zswap is being used, as + * they are not properly handled. Zswap does not properly load large + * folios, and a large folio may only be partially in zswap. + * + * Return true without marking the folio uptodate so that an IO error is + * emitted (e.g. do_swap_page() will sigbus). + */ + if (WARN_ON_ONCE(folio_test_large(folio))) + return true; + /* find */ spin_lock(&tree->lock); entry = zswap_entry_find_get(&tree->rbroot, offset); @@ -1488,6 +1499,9 @@ bool zswap_load(struct folio *folio) zswap_entry_put(tree, entry); spin_unlock(&tree->lock); + if (ret == true) + folio_mark_uptodate(folio); + return ret; } -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS] qede: confirm skb is allocated before using
by Zhang Zekun 30 Apr '25

30 Apr '25

From: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> stable inclusion from stable-v4.19.238 commit 9648adb1b3ece55c657d3a4f52bfee663b710dfe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP4XO CVE: CVE-2022-49084 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------- [ Upstream commit 4e910dbe36508654a896d5735b318c0b88172570 ] qede_build_skb() assumes build_skb() always works and goes straight to skb_reserve(). However, build_skb() can fail under memory pressure. This results in a kernel panic because the skb to reserve is NULL. Add a check in case build_skb() failed to allocate and return NULL. The NULL return is handled correctly in callers to qede_build_skb(). Fixes: 8a8633978b842 ("qede: Add build_skb() support.") Signed-off-by: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/net/ethernet/qlogic/qede/qede_fp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c index a96da16f3404..09ca436e7d49 100644 --- a/drivers/net/ethernet/qlogic/qede/qede_fp.c +++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c @@ -731,6 +731,9 @@ qede_build_skb(struct qede_rx_queue *rxq, buf = page_address(bd->data) + bd->page_offset; skb = build_skb(buf, rxq->rx_buf_seg_size); + if (unlikely(!skb)) + return NULL; + skb_reserve(skb, pad); skb_put(skb, len); -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] mpage: fix softlockup in mpage_readahead()
by Zheng Qixing 30 Apr '25

30 Apr '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBYXQD --------------------------- When using null_blk with a large readahead window, calling madvise to trigger readahead can lead to system softlocks. This occurs because the CPU can remain in the mpage_readpages loop for extended periods without rescheduling, preventing other processes from running. Add a cond_resched() call at the beginning of each loop iteration to allow the CPU to schedule other tasks when necessary, avoiding potential softlocks during heavy readahead operations. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- fs/mpage.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/mpage.c b/fs/mpage.c index fb2ff971c66b..d67a2bae0b87 100644 --- a/fs/mpage.c +++ b/fs/mpage.c @@ -394,6 +394,7 @@ mpage_readpages(struct address_space *mapping, struct list_head *pages, for (page_idx = 0; page_idx < nr_pages; page_idx++) { struct page *page = lru_to_page(pages); + cond_resched(); prefetchw(&page->flags); list_del(&page->lru); if (!add_to_page_cache_lru(page, mapping, -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] md/raid1,raid10: don't ignore IO flags
by Zheng Qixing 30 Apr '25

30 Apr '25

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit e879a0d9cb086c8e52ce6c04e5bfa63825a6213c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QST CVE: CVE-2025-22125 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to flag REQ_IDLE is ignored. And turns out this behaviour exist since blk-wbt is introduced. Other than REQ_IDLE, other flags should not be ignored as well, for example REQ_META can be set for filesystems, clearing it can cause priority reverse problems; And REQ_NOWAIT should not be cleared as well, because io will wait instead of failing directly in underlying disks. Fix those problems by keep IO flags from master bio. Fises: f51d46d0e7cb ("md: add support for REQ_NOWAIT") Fixes: e34cbd307477 ("blk-wbt: add general throttling mechanism") Fixes: 5404bc7a87b9 ("[PATCH] Allow file systems to differentiate between data and meta reads") Link: https://lore.kernel.org/linux-raid/20250227121657.832356-1-yukuai1@huaweicl… Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Conflicts: drivers/md/raid1.c drivers/md/raid10.c [Due to not merging commit 3c5e514db58f ("md/raid1: Use the new blk_opf_t type"), commit cb1802ff82e1 ("md/raid10: Use the new blk_opf_t type"), commit c34b7ac65087 ("block: remove bio_set_op_attrs") and commit f2a38abf5f1c ("md/raid1: Atomic write support").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 4 ---- drivers/md/raid10.c | 7 ------- 2 files changed, 11 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 6ad47783e974..0275dcb18692 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1199,8 +1199,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, struct raid1_info *mirror; struct bio *read_bio; struct bitmap *bitmap = mddev->bitmap; - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); int max_sectors; int rdisk; bool print_msg = !!r1_bio; @@ -1293,7 +1291,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, mirror->rdev->data_offset; bio_set_dev(read_bio, mirror->rdev->bdev); read_bio->bi_end_io = raid1_end_read_request; - bio_set_op_attrs(read_bio, op, do_sync); if (test_bit(FailFast, &mirror->rdev->flags) && test_bit(R1BIO_FailFast, &r1_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1519,7 +1516,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, conf->mirrors[i].rdev->data_offset); bio_set_dev(mbio, conf->mirrors[i].rdev->bdev); mbio->bi_end_io = raid1_end_write_request; - mbio->bi_opf = bio_op(bio) | (bio->bi_opf & (REQ_SYNC | REQ_FUA)); if (test_bit(FailFast, &conf->mirrors[i].rdev->flags) && !test_bit(WriteMostly, &conf->mirrors[i].rdev->flags) && conf->raid_disks - mddev->degraded > 1) diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index f8fea9593955..07d58e88eb7b 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1166,8 +1166,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, { struct r10conf *conf = mddev->private; struct bio *read_bio; - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); int max_sectors; sector_t sectors; struct md_rdev *rdev; @@ -1264,7 +1262,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, choose_data_offset(r10_bio, rdev); bio_set_dev(read_bio, rdev->bdev); read_bio->bi_end_io = raid10_end_read_request; - bio_set_op_attrs(read_bio, op, do_sync); if (test_bit(FailFast, &rdev->flags) && test_bit(R10BIO_FailFast, &r10_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1282,9 +1279,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, struct bio *bio, bool replacement, int n_copy) { - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); - const unsigned long do_fua = (bio->bi_opf & REQ_FUA); unsigned long flags; struct blk_plug_cb *cb; struct raid10_plug_cb *plug = NULL; @@ -1313,7 +1307,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, choose_data_offset(r10_bio, rdev)); bio_set_dev(mbio, rdev->bdev); mbio->bi_end_io = raid10_end_write_request; - bio_set_op_attrs(mbio, op, do_sync | do_fua); if (!replacement && test_bit(FailFast, &conf->mirrors[devnum].rdev->flags) && enough(conf, devnum)) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] md/raid1,raid10: don't ignore IO flags
by Zheng Qixing 30 Apr '25

30 Apr '25

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit e879a0d9cb086c8e52ce6c04e5bfa63825a6213c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QST CVE: CVE-2025-22125 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to flag REQ_IDLE is ignored. And turns out this behaviour exist since blk-wbt is introduced. Other than REQ_IDLE, other flags should not be ignored as well, for example REQ_META can be set for filesystems, clearing it can cause priority reverse problems; And REQ_NOWAIT should not be cleared as well, because io will wait instead of failing directly in underlying disks. Fix those problems by keep IO flags from master bio. Fises: f51d46d0e7cb ("md: add support for REQ_NOWAIT") Fixes: e34cbd307477 ("blk-wbt: add general throttling mechanism") Fixes: 5404bc7a87b9 ("[PATCH] Allow file systems to differentiate between data and meta reads") Link: https://lore.kernel.org/linux-raid/20250227121657.832356-1-yukuai1@huaweicl… Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Conflicts: drivers/md/raid1.c drivers/md/raid10.c [Due to not merging commit 3c5e514db58f ("md/raid1: Use the new blk_opf_t type"), commit cb1802ff82e1 ("md/raid10: Use the new blk_opf_t type"), commit c34b7ac65087 ("block: remove bio_set_op_attrs") and commit f2a38abf5f1c ("md/raid1: Atomic write support").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 4 ---- drivers/md/raid10.c | 7 ------- 2 files changed, 11 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 6ad47783e974..0275dcb18692 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1199,8 +1199,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, struct raid1_info *mirror; struct bio *read_bio; struct bitmap *bitmap = mddev->bitmap; - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); int max_sectors; int rdisk; bool print_msg = !!r1_bio; @@ -1293,7 +1291,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, mirror->rdev->data_offset; bio_set_dev(read_bio, mirror->rdev->bdev); read_bio->bi_end_io = raid1_end_read_request; - bio_set_op_attrs(read_bio, op, do_sync); if (test_bit(FailFast, &mirror->rdev->flags) && test_bit(R1BIO_FailFast, &r1_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1519,7 +1516,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, conf->mirrors[i].rdev->data_offset); bio_set_dev(mbio, conf->mirrors[i].rdev->bdev); mbio->bi_end_io = raid1_end_write_request; - mbio->bi_opf = bio_op(bio) | (bio->bi_opf & (REQ_SYNC | REQ_FUA)); if (test_bit(FailFast, &conf->mirrors[i].rdev->flags) && !test_bit(WriteMostly, &conf->mirrors[i].rdev->flags) && conf->raid_disks - mddev->degraded > 1) diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index f8fea9593955..07d58e88eb7b 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1166,8 +1166,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, { struct r10conf *conf = mddev->private; struct bio *read_bio; - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); int max_sectors; sector_t sectors; struct md_rdev *rdev; @@ -1264,7 +1262,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, choose_data_offset(r10_bio, rdev); bio_set_dev(read_bio, rdev->bdev); read_bio->bi_end_io = raid10_end_read_request; - bio_set_op_attrs(read_bio, op, do_sync); if (test_bit(FailFast, &rdev->flags) && test_bit(R10BIO_FailFast, &r10_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1282,9 +1279,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, struct bio *bio, bool replacement, int n_copy) { - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); - const unsigned long do_fua = (bio->bi_opf & REQ_FUA); unsigned long flags; struct blk_plug_cb *cb; struct raid10_plug_cb *plug = NULL; @@ -1313,7 +1307,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, choose_data_offset(r10_bio, rdev)); bio_set_dev(mbio, rdev->bdev); mbio->bi_end_io = raid10_end_write_request; - bio_set_op_attrs(mbio, op, do_sync | do_fua); if (!replacement && test_bit(FailFast, &conf->mirrors[devnum].rdev->flags) && enough(conf, devnum)) -- 2.39.2

2 1

[PATCH OLK-6.6] md/raid1,raid10: don't ignore IO flags
by Zheng Qixing 30 Apr '25

30 Apr '25

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit e879a0d9cb086c8e52ce6c04e5bfa63825a6213c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QST CVE: CVE-2025-22125 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to flag REQ_IDLE is ignored. And turns out this behaviour exist since blk-wbt is introduced. Other than REQ_IDLE, other flags should not be ignored as well, for example REQ_META can be set for filesystems, clearing it can cause priority reverse problems; And REQ_NOWAIT should not be cleared as well, because io will wait instead of failing directly in underlying disks. Fix those problems by keep IO flags from master bio. Fises: f51d46d0e7cb ("md: add support for REQ_NOWAIT") Fixes: e34cbd307477 ("blk-wbt: add general throttling mechanism") Fixes: 5404bc7a87b9 ("[PATCH] Allow file systems to differentiate between data and meta reads") Link: https://lore.kernel.org/linux-raid/20250227121657.832356-1-yukuai1@huaweicl… Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Conflicts: drivers/md/raid1.c [Due to not merging f2a38abf5f1c ("md/raid1: Atomic write support").] drivers/md/raid10.c [Due to not merging a1d9b4fd42d9 ("md/raid10: Atomic write support").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 4 ---- drivers/md/raid10.c | 7 ------- 2 files changed, 11 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 1be011a700f8..4b7e68276d6c 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1212,8 +1212,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, struct raid1_info *mirror; struct bio *read_bio; struct bitmap *bitmap = mddev->bitmap; - const enum req_op op = bio_op(bio); - const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; int max_sectors; int rdisk; bool r1bio_existed = !!r1_bio; @@ -1311,7 +1309,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, read_bio->bi_iter.bi_sector = r1_bio->sector + mirror->rdev->data_offset; read_bio->bi_end_io = raid1_end_read_request; - read_bio->bi_opf = op | do_sync; if (test_bit(FailFast, &mirror->rdev->flags) && test_bit(R1BIO_FailFast, &r1_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1532,7 +1529,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, mbio->bi_iter.bi_sector = (r1_bio->sector + rdev->data_offset); mbio->bi_end_io = raid1_end_write_request; - mbio->bi_opf = bio_op(bio) | (bio->bi_opf & (REQ_SYNC | REQ_FUA)); if (test_bit(FailFast, &rdev->flags) && !test_bit(WriteMostly, &rdev->flags) && conf->raid_disks - mddev->degraded > 1) diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 5d197d747697..1f7fa6f8f84e 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1161,8 +1161,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, { struct r10conf *conf = mddev->private; struct bio *read_bio; - const enum req_op op = bio_op(bio); - const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; int max_sectors; struct md_rdev *rdev; char b[BDEVNAME_SIZE]; @@ -1238,7 +1236,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, read_bio->bi_iter.bi_sector = r10_bio->devs[slot].addr + choose_data_offset(r10_bio, rdev); read_bio->bi_end_io = raid10_end_read_request; - read_bio->bi_opf = op | do_sync; if (test_bit(FailFast, &rdev->flags) && test_bit(R10BIO_FailFast, &r10_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1255,9 +1252,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, struct bio *bio, bool replacement, int n_copy) { - const enum req_op op = bio_op(bio); - const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; - const blk_opf_t do_fua = bio->bi_opf & REQ_FUA; unsigned long flags; struct r10conf *conf = mddev->private; struct md_rdev *rdev; @@ -1276,7 +1270,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, mbio->bi_iter.bi_sector = (r10_bio->devs[n_copy].addr + choose_data_offset(r10_bio, rdev)); mbio->bi_end_io = raid10_end_write_request; - mbio->bi_opf = op | do_sync | do_fua; if (!replacement && test_bit(FailFast, &conf->mirrors[devnum].rdev->flags) && enough(conf, devnum)) -- 2.39.2

2 1

[PATCH OLK-6.6] scsi: qla1280: Fix kernel oops when debug level > 2
by Zheng Qixing 30 Apr '25

30 Apr '25

From: Magnus Lindholm <linmag7(a)gmail.com> stable inclusion from stable-v6.6.84 commit ea371d1cdefb0951c7127a33bcd7eb931cf44571 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY434 CVE: CVE-2025-21957 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5233e3235dec3065ccc632729675575dbe3c6b8a ] A null dereference or oops exception will eventually occur when qla1280.c driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level > 2. I think its clear from the code that the intention here is sg_dma_len(s) not length of sg_next(s) when printing the debug info. Signed-off-by: Magnus Lindholm <linmag7(a)gmail.com> Link: https://lore.kernel.org/r/20250125095033.26188-1-linmag7@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/qla1280.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c index 6e5e89aaa283..74b23c43af3e 100644 --- a/drivers/scsi/qla1280.c +++ b/drivers/scsi/qla1280.c @@ -2866,7 +2866,7 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp) dprintk(3, "S/G Segment phys_addr=%x %x, len=0x%x\n", cpu_to_le32(upper_32_bits(dma_handle)), cpu_to_le32(lower_32_bits(dma_handle)), - cpu_to_le32(sg_dma_len(sg_next(s)))); + cpu_to_le32(sg_dma_len(s))); remseg--; } dprintk(5, "qla1280_64bit_start_scsi: Scatter/gather " -- 2.39.2

2 1

[openeuler:OLK-6.6 2175/2175] include/linux/sched/signal.h: linux/kabi.h is included more than once.
by kernel test robot 30 Apr '25

30 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: dfd1abba9b4387cb2e9e79e3d6097c2ba507ce32 commit: b53643e68c841ccb6f05f90601ea30b1afeb0a2b [2175/2175] !3695 x86: Add x86 related kabi reservations compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504300733.mAi3Indd-lkp@intel.com/ includecheck warnings: (new ones prefixed by >>) >> include/linux/sched/signal.h: linux/kabi.h is included more than once. vim +15 include/linux/sched/signal.h 4 5 #include <linux/rculist.h> 6 #include <linux/signal.h> 7 #include <linux/sched.h> 8 #include <linux/sched/jobctl.h> 9 #include <linux/sched/task.h> 10 #include <linux/cred.h> 11 #include <linux/refcount.h> 12 #include <linux/posix-timers.h> 13 #include <linux/mm_types.h> 14 #include <asm/ptrace.h> > 15 #include <linux/kabi.h> 16 > 17 #include <linux/kabi.h> 18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2175/2175] drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debug.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
by kernel test robot 30 Apr '25

30 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: dfd1abba9b4387cb2e9e79e3d6097c2ba507ce32 commit: 0ba0ebb029b99864fa5963024535f48299373354 [2175/2175] !15589 [OLK-6.6] Ethernet: Supports Linkdata ethernet Controllers config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250430/202504300433.T31occlR-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250430/202504300433.T31occlR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504300433.T31occlR-lkp@intel.com/ All error/warnings (new ones prefixed by >>): | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:6: error: no previous prototype for function 'sxe_hw_uc_addr_pool_del' [-Werror,-Wmissing-prototypes] 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:5: error: no previous prototype for function 'sxe_hw_uc_addr_pool_enable' [-Werror,-Wmissing-prototypes] 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:5: error: no previous prototype for function 'sxe_hw_nic_reset' [-Werror,-Wmissing-prototypes] 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:6: error: no previous prototype for function 'sxe_hw_pf_rst_done_set' [-Werror,-Wmissing-prototypes] 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:5: error: no previous prototype for function 'sxe_hw_pending_irq_read_clear' [-Werror,-Wmissing-prototypes] 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:6: error: no previous prototype for function 'sxe_hw_pending_irq_write_clear' [-Werror,-Wmissing-prototypes] 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:5: error: no previous prototype for function 'sxe_hw_irq_cause_get' [-Werror,-Wmissing-prototypes] 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:6: error: no previous prototype for function 'sxe_hw_ring_irq_auto_disable' [-Werror,-Wmissing-prototypes] 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:6: error: no previous prototype for function 'sxe_hw_irq_general_reg_set' [-Werror,-Wmissing-prototypes] 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:5: error: no previous prototype for function 'sxe_hw_irq_general_reg_get' [-Werror,-Wmissing-prototypes] 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:6: error: no previous prototype for function 'sxe_hw_event_irq_map' [-Werror,-Wmissing-prototypes] 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:6: error: no previous prototype for function 'sxe_hw_ring_irq_map' [-Werror,-Wmissing-prototypes] 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:6: error: no previous prototype for function 'sxe_hw_ring_irq_interval_set' [-Werror,-Wmissing-prototypes] 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:838:6: error: no previous prototype for function 'sxe_hw_event_irq_auto_clear_set' [-Werror,-Wmissing-prototypes] 838 | void sxe_hw_event_irq_auto_clear_set(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:838:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 838 | void sxe_hw_event_irq_auto_clear_set(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:843:6: error: no previous prototype for function 'sxe_hw_specific_irq_disable' [-Werror,-Wmissing-prototypes] 843 | void sxe_hw_specific_irq_disable(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:843:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 843 | void sxe_hw_specific_irq_disable(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:848:6: error: no previous prototype for function 'sxe_hw_specific_irq_enable' [-Werror,-Wmissing-prototypes] 848 | void sxe_hw_specific_irq_enable(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:848:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 848 | void sxe_hw_specific_irq_enable(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:876:6: error: no previous prototype for function 'sxe_hw_all_irq_disable' [-Werror,-Wmissing-prototypes] 876 | void sxe_hw_all_irq_disable(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:876:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 876 | void sxe_hw_all_irq_disable(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:994:5: error: no previous prototype for function 'sxe_hw_link_speed_get' [-Werror,-Wmissing-prototypes] 994 | u32 sxe_hw_link_speed_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:994:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 994 | u32 sxe_hw_link_speed_get(struct sxe_hw *hw) | ^ | static fatal error: too many errors emitted, stopping now [-ferror-limit=] 20 errors generated. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debug.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_host_cli.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_pci.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_host_hdc.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb_nl.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_monitor.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_filter.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. .. vim +3 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debug.c dd013ad487534c liujie_answer 2025-04-15 @3 * Copyright (C), 2020, Linkdata Technologies Co., Ltd. dd013ad487534c liujie_answer 2025-04-15 4 * dd013ad487534c liujie_answer 2025-04-15 5 * @file: sxe_debug.c dd013ad487534c liujie_answer 2025-04-15 6 * @author: Linkdata dd013ad487534c liujie_answer 2025-04-15 7 * @date: 2025.02.16 dd013ad487534c liujie_answer 2025-04-15 8 * @brief: dd013ad487534c liujie_answer 2025-04-15 9 * @note: dd013ad487534c liujie_answer 2025-04-15 10 */ dd013ad487534c liujie_answer 2025-04-15 11 :::::: The code at line 3 was first introduced by commit :::::: dd013ad487534c1838afc2f55efdb5daec15aace Ethernet: Linkdata: Supports Linkdata ethernet Controllers :::::: TO: liujie_answer <liujie5(a)linkdatatechnology.com> :::::: CC: liujie_answer <liujie5(a)linkdatatechnology.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1597/1597] include/linux/thread_info.h:59:17: warning: 'b' may be used uninitialized
by kernel test robot 30 Apr '25

30 Apr '25

Hi Yu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a48a35466505c8a52da57596944bd0b4485e825f commit: b9f356e64a7eda411ba8b63df9d4c5e204f16025 [1597/1597] block-io-hierarchy: core hierarchy iodump implementation config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250430/202504300437.9dd9ulNF-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250430/202504300437.9dd9ulNF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504300437.9dd9ulNF-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from include/asm-generic/preempt.h:5, from ./arch/arm64/include/generated/asm/preempt.h:1, from include/linux/preempt.h:81, from include/linux/spinlock.h:51, from include/linux/wait.h:9, from include/linux/wait_bit.h:8, from include/linux/fs.h:7, from include/linux/seq_file.h:11, from block/blk-io-hierarchy/iodump.c:14: In function 'check_object_size', inlined from 'check_copy_size' at include/linux/thread_info.h:90:2, inlined from 'copy_from_user' at include/linux/uaccess.h:143:6, inlined from 'threshold_store' at block/blk-io-hierarchy/iodump.c:240:6: >> include/linux/thread_info.h:59:17: warning: 'b' may be used uninitialized [-Wmaybe-uninitialized] 59 | __check_object_size(ptr, n, to_user); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/thread_info.h: In function 'threshold_store': include/linux/thread_info.h:52:13: note: by argument 1 of type 'const void *' to '__check_object_size' declared here 52 | extern void __check_object_size(const void *ptr, unsigned long n, | ^~~~~~~~~~~~~~~~~~~ block/blk-io-hierarchy/iodump.c:234:14: note: 'b' declared here 234 | char b[MAX_BUF_LEN + 1]; | ^ vim +/b +59 include/linux/thread_info.h 0f60a8efe4005a Kees Cook 2016-07-12 50 f5509cc18daa7f Kees Cook 2016-06-07 51 #ifdef CONFIG_HARDENED_USERCOPY f5509cc18daa7f Kees Cook 2016-06-07 52 extern void __check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f Kees Cook 2016-06-07 53 bool to_user); f5509cc18daa7f Kees Cook 2016-06-07 54 a85d6b8242dc78 Kees Cook 2016-09-07 55 static __always_inline void check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f Kees Cook 2016-06-07 56 bool to_user) f5509cc18daa7f Kees Cook 2016-06-07 57 { 81409e9e280588 Kees Cook 2016-08-31 58 if (!__builtin_constant_p(n)) f5509cc18daa7f Kees Cook 2016-06-07 @59 __check_object_size(ptr, n, to_user); f5509cc18daa7f Kees Cook 2016-06-07 60 } f5509cc18daa7f Kees Cook 2016-06-07 61 #else f5509cc18daa7f Kees Cook 2016-06-07 62 static inline void check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f Kees Cook 2016-06-07 63 bool to_user) f5509cc18daa7f Kees Cook 2016-06-07 64 { } f5509cc18daa7f Kees Cook 2016-06-07 65 #endif /* CONFIG_HARDENED_USERCOPY */ f5509cc18daa7f Kees Cook 2016-06-07 66 :::::: The code at line 59 was first introduced by commit :::::: f5509cc18daa7f82bcc553be70df2117c8eedc16 mm: Hardened usercopy :::::: TO: Kees Cook <keescook(a)chromium.org> :::::: CC: Kees Cook <keescook(a)chromium.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1597/1597] include/asm-generic/bitops/non-atomic.h:106:27: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'u32[1]' {aka 'unsigned int[1]'}
by kernel test robot 30 Apr '25

30 Apr '25

Hi Steven, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a48a35466505c8a52da57596944bd0b4485e825f commit: a6a7981cbf66d4951425d33cdce6ef39206eba83 [1597/1597] Net: ethernet: Support 3snic 3s9xx network card config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250430/202504300130.TAvuRGbz-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250430/202504300130.TAvuRGbz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504300130.TAvuRGbz-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:492:5: warning: no previous prototype for 'sss_nic_get_io_stats_size' [-Wmissing-prototypes] 492 | u32 sss_nic_get_io_stats_size(const struct sss_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~ In file included from arch/arm64/include/asm/bitops.h:39, from include/linux/bitops.h:20, from include/linux/kernel.h:11, from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:6: In function 'test_bit', inlined from 'sss_nic_add_ethtool_link_mode' at drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:764:7: >> include/asm-generic/bitops/non-atomic.h:106:27: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'u32[1]' {aka 'unsigned int[1]'} [-Warray-bounds=] 106 | return 1UL & (addr[BIT_WORD(nr)] >> (nr & (BITS_PER_LONG-1))); | ~~~~^~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c: In function 'sss_nic_add_ethtool_link_mode': drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:759:40: note: object 'hw_mode' of size 4 759 | u32 hw_mode, u32 op) | ~~~~^~~~~~~ vim +106 include/asm-generic/bitops/non-atomic.h 4117b02132d1cf Akinobu Mita 2006-03-26 98 4117b02132d1cf Akinobu Mita 2006-03-26 99 /** 4117b02132d1cf Akinobu Mita 2006-03-26 100 * test_bit - Determine whether a bit is set 4117b02132d1cf Akinobu Mita 2006-03-26 101 * @nr: bit number to test 4117b02132d1cf Akinobu Mita 2006-03-26 102 * @addr: Address to start counting from 4117b02132d1cf Akinobu Mita 2006-03-26 103 */ 4117b02132d1cf Akinobu Mita 2006-03-26 104 static inline int test_bit(int nr, const volatile unsigned long *addr) 4117b02132d1cf Akinobu Mita 2006-03-26 105 { d05be13bcc6ec6 Jiri Slaby 2007-10-18 @106 return 1UL & (addr[BIT_WORD(nr)] >> (nr & (BITS_PER_LONG-1))); 4117b02132d1cf Akinobu Mita 2006-03-26 107 } 4117b02132d1cf Akinobu Mita 2006-03-26 108 :::::: The code at line 106 was first introduced by commit :::::: d05be13bcc6ec615fb2e9556a9b85d52800669b6 define first set of BIT* macros :::::: TO: Jiri Slaby <jirislaby(a)gmail.com> :::::: CC: Linus Torvalds <torvalds(a)woody.linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2880/2880] include/linux/blk_types.h: linux/kabi.h is included more than once.
by kernel test robot 30 Apr '25

30 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b7710e01aad5e90a681267c840f4815b024b98c6 commit: dde4fe567523327d09054824030fb2d22e5009c7 [2880/2880] kabi: Add kabi reservation for storage module compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504300111.nH5Pw0yV-lkp@intel.com/ includecheck warnings: (new ones prefixed by >>) >> include/linux/blk_types.h: linux/kabi.h is included more than once. -- >> include/linux/mm.h: linux/kabi.h is included more than once. -- >> include/linux/ioport.h: linux/kabi.h is included more than once. -- >> include/linux/device.h: linux/kabi.h is included more than once. -- >> include/linux/device/class.h: linux/kabi.h is included more than once. -- >> include/linux/cred.h: linux/kabi.h is included more than once. -- >> include/linux/swap.h: linux/kabi.h is included more than once. vim +9 include/linux/blk_types.h 8 > 9 #include <linux/kabi.h> 10 #include <linux/types.h> 11 #include <linux/bvec.h> 12 #include <linux/ktime.h> > 13 #include <linux/kabi.h> 14 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2881/2881] kismet: WARNING: unmet direct dependencies detected for PTP_1588_CLOCK when selected by SXE_VF
by kernel test robot 30 Apr '25

30 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b7710e01aad5e90a681267c840f4815b024b98c6 commit: 8cee206b5558245197158bd20895f95cc28d8468 [2881/2881] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-kismet-CONFIG_PTP_1588_CLOCK-CONFIG_SXE_VF-0-0 (https://download.01.org/0day-ci/archive/20250430/202504300151.RfBZyPgj-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20250430/202504300151.RfBZyPgj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504300151.RfBZyPgj-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for PTP_1588_CLOCK when selected by SXE_VF WARNING: unmet direct dependencies detected for PTP_1588_CLOCK Depends on [n]: NET [=y] && POSIX_TIMERS [=n] Selected by [y]: - SXE [=y] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] - SXE_VF [=y] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2881/2881] kismet: WARNING: unmet direct dependencies detected for PTP_1588_CLOCK when selected by SXE
by kernel test robot 30 Apr '25

30 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b7710e01aad5e90a681267c840f4815b024b98c6 commit: 8cee206b5558245197158bd20895f95cc28d8468 [2881/2881] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-kismet-CONFIG_PTP_1588_CLOCK-CONFIG_SXE-0-0 (https://download.01.org/0day-ci/archive/20250430/202504300001.MoxWgMgI-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20250430/202504300001.MoxWgMgI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504300001.MoxWgMgI-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for PTP_1588_CLOCK when selected by SXE WARNING: unmet direct dependencies detected for PTP_1588_CLOCK Depends on [n]: NET [=y] && POSIX_TIMERS [=n] Selected by [y]: - SXE [=y] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] Selected by [m]: - SXE_VF [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/7] fs/resctrl: Create l2 cache monitors
by Zeng Heng 29 Apr '25

29 Apr '25

James Morse (2): arm64: mpam: Add cpu_pm notifier to restore MPAM sysregs arm64: mpam: Restore the expected MPAM sysregs on cpuhp Zeng Heng (5): x86/resctrl: Add a handling path of default label in get_arch_mbm_state() fs/resctrl: Create l2 cache monitors fs/resctrl: Add l2 mount option to enable L2 msc arm64/mpam: Refuse cpu offline when L2 msc is enabled arm64/mpam: Refuse to enter powerdown state after L2 msc updated arch/arm64/kernel/cpufeature.c | 6 ++ arch/arm64/kernel/mpam.c | 41 ++++++++++++++ arch/x86/include/asm/resctrl.h | 2 + arch/x86/kernel/cpu/resctrl/monitor.c | 2 + drivers/platform/mpam/mpam_devices.c | 7 ++- drivers/platform/mpam/mpam_internal.h | 2 + drivers/platform/mpam/mpam_resctrl.c | 79 +++++++++++++++++++++++++-- fs/resctrl/ctrlmondata.c | 6 ++ fs/resctrl/internal.h | 2 +- fs/resctrl/monitor.c | 14 +++++ fs/resctrl/rdtgroup.c | 33 ++++++++++- include/linux/arm_mpam.h | 2 + include/linux/resctrl.h | 5 ++ include/linux/resctrl_types.h | 10 ++++ 14 files changed, 200 insertions(+), 11 deletions(-) -- 2.25.1

