- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 2547/14244] kernel/sched/core.c:11514:74: warning: format '%llu' expects argument of type 'long long unsigned int', but argument 6 has type 'int'
by kernel test robot 30 Sep '24

30 Sep '24

Hi Hui, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 91ff8f4b711382909faa289c49735e0514af6f76 commit: 6eb07f9925a906d81f328c808ba25f7800888dce [2547/14244] sched: Introduce smart grid scheduling strategy for cfs config: loongarch-randconfig-001-20240930 (https://download.01.org/0day-ci/archive/20240930/202409300437.ZymNl30Z-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240930/202409300437.ZymNl30Z-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409300437.ZymNl30Z-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/irq.h:23, from arch/loongarch/include/asm/hardirq.h:10, from include/linux/hardirq.h:11, from include/linux/highmem.h:12, from kernel/sched/core.c:9: include/linux/nmi.h: In function 'trigger_all_cpu_backtrace': arch/loongarch/include/asm/irq.h:42:40: error: void value not ignored as it ought to be 42 | #define arch_trigger_cpumask_backtrace arch_trigger_cpumask_backtrace include/linux/nmi.h:160:16: note: in expansion of macro 'arch_trigger_cpumask_backtrace' 160 | return arch_trigger_cpumask_backtrace(cpu_online_mask, -1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/nmi.h: In function 'trigger_allbutcpu_cpu_backtrace': arch/loongarch/include/asm/irq.h:42:40: error: void value not ignored as it ought to be 42 | #define arch_trigger_cpumask_backtrace arch_trigger_cpumask_backtrace include/linux/nmi.h:165:16: note: in expansion of macro 'arch_trigger_cpumask_backtrace' 165 | return arch_trigger_cpumask_backtrace(cpu_online_mask, exclude_cpu); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/nmi.h: In function 'trigger_cpumask_backtrace': arch/loongarch/include/asm/irq.h:42:40: error: void value not ignored as it ought to be 42 | #define arch_trigger_cpumask_backtrace arch_trigger_cpumask_backtrace include/linux/nmi.h:170:16: note: in expansion of macro 'arch_trigger_cpumask_backtrace' 170 | return arch_trigger_cpumask_backtrace(mask, -1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/nmi.h: In function 'trigger_single_cpu_backtrace': arch/loongarch/include/asm/irq.h:42:40: error: void value not ignored as it ought to be 42 | #define arch_trigger_cpumask_backtrace arch_trigger_cpumask_backtrace include/linux/nmi.h:175:16: note: in expansion of macro 'arch_trigger_cpumask_backtrace' 175 | return arch_trigger_cpumask_backtrace(cpumask_of(cpu), -1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/core.c: At top level: kernel/sched/core.c:11374:5: warning: no previous prototype for 'tg_set_dynamic_affinity_mode' [-Wmissing-prototypes] 11374 | int tg_set_dynamic_affinity_mode(struct task_group *tg, u64 mode) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/core.c:11415:5: warning: no previous prototype for 'tg_set_affinity_period' [-Wmissing-prototypes] 11415 | int tg_set_affinity_period(struct task_group *tg, u64 period_ms) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/sched/core.c:11429:5: warning: no previous prototype for 'tg_get_affinity_period' [-Wmissing-prototypes] 11429 | u64 tg_get_affinity_period(struct task_group *tg) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/sched/core.c: In function 'cpu_affinity_stat_show': >> kernel/sched/core.c:11514:74: warning: format '%llu' expects argument of type 'long long unsigned int', but argument 6 has type 'int' [-Wformat=] 11514 | seq_printf(sf, "sd_level %d, cpu list %*pbl, stay_cnt %llu\n", | ~~~^ | | | long long unsigned int | %u In file included from kernel/sched/core.c:54: include/linux/nmi.h: In function 'trigger_single_cpu_backtrace': include/linux/nmi.h:176:1: warning: control reaches end of non-void function [-Wreturn-type] 176 | } | ^ vim +11514 kernel/sched/core.c 11493 11494 static int cpu_affinity_stat_show(struct seq_file *sf, void *v) 11495 { 11496 struct task_group *tg = css_tg(seq_css(sf)); 11497 struct auto_affinity *auto_affi = tg->auto_affinity; 11498 struct affinity_domain *ad; 11499 int i; 11500 11501 /* No stat when dynamic affinity disabled */ 11502 if (!dynamic_affinity_enabled()) 11503 return -EPERM; 11504 11505 if (unlikely(!auto_affi)) 11506 return -EPERM; 11507 11508 ad = &auto_affi->ad; 11509 seq_printf(sf, "period_active %d\n", auto_affi->period_active); 11510 seq_printf(sf, "dcount %d\n", ad->dcount); 11511 seq_printf(sf, "domain_mask 0x%x\n", ad->domain_mask); 11512 seq_printf(sf, "curr_level %d\n", ad->curr_level); 11513 for (i = 0; i < ad->dcount; i++) 11514 seq_printf(sf, "sd_level %d, cpu list %*pbl, stay_cnt %llu\n", 11515 i, cpumask_pr_args(ad->domains[i]), 11516 schedstat_val(ad->stay_cnt[i])); 11517 11518 return 0; 11519 } 11520 #endif /* CONFIG_QOS_SCHED_SMART_GRID */ 11521 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 13419/30000] drivers/net/ethernet/netswift/ngbe/ngbe_main.c:2658:30: warning: unused variable 'adapter'
by kernel test robot 30 Sep '24

30 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0988d5e5eb47d35a2babb4c0d6b6b81aa0fccbd3 commit: a5961b4bc6ce09a70902686ecc848a47493a9251 [13419/30000] openeuler: net: ngbe: add ngbe module support config: x86_64-randconfig-015-20240929 (https://download.01.org/0day-ci/archive/20240930/202409300306.EInsH8lZ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240930/202409300306.EInsH8lZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409300306.EInsH8lZ-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/netswift/ngbe/ngbe_main.c:23: drivers/net/ethernet/netswift/ngbe/ngbe.h: In function 'ngbe_misc_isb': drivers/net/ethernet/netswift/ngbe/ngbe.h:741:13: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 741 | u32 cur_diff = 0; | ^~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_main.c: At top level: drivers/net/ethernet/netswift/ngbe/ngbe_main.c:139:6: warning: no previous prototype for 'ngbe_service_event_schedule' [-Wmissing-prototypes] 139 | void ngbe_service_event_schedule(struct ngbe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_main.c: In function 'ngbe_tx_timeout': drivers/net/ethernet/netswift/ngbe/ngbe_main.c:401:14: warning: variable 'real_tx_hang' set but not used [-Wunused-but-set-variable] 401 | bool real_tx_hang = false; | ^~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_main.c: In function 'ngbe_addr_list_itr': >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:2658:30: warning: unused variable 'adapter' [-Wunused-variable] 2658 | struct ngbe_adapter *adapter = hw->back; | ^~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_main.c: At top level: drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3159:6: warning: no previous prototype for 'ngbe_configure_isb' [-Wmissing-prototypes] 3159 | void ngbe_configure_isb(struct ngbe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3173:6: warning: no previous prototype for 'ngbe_configure_port' [-Wmissing-prototypes] 3173 | void ngbe_configure_port(struct ngbe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3529:6: warning: no previous prototype for 'ngbe_disable_device' [-Wmissing-prototypes] 3529 | void ngbe_disable_device(struct ngbe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3644:5: warning: no previous prototype for 'ngbe_init_shared_code' [-Wmissing-prototypes] 3644 | s32 ngbe_init_shared_code(struct ngbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5791:5: warning: no previous prototype for 'ngbe_skb_pad_nonzero' [-Wmissing-prototypes] 5791 | int ngbe_skb_pad_nonzero(struct sk_buff *skb, int pad) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_main.c: In function 'ngbe_mii_ioctl': drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5989:20: warning: variable 'devad' set but not used [-Wunused-but-set-variable] 5989 | int prtad, devad, ret = 0; | ^~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5989:13: warning: variable 'prtad' set but not used [-Wunused-but-set-variable] 5989 | int prtad, devad, ret = 0; | ^~~~~ vim +/adapter +2658 drivers/net/ethernet/netswift/ngbe/ngbe_main.c 2652 2653 static u8 *ngbe_addr_list_itr(struct ngbe_hw *hw, 2654 u8 **mc_addr_ptr, u32 *vmdq) 2655 { 2656 struct netdev_hw_addr *mc_ptr; 2657 u8 *addr = *mc_addr_ptr; > 2658 struct ngbe_adapter *adapter = hw->back; 2659 2660 /* VMDQ_P implicitely uses the adapter struct when CONFIG_PCI_IOV is 2661 * defined, so we have to wrap the pointer above correctly to prevent 2662 * a warning. 2663 */ 2664 *vmdq = VMDQ_P(0); 2665 2666 mc_ptr = container_of(addr, struct netdev_hw_addr, addr[0]); 2667 if (mc_ptr->list.next) { 2668 struct netdev_hw_addr *ha; 2669 2670 ha = list_entry(mc_ptr->list.next, struct netdev_hw_addr, list); 2671 *mc_addr_ptr = ha->addr; 2672 } else { 2673 *mc_addr_ptr = NULL; 2674 } 2675 2676 return addr; 2677 } 2678 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 983693eea268270a0270335c61b8ed2188ca0017
by kernel test robot 30 Sep '24

30 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 983693eea268270a0270335c61b8ed2188ca0017 !11863 memcg_write_event_control(): fix a user-triggerable oops Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202409292359.ZkCbEvo9-lkp@intel.com include/linux/kernel.h:875:9: error: first argument to '__builtin_choose_expr' not a constant Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | `-- include-linux-thread_info.h:warning:b-may-be-used-uninitialized |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-001-20240929 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-003-20240929 | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-004-20240929 | |-- arch-arm64-kvm-..-..-..-virt-kvm-arm-arm.c:error:struct-sched_info-has-no-member-named-run_delay | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | `-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount |-- x86_64-allnoconfig | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | `-- drivers-net-ethernet-stmicro-stmmac-dwmac-phytium.c:error:incompatible-pointer-to-integer-conversion-returning-void-from-a-function-with-result-type-int |-- x86_64-buildonly-randconfig-002-20240929 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20240929 | `-- fs-gfs2-bmap.c:warning:lblock-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-005-20240929 | |-- arch-x86-kernel-unwind_orc.o:warning:objtool:missing-symbol-for-section-.text | `-- drivers-clk-renesas-rcar-gen3-cpg.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20240929 | `-- drivers-md-.tmp_dm-verity-verify-sig.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-kexec | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-002-20240929 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-randconfig-003-20240929 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-randconfig-006-20240929 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-161-20240929 `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration elapsed time: 731m configs tested: 27 configs skipped: 128 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240929 gcc-14.1.0 arm64 randconfig-002-20240929 gcc-14.1.0 arm64 randconfig-003-20240929 gcc-14.1.0 arm64 randconfig-004-20240929 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240929 clang-18 x86_64 buildonly-randconfig-002-20240929 clang-18 x86_64 buildonly-randconfig-003-20240929 gcc-12 x86_64 buildonly-randconfig-004-20240929 clang-18 x86_64 buildonly-randconfig-005-20240929 clang-18 x86_64 buildonly-randconfig-006-20240929 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20240929 clang-18 x86_64 randconfig-002-20240929 gcc-12 x86_64 randconfig-003-20240929 gcc-12 x86_64 randconfig-004-20240929 gcc-12 x86_64 randconfig-005-20240929 clang-18 x86_64 randconfig-006-20240929 clang-18 x86_64 randconfig-011-20240929 gcc-12 x86_64 randconfig-012-20240929 gcc-12 x86_64 randconfig-013-20240929 clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13319/14244] drivers/crypto/ccp/hygon/tdm-kernel-guard.c:308:23: error: use of undeclared identifier 'NR_syscalls'
by kernel test robot 30 Sep '24

30 Sep '24

Hi chench00, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 91ff8f4b711382909faa289c49735e0514af6f76 commit: 3ad98583441f7c8a2553e1e8d6340ed4397033e2 [13319/14244] crypto: tdm: Support dynamic protection for SCT and IDT by HYGON TDM config: x86_64-buildonly-randconfig-004-20240929 (https://download.01.org/0day-ci/archive/20240930/202409300206.JS60OQQZ-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240930/202409300206.JS60OQQZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409300206.JS60OQQZ-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:5: warning: no previous prototype for function 'tdm_service_run' [-Wmissing-prototypes] 151 | int tdm_service_run(struct tdm_security_enhance *data) | ^ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 151 | int tdm_service_run(struct tdm_security_enhance *data) | ^ | static drivers/crypto/ccp/hygon/tdm-kernel-guard.c:212:5: warning: no previous prototype for function 'tdm_service_exit' [-Wmissing-prototypes] 212 | int tdm_service_exit(struct tdm_security_enhance *data) | ^ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:212:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 212 | int tdm_service_exit(struct tdm_security_enhance *data) | ^ | static drivers/crypto/ccp/hygon/tdm-kernel-guard.c:243:15: warning: no previous prototype for function 'kprobe_symbol_address_byname' [-Wmissing-prototypes] 243 | unsigned long kprobe_symbol_address_byname(const char *name) | ^ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:243:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 243 | unsigned long kprobe_symbol_address_byname(const char *name) | ^ | static >> drivers/crypto/ccp/hygon/tdm-kernel-guard.c:308:23: error: use of undeclared identifier 'NR_syscalls' 308 | eh_objs[SCT].size = NR_syscalls * sizeof(char *); | ^ 3 warnings and 1 error generated. vim +/NR_syscalls +308 drivers/crypto/ccp/hygon/tdm-kernel-guard.c 286 287 sct_addr = (unsigned long *)kallsyms_lookup_name("sys_call_table"); 288 #endif 289 if (!sct_addr) { 290 ret = -DYN_ERR_API; 291 pr_err("kallsyms_lookup_name for sys_call_table failed!"); 292 goto end; 293 } 294 295 asm("sidt %0":"=m"(idtr)); 296 297 if (!psp_check_tdm_support()) 298 return 0; 299 300 for (i = 0; i < MAX_OBJ; i++) { 301 memset(&eh_objs[i], 0, sizeof(eh_objs[i])); 302 eh_objs[i].context = CONTEXT_CHECK_MODNAME; 303 eh_objs[i].obj_name = obj_names[i]; 304 } 305 306 if ((eh_obj == -1) || (eh_obj & (1 << SCT))) { 307 eh_objs[SCT].vaddr = (uint64_t)sct_addr; > 308 eh_objs[SCT].size = NR_syscalls * sizeof(char *); 309 } 310 if ((eh_obj == -1) || (eh_obj & (1 << IDT))) { 311 eh_objs[IDT].vaddr = idtr.address; 312 eh_objs[IDT].size = idtr.size; 313 } 314 315 for (i = 0; i < MAX_OBJ; i++) { 316 if (eh_objs[i].vaddr) 317 tdm_service_run(&eh_objs[i]); 318 } 319 320 pr_info("Hygon TDM guard load successfully!\n"); 321 322 end: 323 return ret; 324 } 325 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 16089/30000] arch/arm64/include/asm/stack_pointer.h:8:51: error: register 'sp' unsuitable for global register variables on this target
by kernel test robot 30 Sep '24

30 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0988d5e5eb47d35a2babb4c0d6b6b81aa0fccbd3 commit: 78568d28ad62c586e32e3989de5354fcb014c09f [16089/30000] scripts: Fix issue of module signing with openssl 3.x config: arm64-randconfig-002-20240930 (https://download.01.org/0day-ci/archive/20240930/202409300131.UCq7Om7a-lkp@…) compiler: clang version 15.0.7 (https://github.com/llvm/llvm-project 8dfdcc7b7bf66834a761bd8de445840ef68e4d1a) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240930/202409300131.UCq7Om7a-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409300131.UCq7Om7a-lkp@intel.com/ All errors (new ones prefixed by >>): WARNING: unmet direct dependencies detected for ARM64_ERRATUM_845719 Depends on [n]: AARCH32_EL0 [=n] Selected by [y]: - ARCH_MXC [=y] && COMPAT [=y] arch/arm64/Makefile:44: Detected assembler with broken .inst; disassembly will be unreliable In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:17: In file included from include/linux/lockdep.h:14: In file included from include/linux/smp.h:102: In file included from include/linux/preempt.h:78: In file included from arch/arm64/include/asm/preempt.h:5: In file included from include/linux/thread_info.h:14: In file included from include/linux/thread_bits.h:32: In file included from arch/arm64/include/asm/thread_info.h:18: >> arch/arm64/include/asm/stack_pointer.h:8:51: error: register 'sp' unsuitable for global register variables on this target register unsigned long current_stack_pointer asm ("sp"); ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: >> arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm arm_smccc_1_1_invoke(ARM_SMCCC_TRNG_VERSION, &res); ^ include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' arm_smccc_1_1_hvc(__VA_ARGS__); ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) ^ include/linux/arm-smccc.h:369:33: note: expanded from macro '__arm_smccc_1_1' register unsigned long r0 asm("r0"); ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r1' in asm include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' arm_smccc_1_1_hvc(__VA_ARGS__); ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) ^ include/linux/arm-smccc.h:370:33: note: expanded from macro '__arm_smccc_1_1' register unsigned long r1 asm("r1"); ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r2' in asm include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' arm_smccc_1_1_hvc(__VA_ARGS__); ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) ^ include/linux/arm-smccc.h:371:33: note: expanded from macro '__arm_smccc_1_1' register unsigned long r2 asm("r2"); ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: >> arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r3' in asm include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' arm_smccc_1_1_hvc(__VA_ARGS__); ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) ^ include/linux/arm-smccc.h:372:33: note: expanded from macro '__arm_smccc_1_1' register unsigned long r3 asm("r3"); ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: >> arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' arm_smccc_1_1_hvc(__VA_ARGS__); ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) ^ include/linux/arm-smccc.h:373:3: note: expanded from macro '__arm_smccc_1_1' __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/arm-smccc.h:354:37: note: expanded from macro '___declare_args' #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) ^ <scratch space>:110:1: note: expanded from here __declare_arg_0 ^ include/linux/arm-smccc.h:308:34: note: expanded from macro '__declare_arg_0' register unsigned long arg0 asm("r0") = (u32)a0 ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: >> arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:449:4: note: expanded from macro 'arm_smccc_1_1_invoke' arm_smccc_1_1_smc(__VA_ARGS__); ^ include/linux/arm-smccc.h:396:32: note: expanded from macro 'arm_smccc_1_1_smc' #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) ^ include/linux/arm-smccc.h:369:33: note: expanded from macro '__arm_smccc_1_1' register unsigned long r0 asm("r0"); ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r1' in asm include/linux/arm-smccc.h:449:4: note: expanded from macro 'arm_smccc_1_1_invoke' arm_smccc_1_1_smc(__VA_ARGS__); ^ include/linux/arm-smccc.h:396:32: note: expanded from macro 'arm_smccc_1_1_smc' #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) ^ include/linux/arm-smccc.h:370:33: note: expanded from macro '__arm_smccc_1_1' register unsigned long r1 asm("r1"); ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r2' in asm include/linux/arm-smccc.h:449:4: note: expanded from macro 'arm_smccc_1_1_invoke' arm_smccc_1_1_smc(__VA_ARGS__); ^ include/linux/arm-smccc.h:396:32: note: expanded from macro 'arm_smccc_1_1_smc' #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) ^ include/linux/arm-smccc.h:371:33: note: expanded from macro '__arm_smccc_1_1' register unsigned long r2 asm("r2"); ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: >> arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r3' in asm include/linux/arm-smccc.h:449:4: note: expanded from macro 'arm_smccc_1_1_invoke' arm_smccc_1_1_smc(__VA_ARGS__); ^ include/linux/arm-smccc.h:396:32: note: expanded from macro 'arm_smccc_1_1_smc' #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) ^ include/linux/arm-smccc.h:372:33: note: expanded from macro '__arm_smccc_1_1' register unsigned long r3 asm("r3"); ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: >> arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:449:4: note: expanded from macro 'arm_smccc_1_1_invoke' arm_smccc_1_1_smc(__VA_ARGS__); ^ include/linux/arm-smccc.h:396:32: note: expanded from macro 'arm_smccc_1_1_smc' #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) ^ include/linux/arm-smccc.h:373:3: note: expanded from macro '__arm_smccc_1_1' __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/arm-smccc.h:354:37: note: expanded from macro '___declare_args' #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) ^ <scratch space>:112:1: note: expanded from here __declare_arg_0 ^ include/linux/arm-smccc.h:308:34: note: expanded from macro '__declare_arg_0' register unsigned long arg0 asm("r0") = (u32)a0 ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: >> arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:452:4: note: expanded from macro 'arm_smccc_1_1_invoke' __fail_smccc_1_1(__VA_ARGS__); ^ include/linux/arm-smccc.h:421:3: note: expanded from macro '__fail_smccc_1_1' __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); ^ include/linux/arm-smccc.h:355:37: note: expanded from macro '__declare_args' #define __declare_args(count, ...) ___declare_args(count, __VA_ARGS__) ^ include/linux/arm-smccc.h:354:37: note: expanded from macro '___declare_args' #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) ^ <scratch space>:114:1: note: expanded from here __declare_arg_0 ^ include/linux/arm-smccc.h:308:34: note: expanded from macro '__declare_arg_0' register unsigned long arg0 asm("r0") = (u32)a0 ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:66:3: error: unknown register name 'r0' in asm arm_smccc_1_1_invoke(ARM_SMCCC_TRNG_RND64, 64, &res); ^ include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' arm_smccc_1_1_hvc(__VA_ARGS__); ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) ^ include/linux/arm-smccc.h:369:33: note: expanded from macro '__arm_smccc_1_1' register unsigned long r0 asm("r0"); ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:66:3: error: unknown register name 'r1' in asm include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' arm_smccc_1_1_hvc(__VA_ARGS__); ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) ^ include/linux/arm-smccc.h:370:33: note: expanded from macro '__arm_smccc_1_1' register unsigned long r1 asm("r1"); ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:66:3: error: unknown register name 'r2' in asm include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' arm_smccc_1_1_hvc(__VA_ARGS__); ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) ^ include/linux/arm-smccc.h:371:33: note: expanded from macro '__arm_smccc_1_1' register unsigned long r2 asm("r2"); ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:66:3: error: unknown register name 'r3' in asm include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARM64_ERRATUM_845719 Depends on [n]: AARCH32_EL0 [=n] Selected by [y]: - ARCH_MXC [=y] && COMPAT [=y] vim +/sp +8 arch/arm64/include/asm/stack_pointer.h a9ea0017ebe888 Mark Rutland 2016-11-03 4 a9ea0017ebe888 Mark Rutland 2016-11-03 5 /* a9ea0017ebe888 Mark Rutland 2016-11-03 6 * how to get the current stack pointer from C a9ea0017ebe888 Mark Rutland 2016-11-03 7 */ a9ea0017ebe888 Mark Rutland 2016-11-03 @8 register unsigned long current_stack_pointer asm ("sp"); a9ea0017ebe888 Mark Rutland 2016-11-03 9 :::::: The code at line 8 was first introduced by commit :::::: a9ea0017ebe8889dfa136cac2aa7ae0ee6915e1f arm64: factor out current_stack_pointer :::::: TO: Mark Rutland <mark.rutland(a)arm.com> :::::: CC: Catalin Marinas <catalin.marinas(a)arm.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1624/14244] loongson3-acpi-cpufreq.c:undefined reference to `acpi_processor_unregister_performance'
by kernel test robot 29 Sep '24

29 Sep '24

Hi liuyun, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 91ff8f4b711382909faa289c49735e0514af6f76 commit: 47a0b6f372d7f05822d021f86b21a34fd2142225 [1624/14244] cpufreq: Add cpufreq driver for LoongArch config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20240929/202409292322.d2VPFaNL-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240929/202409292322.d2VPFaNL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409292322.d2VPFaNL-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: drivers/cpufreq/loongson3-acpi-cpufreq.o: in function `loongson3_cpufreq_cpu_exit': >> loongson3-acpi-cpufreq.c:(.text+0x6f8): undefined reference to `acpi_processor_unregister_performance' loongarch64-linux-ld: drivers/cpufreq/loongson3-acpi-cpufreq.o: in function `.L333': >> loongson3-acpi-cpufreq.c:(.text+0x2a20): undefined reference to `acpi_processor_register_performance' loongarch64-linux-ld: drivers/cpufreq/loongson3-acpi-cpufreq.o: in function `.L372': loongson3-acpi-cpufreq.c:(.text+0x3390): undefined reference to `acpi_processor_unregister_performance' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 16446/23805] include/linux/kernel.h:871:9: error: first argument to '__builtin_choose_expr' not a constant
by kernel test robot 29 Sep '24