2 8

[PATCH OLK-6.6] ovl: don't allow datadir only
by Wang Zhaolong 29 Apr '25

29 Apr '25

From: Miklos Szeredi <mszeredi(a)redhat.com> mainline inclusion from mainline-v6.15-rc3 commit eb3a04a8516ee9b5174379306f94279fc90424c4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4U5N CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In theory overlayfs could support upper layer directly referring to a data layer, but there's no current use case for this. Originally, when data-only layers were introduced, this wasn't allowed, only introduced by the "datadir+" feature, but without actually handling this case, resulting in an Oops. Fix by disallowing datadir without lowerdir. Reported-by: Giuseppe Scrivano <gscrivan(a)redhat.com> Fixes: 24e16e385f22 ("ovl: add support for appending lowerdirs one by one") Cc: <stable(a)vger.kernel.org> # v6.7 Reviewed-by: Amir Goldstein <amir73il(a)gmail.com> Reviewed-by: Alexander Larsson <alexl(a)redhat.com> Reviewed-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/overlayfs/super.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c index 2c056d737c27..93ee57bc82ad 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -1178,10 +1178,15 @@ static struct ovl_entry *ovl_get_lowerstack(struct super_block *sb, if (!ofs->config.upperdir && ctx->nr == 1) { pr_err("at least 2 lowerdir are needed while upperdir nonexistent\n"); return ERR_PTR(-EINVAL); } + if (ctx->nr == ctx->nr_data) { + pr_err("at least one non-data lowerdir is required\n"); + return ERR_PTR(-EINVAL); + } + err = -EINVAL; for (i = 0; i < ctx->nr; i++) { l = &ctx->lower[i]; err = ovl_lower_dir(l->name, &l->path, ofs, &sb->s_stack_depth); -- 2.34.3

2 1

[PATCH OLK-6.6] fs: Avoid grabbing sb->s_umount under bdev->bd_holder_lock
by Wang Zhaolong 29 Apr '25

29 Apr '25

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v6.7-rc1 commit fd1464105cb37a3b50a72c1d2902e97a71950af8 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4XMU CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------- The implementation of bdev holder operations such as fs_bdev_mark_dead() and fs_bdev_sync() grab sb->s_umount semaphore under bdev->bd_holder_lock. This is problematic because it leads to disk->open_mutex -> sb->s_umount lock ordering which is counterintuitive (usually we grab higher level (e.g. filesystem) locks first and lower level (e.g. block layer) locks later) and indeed makes lockdep complain about possible locking cycles whenever we open a block device while holding sb->s_umount semaphore. Implement a function bdev_super_lock_shared() which safely transitions from holding bdev->bd_holder_lock to holding sb->s_umount on alive superblock without introducing the problematic lock dependency. We use this function fs_bdev_sync() and fs_bdev_mark_dead(). Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20231018152924.3858-1-jack@suse.cz Link: https://lore.kernel.org/r/20231017184823.1383356-1-hch@lst.de Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- block/bdev.c | 5 +++-- block/ioctl.c | 5 +++-- fs/super.c | 50 ++++++++++++++++++++++++++++++++------------------ 3 files changed, 38 insertions(+), 22 deletions(-) diff --git a/block/bdev.c b/block/bdev.c index 3a4357e5aac6..e95578fd35d3 100644 --- a/block/bdev.c +++ b/block/bdev.c @@ -1138,13 +1138,14 @@ EXPORT_SYMBOL(lookup_bdev); void bdev_mark_dead(struct block_device *bdev, bool surprise) { mutex_lock(&bdev->bd_holder_lock); if (bdev->bd_holder_ops && bdev->bd_holder_ops->mark_dead) bdev->bd_holder_ops->mark_dead(bdev, surprise); - else + else { + mutex_unlock(&bdev->bd_holder_lock); sync_blockdev(bdev); - mutex_unlock(&bdev->bd_holder_lock); + } invalidate_bdev(bdev); } #ifdef CONFIG_DASD_MODULE /* diff --git a/block/ioctl.c b/block/ioctl.c index 71b1a185c226..712fac087f35 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -371,13 +371,14 @@ static int blkdev_flushbuf(struct block_device *bdev, unsigned cmd, return -EACCES; mutex_lock(&bdev->bd_holder_lock); if (bdev->bd_holder_ops && bdev->bd_holder_ops->sync) bdev->bd_holder_ops->sync(bdev); - else + else { + mutex_unlock(&bdev->bd_holder_lock); sync_blockdev(bdev); - mutex_unlock(&bdev->bd_holder_lock); + } invalidate_bdev(bdev); return 0; } diff --git a/fs/super.c b/fs/super.c index 42c9754e3add..c3da64c443dc 100644 --- a/fs/super.c +++ b/fs/super.c @@ -1428,36 +1428,51 @@ struct super_block *sget_dev(struct fs_context *fc, dev_t dev) } EXPORT_SYMBOL(sget_dev); #ifdef CONFIG_BLOCK /* - * Lock a super block that the callers holds a reference to. + * Lock the superblock that is holder of the bdev. Returns the superblock + * pointer if we successfully locked the superblock and it is alive. Otherwise + * we return NULL and just unlock bdev->bd_holder_lock. * - * The caller needs to ensure that the super_block isn't being freed while - * calling this function, e.g. by holding a lock over the call to this function - * and the place that clears the pointer to the superblock used by this function - * before freeing the superblock. + * The function must be called with bdev->bd_holder_lock and releases it. */ -static bool super_lock_shared_active(struct super_block *sb) +static struct super_block *bdev_super_lock_shared(struct block_device *bdev) + __releases(&bdev->bd_holder_lock) { - bool born = super_lock_shared(sb); + struct super_block *sb = bdev->bd_holder; + bool born; + + lockdep_assert_held(&bdev->bd_holder_lock); + lockdep_assert_not_held(&sb->s_umount); + + /* Make sure sb doesn't go away from under us */ + spin_lock(&sb_lock); + sb->s_count++; + spin_unlock(&sb_lock); + mutex_unlock(&bdev->bd_holder_lock); + born = super_lock_shared(sb); if (!born || !sb->s_root || !(sb->s_flags & SB_ACTIVE)) { super_unlock_shared(sb); - return false; + put_super(sb); + return NULL; } - return true; + /* + * The superblock is active and we hold s_umount, we can drop our + * temporary reference now. + */ + put_super(sb); + return sb; } static void fs_bdev_mark_dead(struct block_device *bdev, bool surprise) { - struct super_block *sb = bdev->bd_holder; - - /* bd_holder_lock ensures that the sb isn't freed */ - lockdep_assert_held(&bdev->bd_holder_lock); + struct super_block *sb; - if (!super_lock_shared_active(sb)) + sb = bdev_super_lock_shared(bdev); + if (!sb) return; if (!surprise) sync_filesystem(sb); shrink_dcache_sb(sb); @@ -1468,15 +1483,14 @@ static void fs_bdev_mark_dead(struct block_device *bdev, bool surprise) super_unlock_shared(sb); } static void fs_bdev_sync(struct block_device *bdev) { - struct super_block *sb = bdev->bd_holder; - - lockdep_assert_held(&bdev->bd_holder_lock); + struct super_block *sb; - if (!super_lock_shared_active(sb)) + sb = bdev_super_lock_shared(bdev); + if (!sb) return; sync_filesystem(sb); super_unlock_shared(sb); } -- 2.34.3

2 1

[PATCH OLK-6.6] fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount()
by Wang Zhaolong 29 Apr '25

29 Apr '25

From: Al Viro <viro(a)zeniv.linux.org.uk> mainline inclusion from mainline-v6.15-rc4 commit 0d039eac6e5950f9d1ecc9e410c2fd1feaeab3b6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4UG1 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Normally do_lock_mount(path, _) is locking a mountpoint pinned by *path and at the time when matching unlock_mount() unlocks that location it is still pinned by the same thing. Unfortunately, for 'beneath' case it's no longer that simple - the object being locked is not the one *path points to. It's the mountpoint of path->mnt. The thing is, without sufficient locking ->mnt_parent may change under us and none of the locks are held at that point. The rules are * mount_lock stabilizes m->mnt_parent for any mount m. * namespace_sem stabilizes m->mnt_parent, provided that m is mounted. * if either of the above holds and refcount of m is positive, we are guaranteed the same for refcount of m->mnt_parent. namespace_sem nests inside inode_lock(), so do_lock_mount() has to take inode_lock() before grabbing namespace_sem. It does recheck that path->mnt is still mounted in the same place after getting namespace_sem, and it does take care to pin the dentry. It is needed, since otherwise we might end up with racing mount --move (or umount) happening while we were getting locks; in that case dentry would no longer be a mountpoint and could've been evicted on memory pressure along with its inode - not something you want when grabbing lock on that inode. However, pinning a dentry is not enough - the matching mount is also pinned only by the fact that path->mnt is mounted on top it and at that point we are not holding any locks whatsoever, so the same kind of races could end up with all references to that mount gone just as we are about to enter inode_lock(). If that happens, we are left with filesystem being shut down while we are holding a dentry reference on it; results are not pretty. What we need to do is grab both dentry and mount at the same time; that makes inode_lock() safe *and* avoids the problem with fs getting shut down under us. After taking namespace_sem we verify that path->mnt is still mounted (which stabilizes its ->mnt_parent) and check that it's still mounted at the same place. From that point on to the matching namespace_unlock() we are guaranteed that mount/dentry pair we'd grabbed are also pinned by being the mountpoint of path->mnt, so we can quietly drop both the dentry reference (as the current code does) and mnt one - it's OK to do under namespace_sem, since we are not dropping the final refs. That solves the problem on do_lock_mount() side; unlock_mount() also has one, since dentry is guaranteed to stay pinned only until the namespace_unlock(). That's easy to fix - just have inode_unlock() done earlier, while it's still pinned by mp->m_dentry. Fixes: 6ac392815628 "fs: allow to mount beneath top mount" # v6.5+ Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/namespace.c | 69 ++++++++++++++++++++++++++------------------------ 1 file changed, 36 insertions(+), 33 deletions(-) diff --git a/fs/namespace.c b/fs/namespace.c index 190fbb026ff0..f6cb0ee8cee7 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -2426,78 +2426,81 @@ static int attach_recursive_mnt(struct mount *source_mnt, static struct mountpoint *do_lock_mount(struct path *path, bool beneath) { struct vfsmount *mnt = path->mnt; struct dentry *dentry; struct mountpoint *mp = ERR_PTR(-ENOENT); + struct path under = {}; for (;;) { - struct mount *m; + struct mount *m = real_mount(mnt); if (beneath) { - m = real_mount(mnt); + path_put(&under); read_seqlock_excl(&mount_lock); - dentry = dget(m->mnt_mountpoint); + under.mnt = mntget(&m->mnt_parent->mnt); + under.dentry = dget(m->mnt_mountpoint); read_sequnlock_excl(&mount_lock); + dentry = under.dentry; } else { dentry = path->dentry; } inode_lock(dentry->d_inode); - if (unlikely(cant_mount(dentry))) { - inode_unlock(dentry->d_inode); - goto out; - } - namespace_lock(); - if (beneath && (!is_mounted(mnt) || m->mnt_mountpoint != dentry)) { + if (unlikely(cant_mount(dentry) || !is_mounted(mnt))) + break; // not to be mounted on + + if (beneath && unlikely(m->mnt_mountpoint != dentry || + &m->mnt_parent->mnt != under.mnt)) { namespace_unlock(); inode_unlock(dentry->d_inode); - goto out; + continue; // got moved } mnt = lookup_mnt(path); - if (likely(!mnt)) + if (unlikely(mnt)) { + namespace_unlock(); + inode_unlock(dentry->d_inode); + path_put(path); + path->mnt = mnt; + path->dentry = dget(mnt->mnt_root); + continue; // got overmounted + } + mp = get_mountpoint(dentry); + if (IS_ERR(mp)) break; - - namespace_unlock(); - inode_unlock(dentry->d_inode); - if (beneath) - dput(dentry); - path_put(path); - path->mnt = mnt; - path->dentry = dget(mnt->mnt_root); - } - - mp = get_mountpoint(dentry); - if (IS_ERR(mp)) { - namespace_unlock(); - inode_unlock(dentry->d_inode); + if (beneath) { + /* + * @under duplicates the references that will stay + * at least until namespace_unlock(), so the path_put() + * below is safe (and OK to do under namespace_lock - + * we are not dropping the final references here). + */ + path_put(&under); + } + return mp; } - -out: + namespace_unlock(); + inode_unlock(dentry->d_inode); if (beneath) - dput(dentry); - + path_put(&under); return mp; } static inline struct mountpoint *lock_mount(struct path *path) { return do_lock_mount(path, false); } static void unlock_mount(struct mountpoint *where) { - struct dentry *dentry = where->m_dentry; - + inode_unlock(where->m_dentry->d_inode); read_seqlock_excl(&mount_lock); put_mountpoint(where); read_sequnlock_excl(&mount_lock); - namespace_unlock(); - inode_unlock(dentry->d_inode); } static int graft_tree(struct mount *mnt, struct mount *p, struct mountpoint *mp) { if (mnt->mnt.mnt_sb->s_flags & SB_NOUSER) -- 2.34.3

2 1

[PATCH OLK-6.6] NFS: Shut down the nfs_client only after all the superblocks
by Wang Zhaolong 29 Apr '25

29 Apr '25

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v6.15-rc1 commit 2d3e998a0bc7fe26a724f87a8ce217848040520e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC40FO CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The nfs_client manages state for all the superblocks in the "cl_superblocks" list, so it must not be shut down until all of them are gone. Fixes: 7d3e26a054c8 ("NFS: Cancel all existing RPC tasks when shutdown") Reviewed-by: Benjamin Coddington <bcodding(a)redhat.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/nfs/sysfs.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/fs/nfs/sysfs.c b/fs/nfs/sysfs.c index 7b59a40d40c0..784f7c1d003b 100644 --- a/fs/nfs/sysfs.c +++ b/fs/nfs/sysfs.c @@ -12,10 +12,11 @@ #include <linux/string.h> #include <linux/nfs_fs.h> #include <linux/rcupdate.h> #include <linux/lockd/lockd.h> +#include "internal.h" #include "nfs4_fs.h" #include "netns.h" #include "sysfs.h" static struct kset *nfs_kset; @@ -226,10 +227,29 @@ static void shutdown_client(struct rpc_clnt *clnt) { clnt->cl_shutdown = 1; rpc_cancel_tasks(clnt, -EIO, shutdown_match_client, NULL); } +/* + * Shut down the nfs_client only once all the superblocks + * have been shut down. + */ +static void shutdown_nfs_client(struct nfs_client *clp) +{ + struct nfs_server *server; + rcu_read_lock(); + list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) { + if (!(server->flags & NFS_MOUNT_SHUTDOWN)) { + rcu_read_unlock(); + return; + } + } + rcu_read_unlock(); + nfs_mark_client_ready(clp, -EIO); + shutdown_client(clp->cl_rpcclient); +} + static ssize_t shutdown_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) { struct nfs_server *server = container_of(kobj, struct nfs_server, kobj); @@ -257,18 +277,18 @@ shutdown_store(struct kobject *kobj, struct kobj_attribute *attr, if (server->flags & NFS_MOUNT_SHUTDOWN) goto out; server->flags |= NFS_MOUNT_SHUTDOWN; shutdown_client(server->client); - shutdown_client(server->nfs_client->cl_rpcclient); if (!IS_ERR(server->client_acl)) shutdown_client(server->client_acl); if (server->nlm_host) shutdown_client(server->nlm_host->h_rpcclnt); out: + shutdown_nfs_client(server->nfs_client); return count; } static struct kobj_attribute nfs_sysfs_attr_shutdown = __ATTR_RW(shutdown); -- 2.34.3

2 1

[PATCH OLK-6.6] ksmbd: fix session use-after-free in multichannel connection
by Wang Zhaolong 29 Apr '25

29 Apr '25

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.15-rc1 commit fa4cdb8cbca7d6cb6aa13e4d8d83d1103f6345db category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QSM CVE: CVE-2025-22040 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There is a race condition between session setup and ksmbd_sessions_deregister. The session can be freed before the connection is added to channel list of session. This patch check reference count of session before freeing it. Cc: stable(a)vger.kernel.org Reported-by: Sean Heelan <seanheelan(a)gmail.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/smb/server/auth.c | 4 ++-- fs/smb/server/mgmt/user_session.c | 14 ++++++++------ fs/smb/server/smb2pdu.c | 7 ++++--- 3 files changed, 14 insertions(+), 11 deletions(-) diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c index 58380a986af5..6af666749b8f 100644 --- a/fs/smb/server/auth.c +++ b/fs/smb/server/auth.c @@ -1010,13 +1010,13 @@ static int ksmbd_get_encryption_key(struct ksmbd_work *work, __u64 ses_id, if (!sess) return -EINVAL; ses_enc_key = enc ? sess->smb3encryptionkey : sess->smb3decryptionkey; - if (enc) - ksmbd_user_session_get(sess); memcpy(key, ses_enc_key, SMB3_ENC_DEC_KEY_SIZE); + if (!enc) + ksmbd_user_session_put(sess); return 0; } static inline void smb2_sg_set_buf(struct scatterlist *sg, const void *buf, diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c index e1aabe889c61..50239175e7b4 100644 --- a/fs/smb/server/mgmt/user_session.c +++ b/fs/smb/server/mgmt/user_session.c @@ -178,11 +178,11 @@ static void ksmbd_expire_session(struct ksmbd_conn *conn) struct ksmbd_session *sess; down_write(&sessions_table_lock); down_write(&conn->session_lock); xa_for_each(&conn->sessions, id, sess) { - if (atomic_read(&sess->refcnt) == 0 && + if (atomic_read(&sess->refcnt) <= 1 && (sess->state != SMB2_SESSION_VALID || time_after(jiffies, sess->last_active + SMB2_SESSION_TIMEOUT))) { xa_erase(&conn->sessions, sess->id); hash_del(&sess->hlist); @@ -230,11 +230,12 @@ void ksmbd_sessions_deregister(struct ksmbd_conn *conn) xa_empty(&sess->ksmbd_chann_list)) { hash_del(&sess->hlist); down_write(&conn->session_lock); xa_erase(&conn->sessions, sess->id); up_write(&conn->session_lock); - ksmbd_session_destroy(sess); + if (atomic_dec_and_test(&sess->refcnt)) + ksmbd_session_destroy(sess); } } } down_write(&conn->session_lock); @@ -249,11 +250,12 @@ void ksmbd_sessions_deregister(struct ksmbd_conn *conn) ksmbd_chann_del(conn, sess); if (xa_empty(&sess->ksmbd_chann_list)) { xa_erase(&conn->sessions, sess->id); hash_del(&sess->hlist); - ksmbd_session_destroy(sess); + if (atomic_dec_and_test(&sess->refcnt)) + ksmbd_session_destroy(sess); } } up_write(&conn->session_lock); up_write(&sessions_table_lock); } @@ -309,12 +311,12 @@ void ksmbd_user_session_put(struct ksmbd_session *sess) if (!sess) return; if (atomic_read(&sess->refcnt) <= 0) WARN_ON(1); - else - atomic_dec(&sess->refcnt); + else if (atomic_dec_and_test(&sess->refcnt)) + ksmbd_session_destroy(sess); } struct preauth_session *ksmbd_preauth_session_alloc(struct ksmbd_conn *conn, u64 sess_id) { @@ -415,11 +417,11 @@ static struct ksmbd_session *__session_create(int protocol) xa_init(&sess->tree_conns); xa_init(&sess->ksmbd_chann_list); xa_init(&sess->rpc_handle_list); sess->sequence_number = 1; rwlock_init(&sess->tree_conns_lock); - atomic_set(&sess->refcnt, 1); + atomic_set(&sess->refcnt, 2); ret = __init_smb2_session(sess); if (ret) goto error; diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index b5ce09b10e3b..2074d977d5c9 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -2227,17 +2227,18 @@ int smb2_session_logoff(struct ksmbd_work *work) rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; smb2_set_err_rsp(work); return -ENOENT; } - ksmbd_destroy_file_table(&sess->file_table); down_write(&conn->session_lock); sess->state = SMB2_SESSION_EXPIRED; up_write(&conn->session_lock); - ksmbd_free_user(sess->user); - sess->user = NULL; + if (sess->user) { + ksmbd_free_user(sess->user); + sess->user = NULL; + } ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_NEGOTIATE); rsp->StructureSize = cpu_to_le16(4); err = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_logoff_rsp)); if (err) { -- 2.34.3

2 1

[openeuler:OLK-6.6 2175/2175] drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:432:6: error: no previous prototype for function 'sxe_debugfs_entries_init'
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 39356b4c041558637f7495ab0298150771a435ba commit: dd013ad487534c1838afc2f55efdb5daec15aace [2175/2175] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250429/202504291722.ZB4nQmaR-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250429/202504291722.ZB4nQmaR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504291722.ZB4nQmaR-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_xdp.c:11: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_xdp.h:15: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe.h:15: In file included from include/linux/pci.h:1670: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2253: include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_xdp.c:410:6: error: no previous prototype for function 'sxe_txrx_ring_enable' [-Werror,-Wmissing-prototypes] 410 | void sxe_txrx_ring_enable(struct sxe_adapter *adapter, u32 ring_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_xdp.c:410:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 410 | void sxe_txrx_ring_enable(struct sxe_adapter *adapter, u32 ring_idx) | ^ | static 5 errors generated. -- In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:14: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe.h:15: In file included from include/linux/pci.h:1670: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2253: include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:432:6: error: no previous prototype for function 'sxe_debugfs_entries_init' [-Werror,-Wmissing-prototypes] 432 | void sxe_debugfs_entries_init(struct sxe_adapter *adapter) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:432:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 432 | void sxe_debugfs_entries_init(struct sxe_adapter *adapter) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:459:6: error: no previous prototype for function 'sxe_debugfs_entries_exit' [-Werror,-Wmissing-prototypes] 459 | void sxe_debugfs_entries_exit(struct sxe_adapter *adapter) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:459:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 459 | void sxe_debugfs_entries_exit(struct sxe_adapter *adapter) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:465:6: error: no previous prototype for function 'sxe_debugfs_init' [-Werror,-Wmissing-prototypes] 465 | void sxe_debugfs_init(void) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:465:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 465 | void sxe_debugfs_init(void) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:470:6: error: no previous prototype for function 'sxe_debugfs_exit' [-Werror,-Wmissing-prototypes] 470 | void sxe_debugfs_exit(void) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:470:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 470 | void sxe_debugfs_exit(void) | ^ | static 8 errors generated. -- In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:11: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/arm64/include/asm/cacheflush.h:11: In file included from include/linux/kgdb.h:19: In file included from include/linux/kprobes.h:28: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2253: include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2022:5: error: no previous prototype for function 'sxe_reg_test' [-Werror,-Wmissing-prototypes] 2022 | int sxe_reg_test(struct sxe_adapter *adapter) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2022:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2022 | int sxe_reg_test(struct sxe_adapter *adapter) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2644:5: error: no previous prototype for function 'sxe_phys_id_set' [-Werror,-Wmissing-prototypes] 2644 | int sxe_phys_id_set(struct net_device *netdev, enum ethtool_phys_id_state state) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2644:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2644 | int sxe_phys_id_set(struct net_device *netdev, enum ethtool_phys_id_state state) | ^ | static 6 errors generated. -- In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:15: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_pci.h:14: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe.h:15: In file included from include/linux/pci.h:1670: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2253: include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:230:6: error: no previous prototype for function 'sxe_hw_no_snoop_disable' [-Werror,-Wmissing-prototypes] 230 | void sxe_hw_no_snoop_disable(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:230:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 230 | void sxe_hw_no_snoop_disable(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:6: error: no previous prototype for function 'sxe_hw_uc_addr_pool_del' [-Werror,-Wmissing-prototypes] 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:5: error: no previous prototype for function 'sxe_hw_uc_addr_pool_enable' [-Werror,-Wmissing-prototypes] 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:5: error: no previous prototype for function 'sxe_hw_nic_reset' [-Werror,-Wmissing-prototypes] 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:6: error: no previous prototype for function 'sxe_hw_pf_rst_done_set' [-Werror,-Wmissing-prototypes] 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:5: error: no previous prototype for function 'sxe_hw_pending_irq_read_clear' [-Werror,-Wmissing-prototypes] 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:6: error: no previous prototype for function 'sxe_hw_pending_irq_write_clear' [-Werror,-Wmissing-prototypes] 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:5: error: no previous prototype for function 'sxe_hw_irq_cause_get' [-Werror,-Wmissing-prototypes] 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:6: error: no previous prototype for function 'sxe_hw_ring_irq_auto_disable' [-Werror,-Wmissing-prototypes] 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:6: error: no previous prototype for function 'sxe_hw_irq_general_reg_set' [-Werror,-Wmissing-prototypes] 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:5: error: no previous prototype for function 'sxe_hw_irq_general_reg_get' [-Werror,-Wmissing-prototypes] 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:6: error: no previous prototype for function 'sxe_hw_event_irq_map' [-Werror,-Wmissing-prototypes] 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:6: error: no previous prototype for function 'sxe_hw_ring_irq_map' [-Werror,-Wmissing-prototypes] 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:6: error: no previous prototype for function 'sxe_hw_ring_irq_interval_set' [-Werror,-Wmissing-prototypes] 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:838:6: error: no previous prototype for function 'sxe_hw_event_irq_auto_clear_set' [-Werror,-Wmissing-prototypes] 838 | void sxe_hw_event_irq_auto_clear_set(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:838:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 838 | void sxe_hw_event_irq_auto_clear_set(struct sxe_hw *hw, u32 value) | ^ | static fatal error: too many errors emitted, stopping now [-ferror-limit=] 20 errors generated. -- In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:15: In file included from include/linux/ethtool.h:18: In file included from include/linux/if_ether.h:19: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/arm64/include/asm/cacheflush.h:11: In file included from include/linux/kgdb.h:19: In file included from include/linux/kprobes.h:28: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2253: include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:136:5: error: no previous prototype for function 'sxe_msi_irq_init' [-Werror,-Wmissing-prototypes] 136 | int sxe_msi_irq_init(struct sxe_adapter *adapter) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:136:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 136 | int sxe_msi_irq_init(struct sxe_adapter *adapter) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:182:6: error: no previous prototype for function 'sxe_disable_dcb' [-Werror,-Wmissing-prototypes] 182 | void sxe_disable_dcb(struct sxe_adapter *adapter) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:182:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 182 | void sxe_disable_dcb(struct sxe_adapter *adapter) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:212:6: error: no previous prototype for function 'sxe_disable_rss' [-Werror,-Wmissing-prototypes] 212 | void sxe_disable_rss(struct sxe_adapter *adapter) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:212:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 212 | void sxe_disable_rss(struct sxe_adapter *adapter) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:729:6: error: no previous prototype for function 'sxe_lsc_irq_handler' [-Werror,-Wmissing-prototypes] 729 | void sxe_lsc_irq_handler(struct sxe_adapter *adapter) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:729:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 729 | void sxe_lsc_irq_handler(struct sxe_adapter *adapter) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:745:6: error: no previous prototype for function 'sxe_mailbox_irq_handler' [-Werror,-Wmissing-prototypes] 745 | void sxe_mailbox_irq_handler(struct sxe_adapter *adapter) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:745:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 745 | void sxe_mailbox_irq_handler(struct sxe_adapter *adapter) | ^ | static 9 errors generated. .. vim +/sxe_debugfs_entries_init +432 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c 431 > 432 void sxe_debugfs_entries_init(struct sxe_adapter *adapter) 433 { 434 struct dentry *dir; 435 const char *name = pci_name(adapter->pdev); 436 437 adapter->debugfs_entries = debugfs_create_dir(name, sxe_debugfs_root); 438 dir = debugfs_create_file("reg_ops", 0600, adapter->debugfs_entries, 439 adapter, &sxe_debugfs_reg_ops_fops); 440 if (!dir || dir == ERR_PTR(-ENODEV)) 441 LOG_INFO_BDF("debugfs:reg_ops file create failed\n"); 442 443 dir = debugfs_create_file("netdev_ops", 0600, adapter->debugfs_entries, 444 adapter, &sxe_debugfs_netdev_ops_fops); 445 if (!dir || dir == ERR_PTR(-ENODEV)) 446 LOG_INFO_BDF("debugfs:netdev_ops file create failed\n"); 447 448 dir = debugfs_create_file("hw_stats", 0400, adapter->debugfs_entries, 449 adapter, &sxe_debugfs_hw_stats_fops); 450 if (!dir || dir == ERR_PTR(-ENODEV)) 451 LOG_INFO_BDF("debugfs:hw_stats file create failed\n"); 452 453 dir = debugfs_create_file("sfp_info", 0400, adapter->debugfs_entries, 454 adapter, &sxe_debugfs_sfp_info_fops); 455 if (!dir || dir == ERR_PTR(-ENODEV)) 456 LOG_INFO_BDF("debugfs:sfp_info file create failed\n"); 457 } 458 > 459 void sxe_debugfs_entries_exit(struct sxe_adapter *adapter) 460 { 461 debugfs_remove_recursive(adapter->debugfs_entries); 462 adapter->debugfs_entries = NULL; 463 } 464 > 465 void sxe_debugfs_init(void) 466 { 467 sxe_debugfs_root = debugfs_create_dir(SXE_DRV_NAME, NULL); 468 } 469 > 470 void sxe_debugfs_exit(void) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] jfs: add check read-only before truncation in jfs_truncate_nolock()
by Zhang Yuwei 29 Apr '25

29 Apr '25

mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 980aa3300f10..515cd45d0386 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -379,7 +379,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.22.0

2 1

[PATCH OLK-5.10 0/2] fuse: support fastpath
by chenrenhui 29 Apr '25

29 Apr '25

Support fuse fastpath by using the newly added kernel_ipc module. chenrenhui (2): ipc: add kernel_ipc module to enable fast process switching fuse: support fastpath via kernel_ipc Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + fs/fuse/Kconfig | 6 + fs/fuse/dev.c | 744 +++++++++++++++++++++++++ fs/fuse/dir.c | 87 ++- fs/fuse/file.c | 235 +++++++- fs/fuse/fuse_i.h | 55 ++ fs/fuse/inode.c | 112 ++++ fs/fuse/readdir.c | 8 + include/linux/kernel_ipc.h | 48 ++ include/uapi/linux/fuse.h | 15 +- ipc/Kconfig | 5 + ipc/Makefile | 2 +- ipc/kernel_ipc.c | 301 ++++++++++ 15 files changed, 1596 insertions(+), 28 deletions(-) create mode 100644 include/linux/kernel_ipc.h create mode 100644 ipc/Kconfig create mode 100644 ipc/kernel_ipc.c -- 2.33.0

2 3

[PATCH openEuler-1.0-LTS] mm/khugepaged: fix ->anon_vma race
by Ze Zuo 29 Apr '25

29 Apr '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.2-rc7 commit 023f47a8250c6bdb4aebe744db4bf7f73414028b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVYO CVE: CVE-2023-52935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If an ->anon_vma is attached to the VMA, collapse_and_free_pmd() requires it to be locked. Page table traversal is allowed under any one of the mmap lock, the anon_vma lock (if the VMA is associated with an anon_vma), and the mapping lock (if the VMA is associated with a mapping); and so to be able to remove page tables, we must hold all three of them. retract_page_tables() bails out if an ->anon_vma is attached, but does this check before holding the mmap lock (as the comment above the check explains). If we racily merged an existing ->anon_vma (shared with a child process) from a neighboring VMA, subsequent rmap traversals on pages belonging to the child will be able to see the page tables that we are concurrently removing while assuming that nothing else can access them. Repeat the ->anon_vma check once we hold the mmap lock to ensure that there really is no concurrent page table access. Hitting this bug causes a lockdep warning in collapse_and_free_pmd(), in the line "lockdep_assert_held_write(&vma->anon_vma->root->rwsem)". It can also lead to use-after-free access. Link: https://lore.kernel.org/linux-mm/CAG48ez3434wZBKFFbdx4M9j6eUwSUVPd4dxhzW_k_… Link: https://lkml.kernel.org/r/20230111133351.807024-1-jannh@google.com Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Jann Horn <jannh(a)google.com> Reported-by: Zach O'Keefe <zokeefe(a)google.com> Acked-by: Kirill A. Shutemov <kirill.shutemov(a)intel.linux.com> Reviewed-by: Yang Shi <shy828301(a)gmail.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/khugepaged.c [Conflicts due to 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE") is not merged.] Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/khugepaged.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 88badbed7f73..217410a37677 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -1311,7 +1311,7 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) i_mmap_lock_write(mapping); vma_interval_tree_foreach(vma, &mapping->i_mmap, pgoff, pgoff) { /* probably overkill */ - if (vma->anon_vma) + if (READ_ONCE(vma->anon_vma)) continue; addr = vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT); if (addr & ~HPAGE_PMD_MASK) @@ -1329,6 +1329,18 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) * the system too much. */ if (down_write_trylock(&mm->mmap_sem)) { + /* + * Re-check whether we have an ->anon_vma, because + * collapse_and_free_pmd() requires that either no + * ->anon_vma exists or the anon_vma is locked. + * We already checked ->anon_vma above, but that check + * is racy because ->anon_vma can be populated under the + * mmap lock in read mode. + */ + if (vma->anon_vma) { + up_write(&mm->mmap_sem); + continue; + } if (!khugepaged_test_exit(mm)) { spinlock_t *ptl; unsigned long end = addr + HPAGE_PMD_SIZE; -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1597/1597] include/linux/string.h:249:16: warning: '__builtin_strncpy' accessing 80 bytes at offsets 100 and 36 may overlap up to 0 bytes at offset [9223372036854775807, -9223372036854775808]
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7bd21c560a6f5df598200cc367cad1a683cef8ef commit: a24ec7d8d3462ba48b4bd932960c397d92de8782 [1597/1597] ASoC: dmaengine: Make the pcm->name equal to pcm->id if the name is not set config: arm64-randconfig-002-20250429 (https://download.01.org/0day-ci/archive/20250429/202504291551.FOwjwu8e-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250429/202504291551.FOwjwu8e-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504291551.FOwjwu8e-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/arm64/include/asm/processor.h:41, from include/linux/rcupdate.h:43, from include/linux/rculist.h:11, from include/linux/pid.h:5, from include/linux/sched.h:14, from arch/arm64/include/asm/compat.h:25, from arch/arm64/include/asm/stat.h:24, from include/linux/stat.h:6, from include/linux/module.h:11, from sound/soc/soc-generic-dmaengine-pcm.c:6: In function 'strncpy', inlined from 'dmaengine_pcm_new' at sound/soc/soc-generic-dmaengine-pcm.c:318:4: >> include/linux/string.h:249:16: warning: '__builtin_strncpy' accessing 80 bytes at offsets 100 and 36 may overlap up to 0 bytes at offset [9223372036854775807, -9223372036854775808] [-Wrestrict] 249 | return __builtin_strncpy(p, q, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/__builtin_strncpy +249 include/linux/string.h 6974f0c4555e28 Daniel Micay 2017-07-12 240 6974f0c4555e28 Daniel Micay 2017-07-12 241 #if !defined(__NO_FORTIFY) && defined(__OPTIMIZE__) && defined(CONFIG_FORTIFY_SOURCE) 6974f0c4555e28 Daniel Micay 2017-07-12 242 __FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size) 6974f0c4555e28 Daniel Micay 2017-07-12 243 { 6974f0c4555e28 Daniel Micay 2017-07-12 244 size_t p_size = __builtin_object_size(p, 0); 6974f0c4555e28 Daniel Micay 2017-07-12 245 if (__builtin_constant_p(size) && p_size < size) 6974f0c4555e28 Daniel Micay 2017-07-12 246 __write_overflow(); 6974f0c4555e28 Daniel Micay 2017-07-12 247 if (p_size < size) 6974f0c4555e28 Daniel Micay 2017-07-12 248 fortify_panic(__func__); 6974f0c4555e28 Daniel Micay 2017-07-12 @249 return __builtin_strncpy(p, q, size); 6974f0c4555e28 Daniel Micay 2017-07-12 250 } 6974f0c4555e28 Daniel Micay 2017-07-12 251 :::::: The code at line 249 was first introduced by commit :::::: 6974f0c4555e285ab217cee58b6e874f776ff409 include/linux/string.h: add the option of fortified string.h functions :::::: TO: Daniel Micay <danielmicay(a)gmail.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/1] CVE-2024-58094
by Yongqiang Liu 29 Apr '25

29 Apr '25

Zhang Yuwei (1): jfs: add check read-only before truncation in jfs_truncate_nolock() fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/2] CVE-2025-21979
by Zhang Changzhong 29 Apr '25

29 Apr '25

Edward Adam Davis (1): wifi: cfg80211: init wiphy_work before allocating rfkill fails Miri Korenblit (1): wifi: cfg80211: cancel wiphy_work before freeing wiphy net/wireless/core.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) -- 2.9.5

2 3

[PATCH OLK-6.6] media: streamzap: fix race between device disconnection and urb callback
by Yi Yang 29 Apr '25

29 Apr '25

From: Murad Masimov <m.masimov(a)mt-integration.ru> stable inclusion from stable-v6.6.87 commit 15483afb930fc2f883702dc96f80efbe4055235e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QRT CVE: CVE-2025-22027 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f656cfbc7a293a039d6a0c7100e1c846845148c1 upstream. Syzkaller has reported a general protection fault at function ir_raw_event_store_with_filter(). This crash is caused by a NULL pointer dereference of dev->raw pointer, even though it is checked for NULL in the same function, which means there is a race condition. It occurs due to the incorrect order of actions in the streamzap_disconnect() function: rc_unregister_device() is called before usb_kill_urb(). The dev->raw pointer is freed and set to NULL in rc_unregister_device(), and only after that usb_kill_urb() waits for in-progress requests to finish. If rc_unregister_device() is called while streamzap_callback() handler is not finished, this can lead to accessing freed resources. Thus rc_unregister_device() should be called after usb_kill_urb(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 8e9e60640067 ("V4L/DVB: staging/lirc: port lirc_streamzap to ir-core") Cc: stable(a)vger.kernel.org Reported-by: syzbot+34008406ee9a31b13c73(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=34008406ee9a31b13c73 Signed-off-by: Murad Masimov <m.masimov(a)mt-integration.ru> Signed-off-by: Sean Young <sean(a)mess.org> Signed-off-by: Hans Verkuil <hverkuil(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/media/rc/streamzap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/rc/streamzap.c b/drivers/media/rc/streamzap.c index 9b209e687f25..2ce62fe5d60f 100644 --- a/drivers/media/rc/streamzap.c +++ b/drivers/media/rc/streamzap.c @@ -385,8 +385,8 @@ static void streamzap_disconnect(struct usb_interface *interface) if (!sz) return; - rc_unregister_device(sz->rdev); usb_kill_urb(sz->urb_in); + rc_unregister_device(sz->rdev); usb_free_urb(sz->urb_in); usb_free_coherent(usbdev, sz->buf_in_len, sz->buf_in, sz->dma_in); -- 2.25.1

2 1

[PATCH OLK-5.10] mpage: fix softlockup in mpage_readahead()
by Zheng Qixing 29 Apr '25

29 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBYXQD --------------------------- When using null_blk with a large readahead window, calling madvise to trigger readahead can lead to system softlocks. This occurs because the CPU can remain in the mpage_readahead loop for extended periods without rescheduling, preventing other processes from running. The issue manifests as follows: Call Trace: xas_load+0x3c/0x90 xa_load+0x9f/0x290 page_cache_ra_unbounded+0x92/0x380 force_page_cache _ra+0xd5/0x1c0 generic_fadvise+0x255/0x3e0 vfs_fadvise+0x30/0x40 do_madvise+0xb1b/0x11d0 x64_sys_madvise+0x2b/0x40 x64_sys_call+0x1c0c/0x1e80 do_syscall_64+0x44/0x70 entry_SYScALL_64_after hwframe+0x66/0xd0 Add a cond_resched() call at the beginning of each loop iteration to allow the CPU to schedule other tasks when necessary, avoiding potential softlocks during heavy readahead operations. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- fs/mpage.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/mpage.c b/fs/mpage.c index 830e6cc2a9e7..f303c455b0e9 100644 --- a/fs/mpage.c +++ b/fs/mpage.c @@ -385,6 +385,7 @@ void mpage_readahead(struct readahead_control *rac, get_block_t get_block) }; while ((page = readahead_page(rac))) { + cond_resched(); prefetchw(&page->flags); args.page = page; args.nr_pages = readahead_count(rac); -- 2.39.2

3 2

[PATCH OLK-5.10] jfs: add check read-only before truncation in jfs_truncate_nolock()
by zhangyuwei20＠huawei.com 29 Apr '25

29 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 980aa3300f10..515cd45d0386 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -379,7 +379,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.22.0

1 0

[openeuler:openEuler-1.0-LTS 1597/1597] include/linux/ktask.h:123:35: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct hf_args *)' to 'int (*)(void *, void *, void *)'
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 230c2b30f879859ac3e9d3cc46407a9dbb103160 commit: 4733c59fabc3d9c145aca2f1c86b4872a7fb671d [1597/1597] hugetlbfs: parallelize hugetlbfs_fallocate with ktask config: arm64-randconfig-002-20250429 (https://download.01.org/0day-ci/archive/20250429/202504291102.S4UEqzyV-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250429/202504291102.S4UEqzyV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504291102.S4UEqzyV-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from fs/hugetlbfs/inode.c:39: fs/hugetlbfs/inode.c: In function 'hugetlbfs_fallocate': >> include/linux/ktask.h:123:35: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct hf_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^ include/linux/ktask.h:139:17: note: in expansion of macro 'KTASK_CTL_INITIALIZER' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~ fs/hugetlbfs/inode.c:635:17: note: in expansion of macro 'DEFINE_KTASK_CTL' 635 | DEFINE_KTASK_CTL(ctl, hugetlbfs_fallocate_chunk, | ^~~~~~~~~~~~~~~~ vim +123 include/linux/ktask.h c48676ef6b6f9cb Daniel Jordan 2019-08-14 120 c48676ef6b6f9cb Daniel Jordan 2019-08-14 121 #define KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ c48676ef6b6f9cb Daniel Jordan 2019-08-14 122 { \ c48676ef6b6f9cb Daniel Jordan 2019-08-14 @123 .kc_thread_func = (ktask_thread_func)(thread_func), \ 69cc5b58cc50d2f Daniel Jordan 2019-08-14 124 .kc_undo_func = NULL, \ c48676ef6b6f9cb Daniel Jordan 2019-08-14 125 .kc_func_arg = (func_arg), \ c48676ef6b6f9cb Daniel Jordan 2019-08-14 126 .kc_min_chunk_size = (min_chunk_size), \ c48676ef6b6f9cb Daniel Jordan 2019-08-14 127 .kc_iter_func = (ktask_iter_range), \ c48676ef6b6f9cb Daniel Jordan 2019-08-14 128 .kc_max_threads = 0, \ c48676ef6b6f9cb Daniel Jordan 2019-08-14 129 } c48676ef6b6f9cb Daniel Jordan 2019-08-14 130 :::::: The code at line 123 was first introduced by commit :::::: c48676ef6b6f9cb8497d6264ae9ff71b87630337 ktask: multithread CPU-intensive kernel work :::::: TO: Daniel Jordan <daniel.m.jordan(a)oracle.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] init/Kconfig: Add SMP to the dependencies of QOS_SCHED
by Liu Kai 29 Apr '25

29 Apr '25

From: Xia Fukun <xiafukun(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8MF4R -------------------------------- After CONFIG_SMP is disabled during kernel compilation, CONFIG_QOS_SCHED is not disabled. As a result, the following error occurs: kernel/sched/fair.c: In function ‘check_qos_cfs_rq’: kernel/sched/fair.c:7324:4: error: implicit declaration of function ‘sched_idle_cpu’; did you mean ‘sched_idle_rq’? [-Werror=implicit-function-declaration] 7324 | !sched_idle_cpu(smp_processor_id()) && | ^~~~~~~~~~~~~~ ./include/linux/compiler.h:78:42: note: in definition of macro ‘unlikely’ 78 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ CC mm/highmem.o kernel/sched/fair.c: In function ‘pick_next_task_fair’: kernel/sched/fair.c:7599:43: error: ‘struct rq’ has no member named ‘online’ 7599 | if (cfs_rq->idle_h_nr_running != 0 && rq->online) | ^~ AR arch/x86/mm/pat/built-in.a CC kernel/sched/stats.o kernel/sched/fair.c:7790:7: error: ‘struct rq’ has no member named ‘idle_stamp’; did you mean ‘idle_state’? 7790 | rq->idle_stamp = 0; | ^~~~~~~~~~ | idle_state This is because the definitions of the corresponding functions and variables depend on the SMP configuration. So add SMP to the dependencies of QOS_SCHED. Fixes: fcf53ace7925 ("sched: Enable qos scheduler config") Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/init/Kconfig b/init/Kconfig index 4c566c4bbfa4..22d9ac8ca08f 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1072,12 +1072,12 @@ config QOS_SCHED bool "Qos task scheduling" depends on CGROUP_SCHED depends on CFS_BANDWIDTH + depends on SMP default n help This option enable qos scheduler, and support co-location online services (Latency Sensitive) and offline tasks. colocation can effectively improve the resource utilization. - If in doubt, say N. config QOS_SCHED_SMT_EXPELLER -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] fuse: support fastpath
by chenrenhui 29 Apr '25

29 Apr '25

Support fuse fastpath by using the newly added kernel_ipc module. chenrenhui (2): ipc: add kernel_ipc module to enable fast process switching fuse: support fastpath via kernel_ipc Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + fs/fuse/Kconfig | 6 + fs/fuse/dev.c | 744 +++++++++++++++++++++++++ fs/fuse/dir.c | 87 ++- fs/fuse/file.c | 235 +++++++- fs/fuse/fuse_i.h | 55 ++ fs/fuse/inode.c | 112 ++++ fs/fuse/readdir.c | 8 + include/linux/kernel_ipc.h | 48 ++ include/uapi/linux/fuse.h | 15 +- ipc/Kconfig | 5 + ipc/Makefile | 2 +- ipc/kernel_ipc.c | 303 ++++++++++ 15 files changed, 1598 insertions(+), 28 deletions(-) create mode 100644 include/linux/kernel_ipc.h create mode 100644 ipc/Kconfig create mode 100644 ipc/kernel_ipc.c -- 2.33.0

2 3

[PATCH OLK-6.6] crypto: loongson: add wst se chip support
by Hongchen Zhang 29 Apr '25