29 Sep '24

Hi Will, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 983693eea268270a0270335c61b8ed2188ca0017 commit: 3e8f9682bfad48236b3a76f113cbd5270102e745 [16446/23805] iommu/arm-smmu-v3: Increase maximum size of queues config: arm64-randconfig-001-20240929 (https://download.01.org/0day-ci/archive/20240929/202409292359.ZkCbEvo9-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240929/202409292359.ZkCbEvo9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409292359.ZkCbEvo9-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from include/linux/list.h:9, from include/linux/resource_ext.h:17, from include/linux/acpi.h:26, from drivers/iommu/arm-smmu-v3.c:23: drivers/iommu/arm-smmu-v3.c: In function 'arm_smmu_device_hw_probe': drivers/iommu/arm-smmu-v3.c:211:55: error: 'CONFIG_CMA_ALIGNMENT' undeclared (first use in this function); did you mean 'CONFIG_CMDLINE'? 211 | #define Q_MAX_SZ_SHIFT (PAGE_SHIFT + CONFIG_CMA_ALIGNMENT) | ^~~~~~~~~~~~~~~~~~~~ include/linux/kernel.h:847:36: note: in definition of macro '__typecheck' 847 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ^ include/linux/kernel.h:871:31: note: in expansion of macro '__safe_cmp' 871 | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~ include/linux/kernel.h:939:33: note: in expansion of macro '__careful_cmp' 939 | #define min_t(type, x, y) __careful_cmp((type)(x), (type)(y), <) | ^~~~~~~~~~~~~ drivers/iommu/arm-smmu-v3.c:3558:36: note: in expansion of macro 'min_t' 3558 | smmu->cmdq.q.max_n_shift = min_t(u32, CMDQ_MAX_SZ_SHIFT, | ^~~~~ drivers/iommu/arm-smmu-v3.c:278:42: note: in expansion of macro 'Q_MAX_SZ_SHIFT' 278 | #define CMDQ_MAX_SZ_SHIFT (Q_MAX_SZ_SHIFT - CMDQ_ENT_SZ_SHIFT) | ^~~~~~~~~~~~~~ drivers/iommu/arm-smmu-v3.c:3558:47: note: in expansion of macro 'CMDQ_MAX_SZ_SHIFT' 3558 | smmu->cmdq.q.max_n_shift = min_t(u32, CMDQ_MAX_SZ_SHIFT, | ^~~~~~~~~~~~~~~~~ drivers/iommu/arm-smmu-v3.c:211:55: note: each undeclared identifier is reported only once for each function it appears in 211 | #define Q_MAX_SZ_SHIFT (PAGE_SHIFT + CONFIG_CMA_ALIGNMENT) | ^~~~~~~~~~~~~~~~~~~~ include/linux/kernel.h:847:36: note: in definition of macro '__typecheck' 847 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ^ include/linux/kernel.h:871:31: note: in expansion of macro '__safe_cmp' 871 | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~ include/linux/kernel.h:939:33: note: in expansion of macro '__careful_cmp' 939 | #define min_t(type, x, y) __careful_cmp((type)(x), (type)(y), <) | ^~~~~~~~~~~~~ drivers/iommu/arm-smmu-v3.c:3558:36: note: in expansion of macro 'min_t' 3558 | smmu->cmdq.q.max_n_shift = min_t(u32, CMDQ_MAX_SZ_SHIFT, | ^~~~~ drivers/iommu/arm-smmu-v3.c:278:42: note: in expansion of macro 'Q_MAX_SZ_SHIFT' 278 | #define CMDQ_MAX_SZ_SHIFT (Q_MAX_SZ_SHIFT - CMDQ_ENT_SZ_SHIFT) | ^~~~~~~~~~~~~~ drivers/iommu/arm-smmu-v3.c:3558:47: note: in expansion of macro 'CMDQ_MAX_SZ_SHIFT' 3558 | smmu->cmdq.q.max_n_shift = min_t(u32, CMDQ_MAX_SZ_SHIFT, | ^~~~~~~~~~~~~~~~~ >> include/linux/kernel.h:871:9: error: first argument to '__builtin_choose_expr' not a constant 871 | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~~~~~~~~~~~~ include/linux/kernel.h:939:33: note: in expansion of macro '__careful_cmp' 939 | #define min_t(type, x, y) __careful_cmp((type)(x), (type)(y), <) | ^~~~~~~~~~~~~ drivers/iommu/arm-smmu-v3.c:3558:36: note: in expansion of macro 'min_t' 3558 | smmu->cmdq.q.max_n_shift = min_t(u32, CMDQ_MAX_SZ_SHIFT, | ^~~~~ >> include/linux/kernel.h:871:9: error: first argument to '__builtin_choose_expr' not a constant 871 | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~~~~~~~~~~~~ include/linux/kernel.h:939:33: note: in expansion of macro '__careful_cmp' 939 | #define min_t(type, x, y) __careful_cmp((type)(x), (type)(y), <) | ^~~~~~~~~~~~~ drivers/iommu/arm-smmu-v3.c:3566:36: note: in expansion of macro 'min_t' 3566 | smmu->evtq.q.max_n_shift = min_t(u32, EVTQ_MAX_SZ_SHIFT, | ^~~~~ >> include/linux/kernel.h:871:9: error: first argument to '__builtin_choose_expr' not a constant 871 | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~~~~~~~~~~~~ include/linux/kernel.h:939:33: note: in expansion of macro '__careful_cmp' 939 | #define min_t(type, x, y) __careful_cmp((type)(x), (type)(y), <) | ^~~~~~~~~~~~~ drivers/iommu/arm-smmu-v3.c:3568:36: note: in expansion of macro 'min_t' 3568 | smmu->priq.q.max_n_shift = min_t(u32, PRIQ_MAX_SZ_SHIFT, | ^~~~~ vim +/__builtin_choose_expr +871 include/linux/kernel.h 3c8ba0d61d04ce Kees Cook 2018-03-30 864 e9092d0d979611 Linus Torvalds 2018-04-09 865 #define __cmp_once(x, y, unique_x, unique_y, op) ({ \ e9092d0d979611 Linus Torvalds 2018-04-09 866 typeof(x) unique_x = (x); \ e9092d0d979611 Linus Torvalds 2018-04-09 867 typeof(y) unique_y = (y); \ e9092d0d979611 Linus Torvalds 2018-04-09 868 __cmp(unique_x, unique_y, op); }) 3c8ba0d61d04ce Kees Cook 2018-03-30 869 3c8ba0d61d04ce Kees Cook 2018-03-30 870 #define __careful_cmp(x, y, op) \ 3c8ba0d61d04ce Kees Cook 2018-03-30 @871 __builtin_choose_expr(__safe_cmp(x, y), \ e9092d0d979611 Linus Torvalds 2018-04-09 872 __cmp(x, y, op), \ e9092d0d979611 Linus Torvalds 2018-04-09 873 __cmp_once(x, y, __UNIQUE_ID(__x), __UNIQUE_ID(__y), op)) e8c97af0c1f23d Randy Dunlap 2017-10-13 874 :::::: The code at line 871 was first introduced by commit :::::: 3c8ba0d61d04ced9f8d9ff93977995a9e4e96e91 kernel.h: Retain constant expression output for max()/min() :::::: TO: Kees Cook <keescook(a)chromium.org> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] Add generic xdp multi-buffer support for ipvlan
by Yue Haibing 29 Sep '24

29 Sep '24

1 0

[PATCH OLK-5.10 0/2] Add generic xdp multi-buffer support for ipvlan
by Yue Haibing 29 Sep '24

29 Sep '24

1 0

[PATCH OLK-5.10 0/2] Add generic xdp multi-buffer support for ipvlan
by Yue Haibing 29 Sep '24

29 Sep '24

1 0

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Add array index check for hdcp ddc access
by Bowen You 29 Sep '24

29 Sep '24

From: Hersen Wu <hersenxs.wu(a)amd.com> [Why] Coverity reports OVERRUN warning. Do not check if array index valid. [How] Check msg_id valid and valid array index. Reviewed-by: Alex Hung <alex.hung(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Hersen Wu <hersenxs.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> --- .../drm/amd/display/modules/hdcp/hdcp_ddc.c | 28 ++++++++++++++++--- 1 file changed, 24 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c index 8e9caae7c955..1b2df97226a3 100644 --- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c +++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c @@ -156,11 +156,16 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp, uint32_t cur_size = 0; uint32_t data_offset = 0; - if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) { + if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID || + msg_id >= MOD_HDCP_MESSAGE_ID_MAX) return MOD_HDCP_STATUS_DDC_FAILURE; - } if (is_dp_hdcp(hdcp)) { + int num_dpcd_addrs = sizeof(hdcp_dpcd_addrs) / + sizeof(hdcp_dpcd_addrs[0]); + if (msg_id >= num_dpcd_addrs) + return MOD_HDCP_STATUS_DDC_FAILURE; + while (buf_len > 0) { cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE); success = hdcp->config.ddc.funcs.read_dpcd(hdcp->config.ddc.handle, @@ -175,6 +180,11 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp, data_offset += cur_size; } } else { + int num_i2c_offsets = sizeof(hdcp_i2c_offsets) / + sizeof(hdcp_i2c_offsets[0]); + if (msg_id >= num_i2c_offsets) + return MOD_HDCP_STATUS_DDC_FAILURE; + success = hdcp->config.ddc.funcs.read_i2c( hdcp->config.ddc.handle, HDCP_I2C_ADDR, @@ -219,11 +229,16 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp, uint32_t cur_size = 0; uint32_t data_offset = 0; - if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) { + if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID || + msg_id >= MOD_HDCP_MESSAGE_ID_MAX) return MOD_HDCP_STATUS_DDC_FAILURE; - } if (is_dp_hdcp(hdcp)) { + int num_dpcd_addrs = sizeof(hdcp_dpcd_addrs) / + sizeof(hdcp_dpcd_addrs[0]); + if (msg_id >= num_dpcd_addrs) + return MOD_HDCP_STATUS_DDC_FAILURE; + while (buf_len > 0) { cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE); success = hdcp->config.ddc.funcs.write_dpcd( @@ -239,6 +254,11 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp, data_offset += cur_size; } } else { + int num_i2c_offsets = sizeof(hdcp_i2c_offsets) / + sizeof(hdcp_i2c_offsets[0]); + if (msg_id >= num_i2c_offsets) + return MOD_HDCP_STATUS_DDC_FAILURE; + hdcp->buf[0] = hdcp_i2c_offsets[msg_id]; memmove(&hdcp->buf[1], buf, buf_len); success = hdcp->config.ddc.funcs.write_i2c( -- 2.34.1

2 5

[PATCH OLK-6.6] of/irq: Prevent device address out-of-bounds read in interrupt map walk
by Zhang Zekun 29 Sep '24

29 Sep '24

From: Stefan Wiehler <stefan.wiehler(a)nokia.com> stable inclusion from stable-v6.6.51 commit 7ead730af11ee7da107f16fc77995613c58d292d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWTE CVE: CVE-2024-46743 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------------- [ Upstream commit b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305 ] When of_irq_parse_raw() is invoked with a device address smaller than the interrupt parent node (from #address-cells property), KASAN detects the following out-of-bounds read when populating the initial match table (dyndbg="func of_irq_parse_* +p"): OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0 OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2 OF: intspec=4 OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2 OF: -> addrsize=3 ================================================================== BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0 Read of size 4 at addr ffffff81beca5608 by task bash/764 CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokia_sm_arm64 #1 Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023 Call trace: dump_backtrace+0xdc/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0x6c/0x84 print_report+0x150/0x448 kasan_report+0x98/0x140 __asan_load4+0x78/0xa0 of_irq_parse_raw+0x2b8/0x8d0 of_irq_parse_one+0x24c/0x270 parse_interrupts+0xc0/0x120 of_fwnode_add_links+0x100/0x2d0 fw_devlink_parse_fwtree+0x64/0xc0 device_add+0xb38/0xc30 of_device_add+0x64/0x90 of_platform_device_create_pdata+0xd0/0x170 of_platform_bus_create+0x244/0x600 of_platform_notify+0x1b0/0x254 blocking_notifier_call_chain+0x9c/0xd0 __of_changeset_entry_notify+0x1b8/0x230 __of_changeset_apply_notify+0x54/0xe4 of_overlay_fdt_apply+0xc04/0xd94 ... The buggy address belongs to the object at ffffff81beca5600 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 8 bytes inside of 128-byte region [ffffff81beca5600, ffffff81beca5680) The buggy address belongs to the physical page: page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4 head:00000000230d3d03 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x8000000000010200(slab|head|zone=2) raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ================================================================== OF: -> got it ! Prevent the out-of-bounds read by copying the device address into a buffer of sufficient size. Signed-off-by: Stefan Wiehler <stefan.wiehler(a)nokia.com> Link: https://lore.kernel.org/r/20240812100652.3800963-1-stefan.wiehler@nokia.com Signed-off-by: Rob Herring (Arm) <robh(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/of/irq.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index c94203ce65bb..8fd63100ba8f 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -344,7 +344,8 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar struct device_node *p; const __be32 *addr; u32 intsize; - int i, res; + int i, res, addr_len; + __be32 addr_buf[3] = { 0 }; pr_debug("of_irq_parse_one: dev=%pOF, index=%d\n", device, index); @@ -353,13 +354,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar return of_irq_parse_oldworld(device, index, out_irq); /* Get the reg property (if any) */ - addr = of_get_property(device, "reg", NULL); + addr = of_get_property(device, "reg", &addr_len); + + /* Prevent out-of-bounds read in case of longer interrupt parent address size */ + if (addr_len > (3 * sizeof(__be32))) + addr_len = 3 * sizeof(__be32); + if (addr) + memcpy(addr_buf, addr, addr_len); /* Try the new-style interrupts-extended first */ res = of_parse_phandle_with_args(device, "interrupts-extended", "#interrupt-cells", index, out_irq); if (!res) - return of_irq_parse_raw(addr, out_irq); + return of_irq_parse_raw(addr_buf, out_irq); /* Look for the interrupt parent. */ p = of_irq_find_parent(device); @@ -389,7 +396,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar /* Check if there are any interrupt-map translations to process */ - res = of_irq_parse_raw(addr, out_irq); + res = of_irq_parse_raw(addr_buf, out_irq); out: of_node_put(p); return res; -- 2.17.1

2 1

[PATCH OLK-6.6] sched: Support to enable/disable dynamic_affinity
by Hui Tang 29 Sep '24

29 Sep '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAUFO7 -------------------------------- Currently, the 'dynamic_affinty' can be enabled but can not disabled by cmdline. In some scenarios may need to be enabled by default, it is more reasonable changing cmdline to 'dynamic_affinty=enable/disable'. Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- kernel/sched/fair.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 415f4b060123..099a2e25d03d 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -8962,12 +8962,27 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu) DEFINE_STATIC_KEY_FALSE(__dynamic_affinity_switch); -static int __init dynamic_affinity_switch_setup(char *__unused) +static int __init dynamic_affinity_switch_setup(char *str) { - static_branch_enable(&__dynamic_affinity_switch); - return 1; + int ret = 1; + + if (!str) + goto out; + + if (!strcmp(str, "enable")) + static_branch_enable(&__dynamic_affinity_switch); + else if (!strcmp(str, "disable")) + static_branch_disable(&__dynamic_affinity_switch); + else + ret = 0; + +out: + if (!ret) + pr_warn("Unable to parse dynamic_affinity=\n"); + + return ret; } -__setup("dynamic_affinity", dynamic_affinity_switch_setup); +__setup("dynamic_affinity=", dynamic_affinity_switch_setup); static inline bool prefer_cpus_valid(struct task_struct *p) { -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amd/display: Assign linear_pitch_alignment even for VM
by Gu Bowen 29 Sep '24

29 Sep '24

From: Alvin Lee <alvin.lee2(a)amd.com> stable inclusion from stable-v6.6.50 commit d2fe7ac613a1ea8c346c9f5c89dc6ecc27232997 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAP55A Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 984debc133efa05e62f5aa1a7a1dd8ca0ef041f4 ] [Description] Assign linear_pitch_alignment so we don't cause a divide by 0 error in VM environments Reviewed-by: Sohaib Nadeem <sohaib.nadeem(a)amd.com> Acked-by: Wayne Lin <wayne.lin(a)amd.com> Signed-off-by: Alvin Lee <alvin.lee2(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index 72db370e2f21..50e643bfdfba 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1298,6 +1298,7 @@ struct dc *dc_create(const struct dc_init_data *init_params) return NULL; if (init_params->dce_environment == DCE_ENV_VIRTUAL_HW) { + dc->caps.linear_pitch_alignment = 64; if (!dc_construct_ctx(dc, init_params)) goto destruct_dc; } else { -- 2.25.1

2 1

[PATCH OLK-6.6] drm/amd/display: Run DC_LOG_DC after checking link->link_enc
by Gu Bowen 29 Sep '24

29 Sep '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v6.6.51 commit 874e3bb302f97b94ac548959ec4f925b8e7b45e2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWBK CVE: CVE-2024-46776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3a82f62b0d9d7687eac47603bb6cd14a50fa718b ] [WHAT] The DC_LOG_DC should be run after link->link_enc is checked, not before. This fixes 1 REVERSE_INULL issue reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/link/link_factory.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/link/link_factory.c b/drivers/gpu/drm/amd/display/dc/link/link_factory.c index 2c366866f570..33bb96f770b8 100644 --- a/drivers/gpu/drm/amd/display/dc/link/link_factory.c +++ b/drivers/gpu/drm/amd/display/dc/link/link_factory.c @@ -629,14 +629,14 @@ static bool construct_phy(struct dc_link *link, link->link_enc = link->dc->res_pool->funcs->link_enc_create(dc_ctx, &enc_init_data); - DC_LOG_DC("BIOS object table - DP_IS_USB_C: %d", link->link_enc->features.flags.bits.DP_IS_USB_C); - DC_LOG_DC("BIOS object table - IS_DP2_CAPABLE: %d", link->link_enc->features.flags.bits.IS_DP2_CAPABLE); - if (!link->link_enc) { DC_ERROR("Failed to create link encoder!\n"); goto link_enc_create_fail; } + DC_LOG_DC("BIOS object table - DP_IS_USB_C: %d", link->link_enc->features.flags.bits.DP_IS_USB_C); + DC_LOG_DC("BIOS object table - IS_DP2_CAPABLE: %d", link->link_enc->features.flags.bits.IS_DP2_CAPABLE); + /* Update link encoder tracking variables. These are used for the dynamic * assignment of link encoders to streams. */ -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] drm/amdgpu: fix mc_data out-of-bounds read warning
by He Yujie 29 Sep '24

29 Sep '24

From: Tim Huang <Tim.Huang(a)amd.com> stable inclusion from stable-v4.19.322 commit 5fa4df25ecfc7b6c9006f5b871c46cfe25ea8826 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV9S CVE: CVE-2024-46722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 51dfc0a4d609fe700750a62f41447f01b8c9ea50 ] Clear warning that read mc_data[i-1] may out-of-bounds. Signed-off-by: Tim Huang <Tim.Huang(a)amd.com> Reviewed-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c index bf872f694f50..653651a5b910 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c @@ -1641,6 +1641,8 @@ int amdgpu_atombios_init_mc_reg_table(struct amdgpu_device *adev, (u32)le32_to_cpu(*((u32 *)reg_data + j)); j++; } else if ((reg_table->mc_reg_address[i].pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { + if (i == 0) + continue; reg_table->mc_reg_table_entry[num_ranges].mc_data[i] = reg_table->mc_reg_table_entry[num_ranges].mc_data[i - 1]; } -- 2.34.1

2 1

[PATCH OLK-5.10] serial: sc16is7xx: fix invalid FIFO access with special register set
by Gu Bowen 29 Sep '24

29 Sep '24

From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> mainline inclusion from mainline-v6.11-rc3 commit 7d3b793faaab1305994ce568b59d61927235f57b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY1A CVE: CVE-2024-44950 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When enabling access to the special register set, Receiver time-out and RHR interrupts can happen. In this case, the IRQ handler will try to read from the FIFO thru the RHR register at address 0x00, but address 0x00 is mapped to DLL register, resulting in erroneous FIFO reading. Call graph example: sc16is7xx_startup(): entry sc16is7xx_ms_proc(): entry sc16is7xx_set_termios(): entry sc16is7xx_set_baud(): DLH/DLL = $009C --> access special register set sc16is7xx_port_irq() entry --> IIR is 0x0C sc16is7xx_handle_rx() entry sc16is7xx_fifo_read(): --> unable to access FIFO (RHR) because it is mapped to DLL (LCR=LCR_CONF_MODE_A) sc16is7xx_set_baud(): exit --> Restore access to general register set Fix the problem by claiming the efr_lock mutex when accessing the Special register set. Fixes: dfeae619d781 ("serial: sc16is7xx") Cc: stable(a)vger.kernel.org Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> Link: https://lore.kernel.org/r/20240723125302.1305372-3-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/sc16is7xx.c [The conflicts occurs because the commit 3837a0379533 ("serial: sc16is7xx: improve regmap debugfs by using one regmap per port") and commit 4409df5866b7f ("serial: sc16is7xx: change EFR lock to operate on each channels") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/serial/sc16is7xx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c index 29f05db0d49b..367692a35398 100644 --- a/drivers/tty/serial/sc16is7xx.c +++ b/drivers/tty/serial/sc16is7xx.c @@ -538,6 +538,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) SC16IS7XX_MCR_CLKSEL_BIT, prescaler); + mutex_lock(&s->efr_lock); + /* Open the LCR divisors for configuration */ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, SC16IS7XX_LCR_CONF_MODE_A); @@ -551,6 +553,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) /* Put LCR back to the normal mode */ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); + mutex_unlock(&s->efr_lock); + return DIV_ROUND_CLOSEST(clk / 16, div); } -- 2.25.1

2 1

[PATCH OLK-6.6] drm/amd/pm: Fix negative array index read
by Tengda Wu 29 Sep '24

29 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit 4711b1347cb9f0c3083da6d87c624d75f9bd1d50 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9MO CVE: CVE-2024-46821 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c8c19ebf7c0b202a6a2d37a52ca112432723db5f ] Avoid using the negative values for clk_idex as an index into an array pptable->DpmDescriptor. V2: fix clk_index return check (Tim Huang) Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Fixes: c49b1b59a2fa ("drm/amd/powerplay: change sysfs pp_dpm_xxx format for navi10") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- .../gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 27 ++++++++++++++----- 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c index c564f6e191f8..b1b23233635a 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c @@ -1222,19 +1222,22 @@ static int navi10_get_current_clk_freq_by_table(struct smu_context *smu, value); } -static bool navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) +static int navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) { PPTable_t *pptable = smu->smu_table.driver_pptable; DpmDescriptor_t *dpm_desc = NULL; - uint32_t clk_index = 0; + int clk_index = 0; clk_index = smu_cmn_to_asic_specific_index(smu, CMN2ASIC_MAPPING_CLK, clk_type); + if (clk_index < 0) + return clk_index; + dpm_desc = &pptable->DpmDescriptor[clk_index]; /* 0 - Fine grained DPM, 1 - Discrete DPM */ - return dpm_desc->SnapToDiscrete == 0; + return dpm_desc->SnapToDiscrete == 0 ? 1 : 0; } static inline bool navi10_od_feature_is_supported(struct smu_11_0_overdrive_table *od_table, enum SMU_11_0_ODFEATURE_CAP cap) @@ -1290,7 +1293,11 @@ static int navi10_emit_clk_levels(struct smu_context *smu, if (ret) return ret; - if (!navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (!ret) { for (i = 0; i < count; i++) { ret = smu_v11_0_get_dpm_freq_by_index(smu, clk_type, i, &value); @@ -1499,7 +1506,11 @@ static int navi10_print_clk_levels(struct smu_context *smu, if (ret) return size; - if (!navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (!ret) { for (i = 0; i < count; i++) { ret = smu_v11_0_get_dpm_freq_by_index(smu, clk_type, i, &value); if (ret) @@ -1668,7 +1679,11 @@ static int navi10_force_clk_levels(struct smu_context *smu, case SMU_UCLK: case SMU_FCLK: /* There is only 2 levels for fine grained DPM */ - if (navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (ret) { soft_max_level = (soft_max_level >= 1 ? 1 : 0); soft_min_level = (soft_min_level >= 1 ? 1 : 0); } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/pm: Fix negative array index read
by Tengda Wu 29 Sep '24

29 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit c8c19ebf7c0b202a6a2d37a52ca112432723db5f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9MO CVE: CVE-2024-46821 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Avoid using the negative values for clk_idex as an index into an array pptable->DpmDescriptor. V2: fix clk_index return check (Tim Huang) Signed-off-by: Jesse Zhang <jesse.zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Fixes: c49b1b59a2fa ("drm/amd/powerplay: change sysfs pp_dpm_xxx format for navi10") Conflicts: drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c [The commit didn't backport b06b48d7ddae ("amdgpu/pm: Implement emit_clk_levels for navi10") yet] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- .../gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c index 2937784bc824..bc6f912b1f90 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c @@ -885,19 +885,22 @@ static int navi10_get_current_clk_freq_by_table(struct smu_context *smu, value); } -static bool navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) +static int navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) { PPTable_t *pptable = smu->smu_table.driver_pptable; DpmDescriptor_t *dpm_desc = NULL; - uint32_t clk_index = 0; + int clk_index = 0; clk_index = smu_cmn_to_asic_specific_index(smu, CMN2ASIC_MAPPING_CLK, clk_type); + if (clk_index < 0) + return clk_index; + dpm_desc = &pptable->DpmDescriptor[clk_index]; /* 0 - Fine grained DPM, 1 - Discrete DPM */ - return dpm_desc->SnapToDiscrete == 0 ? true : false; + return dpm_desc->SnapToDiscrete == 0 ? 1 : 0; } static inline bool navi10_od_feature_is_supported(struct smu_11_0_overdrive_table *od_table, enum SMU_11_0_ODFEATURE_CAP cap) @@ -949,7 +952,11 @@ static int navi10_print_clk_levels(struct smu_context *smu, if (ret) return size; - if (!navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (!ret) { for (i = 0; i < count; i++) { ret = smu_v11_0_get_dpm_freq_by_index(smu, clk_type, i, &value); if (ret) @@ -1112,7 +1119,11 @@ static int navi10_force_clk_levels(struct smu_context *smu, case SMU_UCLK: case SMU_FCLK: /* There is only 2 levels for fine grained DPM */ - if (navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (ret) { soft_max_level = (soft_max_level >= 1 ? 1 : 0); soft_min_level = (soft_min_level >= 1 ? 1 : 0); } -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/pm: Fix negative array index read
by Tengda Wu 29 Sep '24

29 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit c8c19ebf7c0b202a6a2d37a52ca112432723db5f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9MO CVE: CVE-2024-46821 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Avoid using the negative values for clk_idex as an index into an array pptable->DpmDescriptor. V2: fix clk_index return check (Tim Huang) Signed-off-by: Jesse Zhang <jesse.zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Fixes: c49b1b59a2fa ("drm/amd/powerplay: change sysfs pp_dpm_xxx format for navi10") Conflicts: drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c [The commit didn't backport b06b48d7ddae ("amdgpu/pm: Implement emit_clk_levels for navi10") yet] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- .../gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c index a7773b6453d5..0af9ee3a520a 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c @@ -900,19 +900,22 @@ static int navi10_get_current_clk_freq_by_table(struct smu_context *smu, value); } -static bool navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) +static int navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) { PPTable_t *pptable = smu->smu_table.driver_pptable; DpmDescriptor_t *dpm_desc = NULL; - uint32_t clk_index = 0; + int clk_index = 0; clk_index = smu_cmn_to_asic_specific_index(smu, CMN2ASIC_MAPPING_CLK, clk_type); + if (clk_index < 0) + return clk_index; + dpm_desc = &pptable->DpmDescriptor[clk_index]; /* 0 - Fine grained DPM, 1 - Discrete DPM */ - return dpm_desc->SnapToDiscrete == 0 ? true : false; + return dpm_desc->SnapToDiscrete == 0 ? 1 : 0; } static inline bool navi10_od_feature_is_supported(struct smu_11_0_overdrive_table *od_table, enum SMU_11_0_ODFEATURE_CAP cap) @@ -964,7 +967,11 @@ static int navi10_print_clk_levels(struct smu_context *smu, if (ret) return size; - if (!navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (!ret) { for (i = 0; i < count; i++) { ret = smu_v11_0_get_dpm_freq_by_index(smu, clk_type, i, &value); if (ret) @@ -1127,7 +1134,11 @@ static int navi10_force_clk_levels(struct smu_context *smu, case SMU_UCLK: case SMU_FCLK: /* There is only 2 levels for fine grained DPM */ - if (navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (ret) { soft_max_level = (soft_max_level >= 1 ? 1 : 0); soft_min_level = (soft_min_level >= 1 ? 1 : 0); } -- 2.34.1

2 1

[PATCH OLK-6.6] serial: sc16is7xx: fix invalid FIFO access with special register set
by Gu Bowen 29 Sep '24