29 Apr '25

From: Qunqin Zhao <zhaoqunqin(a)loongson.cn> LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC1081 CVE: NA -------------------------------- Add support for WST se chip support for LS*5000*. Signed-off-by: Qunqin Zhao <zhaoqunqin(a)loongson.cn> Change-Id: Ie485ae3f1d6ad0dc4e89966943253b08192b6727 --- MAINTAINERS | 6 + arch/loongarch/configs/loongson3_defconfig | 1 + drivers/crypto/Kconfig | 1 + drivers/crypto/Makefile | 1 + drivers/crypto/sedriver/Kconfig | 11 + drivers/crypto/sedriver/Makefile | 7 + drivers/crypto/sedriver/wst_se_common_type.h | 98 ++ drivers/crypto/sedriver/wst_se_define.h | 27 + drivers/crypto/sedriver/wst_se_echip_driver.c | 1420 +++++++++++++++++ drivers/crypto/sedriver/wst_se_echip_driver.h | 169 ++ drivers/crypto/sedriver/wst_se_ktrans.h | 17 + 11 files changed, 1758 insertions(+) create mode 100644 drivers/crypto/sedriver/Kconfig create mode 100644 drivers/crypto/sedriver/Makefile create mode 100644 drivers/crypto/sedriver/wst_se_common_type.h create mode 100644 drivers/crypto/sedriver/wst_se_define.h create mode 100644 drivers/crypto/sedriver/wst_se_echip_driver.c create mode 100644 drivers/crypto/sedriver/wst_se_echip_driver.h create mode 100644 drivers/crypto/sedriver/wst_se_ktrans.h diff --git a/MAINTAINERS b/MAINTAINERS index d28726658085..1db61ba8ad46 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -756,6 +756,12 @@ L: linux-crypto(a)vger.kernel.org S: Maintained F: drivers/crypto/allwinner/ +WST CRYPTO DRIVERS +M: Hongchen Zhang <zhanghongchen(a)loongson.cn> +L: linux-crypto(a)vger.kernel.org +S: Maintained +F: drivers/crypto/sedriver/ + ALLWINNER DMIC DRIVERS M: Ban Tao <fengzheng923(a)gmail.com> L: alsa-devel(a)alsa-project.org (moderated for non-subscribers) diff --git a/arch/loongarch/configs/loongson3_defconfig b/arch/loongarch/configs/loongson3_defconfig index 980f5f2c99a1..cf359d1a2554 100644 --- a/arch/loongarch/configs/loongson3_defconfig +++ b/arch/loongarch/configs/loongson3_defconfig @@ -2177,6 +2177,7 @@ CONFIG_CRYPTO_CRC32_LOONGARCH=m CONFIG_CRYPTO_DEV_NITROX_CNN55XX=m CONFIG_CRYPTO_DEV_CHELSIO=m CONFIG_CRYPTO_DEV_VIRTIO=m +CONFIG_SW_SE_CHIP=m CONFIG_SIGNED_PE_FILE_VERIFICATION=y CONFIG_SECONDARY_TRUSTED_KEYRING=y CONFIG_SYSTEM_BLACKLIST_KEYRING=y diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig index b84a921d293f..efd6a855bca3 100644 --- a/drivers/crypto/Kconfig +++ b/drivers/crypto/Kconfig @@ -836,5 +836,6 @@ config CRYPTO_DEV_SA2UL source "drivers/crypto/aspeed/Kconfig" source "drivers/crypto/starfive/Kconfig" source "drivers/crypto/montage/Kconfig" +source "drivers/crypto/sedriver/Kconfig" endif # CRYPTO_HW diff --git a/drivers/crypto/Makefile b/drivers/crypto/Makefile index 5247d2bf09ce..6ad337bad109 100644 --- a/drivers/crypto/Makefile +++ b/drivers/crypto/Makefile @@ -54,3 +54,4 @@ obj-$(CONFIG_CRYPTO_DEV_AMLOGIC_GXL) += amlogic/ obj-y += intel/ obj-y += starfive/ obj-y += montage/ +obj-$(CONFIG_SW_SE_CHIP) += sedriver/ diff --git a/drivers/crypto/sedriver/Kconfig b/drivers/crypto/sedriver/Kconfig new file mode 100644 index 000000000000..9d58794a6fc9 --- /dev/null +++ b/drivers/crypto/sedriver/Kconfig @@ -0,0 +1,11 @@ +# +# se chip configuration +# +config SW_SE_CHIP + tristate "wst se chip driver" + depends on LOONGARCH + help + If you have a wst security chip, + say Yes and it will be accessible from within Linux. + To compile this driver as a module, choose M here; + the module will be called tpm_tis_i2c. If unsure, say N. diff --git a/drivers/crypto/sedriver/Makefile b/drivers/crypto/sedriver/Makefile new file mode 100644 index 000000000000..0ee095d1a1d2 --- /dev/null +++ b/drivers/crypto/sedriver/Makefile @@ -0,0 +1,7 @@ +# +# Makefile for SE CHIP Driver +# + +obj-$(CONFIG_SW_SE_CHIP) += sw_se_echip_drv.o +sw_se_echip_drv-objs := wst_se_echip_driver.o + diff --git a/drivers/crypto/sedriver/wst_se_common_type.h b/drivers/crypto/sedriver/wst_se_common_type.h new file mode 100644 index 000000000000..c33dc53dfc5b --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_common_type.h @@ -0,0 +1,98 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _WST_SE_COMMON_TYPE_H +#define _WST_SE_COMMON_TYPE_H + +#include <linux/kernel.h> /* We're doing kernel work */ +#include <linux/module.h> /* Specifically, a module */ +#include <linux/errno.h> +#include <linux/init.h> +#include <linux/poll.h> +#include <linux/pci.h> +#include <linux/types.h> +#include <linux/fs.h> +#include <linux/interrupt.h> +#include <linux/workqueue.h> +#include <linux/mm.h> +#include <linux/sched.h> +#include <linux/slab.h> +#include <linux/wait.h> +#include <linux/version.h> +#include <linux/ioport.h> +#include <linux/time.h> +#include <linux/pagemap.h> +#include <linux/delay.h> +#include <linux/list.h> +#include <linux/uaccess.h> +#include <linux/io.h> +#include <asm/mman.h> +#include <asm/irq.h> +#include <asm/dma.h> + +#define WST_GO_CHANNEL0 0x0002 +#define WST_GO_CHANNEL1 0x0000 +#define WST_GO_CHANNEL2 0x0001 + +#define SE_OK 0 + +struct loongson_sedriver_irq { + char *pat; + int irq; +}; + +struct tag_dma_buf_ctl { + struct list_head list; + unsigned char *pDmaBuf; +}; + +struct tag_Queue_container { + struct list_head m_Head; + unsigned int qlen; + unsigned int max_qlen; +}; + +static inline int wst_InitQueue(struct tag_Queue_container *pQueue, int count) +{ + INIT_LIST_HEAD(&pQueue->m_Head); + pQueue->qlen = 0; + pQueue->max_qlen = count; + return 0; +} + +static inline struct list_head * +wst_Popfront_Que(struct tag_Queue_container *pQueue) +{ + struct list_head *pNode = NULL; + + if (list_empty(&pQueue->m_Head)) + return NULL; + + pQueue->qlen--; + pNode = pQueue->m_Head.next; + list_del(pNode); + return pNode; +} + +static inline int wst_Pushback_Que(struct tag_Queue_container *pQueue, + void *pNode) +{ + if (unlikely(pQueue->qlen >= pQueue->max_qlen)) + return -1; + + pQueue->qlen++; + list_add_tail((struct list_head *)(pNode), &pQueue->m_Head); + return 0; +} + +#define READUBUF 0 +#define WRITEUBUF 1 + +static inline int wst_cpyusrbuf(unsigned char *puserbuf, unsigned char *pkbuf, + size_t num, int orient) +{ + if (orient == READUBUF) + return copy_from_user(pkbuf, puserbuf, num); + else + return copy_to_user(puserbuf, pkbuf, num); +} + +#endif diff --git a/drivers/crypto/sedriver/wst_se_define.h b/drivers/crypto/sedriver/wst_se_define.h new file mode 100644 index 000000000000..1902b236c906 --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_define.h @@ -0,0 +1,27 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _WST_SE_DEFINE_H +#define _WST_SE_DEFINE_H + +typedef void (*PSECallBackfn)(void *pParam); + +#define WST_SE_OK 0 //function syccess +#define WST_SE_FAILURE 1 +#define WST_SE_ERROR_MALLOC 2 +#define WST_SE_ERROR_OPEN 3 +#define WST_SE_ERROR_ID 4 +#define WST_SE_ERROR_OPERTYPE 5 +#define WST_SE_ERROR_KEYID 6 +#define WST_SE_NOT_SUPPORT 7 +#define WST_SE_ERROR_FULL 8 +#define WST_SE_VERIFY_ERROR 0xb +#define WST_SE_NOT_SUPPORT_VERIFY 0xd +#define WST_SE_ERROR_LENGTH 0xc +#define WST_SE_HAS_OPEN 0xd +#define WST_COPY_MEM_ERROR 0xe +#define WST_SE_PARAM_ERROR 0xf + +#define BASE_ERROR 0x1000 +#define WST_SE_ERROR_LICENSE 0x100b +#define WST_SE_ERROR_NOT_SUPPORT_TYPE 0x100d + +#endif diff --git a/drivers/crypto/sedriver/wst_se_echip_driver.c b/drivers/crypto/sedriver/wst_se_echip_driver.c new file mode 100644 index 000000000000..57f13789870c --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_echip_driver.c @@ -0,0 +1,1420 @@ +// SPDX-License-Identifier: GPL-2.0 +#include <linux/semaphore.h> +#include <linux/moduleparam.h> +#include <linux/kthread.h> +#include <linux/module.h> +#include <linux/of_device.h> +#include <linux/workqueue.h> +#include <linux/platform_device.h> +#include <linux/crypto.h> +#include <crypto/internal/skcipher.h> +#include <linux/acpi.h> +#include <asm/loongson.h> +#include "wst_se_echip_driver.h" + +#define LS_CRYPTO_SE_ADDR1 TO_UNCACHE(LOONGSON_REG_BASE + 0x0400) +#define LS_CRYPTO_SE_ADDR2 TO_UNCACHE(0xc0010200000) +#define DRIVER_VERSION "01.10.220111" +DEFINE_SPINLOCK(g_reclistlock); +DEFINE_SPINLOCK(g_sendlistlock); +DEFINE_SPINLOCK(g_getdmabuflock); + +unsigned char *g_pCacheInBuf = NULL, *g_pCacheOutBuf = NULL; +static struct class *g_psecclass; +static struct device *g_psecdev; +static struct tagSEdrvctl *g_psechipDrvCtrl; +static int g_isechip_Major = -1; +static struct semaphore g_lowsema, g_lowirqsema; +static atomic_t g_sendtotallen; +static struct tag_Queue_container g_RecQueueContainer; +static struct tag_Queue_container g_SendQueueContainer; +static int g_suspend; +static struct semaphore g_dmabufsem; +struct loongson_sedriver_irq se_irq[] = { + { + .pat = "se-irq", + }, + { + .pat = "se-lirq", + }, +}; +static struct tag_Queue_container g_DmaBQueueContainer; +static struct tag_dma_buf_ctl *g_pdmadatabuf; +static int g_iDmaBufNum; +static struct work_struct g_recwork, g_sendwork; +static struct workqueue_struct *g_worksendqueue, *g_workrecqueue; +static irqreturn_t se_interrupt(int irq, void *p); +static irqreturn_t wst_low_channel_status(int irq, void *p); +static void globalmem_do_send_op(struct work_struct *p); +static void globalmem_do_rec_op(struct work_struct *p); +static int g_iUseIntr = 1; +module_param(g_iUseIntr, int, 0644); + +static int se_init_dma_buf(int idatasize, int idatanum) +{ + int i; + struct tag_dma_buf_ctl *pdmactl; + + wst_InitQueue(&g_DmaBQueueContainer, idatanum); + g_pdmadatabuf = kmalloc((sizeof(struct tag_dma_buf_ctl) * idatanum), + GFP_KERNEL); + if (!g_pdmadatabuf) + return -1; + for (i = 0; i < idatanum; i++) { + pdmactl = &g_pdmadatabuf[i]; + pdmactl->pDmaBuf = + (unsigned char *)__get_free_page(GFP_KERNEL | GFP_DMA); + if (!pdmactl->pDmaBuf) { + g_iDmaBufNum = i; + return SE_OK; + } + wst_Pushback_Que(&g_DmaBQueueContainer, pdmactl); + } + g_iDmaBufNum = i; + sema_init(&g_dmabufsem, 1); + return SE_OK; +} + +static int se_del_dma_buf(void) +{ + int i; + struct tag_dma_buf_ctl *pdmactl; + + for (i = 0; i < g_iDmaBufNum; i++) { + pdmactl = &g_pdmadatabuf[i]; + if (pdmactl) { + free_page((unsigned long)pdmactl->pDmaBuf); + pdmactl->pDmaBuf = NULL; + } + } + kfree(g_pdmadatabuf); + g_pdmadatabuf = NULL; + return 0; +} + +struct tag_dma_buf_ctl *se_get_dma_buf(int ikernel) +{ + struct tag_dma_buf_ctl *pbufctl = NULL; + unsigned long ultimeout = 0; + + ultimeout = jiffies + 20 * HZ; + while (1) { + spin_lock(&g_getdmabuflock); + pbufctl = (struct tag_dma_buf_ctl *)wst_Popfront_Que( + &g_DmaBQueueContainer); + spin_unlock(&g_getdmabuflock); + if (pbufctl) + return pbufctl; + if (down_timeout(&g_dmabufsem, ultimeout)) + return NULL; + } + return pbufctl; +} + +int se_free_dma_buf(struct tag_dma_buf_ctl *pdmabufctl) +{ + spin_lock(&g_getdmabuflock); + wst_Pushback_Que(&g_DmaBQueueContainer, pdmabufctl); + spin_unlock(&g_getdmabuflock); + if (g_dmabufsem.count <= 0) + up(&g_dmabufsem); + + return 0; +} + +static unsigned long bytes_align(struct device *pdev, unsigned long ulVirAddr) +{ + unsigned char diff; + unsigned long ulPhyAddr = (unsigned long)__pa((void *)ulVirAddr); + + if ((ulPhyAddr & 0x000000000000003f) == 0) + return ulVirAddr; + diff = ((long)ulPhyAddr & (~(0x000000000000003f))) + 64 - ulPhyAddr; + ulVirAddr += diff; + + return ulVirAddr; +} + +static unsigned long descri_bytes_align(unsigned long ulVirAddr) +{ + unsigned char diff; + unsigned long ulPhyAddr = ulVirAddr; + + if ((ulPhyAddr & (~0x00000000ffffffe0)) == 0) + return ulVirAddr; + diff = ((long)ulPhyAddr & 0x00000000ffffffe0) + 32 - ulPhyAddr; + ulVirAddr += diff; + return ulVirAddr; +} + +int se_printk_hex(unsigned char *buff, int length) +{ + unsigned char *string_tmp = buff; + int i; + int count = 0; + + for (i = 0; i < length; i++, count++) { + if (count < 16) + pr_info("%02x ", string_tmp[i]); + else { + count = 0; + pr_info("\n%02x ", string_tmp[i]); + continue; + } + } + pr_info("\n"); + return 0; +} + +static int se_ChipInit(struct tagSEdrvctl *pDrvCtrl) +{ + dma_addr_t ulBusAddr; + unsigned long ulVirAddr; + int i = 0, j = 0; + unsigned int dmaoldmask; + + for (i = 0; i < SWCHANNELNUM; i++) { + ulVirAddr = (unsigned long)dma_alloc_coherent( + pDrvCtrl->pdev, (SE_BDQUEUE_LEN * SE_BD_LENGTH + 32), + &ulBusAddr, GFP_KERNEL); + if (ulVirAddr == 0 || ulBusAddr == 0) + return -EFAULT; + memset((void *)ulVirAddr, 0, (SE_BDQUEUE_LEN * SE_BD_LENGTH)); + + pDrvCtrl->ulBDMemBasePhy[i] = ulBusAddr; + pDrvCtrl->ulBDMemBase[i] = ulVirAddr; + pDrvCtrl->ulCurrBdReadPtr[i] = 0; + pDrvCtrl->ulCurrBdWritePtr[i] = 0; + pDrvCtrl->ulCurrReadPtr[i] = 0; + pDrvCtrl->ulCurrWritePtr[i] = 0; + } + for (i = 0; i < SE_BDQUEUE_LEN; i++) { + for (j = 0; j < SWCHANNELNUM; j++) + (&((struct tagSEBasicBD *)(pDrvCtrl->ulBDMemBase[j]))[i]) + ->ucRetCode = 0x0f; + } + ulBusAddr = descri_bytes_align(pDrvCtrl->ulBDMemBasePhy[0]); + HandleWrite32(pDrvCtrl, SE_HREG_BQBA0, HIULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_LREG_BQBA0, LOULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_REG_BQS0, SE_BDQUEUE_LEN - 1); + HandleWrite32(pDrvCtrl, SE_REG_RQRP0, pDrvCtrl->ulCurrBdReadPtr[0]); + HandleWrite32(pDrvCtrl, SE_REG_BQWP0, pDrvCtrl->ulCurrBdWritePtr[0]); + + ulBusAddr = descri_bytes_align(pDrvCtrl->ulBDMemBasePhy[1]); + HandleWrite32(pDrvCtrl, SE_HREG_BQBA1, HIULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_LREG_BQBA1, LOULONG(ulBusAddr)); + HandleWrite32(pDrvCtrl, SE_REG_BQS1, SE_BDQUEUE_LEN - 1); + HandleWrite32(pDrvCtrl, SE_REG_RQRP1, pDrvCtrl->ulCurrBdReadPtr[1]); + HandleWrite32(pDrvCtrl, SE_REG_BQWP1, pDrvCtrl->ulCurrBdWritePtr[1]); + HandleRead32(pDrvCtrl, SE_REG_MSK, &dmaoldmask); + HandleWrite32(pDrvCtrl, SE_REG_MSK, + (dmaoldmask | DMA0_CTRL_CHANNEL_ENABLE | + DMA1_CTRL_CHANNEL_ENABLE)); + if (g_iUseIntr != 0) + HandleWrite32(pDrvCtrl, SE_LOWREG_INQ, 1); + else + HandleWrite32(pDrvCtrl, SE_LOWREG_INQ, 0); + mdelay(1000); + + return SE_OK; +} + +static void se_ChipRelease(struct tagSEdrvctl *pDrvCtrl) +{ + int i; + + for (i = 0; i < SWCHANNELNUM; i++) { + if (pDrvCtrl->ulBDMemBase[i]) { + dma_free_coherent(pDrvCtrl->pdev, + (SE_BDQUEUE_LEN * SE_BD_LENGTH), + (void *)pDrvCtrl->ulBDMemBase[i], + pDrvCtrl->ulBDMemBasePhy[i]); + pDrvCtrl->ulBDMemBase[i] = 0; + pDrvCtrl->ulBDMemBasePhy[i] = 0; + } + } +} + +static void SE_RESET(struct tagSEdrvctl *pdrvctl) +{ + unsigned int reg; + unsigned long ulreg64, uladdr = LS_CRYPTO_SE_ADDR1; + + HandleRead32(pdrvctl, SE_REG_RESET, &reg); + HandleWrite32(pdrvctl, SE_REG_RESET, reg | SE_DMA_CONTROL_RESET); + mdelay(300); + HandleWrite32(pdrvctl, SE_REG_RESET, + (reg & (~SE_DMA_CONTROL_RESET)) | SE_DMA_CONTROL_SET); + mdelay(300); + ulreg64 = readq((void *)uladdr); + if ((ulreg64 & 0xf0000000000000) != 0xf0000000000000) + writeq(ulreg64 | 0xf0000000000000, (void *)uladdr); + HandleWrite32(pdrvctl, SE_INT_CLR, 0xf); +} + +static int wst_init(void) +{ + int iRes = SE_OK; + static u64 wst_dma_mask = DMA_BIT_MASK(64); + char cName[256]; + struct tagSEdrvctl *pdrvctl = NULL; + + pdrvctl = kmalloc(sizeof(struct tagSEdrvctl), GFP_KERNEL); + if (pdrvctl == NULL) + return -ENOMEM; + memset(pdrvctl, 0, sizeof(struct tagSEdrvctl)); + pdrvctl->ulMemBase = LS_CRYPTO_SE_ADDR2; + memset(cName, 0, 256); + sema_init(&(pdrvctl->sema), 0); + rwlock_init(&(pdrvctl->mr_lock)); + rwlock_init(&(pdrvctl->mr_lowlock)); + g_psechipDrvCtrl = pdrvctl; + g_psechipDrvCtrl->pdev = g_psecdev; + g_psechipDrvCtrl->pdev->dma_mask = &wst_dma_mask; + g_psechipDrvCtrl->pdev->coherent_dma_mask = + (unsigned long long)&wst_dma_mask; + wst_InitQueue(&g_RecQueueContainer, 2000); + wst_InitQueue(&g_SendQueueContainer, 2000); + SE_RESET(pdrvctl); + pdrvctl->ilowIrq = 0; + pdrvctl->iIrq = se_irq[0].irq; + iRes = request_irq(pdrvctl->iIrq, &se_interrupt, IRQF_SHARED, + "wst-se-hirq", pdrvctl); + if (iRes) { + pr_err("request_irq err\n"); + pdrvctl->iIrq = 0; + goto err; + } + if (g_iUseIntr == 1) { + pdrvctl->ilowIrq = se_irq[1].irq; + iRes = request_irq(pdrvctl->ilowIrq, &wst_low_channel_status, + IRQF_SHARED, "wst-se-lirq", pdrvctl); + if (iRes) { + pr_err("\nrequest_lowirq err, iRes=0x%x\n", iRes); + pdrvctl->ilowIrq = 0; + goto err; + } + } + if (se_ChipInit(pdrvctl) != SE_OK) { + iRes = -ENODEV; + goto err; + } + return SE_OK; +err: + if (pdrvctl != NULL) { + if (pdrvctl->iIrq) { + free_irq(pdrvctl->iIrq, pdrvctl); + pdrvctl->iIrq = 0; + } + if (pdrvctl->ilowIrq) { + free_irq(pdrvctl->ilowIrq, pdrvctl); + pdrvctl->ilowIrq = 0; + } + se_ChipRelease(pdrvctl); + kfree(pdrvctl); + g_psechipDrvCtrl = NULL; + } + return iRes; +} + +static void wst_clear(void) +{ + struct tagSEdrvctl *pdrvctl = NULL; + + pdrvctl = g_psechipDrvCtrl; + if (pdrvctl) { + if (pdrvctl->iIrq) { + free_irq(pdrvctl->iIrq, pdrvctl); + pdrvctl->iIrq = 0; + } + if (pdrvctl->ilowIrq) { + free_irq(pdrvctl->ilowIrq, pdrvctl); + pdrvctl->ilowIrq = 0; + } + se_ChipRelease(pdrvctl); + kfree(pdrvctl); + g_psechipDrvCtrl = NULL; + } +} +static void globalmem_do_send_op(struct work_struct *p) +{ + struct tagSEBasicBD *pCurBD; + unsigned int ulCurrWritePtr, ulWritePtr; + unsigned short len = 0; + unsigned long ulCurrAddrInput = 0, ulCurrAddrOutput = 0; + struct tagSEdrvctl *pdrvctl; + unsigned char *pInPtr; + unsigned short usInlen; + unsigned char *pOutPtr; + unsigned short *pusOutlen; + int iChannel; + unsigned char ucFlag; + unsigned char ucOpCode; + unsigned char *pucRetCode; + PSECallBackfn pcallback; + void *pParma; + int iKernel; + struct completion *mycomplete; + struct ST_SEND_PACKAGE *psendpackage; + unsigned long ulflag; + unsigned long ultimeout; + int rv = 0; + +PROG: + spin_lock_irq(&g_sendlistlock); + psendpackage = (struct ST_SEND_PACKAGE *)wst_Popfront_Que(&g_SendQueueContainer); + if (!psendpackage) { + spin_unlock_irq(&g_sendlistlock); + return; + } + spin_unlock_irq(&g_sendlistlock); + pdrvctl = psendpackage->pdrvctl; + pInPtr = psendpackage->pInPtr; + usInlen = psendpackage->usInlen; + pOutPtr = psendpackage->pOutPtr; + pusOutlen = psendpackage->pusOutlen; + iChannel = psendpackage->iChannel; + ucFlag = psendpackage->ucFlag; + ucOpCode = psendpackage->ucOpCode; + pucRetCode = psendpackage->pucRetCode; + pcallback = psendpackage->pcallback; + pParma = psendpackage->pParma; + iKernel = psendpackage->iKernel; + mycomplete = psendpackage->mycomplete; + ultimeout = psendpackage->ulendtime; + kfree(psendpackage); + + if (iKernel == 0) { + while (time_before(jiffies, ultimeout)) { +#ifdef CONFIG_MIPS + if ((pdrvctl->ulCurrBdReadPtr[iChannel] == + ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & + (SE_BDQUEUE_LEN - 1))) || + ((atomic_read(&g_sendtotallen) + *pusOutlen + + SE_FILL_LEN) > SE_MAX_SEND_LEN)) +#else + if (pdrvctl->ulCurrBdReadPtr[iChannel] == + ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & + (SE_BDQUEUE_LEN - 1))) +#endif + { + if (down_timeout(&(pdrvctl->sema), 1 * HZ)) + pr_info("down timeout\n"); + rv = WST_SE_ERROR_FULL; + } else { + rv = 0; + break; + } + } + if (rv != 0x0) { + *pucRetCode = WST_SE_ERROR_FULL; + complete(mycomplete); + goto PROG; + } + } else { + ultimeout = jiffies + 1 * HZ; + while (time_before(jiffies, ultimeout)) { +#ifdef CONFIG_MIPS + if ((pdrvctl->ulCurrBdReadPtr[iChannel] == + ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & + (SE_BDQUEUE_LEN - 1))) || + ((atomic_read(&g_sendtotallen) + *pusOutlen + + SE_FILL_LEN) > SE_MAX_SEND_LEN)) +#else + if (pdrvctl->ulCurrBdReadPtr[iChannel] == + ((pdrvctl->ulCurrBdWritePtr[iChannel] + 1) & + (SE_BDQUEUE_LEN - 1))) +#endif + { + rv = WST_SE_ERROR_FULL; + } else { + rv = 0; + break; + } + } + if (rv != 0x0) { + *pucRetCode = WST_SE_ERROR_FULL; + if (pcallback) + pcallback(pParma); + goto PROG; + } + } + ulCurrWritePtr = pdrvctl->ulCurrBdWritePtr[iChannel]; + ulWritePtr = (ulCurrWritePtr + 1) & (SE_BDQUEUE_LEN - 1); + + pCurBD = &(( + struct tagSEBasicBD *)(pdrvctl->ulBDMemBase[iChannel]))[ulCurrWritePtr]; + memset(pCurBD, 0x0, sizeof(struct tagSEBasicBD)); + if (pcallback != NULL) { + (pdrvctl->pcallback)[iChannel][ulCurrWritePtr] = pcallback; + pdrvctl->pParma[iChannel][ulCurrWritePtr] = pParma; + } else { + (pdrvctl->pcallback)[iChannel][ulCurrWritePtr] = NULL; + pdrvctl->pParma[iChannel][ulCurrWritePtr] = NULL; + } + + pdrvctl->ikernel[iChannel][ulCurrWritePtr] = iKernel; + pdrvctl->stsemphore[iChannel][ulCurrWritePtr] = mycomplete; + + if (pInPtr == pOutPtr) { + if (pOutPtr) { + len = usInlen >= *pusOutlen ? usInlen : *pusOutlen; + if (len) { + ulCurrAddrOutput = + dma_map_single(pdrvctl->pdev, pOutPtr, + len, DMA_BIDIRECTIONAL); + if (ulCurrAddrOutput == 0) { + pr_err( + "map ulCurrAddrOutput error\n"); + *pucRetCode = WST_SE_FAILURE; + if (iKernel == 0) + complete(mycomplete); + else if (pcallback) + pcallback(pParma); + goto PROG; + } + pCurBD->ulOutputLPtr = + LOULONG(ulCurrAddrOutput); + pCurBD->ulOutputHPtr = + HIULONG(ulCurrAddrOutput); + pCurBD->ulInputLPtr = pCurBD->ulOutputLPtr; + pCurBD->ulInputHPtr = pCurBD->ulOutputHPtr; + } + } + } else { + if (pOutPtr && (*pusOutlen)) { + ulCurrAddrOutput = dma_map_single(pdrvctl->pdev, + pOutPtr, *pusOutlen, + DMA_FROM_DEVICE); + if (ulCurrAddrOutput == 0) { + pr_err("map ulCurrAddrOutput error\n"); + *pucRetCode = WST_SE_FAILURE; + if (iKernel == 0) { + complete(mycomplete); + } else { + *pucRetCode = WST_SE_FAILURE; + if (pcallback) + pcallback(pParma); + } + goto PROG; + } + pCurBD->ulOutputLPtr = LOULONG(ulCurrAddrOutput); + pCurBD->ulOutputHPtr = HIULONG(ulCurrAddrOutput); + } + if (usInlen && pInPtr) { + ulCurrAddrInput = dma_map_single( + pdrvctl->pdev, pInPtr, usInlen, DMA_TO_DEVICE); + if (ulCurrAddrInput == 0) { + if (ulCurrAddrOutput) { + dma_unmap_single(pdrvctl->pdev, + ulCurrAddrOutput, + *pusOutlen, + DMA_FROM_DEVICE); + pCurBD->ulOutputLPtr = 0; + pCurBD->ulOutputHPtr = 0; + } + *pucRetCode = WST_SE_FAILURE; + if (iKernel == 0) { + complete(mycomplete); + } else { + *pucRetCode = WST_SE_FAILURE; + if (pcallback) + pcallback(pParma); + } + goto PROG; + } + pCurBD->ulInputLPtr = LOULONG(ulCurrAddrInput); + pCurBD->ulInputHPtr = HIULONG(ulCurrAddrInput); + } + } + pCurBD->ucOpCode = ucOpCode & 0x0f; + pCurBD->ucFlag = ucFlag & 0x7; + pCurBD->usInputLength = usInlen; + if (pusOutlen) + pCurBD->usOutputLength = *pusOutlen; + + pCurBD->ucRetCode = 0x0f; + + pdrvctl->pusOutlen[iChannel][ulCurrWritePtr] = pusOutlen; + pdrvctl->usInlen[iChannel][ulCurrWritePtr] = usInlen & 0xffff; + if (ulCurrAddrOutput) + pdrvctl->ulOutputPtr[iChannel][ulCurrWritePtr] = + (unsigned long *)ulCurrAddrOutput; + else + pdrvctl->ulOutputPtr[iChannel][ulCurrWritePtr] = 0; + if (ulCurrAddrInput) + pdrvctl->ulInputPtr[iChannel][ulCurrWritePtr] = + (unsigned long *)ulCurrAddrInput; + else + pdrvctl->ulInputPtr[iChannel][ulCurrWritePtr] = 0; + pdrvctl->pucRetCode[iChannel][ulCurrWritePtr] = pucRetCode; + +#ifdef CONFIG_MIPS + atomic_add( + (*(pdrvctl->pusOutlen[iChannel][ulCurrWritePtr]) + SE_FILL_LEN), + &g_sendtotallen); +#endif + write_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + if (iChannel == 0) + HandleWrite32(pdrvctl, SE_REG_BQWP0, ulWritePtr); + else + HandleWrite32(pdrvctl, SE_REG_BQWP1, ulWritePtr); + write_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + pdrvctl->ulCurrBdWritePtr[iChannel] = ulWritePtr; + goto PROG; +} + +static int se_hardtrans(struct tagSEdrvctl *pdrvctl, unsigned char *pInPtr, + unsigned short usInlen, unsigned char *pOutPtr, + unsigned short *pusOutlen, int iChannel, + unsigned char ucFlag, unsigned char ucOpCode, + unsigned char *pucRetCode, PSECallBackfn pcallback, + void *pParma, int iKernel, + struct completion *mycomplete) +{ + struct ST_SEND_PACKAGE *psendpackage; + gfp_t gfp_flag; + + if (in_interrupt()) + gfp_flag = GFP_ATOMIC; + else + gfp_flag = GFP_KERNEL; + if (g_suspend == 1) + return WST_SE_FAILURE; + psendpackage = kmalloc(sizeof(struct ST_SEND_PACKAGE), gfp_flag); + if (psendpackage == NULL) + return -1; + + psendpackage->pdrvctl = pdrvctl; + psendpackage->pInPtr = pInPtr; + psendpackage->usInlen = usInlen; + psendpackage->pOutPtr = pOutPtr; + psendpackage->pusOutlen = pusOutlen; + psendpackage->iChannel = iChannel; + psendpackage->ucFlag = ucFlag; + psendpackage->ucOpCode = ucOpCode; + psendpackage->pucRetCode = pucRetCode; + psendpackage->pcallback = pcallback; + psendpackage->pParma = pParma; + psendpackage->iKernel = iKernel; + psendpackage->mycomplete = mycomplete; + psendpackage->ulendtime = jiffies + 30 * HZ; + spin_lock_irq(&g_sendlistlock); + if (wst_Pushback_Que(&g_SendQueueContainer, psendpackage) == -1) { + spin_unlock_irq(&g_sendlistlock); + kfree(psendpackage); + return WST_SE_ERROR_FULL; + } + spin_unlock_irq(&g_sendlistlock); + queue_work(g_worksendqueue, &g_sendwork); + return 0; +} + +static irqreturn_t wst_low_channel_status(int irq, void *p) +{ + struct tagSEdrvctl *pdrvctl = p; + int64_t ulIntStat = 0; + unsigned long ulflag; + + read_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + HandleRead64(pdrvctl, SE_LOWREG_STS, &ulIntStat); + if (ulIntStat == 2) { + HandleWrite64(pdrvctl, SE_LOWINT_CLEAR, 2); + up(&g_lowirqsema); + } + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + + return IRQ_HANDLED; +} + +static int se_useropen(struct inode *inode, struct file *file) +{ + if (MINOR(inode->i_rdev) != 0) + return -ENODEV; + + return SE_OK; +} + +static ssize_t wst_low_channel_userwrite_op(struct tagSEdrvctl *pdrvctl, + struct tagSWCOMMUDATA *UserCommuData, + int iskernel) +{ + unsigned long long addr = 0, outaddr = 0; + int ilen; + int count = SE_OK; + unsigned long long ulsendlen; + unsigned char *m_pCacheInBuf; + unsigned char *m_pCacheOutBuf; + unsigned long ulflag; + + if ((g_pCacheInBuf == NULL) || (g_pCacheOutBuf == NULL)) + return -EFAULT; + + m_pCacheInBuf = + (unsigned char *)bytes_align(0, (unsigned long)g_pCacheInBuf); + m_pCacheOutBuf = + (unsigned char *)bytes_align(0, (unsigned long)g_pCacheOutBuf); + if (iskernel == 0) { + if (wst_cpyusrbuf((void *)(UserCommuData->pucInbuf), + (void *)m_pCacheInBuf, + UserCommuData->usInputLen, READUBUF)) { + pr_err("copy user data error\n"); + return -EFAULT; + } + } else + + memcpy((void *)m_pCacheInBuf, (void *)(UserCommuData->pucInbuf), + UserCommuData->usInputLen); + ilen = UserCommuData->usInputLen >= UserCommuData->usOutputLen ? + UserCommuData->usInputLen : + UserCommuData->usOutputLen; + addr = dma_map_single(pdrvctl->pdev, m_pCacheInBuf, ilen, + DMA_TO_DEVICE); + if (addr == 0) { + pr_err("transfer buffer is err\n"); + return -EFAULT; + } + outaddr = dma_map_single(pdrvctl->pdev, m_pCacheOutBuf, ilen, + DMA_FROM_DEVICE); + if (outaddr == 0) { + pr_err("transfer buffer is err\n"); + dma_unmap_single(pdrvctl->pdev, addr, ilen, DMA_TO_DEVICE); + return -EFAULT; + } + ulsendlen = (UserCommuData->usInputLen / 8); + ulsendlen = (ulsendlen & 0x00000000ffffffff) << 32; + write_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + HandleWrite64(pdrvctl, SE_WRITE_REG1, ulsendlen); + HandleWrite64(pdrvctl, SE_WRITE_REG2, addr); + HandleWrite64(pdrvctl, SE_WRITE_REG3, outaddr); + write_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + if (g_iUseIntr != 0) { + if (down_interruptible(&g_lowirqsema) == -EINTR) { + count = -EINTR; + goto EXIT; + } + } else { + unsigned long start_jiffies = 0, end_jiffies = 0; + int64_t ulIntStat = 0; + + start_jiffies = jiffies; + end_jiffies = jiffies; + while (1) { + write_lock_irqsave(&(pdrvctl->mr_lock), ulflag); + HandleRead64(pdrvctl, SE_LOWREG_SR, &ulIntStat); + end_jiffies = jiffies; + if (ulIntStat == 1) { + HandleWrite64(pdrvctl, SE_LOWREG_SR, 0); + write_unlock_irqrestore(&(pdrvctl->mr_lock), + ulflag); + break; + } + write_unlock_irqrestore(&(pdrvctl->mr_lock), ulflag); + if (jiffies_to_msecs(end_jiffies - start_jiffies) / + 1000 >= + 90) { + count = -EFAULT; + goto EXIT; + } + } + } + dma_unmap_single(pdrvctl->pdev, addr, ilen, DMA_TO_DEVICE); + dma_unmap_single(pdrvctl->pdev, outaddr, ilen, DMA_FROM_DEVICE); + if (UserCommuData->usOutputLen) { + if (iskernel == 0) { + if (wst_cpyusrbuf( + UserCommuData->pucOutbuf, m_pCacheOutBuf, + UserCommuData->usOutputLen, WRITEUBUF)) + return -EFAULT; + } else + memcpy(UserCommuData->pucOutbuf, m_pCacheOutBuf, + UserCommuData->usOutputLen); + } + return count; +EXIT: + dma_unmap_single(pdrvctl->pdev, addr, ilen, DMA_TO_DEVICE); + dma_unmap_single(pdrvctl->pdev, outaddr, ilen, DMA_FROM_DEVICE); + return count; +} + +static ssize_t se_userwrite(struct file *file, const char *buf, size_t count, + loff_t *ppos) +{ + unsigned char *pCacheBuf = NULL, *pCacheOutBuf = NULL, + *pCacheBufalign = NULL, *pCacheOutBufalign = NULL; + struct tagSEdrvctl *pdrvctl = NULL; + struct tagSWCOMMUDATA *pCommuData = NULL; + int iCommuDatalen = 0; + int pucRetCode = 0; + unsigned short iChannel = 0; + unsigned char ucFlag = 0, ucOpCode = 0; + int *ppucRetCode; + struct completion mycomplete; + struct tag_dma_buf_ctl *pbufinctl = NULL; + int iret = 0; + + if (count == 0) { + pr_err("count=0\n"); + return SE_OK; + } + + if (MINOR(file->f_path.dentry->d_inode->i_rdev) != 0) + return -ENODEV; + + iCommuDatalen = sizeof(struct tagSWCOMMUDATA); + if (count != iCommuDatalen) + return -EINVAL; + + pdrvctl = g_psechipDrvCtrl; + pCommuData = kmalloc(iCommuDatalen, GFP_KERNEL); + if (!pCommuData) { + pr_err("pCommuData NULL\n"); + return -ENOMEM; + } + if (wst_cpyusrbuf((void *)buf, (void *)pCommuData, iCommuDatalen, + READUBUF)) { + pr_err("copy user data error\n"); + count = -EFAULT; + goto EXIT; + } + switch ((pCommuData->usFlags) & 0x000f) { + case WST_GO_CHANNEL2: + if ((pCommuData->usInputLen > DMA_BUFSIZE) || + (pCommuData->usOutputLen > DMA_BUFSIZE)) { + pr_err("len is error\n"); + count = -EINVAL; + goto EXIT; + } + if (down_interruptible(&g_lowsema) == -EINTR) { + count = -EINTR; + goto EXIT; + } + count = wst_low_channel_userwrite_op(pdrvctl, pCommuData, 0); + up(&g_lowsema); + goto EXIT; + case WST_GO_CHANNEL0: + if (pCommuData->usInputLen == 0) { + count = -EINVAL; + goto EXIT; + } + if (pCommuData->usInputLen != 0) { + if (pCommuData->usInputLen > DMA_BUFSIZE) { + count = -EINVAL; + goto EXIT; + } + ucFlag = INPUT_VALID; + if (pCommuData->usOutputLen) + ucFlag |= OUTPUT_VALID; + } + + iChannel = 0; + ucOpCode = 0x0; + break; + case WST_GO_CHANNEL1: + if (pCommuData->usInputLen == 0) { + count = -EINVAL; + goto EXIT; + } + if (pCommuData->usInputLen != 0) { + if (pCommuData->usInputLen > DMA_BUFSIZE) { + count = -EINVAL; + goto EXIT; + } + ucFlag = INPUT_VALID; + if (pCommuData->usOutputLen) + ucFlag |= OUTPUT_VALID; + } + iChannel = 1; + ucOpCode = 0x0; + break; + default: { + count = -EINVAL; + goto EXIT; + } + } + pbufinctl = se_get_dma_buf(0); + if (pbufinctl == NULL) { + pr_err("kmalloc pCacheBuf error\n"); + count = -ENOMEM; + goto EXIT; + } + pCacheBuf = pbufinctl->pDmaBuf; + pCacheBufalign = pCacheBuf; + + if (wst_cpyusrbuf((void *)(pCommuData->pucInbuf), + (void *)pCacheBufalign, pCommuData->usInputLen, + READUBUF)) { + pr_err("cpyuserbuf pCacheBufalign error\n"); + count = -ENOMEM; + goto EXIT; + } + + pCacheOutBuf = pbufinctl->pDmaBuf; + pCacheOutBufalign = pCacheOutBuf; + + ppucRetCode = &pucRetCode; + + count = SE_OK; + init_completion(&mycomplete); + iret = se_hardtrans(pdrvctl, pCacheBufalign, pCommuData->usInputLen, + pCacheOutBufalign, &(pCommuData->usOutputLen), + iChannel, ucFlag, ucOpCode, + (unsigned char *)ppucRetCode, 0, 0, 0, &mycomplete); + if (iret == -1) { + count = -EIO; + goto EXIT; + } + if (!wait_for_completion_timeout(&mycomplete, + msecs_to_jiffies(60 * 1000))) { + count = -EFAULT; + goto EXIT; + } + if (pucRetCode != SE_OK) { + count = -(SE_BASEERR + pucRetCode); + goto EXIT; + } + + if (pCommuData->pucOutbuf) { + if (wst_cpyusrbuf(pCommuData->pucOutbuf, pCacheOutBufalign, + pCommuData->usOutputLen, WRITEUBUF)) { + count = -EFAULT; + goto EXIT; + } + } +EXIT: + if (pbufinctl) + se_free_dma_buf(pbufinctl); + kfree(pCommuData); + return count; +} +static void globalmem_do_rec_op(struct work_struct *p) +{ + struct ST_INT_MESSAGE *intmessage; + unsigned long ulflags1; + + while (1) { + spin_lock_irqsave(&g_reclistlock, ulflags1); + intmessage = + (struct ST_INT_MESSAGE *)wst_Popfront_Que(&g_RecQueueContainer); + spin_unlock_irqrestore(&g_reclistlock, ulflags1); + if (!intmessage) + return; + intmessage->pcallback(intmessage->pParma); + kfree(intmessage); + } +} +static irqreturn_t se_interrupt(int irq, void *p) +{ + struct tagSEdrvctl *pdrvctl; + struct tagSEBasicBD *pCurBD; + unsigned int ulCurrReadPtr, ulReadPtr; + int iChannel; + int len = 0; + int i; + unsigned char ucMyRetCode = 0; + unsigned long ulIntStat; + int istatus[2] = { 1, 2 }; + unsigned long ulflags; + + pdrvctl = p; + if (!pdrvctl) + return IRQ_HANDLED; + + read_lock_irqsave(&(pdrvctl->mr_lock), ulflags); + HandleRead32(pdrvctl, SE_REG_STS, &ulIntStat); + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflags); + if ((!(ulIntStat & INT_STAT_DMA_MASK)) || (ulIntStat == 0xffffffff)) + return IRQ_HANDLED; + + i = 0; +loop: + if (ulIntStat & istatus[i]) { + if (i == 0) { + read_lock_irqsave(&(pdrvctl->mr_lock), ulflags); + HandleWrite32(pdrvctl, SE_INT_CLR, 1); + HandleRead32(pdrvctl, SE_REG_RQRP0, &ulReadPtr); + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflags); + iChannel = 0; + } else { + read_lock_irqsave(&(pdrvctl->mr_lock), ulflags); + HandleWrite32(pdrvctl, SE_INT_CLR, 2); + HandleRead32(pdrvctl, SE_REG_RQRP1, &ulReadPtr); + read_unlock_irqrestore(&(pdrvctl->mr_lock), ulflags); + iChannel = 1; + } + } else { + if (i == 0) { + i++; + goto loop; + } else + return IRQ_HANDLED; + } + ulCurrReadPtr = pdrvctl->ulCurrReadPtr[iChannel]; +loop2: + if (ulCurrReadPtr != ulReadPtr) { + pCurBD = &((struct tagSEBasicBD *)(pdrvctl->ulBDMemBase[iChannel])) + [ulCurrReadPtr]; + if ((pCurBD->ucRetCode == 0x0f) || + ((pCurBD->ucFlag & 0x8) != 0x8)) { + goto loop2; + } else { + if (pdrvctl->ulInputPtr[iChannel][ulCurrReadPtr] == + pdrvctl->ulOutputPtr[iChannel][ulCurrReadPtr]) { + if (pdrvctl->ulOutputPtr[iChannel] + [ulCurrReadPtr]) { + len = (*(pdrvctl->pusOutlen + [iChannel] + [ulCurrReadPtr])) >= + pdrvctl->usInlen + [iChannel] + [ulCurrReadPtr] ? + (*(pdrvctl->pusOutlen + [iChannel] + [ulCurrReadPtr])) : + pdrvctl->usInlen + [iChannel] + [ulCurrReadPtr]; + dma_unmap_single( + pdrvctl->pdev, + (unsigned long)(pdrvctl->ulOutputPtr + [iChannel] + [ulCurrReadPtr]), + len, DMA_BIDIRECTIONAL); + pCurBD->ulOutputLPtr = 0; + pCurBD->ulOutputHPtr = 0; + pCurBD->ulInputHPtr = 0; + pCurBD->ulInputLPtr = 0; + pdrvctl->ulOutputPtr[iChannel] + [ulCurrReadPtr] = 0; + } + } else { + if (pdrvctl->ulOutputPtr[iChannel] + [ulCurrReadPtr]) { + dma_unmap_single( + pdrvctl->pdev, + (unsigned long)(pdrvctl->ulOutputPtr + [iChannel] + [ulCurrReadPtr]), + *(pdrvctl->pusOutlen + [iChannel] + [ulCurrReadPtr]), + DMA_FROM_DEVICE); + /* WMB */ + smp_wmb(); + pdrvctl->ulOutputPtr[iChannel] + [ulCurrReadPtr] = 0; + } + if (pdrvctl->ulInputPtr[iChannel] + [ulCurrReadPtr]) { + dma_unmap_single( + pdrvctl->pdev, + (unsigned long)(pdrvctl->ulInputPtr + [iChannel] + [ulCurrReadPtr]), + pdrvctl->usInlen[iChannel] + [ulCurrReadPtr], + DMA_TO_DEVICE); + pdrvctl->ulInputPtr[iChannel] + [ulCurrReadPtr] = 0; + } + } + ucMyRetCode = pCurBD->ucRetCode; + memcpy(pdrvctl->pucRetCode[iChannel][ulCurrReadPtr], + &ucMyRetCode, 1); + if (pCurBD->ucRetCode != SE_OK) + pr_info("\nstatus %x\n", pCurBD->ucRetCode); +#ifdef CONFIG_MIPS + atomic_sub(((*(pdrvctl->pusOutlen[iChannel] + [ulCurrReadPtr])) + + SE_FILL_LEN), + &g_sendtotallen); +#endif + if ((pdrvctl->ikernel)[iChannel][ulCurrReadPtr] != 0) { + if (pdrvctl->pcallback[iChannel][ulCurrReadPtr]) { + struct ST_INT_MESSAGE *intmessage = NULL; + unsigned long ulflags1; + + intmessage = + kmalloc(sizeof(struct ST_INT_MESSAGE), + GFP_ATOMIC); + if (!intmessage) + return IRQ_HANDLED; + intmessage->pcallback = + pdrvctl->pcallback[iChannel] + [ulCurrReadPtr]; + intmessage->pParma = + pdrvctl->pParma[iChannel] + [ulCurrReadPtr]; + spin_lock_irqsave(&g_reclistlock, + ulflags1); + wst_Pushback_Que(&g_RecQueueContainer, + intmessage); + spin_unlock_irqrestore(&g_reclistlock, + ulflags1); + queue_work(g_workrecqueue, &g_recwork); + } + } else { + complete(pdrvctl->stsemphore[iChannel] + [ulCurrReadPtr]); + } + ulCurrReadPtr = + ((ulCurrReadPtr + 1) & (SE_BDQUEUE_LEN - 1)); + pdrvctl->ulCurrReadPtr[iChannel] = ulCurrReadPtr; + pdrvctl->ulCurrBdReadPtr[iChannel] = ulCurrReadPtr; + if (pdrvctl->sema.count <= 0) + up(&(pdrvctl->sema)); + } + } + if (i == 0) { + i++; + goto loop; + } else + return IRQ_HANDLED; + + return IRQ_HANDLED; +} + +static int se_userrelease(struct inode *inode, struct file *file) +{ + return SE_OK; +} + +ssize_t se_kernelwrite(unsigned char *pInPtr, unsigned short usInlen, + unsigned char *pOutPtr, unsigned short *pusOutlen, + unsigned char ucFlag, unsigned char *pucRetCode, + PSECallBackfn pcallback, void *pParma) +{ + int iret; + struct tagSEdrvctl *pdrvctl; + int iChannel; + unsigned char ucOpCode; + struct tagSWCOMMUDATA CommuData; + + pdrvctl = g_psechipDrvCtrl; + + switch (ucFlag) { + case WST_GO_CHANNEL2: { + CommuData.pucInbuf = pInPtr; + CommuData.pucOutbuf = pOutPtr; + CommuData.usFlags = 0; + CommuData.usInputLen = usInlen; + CommuData.usOutputLen = *pusOutlen; + CommuData.usReserve = 0; + if (down_interruptible(&g_lowsema) == -EINTR) + return -EINTR; + iret = wst_low_channel_userwrite_op(pdrvctl, &CommuData, 1); + up(&g_lowsema); + return iret; + } + case WST_GO_CHANNEL0: + if (pcallback == NULL) + return WST_SE_PARAM_ERROR; + if (usInlen == 0) + return -EINVAL; + ucFlag = 0; + if (usInlen != 0) { + if (usInlen > DMA_BUFSIZE) + return -EINVAL; + ucFlag = INPUT_VALID; + if (*pusOutlen) + ucFlag |= OUTPUT_VALID; + } + iChannel = 0; + ucOpCode = 0x0; + break; + case WST_GO_CHANNEL1: + if (pcallback == NULL) + return WST_SE_PARAM_ERROR; + if (usInlen == 0) + return -EINVAL; + ucFlag = 0; + if (usInlen != 0) { + if (usInlen > DMA_BUFSIZE) + return -EINVAL; + ucFlag = INPUT_VALID; + if (*pusOutlen) + ucFlag |= OUTPUT_VALID; + } + iChannel = 1; + ucOpCode = 0x0; + break; + default: + return -EINVAL; + } + iret = se_hardtrans(pdrvctl, pInPtr, usInlen, pOutPtr, pusOutlen, + iChannel, ucFlag, ucOpCode, pucRetCode, pcallback, + pParma, 1, NULL); + if (iret == -1) + return -EIO; + + return SE_OK; +} +EXPORT_SYMBOL(se_kernelwrite); + +static long se_userioctl(struct file *filp, u_int cmd, u_long arg) +{ + long iret = SE_OK; + struct tagSEdrvctl *pdrvctl = g_psechipDrvCtrl; + unsigned long ulvalue; + + HandleRead64(pdrvctl, 0x120, &ulvalue); + pr_info("read reg value is 0x%lx in offset 120\n", ulvalue); + HandleRead64(pdrvctl, 0x118, &ulvalue); + pr_info("read reg value is 0x%lx in offset 118\n", ulvalue); + + return iret; +} + +static const struct file_operations SE_fops = { .owner = THIS_MODULE, + .write = se_userwrite, + .open = se_useropen, + .release = se_userrelease, + .unlocked_ioctl = se_userioctl, + .compat_ioctl = se_userioctl }; + +int se_chip_load(void) +{ + int iRes = SE_OK; + + if (g_isechip_Major >= 0) + return WST_SE_HAS_OPEN; + g_psechipDrvCtrl = NULL; + iRes = se_init_dma_buf(DMA_BUFSIZE, CTL_DMABUFNUM); + if (iRes != SE_OK) + return WST_SE_ERROR_MALLOC; + iRes = register_chrdev(0, CRYNAME, &SE_fops); + if (iRes < 0) + goto EXIT; + + g_isechip_Major = iRes; + iRes = 0; + g_psecclass = class_create(CRYNAME); + if (IS_ERR(g_psecclass)) { + iRes = PTR_ERR(g_psecclass); + goto EXIT; + } + g_psecdev = device_create(g_psecclass, NULL, MKDEV(g_isechip_Major, 0), + NULL, CRYNAME); + if (IS_ERR(g_psecdev)) { + iRes = PTR_ERR(g_psecdev); + goto EXIT; + } + iRes = wst_init(); + if (iRes != SE_OK) + goto EXIT; + + sema_init(&g_lowsema, 1); + sema_init(&g_lowirqsema, 0); + atomic_set(&g_sendtotallen, 0); + g_pCacheInBuf = (unsigned char *)__get_free_page(GFP_DMA); + if (IS_ERR(g_pCacheInBuf)) { + iRes = PTR_ERR(g_pCacheInBuf); + goto EXIT; + } + g_pCacheOutBuf = (unsigned char *)__get_free_page(GFP_DMA); + if (IS_ERR(g_pCacheOutBuf)) { + iRes = PTR_ERR(g_pCacheOutBuf); + goto EXIT; + } + + g_worksendqueue = + alloc_workqueue("seworksendqueue", + WQ_MEM_RECLAIM | __WQ_ORDERED | WQ_UNBOUND, 1); + if (IS_ERR(g_worksendqueue)) { + iRes = PTR_ERR(g_worksendqueue); + goto EXIT; + } + g_workrecqueue = alloc_workqueue("seworkrecqueue", + WQ_MEM_RECLAIM | __WQ_ORDERED, 0); + if (IS_ERR(g_workrecqueue)) { + iRes = PTR_ERR(g_workrecqueue); + goto EXIT; + } + INIT_WORK(&g_recwork, globalmem_do_rec_op); + INIT_WORK(&g_sendwork, globalmem_do_send_op); + pr_info("this driver version is %s\n", DRIVER_VERSION); + + return SE_OK; +EXIT: + se_del_dma_buf(); + if (g_pCacheInBuf) { + free_page((unsigned long)g_pCacheInBuf); + g_pCacheInBuf = NULL; + } + if (g_pCacheOutBuf) { + free_page((unsigned long)g_pCacheOutBuf); + g_pCacheOutBuf = NULL; + } + if (g_worksendqueue) { + destroy_workqueue(g_worksendqueue); + g_worksendqueue = NULL; + } + if (g_workrecqueue) { + destroy_workqueue(g_workrecqueue); + g_workrecqueue = NULL; + } + wst_clear(); + if (g_psecdev) { + device_unregister(g_psecdev); + g_psecdev = NULL; + } + if (g_psecclass) { + class_destroy(g_psecclass); + g_psecclass = NULL; + } + if (g_isechip_Major >= 0) { + unregister_chrdev(g_isechip_Major, CRYNAME); + g_isechip_Major = -1; + } + return iRes; +} + +void se_chip_unload(void) +{ + struct tagSEdrvctl *pdrvctl = NULL; + + pdrvctl = g_psechipDrvCtrl; + + up(&pdrvctl->sema); + if (g_pCacheInBuf) { + free_page((unsigned long)g_pCacheInBuf); + g_pCacheInBuf = NULL; + } + if (g_pCacheOutBuf) { + free_page((unsigned long)g_pCacheOutBuf); + g_pCacheOutBuf = NULL; + } + if (g_worksendqueue) { + cancel_work_sync(&g_sendwork); + destroy_workqueue(g_worksendqueue); + g_worksendqueue = NULL; + } + if (g_workrecqueue) { + cancel_work_sync(&g_recwork); + destroy_workqueue(g_workrecqueue); + g_workrecqueue = NULL; + } + wst_clear(); + if (g_psecdev) { + device_destroy(g_psecclass, MKDEV(g_isechip_Major, 0)); + g_psecdev = NULL; + } + if (g_psecclass) { + class_destroy(g_psecclass); + g_psecclass = NULL; + } + if (g_isechip_Major >= 0) { + unregister_chrdev(g_isechip_Major, CRYNAME); + g_isechip_Major = -1; + } + se_del_dma_buf(); +} + +static int loongson_cryp_get_irq(struct platform_device *pdev, char *pat) +{ + int i; + struct resource *res = pdev->resource; + + for (i = 0; i < pdev->num_resources; i++) { + if (strcmp(res[i].name, pat) == 0) + return res[i].start; + } + return -1; +} +static int loongson_cryp_probe(struct platform_device *pdev) +{ + int i; + + if (ACPI_COMPANION(&pdev->dev)) { + se_irq[0].irq = platform_get_irq(pdev, 1); + se_irq[1].irq = platform_get_irq(pdev, 0); + } else { + for (i = 0; i < pdev->num_resources; i++) { + se_irq[i].irq = + loongson_cryp_get_irq(pdev, se_irq[i].pat); + if (se_irq[i].irq < 0) { + pr_warn("ERROR:sedriver get irq failed\n"); + return -1; + } + } + } + + return se_chip_load(); +} +static int loongson_cryp_remove(struct platform_device *pdev) +{ + se_chip_unload(); + return 0; +} +static int loongson_cryp_suspend(struct platform_device *pdev, + pm_message_t state) +{ + g_suspend = 1; + cancel_work_sync(&g_recwork); + cancel_work_sync(&g_sendwork); + flush_work(&g_recwork); + flush_work(&g_sendwork); + se_chip_unload(); + return 0; +} + +static int loongson_cryp_resume(struct platform_device *pdev) +{ + int i; + + g_suspend = 0; + g_worksendqueue = NULL; + g_workrecqueue = NULL; + g_isechip_Major = -1; + g_pCacheInBuf = NULL; + g_pCacheOutBuf = NULL; + g_iUseIntr = 1; + spin_lock_init(&g_reclistlock); + spin_lock_init(&g_sendlistlock); + spin_lock_init(&g_getdmabuflock); + + for (i = 0; i < pdev->num_resources; i++) { + se_irq[i].irq = loongson_cryp_get_irq(pdev, se_irq[i].pat); + + if (se_irq[i].irq < 0) { + pr_warn("ERROR:sedriver get irq failed\n"); + return -1; + } + } + se_chip_load(); + return 0; +} + +static const struct acpi_device_id loongson_cryp_acpi_match[] = { { "LOON0003" }, + {} }; +MODULE_DEVICE_TABLE(acpi, loongson_cryp_acpi_match); + +static struct platform_driver loongson_cryp_driver = { + .probe = loongson_cryp_probe, + .remove = loongson_cryp_remove, + .suspend = loongson_cryp_suspend, + .resume = loongson_cryp_resume, + .driver = { + .name = "loongson3_crypto", + .acpi_match_table = ACPI_PTR(loongson_cryp_acpi_match), + }, +}; + +static int __init initmodule(void) +{ + return platform_driver_register(&loongson_cryp_driver); +} + +static void __exit exitmodule(void) +{ + platform_driver_unregister(&loongson_cryp_driver); +} + +module_init(initmodule); +module_exit(exitmodule); + +MODULE_ALIAS("platform:loongson3_crypto"); +MODULE_AUTHOR("dcm"); +MODULE_DESCRIPTION("se encryption chip driver Co westone"); +MODULE_VERSION(DRIVER_VERSION); +MODULE_LICENSE("GPL"); diff --git a/drivers/crypto/sedriver/wst_se_echip_driver.h b/drivers/crypto/sedriver/wst_se_echip_driver.h new file mode 100644 index 000000000000..4371738da465 --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_echip_driver.h @@ -0,0 +1,169 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _WST_SE_ECHIP_DRIVER_H +#define _WST_SE_ECHIP_DRIVER_H +#include "wst_se_ktrans.h" + +#define CRYNAME "wst-se" + +#define SWBUFNUM 512 +#define SWCHANNELNUM 2 +#define CTL_DMABUFNUM 512 + +#define DMA_MASK 0xffffffff +#define SE_DMA_CONTROL_RESET 0x80000000 +#define SE_DMA_CONTROL_SET 0x00000000 + +#define SE_BASEERR 1000 + +#define SE_MAX_SEND_LEN (3 * 2048) +#define SE_FILL_LEN 48 +#define SE_BD_LENGTH sizeof(struct tagSEBasicBD) +#define SE_BDQUEUE_LEN SWBUFNUM +#define DMA0_CTRL_CHANNEL_ENABLE 1 +#define DMA0_CTRL_CHANNEL_DISABLE 0xfffffffe +#define DMA1_CTRL_CHANNEL_ENABLE 2 +#define DMA1_CTRL_CHANNEL_DISABLE 0xfffffffd + +#define SE_REG_RESET 0 +#define SE_REG_STS 0x08 +#define SE_INT_CTRL 0x10 +#define SE_REG_MSK 0x18 +#define SE_INT_CLR 0x20 + +#define SE_LREG_BQBA0 0x100 +#define SE_HREG_BQBA0 0x108 +#define SE_REG_BQS0 0x110 +#define SE_REG_BQWP0 0x118 +#define SE_REG_RQRP0 0x120 + +#define SE_LREG_BQBA1 0x128 +#define SE_HREG_BQBA1 0x130 +#define SE_REG_BQS1 0x138 +#define SE_REG_BQWP1 0x140 +#define SE_REG_RQRP1 0x148 + +#define SE_WRITE_REG1 0x200 +#define SE_WRITE_REG2 0x208 +#define SE_WRITE_REG3 0x210 +#define SE_LOWREG_STS 0x240 +#define SE_LOWINT_CLEAR 0x248 +#define SE_LOWREG_INQ 0x1600 +#define SE_LOWREG_SR 0x1608 +#define INPUT_VALID 0x4 +#define OUTPUT_VALID 0x8 +#define SE_LOWINT_CLR 0x228 +#define INT_STAT_DMA0_PACK_DONE 1 +#define INT_STAT_DMA1_PACK_DONE 2 +#define INT_STAT_DMA_MASK (INT_STAT_DMA0_PACK_DONE | INT_STAT_DMA1_PACK_DONE) + +struct tagSEdrvctl { + unsigned long ulMemBase; + struct device *pdev; + struct device dev; + unsigned int ulCurrBdReadPtr[SWCHANNELNUM]; + unsigned int ulCurrBdWritePtr[SWCHANNELNUM]; + unsigned int ulCurrReadPtr[SWCHANNELNUM]; + unsigned int ulCurrWritePtr[SWCHANNELNUM]; + PSECallBackfn pcallback[SWCHANNELNUM][SWBUFNUM]; + void *pParma[SWCHANNELNUM][SWBUFNUM]; + struct completion *stsemphore[SWCHANNELNUM][SWBUFNUM]; + int ikernel[SWCHANNELNUM][SWBUFNUM]; + unsigned long ulBDMemBasePhy[SWCHANNELNUM]; + unsigned long ulBDMemBase[SWCHANNELNUM]; + unsigned short *pusOutlen[SWCHANNELNUM][SWBUFNUM]; + unsigned short usInlen[SWCHANNELNUM][SWBUFNUM]; + unsigned long *ulOutputPtr[SWCHANNELNUM][SWBUFNUM]; + unsigned long *ulInputPtr[SWCHANNELNUM][SWBUFNUM]; + unsigned char *pucRetCode[SWCHANNELNUM][SWBUFNUM]; + rwlock_t mr_lock; + rwlock_t mr_lowlock; + spinlock_t readlock; + struct semaphore sema; + int iIrq; + int ilowIrq; +}; + +struct tagSEBasicBD { + unsigned int ucOpCode : 4, ucFlag : 4, ucRetCode : 8, ucInCtxLength : 8, + ucOutCtxLength : 8; + unsigned int usInputLength : 16, usOutputLength : 16; + unsigned int ulCtxLPtr; + unsigned int ulCtxHPtr; + unsigned int ulInputLPtr; + unsigned int ulInputHPtr; + unsigned int ulOutputLPtr; + unsigned int ulOutputHPtr; + +}; + +#define SW_CONT_BUF_SIZE 0x100 +#define DMA_BUFSIZE 0x1000 + +#define PAGE_NUM (DMA_BUFSIZE / PAGE_SIZE + 1) + +struct _SW_GET_STAT { + unsigned long TXD; + unsigned long RXD; +}; + +DEFINE_SPINLOCK(g_writelock); + +#define HandleRead32(handle, addr, pData) \ + do { /* MB */ \ + smp_mb(); \ + *(pData) = readl((void *)(handle->ulMemBase + addr)); \ + } while (0) + +#define HandleWrite32(handle, addr, value) \ + do { \ + writel(value, (void *)(handle->ulMemBase + addr)); \ + /* MB */ \ + smp_mb(); \ + } while (0) + +#define HandleRead64(handle, addr, pData) \ + do { /* MB */ \ + smp_mb(); \ + *(pData) = readq((void *)(handle->ulMemBase + addr)); \ + } while (0) + +#define HandleWrite64(handle, addr, value) \ + do { \ + writeq(value, (void *)(handle->ulMemBase + addr)); \ + /* MB */ \ + smp_mb(); \ + } while (0) + +#define SPRINTF sprintf + +#define HIULONG(w) \ + ((unsigned int)((((unsigned long long)w) >> 32) & 0x00000000ffffffff)) +#define LOULONG(w) ((unsigned int)((unsigned long long)w) & 0x00000000ffffffff) + +#define HIBYTE(w) ((unsigned char)(((unsigned short)(w) >> 8) & 0xFF)) +#define LOBYTE(w) ((unsigned char)(w)) + +struct ST_SEND_PACKAGE { + struct list_head list; + struct tagSEdrvctl *pdrvctl; + unsigned char *pInPtr; + unsigned short usInlen; + unsigned char *pOutPtr; + unsigned short *pusOutlen; + int iChannel; + unsigned char ucFlag; + unsigned char ucOpCode; + unsigned char *pucRetCode; + PSECallBackfn pcallback; + void *pParma; + int iKernel; + struct completion *mycomplete; + unsigned long ulendtime; +}; + +struct ST_INT_MESSAGE { + struct list_head list; + PSECallBackfn pcallback; + void *pParma; +}; +#endif diff --git a/drivers/crypto/sedriver/wst_se_ktrans.h b/drivers/crypto/sedriver/wst_se_ktrans.h new file mode 100644 index 000000000000..2eea0f1f2d1e --- /dev/null +++ b/drivers/crypto/sedriver/wst_se_ktrans.h @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _WST_SE_KTRANS_H +#define _WST_SE_KTRANS_H + +#include "wst_se_common_type.h" +#include "wst_se_define.h" + +struct tagSWCOMMUDATA { + unsigned short usFlags; + unsigned short usInputLen; + unsigned short usOutputLen; + unsigned short usReserve; + unsigned char *pucInbuf; + unsigned char *pucOutbuf; +}; + +#endif -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-47668
by Gu Bowen 29 Apr '25