29 Sep '24

From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> mainline inclusion from mainline-v6.11-rc3 commit 7d3b793faaab1305994ce568b59d61927235f57b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY1A CVE: CVE-2024-44950 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When enabling access to the special register set, Receiver time-out and RHR interrupts can happen. In this case, the IRQ handler will try to read from the FIFO thru the RHR register at address 0x00, but address 0x00 is mapped to DLL register, resulting in erroneous FIFO reading. Call graph example: sc16is7xx_startup(): entry sc16is7xx_ms_proc(): entry sc16is7xx_set_termios(): entry sc16is7xx_set_baud(): DLH/DLL = $009C --> access special register set sc16is7xx_port_irq() entry --> IIR is 0x0C sc16is7xx_handle_rx() entry sc16is7xx_fifo_read(): --> unable to access FIFO (RHR) because it is mapped to DLL (LCR=LCR_CONF_MODE_A) sc16is7xx_set_baud(): exit --> Restore access to general register set Fix the problem by claiming the efr_lock mutex when accessing the Special register set. Fixes: dfeae619d781 ("serial: sc16is7xx") Cc: stable(a)vger.kernel.org Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> Link: https://lore.kernel.org/r/20240723125302.1305372-3-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/sc16is7xx.c [Trace context conflict, no adaptation required.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/serial/sc16is7xx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c index 7a9924d9b294..f290fbe21d63 100644 --- a/drivers/tty/serial/sc16is7xx.c +++ b/drivers/tty/serial/sc16is7xx.c @@ -545,6 +545,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) SC16IS7XX_MCR_CLKSEL_BIT, prescaler == 1 ? 0 : SC16IS7XX_MCR_CLKSEL_BIT); + mutex_lock(&one->efr_lock); + /* Open the LCR divisors for configuration */ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, SC16IS7XX_LCR_CONF_MODE_A); @@ -558,6 +560,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) /* Put LCR back to the normal mode */ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); + mutex_unlock(&one->efr_lock); + return DIV_ROUND_CLOSEST((clk / prescaler) / 16, div); } -- 2.25.1

2 1

[PATCH OLK-6.6] sched: Support to enable/disable dynamic_affinity
by Hui Tang 29 Sep '24

29 Sep '24

Offering: HULK hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAUFO7 CVE: NA -------------------------------- Currently, the 'dynamic_affinty' can be enabled but can not disabled by cmdline. In some scenarios may need to be enabled by default, it is more reasonable changing cmdline to 'dynamic_affinty=enable/disable'. Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- kernel/sched/fair.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 415f4b060123..099a2e25d03d 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -8962,12 +8962,27 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu) DEFINE_STATIC_KEY_FALSE(__dynamic_affinity_switch); -static int __init dynamic_affinity_switch_setup(char *__unused) +static int __init dynamic_affinity_switch_setup(char *str) { - static_branch_enable(&__dynamic_affinity_switch); - return 1; + int ret = 1; + + if (!str) + goto out; + + if (!strcmp(str, "enable")) + static_branch_enable(&__dynamic_affinity_switch); + else if (!strcmp(str, "disable")) + static_branch_disable(&__dynamic_affinity_switch); + else + ret = 0; + +out: + if (!ret) + pr_warn("Unable to parse dynamic_affinity=\n"); + + return ret; } -__setup("dynamic_affinity", dynamic_affinity_switch_setup); +__setup("dynamic_affinity=", dynamic_affinity_switch_setup); static inline bool prefer_cpus_valid(struct task_struct *p) { -- 2.34.1

2 1

[PATCH OLK-6.6] [Backport] serial: sc16is7xx: fix invalid FIFO access with special register set
by Gu Bowen 29 Sep '24

29 Sep '24

From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> mainline inclusion from mainline-v6.11-rc3 commit 7d3b793faaab1305994ce568b59d61927235f57b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY1A CVE: CVE-2024-44950 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When enabling access to the special register set, Receiver time-out and RHR interrupts can happen. In this case, the IRQ handler will try to read from the FIFO thru the RHR register at address 0x00, but address 0x00 is mapped to DLL register, resulting in erroneous FIFO reading. Call graph example: sc16is7xx_startup(): entry sc16is7xx_ms_proc(): entry sc16is7xx_set_termios(): entry sc16is7xx_set_baud(): DLH/DLL = $009C --> access special register set sc16is7xx_port_irq() entry --> IIR is 0x0C sc16is7xx_handle_rx() entry sc16is7xx_fifo_read(): --> unable to access FIFO (RHR) because it is mapped to DLL (LCR=LCR_CONF_MODE_A) sc16is7xx_set_baud(): exit --> Restore access to general register set Fix the problem by claiming the efr_lock mutex when accessing the Special register set. Fixes: dfeae619d781 ("serial: sc16is7xx") Cc: stable(a)vger.kernel.org Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> Link: https://lore.kernel.org/r/20240723125302.1305372-3-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/sc16is7xx.c [Trace context conflict, no adaptation required.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/serial/sc16is7xx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c index 7a9924d9b294..f290fbe21d63 100644 --- a/drivers/tty/serial/sc16is7xx.c +++ b/drivers/tty/serial/sc16is7xx.c @@ -545,6 +545,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) SC16IS7XX_MCR_CLKSEL_BIT, prescaler == 1 ? 0 : SC16IS7XX_MCR_CLKSEL_BIT); + mutex_lock(&one->efr_lock); + /* Open the LCR divisors for configuration */ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, SC16IS7XX_LCR_CONF_MODE_A); @@ -558,6 +560,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) /* Put LCR back to the normal mode */ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); + mutex_unlock(&one->efr_lock); + return DIV_ROUND_CLOSEST((clk / prescaler) / 16, div); } -- 2.25.1

2 1

[PATCH OLK-6.6] scsi: ufs: core: Remove SCSI host only if added
by Pu Lehui 29 Sep '24

29 Sep '24

From: Kyoungrul Kim <k831.kim(a)samsung.com> stable inclusion from stable-v6.6.51 commit 2f49e05d6b58d660f035a75ff96b77071b4bd5ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9QP CVE: CVE-2024-46843 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7cbff570dbe8907e23bba06f6414899a0fbb2fcc ] If host tries to remove ufshcd driver from a UFS device it would cause a kernel panic if ufshcd_async_scan fails during ufshcd_probe_hba before adding a SCSI host with scsi_add_host and MCQ is enabled since SCSI host has been defered after MCQ configuration introduced by commit 0cab4023ec7b ("scsi: ufs: core: Defer adding host to SCSI if MCQ is supported"). To guarantee that SCSI host is removed only if it has been added, set the scsi_host_added flag to true after adding a SCSI host and check whether it is set or not before removing it. Signed-off-by: Kyoungrul Kim <k831.kim(a)samsung.com> Signed-off-by: Minwoo Im <minwoo.im(a)samsung.com> Link: https://lore.kernel.org/r/20240627085104epcms2p5897a3870ea5c6416aa44f94df6c… Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/ufs/core/ufshcd.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index 94edac17b95f..2f92e3f4ca91 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -10119,7 +10119,8 @@ void ufshcd_remove(struct ufs_hba *hba) blk_mq_destroy_queue(hba->tmf_queue); blk_put_queue(hba->tmf_queue); blk_mq_free_tag_set(&hba->tmf_tag_set); - scsi_remove_host(hba->host); + if (hba->scsi_host_added) + scsi_remove_host(hba->host); /* disable interrupts */ ufshcd_disable_intr(hba, hba->intr_mask); ufshcd_hba_stop(hba); @@ -10391,6 +10392,7 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) dev_err(hba->dev, "scsi_add_host failed\n"); goto out_disable; } + hba->scsi_host_added = true; } hba->tmf_tag_set = (struct blk_mq_tag_set) { @@ -10472,7 +10474,8 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) free_tmf_tag_set: blk_mq_free_tag_set(&hba->tmf_tag_set); out_remove_scsi_host: - scsi_remove_host(hba->host); + if (hba->scsi_host_added) + scsi_remove_host(hba->host); out_disable: hba->is_irq_enabled = false; ufshcd_hba_exit(hba); -- 2.34.1

2 1

[PATCH OLK-6.6] scsi: ufs: core: Remove SCSI host only if added
by Pu Lehui 29 Sep '24

29 Sep '24

From: Kyoungrul Kim <k831.kim(a)samsung.com> stable inclusion from stable-v6.6.51 commit 2f49e05d6b58d660f035a75ff96b77071b4bd5ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9QP CVE: CVE-2024-46843 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7cbff570dbe8907e23bba06f6414899a0fbb2fcc ] If host tries to remove ufshcd driver from a UFS device it would cause a kernel panic if ufshcd_async_scan fails during ufshcd_probe_hba before adding a SCSI host with scsi_add_host and MCQ is enabled since SCSI host has been defered after MCQ configuration introduced by commit 0cab4023ec7b ("scsi: ufs: core: Defer adding host to SCSI if MCQ is supported"). To guarantee that SCSI host is removed only if it has been added, set the scsi_host_added flag to true after adding a SCSI host and check whether it is set or not before removing it. Signed-off-by: Kyoungrul Kim <k831.kim(a)samsung.com> Signed-off-by: Minwoo Im <minwoo.im(a)samsung.com> Link: https://lore.kernel.org/r/20240627085104epcms2p5897a3870ea5c6416aa44f94df6c… Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/ufs/core/ufshcd.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index 94edac17b95f..2f92e3f4ca91 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -10119,7 +10119,8 @@ void ufshcd_remove(struct ufs_hba *hba) blk_mq_destroy_queue(hba->tmf_queue); blk_put_queue(hba->tmf_queue); blk_mq_free_tag_set(&hba->tmf_tag_set); - scsi_remove_host(hba->host); + if (hba->scsi_host_added) + scsi_remove_host(hba->host); /* disable interrupts */ ufshcd_disable_intr(hba, hba->intr_mask); ufshcd_hba_stop(hba); @@ -10391,6 +10392,7 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) dev_err(hba->dev, "scsi_add_host failed\n"); goto out_disable; } + hba->scsi_host_added = true; } hba->tmf_tag_set = (struct blk_mq_tag_set) { @@ -10472,7 +10474,8 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) free_tmf_tag_set: blk_mq_free_tag_set(&hba->tmf_tag_set); out_remove_scsi_host: - scsi_remove_host(hba->host); + if (hba->scsi_host_added) + scsi_remove_host(hba->host); out_disable: hba->is_irq_enabled = false; ufshcd_hba_exit(hba); -- 2.34.1

2 1

[openeuler:OLK-5.10 24628/30000] fs/proc/base.c:1454:6: warning: no previous prototype for 'pbha_bit0_hide_file'
by kernel test robot 29 Sep '24

29 Sep '24

Hi Ma, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0988d5e5eb47d35a2babb4c0d6b6b81aa0fccbd3 commit: bea38841945a52bd03004240eb0da6a5115bae21 [24628/30000] arm64: mm: Hide pbha_bit0 in procfs if pbha is not enabled config: arm64-randconfig-004-20240928 (https://download.01.org/0day-ci/archive/20240929/202409291756.R89OCM5f-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240929/202409291756.R89OCM5f-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291756.R89OCM5f-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/proc/base.c:1454:6: warning: no previous prototype for 'pbha_bit0_hide_file' [-Wmissing-prototypes] 1454 | bool pbha_bit0_hide_file(const char *name) | ^~~~~~~~~~~~~~~~~~~ vim +/pbha_bit0_hide_file +1454 fs/proc/base.c 1453 > 1454 bool pbha_bit0_hide_file(const char *name) 1455 { 1456 if (!system_support_pbha_bit0() && !strncmp("pbha_bit0", name, 9)) 1457 return true; 1458 1459 return false; 1460 } 1461 #else 1462 static bool pbha_bit0_hide_file(const char *name) { return false; } 1463 #endif 1464 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] drm/amdgpu: Fix the warning division or modulo by zero
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit d116bb921e8b104f45d1f30a473ea99ef4262b9a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAUA67 CVE: CVE-2024-46806 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c ] Checks the partition mode and returns an error for an invalid mode. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Suggested-by: Lijo Lazar <lijo.lazar(a)amd.com> Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c index 0284c9198a04..6c6f9d9b5d89 100644 --- a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c +++ b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c @@ -500,6 +500,12 @@ static int aqua_vanjaram_switch_partition_mode(struct amdgpu_xcp_mgr *xcp_mgr, if (mode == AMDGPU_AUTO_COMPUTE_PARTITION_MODE) { mode = __aqua_vanjaram_get_auto_mode(xcp_mgr); + if (mode == AMDGPU_UNKNOWN_COMPUTE_PARTITION_MODE) { + dev_err(adev->dev, + "Invalid config, no compatible compute partition mode found, available memory partitions: %d", + adev->gmc.num_mem_partitions); + return -EINVAL; + } } else if (!__aqua_vanjaram_is_valid_mode(xcp_mgr, mode)) { dev_err(adev->dev, "Invalid compute partition mode requested, requested: %s, available memory partitions: %d", -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2024-44958 6.6
by Zheng Zucheng 29 Sep '24

29 Sep '24

Yang Yingliang (2): [Backport] sched/smt: Introduce sched_smt_present_inc/dec() helper [Backport] sched/smt: Fix unbalance sched_smt_present dec/inc kernel/sched/core.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] Fix CVE-2024-44958 5.10
by Zheng Zucheng 29 Sep '24

29 Sep '24

Yang Yingliang (2): sched/smt: Introduce sched_smt_present_inc/dec() helper sched/smt: Fix unbalance sched_smt_present dec/inc kernel/sched/core.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] drm/amdgpu: fix the waring dereferencing hive
by Yi Yang 29 Sep '24

29 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit 4ab720b6aa1ef5e71db1e534b5b45c80ac4ec58a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9PU CVE: CVE-2024-46805 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1940708ccf5aff76de4e0b399f99267c93a89193 ] Check the amdgpu_hive_info *hive that maybe is NULL. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c index 429ef212c1f2..a4f9015345cc 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c @@ -1336,6 +1336,9 @@ static void psp_xgmi_reflect_topology_info(struct psp_context *psp, uint8_t dst_num_links = node_info.num_links; hive = amdgpu_get_xgmi_hive(psp->adev); + if (WARN_ON(!hive)) + return; + list_for_each_entry(mirror_adev, &hive->device_list, gmc.xgmi.head) { struct psp_xgmi_topology_info *mirror_top_info; int j; -- 2.25.1

2 1

[openeuler:OLK-5.10 29235/30000] drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:1195:5: sparse: sparse: symbol 'hclge_tm_vf_tc_dwrr_cfg' was not declared. Should it be static?
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: dc55753ca59725e5130059dc4c520e8a91c655c0 commit: 518ea89ec98b78c749c27d6ba7792e1bdb5779ed [29235/30000] net: hns3: add support for vf multiple tcs config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240929/202409291552.pM1zgESs-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409291552.pM1zgESs-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291552.pM1zgESs-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:1195:5: sparse: sparse: symbol 'hclge_tm_vf_tc_dwrr_cfg' was not declared. Should it be static? vim +/hclge_tm_vf_tc_dwrr_cfg +1195 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c 1194 > 1195 int hclge_tm_vf_tc_dwrr_cfg(struct hclge_vport *vport) 1196 { 1197 struct hnae3_knic_private_info *kinfo = &vport->nic.kinfo; 1198 struct hclge_dev *hdev = vport->back; 1199 struct hclge_pg_info *pg_info; 1200 u8 dwrr; 1201 int ret; 1202 u32 i; 1203 1204 for (i = 0; i < kinfo->tc_info.max_tc; i++) { 1205 pg_info = &hdev->tm_info.pg_info[hdev->tm_info.tc_info[i].pgid]; 1206 dwrr = i < kinfo->tc_info.num_tc ? pg_info->tc_dwrr[i] : 0; 1207 ret = hclge_tm_qs_weight_cfg(hdev, vport->qs_offset + i, dwrr); 1208 if (ret) 1209 return ret; 1210 } 1211 1212 return 0; 1213 } 1214 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] Fix CVE-2024-44958 for 6.6
by Zheng Zucheng 29 Sep '24

29 Sep '24

Yang Yingliang (2): [Backport] sched/smt: Introduce sched_smt_present_inc/dec() helper [Backport] sched/smt: Fix unbalance sched_smt_present dec/inc kernel/sched/core.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 18534/23801] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3a5093f2913b14c22e19e60b6bf7a4d8ec2e5c69 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [18534/23801] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-104-20240929 (https://download.01.org/0day-ci/archive/20240929/202409291416.g51wPHKv-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291416.g51wPHKv-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] net: phy: Fix missing of_node_put() for leds
by Zhang Changzhong 29 Sep '24

29 Sep '24

From: Jinjie Ruan <ruanjinjie(a)huawei.com> stable inclusion from stable-v6.6.51 commit 26928c8f00f6bb0e194f3957fe51c69d36838eb2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYBT CVE: CVE-2024-46767 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2560db6ede1aaf162a73b2df43e0b6c5ed8819f7 ] The call of of_get_child_by_name() will cause refcount incremented for leds, if it succeeds, it should call of_node_put() to decrease it, fix it. Fixes: 01e5b728e9e4 ("net: phy: Add a binding for PHY LEDs") Reviewed-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://patch.msgid.link/20240830022025.610844-1-ruanjinjie@huawei.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/phy_device.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index c895cd1..2e4bff6 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -3164,11 +3164,13 @@ static int of_phy_leds(struct phy_device *phydev) err = of_phy_led(phydev, led); if (err) { of_node_put(led); + of_node_put(leds); phy_leds_unregister(phydev); return err; } } + of_node_put(leds); return 0; } -- 2.9.5

2 1

[PATCH OLK-6.6] mptcp: pm: only decrement add_addr_accepted for MPJ req
by Wang Liang 29 Sep '24

29 Sep '24

From: "Matthieu Baerts (NGI0)" <matttbe(a)kernel.org> stable inclusion from stable-v6.6.48 commit d20bf2c96d7ffd171299b32f562f70e5bf5dc608 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJM CVE: CVE-2024-45009 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1c1f721375989579e46741f59523e39ec9b2a9bd upstream. Adding the following warning ... WARN_ON_ONCE(msk->pm.add_addr_accepted == 0) ... before decrementing the add_addr_accepted counter helped to find a bug when running the "remove single subflow" subtest from the mptcp_join.sh selftest. Removing a 'subflow' endpoint will first trigger a RM_ADDR, then the subflow closure. Before this patch, and upon the reception of the RM_ADDR, the other peer will then try to decrement this add_addr_accepted. That's not correct because the attached subflows have not been created upon the reception of an ADD_ADDR. A way to solve that is to decrement the counter only if the attached subflow was an MP_JOIN to a remote id that was not 0, and initiated by the host receiving the RM_ADDR. Fixes: d0876b2284cf ("mptcp: add the incoming RM_ADDR support") Cc: stable(a)vger.kernel.org Reviewed-by: Mat Martineau <martineau(a)kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-9-38035d40de5b… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/mptcp/pm_netlink.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index aa56696cdc78..7fc4d7063c82 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -841,7 +841,7 @@ static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk, mptcp_close_ssk(sk, ssk, subflow); spin_lock_bh(&msk->pm.lock); - removed = true; + removed |= subflow->request_join; if (rm_type == MPTCP_MIB_RMSUBFLOW) __MPTCP_INC_STATS(sock_net(sk), rm_type); } @@ -855,7 +855,11 @@ static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk, if (!mptcp_pm_is_kernel(msk)) continue; - if (rm_type == MPTCP_MIB_RMADDR) { + if (rm_type == MPTCP_MIB_RMADDR && rm_id && + !WARN_ON_ONCE(msk->pm.add_addr_accepted == 0)) { + /* Note: if the subflow has been closed before, this + * add_addr_accepted counter will not be decremented. + */ msk->pm.add_addr_accepted--; WRITE_ONCE(msk->pm.accept_addr, true); } else if (rm_type == MPTCP_MIB_RMSUBFLOW) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/3] Fix CVE-2024-44958
by Zheng Zucheng 29 Sep '24

29 Sep '24

Yang Yingliang (2): sched/smt: Introduce sched_smt_present_inc/dec() helper sched/smt: Fix unbalance sched_smt_present dec/inc Zheng Zucheng (1): sched: Revert fix unbalance sched_smt_present dec/inc kernel/sched/core.c | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS-SP1] btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.11-rc1 commit a580fb2c3479d993556e1c31b237c9e5be4944a3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9LZ CVE: CVE-2024-46841 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We handle errors here properly, ENOMEM isn't fatal, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 4049405548ac..d53a4a3a9f8a 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -4860,7 +4860,6 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, eb->start, level, 1, &wc->refs[level], &wc->flags[level]); - BUG_ON(ret == -ENOMEM); if (ret) return ret; BUG_ON(wc->refs[level] == 0); -- 2.39.2

2 1

[PATCH OLK-5.10] btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.11-rc1 commit a580fb2c3479d993556e1c31b237c9e5be4944a3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9LZ CVE: CVE-2024-46841 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We handle errors here properly, ENOMEM isn't fatal, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index ae6625aa2c4a..854c7fa0fc06 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -4872,7 +4872,6 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, eb->start, level, 1, &wc->refs[level], &wc->flags[level]); - BUG_ON(ret == -ENOMEM); if (ret) return ret; BUG_ON(wc->refs[level] == 0); -- 2.39.2

2 1

[PATCH OLK-6.6] btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.11-rc1 commit a580fb2c3479d993556e1c31b237c9e5be4944a3 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9LZ CVE: CVE-2024-46841 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We handle errors here properly, ENOMEM isn't fatal, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 39afb1c46907..c88907111d80 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5150,7 +5150,6 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, eb->start, level, 1, &wc->refs[level], &wc->flags[level]); - BUG_ON(ret == -ENOMEM); if (ret) return ret; BUG_ON(wc->refs[level] == 0); -- 2.39.2

2 1

[PATCH OLK-6.6] drm/amdgpu: Fix the warning division or modulo by zero
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit d116bb921e8b104f45d1f30a473ea99ef4262b9a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAUA67 CVE: CVE-2024-46806 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c ] Checks the partition mode and returns an error for an invalid mode. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Suggested-by: Lijo Lazar <lijo.lazar(a)amd.com> Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c index 0284c9198a04..6c6f9d9b5d89 100644 --- a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c +++ b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c @@ -500,6 +500,12 @@ static int aqua_vanjaram_switch_partition_mode(struct amdgpu_xcp_mgr *xcp_mgr, if (mode == AMDGPU_AUTO_COMPUTE_PARTITION_MODE) { mode = __aqua_vanjaram_get_auto_mode(xcp_mgr); + if (mode == AMDGPU_UNKNOWN_COMPUTE_PARTITION_MODE) { + dev_err(adev->dev, + "Invalid config, no compatible compute partition mode found, available memory partitions: %d", + adev->gmc.num_mem_partitions); + return -EINVAL; + } } else if (!__aqua_vanjaram_is_valid_mode(xcp_mgr, mode)) { dev_err(adev->dev, "Invalid compute partition mode requested, requested: %s, available memory partitions: %d", -- 2.39.2

2 1

[openeuler:OLK-5.10 22702/30000] drivers/irqchip/irq-mbigen.c:122:11: sparse: sparse: symbol 'vtimer_cpu_mask' was not declared. Should it be static?
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: dc55753ca59725e5130059dc4c520e8a91c655c0 commit: 212e82b2357f9103ddb3b759c37ae518831f701b [22702/30000] mbigen: vtimer mbigen driver support config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240929/202409291341.axFxcmaf-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409291341.axFxcmaf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291341.axFxcmaf-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/irqchip/irq-mbigen.c:122:11: sparse: sparse: symbol 'vtimer_cpu_mask' was not declared. Should it be static? drivers/irqchip/irq-mbigen.c:318:34: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void [noderef] __iomem *base @@ got void *chip_data @@ drivers/irqchip/irq-mbigen.c:318:34: sparse: expected void [noderef] __iomem *base drivers/irqchip/irq-mbigen.c:318:34: sparse: got void *chip_data drivers/irqchip/irq-mbigen.c:330:34: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void [noderef] __iomem *base @@ got void *chip_data @@ drivers/irqchip/irq-mbigen.c:330:34: sparse: expected void [noderef] __iomem *base drivers/irqchip/irq-mbigen.c:330:34: sparse: got void *chip_data drivers/irqchip/irq-mbigen.c:362:31: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void [noderef] __iomem *base @@ got void *chip_data @@ drivers/irqchip/irq-mbigen.c:362:31: sparse: expected void [noderef] __iomem *base drivers/irqchip/irq-mbigen.c:362:31: sparse: got void *chip_data drivers/irqchip/irq-mbigen.c:435:65: sparse: sparse: incorrect type in argument 5 (different address spaces) @@ expected void *chip_data @@ got void [noderef] __iomem *base @@ drivers/irqchip/irq-mbigen.c:435:65: sparse: expected void *chip_data drivers/irqchip/irq-mbigen.c:435:65: sparse: got void [noderef] __iomem *base vim +/vtimer_cpu_mask +122 drivers/irqchip/irq-mbigen.c 121 > 122 cpumask_t vtimer_cpu_mask; 123 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 23323/30000] drivers/ub/urma/ubcore/ubcore_tp.c:392:5: warning: no previous prototype for 'ubcore_modify_tp_state'
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: dc55753ca59725e5130059dc4c520e8a91c655c0 commit: 329bf7f331286ee5d571d374e31ed50d2877b110 [23323/30000] ubcore: fix the bug of tp negotiation concurrency config: arm64-randconfig-004-20240928 (https://download.01.org/0day-ci/archive/20240929/202409291302.BCi0PcSr-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240929/202409291302.BCi0PcSr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291302.BCi0PcSr-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/ubcore/ubcore_tp.c:66:17: warning: no previous prototype for 'ubcore_get_mtu' [-Wmissing-prototypes] 66 | enum ubcore_mtu ubcore_get_mtu(int mtu) | ^~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_tp.c:392:5: warning: no previous prototype for 'ubcore_modify_tp_state' [-Wmissing-prototypes] 392 | int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_tp.c:894:19: warning: no previous prototype for 'ubcore_create_vtp' [-Wmissing-prototypes] 894 | struct ubcore_tp *ubcore_create_vtp(struct ubcore_device *dev, union ubcore_eid *remote_eid, | ^~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_tp.c:920:5: warning: no previous prototype for 'ubcore_destroy_vtp' [-Wmissing-prototypes] 920 | int ubcore_destroy_vtp(struct ubcore_tp *vtp) | ^~~~~~~~~~~~~~~~~~ vim +/ubcore_modify_tp_state +392 drivers/ub/urma/ubcore/ubcore_tp.c 391 > 392 int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp, 393 enum ubcore_tp_state new_state, struct ubcore_tp_attr *attr, union ubcore_tp_attr_mask mask) 394 { 395 if (ubcore_modify_tp_state_check(tp, new_state) != 0) 396 return -1; 397 398 if (tp->state == UBCORE_TP_STATE_ERR && new_state == UBCORE_TP_STATE_ERR) { 399 ubcore_log_info("tp is already in ERR state and tpn = %u", 400 tp->tpn); 401 return 0; 402 } 403 404 if (dev->ops->modify_tp(tp, attr, mask) != 0) { 405 /* tp->peer_ext.addr will be freed when called ubcore_destroy_tp */ 406 ubcore_log_err("Failed to modify tp to %u from state %u and tpn = %u", 407 (uint32_t)new_state, (uint32_t)tp->state, tp->tpn); 408 return -1; 409 } 410 tp->state = new_state; 411 ubcore_log_info("tp state:(%u to %u) with tpn %u, peer_tpn %u", 412 (uint32_t)tp->state, (uint32_t)new_state, tp->tpn, tp->peer_tpn); 413 return 0; 414 } 415 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20368/23799] drivers/android/binder_alloc_selftest.c:109:19: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3a5093f2913b14c22e19e60b6bf7a4d8ec2e5c69 commit: d549e609b8685eb101a4653249ef7e3fe8bb3e99 [20368/23799] binder: use userspace pointer as base of buffer space config: arm64-randconfig-r133-20240926 (https://download.01.org/0day-ci/archive/20240929/202409291234.x2jnAFD9-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409291234.x2jnAFD9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291234.x2jnAFD9-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/android/binder_alloc_selftest.c:109:19: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *page_addr @@ got void [noderef] <asn:1> *user_data @@ drivers/android/binder_alloc_selftest.c:109:19: sparse: expected void *page_addr drivers/android/binder_alloc_selftest.c:109:19: sparse: got void [noderef] <asn:1> *user_data >> drivers/android/binder_alloc_selftest.c:111:41: sparse: sparse: subtraction of different types can't work (different address spaces) drivers/android/binder_alloc_selftest.c:85: warning: Enum value 'LOOP_END' not described in enum 'buf_end_align_type' vim +109 drivers/android/binder_alloc_selftest.c 100 101 static bool check_buffer_pages_allocated(struct binder_alloc *alloc, 102 struct binder_buffer *buffer, 103 size_t size) 104 { 105 void *page_addr, *end; 106 int page_index; 107 108 end = (void *)PAGE_ALIGN((uintptr_t)buffer->user_data + size); > 109 page_addr = buffer->user_data; 110 for (; page_addr < end; page_addr += PAGE_SIZE) { > 111 page_index = (page_addr - alloc->buffer) / PAGE_SIZE; 112 if (!alloc->pages[page_index].page_ptr || 113 !list_empty(&alloc->pages[page_index].lru)) { 114 pr_err("expect alloc but is %s at page index %d\n", 115 alloc->pages[page_index].page_ptr ? 116 "lru" : "free", page_index); 117 return false; 118 } 119 } 120 return true; 121 } 122 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] drm/amdgpu: fix mc_data out-of-bounds read warning
by He Yujie 29 Sep '24

29 Sep '24

From: Tim Huang <Tim.Huang(a)amd.com> stable inclusion from stable-v4.19.322 commit eb1d4ce2609584eeb7694866f34d4b213caa3af9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV9S CVE: CVE-2024-46722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 51dfc0a4d609fe700750a62f41447f01b8c9ea50 ] Clear warning that read mc_data[i-1] may out-of-bounds. Signed-off-by: Tim Huang <Tim.Huang(a)amd.com> Reviewed-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c index bf872f694f50..653651a5b910 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c @@ -1641,6 +1641,8 @@ int amdgpu_atombios_init_mc_reg_table(struct amdgpu_device *adev, (u32)le32_to_cpu(*((u32 *)reg_data + j)); j++; } else if ((reg_table->mc_reg_address[i].pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { + if (i == 0) + continue; reg_table->mc_reg_table_entry[num_ranges].mc_data[i] = reg_table->mc_reg_table_entry[num_ranges].mc_data[i - 1]; } -- 2.34.1

2 1

[PATCH OLK-5.10 00/10] sbitmap: backport bugfix patches
by Yu Kuai 29 Sep '24

29 Sep '24

Hugh Dickins (1): sbitmap: fix lockup while swapping Jan Kara (1): sbitmap: Avoid leaving waitqueue in invalid state in __sbq_wake_up() Kemeng Shi (3): sbitmap: correct wake_batch recalculation to avoid potential IO hung blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait blk-mq: Fix potential io hung for shared sbitmap per tagset Laibin Qiu (2): blk-mq: fix tag_get wait task can't be awakened blk-mq: Fix wrong wakeup batch configuration which will cause hang Li Lingfeng (1): block: Fix lockdep warning in blk_mq_mark_tag_wait Yu Kuai (2): blk-mq: fix potential io hang by wrong 'wake_batch' sbitmap: fix possible io hung due to lost wakeup block/blk-mq-tag.c | 46 +++++++++++++++---- block/blk-mq.c | 12 +++-- include/linux/sbitmap.h | 11 +++++ lib/sbitmap.c | 97 +++++++++++++++++++++++++++++------------ 4 files changed, 128 insertions(+), 38 deletions(-) -- 2.39.2

2 11

[PATCH OLK-5.10] usb: typec: ucsi: Fix null pointer dereference in trace
by Zhang Zekun 29 Sep '24

29 Sep '24

From: Abhishek Pandit-Subedi <abhishekpandit(a)chromium.org> stable inclusion from stable-v5.10.226 commit 7e64cabe81c303bdf6fd26b6a09a3289b33bc870 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV3B CVE: CVE-2024-46719 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------------ [ Upstream commit 99516f76db48e1a9d54cdfed63c1babcee4e71a5 ] ucsi_register_altmode checks IS_ERR for the alt pointer and treats NULL as valid. When CONFIG_TYPEC_DP_ALTMODE is not enabled, ucsi_register_displayport returns NULL which causes a NULL pointer dereference in trace. Rather than return NULL, call typec_port_register_altmode to register DisplayPort alternate mode as a non-controllable mode when CONFIG_TYPEC_DP_ALTMODE is not enabled. Reviewed-by: Benson Leung <bleung(a)chromium.org> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Signed-off-by: Abhishek Pandit-Subedi <abhishekpandit(a)chromium.org> Signed-off-by: Jameson Thies <jthies(a)google.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Link: https://lore.kernel.org/r/20240510201244.2968152-2-jthies@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/usb/typec/ucsi/ucsi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h index cc1459b366cc..20995adc6b81 100644 --- a/drivers/usb/typec/ucsi/ucsi.h +++ b/drivers/usb/typec/ucsi/ucsi.h @@ -376,7 +376,7 @@ ucsi_register_displayport(struct ucsi_connector *con, bool override, int offset, struct typec_altmode_desc *desc) { - return NULL; + return typec_port_register_altmode(con->port, desc); } static inline void -- 2.17.1

2 1

[PATCH OLK-5.10] of/irq: Prevent device address out-of-bounds read in interrupt map walk
by Zhang Zekun 29 Sep '24

29 Sep '24

From: Stefan Wiehler <stefan.wiehler(a)nokia.com> stable inclusion from stable-v5.10.226 commit 9d1e9f0876b03d74d44513a0ed3ed15ef8f2fed5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWTE CVE: CVE-2024-46743 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------------------------------------- [ Upstream commit b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305 ] When of_irq_parse_raw() is invoked with a device address smaller than the interrupt parent node (from #address-cells property), KASAN detects the following out-of-bounds read when populating the initial match table (dyndbg="func of_irq_parse_* +p"): OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0 OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2 OF: intspec=4 OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2 OF: -> addrsize=3 ================================================================== BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0 Read of size 4 at addr ffffff81beca5608 by task bash/764 CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokia_sm_arm64 #1 Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023 Call trace: dump_backtrace+0xdc/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0x6c/0x84 print_report+0x150/0x448 kasan_report+0x98/0x140 __asan_load4+0x78/0xa0 of_irq_parse_raw+0x2b8/0x8d0 of_irq_parse_one+0x24c/0x270 parse_interrupts+0xc0/0x120 of_fwnode_add_links+0x100/0x2d0 fw_devlink_parse_fwtree+0x64/0xc0 device_add+0xb38/0xc30 of_device_add+0x64/0x90 of_platform_device_create_pdata+0xd0/0x170 of_platform_bus_create+0x244/0x600 of_platform_notify+0x1b0/0x254 blocking_notifier_call_chain+0x9c/0xd0 __of_changeset_entry_notify+0x1b8/0x230 __of_changeset_apply_notify+0x54/0xe4 of_overlay_fdt_apply+0xc04/0xd94 ... The buggy address belongs to the object at ffffff81beca5600 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 8 bytes inside of 128-byte region [ffffff81beca5600, ffffff81beca5680) The buggy address belongs to the physical page: page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4 head:00000000230d3d03 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x8000000000010200(slab|head|zone=2) raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ================================================================== OF: -> got it ! Prevent the out-of-bounds read by copying the device address into a buffer of sufficient size. Signed-off-by: Stefan Wiehler <stefan.wiehler(a)nokia.com> Link: https://lore.kernel.org/r/20240812100652.3800963-1-stefan.wiehler@nokia.com Signed-off-by: Rob Herring (Arm) <robh(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/of/irq.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index 352e14b007e7..ad0cb49e233a 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -288,7 +288,8 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar struct device_node *p; const __be32 *addr; u32 intsize; - int i, res; + int i, res, addr_len; + __be32 addr_buf[3] = { 0 }; pr_debug("of_irq_parse_one: dev=%pOF, index=%d\n", device, index); @@ -297,13 +298,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar return of_irq_parse_oldworld(device, index, out_irq); /* Get the reg property (if any) */ - addr = of_get_property(device, "reg", NULL); + addr = of_get_property(device, "reg", &addr_len); + + /* Prevent out-of-bounds read in case of longer interrupt parent address size */ + if (addr_len > (3 * sizeof(__be32))) + addr_len = 3 * sizeof(__be32); + if (addr) + memcpy(addr_buf, addr, addr_len); /* Try the new-style interrupts-extended first */ res = of_parse_phandle_with_args(device, "interrupts-extended", "#interrupt-cells", index, out_irq); if (!res) - return of_irq_parse_raw(addr, out_irq); + return of_irq_parse_raw(addr_buf, out_irq); /* Look for the interrupt parent. */ p = of_irq_find_parent(device); @@ -333,7 +340,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar /* Check if there are any interrupt-map translations to process */ - res = of_irq_parse_raw(addr, out_irq); + res = of_irq_parse_raw(addr_buf, out_irq); out: of_node_put(p); return res; -- 2.17.1

2 1

[PATCH OLK-5.10] KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
by Zhang Zekun 29 Sep '24

29 Sep '24

From: Marc Zyngier <maz(a)kernel.org> stable inclusion from stable-v5.10.225 commit 15818af2f7aa55eff375333cb7689df15d3f24ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR5D2 CVE: CVE-2024-46707 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------------------------- commit 3e6245ebe7ef341639e9a7e402b3ade8ad45a19f upstream. On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a write to any of the ICC_*SGI*_EL1 registers is trapped to EL2. We therefore try to emulate the SGI access, only to hit a NULL pointer as no private interrupt is allocated (no GIC, remember?). The obvious fix is to give the guest what it deserves, in the shape of a UNDEF exception. Reported-by: Alexander Potapenko <glider(a)google.com> Signed-off-by: Marc Zyngier <maz(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240820100349.3544850-2-maz@kernel.org Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/arm64/kvm/vgic/vgic.h [Code context change only] Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- arch/arm64/kvm/sys_regs.c | 6 ++++++ arch/arm64/kvm/vgic/vgic.h | 7 +++++++ 2 files changed, 13 insertions(+) diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c index 0cb9e4de5afd..1ee3c00ed8a0 100644 --- a/arch/arm64/kvm/sys_regs.c +++ b/arch/arm64/kvm/sys_regs.c @@ -30,6 +30,7 @@ #include <trace/events/kvm.h> #include "sys_regs.h" +#include "vgic/vgic.h" #include "trace.h" @@ -275,6 +276,11 @@ static bool access_gic_sgi(struct kvm_vcpu *vcpu, { bool g1; + if (!kvm_has_gicv3(vcpu->kvm)) { + kvm_inject_undefined(vcpu); + return false; + } + if (!p->is_write) return read_from_write_only(vcpu, p, r); diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h index 47abce1ff89e..06564e8dd69b 100644 --- a/arch/arm64/kvm/vgic/vgic.h +++ b/arch/arm64/kvm/vgic/vgic.h @@ -330,4 +330,11 @@ void vgic_v4_configure_vsgis(struct kvm *kvm); void vgic_v4_get_vlpi_state(struct vgic_irq *irq, bool *val); void vgic_v4_configure_vtimer(struct kvm *kvm); +static inline bool kvm_has_gicv3(struct kvm *kvm) +{ + return (static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif) && + irqchip_in_kernel(kvm) && + kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3); +} + #endif -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] btrfs: remove NULL transaction support for btrfs_lookup_extent_info()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.11-rc1 commit 119474bdbac0858053cf367c8c932dd5c4bb4e85 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX0N Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There are no callers of btrfs_lookup_extent_info() that pass a NULL value for the transaction handle argument, so there's no point in having special logic to deal with the NULL. The last caller that passed a NULL value was removed in commit 19b546d7a1b2 ("btrfs: relocation: Use btrfs_find_all_leafs to locate data extent parent tree leaves"). So remove the NULL handling from btrfs_lookup_extent_info(). Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202409271612.ikY68CAg-lkp@intel.com/ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Context differences.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 9521cb45433f..4049405548ac 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -135,11 +135,6 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, if (!path) return -ENOMEM; - if (!trans) { - path->skip_locking = 1; - path->search_commit_root = 1; - } - search_again: key.objectid = bytenr; key.offset = offset; @@ -172,10 +167,7 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, if (unlikely(item_size < sizeof(*ei))) { ret = -EINVAL; btrfs_print_v0_err(fs_info); - if (trans) - btrfs_abort_transaction(trans, ret); - else - btrfs_handle_fs_error(fs_info, ret, NULL); + btrfs_abort_transaction(trans, ret); goto out_free; } @@ -197,9 +189,6 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, ret = 0; } - if (!trans) - goto out; - delayed_refs = &trans->transaction->delayed_refs; spin_lock(&delayed_refs->lock); head = btrfs_find_delayed_ref_head(delayed_refs, bytenr); @@ -239,7 +228,7 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, mutex_unlock(&head->mutex); } spin_unlock(&delayed_refs->lock); -out: + WARN_ON(num_refs == 0); if (refs) *refs = num_refs; -- 2.39.2

2 1

[PATCH OLK-6.6] btrfs: remove NULL transaction support for btrfs_lookup_extent_info()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.11-rc1 commit 119474bdbac0858053cf367c8c932dd5c4bb4e85 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX0N Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There are no callers of btrfs_lookup_extent_info() that pass a NULL value for the transaction handle argument, so there's no point in having special logic to deal with the NULL. The last caller that passed a NULL value was removed in commit 19b546d7a1b2 ("btrfs: relocation: Use btrfs_find_all_leafs to locate data extent parent tree leaves"). So remove the NULL handling from btrfs_lookup_extent_info(). Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202409271612.ikY68CAg-lkp@intel.com/ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 9bf1e4ac4de0..39afb1c46907 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -124,11 +124,6 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, if (!path) return -ENOMEM; - if (!trans) { - path->skip_locking = 1; - path->search_commit_root = 1; - } - search_again: key.objectid = bytenr; key.offset = offset; @@ -164,11 +159,7 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, btrfs_err(fs_info, "unexpected extent item size, has %u expect >= %zu", item_size, sizeof(*ei)); - if (trans) - btrfs_abort_transaction(trans, ret); - else - btrfs_handle_fs_error(fs_info, ret, NULL); - + btrfs_abort_transaction(trans, ret); goto out_free; } @@ -189,9 +180,6 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, ret = 0; } - if (!trans) - goto out; - delayed_refs = &trans->transaction->delayed_refs; spin_lock(&delayed_refs->lock); head = btrfs_find_delayed_ref_head(delayed_refs, bytenr); @@ -231,7 +219,7 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, mutex_unlock(&head->mutex); } spin_unlock(&delayed_refs->lock); -out: + WARN_ON(num_refs == 0); if (refs) *refs = num_refs; -- 2.39.2

2 1

[PATCH OLK-5.10] btrfs: remove NULL transaction support for btrfs_lookup_extent_info()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.11-rc1 commit 119474bdbac0858053cf367c8c932dd5c4bb4e85 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX0N Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There are no callers of btrfs_lookup_extent_info() that pass a NULL value for the transaction handle argument, so there's no point in having special logic to deal with the NULL. The last caller that passed a NULL value was removed in commit 19b546d7a1b2 ("btrfs: relocation: Use btrfs_find_all_leafs to locate data extent parent tree leaves"). So remove the NULL handling from btrfs_lookup_extent_info(). Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202409271612.ikY68CAg-lkp@intel.com/ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Context differences.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 054785ffacf7..ae6625aa2c4a 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -135,11 +135,6 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, if (!path) return -ENOMEM; - if (!trans) { - path->skip_locking = 1; - path->search_commit_root = 1; - } - search_again: key.objectid = bytenr; key.offset = offset; @@ -172,10 +167,7 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, if (unlikely(item_size < sizeof(*ei))) { ret = -EINVAL; btrfs_print_v0_err(fs_info); - if (trans) - btrfs_abort_transaction(trans, ret); - else - btrfs_handle_fs_error(fs_info, ret, NULL); + btrfs_abort_transaction(trans, ret); goto out_free; } @@ -197,9 +189,6 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, ret = 0; } - if (!trans) - goto out; - delayed_refs = &trans->transaction->delayed_refs; spin_lock(&delayed_refs->lock); head = btrfs_find_delayed_ref_head(delayed_refs, bytenr); @@ -239,7 +228,7 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, mutex_unlock(&head->mutex); } spin_unlock(&delayed_refs->lock); -out: + WARN_ON(num_refs == 0); if (refs) *refs = num_refs; -- 2.39.2

2 1

[PATCH OLK-5.10] kprobes: Fix deadlock issue with kmemleak
by Zheng Yejian 29 Sep '24