29 Apr '25

CVE fix. Alejandro Concepcion Rodriguez (1): can: dev: can_restart(): post buffer from the right context Vincent Mailhol (1): can: dev: can_restart: fix use after free bug drivers/net/can/dev/dev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] Revert "LoongArch: Set hugetlb mmap base address aligned with pmd size"
by Hongchen Zhang 29 Apr '25

29 Apr '25

LoongArch inclusion category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC4SOE CVE: NA -------------------------------- This reverts commit fac59827a853a747becd1234249a3d64b7916fa8. Signed-off-by: Bibo Mao <maobibo(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/mm/mmap.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/arch/loongarch/mm/mmap.c b/arch/loongarch/mm/mmap.c index 01c20564f4b6..a9630a81b38a 100644 --- a/arch/loongarch/mm/mmap.c +++ b/arch/loongarch/mm/mmap.c @@ -3,7 +3,6 @@ * Copyright (C) 2020-2022 Loongson Technology Corporation Limited */ #include <linux/export.h> -#include <linux/hugetlb.h> #include <linux/io.h> #include <linux/memblock.h> #include <linux/mm.h> @@ -63,11 +62,8 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp, } info.length = len; + info.align_mask = do_color_align ? (PAGE_MASK & SHM_ALIGN_MASK) : 0; info.align_offset = pgoff << PAGE_SHIFT; - if (filp && is_file_hugepages(filp)) - info.align_mask = huge_page_mask_align(filp); - else - info.align_mask = do_color_align ? (PAGE_MASK & SHM_ALIGN_MASK) : 0; if (dir == DOWN) { info.flags = VM_UNMAPPED_AREA_TOPDOWN; -- 2.33.0

2 1

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7bd21c560a6f5df598200cc367cad1a683cef8ef commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250429/202504291127.BVuV3Rjt-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504291127.BVuV3Rjt-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] PCI/ASPM: Fix link state exit during switch upstream function removal
by Qi Xi 29 Apr '25

29 Apr '25

From: Daniel Stodden <daniel.stodden(a)gmail.com> mainline inclusion from mainline-v6.15-rc1 commit cbf937dcadfd571a434f8074d057b32cd14fbea5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QT2 CVE: CVE-2024-58093 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM link only after the last function on the bus pertaining to the given link was removed. That was too late. If function 0 is removed before sibling function, link->downstream would point to free'd memory after. After above change, we freed the ASPM parent link state upon any function removal on the bus pertaining to a given link. That is too early. If the link is to a PCIe switch with MFD on the upstream port, then removing functions other than 0 first would free a link which still remains parent_link to the remaining downstream ports. The resulting GPFs are especially frequent during hot-unplug, because pciehp removes devices on the link bus in reverse order. On that switch, function 0 is the virtual P2P bridge to the internal bus. Free exactly when function 0 is removed -- before the parent link is obsolete, but after all subordinate links are gone. Link: https://lore.kernel.org/r/e12898835f25234561c9d7de4435590d957b85d9.17349248… Fixes: 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free") Signed-off-by: Daniel Stodden <dns(a)arista.com> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> [kwilczynski: commit log] Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Conflicts: drivers/pci/pcie/aspm.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/pci/pcie/aspm.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c index a4b78c2bfc40..5add61365b2b 100644 --- a/drivers/pci/pcie/aspm.c +++ b/drivers/pci/pcie/aspm.c @@ -977,16 +977,16 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) parent_link = link->parent; /* - * link->downstream is a pointer to the pci_dev of function 0. If - * we remove that function, the pci_dev is about to be deallocated, - * so we can't use link->downstream again. Free the link state to - * avoid this. + * Free the parent link state, no later than function 0 (i.e. + * link->downstream) being removed. * - * If we're removing a non-0 function, it's possible we could - * retain the link state, but PCIe r6.0, sec 7.5.3.7, recommends - * programming the same ASPM Control value for all functions of - * multi-function devices, so disable ASPM for all of them. + * Do not free the link state any earlier. If function 0 is a + * switch upstream port, this link state is parent_link to all + * subordinate ones. */ + if (pdev != link->downstream) + goto out; + pcie_config_aspm_link(link, 0); list_del(&link->sibling); free_link_state(link); @@ -999,6 +999,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) pcie_aspm_update_sysfs_visibility(parent); +out: mutex_unlock(&aspm_lock); up_read(&pci_bus_sem); } -- 2.33.0

2 1

[PATCH OLK-6.6 v2] tracing: Verify event formats that have "%*p.."
by Pu Lehui 29 Apr '25

29 Apr '25

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.15-rc1 commit ea8d7647f9ddf1f81e2027ed305299797299aa03 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4TFV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself or in data that will never be freed. If an event references data that was allocated when the event triggered and that same data is freed before the event is read, then the kernel can crash by reading freed memory. The verifier runs at boot up (or module load) and scans the print formats of the events and checks their arguments to make sure that dereferenced pointers are safe. If the format uses "%*p.." the verifier will ignore it, and that could be dangerous. Cover this case as well. Also add to the sample code a use case of "%*pbl". Link: https://lore.kernel.org/all/bcba4d76-2c3f-4d11-baf0-02905db953dd@oracle.com/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Fixes: 5013f454a352c ("tracing: Add check of trace event print fmts for dereferencing pointers") Link: https://lore.kernel.org/20250327195311.2d89ec66@gandalf.local.home Reported-by: Libo Chen <libo.chen(a)oracle.com> Reviewed-by: Libo Chen <libo.chen(a)oracle.com> Tested-by: Libo Chen <libo.chen(a)oracle.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace_events.c samples/trace_events/trace-events-sample.h [The conflicts were due to some minor issues] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/trace_events.c | 7 +++++++ samples/trace_events/trace-events-sample.h | 8 ++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 9d22745cdea5..f2e07d470784 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -470,6 +470,7 @@ static void test_event_printk(struct trace_event_call *call) case '%': continue; case 'p': + do_pointer: /* Find dereferencing fields */ switch (fmt[i + 1]) { case 'B': case 'R': case 'r': @@ -498,6 +499,12 @@ static void test_event_printk(struct trace_event_call *call) continue; if (fmt[i + j] == '*') { star = true; + /* Handle %*pbl case */ + if (!j && fmt[i + 1] == 'p') { + arg++; + i++; + goto do_pointer; + } continue; } if ((fmt[i + j] == 's')) { diff --git a/samples/trace_events/trace-events-sample.h b/samples/trace_events/trace-events-sample.h index 1c6b843b8c4e..6a5d4717f37a 100644 --- a/samples/trace_events/trace-events-sample.h +++ b/samples/trace_events/trace-events-sample.h @@ -315,7 +315,8 @@ TRACE_EVENT(foo_bar, __assign_cpumask(cpum, cpumask_bits(mask)); ), - TP_printk("foo %s %d %s %s %s %s (%s) (%s) %s", __entry->foo, __entry->bar, + TP_printk("foo %s %d %s %s %s %s (%s) (%s) %s [%d] %*pbl", + __entry->foo, __entry->bar, /* * Notice here the use of some helper functions. This includes: @@ -360,7 +361,10 @@ TRACE_EVENT(foo_bar, __get_dynamic_array_len(list) / sizeof(int), sizeof(int)), __get_str(str), __get_bitmask(cpus), __get_cpumask(cpum), - __get_str(vstr)) + __get_str(vstr), + __get_dynamic_array_len(cpus), + __get_dynamic_array_len(cpus), + __get_dynamic_array(cpus)) ); /* -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2022-49429
by Yongqiang Liu 29 Apr '25

29 Apr '25

CVE-2022-49429 Douglas Miller (1): RDMA/hfi1: Prevent panic when SDMA is disabled drivers/infiniband/hw/hfi1/file_ops.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49626
by Yongqiang Liu 29 Apr '25

29 Apr '25

CVE-2022-49626 Íñigo Huguet (2): sfc: error code if SRIOV cannot be disabled sfc: fix use after free when disabling sriov drivers/net/ethernet/sfc/ef10_sriov.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] mpage: fix softlockup in mpage_readahead()
by Zheng Qixing 29 Apr '25

29 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBYXQD --------------------------- When using null_blk with a large readahead window, calling madvise to trigger readahead can lead to system softlocks. This occurs because the CPU can remain in the mpage_readahead loop for extended periods without rescheduling, preventing other processes from running. The issue manifests as follows: Call Trace: bio_add_page+0x7f/0x120 bio_add_folio+0x24/0x40 do_mpage_readpage+0x6de/0xbc0 xas_load+0x1e/0x240 xa_load+0x8f/0xf0 mpage_readahead+0xe7/0x230 __pfx_blkdev_get_block+0x10/0x10 blkdev_readahead+0x14/0x30 read_pages+0x71/0x460 folio_add_lru+0x6a/0x140 ? filemap_add_folio+0xb6/0x190 page_cache_ra_unbounded+0x197/0x2a0 do_page_cache_ra+0x42/0x70 page_cache_ra_order+0x360/0x610 filemap_fault+0x7d8/0x1200 __do_fault+0x3e/0x380 do_pte_missing+0x628/0x1cd0 ? __pte_offset_map+0x1a/0x200 __handle_mm_fault+0x7f2/0x19b0 ? __pte_offset_map+0x1a/0x200 ? __pte_offset_map_lock+0x78/0x170 handle_mm_fault+0x275/0x560 __get_user_pages+0x1f0/0xbd0 faultin_page_range+0xae/0x460 madvise_vma_behavior+0x62e/0xfa0 ? find_vma_prev+0x85/0xe0 do_madvise+0x1eb/0x5a0 __x64_sys_madvise+0x2b/0x40 x64_sys_call+0x23b3/0x4620 do_syscall_64+0x9e/0x1b0 ? irqentry_exit_to_user_mode+0x7d/0x300 entry_SYSCALL_64_after_hwframe+0x78/0xe2 Add a cond_resched() call at the beginning of each loop iteration to allow the CPU to schedule other tasks when necessary, avoiding potential softlocks during heavy readahead operations. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- fs/mpage.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/mpage.c b/fs/mpage.c index 242e213ee064..73947fc8ff1e 100644 --- a/fs/mpage.c +++ b/fs/mpage.c @@ -376,6 +376,7 @@ void mpage_readahead(struct readahead_control *rac, get_block_t get_block) }; while ((folio = readahead_folio(rac))) { + cond_resched(); prefetchw(&folio->flags); args.folio = folio; args.nr_pages = readahead_count(rac); -- 2.39.2

2 1

[PATCH OLK-6.6] x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
by Qi Xi 29 Apr '25

29 Apr '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.15-rc1 commit 3ef938c3503563bfc2ac15083557f880d29c2e64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QSV CVE: CVE-2025-22045 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) together with the PTE entries in the pointed-to page table: collapse_pte_mapped_thp pmdp_collapse_flush flush_tlb_range The arm64 version of flush_tlb_range() has a comment describing that it can be used for page table removal, and does not use any last-level invalidation optimizations. Fix the X86 version by making it behave the same way. Currently, X86 only uses this information for the following two purposes, which I think means the issue doesn't have much impact: - In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be IPI'd to avoid issues with speculative page table walks. - In Hyper-V TLB paravirtualization, again for lazy TLB stuff. The patch "x86/mm: only invalidate final translations with INVLPGB" which is currently under review (see <https://lore.kernel.org/all/20241230175550.4046587-13-riel@surriel.com/>) would probably be making the impact of this a lot worse. Fixes: 016c4d92cd16 ("x86/mm/tlb: Add freed_tables argument to flush_tlb_mm_range") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Link: https://lkml.kernel.org/r/20250103-x86-collapse-flush-fix-v1-1-3c521856cfa6… Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/x86/include/asm/tlbflush.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h index 25726893c6f4..4bd3c1a1b355 100644 --- a/arch/x86/include/asm/tlbflush.h +++ b/arch/x86/include/asm/tlbflush.h @@ -241,7 +241,7 @@ void flush_tlb_multi(const struct cpumask *cpumask, flush_tlb_mm_range((vma)->vm_mm, start, end, \ ((vma)->vm_flags & VM_HUGETLB) \ ? huge_page_shift(hstate_vma(vma)) \ - : PAGE_SHIFT, false) + : PAGE_SHIFT, true) extern void flush_tlb_all(void); extern void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start, -- 2.33.0

2 1

[PATCH OLK-6.6] acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
by Qi Xi 29 Apr '25

29 Apr '25

From: Murad Masimov <m.masimov(a)mt-integration.ru> mainline inclusion from mainline-v6.15-rc1 commit 2ff0e408db36c21ed3fa5e3c1e0e687c82cf132f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QRM CVE: CVE-2025-22044 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzkaller has reported a warning in to_nfit_bus_uuid(): "only secondary bus families can be translated". This warning is emited if the argument is equal to NVDIMM_BUS_FAMILY_NFIT == 0. Function acpi_nfit_ctl() first verifies that a user-provided value call_pkg->nd_family of type u64 is not equal to 0. Then the value is converted to int, and only after that is compared to NVDIMM_BUS_FAMILY_MAX. This can lead to passing an invalid argument to acpi_nfit_ctl(), if call_pkg->nd_family is non-zero, while the lower 32 bits are zero. Furthermore, it is best to return EINVAL immediately upon seeing the invalid user input. The WARNING is insufficient to prevent further undefined behavior based on other invalid user input. All checks of the input value should be applied to the original variable call_pkg->nd_family. [iweiny: update commit message] Fixes: 6450ddbd5d8e ("ACPI: NFIT: Define runtime firmware activation commands") Cc: stable(a)vger.kernel.org Reported-by: syzbot+c80d8dc0d9fa81a3cd8c(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c80d8dc0d9fa81a3cd8c Signed-off-by: Murad Masimov <m.masimov(a)mt-integration.ru> Link: https://patch.msgid.link/20250123163945.251-1-m.masimov@mt-integration.ru Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/acpi/nfit/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 7918923e3b74..a466ad6e5d93 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -485,7 +485,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, cmd_mask = nd_desc->cmd_mask; if (cmd == ND_CMD_CALL && call_pkg->nd_family) { family = call_pkg->nd_family; - if (family > NVDIMM_BUS_FAMILY_MAX || + if (call_pkg->nd_family > NVDIMM_BUS_FAMILY_MAX || !test_bit(family, &nd_desc->bus_family_mask)) return -EINVAL; family = array_index_nospec(family, -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS 0/3] Backport SMC patchs
by Wang Liang 29 Apr '25