29 Sep '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://codehub-y.huawei.com/hulk/bugzilla/issues/196 -------------------------------- There is following deadlock issue: CPU0 CPU1 ==== ==== kretprobe_trampoline kmem_cache_alloc trampoline_handler kmemleak_alloc __kretprobe_trampoline_handler create_object kretprobe_hash_lock <-- hold kmemleak lock <-- hold kretprobe table lock __link_object recycle_rp_inst stack_trace_save kfree_rcu kvfree_call_rcu ... kmemleak_ignore unwind_next_frame kretprobe_find_ret_addr <-- wait for kmemleak lock kretprobe_hash_lock <-- wait for kretprobe table lock One task on CPU0 hold kretprobe_hash_lock and wait for kmemleak_lock, however, kmemleak_lock was held by other task on CPU1 and that task is waiting for kretprobe_hash_lock, then deadlock happended. To fix it, move kfree_rcu() out of kretprobe table lock area. Fixes: b67815b05d67 ("[Backport] kprobes: Add kretprobe_find_ret_addr() for searching return address") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/kprobes.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index dacb71214fa1..5d64d97975ba 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1223,7 +1223,7 @@ void kprobes_inc_nmissed_count(struct kprobe *p) } NOKPROBE_SYMBOL(kprobes_inc_nmissed_count); -static void recycle_rp_inst(struct kretprobe_instance *ri) +static void recycle_rp_inst(struct kretprobe_instance *ri, struct hlist_head *head) { struct kretprobe *rp = ri->rp; @@ -1235,7 +1235,7 @@ static void recycle_rp_inst(struct kretprobe_instance *ri) hlist_add_head(&ri->hlist, &rp->free_instances); raw_spin_unlock(&rp->lock); } else - kfree_rcu(ri, rcu); + hlist_add_head(&ri->hlist, head); } NOKPROBE_SYMBOL(recycle_rp_inst); @@ -1326,6 +1326,7 @@ void kprobe_flush_task(struct task_struct *tk) struct hlist_head *head; struct hlist_node *tmp; unsigned long hash, flags = 0; + HLIST_HEAD(empty_rp); if (unlikely(!kprobes_initialized)) /* Early boot. kretprobe_table_locks not yet initialized. */ @@ -1338,10 +1339,16 @@ void kprobe_flush_task(struct task_struct *tk) kretprobe_table_lock(hash, &flags); hlist_for_each_entry_safe(ri, tmp, head, hlist) { if (ri->task == tk) - recycle_rp_inst(ri); + recycle_rp_inst(ri, &empty_rp); } kretprobe_table_unlock(hash, &flags); + hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) { + hlist_del(&ri->hlist); + INIT_HLIST_NODE(&ri->hlist); + kfree_rcu(ri, rcu); + } + kprobe_busy_end(); } NOKPROBE_SYMBOL(kprobe_flush_task); @@ -2014,6 +2021,7 @@ unsigned long __kretprobe_trampoline_handler(struct pt_regs *regs, unsigned long flags; kprobe_opcode_t *correct_ret_addr = NULL; bool skipped = false; + HLIST_HEAD(empty_rp); kretprobe_hash_lock(current, &head, &flags); @@ -2082,7 +2090,7 @@ unsigned long __kretprobe_trampoline_handler(struct pt_regs *regs, __this_cpu_write(current_kprobe, prev); } - recycle_rp_inst(ri); + recycle_rp_inst(ri, &empty_rp); if (ri == last) break; @@ -2090,6 +2098,12 @@ unsigned long __kretprobe_trampoline_handler(struct pt_regs *regs, kretprobe_hash_unlock(current, &flags); + hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) { + hlist_del(&ri->hlist); + INIT_HLIST_NODE(&ri->hlist); + kfree_rcu(ri, rcu); + } + return (unsigned long)correct_ret_addr; } NOKPROBE_SYMBOL(__kretprobe_trampoline_handler) -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 5940/23799] drivers/iommu/iommu.c:979:31: sparse: sparse: dubious: !x | !y
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: ac084b72b429b1bc0378add3abecfe107a732b7a [5940/23799] iommu: introduce device fault report API config: arm64-randconfig-r133-20240926 (https://download.01.org/0day-ci/archive/20240929/202409290930.qkB2O1Kz-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409290930.qkB2O1Kz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290930.qkB2O1Kz-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/iommu/iommu.c:979:31: sparse: sparse: dubious: !x | !y drivers/iommu/iommu.c: In function 'iommu_unregister_device_fault_handler': drivers/iommu/iommu.c:937:13: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 937 | int ret = 0; | ^~~ vim +979 drivers/iommu/iommu.c 960 961 962 /** 963 * iommu_report_device_fault() - Report fault event to device 964 * @dev: the device 965 * @evt: fault event data 966 * 967 * Called by IOMMU model specific drivers when fault is detected, typically 968 * in a threaded IRQ handler. 969 * 970 * Return 0 on success, or an error. 971 */ 972 int iommu_report_device_fault(struct device *dev, struct iommu_fault_event *evt) 973 { 974 int ret = 0; 975 struct iommu_fault_event *evt_pending; 976 struct iommu_fault_param *fparam; 977 978 /* iommu_param is allocated when device is added to group */ > 979 if (!dev->iommu_param | !evt) 980 return -EINVAL; 981 /* we only report device fault if there is a handler registered */ 982 mutex_lock(&dev->iommu_param->lock); 983 if (!dev->iommu_param->fault_param || 984 !dev->iommu_param->fault_param->handler) { 985 ret = -EINVAL; 986 goto done_unlock; 987 } 988 fparam = dev->iommu_param->fault_param; 989 if (evt->type == IOMMU_FAULT_PAGE_REQ && evt->last_req) { 990 evt_pending = kzalloc(sizeof(*evt_pending), GFP_ATOMIC); 991 if (!evt_pending) { 992 ret = -ENOMEM; 993 goto done_unlock; 994 } 995 memcpy(evt_pending, evt, sizeof(struct iommu_fault_event)); 996 mutex_lock(&fparam->lock); 997 list_add_tail(&evt_pending->list, &fparam->faults); 998 mutex_unlock(&fparam->lock); 999 } 1000 ret = fparam->handler(evt, fparam->data); 1001 done_unlock: 1002 mutex_unlock(&dev->iommu_param->lock); 1003 return ret; 1004 } 1005 EXPORT_SYMBOL_GPL(iommu_report_device_fault); 1006 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 21562/30000] drivers/ub/urma/ubcore/ubcore_netdev.c:213:5: warning: no previous prototype for 'ubcore_unset_port_netdev'
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 37c6170f742ef3a18a3131a2a157dd7b7aa08103 [21562/30000] ub: Fix bugs in urma kernel and user lib config: arm64-randconfig-004-20240928 (https://download.01.org/0day-ci/archive/20240929/202409290901.wWQmpMUX-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240929/202409290901.wWQmpMUX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290901.wWQmpMUX-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/ubcore/ubcore_netdev.c:51:5: warning: no previous prototype for 'ubcore_check_port_state' [-Wmissing-prototypes] 51 | int ubcore_check_port_state(struct ubcore_device *dev, uint8_t port_idx) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:75:6: warning: no previous prototype for 'ubcore_find_port_netdev' [-Wmissing-prototypes] 75 | void ubcore_find_port_netdev(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:133:5: warning: no previous prototype for 'ubcore_set_port_netdev' [-Wmissing-prototypes] 133 | int ubcore_set_port_netdev(struct ubcore_device *dev, struct net_device *ndev, | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:213:5: warning: no previous prototype for 'ubcore_unset_port_netdev' [-Wmissing-prototypes] 213 | int ubcore_unset_port_netdev(struct ubcore_device *dev, struct net_device *ndev, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:242:6: warning: no previous prototype for 'ubcore_put_port_netdev' [-Wmissing-prototypes] 242 | void ubcore_put_port_netdev(struct ubcore_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:262:10: warning: no previous prototype for 'ubcore_sip_idx_alloc' [-Wmissing-prototypes] 262 | uint32_t ubcore_sip_idx_alloc(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:290:5: warning: no previous prototype for 'ubcore_sip_idx_free' [-Wmissing-prototypes] 290 | int ubcore_sip_idx_free(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:303:6: warning: no previous prototype for 'ubcore_sip_table_init' [-Wmissing-prototypes] 303 | void ubcore_sip_table_init(void) | ^~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:309:6: warning: no previous prototype for 'ubcore_sip_table_uninit' [-Wmissing-prototypes] 309 | void ubcore_sip_table_uninit(void) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:324:5: warning: no previous prototype for 'ubcore_add_sip_entry' [-Wmissing-prototypes] 324 | int ubcore_add_sip_entry(const struct ubcore_sip_info *sip, uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:344:5: warning: no previous prototype for 'ubcore_del_sip_entry' [-Wmissing-prototypes] 344 | int ubcore_del_sip_entry(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:358:5: warning: no previous prototype for 'ubcore_lookup_sip_idx' [-Wmissing-prototypes] 358 | int ubcore_lookup_sip_idx(struct ubcore_sip_info *sip, uint32_t *idx) | ^~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:379:10: warning: no previous prototype for 'ubcore_get_sip_max_cnt' [-Wmissing-prototypes] 379 | uint32_t ubcore_get_sip_max_cnt(void) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:384:25: warning: no previous prototype for 'ubcore_lookup_sip_info' [-Wmissing-prototypes] 384 | struct ubcore_sip_info *ubcore_lookup_sip_info(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:395:5: warning: no previous prototype for 'ubcore_notify_uvs_del_sip' [-Wmissing-prototypes] 395 | int ubcore_notify_uvs_del_sip(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:437:5: warning: no previous prototype for 'ubcore_notify_uvs_add_sip' [-Wmissing-prototypes] 437 | int ubcore_notify_uvs_add_sip(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ vim +/ubcore_unset_port_netdev +213 drivers/ub/urma/ubcore/ubcore_netdev.c 212 > 213 int ubcore_unset_port_netdev(struct ubcore_device *dev, struct net_device *ndev, 214 unsigned int port_id) 215 { 216 struct ubcore_ndev_port *port_info; 217 218 if (dev == NULL || ndev == NULL) { 219 ubcore_log_err("invalid input parameter.\n"); 220 return -1; 221 } 222 down_write(&g_port_list_lock); 223 list_for_each_entry(port_info, &dev->port_list, node) { 224 if (port_info->ndev == ndev) { 225 if (ubcore_del_port(port_info, (uint8_t)port_id, dev, ndev) != 0) { 226 up_write(&g_port_list_lock); 227 ubcore_log_err("Failed to do ubcore_del_port"); 228 return -1; 229 } 230 up_write(&g_port_list_lock); 231 return 0; 232 } 233 } 234 up_write(&g_port_list_lock); 235 236 ubcore_log_err("Failed to find and remove ndev:%s dev_name: %s bound port: %u\n", 237 netdev_name(ndev), dev->dev_name, port_id); 238 return -1; 239 } 240 EXPORT_SYMBOL(ubcore_unset_port_netdev); 241 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 21579/30000] net/smc/smc_core.c:770:6: sparse: sparse: symbol '__smcr_link_clear' was not declared. Should it be static?
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 7dad816cb1f8841fda526c0978c10a94793f1178 [21579/30000] anolis: net/smc: Resolve the race between SMC-R link access and clear config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240929/202409290926.Ll8zQyOY-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409290926.Ll8zQyOY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290926.Ll8zQyOY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> net/smc/smc_core.c:770:6: sparse: sparse: symbol '__smcr_link_clear' was not declared. Should it be static? vim +/__smcr_link_clear +770 net/smc/smc_core.c 769 > 770 void __smcr_link_clear(struct smc_link *lnk) 771 { 772 smc_wr_free_link_mem(lnk); 773 smc_lgr_put(lnk->lgr); /* lgr_hold in smcr_link_init() */ 774 memset(lnk, 0, sizeof(struct smc_link)); 775 lnk->state = SMC_LNK_UNUSED; 776 } 777 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 4008/23799] drivers/staging/erofs/utils.c:138:6: sparse: sparse: symbol 'erofs_try_to_release_workgroup' was not declared. Should it be static?
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: fb4c3a2751ebf142fecc61eea8c738573ec3bf10 [4008/23799] staging: erofs: fix race when the managed cache is enabled config: arm64-randconfig-r133-20240926 (https://download.01.org/0day-ci/archive/20240929/202409290639.uZftDFPU-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409290639.uZftDFPU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290639.uZftDFPU-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/staging/erofs/utils.c:138:6: sparse: sparse: symbol 'erofs_try_to_release_workgroup' was not declared. Should it be static? drivers/staging/erofs/utils.c:138:6: warning: no previous prototype for 'erofs_try_to_release_workgroup' [-Wmissing-prototypes] 138 | bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/erofs_try_to_release_workgroup +138 drivers/staging/erofs/utils.c 137 > 138 bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi, 139 struct erofs_workgroup *grp, 140 bool cleanup) 141 { 142 void *entry; 143 144 /* 145 * for managed cache enabled, the refcount of workgroups 146 * themselves could be < 0 (freezed). So there is no guarantee 147 * that all refcount > 0 if managed cache is enabled. 148 */ 149 if (!erofs_workgroup_try_to_freeze(grp, 1)) 150 return false; 151 152 /* 153 * note that all cached pages should be unlinked 154 * before delete it from the radix tree. 155 * Otherwise some cached pages of an orphan old workgroup 156 * could be still linked after the new one is available. 157 */ 158 if (erofs_try_to_free_all_cached_pages(sbi, grp)) { 159 erofs_workgroup_unfreeze(grp, 1); 160 return false; 161 } 162 163 /* 164 * it is impossible to fail after the workgroup is freezed, 165 * however in order to avoid some race conditions, add a 166 * DBG_BUGON to observe this in advance. 167 */ 168 entry = radix_tree_delete(&sbi->workstn_tree, grp->index); 169 DBG_BUGON((void *)((unsigned long)entry & 170 ~RADIX_TREE_EXCEPTIONAL_ENTRY) != grp); 171 172 /* 173 * if managed cache is enable, the last refcount 174 * should indicate the related workstation. 175 */ 176 erofs_workgroup_unfreeze_final(grp); 177 return true; 178 } 179 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 21084/30000] drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 0b68f4778af4fded021ba67f5eb3fb74ff8d7fc1 [21084/30000] net: hns3: support arp proxy config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240929/202409290547.aSbDInhQ-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409290547.aSbDInhQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290547.aSbDInhQ-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] vlan_tci @@ got unsigned short [usertype] vlan_tci @@ drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: expected restricted __be16 [usertype] vlan_tci drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: got unsigned short [usertype] vlan_tci >> drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:128:58: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned short [usertype] vlan_tci @@ got restricted __be16 [usertype] vlan_tci @@ drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:128:58: sparse: expected unsigned short [usertype] vlan_tci drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:128:58: sparse: got restricted __be16 [usertype] vlan_tci vim +79 drivers/net/ethernet/hisilicon/hns3/hns3_roh.c 56 57 int hns3_handle_roh_arp_req(struct sk_buff *skb, struct hns3_nic_priv *priv) 58 { 59 struct hnae3_handle *h = priv->ae_handle; 60 struct hns3_enet_ring *ring; 61 struct arphdr *arphdr; 62 struct ethhdr *ethhdr; 63 int reply_idx, len; 64 __be32 *sip, *tip; 65 66 /* use same queue num in rx */ 67 ring = &priv->ring[skb->queue_mapping + h->kinfo.num_tqps]; 68 reply_idx = ring->arp_reply_tail; 69 hns3_roh_arp_reply_idx_move_fd(reply_idx); 70 /* This smp_load_acquire() pairs with smp_store_release() in 71 * hns3_handle_roh_arp_reply(). 72 */ 73 if (reply_idx == smp_load_acquire(&ring->arp_reply_head)) 74 return NETDEV_TX_BUSY; 75 len = skb->len; 76 77 if (skb_vlan_tagged(skb)) { 78 ring->arp_reply[reply_idx].has_vlan = true; > 79 ring->arp_reply[reply_idx].vlan_tci = skb_vlan_tag_get(skb); 80 skb_vlan_pop(skb); 81 len += VLAN_HLEN; 82 } else { 83 ring->arp_reply[reply_idx].has_vlan = false; 84 } 85 86 ethhdr = eth_hdr(skb); 87 arphdr = arp_hdr(skb); 88 89 hns3_extract_arp_ip_field(arphdr, &sip, &tip, skb->dev->addr_len); 90 ether_addr_copy(ring->arp_reply[reply_idx].dest_hw, ethhdr->h_source); 91 ether_addr_copy(ring->arp_reply[reply_idx].src_hw, ethhdr->h_dest); 92 ring->arp_reply[reply_idx].dest_ip = *sip; 93 ring->arp_reply[reply_idx].src_ip = *tip; 94 hns3_roh_update_mac_by_ip(be32_to_cpu(*tip), 95 ring->arp_reply[reply_idx].src_hw); 96 /* This smp_store_release() pairs with smp_load_acquire() in 97 * hns3_handle_roh_arp_reply(). Ensure that the arp_reply_tail is 98 * update validly. 99 */ 100 smp_store_release(&ring->arp_reply_tail, reply_idx); 101 102 ring = &priv->ring[skb->queue_mapping]; 103 u64_stats_update_begin(&ring->syncp); 104 ring->stats.tx_pkts++; 105 ring->stats.tx_bytes += len; 106 u64_stats_update_end(&ring->syncp); 107 108 dev_kfree_skb_any(skb); 109 napi_schedule(&ring->tqp_vector->napi); 110 return NETDEV_TX_OK; 111 } 112 113 static struct sk_buff *setup_arp_reply_skb(struct hns3_arp_reply *arp_reply, 114 struct hns3_nic_priv *priv) 115 { 116 struct sk_buff *skb = arp_create(ARPOP_REPLY, ETH_P_ARP, 117 arp_reply->dest_ip, priv->netdev, 118 arp_reply->src_ip, arp_reply->dest_hw, 119 arp_reply->src_hw, arp_reply->dest_hw); 120 if (!skb) 121 return NULL; 122 123 skb_reset_mac_header(skb); 124 skb_reset_mac_len(skb); 125 126 if (arp_reply->has_vlan) { 127 skb = vlan_insert_tag_set_proto(skb, htons(ETH_P_8021Q), > 128 arp_reply->vlan_tci); 129 if (!skb) 130 return NULL; 131 skb_reset_network_header(skb); 132 } 133 134 skb_reserve(skb, skb->mac_len); 135 return skb; 136 } 137 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 21485/30000] drivers/ub/urma/ubcore/ubcore_device.c:344:6: warning: no previous prototype for 'ubcore_destroy_upi_list'
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 84e122368ec3a37e074c9657bc09422b62f6ccd0 [21485/30000] ub: add new feature for urma config: arm64-randconfig-004-20240928 (https://download.01.org/0day-ci/archive/20240929/202409290428.ZYNCVbJr-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240929/202409290428.ZYNCVbJr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290428.ZYNCVbJr-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/ubcore/ubcore_device.c:344:6: warning: no previous prototype for 'ubcore_destroy_upi_list' [-Wmissing-prototypes] 344 | void ubcore_destroy_upi_list(void) | ^~~~~~~~~~~~~~~~~~~~~~~ -- drivers/ub/urma/ubcore/ubcore_uvs_cmd.c: In function 'ubcore_uvs_cmd_channel_init': >> drivers/ub/urma/ubcore/ubcore_uvs_cmd.c:47:15: warning: 'strncpy' output truncated before terminating nul copying 10 bytes from a string of the same length [-Wstringop-truncation] 47 | (void)strncpy(arg.out.kernel_out, "Hello uvs!", strlen("Hello uvs!")); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/ub/urma/ubcore/ubcore_netdev.c:49:5: warning: no previous prototype for 'ubcore_check_port_state' [-Wmissing-prototypes] 49 | int ubcore_check_port_state(struct ubcore_device *dev, uint8_t port_idx) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:73:5: warning: no previous prototype for 'ubcore_find_port_netdev' [-Wmissing-prototypes] 73 | int ubcore_find_port_netdev(struct ubcore_device *dev, struct net_device *ndev) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:90:5: warning: no previous prototype for 'ubcore_find_port_with_dev_name' [-Wmissing-prototypes] 90 | int ubcore_find_port_with_dev_name(struct ubcore_device *dev, char *dev_name) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:113:5: warning: no previous prototype for 'ubcore_set_port_netdev' [-Wmissing-prototypes] 113 | int ubcore_set_port_netdev(struct ubcore_device *dev, struct net_device *ndev, | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:149:6: warning: no previous prototype for 'ubcore_put_port_netdev' [-Wmissing-prototypes] 149 | void ubcore_put_port_netdev(struct ubcore_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:169:10: warning: no previous prototype for 'ubcore_sip_idx_alloc' [-Wmissing-prototypes] 169 | uint32_t ubcore_sip_idx_alloc(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:197:5: warning: no previous prototype for 'ubcore_sip_idx_free' [-Wmissing-prototypes] 197 | int ubcore_sip_idx_free(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:210:6: warning: no previous prototype for 'ubcore_sip_table_init' [-Wmissing-prototypes] 210 | void ubcore_sip_table_init(void) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:216:6: warning: no previous prototype for 'ubcore_sip_table_uninit' [-Wmissing-prototypes] 216 | void ubcore_sip_table_uninit(void) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:230:5: warning: no previous prototype for 'ubcore_add_sip_entry' [-Wmissing-prototypes] 230 | int ubcore_add_sip_entry(const struct ubcore_sip_info *sip, uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:250:5: warning: no previous prototype for 'ubcore_del_sip_entry' [-Wmissing-prototypes] 250 | int ubcore_del_sip_entry(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:264:5: warning: no previous prototype for 'ubcore_lookup_sip_idx' [-Wmissing-prototypes] 264 | int ubcore_lookup_sip_idx(struct ubcore_sip_info *sip, uint32_t *idx) | ^~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:285:10: warning: no previous prototype for 'ubcore_get_sip_max_cnt' [-Wmissing-prototypes] 285 | uint32_t ubcore_get_sip_max_cnt(void) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:290:25: warning: no previous prototype for 'ubcore_lookup_sip_info' [-Wmissing-prototypes] 290 | struct ubcore_sip_info *ubcore_lookup_sip_info(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:301:5: warning: no previous prototype for 'ubcore_notify_uvs_del_sip' [-Wmissing-prototypes] 301 | int ubcore_notify_uvs_del_sip(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:343:5: warning: no previous prototype for 'ubcore_notify_uvs_add_sip' [-Wmissing-prototypes] 343 | int ubcore_notify_uvs_add_sip(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ vim +/ubcore_destroy_upi_list +344 drivers/ub/urma/ubcore/ubcore_device.c 343 > 344 void ubcore_destroy_upi_list(void) 345 { 346 struct ubcore_upi_entry *entry = NULL, *next; 347 348 mutex_lock(&g_upi_lock); 349 list_for_each_entry_safe(entry, next, &g_upi_list, node) { 350 if (entry != NULL) { 351 list_del(&entry->node); 352 kfree(entry); 353 } 354 } 355 mutex_unlock(&g_upi_lock); 356 } 357 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1487/23799] drivers/firmware/efi/libstub/arm-stub.c:72:6: sparse: sparse: symbol 'install_memreserve_table' was not declared. Should it be static?
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: 805a16040f9b52834cff060839fe25ad655f042e [1487/23799] efi/arm: libstub: add a root memreserve config table config: arm64-randconfig-r133-20240926 (https://download.01.org/0day-ci/archive/20240929/202409290414.yOuyHbaP-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409290414.yOuyHbaP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290414.yOuyHbaP-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/firmware/efi/libstub/arm-stub.c:72:6: sparse: sparse: symbol 'install_memreserve_table' was not declared. Should it be static? drivers/firmware/efi/libstub/arm-stub.c:72:6: warning: no previous prototype for 'install_memreserve_table' [-Wmissing-prototypes] 72 | void install_memreserve_table(efi_system_table_t *sys_table_arg) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/firmware/efi/libstub/arm-stub.c:116:15: warning: no previous prototype for 'efi_entry' [-Wmissing-prototypes] 116 | unsigned long efi_entry(void *handle, efi_system_table_t *sys_table, | ^~~~~~~~~ drivers/firmware/efi/libstub/arm-stub.c: In function 'efi_entry': drivers/firmware/efi/libstub/arm-stub.c:135:29: warning: variable 'si' set but not used [-Wunused-but-set-variable] 135 | struct screen_info *si; | ^~ vim +/install_memreserve_table +72 drivers/firmware/efi/libstub/arm-stub.c 71 > 72 void install_memreserve_table(efi_system_table_t *sys_table_arg) 73 { 74 struct linux_efi_memreserve *rsv; 75 efi_guid_t memreserve_table_guid = LINUX_EFI_MEMRESERVE_TABLE_GUID; 76 efi_status_t status; 77 78 status = efi_call_early(allocate_pool, EFI_LOADER_DATA, sizeof(*rsv), 79 (void **)&rsv); 80 if (status != EFI_SUCCESS) { 81 pr_efi_err(sys_table_arg, "Failed to allocate memreserve entry!\n"); 82 return; 83 } 84 85 rsv->next = 0; 86 rsv->base = 0; 87 rsv->size = 0; 88 89 status = efi_call_early(install_configuration_table, 90 &memreserve_table_guid, 91 rsv); 92 if (status != EFI_SUCCESS) 93 pr_efi_err(sys_table_arg, "Failed to install memreserve config table!\n"); 94 } 95 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 21044/30000] drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c:478:68: sparse: sparse: incorrect type in argument 1 (different base types)
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 7906c655c7b6e8bd68a7e7ee2455d9a8d8622fa9 [21044/30000] net: hns3: add command queue trace for hns3 config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240929/202409290215.32P52XtH-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409290215.32P52XtH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290215.32P52XtH-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c:478:68: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned short [usertype] opcode @@ got restricted __le16 [usertype] opcode @@ drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c:478:68: sparse: expected unsigned short [usertype] opcode drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c:478:68: sparse: got restricted __le16 [usertype] opcode drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c:514:67: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned short [usertype] opcode @@ got restricted __le16 [usertype] opcode @@ drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c:514:67: sparse: expected unsigned short [usertype] opcode drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c:514:67: sparse: got restricted __le16 [usertype] opcode -- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c: note: in included file (through include/trace/trace_events.h, include/trace/define_trace.h, ...): >> drivers/net/ethernet/hisilicon/hns3/hns3pf/./hclge_trace.h:132:1: sparse: sparse: cast to restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c: note: in included file (through include/trace/perf.h, include/trace/define_trace.h, drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h): >> drivers/net/ethernet/hisilicon/hns3/hns3pf/./hclge_trace.h:132:1: sparse: sparse: cast to restricted __le32 vim +478 drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c 461 462 /** 463 * hclge_comm_cmd_send - send command to command queue 464 * @hw: pointer to the hw struct 465 * @desc: prefilled descriptor for describing the command 466 * @num : the number of descriptors to be sent 467 * 468 * This is the main send command for command queue, it 469 * sends the queue, cleans the queue, etc 470 **/ 471 int hclge_comm_cmd_send(struct hclge_comm_hw *hw, struct hclge_desc *desc, 472 int num) 473 { 474 struct hclge_comm_cmq_ring *csq = &hw->cmq.csq; 475 int ret; 476 int ntc; 477 trace_hclge_comm_cmd_send(hw, desc, num, > 478 hclge_comm_is_special_opcode(desc->opcode)); 479 480 spin_lock_bh(&hw->cmq.csq.lock); 481 482 if (test_bit(HCLGE_COMM_STATE_CMD_DISABLE, &hw->comm_state)) { 483 spin_unlock_bh(&hw->cmq.csq.lock); 484 return -EBUSY; 485 } 486 487 if (num > hclge_comm_ring_space(&hw->cmq.csq)) { 488 /* If CMDQ ring is full, SW HEAD and HW HEAD may be different, 489 * need update the SW HEAD pointer csq->next_to_clean 490 */ 491 csq->next_to_clean = 492 hclge_comm_read_dev(hw, HCLGE_COMM_NIC_CSQ_HEAD_REG); 493 spin_unlock_bh(&hw->cmq.csq.lock); 494 return -EBUSY; 495 } 496 497 /** 498 * Record the location of desc in the ring for this time 499 * which will be use for hardware to write back 500 */ 501 ntc = hw->cmq.csq.next_to_use; 502 503 hclge_comm_cmd_copy_desc(hw, desc, num); 504 505 /* Write to hardware */ 506 hclge_comm_write_dev(hw, HCLGE_COMM_NIC_CSQ_TAIL_REG, 507 hw->cmq.csq.next_to_use); 508 509 ret = hclge_comm_cmd_check_result(hw, desc, num, ntc); 510 511 spin_unlock_bh(&hw->cmq.csq.lock); 512 513 trace_hclge_comm_cmd_get(hw, desc, num, 514 hclge_comm_is_special_opcode(desc->opcode)); 515 return ret; 516 } 517 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21349/23799] drivers/mmc/host/phytium-mci-plat.c:169:23: error: lvalue required as unary '&' operand
by kernel test robot 29 Sep '24

29 Sep '24

Hi Malloy, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: d65622e6edee11f7fcbd295bdb5aef86e12dfef3 [21349/23799] mmc: add support for Phytium MMC config: arm64-randconfig-003-20240928 (https://download.01.org/0day-ci/archive/20240929/202409290132.fGKHm3da-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240929/202409290132.fGKHm3da-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290132.fGKHm3da-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/mmc/host/phytium-mci-plat.c:169:23: error: lvalue required as unary '&' operand 169 | .pm = &phytium_mci_dev_pm_ops, | ^ vim +169 drivers/mmc/host/phytium-mci-plat.c 161 162 static struct platform_driver phytium_mci_driver = { 163 .probe = phytium_mci_probe, 164 .remove = phytium_mci_remove, 165 .driver = { 166 .name = "phytium-mci-platform", 167 .of_match_table = phytium_mci_of_ids, 168 .acpi_match_table = phytium_mci_acpi_ids, > 169 .pm = &phytium_mci_dev_pm_ops, 170 }, 171 }; 172 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 19223/30000] drivers/ub/urma/ubcore/ubcore_dp.c:26:5: warning: no previous prototype for 'ubcore_post_jetty_send_wr'
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 33800c2820ab85fe02800e33f6b3287130278bdf [19223/30000] ub: ubcore add data plane ops api. config: arm64-randconfig-004-20240928 (https://download.01.org/0day-ci/archive/20240929/202409290129.erX7l03j-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240929/202409290129.erX7l03j-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290129.erX7l03j-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/ubcore/ubcore_dp.c:26:5: warning: no previous prototype for 'ubcore_post_jetty_send_wr' [-Wmissing-prototypes] 26 | int ubcore_post_jetty_send_wr(struct ubcore_jetty *jetty, const struct ubcore_jfs_wr *wr, | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_dp.c:42:5: warning: no previous prototype for 'ubcore_post_jetty_recv_wr' [-Wmissing-prototypes] 42 | int ubcore_post_jetty_recv_wr(struct ubcore_jetty *jetty, const struct ubcore_jfr_wr *wr, | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_dp.c:58:5: warning: no previous prototype for 'ubcore_post_jfs_wr' [-Wmissing-prototypes] 58 | int ubcore_post_jfs_wr(struct ubcore_jfs *jfs, const struct ubcore_jfs_wr *wr, | ^~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_dp.c:74:5: warning: no previous prototype for 'ubcore_post_jfr_wr' [-Wmissing-prototypes] 74 | int ubcore_post_jfr_wr(struct ubcore_jfr *jfr, const struct ubcore_jfr_wr *wr, | ^~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_dp.c:90:5: warning: no previous prototype for 'ubcore_poll_jfc' [-Wmissing-prototypes] 90 | int ubcore_poll_jfc(struct ubcore_jfc *jfc, int cr_cnt, struct ubcore_cr *cr) | ^~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_dp.c:105:5: warning: no previous prototype for 'ubcore_rearm_jfc' [-Wmissing-prototypes] 105 | int ubcore_rearm_jfc(struct ubcore_jfc *jfc, bool solicited_only) | ^~~~~~~~~~~~~~~~ vim +/ubcore_post_jetty_send_wr +26 drivers/ub/urma/ubcore/ubcore_dp.c 25 > 26 int ubcore_post_jetty_send_wr(struct ubcore_jetty *jetty, const struct ubcore_jfs_wr *wr, 27 struct ubcore_jfs_wr **bad_wr) 28 { 29 struct ubcore_ops *dev_ops; 30 31 if (jetty == NULL || jetty->ub_dev == NULL || jetty->ub_dev->ops == NULL || 32 jetty->ub_dev->ops->post_jetty_send_wr == NULL || wr == NULL || bad_wr == NULL) { 33 ubcore_log_err("Invalid parameter"); 34 return -EINVAL; 35 } 36 37 dev_ops = jetty->ub_dev->ops; 38 return dev_ops->post_jetty_send_wr(jetty, wr, bad_wr); 39 } 40 EXPORT_SYMBOL(ubcore_post_jetty_send_wr); 41 > 42 int ubcore_post_jetty_recv_wr(struct ubcore_jetty *jetty, const struct ubcore_jfr_wr *wr, 43 struct ubcore_jfr_wr **bad_wr) 44 { 45 struct ubcore_ops *dev_ops; 46 47 if (jetty == NULL || jetty->ub_dev == NULL || jetty->ub_dev->ops == NULL || 48 jetty->ub_dev->ops->post_jetty_recv_wr == NULL || wr == NULL || bad_wr == NULL) { 49 ubcore_log_err("Invalid parameter"); 50 return -EINVAL; 51 } 52 53 dev_ops = jetty->ub_dev->ops; 54 return dev_ops->post_jetty_recv_wr(jetty, wr, bad_wr); 55 } 56 EXPORT_SYMBOL(ubcore_post_jetty_recv_wr); 57 > 58 int ubcore_post_jfs_wr(struct ubcore_jfs *jfs, const struct ubcore_jfs_wr *wr, 59 struct ubcore_jfs_wr **bad_wr) 60 { 61 struct ubcore_ops *dev_ops; 62 63 if (jfs == NULL || jfs->ub_dev == NULL || jfs->ub_dev->ops == NULL || 64 jfs->ub_dev->ops->post_jfs_wr == NULL || wr == NULL || bad_wr == NULL) { 65 ubcore_log_err("Invalid parameter"); 66 return -EINVAL; 67 } 68 69 dev_ops = jfs->ub_dev->ops; 70 return dev_ops->post_jfs_wr(jfs, wr, bad_wr); 71 } 72 EXPORT_SYMBOL(ubcore_post_jfs_wr); 73 > 74 int ubcore_post_jfr_wr(struct ubcore_jfr *jfr, const struct ubcore_jfr_wr *wr, 75 struct ubcore_jfr_wr **bad_wr) 76 { 77 struct ubcore_ops *dev_ops; 78 79 if (jfr == NULL || jfr->ub_dev == NULL || jfr->ub_dev->ops == NULL || 80 jfr->ub_dev->ops->post_jfr_wr == NULL || wr == NULL || bad_wr == NULL) { 81 ubcore_log_err("Invalid parameter"); 82 return -EINVAL; 83 } 84 85 dev_ops = jfr->ub_dev->ops; 86 return dev_ops->post_jfr_wr(jfr, wr, bad_wr); 87 } 88 EXPORT_SYMBOL(ubcore_post_jfr_wr); 89 > 90 int ubcore_poll_jfc(struct ubcore_jfc *jfc, int cr_cnt, struct ubcore_cr *cr) 91 { 92 struct ubcore_ops *dev_ops; 93 94 if (jfc == NULL || jfc->ub_dev == NULL || jfc->ub_dev->ops == NULL || 95 jfc->ub_dev->ops->poll_jfc == NULL || cr == NULL) { 96 ubcore_log_err("Invalid parameter"); 97 return -EINVAL; 98 } 99 100 dev_ops = jfc->ub_dev->ops; 101 return dev_ops->poll_jfc(jfc, cr_cnt, cr); 102 } 103 EXPORT_SYMBOL(ubcore_poll_jfc); 104 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 27588/30000] include/linux/compiler_attributes.h:221:41: warning: attribute 'fallthrough' not preceding a case label or default label
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 0695e18bbaebbfbe22b049104bbb9a4300a9f30c [27588/30000] mm: Add PMU based memory sampling abstract layer config: arm64-randconfig-002-20240928 (https://download.01.org/0day-ci/archive/20240929/202409290030.UdfZl3fZ-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240929/202409290030.UdfZl3fZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290030.UdfZl3fZ-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/compiler_types.h:65, from <command-line>: drivers/arm/spe/spe.c: In function '__arm_spe_dev_probe': >> include/linux/compiler_attributes.h:221:41: warning: attribute 'fallthrough' not preceding a case label or default label 221 | # define fallthrough __attribute__((__fallthrough__)) | ^~~~~~~~~~~~~ drivers/arm/spe/spe.c:492:17: note: in expansion of macro 'fallthrough' 492 | fallthrough; | ^~~~~~~~~~~ >> include/linux/compiler_attributes.h:221:41: warning: attribute 'fallthrough' not preceding a case label or default label 221 | # define fallthrough __attribute__((__fallthrough__)) | ^~~~~~~~~~~~~ drivers/arm/spe/spe.c:514:17: note: in expansion of macro 'fallthrough' 514 | fallthrough; | ^~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARM_SPE_MEM_SAMPLING Depends on [n]: ARM64 [=y] && !ARM_SPE_PMU [=y] Selected by [y]: - MEM_SAMPLING [=y] && ARM64 [=y] WARNING: unmet direct dependencies detected for BPF_NET_GLOBAL_PROG Depends on [n]: NET [=n] && BPF_SYSCALL [=n] Selected by [y]: - SCHED_TASK_RELATIONSHIP [=y] && CGROUPS [=y] && NUMA_BALANCING [=y] vim +/fallthrough +221 include/linux/compiler_attributes.h 294f69e662d157 Joe Perches 2019-10-05 209 294f69e662d157 Joe Perches 2019-10-05 210 /* 294f69e662d157 Joe Perches 2019-10-05 211 * Add the pseudo keyword 'fallthrough' so case statement blocks 294f69e662d157 Joe Perches 2019-10-05 212 * must end with any of these keywords: 294f69e662d157 Joe Perches 2019-10-05 213 * break; 294f69e662d157 Joe Perches 2019-10-05 214 * fallthrough; 294f69e662d157 Joe Perches 2019-10-05 215 * goto <label>; 294f69e662d157 Joe Perches 2019-10-05 216 * return [expression]; 294f69e662d157 Joe Perches 2019-10-05 217 * 294f69e662d157 Joe Perches 2019-10-05 218 * gcc: https://gcc.gnu.org/onlinedocs/gcc/Statement-Attributes.html#Statement-Attr… 294f69e662d157 Joe Perches 2019-10-05 219 */ 294f69e662d157 Joe Perches 2019-10-05 220 #if __has_attribute(__fallthrough__) 294f69e662d157 Joe Perches 2019-10-05 @221 # define fallthrough __attribute__((__fallthrough__)) 294f69e662d157 Joe Perches 2019-10-05 222 #else 294f69e662d157 Joe Perches 2019-10-05 223 # define fallthrough do {} while (0) /* fallthrough */ a3f8a30f3f0079 Miguel Ojeda 2018-08-30 224 #endif a3f8a30f3f0079 Miguel Ojeda 2018-08-30 225 :::::: The code at line 221 was first introduced by commit :::::: 294f69e662d1570703e9b56e95be37a9fd3afba5 compiler_attributes.h: Add 'fallthrough' pseudo keyword for switch/case use :::::: TO: Joe Perches <joe(a)perches.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21291/23799] drivers/spi/spi-phytium-plat.c:192:36: warning: 'phytium_spi_acpi_match' defined but not used
by kernel test robot 29 Sep '24

29 Sep '24

Hi Malloy, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: e8483fcd43fc1dbb8d21bb7eacce804cbab6a7c6 [21291/23799] spi: add phytium spi support config: arm64-randconfig-003-20240928 (https://download.01.org/0day-ci/archive/20240929/202409290023.FihgEvFc-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240929/202409290023.FihgEvFc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290023.FihgEvFc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/spi/spi-phytium-plat.c:192:36: warning: 'phytium_spi_acpi_match' defined but not used [-Wunused-const-variable=] 192 | static const struct acpi_device_id phytium_spi_acpi_match[] = { | ^~~~~~~~~~~~~~~~~~~~~~ vim +/phytium_spi_acpi_match +192 drivers/spi/spi-phytium-plat.c 191 > 192 static const struct acpi_device_id phytium_spi_acpi_match[] = { 193 {"PHYT000E", 0}, 194 {} 195 }; 196 MODULE_DEVICE_TABLE(acpi, phytium_spi_acpi_match); 197 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 19782/30000] drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:3270:29: sparse: sparse: symbol 'hns3_unic_netdev_ops' was not declared. Should it be static?
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 737ec46e963210dc3b856637e871fa5b0c91316e [19782/30000] UNIC: Adds the process of UNIC driver initializing config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240929/202409290026.ODSSLRxB-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409290026.ODSSLRxB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290026.ODSSLRxB-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:1200:29: sparse: sparse: restricted __be32 degrades to integer >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:3270:29: sparse: sparse: symbol 'hns3_unic_netdev_ops' was not declared. Should it be static? vim +/hns3_unic_netdev_ops +3270 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c 3269 > 3270 const struct net_device_ops hns3_unic_netdev_ops = { 3271 .ndo_open = hns3_nic_net_open, 3272 .ndo_stop = hns3_nic_net_stop, 3273 .ndo_start_xmit = hns3_nic_net_xmit, 3274 .ndo_tx_timeout = hns3_nic_net_timeout, 3275 .ndo_do_ioctl = hns3_nic_do_ioctl, 3276 .ndo_change_mtu = hns3_nic_change_mtu, 3277 .ndo_set_features = hns3_nic_set_features, 3278 .ndo_features_check = hns3_features_check, 3279 .ndo_get_stats64 = hns3_nic_get_stats64, 3280 .ndo_setup_tc = hns3_nic_setup_tc, 3281 .ndo_set_rx_mode = hns3_nic_set_rx_mode, 3282 .ndo_set_vf_trust = hns3_set_vf_trust, 3283 #ifdef CONFIG_RFS_ACCEL 3284 .ndo_rx_flow_steer = hns3_rx_flow_steer, 3285 #endif 3286 .ndo_get_vf_config = hns3_nic_get_vf_config, 3287 .ndo_set_vf_link_state = hns3_nic_set_vf_link_state, 3288 .ndo_set_vf_rate = hns3_nic_set_vf_rate, 3289 .ndo_select_queue = hns3_nic_select_queue, 3290 }; 3291 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 19685/23799] drivers/md/.tmp_dm-verity-verify-sig.o: warning: objtool: missing symbol for section .text
by kernel test robot 28 Sep '24

28 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: 193a981127632c7d4c26a0674881dea0c208640c [19685/23799] dm verity: add root hash pkcs#7 signature verification config: x86_64-buildonly-randconfig-002-20240926 (https://download.01.org/0day-ci/archive/20240928/202409282255.GuxtXkRJ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409282255.GuxtXkRJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409282255.GuxtXkRJ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/md/.tmp_dm-verity-verify-sig.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 27522/30000] drivers/soc/hisilicon/hisi_lockdown.c:56:19: warning: no previous prototype for 'get_valid_sccl'
by kernel test robot 28 Sep '24

28 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: c40d971092ff58cd771bb9413ae132a3eb74fab3 [27522/30000] hisi: l3t: Add L3 cache driver for hisi config: arm64-randconfig-002-20240928 (https://download.01.org/0day-ci/archive/20240928/202409282220.v0Ys1Flg-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409282220.v0Ys1Flg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409282220.v0Ys1Flg-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/soc/hisilicon/hisi_lockdown.c:56:19: warning: no previous prototype for 'get_valid_sccl' [-Wmissing-prototypes] 56 | struct hisi_sccl *get_valid_sccl(int nid) | ^~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for BPF_NET_GLOBAL_PROG Depends on [n]: NET [=n] && BPF_SYSCALL [=n] Selected by [y]: - SCHED_TASK_RELATIONSHIP [=y] && CGROUPS [=y] && NUMA_BALANCING [=y] vim +/get_valid_sccl +56 drivers/soc/hisilicon/hisi_lockdown.c 55 > 56 struct hisi_sccl *get_valid_sccl(int nid) 57 { 58 struct hisi_sccl *sccl; 59 60 sccl = hisi_l3t_get_sccl(nid); 61 if (!sccl || !sccl->ccl_cnt) 62 return NULL; 63 64 if (!sccl->l3t || !sccl->l3t[0]) 65 return NULL; 66 67 return sccl; 68 } 69 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20162/23799] mm/share_pool.c:4577:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared
by kernel test robot 28 Sep '24

28 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: 0886320b818787f720824229f153f161c89faf70 [20162/23799] mm/sharepool: Charge Buddy hugepage to memcg config: arm64-randconfig-003-20240928 (https://download.01.org/0day-ci/archive/20240928/202409282248.mtMRfV3U-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409282248.mtMRfV3U-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409282248.mtMRfV3U-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c: In function 'mg_sp_group_id_by_pid': mm/share_pool.c:1086:29: warning: ordered comparison of pointer with integer zero [-Wextra] 1086 | if (!spg_ids || num <= 0) | ^~ mm/share_pool.c: In function 'sp_compact_nodes': mm/share_pool.c:2149:9: error: implicit declaration of function 'sysctl_compaction_handler'; did you mean 'sysctl_memcg_qos_handler'? [-Werror=implicit-function-declaration] 2149 | sysctl_compaction_handler(NULL, 1, NULL, NULL, NULL); | ^~~~~~~~~~~~~~~~~~~~~~~~~ | sysctl_memcg_qos_handler mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:3299:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 3299 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:3299:21: error: invalid initializer mm/share_pool.c: In function 'sharepool_no_page': mm/share_pool.c:4577:32: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 4577 | page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage >> mm/share_pool.c:4577:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared (first use in this function) 4577 | page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); | ^~~~~~~~~~~~~~~~~~~ mm/share_pool.c:4577:64: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:4585:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 4585 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock mm/share_pool.c:4606:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 4606 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache mm/share_pool.c:4631:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 4631 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at mm/share_pool.c:4633:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 4633 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:4797:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 4797 | page = hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c: At top level: mm/share_pool.c:4492:12: warning: 'proc_overview_show' defined but not used [-Wunused-function] 4492 | static int proc_overview_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~~~~~~ mm/share_pool.c:4440:12: warning: 'proc_stat_show' defined but not used [-Wunused-function] 4440 | static int proc_stat_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~~ mm/share_pool.c:4377:12: warning: 'spa_stat_show' defined but not used [-Wunused-function] 4377 | static int spa_stat_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/HUGETLB_ALLOC_BUDDY +4577 mm/share_pool.c 4541 4542 vm_fault_t sharepool_no_page(struct mm_struct *mm, 4543 struct vm_area_struct *vma, 4544 struct address_space *mapping, pgoff_t idx, 4545 unsigned long address, pte_t *ptep, unsigned int flags) 4546 { 4547 struct hstate *h = hstate_vma(vma); 4548 vm_fault_t ret = VM_FAULT_SIGBUS; 4549 unsigned long size; 4550 struct page *page; 4551 pte_t new_pte; 4552 spinlock_t *ptl; 4553 unsigned long haddr = address & huge_page_mask(h); 4554 bool new_page = false; 4555 int err; 4556 int node_id; 4557 struct sp_area *spa; 4558 bool charge_hpage = false; 4559 struct mem_cgroup *memcg; 4560 4561 spa = vma->vm_private_data; 4562 if (!spa) { 4563 pr_err("share pool: vma is invalid, not from sp mmap\n"); 4564 return ret; 4565 } 4566 node_id = spa->node_id; 4567 4568 retry: 4569 page = find_lock_page(mapping, idx); 4570 if (!page) { 4571 size = i_size_read(mapping->host) >> huge_page_shift(h); 4572 if (idx >= size) 4573 goto out; 4574 4575 page = alloc_huge_page(vma, haddr, 0); 4576 if (IS_ERR(page)) { > 4577 page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); 4578 if (!page) 4579 page = ERR_PTR(-ENOMEM); 4580 else if (!PageKmemcg(page)) 4581 charge_hpage = true; 4582 } 4583 if (IS_ERR(page)) { 4584 ptl = huge_pte_lock(h, mm, ptep); 4585 if (!huge_pte_none(huge_ptep_get(ptep))) { 4586 ret = 0; 4587 spin_unlock(ptl); 4588 goto out; 4589 } 4590 spin_unlock(ptl); 4591 ret = vmf_error(PTR_ERR(page)); 4592 goto out; 4593 } 4594 4595 if (charge_hpage && 4596 mem_cgroup_try_charge_delay(page, vma->vm_mm, GFP_KERNEL, &memcg, true)) { 4597 put_page(page); 4598 ret = vmf_error(-ENOMEM); 4599 goto out; 4600 } 4601 4602 __SetPageUptodate(page); 4603 new_page = true; 4604 4605 /* sharepool pages are all shared */ 4606 err = huge_add_to_page_cache(page, mapping, idx); 4607 if (err) { 4608 if (charge_hpage) { 4609 mem_cgroup_cancel_charge(page, memcg, true); 4610 charge_hpage = false; 4611 } 4612 put_page(page); 4613 if (err == -EEXIST) 4614 goto retry; 4615 goto out; 4616 } 4617 } 4618 4619 ptl = huge_pte_lock(h, mm, ptep); 4620 size = i_size_read(mapping->host) >> huge_page_shift(h); 4621 if (idx >= size) 4622 goto backout; 4623 4624 ret = 0; 4625 if (!huge_pte_none(huge_ptep_get(ptep))) 4626 goto backout; 4627 4628 page_dup_rmap(page, true); 4629 new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) 4630 && (vma->vm_flags & VM_SHARED))); 4631 set_huge_pte_at(mm, haddr, ptep, new_pte); 4632 4633 hugetlb_count_add(pages_per_huge_page(h), mm); 4634 4635 if (charge_hpage) 4636 mem_cgroup_commit_charge(page, memcg, false, true); 4637 4638 spin_unlock(ptl); 4639 4640 if (new_page) 4641 SetPagePrivate(&page[1]); 4642 4643 unlock_page(page); 4644 out: 4645 return ret; 4646 4647 backout: 4648 spin_unlock(ptl); 4649 unlock_page(page); 4650 if (charge_hpage) 4651 mem_cgroup_cancel_charge(page, memcg, true); 4652 put_page(page); 4653 goto out; 4654 } 4655 EXPORT_SYMBOL(sharepool_no_page); 4656 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 15413/30000] drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:1184:29: sparse: sparse: restricted __be32 degrades to integer
by kernel test robot 28 Sep '24

28 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 19f053b7ee378e6d556caddf05485fe55695149e [15413/30000] net: hns3: add support handling tx dhcp packets for ROH config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240928/202409282011.zsMjvrEl-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240928/202409282011.zsMjvrEl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409282011.zsMjvrEl-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:1184:29: sparse: sparse: restricted __be32 degrades to integer vim +1184 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c 1167 1168 static struct hns3_dhcp_packet *hns3_get_dhcp_packet(struct sk_buff *skb, 1169 int *dhcp_len) 1170 { 1171 struct hns3_dhcp_packet *dhcp; 1172 union l4_hdr_info l4; 1173 int l4_payload_len; 1174 1175 l4.hdr = skb_transport_header(skb); 1176 if (l4.udp->dest != htons(HNS3_DHCP_CLIENT_PORT) || 1177 l4.udp->source != htons(HNS3_DHCP_SERVER_PORT)) 1178 return NULL; 1179 1180 dhcp = (struct hns3_dhcp_packet *)(l4.hdr + sizeof(struct udphdr)); 1181 l4_payload_len = ntohs(l4.udp->len) - sizeof(struct udphdr); 1182 if (l4_payload_len < offsetof(struct hns3_dhcp_packet, options) || 1183 dhcp->hlen != ETH_ALEN || > 1184 dhcp->cookie != htonl(HNS3_DHCP_MAGIC)) 1185 return NULL; 1186 1187 *dhcp_len = l4_payload_len; 1188 return dhcp; 1189 } 1190 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 19033/23799] mm/mem_reliable.c:41:22: warning: 'zero' defined but not used
by kernel test robot 28 Sep '24

28 Sep '24

Hi Chen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: 6943b93b464351cbc35aa002e86bac48e08b1c3f [19033/23799] mm: add support for limiting the usage of reliable memory in pagecache config: arm64-randconfig-003-20240928 (https://download.01.org/0day-ci/archive/20240928/202409281933.6SgL6bDf-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409281933.6SgL6bDf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409281933.6SgL6bDf-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/mem_reliable.c:42:22: warning: 'reliable_pagecache_max_bytes' defined but not used [-Wunused-variable] 42 | static unsigned long reliable_pagecache_max_bytes = ULONG_MAX; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> mm/mem_reliable.c:41:22: warning: 'zero' defined but not used [-Wunused-variable] 41 | static unsigned long zero; | ^~~~ vim +/zero +41 mm/mem_reliable.c 40 > 41 static unsigned long zero; 42 static unsigned long reliable_pagecache_max_bytes = ULONG_MAX; 43 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 20090/30000] arch/arm64/kernel/cpufeature.c:1729:13: warning: no previous prototype for 'early_pbha_init'
by kernel test robot 28 Sep '24

28 Sep '24

Hi Ma, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: f43933b3f947a7f9314ec8d704c6ae01041dbbba [20090/30000] arm64: cpufeature: Enable PBHA for stage1 early via FDT config: arm64-randconfig-002-20240928 (https://download.01.org/0day-ci/archive/20240928/202409281932.KZq0zK8A-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409281932.KZq0zK8A-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409281932.KZq0zK8A-lkp@intel.com/ Note: functions only called from assembly code should be annotated with the asmlinkage attribute All warnings (new ones prefixed by >>): arch/arm64/kernel/cpufeature.c:1627:6: warning: no previous prototype for 'update_pbha_perf_only_bit' [-Wmissing-prototypes] 1627 | void update_pbha_perf_only_bit(const u8 *bits, int cnt) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kernel/cpufeature.c:1729:13: warning: no previous prototype for 'early_pbha_init' [-Wmissing-prototypes] 1729 | void __init early_pbha_init(void) | ^~~~~~~~~~~~~~~ vim +/early_pbha_init +1729 arch/arm64/kernel/cpufeature.c 1728 > 1729 void __init early_pbha_init(void) 1730 { 1731 void *fdt; 1732 int node; 1733 const u8 *prop; 1734 int size; 1735 1736 spin_lock(&pbha_dt_lock); 1737 1738 fdt = get_early_fdt_ptr(); 1739 if (!fdt) 1740 goto unlock; 1741 1742 node = fdt_path_offset(fdt, "/cpus"); 1743 if (node < 0) 1744 goto unlock; 1745 1746 prop = fdt_getprop(fdt, node, "arm,pbha-performance-only", &size); 1747 if (!prop) 1748 goto unlock; 1749 1750 if (!cpu_has_pbha()) 1751 goto unlock; 1752 1753 update_pbha_perf_only_bit(prop, size); 1754 enable_pbha_inner(); 1755 1756 pbha_enabled = true; 1757 1758 unlock: 1759 spin_unlock(&pbha_dt_lock); 1760 } 1761 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/3] Some misses patch for run scheduler bpf programs
by Hui Tang 28 Sep '24

28 Sep '24

The patchset as follow: Guan Jing (3): libbpf: add support for scheduler bpf programs bpftool: recognize scheduler programs sched: Add helper functions to get cpu statistics include/linux/sched.h | 9 ++++++++ include/uapi/linux/bpf.h | 7 +++++++ kernel/sched/bpf_sched.c | 38 ++++++++++++++++++++++++++++++++++ scripts/bpf_doc.py | 2 ++ tools/include/uapi/linux/bpf.h | 7 +++++++ tools/lib/bpf/libbpf.c | 23 +++++++++++++++++++- tools/lib/bpf/libbpf.h | 2 ++ tools/lib/bpf/libbpf.map | 1 + 8 files changed, 88 insertions(+), 1 deletion(-) -- 2.34.1

2 4

[openeuler:OLK-5.10 14637/30000] drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:4413:46: sparse: sparse: mixing different enum types:
by kernel test robot 28 Sep '24

28 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 62aede9feaf6f4729af43df72be267a32bda43d1 [14637/30000] net: hns3: add support customized exception handling interfaces. config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240928/202409281736.VfwcJjb4-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240928/202409281736.VfwcJjb4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409281736.VfwcJjb4-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:4413:46: sparse: sparse: mixing different enum types: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:4413:46: sparse: unsigned int enum hnae3_reset_type drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:4413:46: sparse: unsigned int enum hnae3_event_type_custom drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5902:37: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5903:37: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:6137:17: sparse: sparse: restricted __be32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:6231:17: sparse: sparse: restricted __be32 degrades to integer >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:13772:21: sparse: sparse: symbol 'hclge_ops' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5473:31: sparse: sparse: context imbalance in 'hclge_sync_fd_user_def_cfg' - unexpected unlock drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:12714:23: sparse: sparse: memset with byte count of 131072 vim +4413 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c 4374 4375 void hclge_reset_event(struct pci_dev *pdev, struct hnae3_handle *handle) 4376 { 4377 struct hnae3_ae_dev *ae_dev = pci_get_drvdata(pdev); 4378 struct hclge_dev *hdev = ae_dev->priv; 4379 int ret; 4380 4381 /* We might end up getting called broadly because of 2 below cases: 4382 * 1. Recoverable error was conveyed through APEI and only way to bring 4383 * normalcy is to reset. 4384 * 2. A new reset request from the stack due to timeout 4385 * 4386 * check if this is a new reset request and we are not here just because 4387 * last reset attempt did not succeed and watchdog hit us again. We will 4388 * know this if last reset request did not occur very recently (watchdog 4389 * timer = 5*HZ, let us check after sufficiently large time, say 4*5*Hz) 4390 * In case of new request we reset the "reset level" to PF reset. 4391 * And if it is a repeat reset request of the most recent one then we 4392 * want to make sure we throttle the reset request. Therefore, we will 4393 * not allow it again before 3*HZ times. 4394 */ 4395 4396 if (time_before(jiffies, (hdev->last_reset_time + 4397 HCLGE_RESET_INTERVAL))) { 4398 mod_timer(&hdev->reset_timer, jiffies + HCLGE_RESET_INTERVAL); 4399 return; 4400 } 4401 4402 if (hdev->default_reset_request) { 4403 hdev->reset_level = 4404 hclge_get_reset_level(ae_dev, 4405 &hdev->default_reset_request); 4406 } else if (time_after(jiffies, (hdev->last_reset_time + 4 * 5 * HZ))) { 4407 hdev->reset_level = HNAE3_FUNC_RESET; 4408 } 4409 4410 dev_info(&hdev->pdev->dev, "received reset event, reset type is %d\n", 4411 hdev->reset_level); 4412 > 4413 ret = hclge_ext_call_event(hdev, hdev->reset_level); 4414 if (ret) { 4415 /* request reset & schedule reset task */ 4416 set_bit(hdev->reset_level, &hdev->reset_request); 4417 hclge_reset_task_schedule(hdev); 4418 } 4419 4420 if (hdev->reset_level < HNAE3_GLOBAL_RESET) 4421 hdev->reset_level++; 4422 } 4423 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 18309/23799] mm/share_pool.c:3736:12: warning: 'proc_overview_show' defined but not used
by kernel test robot 28 Sep '24

28 Sep '24

Hi Tang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: 1cfc25ccec44c17c19c892bd31d00d8f6fb23f9b [18309/23799] share_pool: Add proc node to show process overview info config: arm64-randconfig-003-20240928 (https://download.01.org/0day-ci/archive/20240928/202409281617.XJYO7emb-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409281617.XJYO7emb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409281617.XJYO7emb-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/share_pool.c: In function 'sp_group_id_by_pid': mm/share_pool.c:840:29: warning: ordered comparison of pointer with integer zero [-Wextra] 840 | if (!spg_ids || num <= 0) | ^~ mm/share_pool.c: In function 'sp_compact_nodes': mm/share_pool.c:1689:9: error: implicit declaration of function 'sysctl_compaction_handler'; did you mean 'sysctl_memcg_qos_handler'? [-Werror=implicit-function-declaration] 1689 | sysctl_compaction_handler(NULL, 1, NULL, NULL, NULL); | ^~~~~~~~~~~~~~~~~~~~~~~~~ | sysctl_memcg_qos_handler mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:2688:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 2688 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:2688:21: error: invalid initializer mm/share_pool.c: In function 'sharepool_no_page': mm/share_pool.c:3824:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 3824 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock mm/share_pool.c:3837:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 3837 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache mm/share_pool.c:3859:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 3859 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at mm/share_pool.c:3861:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 3861 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub mm/share_pool.c:3797:13: warning: variable 'node_id' set but not used [-Wunused-but-set-variable] 3797 | int node_id; | ^~~~~~~ mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:4018:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 4018 | page = hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage mm/share_pool.c:4018:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 4018 | page = hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:4018:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c: At top level: >> mm/share_pool.c:3736:12: warning: 'proc_overview_show' defined but not used [-Wunused-function] 3736 | static int proc_overview_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~~~~~~ mm/share_pool.c:3693:12: warning: 'proc_stat_show' defined but not used [-Wunused-function] 3693 | static int proc_stat_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~~ mm/share_pool.c:3635:12: warning: 'spa_stat_show' defined but not used [-Wunused-function] 3635 | static int spa_stat_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/proc_overview_show +3736 mm/share_pool.c 3735 > 3736 static int proc_overview_show(struct seq_file *seq, void *offset) 3737 { 3738 seq_printf(seq, "%-8s %-16s %-9s %-9s %-9s %-10s %-10s %-8s\n", 3739 "PID", "COMM", "SP_ALLOC", "SP_K2U", "SP_RES", "Non-SP_RES", 3740 "Non-SP_Shm", "VIRT"); 3741 3742 down_read(&sp_proc_stat_sem); 3743 idr_for_each(&sp_proc_stat_idr, idr_proc_overview_cb, seq); 3744 up_read(&sp_proc_stat_sem); 3745 return 0; 3746 } 3747 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 18200/23799] mm/share_pool.c:1043:9: error: implicit declaration of function 'sysctl_compaction_handler'; did you mean 'sysctl_memcg_qos_handler'?
by kernel test robot 28 Sep '24

28 Sep '24

Hi Zhou, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: d45b33b72c530e64219ad997947a33f6e07d339c [18200/23799] share pool: Try to compact when memory is insufficient config: arm64-randconfig-003-20240928 (https://download.01.org/0day-ci/archive/20240928/202409281442.EoXjS7UC-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409281442.EoXjS7UC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409281442.EoXjS7UC-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c: In function 'sp_compact_nodes': >> mm/share_pool.c:1043:9: error: implicit declaration of function 'sysctl_compaction_handler'; did you mean 'sysctl_memcg_qos_handler'? [-Werror=implicit-function-declaration] 1043 | sysctl_compaction_handler(NULL, 1, NULL, NULL, NULL); | ^~~~~~~~~~~~~~~~~~~~~~~~~ | sysctl_memcg_qos_handler mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:1772:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 1772 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:1772:21: error: invalid initializer mm/share_pool.c: In function 'sharepool_no_page': mm/share_pool.c:2524:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 2524 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock mm/share_pool.c:2537:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 2537 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache mm/share_pool.c:2559:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 2559 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at mm/share_pool.c:2561:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 2561 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:2597:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 2597 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage mm/share_pool.c:2597:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 2597 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:2597:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:2600:1: warning: control reaches end of non-void function [-Wreturn-type] 2600 | } | ^ mm/share_pool.c: At top level: mm/share_pool.c:2482:12: warning: 'spa_stat_show' defined but not used [-Wunused-function] 2482 | static int spa_stat_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~ mm/share_pool.c:2363:12: warning: 'proc_stat_show' defined but not used [-Wunused-function] 2363 | static int proc_stat_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +1043 mm/share_pool.c 1039 1040 static unsigned long last_jiffies; 1041 static void sp_compact_nodes(struct work_struct *work) 1042 { > 1043 sysctl_compaction_handler(NULL, 1, NULL, NULL, NULL); 1044 1045 kfree(work); 1046 } 1047 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 14521/30000] drivers/gpu/drm/loongson/lsdc_i2c.c:180:23: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 28 Sep '24