29 Apr '25

Karsten Graul (1): net/smc: fix restoring of fallback changes Ursula Braun (2): net/smc: propagate file from SMC to TCP socket net/smc: fix closing of fallback SMC sockets include/net/sock.h | 6 ------ net/smc/af_smc.c | 47 ++++++++++++++++++++++++++++++++++++---------- 2 files changed, 37 insertions(+), 16 deletions(-) -- 2.34.1

2 4

[openeuler:OLK-6.6 2175/2175] drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_ethtool.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 85cae3bfc6f56b1f497d5521a0caa9b8c299ac01 commit: dd013ad487534c1838afc2f55efdb5daec15aace [2175/2175] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-randconfig-161-20250429 (https://download.01.org/0day-ci/archive/20250429/202504290927.uassI0w9-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250429/202504290927.uassI0w9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504290927.uassI0w9-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_ethtool.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. vim +3 drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_ethtool.c > 3 * Copyright (C), 2020, Linkdata Technologies Co., Ltd. 4 * 5 * @file: sxevf_ethtool.c 6 * @author: Linkdata 7 * @date: 2025.02.16 8 * @brief: 9 * @note: 10 */ 11 #include "sxe_version.h" 12 #include "sxevf_ethtool.h" 13 #include "sxevf_hw.h" 14 #include "sxe_log.h" 15 #include "sxevf_tx_proc.h" 16 #include "sxevf_rx_proc.h" 17 #include "sxevf_netdev.h" 18 #include "sxevf_msg.h" 19 #include "sxevf_irq.h" 20 #include "sxevf_ring.h" 21 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1597/1597] include/linux/ktask.h:123:35: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)'
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 230c2b30f879859ac3e9d3cc46407a9dbb103160 commit: eb761d6521c32c006a4987260394a61c6684fb35 [1597/1597] mm: parallelize deferred struct page initialization within each node config: arm64-randconfig-002-20250429 (https://download.01.org/0day-ci/archive/20250429/202504290808.iYcj1P8f-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250429/202504290808.iYcj1P8f-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504290808.iYcj1P8f-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/page_alloc.c:69: mm/page_alloc.c: In function 'deferred_init_memmap': >> include/linux/ktask.h:123:35: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^ include/linux/ktask.h:139:17: note: in expansion of macro 'KTASK_CTL_INITIALIZER' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1645:17: note: in expansion of macro 'DEFINE_KTASK_CTL' 1645 | DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, | ^~~~~~~~~~~~~~~~ >> include/linux/ktask.h:123:35: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^ include/linux/ktask.h:139:17: note: in expansion of macro 'KTASK_CTL_INITIALIZER' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1661:17: note: in expansion of macro 'DEFINE_KTASK_CTL' 1661 | DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, | ^~~~~~~~~~~~~~~~ vim +123 include/linux/ktask.h c48676ef6b6f9c Daniel Jordan 2019-08-14 120 c48676ef6b6f9c Daniel Jordan 2019-08-14 121 #define KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ c48676ef6b6f9c Daniel Jordan 2019-08-14 122 { \ c48676ef6b6f9c Daniel Jordan 2019-08-14 @123 .kc_thread_func = (ktask_thread_func)(thread_func), \ 69cc5b58cc50d2 Daniel Jordan 2019-08-14 124 .kc_undo_func = NULL, \ c48676ef6b6f9c Daniel Jordan 2019-08-14 125 .kc_func_arg = (func_arg), \ c48676ef6b6f9c Daniel Jordan 2019-08-14 126 .kc_min_chunk_size = (min_chunk_size), \ c48676ef6b6f9c Daniel Jordan 2019-08-14 127 .kc_iter_func = (ktask_iter_range), \ c48676ef6b6f9c Daniel Jordan 2019-08-14 128 .kc_max_threads = 0, \ c48676ef6b6f9c Daniel Jordan 2019-08-14 129 } c48676ef6b6f9c Daniel Jordan 2019-08-14 130 :::::: The code at line 123 was first introduced by commit :::::: c48676ef6b6f9cb8497d6264ae9ff71b87630337 ktask: multithread CPU-intensive kernel work :::::: TO: Daniel Jordan <daniel.m.jordan(a)oracle.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1597/1597] include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used
by kernel test robot 29 Apr '25

29 Apr '25

Hi Zhang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 230c2b30f879859ac3e9d3cc46407a9dbb103160 commit: 1811840c2cdebd0820818392a8217ffbd1be5c67 [1597/1597] mm/sharepool: Fix sharepool node id invalid when using sp_alloc config: arm64-randconfig-004-20250429 (https://download.01.org/0day-ci/archive/20250429/202504290804.SFjtS4nf-lkp@…) compiler: aarch64-linux-gcc (GCC) 9.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250429/202504290804.SFjtS4nf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504290804.SFjtS4nf-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/shmem_fs.h:7, from mm/truncate.c:23: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ -- mm/mmap.c: In function 'acct_stack_growth': mm/mmap.c:2584:16: warning: variable 'new_start' set but not used [-Wunused-but-set-variable] 2584 | unsigned long new_start; | ^~~~~~~~~ In file included from include/linux/shmem_fs.h:7, from mm/mmap.c:28: At top level: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ -- mm/vmscan.c: In function 'kernel_swap_check': mm/vmscan.c:3264:21: error: implicit declaration of function 'kernel_swap_enabled'; did you mean 'kernfs_ns_enabled'? [-Werror=implicit-function-declaration] 3264 | if (sc != NULL && !kernel_swap_enabled()) | ^~~~~~~~~~~~~~~~~~~ | kernfs_ns_enabled mm/vmscan.c: In function 'try_to_free_mem_cgroup_pages': mm/vmscan.c:3360:6: warning: variable 'nid' set but not used [-Wunused-but-set-variable] 3360 | int nid; | ^~~ mm/vmscan.c: In function 'get_swapcache_reclaim_num': mm/vmscan.c:4683:33: warning: comparison of unsigned expression < 0 is always false [-Wtype-limits] 4683 | return total_swapcache_pages() > | ^ In file included from mm/vmscan.c:39: At top level: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ cc1: some warnings being treated as errors -- In file included from include/linux/page_counter.h:6, from mm/memcontrol.c:34: mm/memcontrol.c: In function 'mem_cgroup_get_max': include/linux/kernel.h:884:39: warning: comparison of unsigned expression < 0 is always false [-Wtype-limits] 884 | #define min(x, y) __careful_cmp(x, y, <) | ^ include/linux/kernel.h:867:30: note: in definition of macro '__cmp' 867 | #define __cmp(x, y, op) ((x) op (y) ? (x) : (y)) | ^~ include/linux/kernel.h:884:19: note: in expansion of macro '__careful_cmp' 884 | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~ mm/memcontrol.c:1506:14: note: in expansion of macro 'min' 1506 | swap_max = min(swap_max, (unsigned long)total_swap_pages); | ^~~ In file included from include/linux/shmem_fs.h:7, from mm/memcontrol.c:39: At top level: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ mm/memcontrol.c:6306: warning: bad line: | 0, otherwise. -- mm/page_alloc.c:1489:6: warning: no previous prototype for 'set_zone_contiguous' [-Wmissing-prototypes] 1489 | void set_zone_contiguous(struct zone *zone) | ^~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1511:6: warning: no previous prototype for 'clear_zone_contiguous' [-Wmissing-prototypes] 1511 | void clear_zone_contiguous(struct zone *zone) | ^~~~~~~~~~~~~~~~~~~~~ In file included from mm/page_alloc.c:43: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ mm/page_alloc.c:3083: warning: Function parameter or member 'mt' not described in '__putback_isolated_page' -- mm/workingset.c: In function 'unpack_shadow': mm/workingset.c:187:15: warning: variable 'nid' set but not used [-Wunused-but-set-variable] 187 | int memcgid, nid; | ^~~ In file included from include/linux/shmem_fs.h:7, from mm/workingset.c:10: At top level: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ -- mm/memory.c: In function 'vm_insert_page': mm/memory.c:1554:10: error: implicit declaration of function 'hugetlb_insert_hugepage_pte_by_pa'; did you mean 'hugetlb_insert__hugepage_pte_by_pa'? [-Werror=implicit-function-declaration] 1554 | return hugetlb_insert_hugepage_pte_by_pa(vma->vm_mm, addr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | hugetlb_insert__hugepage_pte_by_pa In file included from mm/memory.c:72: mm/memory.c: In function 'clear_huge_page': include/linux/ktask.h:123:21: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct cgp_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^ include/linux/ktask.h:139:3: note: in expansion of macro 'KTASK_CTL_INITIALIZER' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~ mm/memory.c:4754:3: note: in expansion of macro 'DEFINE_KTASK_CTL' 4754 | DEFINE_KTASK_CTL(ctl, clear_gigantic_page_chunk, &args, | ^~~~~~~~~~~~~~~~ In file included from include/linux/migrate.h:6, from mm/memory.c:65: At top level: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ cc1: some warnings being treated as errors -- In file included from mm/oom_kill.c:35: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ mm/oom_kill.c:328: warning: Function parameter or member 'task' not described in 'oom_next_task' mm/oom_kill.c:328: warning: Function parameter or member 'oc' not described in 'oom_next_task' mm/oom_kill.c:328: warning: Function parameter or member 'points' not described in 'oom_next_task' -- In file included from include/linux/shmem_fs.h:7, from mm/khugepaged.c:20: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ mm/khugepaged.c:1348: warning: Function parameter or member 'mm' not described in 'collapse_shmem' mm/khugepaged.c:1348: warning: Function parameter or member 'mapping' not described in 'collapse_shmem' mm/khugepaged.c:1348: warning: Function parameter or member 'start' not described in 'collapse_shmem' mm/khugepaged.c:1348: warning: Function parameter or member 'hpage' not described in 'collapse_shmem' mm/khugepaged.c:1348: warning: Function parameter or member 'node' not described in 'collapse_shmem' mm/khugepaged.c:1348: warning: Function parameter or member 'reliable' not described in 'collapse_shmem' vim +/__do_mbind +329 include/linux/mempolicy.h 328 > 329 static long __do_mbind(unsigned long start, unsigned long len, -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2880/2880] drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:432:6: error: no previous prototype for 'sxe_debugfs_entries_init'
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: f6ce6a14f5841221e47ea0192331253223bdab2d commit: 8cee206b5558245197158bd20895f95cc28d8468 [2880/2880] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-defconfig (https://download.01.org/0day-ci/archive/20250429/202504290828.J8Cynzh6-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250429/202504290828.J8Cynzh6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504290828.J8Cynzh6-lkp@intel.com/ All error/warnings (new ones prefixed by >>): >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_xdp.c:403:6: error: no previous prototype for 'sxe_txrx_ring_enable' [-Werror=missing-prototypes] 403 | void sxe_txrx_ring_enable(struct sxe_adapter *adapter, u32 ring_idx) | ^~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:432:6: error: no previous prototype for 'sxe_debugfs_entries_init' [-Werror=missing-prototypes] 432 | void sxe_debugfs_entries_init(struct sxe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:459:6: error: no previous prototype for 'sxe_debugfs_entries_exit' [-Werror=missing-prototypes] 459 | void sxe_debugfs_entries_exit(struct sxe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:465:6: error: no previous prototype for 'sxe_debugfs_init' [-Werror=missing-prototypes] 465 | void sxe_debugfs_init(void) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:470:6: error: no previous prototype for 'sxe_debugfs_exit' [-Werror=missing-prototypes] 470 | void sxe_debugfs_exit(void) | ^~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2022:5: error: no previous prototype for 'sxe_reg_test' [-Werror=missing-prototypes] 2022 | int sxe_reg_test(struct sxe_adapter *adapter) | ^~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2644:5: error: no previous prototype for 'sxe_phys_id_set' [-Werror=missing-prototypes] 2644 | int sxe_phys_id_set(struct net_device *netdev, enum ethtool_phys_id_state state) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c: In function 'sxe_get_module_eeprom': >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2736:47: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] 2736 | LOG_ERROR("read sfp failed\n"); | ^ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:230:6: error: no previous prototype for 'sxe_hw_no_snoop_disable' [-Werror=missing-prototypes] 230 | void sxe_hw_no_snoop_disable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:6: error: no previous prototype for 'sxe_hw_uc_addr_pool_del' [-Werror=missing-prototypes] 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:5: error: no previous prototype for 'sxe_hw_uc_addr_pool_enable' [-Werror=missing-prototypes] 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:5: error: no previous prototype for 'sxe_hw_nic_reset' [-Werror=missing-prototypes] 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:6: error: no previous prototype for 'sxe_hw_pf_rst_done_set' [-Werror=missing-prototypes] 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:5: error: no previous prototype for 'sxe_hw_pending_irq_read_clear' [-Werror=missing-prototypes] 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:6: error: no previous prototype for 'sxe_hw_pending_irq_write_clear' [-Werror=missing-prototypes] 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:5: error: no previous prototype for 'sxe_hw_irq_cause_get' [-Werror=missing-prototypes] 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:6: error: no previous prototype for 'sxe_hw_ring_irq_auto_disable' [-Werror=missing-prototypes] 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:6: error: no previous prototype for 'sxe_hw_irq_general_reg_set' [-Werror=missing-prototypes] 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:5: error: no previous prototype for 'sxe_hw_irq_general_reg_get' [-Werror=missing-prototypes] 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:6: error: no previous prototype for 'sxe_hw_event_irq_map' [-Werror=missing-prototypes] 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:6: error: no previous prototype for 'sxe_hw_ring_irq_map' [-Werror=missing-prototypes] 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:6: error: no previous prototype for 'sxe_hw_ring_irq_interval_set' [-Werror=missing-prototypes] 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:838:6: error: no previous prototype for 'sxe_hw_event_irq_auto_clear_set' [-Werror=missing-prototypes] 838 | void sxe_hw_event_irq_auto_clear_set(struct sxe_hw *hw, u32 value) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:843:6: error: no previous prototype for 'sxe_hw_specific_irq_disable' [-Werror=missing-prototypes] 843 | void sxe_hw_specific_irq_disable(struct sxe_hw *hw, u32 value) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:848:6: error: no previous prototype for 'sxe_hw_specific_irq_enable' [-Werror=missing-prototypes] 848 | void sxe_hw_specific_irq_enable(struct sxe_hw *hw, u32 value) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:876:6: error: no previous prototype for 'sxe_hw_all_irq_disable' [-Werror=missing-prototypes] 876 | void sxe_hw_all_irq_disable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:994:5: error: no previous prototype for 'sxe_hw_link_speed_get' [-Werror=missing-prototypes] 994 | u32 sxe_hw_link_speed_get(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1014:6: error: no previous prototype for 'sxe_hw_link_speed_set' [-Werror=missing-prototypes] 1014 | void sxe_hw_link_speed_set(struct sxe_hw *hw, u32 speed) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1033:6: error: no previous prototype for 'sxe_hw_is_link_state_up' [-Werror=missing-prototypes] 1033 | bool sxe_hw_is_link_state_up(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1055:6: error: no previous prototype for 'sxe_hw_mac_pad_enable' [-Werror=missing-prototypes] 1055 | void sxe_hw_mac_pad_enable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1064:5: error: no previous prototype for 'sxe_hw_fc_enable' [-Werror=missing-prototypes] 1064 | s32 sxe_hw_fc_enable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1135:6: error: no previous prototype for 'sxe_fc_autoneg_localcap_set' [-Werror=missing-prototypes] 1135 | void sxe_fc_autoneg_localcap_set(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1164:5: error: no previous prototype for 'sxe_hw_pfc_enable' [-Werror=missing-prototypes] 1164 | s32 sxe_hw_pfc_enable(struct sxe_hw *hw, u8 tc_idx) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1256:6: error: no previous prototype for 'sxe_hw_crc_configure' [-Werror=missing-prototypes] 1256 | void sxe_hw_crc_configure(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1264:6: error: no previous prototype for 'sxe_hw_loopback_switch' [-Werror=missing-prototypes] 1264 | void sxe_hw_loopback_switch(struct sxe_hw *hw, bool is_enable) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1276:6: error: no previous prototype for 'sxe_hw_mac_txrx_enable' [-Werror=missing-prototypes] 1276 | void sxe_hw_mac_txrx_enable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1285:6: error: no previous prototype for 'sxe_hw_mac_max_frame_set' [-Werror=missing-prototypes] 1285 | void sxe_hw_mac_max_frame_set(struct sxe_hw *hw, u32 max_frame) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1298:5: error: no previous prototype for 'sxe_hw_mac_max_frame_get' [-Werror=missing-prototypes] 1298 | u32 sxe_hw_mac_max_frame_get(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1330:6: error: no previous prototype for 'sxe_hw_fc_tc_high_water_mark_set' [-Werror=missing-prototypes] 1330 | void sxe_hw_fc_tc_high_water_mark_set(struct sxe_hw *hw, u8 tc_idx, u32 mark) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1335:6: error: no previous prototype for 'sxe_hw_fc_tc_low_water_mark_set' [-Werror=missing-prototypes] 1335 | void sxe_hw_fc_tc_low_water_mark_set(struct sxe_hw *hw, u8 tc_idx, u32 mark) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1340:6: error: no previous prototype for 'sxe_hw_is_fc_autoneg_disabled' [-Werror=missing-prototypes] 1340 | bool sxe_hw_is_fc_autoneg_disabled(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1345:6: error: no previous prototype for 'sxe_hw_fc_autoneg_disable_set' [-Werror=missing-prototypes] 1345 | void sxe_hw_fc_autoneg_disable_set(struct sxe_hw *hw, bool is_disabled) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1360:6: error: no previous prototype for 'sxe_hw_fc_requested_mode_set' [-Werror=missing-prototypes] 1360 | void sxe_hw_fc_requested_mode_set(struct sxe_hw *hw, enum sxe_fc_mode mode) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1388:5: error: no previous prototype for 'sxe_hw_rx_mode_get' [-Werror=missing-prototypes] 1388 | u32 sxe_hw_rx_mode_get(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1393:5: error: no previous prototype for 'sxe_hw_pool_rx_mode_get' [-Werror=missing-prototypes] 1393 | u32 sxe_hw_pool_rx_mode_get(struct sxe_hw *hw, u16 pool_idx) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1398:6: error: no previous prototype for 'sxe_hw_rx_mode_set' [-Werror=missing-prototypes] 1398 | void sxe_hw_rx_mode_set(struct sxe_hw *hw, u32 filter_ctrl) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1403:6: error: no previous prototype for 'sxe_hw_pool_rx_mode_set' [-Werror=missing-prototypes] 1403 | void sxe_hw_pool_rx_mode_set(struct sxe_hw *hw, u32 vmolr, u16 pool_idx) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1408:6: error: no previous prototype for 'sxe_hw_rx_lro_enable' [-Werror=missing-prototypes] 1408 | void sxe_hw_rx_lro_enable(struct sxe_hw *hw, bool is_enable) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1420:6: error: no previous prototype for 'sxe_hw_rx_nfs_filter_disable' [-Werror=missing-prototypes] 1420 | void sxe_hw_rx_nfs_filter_disable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1428:6: error: no previous prototype for 'sxe_hw_rx_udp_frag_checksum_disable' [-Werror=missing-prototypes] 1428 | void sxe_hw_rx_udp_frag_checksum_disable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1437:6: error: no previous prototype for 'sxe_hw_fc_mac_addr_set' [-Werror=missing-prototypes] 1437 | void sxe_hw_fc_mac_addr_set(struct sxe_hw *hw, u8 *mac_addr) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1449:5: error: no previous prototype for 'sxe_hw_uc_addr_add' [-Werror=missing-prototypes] 1449 | s32 sxe_hw_uc_addr_add(struct sxe_hw *hw, u32 rar_idx, u8 *addr, u32 pool_idx) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1484:5: error: no previous prototype for 'sxe_hw_uc_addr_del' [-Werror=missing-prototypes] 1484 | s32 sxe_hw_uc_addr_del(struct sxe_hw *hw, u32 index) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1510:6: error: no previous prototype for 'sxe_hw_mta_hash_table_set' [-Werror=missing-prototypes] 1510 | void sxe_hw_mta_hash_table_set(struct sxe_hw *hw, u8 index, u32 value) | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1515:6: error: no previous prototype for 'sxe_hw_mta_hash_table_update' [-Werror=missing-prototypes] 1515 | void sxe_hw_mta_hash_table_update(struct sxe_hw *hw, u8 reg_idx, u8 bit_idx) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1525:5: error: no previous prototype for 'sxe_hw_mc_filter_get' [-Werror=missing-prototypes] 1525 | u32 sxe_hw_mc_filter_get(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1530:6: error: no previous prototype for 'sxe_hw_mc_filter_enable' [-Werror=missing-prototypes] 1530 | void sxe_hw_mc_filter_enable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1554:6: error: no previous prototype for 'sxe_hw_uc_addr_clear' [-Werror=missing-prototypes] 1554 | void sxe_hw_uc_addr_clear(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1587:6: error: no previous prototype for 'sxe_hw_vt_ctrl_cfg' [-Werror=missing-prototypes] 1587 | void sxe_hw_vt_ctrl_cfg(struct sxe_hw *hw, u8 default_pool) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1601:6: error: no previous prototype for 'sxe_hw_vt_disable' [-Werror=missing-prototypes] 1601 | void sxe_hw_vt_disable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1675:5: error: no previous prototype for 'sxe_hw_vlan_pool_filter_read' [-Werror=missing-prototypes] 1675 | u32 sxe_hw_vlan_pool_filter_read(struct sxe_hw *hw, u16 reg_index) -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:136:5: error: no previous prototype for 'sxe_msi_irq_init' [-Werror=missing-prototypes] 136 | int sxe_msi_irq_init(struct sxe_adapter *adapter) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:182:6: error: no previous prototype for 'sxe_disable_dcb' [-Werror=missing-prototypes] 182 | void sxe_disable_dcb(struct sxe_adapter *adapter) | ^~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:212:6: error: no previous prototype for 'sxe_disable_rss' [-Werror=missing-prototypes] 212 | void sxe_disable_rss(struct sxe_adapter *adapter) | ^~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:729:6: error: no previous prototype for 'sxe_lsc_irq_handler' [-Werror=missing-prototypes] 729 | void sxe_lsc_irq_handler(struct sxe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:745:6: error: no previous prototype for 'sxe_mailbox_irq_handler' [-Werror=missing-prototypes] 745 | void sxe_mailbox_irq_handler(struct sxe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_main.c:70:6: error: no previous prototype for 'sxe_allow_inval_mac' [-Werror=missing-prototypes] 70 | bool sxe_allow_inval_mac(void) | ^~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_phy.c:733:5: error: no previous prototype for 'sxe_multispeed_sfp_link_configure' [-Werror=missing-prototypes] 733 | s32 sxe_multispeed_sfp_link_configure(struct sxe_adapter *adapter, u32 speed) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxe/base/trace/sxe_trace.c:21: warning: Excess function parameter 'file' description in 'SXE_FILE_NAME_LEN' >> drivers/net/ethernet/linkdata/sxe/base/trace/sxe_trace.c:21: warning: Excess function parameter 'author' description in 'SXE_FILE_NAME_LEN' >> drivers/net/ethernet/linkdata/sxe/base/trace/sxe_trace.c:21: warning: Excess function parameter 'date' description in 'SXE_FILE_NAME_LEN' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_rx_proc.c:1431:6: error: no previous prototype for 'sxe_headers_cleanup' [-Werror=missing-prototypes] 1431 | bool sxe_headers_cleanup(struct sxe_ring *rx_ring, | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_rx_proc.c:1569:6: error: no previous prototype for 'sxe_rx_buffer_page_offset_update' [-Werror=missing-prototypes] 1569 | void sxe_rx_buffer_page_offset_update(struct sxe_ring *rx_ring, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- drivers/net/ethernet/linkdata/sxe/sxepf/sxe_sriov.c: In function 'sxe_vf_uc_addr_del': >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_sriov.c:766:13: error: variable 'ret' set but not used [-Werror=unused-but-set-variable] 766 | s32 ret; | ^~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_sriov.c: At top level: >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_sriov.c:1552:6: error: no previous prototype for 'sxe_set_vf_link_enable' [-Werror=missing-prototypes] 1552 | void sxe_set_vf_link_enable(struct sxe_adapter *adapter, s32 vf_idx, s32 state) | ^~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ipsec.c:23: warning: cannot understand function prototype: 'const char ipsec_aes_name[] = "rfc4106(gcm(aes))"; ' .. vim +/sxe_debugfs_entries_init +432 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c 431 > 432 void sxe_debugfs_entries_init(struct sxe_adapter *adapter) 433 { 434 struct dentry *dir; 435 const char *name = pci_name(adapter->pdev); 436 437 adapter->debugfs_entries = debugfs_create_dir(name, sxe_debugfs_root); 438 dir = debugfs_create_file("reg_ops", 0600, adapter->debugfs_entries, 439 adapter, &sxe_debugfs_reg_ops_fops); 440 if (!dir || dir == ERR_PTR(-ENODEV)) 441 LOG_INFO_BDF("debugfs:reg_ops file create failed\n"); 442 443 dir = debugfs_create_file("netdev_ops", 0600, adapter->debugfs_entries, 444 adapter, &sxe_debugfs_netdev_ops_fops); 445 if (!dir || dir == ERR_PTR(-ENODEV)) 446 LOG_INFO_BDF("debugfs:netdev_ops file create failed\n"); 447 448 dir = debugfs_create_file("hw_stats", 0400, adapter->debugfs_entries, 449 adapter, &sxe_debugfs_hw_stats_fops); 450 if (!dir || dir == ERR_PTR(-ENODEV)) 451 LOG_INFO_BDF("debugfs:hw_stats file create failed\n"); 452 453 dir = debugfs_create_file("sfp_info", 0400, adapter->debugfs_entries, 454 adapter, &sxe_debugfs_sfp_info_fops); 455 if (!dir || dir == ERR_PTR(-ENODEV)) 456 LOG_INFO_BDF("debugfs:sfp_info file create failed\n"); 457 } 458 > 459 void sxe_debugfs_entries_exit(struct sxe_adapter *adapter) 460 { 461 debugfs_remove_recursive(adapter->debugfs_entries); 462 adapter->debugfs_entries = NULL; 463 } 464 > 465 void sxe_debugfs_init(void) 466 { 467 sxe_debugfs_root = debugfs_create_dir(SXE_DRV_NAME, NULL); 468 } 469 > 470 void sxe_debugfs_exit(void) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2175/2175] crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'data' not described in 'pgp_parse_packets'
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 85cae3bfc6f56b1f497d5521a0caa9b8c299ac01 commit: b78af6579e15dcdff86504da90af77f3e890270e [2175/2175] PGPLIB: Basic packet parser config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20250429/202504290703.q8lvsdB3-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250429/202504290703.q8lvsdB3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504290703.q8lvsdB3-lkp@intel.com/ All warnings (new ones prefixed by >>): >> crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'data' not described in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'datalen' not described in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Excess function parameter '_data' description in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Excess function parameter '_datalen' description in 'pgp_parse_packets' vim +189 crypto/asymmetric_keys/pgp_library.c 178 179 /** 180 * pgp_parse_packets - Parse a set of PGP packets 181 * @_data: Data to be parsed (updated) 182 * @_datalen: Amount of data (updated) 183 * @ctx: Parsing context 184 * 185 * Parse a set of PGP packets [RFC 4880: 4]. 186 */ 187 int pgp_parse_packets(const u8 *data, size_t datalen, 188 struct pgp_parse_context *ctx) > 189 { 190 enum pgp_packet_tag type; 191 ssize_t pktlen; 192 u8 headerlen; 193 int ret; 194 195 while (datalen > 2) { 196 pktlen = pgp_parse_packet_header(&data, &datalen, &type, 197 &headerlen); 198 if (pktlen < 0) 199 return pktlen; 200 201 if ((ctx->types_of_interest >> type) & 1) { 202 ret = ctx->process_packet(ctx, type, headerlen, 203 data, pktlen); 204 if (ret < 0) 205 return ret; 206 } 207 data += pktlen; 208 datalen -= pktlen; 209 } 210 211 if (datalen != 0) { 212 pr_debug("Excess octets in packet stream\n"); 213 return -EBADMSG; 214 } 215 216 return 0; 217 } 218 EXPORT_SYMBOL_GPL(pgp_parse_packets); 219 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2880/2880] versioncheck: ./drivers/net/ethernet/linkdata/sxe/base/compat/sxe_compat.h: 16 linux/version.h not needed.
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: f6ce6a14f5841221e47ea0192331253223bdab2d commit: 8cee206b5558245197158bd20895f95cc28d8468 [2880/2880] Ethernet: Linkdata: Supports Linkdata ethernet Controllers reproduce: (https://download.01.org/0day-ci/archive/20250429/202504290659.kdYkNrXR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504290659.kdYkNrXR-lkp@intel.com/ versioncheck warnings: (new ones prefixed by >>) INFO PATH=/opt/cross/rustc-1.58.0-bindgen-0.56.0/cargo/bin:/opt/cross/clang-20/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/timeout -k 100 3h /usr/bin/make KCFLAGS= -Wno-error=return-type -Wreturn-type -funsigned-char -Wundef W=1 --keep-going LLVM=1 -j32 ARCH=x86_64 versioncheck find ./* $ -name SCCS -o -name BitKeeper -o -name .svn -o -name CVS -o -name .pc -o -name .hg -o -name .git $ -prune -o \ -name '*.[hcS]' -type f -print | sort \ | xargs perl -w ./scripts/checkversion.pl ./arch/csky/include/asm/atomic.h: 6 linux/version.h not needed. ./arch/csky/include/asm/io.h: 9 linux/version.h not needed. ./arch/csky/include/asm/thread_info.h: 9 linux/version.h not needed. ./arch/csky/include/asm/uaccess.h: 15 linux/version.h not needed. ./arch/csky/kernel/process.c: 5 linux/version.h not needed. ./arch/csky/mm/dma-mapping.c: 12 linux/version.h not needed. ./arch/csky/mm/fault.c: 16 linux/version.h not needed. ./arch/s390/include/asm/setup.h: 183: need linux/version.h ./arch/um/drivers/vector_kern.c: 11 linux/version.h not needed. ./drivers/block/rsxx/rsxx_priv.h: 14 linux/version.h not needed. ./drivers/char/ipmi/ipmi_si_ls2k500.c: 19 linux/version.h not needed. ./drivers/crypto/cavium/cpt/cptpf_main.c: 13 linux/version.h not needed. ./drivers/crypto/cavium/zip/common.h: 59 linux/version.h not needed. ./drivers/crypto/ccree/cc_driver.h: 26 linux/version.h not needed. ./drivers/crypto/montage/tsse/tsse_vuart.c: 21 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c: 62 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c: 28 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c: 26 linux/version.h not needed. ./drivers/gpu/drm/inspur/inspur_drm_de.c: 513: need linux/version.h ./drivers/gpu/drm/inspur/inspur_drm_drv.c: 456: need linux/version.h ./drivers/gpu/drm/pl111/pl111_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/pl111/pl111_drv.c: 47 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_drv.c: 38 linux/version.h not needed. ./drivers/hv/hv.c: 16 linux/version.h not needed. ./drivers/i2c/busses/i2c-brcmstb.c: 25 linux/version.h not needed. ./drivers/i2c/busses/i2c-xgene-slimpro.c: 22 linux/version.h not needed. ./drivers/media/pci/cx25821/cx25821.h: 31 linux/version.h not needed. ./drivers/media/platform/s3c-camif/camif-core.c: 26 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-common.h: 16 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c: 31 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-dvb.c: 14 linux/version.h not needed. ./drivers/media/usb/uvc/uvc_driver.c: 18 linux/version.h not needed. ./drivers/net/ethernet/3snic/sssnic/include/kernel/sss_linux_kernel.h: 12 linux/version.h not needed. ./drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c: 21 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h: 32 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c: 17 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h: 20 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic/ossl_knl.h: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h: 12 linux/version.h not needed. >> ./drivers/net/ethernet/linkdata/sxe/base/compat/sxe_compat.h: 16 linux/version.h not needed. >> ./drivers/net/ethernet/linkdata/sxevf/base/compat/sxe_compat.h: 16 linux/version.h not needed. ./drivers/net/ethernet/mucse/rnpm/rnpm_common.h: 7 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/common.h: 12 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/txrx.c: 9 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede.h: 10 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_ethtool.c: 7 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_main.c: 10 linux/version.h not needed. ./drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h: 26 linux/version.h not needed. ./drivers/net/usb/lan78xx.c: 5 linux/version.h not needed. ./drivers/net/wireless/rsi/rsi_91x_ps.c: 19 linux/version.h not needed. ./drivers/scsi/cxgbi/libcxgbi.h: 27 linux/version.h not needed. ./drivers/scsi/hisi_raid/hiraid_main.c: 9 linux/version.h not needed. ./drivers/scsi/huawei/hifc/hifc_knl_adp.h: 23 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/linux/ps3_base.c: 12 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/linux/ps3_cli.c: 15 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/linux/ps3_driver_log.c: 4 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/ps3_device_manager.h: 10 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/ps3_device_manager_sas.h: 7 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/ps3_qos.c: 7 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/ps3_rb_tree.h: 8 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/ps3_sas_transport.h: 10 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c: 10 linux/version.h not needed. ./drivers/scsi/qedf/qedf.h: 15 linux/version.h not needed. ./drivers/scsi/qedf/qedf_dbg.h: 13 linux/version.h not needed. ./drivers/scsi/qedi/qedi_dbg.h: 14 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_fw.c: 6 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_os.c: 6 linux/version.h not needed. ./drivers/soc/tegra/powergate-bpmp.c: 10 linux/version.h not needed. ./drivers/staging/media/atomisp/include/linux/atomisp.h: 23 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/drv_types.h: 17 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/ioctl_cfg80211.h: 10 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_cdev_file.c: 23 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_device.c: 33 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_genl.c: 26 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_genl_admin.c: 20 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_main.c: 28 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_tp.c: 26 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_umem.c: 26 linux/version.h not needed. ./drivers/ub/urma/uburma/uburma_main.c: 29 linux/version.h not needed. ./drivers/ub/urma/uburma/uburma_mmap.c: 21 linux/version.h not needed. ./drivers/watchdog/ziirave_wdt.c: 21 linux/version.h not needed. ./fs/eulerfs/euler.h: 20 linux/version.h not needed. ./fs/eulerfs/euler_common.h: 25 linux/version.h not needed. ./fs/proc/etmem_scan.c: 13 linux/version.h not needed. ./include/linux/qed/qed_ll2_if.h: 15 linux/version.h not needed. ./kernel/bpf/syscall.c: 20 linux/version.h not needed. ./samples/bpf/sampleip_kern.c: 7 linux/version.h not needed. ./samples/bpf/trace_event_kern.c: 8 linux/version.h not needed. ./sound/soc/codecs/cs35l35.c: 12 linux/version.h not needed. ./sound/soc/codecs/cs42l42.c: 14 linux/version.h not needed. ./tools/lib/bpf/libbpf_sched.h: 21 linux/version.h not needed. ./tools/perf/include/bpf/bpf.h: 70: need linux/version.h ./tools/perf/tests/bpf-script-example.c: 49: need linux/version.h ./tools/perf/tests/bpf-script-test-kbuild.c: 21: need linux/version.h ./tools/perf/tests/bpf-script-test-prologue.c: 47: need linux/version.h ./tools/perf/tests/bpf-script-test-relocation.c: 51: need linux/version.h ./tools/testing/selftests/bpf/progs/test_map_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_send_signal_kern.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_spin_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_tcp_estats.c: 37 linux/version.h not needed. ./tools/testing/selftests/wireguard/qemu/init.c: 25 linux/version.h not needed. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1597/1597] include/linux/ktask.h:123:21: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct cgp_args *)' to 'int (*)(void *, void *, void *)'
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 230c2b30f879859ac3e9d3cc46407a9dbb103160 commit: ae0cd4d46ced733c522f2cc6da2d380d69123fc4 [1597/1597] mm: parallelize clear_gigantic_page config: arm64-randconfig-004-20250429 (https://download.01.org/0day-ci/archive/20250429/202504290604.Y62ysEZs-lkp@…) compiler: aarch64-linux-gcc (GCC) 9.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250429/202504290604.Y62ysEZs-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504290604.Y62ysEZs-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/memory.c:72: mm/memory.c: In function 'clear_huge_page': >> include/linux/ktask.h:123:21: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct cgp_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^ include/linux/ktask.h:139:3: note: in expansion of macro 'KTASK_CTL_INITIALIZER' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~ mm/memory.c:4491:3: note: in expansion of macro 'DEFINE_KTASK_CTL' 4491 | DEFINE_KTASK_CTL(ctl, clear_gigantic_page_chunk, &args, | ^~~~~~~~~~~~~~~~ vim +123 include/linux/ktask.h c48676ef6b6f9c Daniel Jordan 2019-08-14 120 c48676ef6b6f9c Daniel Jordan 2019-08-14 121 #define KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ c48676ef6b6f9c Daniel Jordan 2019-08-14 122 { \ c48676ef6b6f9c Daniel Jordan 2019-08-14 @123 .kc_thread_func = (ktask_thread_func)(thread_func), \ 69cc5b58cc50d2 Daniel Jordan 2019-08-14 124 .kc_undo_func = NULL, \ c48676ef6b6f9c Daniel Jordan 2019-08-14 125 .kc_func_arg = (func_arg), \ c48676ef6b6f9c Daniel Jordan 2019-08-14 126 .kc_min_chunk_size = (min_chunk_size), \ c48676ef6b6f9c Daniel Jordan 2019-08-14 127 .kc_iter_func = (ktask_iter_range), \ c48676ef6b6f9c Daniel Jordan 2019-08-14 128 .kc_max_threads = 0, \ c48676ef6b6f9c Daniel Jordan 2019-08-14 129 } c48676ef6b6f9c Daniel Jordan 2019-08-14 130 :::::: The code at line 123 was first introduced by commit :::::: c48676ef6b6f9cb8497d6264ae9ff71b87630337 ktask: multithread CPU-intensive kernel work :::::: TO: Daniel Jordan <daniel.m.jordan(a)oracle.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2880/2880] include/linux/backing-dev.h:418:49: warning: 'struct cgroup_subsys' declared inside parameter list will not be visible outside of this definition or declaration
by kernel test robot 29 Apr '25

29 Apr '25

Hi wangyigen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: f6ce6a14f5841221e47ea0192331253223bdab2d commit: 13e5c52d7cec7621f78bce452b78785e689ed0b2 [2880/2880] cgroup_writeback: bind blkcg and memcg config: arm64-allnoconfig (https://download.01.org/0day-ci/archive/20250429/202504290538.Gt6tWC7N-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250429/202504290538.Gt6tWC7N-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504290538.Gt6tWC7N-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/filemap.c:32: >> include/linux/backing-dev.h:418:49: warning: 'struct cgroup_subsys' declared inside parameter list will not be visible outside of this definition or declaration 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^~~~~~~~~~~~~ mm/filemap.c:823:14: warning: no previous prototype for '__add_to_page_cache_locked' [-Wmissing-prototypes] 823 | noinline int __add_to_page_cache_locked(struct page *page, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ -- In file included from mm/fadvise.c:16: >> include/linux/backing-dev.h:418:49: warning: 'struct cgroup_subsys' declared inside parameter list will not be visible outside of this definition or declaration 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^~~~~~~~~~~~~ -- In file included from mm/page_alloc.c:50: >> include/linux/backing-dev.h:418:49: warning: 'struct cgroup_subsys' declared inside parameter list will not be visible outside of this definition or declaration 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^~~~~~~~~~~~~ mm/page_alloc.c:2609:5: warning: no previous prototype for 'find_suitable_fallback' [-Wmissing-prototypes] 2609 | int find_suitable_fallback(struct free_area *area, unsigned int order, | ^~~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:3040:6: warning: no previous prototype for '__drain_all_pages' [-Wmissing-prototypes] 3040 | void __drain_all_pages(struct zone *zone, bool force_all_cpus) | ^~~~~~~~~~~~~~~~~ mm/page_alloc.c:3603:15: warning: no previous prototype for 'should_fail_alloc_page' [-Wmissing-prototypes] 3603 | noinline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) | ^~~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:6753:20: warning: no previous prototype for 'memmap_init' [-Wmissing-prototypes] 6753 | void __init __weak memmap_init(void) | ^~~~~~~~~~~ mm/page_alloc.c:6791:23: warning: no previous prototype for 'arch_memmap_init' [-Wmissing-prototypes] 6791 | void __meminit __weak arch_memmap_init(unsigned long size, int nid, | ^~~~~~~~~~~~~~~~ mm/page_alloc.c:6909:6: warning: no previous prototype for '__zone_set_pageset_high_and_batch' [-Wmissing-prototypes] 6909 | void __zone_set_pageset_high_and_batch(struct zone *zone, unsigned long high, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +418 include/linux/backing-dev.h 417 > 418 static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, 419 struct css_set *cset) 420 { 421 } 422 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1597/1597] include/linux/ktask.h:123:21: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct vfio_pin_args *)' to 'int (*)(void *, void *, void *)'
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 230c2b30f879859ac3e9d3cc46407a9dbb103160 commit: b0908eee74d6b5fdec924e1fcfcdb8184888ee61 [1597/1597] vfio: parallelize vfio_pin_map_dma config: arm64-randconfig-003-20250429 (https://download.01.org/0day-ci/archive/20250429/202504290542.wZ43d7od-lkp@…) compiler: aarch64-linux-gcc (GCC) 9.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250429/202504290542.wZ43d7od-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504290542.wZ43d7od-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/vfio/vfio_iommu_type1.c:45: drivers/vfio/vfio_iommu_type1.c: In function 'vfio_pin_map_dma': >> include/linux/ktask.h:123:21: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct vfio_pin_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^ include/linux/ktask.h:139:3: note: in expansion of macro 'KTASK_CTL_INITIALIZER' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:1120:2: note: in expansion of macro 'DEFINE_KTASK_CTL' 1120 | DEFINE_KTASK_CTL(ctl, vfio_pin_map_dma_chunk, &args, PMD_SIZE); | ^~~~~~~~~~~~~~~~ >> include/linux/ktask.h:163:25: warning: cast between incompatible function types from 'void (*)(long unsigned int, long unsigned int, struct vfio_pin_args *)' to 'void (*)(void *, void *, void *)' [-Wcast-function-type] 163 | ((ctl)->kc_undo_func = (ktask_undo_func)(undo_func)) | ^ drivers/vfio/vfio_iommu_type1.c:1122:2: note: in expansion of macro 'ktask_ctl_set_undo_func' 1122 | ktask_ctl_set_undo_func(&ctl, vfio_pin_map_dma_undo); | ^~~~~~~~~~~~~~~~~~~~~~~ vim +123 include/linux/ktask.h c48676ef6b6f9c Daniel Jordan 2019-08-14 120 c48676ef6b6f9c Daniel Jordan 2019-08-14 121 #define KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ c48676ef6b6f9c Daniel Jordan 2019-08-14 122 { \ c48676ef6b6f9c Daniel Jordan 2019-08-14 @123 .kc_thread_func = (ktask_thread_func)(thread_func), \ 69cc5b58cc50d2 Daniel Jordan 2019-08-14 124 .kc_undo_func = NULL, \ c48676ef6b6f9c Daniel Jordan 2019-08-14 125 .kc_func_arg = (func_arg), \ c48676ef6b6f9c Daniel Jordan 2019-08-14 126 .kc_min_chunk_size = (min_chunk_size), \ c48676ef6b6f9c Daniel Jordan 2019-08-14 127 .kc_iter_func = (ktask_iter_range), \ c48676ef6b6f9c Daniel Jordan 2019-08-14 128 .kc_max_threads = 0, \ c48676ef6b6f9c Daniel Jordan 2019-08-14 129 } c48676ef6b6f9c Daniel Jordan 2019-08-14 130 c48676ef6b6f9c Daniel Jordan 2019-08-14 131 /* c48676ef6b6f9c Daniel Jordan 2019-08-14 132 * KTASK_CTL_INITIALIZER casts 'thread_func' to be of type ktask_thread_func so c48676ef6b6f9c Daniel Jordan 2019-08-14 133 * clients can write cleaner thread functions by relieving them of the need to c48676ef6b6f9c Daniel Jordan 2019-08-14 134 * cast the three void * arguments. Clients can just use the actual argument c48676ef6b6f9c Daniel Jordan 2019-08-14 135 * types instead. c48676ef6b6f9c Daniel Jordan 2019-08-14 136 */ c48676ef6b6f9c Daniel Jordan 2019-08-14 137 #define DEFINE_KTASK_CTL(ctl_name, thread_func, func_arg, min_chunk_size) \ c48676ef6b6f9c Daniel Jordan 2019-08-14 138 struct ktask_ctl ctl_name = \ c48676ef6b6f9c Daniel Jordan 2019-08-14 139 KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ c48676ef6b6f9c Daniel Jordan 2019-08-14 140 c48676ef6b6f9c Daniel Jordan 2019-08-14 141 /** c48676ef6b6f9c Daniel Jordan 2019-08-14 142 * ktask_ctl_set_iter_func - Set a task-specific iterator c48676ef6b6f9c Daniel Jordan 2019-08-14 143 * c48676ef6b6f9c Daniel Jordan 2019-08-14 144 * Overrides the default iterator, ktask_iter_range. c48676ef6b6f9c Daniel Jordan 2019-08-14 145 * c48676ef6b6f9c Daniel Jordan 2019-08-14 146 * Casts the type of the iterator function so its arguments can be c48676ef6b6f9c Daniel Jordan 2019-08-14 147 * client-specific (see the comment above DEFINE_KTASK_CTL). c48676ef6b6f9c Daniel Jordan 2019-08-14 148 * c48676ef6b6f9c Daniel Jordan 2019-08-14 149 * @ctl: A control structure containing information about the task. c48676ef6b6f9c Daniel Jordan 2019-08-14 150 * @iter_func: Walks a given number of units forward in the task, returning c48676ef6b6f9c Daniel Jordan 2019-08-14 151 * an iterator corresponding to the new position. c48676ef6b6f9c Daniel Jordan 2019-08-14 152 */ c48676ef6b6f9c Daniel Jordan 2019-08-14 153 #define ktask_ctl_set_iter_func(ctl, iter_func) \ c48676ef6b6f9c Daniel Jordan 2019-08-14 154 ((ctl)->kc_iter_func = (ktask_iter_func)(iter_func)) c48676ef6b6f9c Daniel Jordan 2019-08-14 155 69cc5b58cc50d2 Daniel Jordan 2019-08-14 156 /** 69cc5b58cc50d2 Daniel Jordan 2019-08-14 157 * ktask_ctl_set_undo_func - Designate an undo function to unwind from error 69cc5b58cc50d2 Daniel Jordan 2019-08-14 158 * 69cc5b58cc50d2 Daniel Jordan 2019-08-14 159 * @ctl: A control structure containing information about the task. 69cc5b58cc50d2 Daniel Jordan 2019-08-14 160 * @undo_func: Undoes a piece of the task. 69cc5b58cc50d2 Daniel Jordan 2019-08-14 161 */ 69cc5b58cc50d2 Daniel Jordan 2019-08-14 162 #define ktask_ctl_set_undo_func(ctl, undo_func) \ 69cc5b58cc50d2 Daniel Jordan 2019-08-14 @163 ((ctl)->kc_undo_func = (ktask_undo_func)(undo_func)) 69cc5b58cc50d2 Daniel Jordan 2019-08-14 164 :::::: The code at line 123 was first introduced by commit :::::: c48676ef6b6f9cb8497d6264ae9ff71b87630337 ktask: multithread CPU-intensive kernel work :::::: TO: Daniel Jordan <daniel.m.jordan(a)oracle.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 230c2b30f879859ac3e9d3cc46407a9dbb103160 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250429/202504290328.U1Cc5OUy-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504290328.U1Cc5OUy-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] net: fix geneve_opt length integer overflow
by Wang Liang 28 Apr '25

28 Apr '25

From: Lin Ma <linma(a)zju.edu.cn> mainline inclusion from mainline-v6.15-rc1 commit b27055a08ad4b415dcf15b63034f9cb236f7fb40 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QP0 CVE: CVE-2025-22055 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- struct geneve_opt uses 5 bit length for each single option, which means every vary size option should be smaller than 128 bytes. However, all current related Netlink policies cannot promise this length condition and the attacker can exploit a exact 128-byte size option to *fake* a zero length option and confuse the parsing logic, further achieve heap out-of-bounds read. One example crash log is like below: [ 3.905425] ================================================================== [ 3.905925] BUG: KASAN: slab-out-of-bounds in nla_put+0xa9/0xe0 [ 3.906255] Read of size 124 at addr ffff888005f291cc by task poc/177 [ 3.906646] [ 3.906775] CPU: 0 PID: 177 Comm: poc-oob-read Not tainted 6.1.132 #1 [ 3.907131] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 3.907784] Call Trace: [ 3.907925] <TASK> [ 3.908048] dump_stack_lvl+0x44/0x5c [ 3.908258] print_report+0x184/0x4be [ 3.909151] kasan_report+0xc5/0x100 [ 3.909539] kasan_check_range+0xf3/0x1a0 [ 3.909794] memcpy+0x1f/0x60 [ 3.909968] nla_put+0xa9/0xe0 [ 3.910147] tunnel_key_dump+0x945/0xba0 [ 3.911536] tcf_action_dump_1+0x1c1/0x340 [ 3.912436] tcf_action_dump+0x101/0x180 [ 3.912689] tcf_exts_dump+0x164/0x1e0 [ 3.912905] fw_dump+0x18b/0x2d0 [ 3.913483] tcf_fill_node+0x2ee/0x460 [ 3.914778] tfilter_notify+0xf4/0x180 [ 3.915208] tc_new_tfilter+0xd51/0x10d0 [ 3.918615] rtnetlink_rcv_msg+0x4a2/0x560 [ 3.919118] netlink_rcv_skb+0xcd/0x200 [ 3.919787] netlink_unicast+0x395/0x530 [ 3.921032] netlink_sendmsg+0x3d0/0x6d0 [ 3.921987] __sock_sendmsg+0x99/0xa0 [ 3.922220] __sys_sendto+0x1b7/0x240 [ 3.922682] __x64_sys_sendto+0x72/0x90 [ 3.922906] do_syscall_64+0x5e/0x90 [ 3.923814] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 3.924122] RIP: 0033:0x7e83eab84407 [ 3.924331] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 faf [ 3.925330] RSP: 002b:00007ffff505e370 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 3.925752] RAX: ffffffffffffffda RBX: 00007e83eaafa740 RCX: 00007e83eab84407 [ 3.926173] RDX: 00000000000001a8 RSI: 00007ffff505e3c0 RDI: 0000000000000003 [ 3.926587] RBP: 00007ffff505f460 R08: 00007e83eace1000 R09: 000000000000000c [ 3.926977] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffff505f3c0 [ 3.927367] R13: 00007ffff505f5c8 R14: 00007e83ead1b000 R15: 00005d4fbbe6dcb8 Fix these issues by enforing correct length condition in related policies. Fixes: 925d844696d9 ("netfilter: nft_tunnel: add support for geneve opts") Fixes: 4ece47787077 ("lwtunnel: add options setting and dumping for geneve") Fixes: 0ed5269f9e41 ("net/sched: add tunnel option support to act_tunnel_key") Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options") Signed-off-by: Lin Ma <linma(a)zju.edu.cn> Reviewed-by: Xin Long <lucien.xin(a)gmail.com> Acked-by: Cong Wang <xiyou.wangcong(a)gmail.com> Link: https://patch.msgid.link/20250402165632.6958-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/ip_tunnel_core.c net/netfilter/nft_tunnel.c net/sched/act_tunnel_key.c net/sched/cls_flower.c [conflicts due to not merge 4ece47787077 ("lwtunnel: add options setting and dumping for geneve"), conflicts due to not merge 925d844696d9 ("netfilter: nft_tunnel: add support for geneve opts"), conflicts due to not merge fca3f91cc38a ("net: sched: add vxlan option support to act_tunnel_key"), conflicts due to not merge d8f9dfae49ce ("net: sched: allow flower to match vxlan options")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sched/act_tunnel_key.c | 2 +- net/sched/cls_flower.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c index f43234be5695..5ae31bdaffb7 100644 --- a/net/sched/act_tunnel_key.c +++ b/net/sched/act_tunnel_key.c @@ -64,7 +64,7 @@ geneve_opt_policy[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_MAX + 1] = { [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS] = { .type = NLA_U16 }, [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE] = { .type = NLA_U8 }, [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA] = { .type = NLA_BINARY, - .len = 128 }, + .len = 127 }, }; static int diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c index fff54fa798d5..227c78db7548 100644 --- a/net/sched/cls_flower.c +++ b/net/sched/cls_flower.c @@ -500,7 +500,7 @@ geneve_opt_policy[TCA_FLOWER_KEY_ENC_OPT_GENEVE_MAX + 1] = { [TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS] = { .type = NLA_U16 }, [TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE] = { .type = NLA_U8 }, [TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA] = { .type = NLA_BINARY, - .len = 128 }, + .len = 127 }, }; static void fl_set_key_val(struct nlattr **tb, -- 2.34.1

2 1

[PATCH OLK-6.6] rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
by Zhang Changzhong 28 Apr '25

28 Apr '25

From: "Matthieu Baerts (NGI0)" <matttbe(a)kernel.org> mainline inclusion from mainline-v6.13-rc7 commit 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQQO CVE: CVE-2025-21635 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns. - current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2). The per-netns structure can be obtained from the table->data using container_of(), then the 'net' one can be retrieved from the listen socket (if available). Fixes: c6a58ffed536 ("RDS: TCP: Add sysctl tunables for sndbuf/rcvbuf on rds-tcp socket") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/67769ecb.050a0220.3a8527.003f.GAE@google.com [1] Suggested-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://patch.msgid.link/20250108-net-sysctl-current-nsproxy-v1-9-5df34b208… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/rds/tcp.c [commit 78eb4ea25cd5 ("sysctl: treewide: constify the ctl_table argument of proc_handlers") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/rds/tcp.c | 39 ++++++++++++++++++++++++++++++++------- 1 file changed, 32 insertions(+), 7 deletions(-) diff --git a/net/rds/tcp.c b/net/rds/tcp.c index 2dba750..fb6eaea 100644 --- a/net/rds/tcp.c +++ b/net/rds/tcp.c @@ -61,8 +61,10 @@ static atomic_t rds_tcp_unloading = ATOMIC_INIT(0); static struct kmem_cache *rds_tcp_conn_slab; -static int rds_tcp_skbuf_handler(struct ctl_table *ctl, int write, - void *buffer, size_t *lenp, loff_t *fpos); +static int rds_tcp_sndbuf_handler(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *fpos); +static int rds_tcp_rcvbuf_handler(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *fpos); static int rds_tcp_min_sndbuf = SOCK_MIN_SNDBUF; static int rds_tcp_min_rcvbuf = SOCK_MIN_RCVBUF; @@ -74,7 +76,7 @@ static struct ctl_table rds_tcp_sysctl_table[] = { /* data is per-net pointer */ .maxlen = sizeof(int), .mode = 0644, - .proc_handler = rds_tcp_skbuf_handler, + .proc_handler = rds_tcp_sndbuf_handler, .extra1 = &rds_tcp_min_sndbuf, }, #define RDS_TCP_RCVBUF 1 @@ -83,7 +85,7 @@ static struct ctl_table rds_tcp_sysctl_table[] = { /* data is per-net pointer */ .maxlen = sizeof(int), .mode = 0644, - .proc_handler = rds_tcp_skbuf_handler, + .proc_handler = rds_tcp_rcvbuf_handler, .extra1 = &rds_tcp_min_rcvbuf, }, { } @@ -683,10 +685,10 @@ static void rds_tcp_sysctl_reset(struct net *net) spin_unlock_irq(&rds_tcp_conn_lock); } -static int rds_tcp_skbuf_handler(struct ctl_table *ctl, int write, +static int rds_tcp_skbuf_handler(struct rds_tcp_net *rtn, + struct ctl_table *ctl, int write, void *buffer, size_t *lenp, loff_t *fpos) { - struct net *net = current->nsproxy->net_ns; int err; err = proc_dointvec_minmax(ctl, write, buffer, lenp, fpos); @@ -695,11 +697,34 @@ static int rds_tcp_skbuf_handler(struct ctl_table *ctl, int write, *(int *)(ctl->extra1)); return err; } - if (write) + + if (write && rtn->rds_tcp_listen_sock && rtn->rds_tcp_listen_sock->sk) { + struct net *net = sock_net(rtn->rds_tcp_listen_sock->sk); + rds_tcp_sysctl_reset(net); + } + return 0; } +static int rds_tcp_sndbuf_handler(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *fpos) +{ + struct rds_tcp_net *rtn = container_of(ctl->data, struct rds_tcp_net, + sndbuf_size); + + return rds_tcp_skbuf_handler(rtn, ctl, write, buffer, lenp, fpos); +} + +static int rds_tcp_rcvbuf_handler(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *fpos) +{ + struct rds_tcp_net *rtn = container_of(ctl->data, struct rds_tcp_net, + rcvbuf_size); + + return rds_tcp_skbuf_handler(rtn, ctl, write, buffer, lenp, fpos); +} + static void rds_tcp_exit(void) { rds_tcp_set_unloading(); -- 2.9.5

2 1

[PATCH OLK-6.6] wifi: cfg80211: cancel wiphy_work before freeing wiphy
by Zhang Changzhong 28 Apr '25

28 Apr '25

From: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> stable inclusion from stable-v6.6.84 commit 75d262ad3c36d52852d764588fcd887f0fcd9138 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY431 CVE: CVE-2025-21979 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 72d520476a2fab6f3489e8388ab524985d6c4b90 ] A wiphy_work can be queued from the moment the wiphy is allocated and initialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the rdev::wiphy_work is getting queued. If wiphy_free is called before the rdev::wiphy_work had a chance to run, the wiphy memory will be freed, and then when it eventally gets to run it'll use invalid memory. Fix this by canceling the work before freeing the wiphy. Fixes: a3ee4dc84c4e ("wifi: cfg80211: add a work abstraction with special semantics") Signed-off-by: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> Reviewed-by: Johannes Berg <johannes.berg(a)intel.com> Link: https://patch.msgid.link/20250306123626.efd1d19f6e07.I48229f96f4067ef73f5b8… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/wireless/core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/wireless/core.c b/net/wireless/core.c index 3c12479..a2b1534 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -1151,6 +1151,13 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev) { struct cfg80211_internal_bss *scan, *tmp; struct cfg80211_beacon_registration *reg, *treg; + unsigned long flags; + + spin_lock_irqsave(&rdev->wiphy_work_lock, flags); + WARN_ON(!list_empty(&rdev->wiphy_work_list)); + spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags); + cancel_work_sync(&rdev->wiphy_work); + rfkill_destroy(rdev->wiphy.rfkill); list_for_each_entry_safe(reg, treg, &rdev->beacon_registrations, list) { list_del(&reg->list); -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS 0/3] ndisc: Fix CVE-2025-21764
by Dong Chenchen 28 Apr '25

28 Apr '25

Fix CVE-2025-21764. Eric Dumazet (2): net: add dev_net_rcu() helper ndisc: use RCU protection in ndisc_alloc_skb() Jiri Pirko (1): net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() include/linux/netdevice.h | 6 ++++++ include/net/net_namespace.h | 15 ++++++++++++--- net/ipv6/ndisc.c | 10 ++++------ 3 files changed, 22 insertions(+), 9 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 0/3] ndisc: Fix CVE-2025-21764
by Dong Chenchen 28 Apr '25

28 Apr '25

fix CVE-2025-21764. Eric Dumazet (2): net: add dev_net_rcu() helper ndisc: use RCU protection in ndisc_alloc_skb() Jiri Pirko (1): net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() include/linux/netdevice.h | 6 ++++++ include/net/net_namespace.h | 15 ++++++++++++--- net/ipv6/ndisc.c | 10 ++++------ 3 files changed, 22 insertions(+), 9 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 0/5] arm64/mpam: Expanding MPAM's QoS capability
by Zeng Heng 28 Apr '25

28 Apr '25

Zeng Heng (5): fs/resctrl: As a pre-patch for expanding MPAM's QoS capability arm64/mpam: Add CMAX feature arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add limit feature arch/x86/kernel/cpu/resctrl/core.c | 4 + drivers/platform/mpam/mpam_devices.c | 85 +++++-- drivers/platform/mpam/mpam_internal.h | 16 +- drivers/platform/mpam/mpam_resctrl.c | 326 +++++++++++++++++++++++--- fs/resctrl/ctrlmondata.c | 13 +- fs/resctrl/rdtgroup.c | 13 +- include/linux/resctrl.h | 19 +- include/linux/resctrl_types.h | 11 + 8 files changed, 418 insertions(+), 69 deletions(-) -- 2.25.1

2 6

[PATCH OLK-5.10 0/2] fuse: support fastpath
by chenrenhui 28 Apr '25

28 Apr '25

Support fuse fastpath by using the newly added kernel_ipc module. chenrenhui (2): ipc: add kernel_ipc module to enable fast process switching fuse: support fastpath via kernel_ipc Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 2 + fs/fuse/Kconfig | 6 + fs/fuse/dev.c | 744 +++++++++++++++++++++++++ fs/fuse/dir.c | 87 ++- fs/fuse/file.c | 244 +++++++- fs/fuse/fuse_i.h | 55 ++ fs/fuse/inode.c | 112 ++++ fs/fuse/readdir.c | 8 + include/linux/kernel_ipc.h | 48 ++ include/uapi/linux/fuse.h | 15 +- ipc/Kconfig | 5 + ipc/Makefile | 2 +- ipc/kernel_ipc.c | 305 ++++++++++ 14 files changed, 1605 insertions(+), 30 deletions(-) create mode 100644 include/linux/kernel_ipc.h create mode 100644 ipc/Kconfig create mode 100644 ipc/kernel_ipc.c -- 2.33.0

2 3

[PATCH OLK-6.6 0/5] drm: LoongArch: fix rx550/gfx6/gfx7/gfx8 error
by Hongchen Zhang 28 Apr '25

28 Apr '25

Tianrui Zhao (3): drm/amdgpu: Fix pcie order dislocation drm/amdgpu: make duplicated EOP packet for GFX6 have real content drm/amdgpu: Fix RX550 pcie order dislocation. lvjianmin (2): drm/radeon: repeat the same EOP packet for EOP workaround on CIK drm/amdgpu: make duplicated EOP packet for GFX7/8 have real content drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c | 161 ++++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ih.h | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.h | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 19 +++ drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 6 + drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 6 + drivers/gpu/drm/radeon/cik.c | 4 + 9 files changed, 214 insertions(+) -- 2.33.0

2 6

[PATCH OLK-6.6 0/5] arm64/mpam: Expanding MPAM's QoS capability
by Zeng Heng 28 Apr '25

28 Apr '25

Zeng Heng (5): fs/resctrl: As a pre-patch for expanding MPAM's QoS capability arm64/mpam: Add CMAX feature arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add limit feature arch/x86/kernel/cpu/resctrl/core.c | 4 + drivers/platform/mpam/mpam_devices.c | 85 +++++-- drivers/platform/mpam/mpam_internal.h | 16 +- drivers/platform/mpam/mpam_resctrl.c | 326 +++++++++++++++++++++++--- fs/resctrl/ctrlmondata.c | 13 +- fs/resctrl/rdtgroup.c | 13 +- include/linux/resctrl.h | 19 +- include/linux/resctrl_types.h | 11 + 8 files changed, 418 insertions(+), 69 deletions(-) -- 2.25.1