28 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 028c67cca3dd40a78c0f025f2b8562343dcb2741 [14521/30000] LoongArch: fix compile error when using make allmodconfig config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240928/202409281308.P52A5s6n-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240928/202409281308.P52A5s6n-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409281308.P52A5s6n-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/gpu/drm/loongson/lsdc_i2c.c:180:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __iomem *dir_reg @@ got void * @@ drivers/gpu/drm/loongson/lsdc_i2c.c:180:23: sparse: expected void [noderef] __iomem *dir_reg drivers/gpu/drm/loongson/lsdc_i2c.c:180:23: sparse: got void * >> drivers/gpu/drm/loongson/lsdc_i2c.c:181:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __iomem *dat_reg @@ got void * @@ drivers/gpu/drm/loongson/lsdc_i2c.c:181:23: sparse: expected void [noderef] __iomem *dat_reg drivers/gpu/drm/loongson/lsdc_i2c.c:181:23: sparse: got void * drivers/gpu/drm/loongson/lsdc_i2c.c:253:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __iomem *dir_reg @@ got void * @@ drivers/gpu/drm/loongson/lsdc_i2c.c:253:23: sparse: expected void [noderef] __iomem *dir_reg drivers/gpu/drm/loongson/lsdc_i2c.c:253:23: sparse: got void * drivers/gpu/drm/loongson/lsdc_i2c.c:254:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __iomem *dat_reg @@ got void * @@ drivers/gpu/drm/loongson/lsdc_i2c.c:254:23: sparse: expected void [noderef] __iomem *dat_reg drivers/gpu/drm/loongson/lsdc_i2c.c:254:23: sparse: got void * vim +180 drivers/gpu/drm/loongson/lsdc_i2c.c 80764bc784413e Huacai Chen 2018-05-22 130 80764bc784413e Huacai Chen 2018-05-22 131 struct lsdc_i2c *lsdc_of_create_i2c_adapter(struct device *parent, 80764bc784413e Huacai Chen 2018-05-22 132 void *reg_base, 80764bc784413e Huacai Chen 2018-05-22 133 struct device_node *i2c_np) 80764bc784413e Huacai Chen 2018-05-22 134 { 80764bc784413e Huacai Chen 2018-05-22 135 unsigned int udelay = 5; 80764bc784413e Huacai Chen 2018-05-22 136 unsigned int timeout = 2200; 80764bc784413e Huacai Chen 2018-05-22 137 int nr = -1; 80764bc784413e Huacai Chen 2018-05-22 138 struct i2c_adapter *adapter; 80764bc784413e Huacai Chen 2018-05-22 139 struct lsdc_i2c *li2c; 80764bc784413e Huacai Chen 2018-05-22 140 u32 sda, scl; 80764bc784413e Huacai Chen 2018-05-22 141 int ret; 80764bc784413e Huacai Chen 2018-05-22 142 80764bc784413e Huacai Chen 2018-05-22 143 li2c = kzalloc(sizeof(*li2c), GFP_KERNEL); 80764bc784413e Huacai Chen 2018-05-22 144 if (!li2c) 80764bc784413e Huacai Chen 2018-05-22 145 return ERR_PTR(-ENOMEM); 80764bc784413e Huacai Chen 2018-05-22 146 80764bc784413e Huacai Chen 2018-05-22 147 spin_lock_init(&li2c->reglock); 80764bc784413e Huacai Chen 2018-05-22 148 80764bc784413e Huacai Chen 2018-05-22 149 ret = of_property_read_u32(i2c_np, "loongson,sda", &sda); 80764bc784413e Huacai Chen 2018-05-22 150 if (ret) { 80764bc784413e Huacai Chen 2018-05-22 151 dev_err(parent, "No sda pin number provided\n"); 80764bc784413e Huacai Chen 2018-05-22 152 return ERR_PTR(ret); 80764bc784413e Huacai Chen 2018-05-22 153 } 80764bc784413e Huacai Chen 2018-05-22 154 80764bc784413e Huacai Chen 2018-05-22 155 ret = of_property_read_u32(i2c_np, "loongson,scl", &scl); 80764bc784413e Huacai Chen 2018-05-22 156 if (ret) { 80764bc784413e Huacai Chen 2018-05-22 157 dev_err(parent, "No scl pin number provided\n"); 80764bc784413e Huacai Chen 2018-05-22 158 return ERR_PTR(ret); 80764bc784413e Huacai Chen 2018-05-22 159 } 80764bc784413e Huacai Chen 2018-05-22 160 80764bc784413e Huacai Chen 2018-05-22 161 ret = of_property_read_u32(i2c_np, "loongson,nr", &nr); 80764bc784413e Huacai Chen 2018-05-22 162 if (ret) { 80764bc784413e Huacai Chen 2018-05-22 163 int id; 80764bc784413e Huacai Chen 2018-05-22 164 80764bc784413e Huacai Chen 2018-05-22 165 if (ret == -EINVAL) 80764bc784413e Huacai Chen 2018-05-22 166 dev_dbg(parent, "no nr provided\n"); 80764bc784413e Huacai Chen 2018-05-22 167 80764bc784413e Huacai Chen 2018-05-22 168 id = of_alias_get_id(i2c_np, "i2c"); 80764bc784413e Huacai Chen 2018-05-22 169 if (id >= 0) 80764bc784413e Huacai Chen 2018-05-22 170 nr = id; 80764bc784413e Huacai Chen 2018-05-22 171 } 80764bc784413e Huacai Chen 2018-05-22 172 80764bc784413e Huacai Chen 2018-05-22 173 li2c->sda = 1 << sda; 80764bc784413e Huacai Chen 2018-05-22 174 li2c->scl = 1 << scl; 80764bc784413e Huacai Chen 2018-05-22 175 80764bc784413e Huacai Chen 2018-05-22 176 /* Optional properties which made the driver more flexible */ 80764bc784413e Huacai Chen 2018-05-22 177 of_property_read_u32(i2c_np, "loongson,udelay", &udelay); 80764bc784413e Huacai Chen 2018-05-22 178 of_property_read_u32(i2c_np, "loongson,timeout", &timeout); 80764bc784413e Huacai Chen 2018-05-22 179 80764bc784413e Huacai Chen 2018-05-22 @180 li2c->dir_reg = reg_base + LS7A_DC_GPIO_DIR_REG; 80764bc784413e Huacai Chen 2018-05-22 @181 li2c->dat_reg = reg_base + LS7A_DC_GPIO_DAT_REG; 80764bc784413e Huacai Chen 2018-05-22 182 80764bc784413e Huacai Chen 2018-05-22 183 li2c->bit.setsda = ls7a_i2c_set_sda; 80764bc784413e Huacai Chen 2018-05-22 184 li2c->bit.setscl = ls7a_i2c_set_scl; 80764bc784413e Huacai Chen 2018-05-22 185 li2c->bit.getsda = ls7a_i2c_get_sda; 80764bc784413e Huacai Chen 2018-05-22 186 li2c->bit.getscl = ls7a_i2c_get_scl; 80764bc784413e Huacai Chen 2018-05-22 187 li2c->bit.udelay = udelay; 80764bc784413e Huacai Chen 2018-05-22 188 li2c->bit.timeout = usecs_to_jiffies(timeout); 80764bc784413e Huacai Chen 2018-05-22 189 li2c->bit.data = li2c; 80764bc784413e Huacai Chen 2018-05-22 190 80764bc784413e Huacai Chen 2018-05-22 191 adapter = &li2c->adapter; 80764bc784413e Huacai Chen 2018-05-22 192 adapter->algo_data = &li2c->bit; 80764bc784413e Huacai Chen 2018-05-22 193 adapter->owner = THIS_MODULE; 80764bc784413e Huacai Chen 2018-05-22 194 adapter->class = I2C_CLASS_DDC; 80764bc784413e Huacai Chen 2018-05-22 195 adapter->dev.parent = parent; 80764bc784413e Huacai Chen 2018-05-22 196 adapter->nr = nr; 80764bc784413e Huacai Chen 2018-05-22 197 adapter->dev.of_node = i2c_np; 80764bc784413e Huacai Chen 2018-05-22 198 80764bc784413e Huacai Chen 2018-05-22 199 snprintf(adapter->name, sizeof(adapter->name), "gpio-i2c-%d", nr); 80764bc784413e Huacai Chen 2018-05-22 200 80764bc784413e Huacai Chen 2018-05-22 201 i2c_set_adapdata(adapter, li2c); 80764bc784413e Huacai Chen 2018-05-22 202 80764bc784413e Huacai Chen 2018-05-22 203 ret = i2c_bit_add_numbered_bus(adapter); 80764bc784413e Huacai Chen 2018-05-22 204 if (ret) { 80764bc784413e Huacai Chen 2018-05-22 205 if (i2c_np) 80764bc784413e Huacai Chen 2018-05-22 206 of_node_put(i2c_np); 80764bc784413e Huacai Chen 2018-05-22 207 80764bc784413e Huacai Chen 2018-05-22 208 kfree(li2c); 80764bc784413e Huacai Chen 2018-05-22 209 return ERR_PTR(ret); 80764bc784413e Huacai Chen 2018-05-22 210 } 80764bc784413e Huacai Chen 2018-05-22 211 80764bc784413e Huacai Chen 2018-05-22 212 dev_info(parent, "sda=%u, scl=%u, nr=%d, udelay=%u, timeout=%u\n", 80764bc784413e Huacai Chen 2018-05-22 213 li2c->sda, li2c->scl, nr, udelay, timeout); 80764bc784413e Huacai Chen 2018-05-22 214 80764bc784413e Huacai Chen 2018-05-22 215 ret = devm_add_action_or_reset(parent, lsdc_of_release_i2c_adapter, li2c); 80764bc784413e Huacai Chen 2018-05-22 216 if (ret) 80764bc784413e Huacai Chen 2018-05-22 217 return NULL; 80764bc784413e Huacai Chen 2018-05-22 218 80764bc784413e Huacai Chen 2018-05-22 219 return li2c; 80764bc784413e Huacai Chen 2018-05-22 220 } 80764bc784413e Huacai Chen 2018-05-22 221 :::::: The code at line 180 was first introduced by commit :::::: 80764bc784413eb604c7d472db55b1ca72d4bbc5 drm/loongson: add kernel modesetting driver support for ls7a1000/ls7a2000 :::::: TO: Huacai Chen <chenhc(a)lemote.com> :::::: CC: Hongchen Zhang <zhanghongchen(a)loongson.cn> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 10131/23799] kernel/sched/debug.o: warning: objtool: missing symbol for section .text.unlikely
by kernel test robot 28 Sep '24

28 Sep '24

Hi Qiang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: acfa0f545c7dd43f959c28e8ab4b139c927ba387 [10131/23799] svm: reduce log of run queue and atomic->atomic64 config: x86_64-buildonly-randconfig-002-20240928 (https://download.01.org/0day-ci/archive/20240928/202409281256.6EkX99ER-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409281256.6EkX99ER-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409281256.6EkX99ER-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/sched/debug.c:797:6: warning: no previous prototype for 'sysrq_sched_debug_tidy' [-Wmissing-prototypes] 797 | void sysrq_sched_debug_tidy(void) | ^~~~~~~~~~~~~~~~~~~~~~ >> kernel/sched/debug.o: warning: objtool: missing symbol for section .text.unlikely -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 15026/23799] arch/arm64/mm/init.c:790:17: error: 'pmu_nmi_enable' undeclared; did you mean 'perf_pmu_enable'?
by kernel test robot 28 Sep '24

28 Sep '24

Hi Xu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: 0c40cea7cfc2d1d9762e6fbbb531a43e6dac95ca [15026/23799] NMI: Enable arm-pmu interrupt as NMI in Acensed. config: arm64-randconfig-002-20240928 (https://download.01.org/0day-ci/archive/20240928/202409281255.ytTMHoEG-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409281255.ytTMHoEG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409281255.ytTMHoEG-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/mm/init.c:469:13: warning: no previous prototype for 'arm64_memblock_init' [-Wmissing-prototypes] 469 | void __init arm64_memblock_init(void) | ^~~~~~~~~~~~~~~~~~~ arch/arm64/mm/init.c: In function 'ascend_enable_all_features': arch/arm64/mm/init.c:787:17: error: 'mem_sleep_current' undeclared (first use in this function) 787 | mem_sleep_current = PM_SUSPEND_ON; | ^~~~~~~~~~~~~~~~~ arch/arm64/mm/init.c:787:17: note: each undeclared identifier is reported only once for each function it appears in >> arch/arm64/mm/init.c:790:17: error: 'pmu_nmi_enable' undeclared (first use in this function); did you mean 'perf_pmu_enable'? 790 | pmu_nmi_enable = true; | ^~~~~~~~~~~~~~ | perf_pmu_enable vim +790 arch/arm64/mm/init.c 774 775 void ascend_enable_all_features(void) 776 { 777 if (IS_ENABLED(CONFIG_ASCEND_DVPP_MMAP)) 778 enable_mmap_dvpp = 1; 779 780 if (IS_ENABLED(CONFIG_ASCEND_IOPF_HIPRI)) 781 enable_iopf_hipri = 1; 782 783 if (IS_ENABLED(CONFIG_ASCEND_CHARGE_MIGRATE_HUGEPAGES)) 784 enable_charge_mighp = 1; 785 786 if (IS_ENABLED(CONFIG_SUSPEND)) 787 mem_sleep_current = PM_SUSPEND_ON; 788 789 if (IS_ENABLED(CONFIG_PMU_WATCHDOG)) > 790 pmu_nmi_enable = true; 791 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 18191/23799] mm/share_pool.c:2435:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'?
by kernel test robot 28 Sep '24

28 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: 4e851c2bb53e45d92e266c65cf0c203624e74710 [18191/23799] ascend: share_pool: Use sharepool_no_page to alloc hugepage config: arm64-randconfig-003-20240928 (https://download.01.org/0day-ci/archive/20240928/202409281115.zfsojOdU-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409281115.zfsojOdU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409281115.zfsojOdU-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:1685:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 1685 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:1685:21: error: invalid initializer mm/share_pool.c: In function 'sharepool_no_page': >> mm/share_pool.c:2435:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 2435 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock >> mm/share_pool.c:2448:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 2448 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache >> mm/share_pool.c:2470:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 2470 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at >> mm/share_pool.c:2472:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 2472 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:2508:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 2508 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage mm/share_pool.c:2508:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 2508 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:2508:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:2511:1: warning: control reaches end of non-void function [-Wreturn-type] 2511 | } | ^ mm/share_pool.c: At top level: mm/share_pool.c:2393:12: warning: 'spa_stat_show' defined but not used [-Wunused-function] 2393 | static int spa_stat_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~ mm/share_pool.c:2274:12: warning: 'proc_stat_show' defined but not used [-Wunused-function] 2274 | static int proc_stat_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +2435 mm/share_pool.c 2403 2404 vm_fault_t sharepool_no_page(struct mm_struct *mm, 2405 struct vm_area_struct *vma, 2406 struct address_space *mapping, pgoff_t idx, 2407 unsigned long address, pte_t *ptep, unsigned int flags) 2408 { 2409 struct hstate *h = hstate_vma(vma); 2410 vm_fault_t ret = VM_FAULT_SIGBUS; 2411 unsigned long size; 2412 struct page *page; 2413 pte_t new_pte; 2414 spinlock_t *ptl; 2415 unsigned long haddr = address & huge_page_mask(h); 2416 bool new_page = false; 2417 int err; 2418 2419 retry: 2420 page = find_lock_page(mapping, idx); 2421 if (!page) { 2422 size = i_size_read(mapping->host) >> huge_page_shift(h); 2423 if (idx >= size) 2424 goto out; 2425 2426 page = alloc_huge_page(vma, haddr, 0); 2427 if (IS_ERR(page)) { 2428 page = alloc_huge_page_node(hstate_file(vma->vm_file), 2429 numa_mem_id()); 2430 if (!page) 2431 page = ERR_PTR(-ENOMEM); 2432 } 2433 if (IS_ERR(page)) { 2434 ptl = huge_pte_lock(h, mm, ptep); > 2435 if (!huge_pte_none(huge_ptep_get(ptep))) { 2436 ret = 0; 2437 spin_unlock(ptl); 2438 goto out; 2439 } 2440 spin_unlock(ptl); 2441 ret = vmf_error(PTR_ERR(page)); 2442 goto out; 2443 } 2444 __SetPageUptodate(page); 2445 new_page = true; 2446 2447 /* sharepool pages are all shared */ > 2448 err = huge_add_to_page_cache(page, mapping, idx); 2449 if (err) { 2450 put_page(page); 2451 if (err == -EEXIST) 2452 goto retry; 2453 goto out; 2454 } 2455 } 2456 2457 2458 ptl = huge_pte_lock(h, mm, ptep); 2459 size = i_size_read(mapping->host) >> huge_page_shift(h); 2460 if (idx >= size) 2461 goto backout; 2462 2463 ret = 0; 2464 if (!huge_pte_none(huge_ptep_get(ptep))) 2465 goto backout; 2466 2467 page_dup_rmap(page, true); 2468 new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) 2469 && (vma->vm_flags & VM_SHARED))); > 2470 set_huge_pte_at(mm, haddr, ptep, new_pte); 2471 > 2472 hugetlb_count_add(pages_per_huge_page(h), mm); 2473 2474 spin_unlock(ptl); 2475 2476 if (new_page) { 2477 SetPagePrivate(&page[1]); 2478 } 2479 2480 unlock_page(page); 2481 out: 2482 return ret; 2483 2484 backout: 2485 spin_unlock(ptl); 2486 unlock_page(page); 2487 put_page(page); 2488 goto out; 2489 } 2490 EXPORT_SYMBOL(sharepool_no_page); 2491 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 14416/30000] drivers/gpu/drm/loongson/lsdc_output.c:379:63: sparse: sparse: incorrect type in argument 2 (different address spaces)
by kernel test robot 28 Sep '24

28 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 80764bc784413eb604c7d472db55b1ca72d4bbc5 [14416/30000] drm/loongson: add kernel modesetting driver support for ls7a1000/ls7a2000 config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240928/202409281002.dDRqb1Lc-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240928/202409281002.dDRqb1Lc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409281002.dDRqb1Lc-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/gpu/drm/loongson/lsdc_output.c:379:63: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void *reg_base @@ got void [noderef] __iomem *reg_base @@ drivers/gpu/drm/loongson/lsdc_output.c:379:63: sparse: expected void *reg_base drivers/gpu/drm/loongson/lsdc_output.c:379:63: sparse: got void [noderef] __iomem *reg_base vim +379 drivers/gpu/drm/loongson/lsdc_output.c 338 339 /* No DT support, provide a minimal support */ 340 int lsdc_create_output(struct lsdc_device *ldev, 341 unsigned int index, 342 unsigned int num_crtc) 343 { 344 const struct lsdc_chip_desc * const descp = ldev->desc; 345 struct lsdc_display_pipe * const dispipe = &ldev->dispipe[index]; 346 struct drm_device *ddev = ldev->ddev; 347 int encoder_type = DRM_MODE_ENCODER_DPI; 348 int connector_type = DRM_MODE_CONNECTOR_DPI; 349 struct lsdc_output *output; 350 struct drm_encoder *encoder; 351 struct drm_connector *connector; 352 int ret; 353 354 output = devm_kzalloc(ddev->dev, sizeof(*output), GFP_KERNEL); 355 if (!output) 356 return -ENOMEM; 357 358 encoder = &output->encoder; 359 360 if (descp->chip == LSDC_CHIP_7A2000) { 361 encoder_type = DRM_MODE_ENCODER_TMDS; 362 connector_type = DRM_MODE_CONNECTOR_HDMIA; 363 } 364 365 ret = drm_encoder_init(ddev, encoder, &lsdc_encoder_funcs, 366 encoder_type, "encoder-%u", index); 367 368 if (ret) { 369 drm_err(ddev, "Failed to init encoder: %d\n", ret); 370 return ret; 371 } 372 373 if (descp->chip == LSDC_CHIP_7A2000) 374 drm_encoder_helper_add(encoder, &ls7a2000_hdmi_encoder_helper_funcs); 375 376 encoder->possible_crtcs = BIT(index); 377 378 if (descp->has_builtin_i2c) { > 379 output->li2c = lsdc_create_i2c_chan(ddev, ldev->reg_base, index); -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 15479/30000] kernel/sched/topology.c:1618:9: error: implicit declaration of function 'register_sysctl_init'; did you mean 'register_sysctl'?
by kernel test robot 28 Sep '24

28 Sep '24

Hi Tim, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 8ce3e706b31409147f035c037055caa68e450ce5 [15479/30000] scheduler: Add runtime knob sysctl_sched_cluster config: arm64-randconfig-002-20240928 (https://download.01.org/0day-ci/archive/20240928/202409281008.YCpsDSF7-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409281008.YCpsDSF7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409281008.YCpsDSF7-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/sched/topology.c: In function 'sched_cluster_sysctl_init': >> kernel/sched/topology.c:1618:9: error: implicit declaration of function 'register_sysctl_init'; did you mean 'register_sysctl'? [-Werror=implicit-function-declaration] 1618 | register_sysctl_init("kernel", sched_cluster_sysctls); | ^~~~~~~~~~~~~~~~~~~~ | register_sysctl cc1: some warnings being treated as errors vim +1618 kernel/sched/topology.c 1615 1616 static int __init sched_cluster_sysctl_init(void) 1617 { > 1618 register_sysctl_init("kernel", sched_cluster_sysctls); 1619 return 0; 1620 } 1621 late_initcall(sched_cluster_sysctl_init); 1622 #endif 1623 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 4701/30000] arch/arm64/mm/pmem_reserve.c:13:13: warning: no previous prototype for 'setup_reserve_pmem'
by kernel test robot 28 Sep '24

28 Sep '24

Hi Zhuling, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: db4cd75bc674e6f473c0a7303b1744155352882c [4701/30000] arm64: register persistent memory via protected memory config: arm64-randconfig-004-20240928 (https://download.01.org/0day-ci/archive/20240928/202409280935.BxmRiHdQ-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409280935.BxmRiHdQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280935.BxmRiHdQ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/arm64/mm/pmem_reserve.c:13:13: warning: no previous prototype for 'setup_reserve_pmem' [-Wmissing-prototypes] 13 | void __init setup_reserve_pmem(u64 start, u64 size) | ^~~~~~~~~~~~~~~~~~ >> arch/arm64/mm/pmem_reserve.c:25:13: warning: no previous prototype for 'request_pmem_res_resource' [-Wmissing-prototypes] 25 | void __init request_pmem_res_resource(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/mm/pmem_reserve.c:40:13: warning: no previous prototype for 'reserve_pmem' [-Wmissing-prototypes] 40 | void __init reserve_pmem(void) | ^~~~~~~~~~~~ vim +/setup_reserve_pmem +13 arch/arm64/mm/pmem_reserve.c 12 > 13 void __init setup_reserve_pmem(u64 start, u64 size) 14 { 15 if (pmem_res_cnt >= MAX_REGIONS) { 16 pr_err("protected memory regions above upper limit %d\n", MAX_REGIONS); 17 return; 18 } 19 20 pmem_res[pmem_res_cnt].start = start; 21 pmem_res[pmem_res_cnt].end = start + size - 1; 22 pmem_res_cnt++; 23 } 24 > 25 void __init request_pmem_res_resource(void) 26 { 27 struct resource *res; 28 int i; 29 30 for (i = 0; i < pmem_res_cnt; i++) { 31 res = &pmem_res[i]; 32 res->name = "Persistent Memory (legacy)"; 33 res->flags = IORESOURCE_MEM; 34 res->desc = IORES_DESC_PERSISTENT_MEMORY_LEGACY; 35 if (res->start && res->end) 36 request_resource(&iomem_resource, res); 37 } 38 } 39 > 40 void __init reserve_pmem(void) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 13850/23799] arch/arm64/mm/init.c:784:17: error: 'mem_sleep_current' undeclared
by kernel test robot 28 Sep '24

28 Sep '24

Hi Ding, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: fdda68feeca82610ccbcdcbda7250623a6d187d2 [13850/23799] arm64/ascend: Set mem_sleep_current to PM_SUSPEND_ON for ascend platform config: arm64-randconfig-002-20240928 (https://download.01.org/0day-ci/archive/20240928/202409280825.5UMBIt9A-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409280825.5UMBIt9A-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280825.5UMBIt9A-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/mm/init.c:469:13: warning: no previous prototype for 'arm64_memblock_init' [-Wmissing-prototypes] 469 | void __init arm64_memblock_init(void) | ^~~~~~~~~~~~~~~~~~~ arch/arm64/mm/init.c: In function 'ascend_enable_setup': >> arch/arm64/mm/init.c:784:17: error: 'mem_sleep_current' undeclared (first use in this function) 784 | mem_sleep_current = PM_SUSPEND_ON; | ^~~~~~~~~~~~~~~~~ arch/arm64/mm/init.c:784:17: note: each undeclared identifier is reported only once for each function it appears in vim +/mem_sleep_current +784 arch/arm64/mm/init.c 770 771 #ifdef CONFIG_ASCEND_FEATURES 772 static int __init ascend_enable_setup(char *__unused) 773 { 774 if (IS_ENABLED(CONFIG_ASCEND_DVPP_MMAP)) 775 enable_mmap_dvpp = 1; 776 777 if (IS_ENABLED(CONFIG_ASCEND_IOPF_HIPRI)) 778 enable_iopf_hipri = 1; 779 780 if (IS_ENABLED(CONFIG_ASCEND_CHARGE_MIGRATE_HUGEPAGES)) 781 enable_charge_mighp = 1; 782 783 if (IS_ENABLED(CONFIG_SUSPEND)) > 784 mem_sleep_current = PM_SUSPEND_ON; 785 786 return 1; 787 } 788 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 18183/23799] mm/share_pool.c:1542:21: error: implicit declaration of function 'huge_ptep_get'
by kernel test robot 28 Sep '24

28 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: 4a280fac30d27ae2aff096f9f99aa12d50f83426 [18183/23799] ascend: share_pool: support share pool features for ascend platform config: arm64-randconfig-003-20240928 (https://download.01.org/0day-ci/archive/20240928/202409280759.ueQXB2WQ-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409280759.ueQXB2WQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280759.ueQXB2WQ-lkp@intel.com/ All error/warnings (new ones prefixed by >>): mm/share_pool.c: In function 'sp_hugetlb_entry': >> mm/share_pool.c:1542:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 1542 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ >> mm/share_pool.c:1542:21: error: invalid initializer mm/share_pool.c: In function 'sp_alloc_pages': >> mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage >> mm/share_pool.c:2263:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:2263:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:2266:1: warning: control reaches end of non-void function [-Wreturn-type] 2266 | } | ^ mm/share_pool.c: At top level: >> mm/share_pool.c:2235:12: warning: 'spa_stat_show' defined but not used [-Wunused-function] 2235 | static int spa_stat_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~ >> mm/share_pool.c:2121:12: warning: 'proc_stat_show' defined but not used [-Wunused-function] 2121 | static int proc_stat_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/huge_ptep_get +1542 mm/share_pool.c 1537 1538 static int sp_hugetlb_entry(pte_t *ptep, unsigned long hmask, 1539 unsigned long addr, unsigned long next, 1540 struct mm_walk *walk) 1541 { > 1542 pte_t pte = huge_ptep_get(ptep); 1543 struct page *page = pte_page(pte); 1544 struct sp_walk_data *sp_walk_data; 1545 1546 if (unlikely(!pte_present(pte))) { 1547 if (printk_ratelimit()) 1548 pr_err("share pool: the page of addr %pK unexpectedly not in RAM\n", (void *)addr); 1549 return -EFAULT; 1550 } 1551 1552 sp_walk_data = walk->private; 1553 get_page(page); 1554 sp_walk_data->pages[sp_walk_data->page_count++] = page; 1555 return 0; 1556 } 1557 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 13190/30000] drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c:385:58: sparse: sparse: incorrect type in argument 2 (different base types)
by kernel test robot 28 Sep '24