2 6

[PATCH OLK-5.10] jfs: add check read-only before truncation in jfs_truncate_nolock()
by zhangyuwei20＠huawei.com 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 980aa3300f10..515cd45d0386 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -379,7 +379,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS] udp: Fix memory accounting leak.
by Wang Liang 28 Apr '25

28 Apr '25

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> mainline inclusion from mainline-v6.15-rc1 commit df207de9d9e7a4d92f8567e2c539d9c8c12fd99d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC4CD8 CVE: CVE-2025-22058 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Matt Dowling reported a weird UDP memory usage issue. Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. However, it occasionally spiked to 524,288 pages and never dropped. Moreover, the value doubled when the application was terminated. Finally, it caused intermittent packet drops. We can reproduce the issue with the script below [0]: 1. /proc/net/sockstat reports 0 pages # cat /proc/net/sockstat | grep UDP: UDP: inuse 1 mem 0 2. Run the script till the report reaches 524,288 # python3 test.py & sleep 5 # cat /proc/net/sockstat | grep UDP: UDP: inuse 3 mem 524288 <-- (INT_MAX + 1) >> PAGE_SHIFT 3. Kill the socket and confirm the number never drops # pkill python3 && sleep 5 # cat /proc/net/sockstat | grep UDP: UDP: inuse 1 mem 524288 4. (necessary since v6.0) Trigger proto_memory_pcpu_drain() # python3 test.py & sleep 1 && pkill python3 5. The number doubles # cat /proc/net/sockstat | grep UDP: UDP: inuse 1 mem 1048577 The application set INT_MAX to SO_RCVBUF, which triggered an integer overflow in udp_rmem_release(). When a socket is close()d, udp_destruct_common() purges its receive queue and sums up skb->truesize in the queue. This total is calculated and stored in a local unsigned integer variable. The total size is then passed to udp_rmem_release() to adjust memory accounting. However, because the function takes a signed integer argument, the total size can wrap around, causing an overflow. Then, the released amount is calculated as follows: 1) Add size to sk->sk_forward_alloc. 2) Round down sk->sk_forward_alloc to the nearest lower multiple of PAGE_SIZE and assign it to amount. 3) Subtract amount from sk->sk_forward_alloc. 4) Pass amount >> PAGE_SHIFT to __sk_mem_reduce_allocated(). When the issue occurred, the total in udp_destruct_common() was 2147484480 (INT_MAX + 833), which was cast to -2147482816 in udp_rmem_release(). At 1) sk->sk_forward_alloc is changed from 3264 to -2147479552, and 2) sets -2147479552 to amount. 3) reverts the wraparound, so we don't see a warning in inet_sock_destruct(). However, udp_memory_allocated ends up doubling at 4). Since commit 3cd3399dd7a8 ("net: implement per-cpu reserves for memory_allocated"), memory usage no longer doubles immediately after a socket is close()d because __sk_mem_reduce_allocated() caches the amount in udp_memory_per_cpu_fw_alloc. However, the next time a UDP socket receives a packet, the subtraction takes effect, causing UDP memory usage to double. This issue makes further memory allocation fail once the socket's sk->sk_rmem_alloc exceeds net.ipv4.udp_rmem_min, resulting in packet drops. To prevent this issue, let's use unsigned int for the calculation and call sk_forward_alloc_add() only once for the small delta. Note that first_packet_length() also potentially has the same problem. [0]: from socket import * SO_RCVBUFFORCE = 33 INT_MAX = (2 ** 31) - 1 s = socket(AF_INET, SOCK_DGRAM) s.bind(('', 0)) s.setsockopt(SOL_SOCKET, SO_RCVBUFFORCE, INT_MAX) c = socket(AF_INET, SOCK_DGRAM) c.connect(s.getsockname()) data = b'a' * 100 while True: c.send(data) Fixes: f970bd9e3a06 ("udp: implement memory accounting helpers") Reported-by: Matt Dowling <madowlin(a)amazon.com> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://patch.msgid.link/20250401184501.67377-3-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/udp.c [conflicts due to not merge 5e6300e7b3a4 ("net: annotate data-races around sk->sk_forward_alloc"), conflicts due to not merge 100fdd1faf50 ("net: remove SK_MEM_QUANTUM and SK_MEM_QUANTUM_SHIFT")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv4/udp.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 98da60beab18..61af6d3388b6 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1296,12 +1296,12 @@ static bool udp_skb_has_head_state(struct sk_buff *skb) } /* fully reclaim rmem/fwd memory allocated for skb */ -static void udp_rmem_release(struct sock *sk, int size, int partial, - bool rx_queue_lock_held) +static void udp_rmem_release(struct sock *sk, unsigned int size, + int partial, bool rx_queue_lock_held) { struct udp_sock *up = udp_sk(sk); struct sk_buff_head *sk_queue; - int amt; + unsigned int amt; if (likely(partial)) { up->forward_deficit += size; @@ -1321,10 +1321,8 @@ static void udp_rmem_release(struct sock *sk, int size, int partial, if (!rx_queue_lock_held) spin_lock(&sk_queue->lock); - - sk->sk_forward_alloc += size; - amt = (sk->sk_forward_alloc - partial) & ~(SK_MEM_QUANTUM - 1); - sk->sk_forward_alloc -= amt; + amt = (size + sk->sk_forward_alloc - partial) & ~(SK_MEM_QUANTUM - 1); + sk->sk_forward_alloc = sk->sk_forward_alloc + size - amt; if (amt) __sk_mem_reduce_allocated(sk, amt >> SK_MEM_QUANTUM_SHIFT); @@ -1508,7 +1506,7 @@ EXPORT_SYMBOL_GPL(skb_consume_udp); static struct sk_buff *__first_packet_length(struct sock *sk, struct sk_buff_head *rcvq, - int *total) + unsigned int *total) { struct sk_buff *skb; @@ -1541,8 +1539,8 @@ static int first_packet_length(struct sock *sk) { struct sk_buff_head *rcvq = &udp_sk(sk)->reader_queue; struct sk_buff_head *sk_queue = &sk->sk_receive_queue; + unsigned int total = 0; struct sk_buff *skb; - int total = 0; int res; spin_lock_bh(&rcvq->lock); -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] arm64/mpam: Expanding MPAM's QoS capability
by Zeng Heng 28 Apr '25

28 Apr '25

Zeng Heng (5): fs/resctrl: As a pre-patch for expanding MPAM's QoS capability arm64/mpam: Add CMAX feature arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add limit feature arch/x86/kernel/cpu/resctrl/core.c | 6 +- drivers/platform/mpam/mpam_devices.c | 85 +++++-- drivers/platform/mpam/mpam_internal.h | 16 +- drivers/platform/mpam/mpam_resctrl.c | 326 +++++++++++++++++++++++--- fs/resctrl/ctrlmondata.c | 13 +- fs/resctrl/rdtgroup.c | 13 +- include/linux/resctrl.h | 19 +- include/linux/resctrl_types.h | 11 + 8 files changed, 419 insertions(+), 70 deletions(-) -- 2.25.1

2 6

[PATCH openEuler-1.0-LTS] jfs: add check read-only before truncation in jfs_truncate_nolock()
by Yongqiang Liu 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Reviewed-by: Chen Jun <chenjun102(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 68779cc3609a..5a60ba8c021e 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -381,7 +381,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.34.1

2 1

[PATCH OLK-6.6] jfs: add check read-only before truncation in jfs_truncate_nolock()
by Yongqiang Liu 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> Reviewed-by: Chen Jun <chenjun102(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 920d58a1566b..d1333e946f96 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -369,7 +369,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.34.1

2 1

[OLK-6.6] jfs: add check read-only before truncation in jfs_truncate_nolock()
by Yongqiang Liu 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> Reviewed-by: Chen Jun <chenjun102(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 920d58a1566b..d1333e946f96 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -369,7 +369,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.34.1

1 0

[openEuler-1.0-LTS] jfs: add check read-only before truncation in jfs_truncate_nolock()
by Yongqiang Liu 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Reviewed-by: Chen Jun <chenjun102(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 68779cc3609a..5a60ba8c021e 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -381,7 +381,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.34.1

1 0

[PATCH OLK-5.10] jfs: add check read-only before truncation in jfs_truncate_nolock()
by zhangyuwei20＠huawei.com 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 980aa3300f10..515cd45d0386 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -379,7 +379,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS 0/2] Backport SMC patchs
by Wang Liang 28 Apr '25

28 Apr '25

Ursula Braun (2): net/smc: propagate file from SMC to TCP socket net/smc: fix closing of fallback SMC sockets include/net/sock.h | 6 ------ net/smc/af_smc.c | 45 +++++++++++++++++++++++++++++++++++---------- 2 files changed, 35 insertions(+), 16 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/5] drm: LoongArch: fix rx550/gfx6/gfx7/gfx8 error
by Hongchen Zhang 28 Apr '25

28 Apr '25

Tianrui Zhao (3): drm/amdgpu: Fix pcie order dislocation drm/amdgpu: make duplicated EOP packet for GFX6 have real content drm/amdgpu: Fix RX550 pcie order dislocation. lvjianmin (2): drm/radeon: repeat the same EOP packet for EOP workaround on CIK drm/amdgpu: make duplicated EOP packet for GFX7/8 have real content drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c | 161 ++++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ih.h | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.h | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 19 +++ drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 13 +- drivers/gpu/drm/radeon/cik.c | 9 +- 9 files changed, 218 insertions(+), 15 deletions(-) -- 2.33.0

2 6

[PATCH OLK-5.10 0/2] fuse: support fastpath
by chenrenhui 28 Apr '25

28 Apr '25

Support fuse fastpath by using the newly added kernel_ipc module. chenrenhui (2): ipc: add kernel_ipc module to enable fast process switching fuse: support fastpath via kernel_ipc Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 2 + fs/fuse/Kconfig | 6 + fs/fuse/dev.c | 744 +++++++++++++++++++++++++ fs/fuse/dir.c | 87 ++- fs/fuse/file.c | 263 ++++++++- fs/fuse/fuse_i.h | 54 ++ fs/fuse/inode.c | 112 ++++ fs/fuse/readdir.c | 8 + include/linux/kernel_ipc.h | 48 ++ include/uapi/linux/fuse.h | 20 + ipc/Kconfig | 5 + ipc/Makefile | 2 +- ipc/kernel_ipc.c | 318 +++++++++++ 14 files changed, 1642 insertions(+), 29 deletions(-) create mode 100644 include/linux/kernel_ipc.h create mode 100644 ipc/Kconfig create mode 100644 ipc/kernel_ipc.c -- 2.33.0

2 3

[PATCH OLK-6.6] irqchip/mbigen: add check before deference 'mgn_chip'
by Bowen You 28 Apr '25

28 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4H9T -------------------------------- In function vtimer_mbigen_set_regs, variable dereferenced before check and it caused a warning: drivers/irqchip/irq-mbigen.c:746 vtimer_mbigen_set_regs() warn: variable dereferenced before check 'mgn_chip' (see line 737) To fix this, move the null-check logic before access base member in mgn_chip. Fixes: b8b70fe6bcf0 ("mbigen: Sets the regs related to vtimer irqbypass") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/irqchip/irq-mbigen.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c index 4e603fa73c33..a6aba60df599 100644 --- a/drivers/irqchip/irq-mbigen.c +++ b/drivers/irqchip/irq-mbigen.c @@ -719,6 +719,9 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) if (!vtimer_irqbypass) return 0; + if (!mgn_chip) + return -ENOMEM; + addr = mgn_chip->base + MBIGEN_CTLR_OFFSET; val = readl_relaxed(addr); mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; @@ -728,9 +731,6 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) } res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!mgn_chip) - return -ENOMEM; - if (res->start == CHIP0_TA_MBIGEN_PHY_BASE) { addr = ioremap(CHIP0_TA_PERI_PHY_BASE, 4); if (!addr) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] jfs: add check read-only before truncation in jfs_truncate_nolock()
by zhangyuwei20＠huawei.com 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 68779cc3609a..5a60ba8c021e 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -381,7 +381,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS] jfs: add check read-only before truncation in jfs_truncate_nolock()
by zhangyuwei20＠huawei.com 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 68779cc3609a..5a60ba8c021e 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -381,7 +381,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.22.0

1 0

[PATCH OLK-6.6] irqchip/mbigen: add check before deference 'mgn_chip'
by Bowen You 28 Apr '25

28 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4H9T -------------------------------- In function vtimer_mbigen_set_regs, variable dereferenced before check and it caused a warning: drivers/irqchip/irq-mbigen.c:746 vtimer_mbigen_set_regs() warn: variable dereferenced before check 'mgn_chip' (see line 737) To fix this, move the null-check logic before access base member in mgn_chip. Fixes: b8b70fe6bcf0 ("mbigen: Sets the regs related to vtimer irqbypass") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/irqchip/irq-mbigen.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c index 4e603fa73c33..56954d959629 100644 --- a/drivers/irqchip/irq-mbigen.c +++ b/drivers/irqchip/irq-mbigen.c @@ -719,6 +719,9 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) if (!vtimer_irqbypass) return 0; + if (!mgn_chip) + return -ENOMEM; + addr = mgn_chip->base + MBIGEN_CTLR_OFFSET; val = readl_relaxed(addr); mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; @@ -728,8 +731,6 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) } res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!mgn_chip) - return -ENOMEM; if (res->start == CHIP0_TA_MBIGEN_PHY_BASE) { addr = ioremap(CHIP0_TA_PERI_PHY_BASE, 4); -- 2.34.1

2 1

[PATCH OLK-5.10] [Backport] scsi: qla2xxx: Fix premature hw access after PCI error
by Lin Ruifeng 28 Apr '25

28 Apr '25

From: Quinn Tran <qutran(a)marvell.com> stable inclusion from stable-v5.15.33 commit 5ef6319f9882699613d5182fbd7929b017e8c5ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6P6 CVE: CVE-2022-49157 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e35920ab7874d5e2faeb4f958a74bfa793f1ce5a upstream. After a recoverable PCI error has been detected and recovered, qla driver needs to check to see if the error condition still persist and/or wait for the OS to give the resume signal. Sep 8 22:26:03 localhost kernel: WARNING: CPU: 9 PID: 124606 at qla_tmpl.c:440 qla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx] Sep 8 22:26:03 localhost kernel: RIP: 0010:qla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx] Sep 8 22:26:03 localhost kernel: Call Trace: Sep 8 22:26:03 localhost kernel: ? qla27xx_walk_template+0xb1/0x1b0 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla27xx_execute_fwdt_template+0x12a/0x160 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla27xx_fwdump+0xa0/0x1c0 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla2xxx_pci_mmio_enabled+0xfb/0x120 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? report_mmio_enabled+0x44/0x80 Sep 8 22:26:03 localhost kernel: ? report_slot_reset+0x80/0x80 Sep 8 22:26:03 localhost kernel: ? pci_walk_bus+0x70/0x90 Sep 8 22:26:03 localhost kernel: ? aer_dev_correctable_show+0xc0/0xc0 Sep 8 22:26:03 localhost kernel: ? pcie_do_recovery+0x1bb/0x240 Sep 8 22:26:03 localhost kernel: ? aer_recover_work_func+0xaa/0xd0 Sep 8 22:26:03 localhost kernel: ? process_one_work+0x1a7/0x360 .. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-8041:22: detected PCI disconnect. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: qla27xx_fwdt_entry_t262: dump ram MB failed. Area 5h start 198013h end 198013h Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: Unable to capture FW dump Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-1015:22: cmd=0x0, waited 5221 msecs Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-680d:22: mmio enabled returning. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-d04c:22: MBX Command timeout for cmd 0, iocontrol=ffffffff jiffies=10140f2e5 mb[0-3]=[0xffff 0xffff 0xffff 0xffff] Link: https://lore.kernel.org/r/20220110050218.3958-6-njavali@marvell.com Cc: stable(a)vger.kernel.org Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Quinn Tran <qutran(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/scsi/qla2xxx/qla_os.c | 10 +++++++++- drivers/scsi/qla2xxx/qla_tmpl.c | 9 +++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c index a6ecb4bb7456..b60da5d4d79c 100644 --- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -7444,7 +7444,7 @@ qla2xxx_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state) switch (state) { case pci_channel_io_normal: - ha->flags.eeh_busy = 0; + qla_pci_set_eeh_busy(vha); if (ql2xmqsupport || ql2xnvmeenable) { set_bit(QPAIR_ONLINE_CHECK_NEEDED, &vha->dpc_flags); qla2xxx_wake_dpc(vha); @@ -7485,9 +7485,16 @@ qla2xxx_pci_mmio_enabled(struct pci_dev *pdev) "mmio enabled\n"); ha->pci_error_state = QLA_PCI_MMIO_ENABLED; + if (IS_QLA82XX(ha)) return PCI_ERS_RESULT_RECOVERED; + if (qla2x00_isp_reg_stat(ha)) { + ql_log(ql_log_info, base_vha, 0x803f, + "During mmio enabled, PCI/Register disconnect still detected.\n"); + goto out; + } + spin_lock_irqsave(&ha->hardware_lock, flags); if (IS_QLA2100(ha) || IS_QLA2200(ha)){ stat = rd_reg_word(&reg->hccr); @@ -7509,6 +7516,7 @@ qla2xxx_pci_mmio_enabled(struct pci_dev *pdev) "RISC paused -- mmio_enabled, Dumping firmware.\n"); qla2xxx_dump_fw(base_vha); } +out: /* set PCI_ERS_RESULT_NEED_RESET to trigger call to qla2xxx_pci_slot_reset */ ql_dbg(ql_dbg_aer, base_vha, 0x600d, "mmio enabled returning.\n"); diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c index 26c13a953b97..b0a74b036cf4 100644 --- a/drivers/scsi/qla2xxx/qla_tmpl.c +++ b/drivers/scsi/qla2xxx/qla_tmpl.c @@ -435,8 +435,13 @@ qla27xx_fwdt_entry_t266(struct scsi_qla_host *vha, { ql_dbg(ql_dbg_misc, vha, 0xd20a, "%s: reset risc [%lx]\n", __func__, *len); - if (buf) - WARN_ON_ONCE(qla24xx_soft_reset(vha->hw) != QLA_SUCCESS); + if (buf) { + if (qla24xx_soft_reset(vha->hw) != QLA_SUCCESS) { + ql_dbg(ql_dbg_async, vha, 0x5001, + "%s: unable to soft reset\n", __func__); + return INVALID_ENTRY; + } + } return qla27xx_next_entry(ent); } -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] jfs: add check read-only before truncation in jfs_truncate_nolock()
by zhangyuwei20＠huawei.com 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 68779cc3609a..5a60ba8c021e 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -381,7 +381,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS 0/2] Backport SMC patchs
by Wang Liang 28 Apr '25

28 Apr '25

Ursula Braun (2): net/smc: propagate file from SMC to TCP socket net/smc: fix closing of fallback SMC sockets include/net/sock.h | 6 ------ net/smc/af_smc.c | 45 +++++++++++++++++++++++++++++++++++---------- 2 files changed, 35 insertions(+), 16 deletions(-) -- 2.34.1

1 2

[PATCH openEuler-1.0-LTS] jfs: add check read-only before truncation in jfs_truncate_nolock()
by zhangyuwei20＠huawei.com 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 68779cc3609a..5a60ba8c021e 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -381,7 +381,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.22.0

1 0

[PATCH OPENEULER-1.0-LTS] [Backport] jfs: add check read-only before truncation in jfs_truncate_nolock()
by zhangyuwei20＠huawei.com 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 68779cc3609a..5a60ba8c021e 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -381,7 +381,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS] [Backport] drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
by Lin Ruifeng 28 Apr '25

28 Apr '25

From: Zhou Qingyang <zhou1615(a)umn.edu> stable inclusion from stable-v4.19.238 commit 2c729dec8c1e3e2892fde5ce8181553860914e74 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6X6 CVE: CVE-2022-49232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 588a70177df3b1777484267584ef38ab2ca899a2 ] In amdgpu_dm_connector_add_common_modes(), amdgpu_dm_create_common_mode() is assigned to mode and is passed to drm_mode_probed_add() directly after that. drm_mode_probed_add() passes &mode->head to list_add_tail(), and there is a dereference of it in list_add_tail() without recoveries, which could lead to NULL pointer dereference on failure of amdgpu_dm_create_common_mode(). Fix this by adding a NULL check of mode. This bug was found by a static analyzer. Builds with 'make allyesconfig' show no new warnings, and our static analyzer no longer warns about this code. Fixes: e7b07ceef2a6 ("drm/amd/display: Merge amdgpu_dm_types and amdgpu_dm") Signed-off-by: Zhou Qingyang <zhou1615(a)umn.edu> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 65fb64c8727f..58b66ca4f3bd 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -3595,6 +3595,9 @@ static void amdgpu_dm_connector_add_common_modes(struct drm_encoder *encoder, mode = amdgpu_dm_create_common_mode(encoder, common_modes[i].name, common_modes[i].w, common_modes[i].h); + if (!mode) + continue; + drm_mode_probed_add(connector, mode); amdgpu_dm_connector->num_modes++; } -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS] [Backport] staging: rtl8712: fix uninit-value in r871xu_drv_init()
by Lin Ruifeng 28 Apr '25

28 Apr '25

From: Wang Cheng <wanngchenng(a)gmail.com> stable inclusion from stable-v4.19.247 commit a6535d00a9d54ce1c2a8d86a85001ffb6844f9b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP5XN CVE: CVE-2022-49298 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0458e5428e5e959d201a40ffe71d762a79ecedc4 ] When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0, 'mac[6]' will not be initialized. BUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541 r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 really_probe+0x653/0x14b0 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238 usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293 really_probe+0x653/0x14b0 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566 hub_port_connect drivers/usb/core/hub.c:5358 [inline] hub_port_connect_change drivers/usb/core/hub.c:5502 [inline] port_event drivers/usb/core/hub.c:5660 [inline] hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742 process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307 worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454 kthread+0x3c7/0x500 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 Local variable mac created at: r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 KMSAN: uninit-value in r871xu_drv_init https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00b… Reported-by: <syzbot+6f5ecd144854c0d8580b(a)syzkaller.appspotmail.com> Tested-by: <syzbot+6f5ecd144854c0d8580b(a)syzkaller.appspotmail.com> Reviewed-by: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Wang Cheng <wanngchenng(a)gmail.com> Link: https://lore.kernel.org/r/14c3886173dfa4597f0704547c414cfdbcd11d16.16526182… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/staging/rtl8712/usb_intf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c index 709d687180bf..c10d1cbad816 100644 --- a/drivers/staging/rtl8712/usb_intf.c +++ b/drivers/staging/rtl8712/usb_intf.c @@ -569,13 +569,13 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf, } else { AutoloadFail = false; } - if (((mac[0] == 0xff) && (mac[1] == 0xff) && + if ((!AutoloadFail) || + ((mac[0] == 0xff) && (mac[1] == 0xff) && (mac[2] == 0xff) && (mac[3] == 0xff) && (mac[4] == 0xff) && (mac[5] == 0xff)) || ((mac[0] == 0x00) && (mac[1] == 0x00) && (mac[2] == 0x00) && (mac[3] == 0x00) && - (mac[4] == 0x00) && (mac[5] == 0x00)) || - (!AutoloadFail)) { + (mac[4] == 0x00) && (mac[5] == 0x00))) { mac[0] = 0x00; mac[1] = 0xe0; mac[2] = 0x4c; -- 2.22.0

1 0

[PATCH OLK-6.6] irqchip/mbigen: add check before deference 'mgn_chip'
by Bowen You 28 Apr '25

28 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4H9T -------------------------------- In function vtimer_mbigen_set_regs, variable dereferenced before check and it caused a warning: drivers/irqchip/irq-mbigen.c:746 vtimer_mbigen_set_regs() warn: variable dereferenced before check 'mgn_chip' (see line 737) To fix this, move the null-check logic before access base member in mgn_chip. Fixes: b8b70fe6bcf0 ("mbigen: Sets the regs related to vtimer irqbypass") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/irqchip/irq-mbigen.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c index 4e603fa73c33..56954d959629 100644 --- a/drivers/irqchip/irq-mbigen.c +++ b/drivers/irqchip/irq-mbigen.c @@ -719,6 +719,9 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) if (!vtimer_irqbypass) return 0; + if (!mgn_chip) + return -ENOMEM; + addr = mgn_chip->base + MBIGEN_CTLR_OFFSET; val = readl_relaxed(addr); mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; @@ -728,8 +731,6 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) } res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!mgn_chip) - return -ENOMEM; if (res->start == CHIP0_TA_MBIGEN_PHY_BASE) { addr = ioremap(CHIP0_TA_PERI_PHY_BASE, 4); -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] [Backport] jfs: add check read-only before truncation in jfs_truncate_nolock()
by zhangyuwei20＠huawei.com 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 68779cc3609a..5a60ba8c021e 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -381,7 +381,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.22.0

1 0

[PATCH OLK-6.6] irqchip/mbigen: add check before deference 'mgn_chip'
by Bowen You 28 Apr '25

28 Apr '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4H9T -------------------------------- In function vtimer_mbigen_set_regs, variable dereferenced before check and it caused a warning: drivers/irqchip/irq-mbigen.c:746 vtimer_mbigen_set_regs() warn: variable dereferenced before check 'mgn_chip' (see line 737) To fix this, move the null-check logic before access base member in mgn_chip. Fixes: b8b70fe6bcf0 ("mbigen: Sets the regs related to vtimer irqbypass") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/irqchip/irq-mbigen.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c index 4e603fa73c33..56954d959629 100644 --- a/drivers/irqchip/irq-mbigen.c +++ b/drivers/irqchip/irq-mbigen.c @@ -719,6 +719,9 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) if (!vtimer_irqbypass) return 0; + if (!mgn_chip) + return -ENOMEM; + addr = mgn_chip->base + MBIGEN_CTLR_OFFSET; val = readl_relaxed(addr); mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; @@ -728,8 +731,6 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) } res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!mgn_chip) - return -ENOMEM; if (res->start == CHIP0_TA_MBIGEN_PHY_BASE) { addr = ioremap(CHIP0_TA_PERI_PHY_BASE, 4); -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Verify event formats that have "%*p.."
by Pu Lehui 27 Apr '25

27 Apr '25

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.15-rc1 commit ea8d7647f9ddf1f81e2027ed305299797299aa03 category: bugfix bugzilla: 190584 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself or in data that will never be freed. If an event references data that was allocated when the event triggered and that same data is freed before the event is read, then the kernel can crash by reading freed memory. The verifier runs at boot up (or module load) and scans the print formats of the events and checks their arguments to make sure that dereferenced pointers are safe. If the format uses "%*p.." the verifier will ignore it, and that could be dangerous. Cover this case as well. Also add to the sample code a use case of "%*pbl". Link: https://lore.kernel.org/all/bcba4d76-2c3f-4d11-baf0-02905db953dd@oracle.com/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Fixes: 5013f454a352c ("tracing: Add check of trace event print fmts for dereferencing pointers") Link: https://lore.kernel.org/20250327195311.2d89ec66@gandalf.local.home Reported-by: Libo Chen <libo.chen(a)oracle.com> Reviewed-by: Libo Chen <libo.chen(a)oracle.com> Tested-by: Libo Chen <libo.chen(a)oracle.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace_events.c samples/trace_events/trace-events-sample.h [The conflicts were due to some minor issues] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/trace_events.c | 7 +++++++ samples/trace_events/trace-events-sample.h | 8 ++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 9d22745cdea5..f2e07d470784 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -470,6 +470,7 @@ static void test_event_printk(struct trace_event_call *call) case '%': continue; case 'p': + do_pointer: /* Find dereferencing fields */ switch (fmt[i + 1]) { case 'B': case 'R': case 'r': @@ -498,6 +499,12 @@ static void test_event_printk(struct trace_event_call *call) continue; if (fmt[i + j] == '*') { star = true; + /* Handle %*pbl case */ + if (!j && fmt[i + 1] == 'p') { + arg++; + i++; + goto do_pointer; + } continue; } if ((fmt[i + j] == 's')) { diff --git a/samples/trace_events/trace-events-sample.h b/samples/trace_events/trace-events-sample.h index 1c6b843b8c4e..6a5d4717f37a 100644 --- a/samples/trace_events/trace-events-sample.h +++ b/samples/trace_events/trace-events-sample.h @@ -315,7 +315,8 @@ TRACE_EVENT(foo_bar, __assign_cpumask(cpum, cpumask_bits(mask)); ), - TP_printk("foo %s %d %s %s %s %s (%s) (%s) %s", __entry->foo, __entry->bar, + TP_printk("foo %s %d %s %s %s %s (%s) (%s) %s [%d] %*pbl", + __entry->foo, __entry->bar, /* * Notice here the use of some helper functions. This includes: @@ -360,7 +361,10 @@ TRACE_EVENT(foo_bar, __get_dynamic_array_len(list) / sizeof(int), sizeof(int)), __get_str(str), __get_bitmask(cpus), __get_cpumask(cpum), - __get_str(vstr)) + __get_str(vstr), + __get_dynamic_array_len(cpus), + __get_dynamic_array_len(cpus), + __get_dynamic_array(cpus)) ); /* -- 2.34.1

2 1

[PATCH OLK-6.6] irqchip/mbigen: add check before deference 'mgn_chip'
by Bowen You 27 Apr '25

27 Apr '25

Offering: HULK hulk inclusion category: bugfix bugzilla: 190582 -------------------------------- In function vtimer_mbigen_set_regs, variable dereferenced before check and it caused a warning: drivers/irqchip/irq-mbigen.c:746 vtimer_mbigen_set_regs() warn: variable dereferenced before check 'mgn_chip' (see line 737) To fix this, move the null-check logic before access base member in mgn_chip. Fixes: b8b70fe6bcf0 ("mbigen: Sets the regs related to vtimer irqbypass") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/irqchip/irq-mbigen.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c index 4e603fa73c33..56954d959629 100644 --- a/drivers/irqchip/irq-mbigen.c +++ b/drivers/irqchip/irq-mbigen.c @@ -719,6 +719,9 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) if (!vtimer_irqbypass) return 0; + if (!mgn_chip) + return -ENOMEM; + addr = mgn_chip->base + MBIGEN_CTLR_OFFSET; val = readl_relaxed(addr); mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; @@ -728,8 +731,6 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) } res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!mgn_chip) - return -ENOMEM; if (res->start == CHIP0_TA_MBIGEN_PHY_BASE) { addr = ioremap(CHIP0_TA_PERI_PHY_BASE, 4); -- 2.34.1

2 1

[PATCH OLK-6.6] ext4: fix the logic to determine whether buffered IO can use iomap
by Yongjian Sun 27 Apr '25

27 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC2EYK ---------------------------------------- The current logic for determining whether buffered IO can use iomap only checks for the EXT4_MOUNT_JOURNAL_DATA mount flag. However, when a user dynamically sets the EXT4_INODE_JOURNAL_DATA flag for a specific file, that file should switch to `data=journal` mode and clear the EXT4_STATE_BUFFERED_IOMAP flag, falling back to the regular buffer head path. Therefore, we have added a new condition to the logic to check if the file has the EXT4_INODE_JOURNAL_DATA flag set. It is important to note that if this flag is set dynamically for a specific file during runtime, the setting cannot take effect immediately because the inode already exists in memory with the EXT4_STATE_BUFFERED_IOMAP flag set. To make it take effect immediately, the user needs to execute a drop cache operation. Fixes: c691783a086b ("ext4: partial enable iomap for regular file's buffered IO path") Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index bc5aa01cc6da..1e27155797cc 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -5359,7 +5359,8 @@ bool ext4_should_use_buffered_iomap(struct inode *inode) return false; if (ext4_has_feature_verity(sb)) return false; - if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) + if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA || + ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA)) return false; if (!S_ISREG(inode->i_mode)) return false; -- 2.39.2

2 1