28 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 29ecb19fc3e567091641824b91a6019cc1eb8154 [13190/30000] net: hns3: add queue bonding mode support for VF config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240928/202409280619.HevoAR3n-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240928/202409280619.HevoAR3n-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280619.HevoAR3n-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c:385:58: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected unsigned short [usertype] qb_state @@ got restricted __le16 [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c:385:58: sparse: expected unsigned short [usertype] qb_state drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c:385:58: sparse: got restricted __le16 [usertype] vim +385 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c 305 306 void hclgevf_mbx_async_handler(struct hclgevf_dev *hdev) 307 { 308 struct hclge_mbx_port_base_vlan *vlan_info; 309 struct hclge_mbx_link_status *link_info; 310 struct hclge_mbx_link_mode *link_mode; 311 enum hnae3_reset_type reset_type; 312 u16 link_status, state; 313 __le16 *msg_q; 314 u16 opcode; 315 u8 duplex; 316 u32 speed; 317 u32 tail; 318 u8 flag; 319 u16 idx; 320 321 tail = hdev->arq.tail; 322 323 /* process all the async queue messages */ 324 while (tail != hdev->arq.head) { 325 if (test_bit(HCLGE_COMM_STATE_CMD_DISABLE, 326 &hdev->hw.hw.comm_state)) { 327 dev_info(&hdev->pdev->dev, 328 "vf crq need init in async\n"); 329 return; 330 } 331 332 msg_q = hdev->arq.msg_q[hdev->arq.head]; 333 opcode = le16_to_cpu(msg_q[0]); 334 switch (opcode) { 335 case HCLGE_MBX_LINK_STAT_CHANGE: 336 link_info = (struct hclge_mbx_link_status *)(msg_q + 1); 337 link_status = le16_to_cpu(link_info->link_status); 338 speed = le32_to_cpu(link_info->speed); 339 duplex = (u8)le16_to_cpu(link_info->duplex); 340 flag = link_info->flag; 341 342 /* update upper layer with new link link status */ 343 hclgevf_update_speed_duplex(hdev, speed, duplex); 344 hclgevf_update_link_status(hdev, link_status); 345 346 if (flag & HCLGE_MBX_PUSH_LINK_STATUS_EN) 347 set_bit(HCLGEVF_STATE_PF_PUSH_LINK_STATUS, 348 &hdev->state); 349 350 break; 351 case HCLGE_MBX_LINK_STAT_MODE: 352 link_mode = (struct hclge_mbx_link_mode *)(msg_q + 1); 353 idx = le16_to_cpu(link_mode->idx); 354 if (idx) 355 hdev->hw.mac.supported = 356 le64_to_cpu(link_mode->link_mode); 357 else 358 hdev->hw.mac.advertising = 359 le64_to_cpu(link_mode->link_mode); 360 break; 361 case HCLGE_MBX_ASSERTING_RESET: 362 /* PF has asserted reset hence VF should go in pending 363 * state and poll for the hardware reset status till it 364 * has been completely reset. After this stack should 365 * eventually be re-initialized. 366 */ 367 reset_type = 368 (enum hnae3_reset_type)le16_to_cpu(msg_q[1]); 369 set_bit(reset_type, &hdev->reset_pending); 370 set_bit(HCLGEVF_RESET_PENDING, &hdev->reset_state); 371 hclgevf_reset_task_schedule(hdev); 372 373 break; 374 case HCLGE_MBX_PUSH_VLAN_INFO: 375 vlan_info = 376 (struct hclge_mbx_port_base_vlan *)(msg_q + 1); 377 state = le16_to_cpu(vlan_info->state); 378 hclgevf_update_port_base_vlan_info(hdev, state, 379 vlan_info); 380 break; 381 case HCLGE_MBX_PUSH_PROMISC_INFO: 382 hclgevf_parse_promisc_info(hdev, le16_to_cpu(msg_q[1])); 383 break; 384 case HCLGE_MBX_PUSH_QB_STATE: > 385 hclgevf_parse_qb_info(hdev, msg_q[1]); -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION bef6f06e039b8929481350d15d6d8c3ba81c6fd2
by kernel test robot 28 Sep '24

28 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 !11896 [sync] PR-11831: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202409271902.PwZin66T-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409280106.13pCWH1k-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409280444.fQT7iGoe-lkp@intel.com arch/x86/kernel/paravirt.c:65:36: error: 'CALL_INSN_OPCODE' undeclared (first use in this function) arch/x86/kernel/paravirt.c:65:9: error: implicit declaration of function '__text_gen_insn' [-Werror=implicit-function-declaration] arch/x86/kernel/paravirt.c:66:47: error: 'CALL_INSN_SIZE' undeclared (first use in this function) arch/x86/kernel/paravirt.c:68:1: warning: control reaches end of non-void function [-Wreturn-type] drivers/tty/tty_buffer.c:177:9: error: implicit declaration of function 'printk_safe_exit'; did you mean 'printk_nmi_exit'? [-Werror=implicit-function-declaration] mm/pin_mem.c:246:31: error: 'HUGETLB_PAGE_DTOR' undeclared (first use in this function); did you mean 'HUGETLB_PAGE_ORDER'? Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-002-20240928 | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- arch-arm64-mm-quick_kexec.c:warning:no-previous-prototype-for-request_quick_kexec_res | |-- arch-arm64-mm-quick_kexec.c:warning:no-previous-prototype-for-reserve_quick_kexec | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | |-- drivers-misc-sdma-dae-sdma_dbg.c:warning:variable-exclusive_chn_num-set-but-not-used | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit | |-- mm-hugetlb.c:warning:no-previous-prototype-for-hugetlb_alloc_hugepage_nodemask | `-- mm-memcontrol.c:error:implicit-declaration-of-function-ksm_process_profit |-- arm64-randconfig-004-20240928 | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- arch-arm64-mm-pmem_reserve.c:warning:no-previous-prototype-for-request_pmem_res_resource | |-- arch-arm64-mm-pmem_reserve.c:warning:no-previous-prototype-for-reserve_pmem | |-- arch-arm64-mm-pmem_reserve.c:warning:no-previous-prototype-for-setup_reserve_pmem | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_rearm_jfc | |-- drivers-ub-urma-ubcore-ubcore_main.c:warning:no-previous-prototype-for-ubcore_open | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-ctx-not-described-in-ubcore_update_uvs_eid_ret | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-dev-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-req-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-ubcore_get_mtu | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_release | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit | `-- mm-pin_mem.c:error:HUGETLB_PAGE_DTOR-undeclared-(first-use-in-this-function) |-- arm64-randconfig-r131-20240925 | |-- drivers-hwtracing-coresight-coresight-core.c:sparse:sparse:symbol-__pcpu_scope_csdev_sink-was-not-declared.-Should-it-be-static | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_main.c:sparse:sparse:restricted-__be32-degrades-to-integer | `-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_main.c:sparse:sparse:restricted-__le32-degrades-to-integer |-- x86_64-allnoconfig | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | |-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-function-mcp251xfd_tx_obj_write_sync | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_mbx_set_vf_multi_tc | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_tm_vf_tc_dwrr_cfg | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:variable-err-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-direction-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-queue-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-direction-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-queue-description-in-rnpvf_set_ring_vector | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_CTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-ctx-not-described-in-ubcore_update_uvs_eid_ret | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-dev-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-req-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-function-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-function-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TPG-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-function-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-function-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_UTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-function-ubcore_hash_table_rmv_vtpn | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_get_umap_ops | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_umap_priv_init | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_unmap_vma_pages | |-- ld.lld:error:duplicate-symbol:g_uld_mutex | |-- ld.lld:error:duplicate-symbol:lld_dev_hold | `-- ld.lld:error:duplicate-symbol:lld_dev_put |-- x86_64-buildonly-randconfig-001-20240928 | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20240928 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | `-- arch-x86-kernel-paravirt.c:warning:control-reaches-end-of-non-void-function |-- x86_64-buildonly-randconfig-003-20240928 | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-buildonly-randconfig-004-20240928 | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-buildonly-randconfig-006-20240928 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | `-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn |-- x86_64-kexec | |-- arch-x86-kvm-vmx-vmx.o:warning:objtool:fix_rmode_seg:unreachable-instruction | `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target |-- x86_64-randconfig-161-20240927 | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:copy_highpages_root_table-proc_handler | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:copy_highpages_table-proc_handler | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:copy_highpages_root_table-procname | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:copy_highpages_table-procname | |-- fs-btrfs-extent-tree.c-btrfs_lookup_extent_info()-error:we-previously-assumed-trans-could-be-null-(see-line-) | |-- fs-cifs-file.c-cifs_write_from_iter()-error:uninitialized-symbol-pagevec-. | `-- fs-xfs-xfs_icache.c-xfs_icwalk_tag()-warn:unsigned-goal-is-never-less-than-zero. |-- x86_64-rhel-8.3 | `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target |-- x86_64-rhel-8.3-func | `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target |-- x86_64-rhel-8.3-kselftests | `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target `-- x86_64-rhel-8.3-rust `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target elapsed time: 742m configs tested: 23 configs skipped: 128 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240928 gcc-14.1.0 arm64 randconfig-002-20240928 gcc-14.1.0 arm64 randconfig-003-20240928 clang-20 arm64 randconfig-004-20240928 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240928 clang-18 x86_64 buildonly-randconfig-002-20240928 gcc-12 x86_64 buildonly-randconfig-003-20240928 gcc-12 x86_64 buildonly-randconfig-004-20240928 gcc-12 x86_64 buildonly-randconfig-005-20240928 clang-18 x86_64 buildonly-randconfig-006-20240928 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20240928 clang-18 x86_64 randconfig-002-20240928 gcc-12 x86_64 randconfig-003-20240928 clang-18 x86_64 randconfig-004-20240928 gcc-12 x86_64 randconfig-005-20240928 clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 3841d75a6dcd12d108aaf56560b99431d18169e4
by kernel test robot 28 Sep '24

28 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 3841d75a6dcd12d108aaf56560b99431d18169e4 !11842 CVE-2024-46771 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202409271931.90b1jljj-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409280233.aF2FycBU-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409280341.XkIGO1R8-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409280354.ixZVRGmb-lkp@intel.com drivers/crypto/hisilicon/qm.c:2726: warning: Excess function parameter 'ce' description in 'qm_hw_error_init' drivers/crypto/hisilicon/qm.c:2726: warning: Excess function parameter 'fe' description in 'qm_hw_error_init' drivers/crypto/hisilicon/qm.c:2726: warning: Excess function parameter 'msi' description in 'qm_hw_error_init' drivers/crypto/hisilicon/qm.c:2726: warning: Excess function parameter 'nfe' description in 'qm_hw_error_init' drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:159:10: error: incompatible pointer to integer conversion returning 'void *' from a function with result type 'int' [-Wint-conversion] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | `-- include-linux-thread_info.h:warning:b-may-be-used-uninitialized |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-001-20240928 | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:expected-before-ptrval | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-002-20240928 | |-- arch-arm64-mm-init.c:error:mem_sleep_current-undeclared-(first-use-in-this-function) | |-- arch-arm64-mm-init.c:error:pmu_nmi_enable-undeclared-(first-use-in-this-function) | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-ce-description-in-qm_hw_error_init | |-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-fe-description-in-qm_hw_error_init | |-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-msi-description-in-qm_hw_error_init | |-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-nfe-description-in-qm_hw_error_init | `-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount |-- arm64-randconfig-003-20240928 | |-- arch-arm64-mm-init.c:error:mem_sleep_current-undeclared-(first-use-in-this-function) | |-- arch-arm64-mm-init.c:error:pmu_nmi_enable-undeclared-(first-use-in-this-function) | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | `-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount |-- arm64-randconfig-004-20240928 | |-- arch-arm64-mm-init.c:error:mem_sleep_current-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-allnoconfig | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | `-- drivers-net-ethernet-stmicro-stmmac-dwmac-phytium.c:error:incompatible-pointer-to-integer-conversion-returning-void-from-a-function-with-result-type-int |-- x86_64-buildonly-randconfig-001-20240926 | |-- drivers-hwtracing-intel_th-msu-sink.o:warning:objtool:missing-symbol-for-section-.init.text | `-- drivers-powercap-intel_rapl_common.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20240928 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20240928 | `-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount |-- x86_64-kexec | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-161-20240928 `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration elapsed time: 732m configs tested: 15 configs skipped: 126 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240928 gcc-14.1.0 arm64 randconfig-002-20240928 gcc-14.1.0 arm64 randconfig-003-20240928 gcc-14.1.0 arm64 randconfig-004-20240928 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240928 clang-18 x86_64 buildonly-randconfig-002-20240928 gcc-12 x86_64 buildonly-randconfig-004-20240928 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2413/14216] mm/mem_reliable.c:345:2: error: call to undeclared function 'mem_reliable_ctrl_bit_disable'; ISO C99 and later do not support implicit function declarations
by kernel test robot 28 Sep '24

28 Sep '24

Hi Ma, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c9fe32fed709da98069e8215f6ecf39ea63f5355 commit: 425771499c0742a996ab28df143d7a5123102686 [2413/14216] mm: mem_reliable: Introduce proc interface to disable memory reliable features config: arm64-randconfig-003-20240928 (https://download.01.org/0day-ci/archive/20240928/202409280502.YvJdfMQd-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 7773243d9916f98ba0ffce0c3a960e4aa9f03e81) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409280502.YvJdfMQd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280502.YvJdfMQd-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from mm/mem_reliable.c:5: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> mm/mem_reliable.c:345:2: error: call to undeclared function 'mem_reliable_ctrl_bit_disable'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 345 | mem_reliable_ctrl_bit_disable(idx); | ^ mm/mem_reliable.c:345:2: note: did you mean 'mem_reliable_ctrl_bit_disabled'? mm/mem_reliable.c:320:13: note: 'mem_reliable_ctrl_bit_disabled' declared here 320 | static void mem_reliable_ctrl_bit_disabled(int idx) {} | ^ mm/mem_reliable.c:376:45: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 376 | num += global_node_page_state(NR_LRU_BASE + LRU_ACTIVE_FILE); | ~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~ mm/mem_reliable.c:377:45: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 377 | num += global_node_page_state(NR_LRU_BASE + LRU_INACTIVE_FILE); | ~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~ 7 warnings and 1 error generated. vim +/mem_reliable_ctrl_bit_disable +345 mm/mem_reliable.c 322 323 static void mem_reliable_feature_disable(int idx) 324 { 325 char *str = NULL; 326 327 switch (idx) { 328 case MEM_RELIABLE_FALLBACK: 329 reliable_allow_fallback = false; 330 str = "fallback"; 331 break; 332 case MEM_RELIABLE_SHMEM: 333 shmem_reliable = false; 334 str = "shmem"; 335 break; 336 case MEM_RELIABLE_PAGECACHE: 337 pagecache_reliable = false; 338 str = "pagecache"; 339 break; 340 default: 341 pr_err("unknown index: %d", idx); 342 return; 343 } 344 > 345 mem_reliable_ctrl_bit_disable(idx); 346 pr_info("%s is disabled\n", str); 347 } 348 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION c9fe32fed709da98069e8215f6ecf39ea63f5355
by kernel test robot 28 Sep '24

28 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: c9fe32fed709da98069e8215f6ecf39ea63f5355 !11844 fix CVE-2024-46771 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202409280347.fIsKo3PM-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409280502.YvJdfMQd-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409280518.YiZdECth-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409280536.wLGz5QQ3-lkp@intel.com arch/loongarch/kvm/exit.c:764:63: error: 'struct sched_info' has no member named 'run_delay' include/linux/psp-hygon.h:257:1: error: conflicting types for 'vpsp_try_do_cmd'; have 'int(int, phys_addr_t, struct vpsp_ret *)' {aka 'int(int, long long unsigned int, struct vpsp_ret *)'} mm/mem_reliable.c:345:2: error: call to undeclared function 'mem_reliable_ctrl_bit_disable'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] mm/memcontrol.c:3147:6: warning: no previous prototype for 'hisi_oom_recover' [-Wmissing-prototypes] mm/share_pool.c:2584:14: error: call to undeclared function 'huge_ptep_get'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] mm/share_pool.c:2584:8: error: initializing 'pte_t' with an expression of incompatible type 'int' mm/share_pool.c:3285:12: warning: 'proc_group_usage_show' defined but not used [-Wunused-function] mm/share_pool.c:3305:12: warning: 'proc_usage_show' defined but not used [-Wunused-function] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:no-previous-prototype-for-function-virtcca_smmu_gerror_handler |-- arm64-randconfig-002-20240928 | |-- mm-memcontrol.c:warning:no-previous-prototype-for-hisi_oom_recover | |-- mm-share_pool.c:warning:proc_group_usage_show-defined-but-not-used | `-- mm-share_pool.c:warning:proc_usage_show-defined-but-not-used |-- arm64-randconfig-003-20240928 | |-- mm-mem_reliable.c:error:call-to-undeclared-function-mem_reliable_ctrl_bit_disable-ISO-C99-and-later-do-not-support-implicit-function-declarations | |-- mm-page_alloc.c:error:call-to-undeclared-function-dynamic_pool_should_alloc-ISO-C99-and-later-do-not-support-implicit-function-declarations | |-- mm-share_pool.c:error:call-to-undeclared-function-huge_ptep_get-ISO-C99-and-later-do-not-support-implicit-function-declarations | `-- mm-share_pool.c:error:initializing-pte_t-with-an-expression-of-incompatible-type-int |-- loongarch-allmodconfig | `-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance |-- loongarch-randconfig-001-20240928 | |-- arch-loongarch-kvm-exit.c:error:struct-sched_info-has-no-member-named-run_delay | `-- arch-loongarch-kvm-vcpu.c:error:struct-sched_info-has-no-member-named-run_delay |-- x86_64-allyesconfig | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-buildonly-randconfig-004-20240928 | |-- drivers-crypto-ccp-hygon-hct.c:error:struct-device-has-no-member-named-numa_node | `-- include-linux-psp-hygon.h:error:conflicting-types-for-vpsp_try_do_cmd-have-int(int-phys_addr_t-struct-vpsp_ret-)-aka-int(int-long-long-unsigned-int-struct-vpsp_ret-) |-- x86_64-randconfig-006-20240928 | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-hct.c:error:struct-device-has-no-member-named-numa_node | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3 | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-func | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-kselftests | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst `-- x86_64-rhel-8.3-rust |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst elapsed time: 731m configs tested: 33 configs skipped: 121 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240928 gcc-14.1.0 arm64 randconfig-002-20240928 gcc-14.1.0 arm64 randconfig-003-20240928 clang-20 arm64 randconfig-004-20240928 gcc-14.1.0 loongarch alldefconfig gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240928 gcc-14.1.0 loongarch randconfig-002-20240928 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240928 clang-18 x86_64 buildonly-randconfig-002-20240928 gcc-12 x86_64 buildonly-randconfig-003-20240928 gcc-12 x86_64 buildonly-randconfig-004-20240928 gcc-12 x86_64 buildonly-randconfig-005-20240928 clang-18 x86_64 buildonly-randconfig-006-20240928 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20240928 clang-18 x86_64 randconfig-002-20240928 gcc-12 x86_64 randconfig-003-20240928 clang-18 x86_64 randconfig-004-20240928 gcc-12 x86_64 randconfig-005-20240928 clang-18 x86_64 randconfig-006-20240928 gcc-11 x86_64 randconfig-011-20240928 gcc-12 x86_64 randconfig-012-20240928 gcc-12 x86_64 randconfig-013-20240928 gcc-12 x86_64 randconfig-014-20240928 clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13560/14216] include/linux/psp-hygon.h:257:1: error: conflicting types for 'vpsp_try_do_cmd'; have 'int(int, phys_addr_t, struct vpsp_ret *)' {aka 'int(int, long long unsigned int, struct vpsp_ret *)'}
by kernel test robot 28 Sep '24

28 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c9fe32fed709da98069e8215f6ecf39ea63f5355 commit: 3ce4cb81ef2b148f6c830c7debb4405e26cded1c [13560/14216] drivers/crypto/ccp: support TKM run on CSV config: x86_64-buildonly-randconfig-004-20240928 (https://download.01.org/0day-ci/archive/20240928/202409280518.YiZdECth-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409280518.YiZdECth-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280518.YiZdECth-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from arch/x86/kvm/svm/svm.c:25: >> include/linux/psp-hygon.h:257:1: error: conflicting types for 'vpsp_try_do_cmd'; have 'int(int, phys_addr_t, struct vpsp_ret *)' {aka 'int(int, long long unsigned int, struct vpsp_ret *)'} 257 | vpsp_try_do_cmd(int cmd, phys_addr_t phy_addr, | ^~~~~~~~~~~~~~~ include/linux/psp-hygon.h:253:1: note: previous definition of 'vpsp_try_do_cmd' with type 'int(uint32_t, int, void *, struct vpsp_ret *)' {aka 'int(unsigned int, int, void *, struct vpsp_ret *)'} 253 | vpsp_try_do_cmd(uint32_t vid, int cmd, | ^~~~~~~~~~~~~~~ include/linux/psp-hygon.h:285:5: warning: no previous prototype for 'psp_register_cmd_notifier' [-Wmissing-prototypes] 285 | int psp_register_cmd_notifier(uint32_t cmd_id, p2c_notifier_t notifier) { return -ENODEV; } | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/psp-hygon.h:286:5: warning: no previous prototype for 'psp_unregister_cmd_notifier' [-Wmissing-prototypes] 286 | int psp_unregister_cmd_notifier(uint32_t cmd_id, p2c_notifier_t notifier) { return -ENODEV; } | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +257 include/linux/psp-hygon.h 247 248 static inline int 249 vpsp_try_get_result(uint8_t prio, 250 uint32_t index, phys_addr_t phy_addr, struct vpsp_ret *psp_ret) { return -ENODEV; } 251 252 static inline int 253 vpsp_try_do_cmd(uint32_t vid, int cmd, 254 void *data, struct vpsp_ret *psp_ret) { return -ENODEV; } 255 256 static inline int > 257 vpsp_try_do_cmd(int cmd, phys_addr_t phy_addr, 258 struct vpsp_ret *psp_ret) { return -ENODEV; } 259 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1683/14216] mm/memcontrol.c:3147:6: warning: no previous prototype for 'hisi_oom_recover'
by kernel test robot 28 Sep '24

28 Sep '24

Hi Weilong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c9fe32fed709da98069e8215f6ecf39ea63f5355 commit: b498d9f1bacd40d583c0970cab02ad522127a7e7 [1683/14216] arm64/ascend: Add new enable_oom_killer interface for oom contrl config: arm64-randconfig-002-20240928 (https://download.01.org/0day-ci/archive/20240928/202409280536.wLGz5QQ3-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409280536.wLGz5QQ3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280536.wLGz5QQ3-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/memcontrol.c:3147:6: warning: no previous prototype for 'hisi_oom_recover' [-Wmissing-prototypes] 3147 | void hisi_oom_recover(struct obj_cgroup *objcg) | ^~~~~~~~~~~~~~~~ vim +/hisi_oom_recover +3147 mm/memcontrol.c 3145 3146 #ifdef CONFIG_ASCEND_OOM > 3147 void hisi_oom_recover(struct obj_cgroup *objcg) 3148 { 3149 struct mem_cgroup *memcg; 3150 3151 memcg = get_mem_cgroup_from_objcg(objcg); 3152 if (!mem_cgroup_is_root(memcg)) 3153 memcg_oom_recover(memcg); 3154 css_put(&memcg->css); 3155 } 3156 #else 3157 static inline void hisi_oom_recover(struct obj_cgroup *objcg) { } 3158 #endif 3159 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2613/30000] drivers/tty/tty_buffer.c:177:9: error: implicit declaration of function 'printk_safe_exit'; did you mean 'printk_nmi_exit'?
by kernel test robot 28 Sep '24

28 Sep '24

Hi Hongbo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 923efc4dc37c1a7cc91f0dd5dbdc87e0943ad1ae [2613/30000] tty: fix possible deadlock in console_unlock config: arm64-randconfig-002-20240928 (https://download.01.org/0day-ci/archive/20240928/202409280444.fQT7iGoe-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409280444.fQT7iGoe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280444.fQT7iGoe-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/tty/tty_buffer.c: In function 'tty_buffer_alloc': drivers/tty/tty_buffer.c:175:9: error: implicit declaration of function 'printk_safe_enter'; did you mean 'printk_nmi_enter'? [-Werror=implicit-function-declaration] 175 | printk_safe_enter(); | ^~~~~~~~~~~~~~~~~ | printk_nmi_enter >> drivers/tty/tty_buffer.c:177:9: error: implicit declaration of function 'printk_safe_exit'; did you mean 'printk_nmi_exit'? [-Werror=implicit-function-declaration] 177 | printk_safe_exit(); | ^~~~~~~~~~~~~~~~ | printk_nmi_exit cc1: some warnings being treated as errors vim +177 drivers/tty/tty_buffer.c 142 143 /** 144 * tty_buffer_alloc - allocate a tty buffer 145 * @port: tty port 146 * @size: desired size (characters) 147 * 148 * Allocate a new tty buffer to hold the desired number of characters. 149 * We round our buffers off in 256 character chunks to get better 150 * allocation behaviour. 151 * Return NULL if out of memory or the allocation would exceed the 152 * per device queue 153 */ 154 155 static struct tty_buffer *tty_buffer_alloc(struct tty_port *port, size_t size) 156 { 157 struct llist_node *free; 158 struct tty_buffer *p; 159 160 /* Round the buffer size out */ 161 size = __ALIGN_MASK(size, TTYB_ALIGN_MASK); 162 163 if (size <= MIN_TTYB_SIZE) { 164 free = llist_del_first(&port->buf.free); 165 if (free) { 166 p = llist_entry(free, struct tty_buffer, free); 167 goto found; 168 } 169 } 170 171 /* Should possibly check if this fails for the largest buffer we 172 have queued and recycle that ? */ 173 if (atomic_read(&port->buf.mem_used) > port->buf.mem_limit) 174 return NULL; 175 printk_safe_enter(); 176 p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC); > 177 printk_safe_exit(); 178 if (p == NULL) 179 return NULL; 180 181 found: 182 tty_buffer_reset(p, size); 183 atomic_add(size, &port->buf.mem_used); 184 return p; 185 } 186 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 13192/23799] drivers/crypto/hisilicon/qm.c:2726: warning: Excess function parameter 'ce' description in 'qm_hw_error_init'
by kernel test robot 28 Sep '24

28 Sep '24

Hi Yu'an, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: 73d33f5c59dc3824444baca6a458427f4de3d8fa [13192/23799] qm: Move all the same logic functions of hisilicon crypto to qm config: arm64-randconfig-002-20240928 (https://download.01.org/0day-ci/archive/20240928/202409280341.XkIGO1R8-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409280341.XkIGO1R8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280341.XkIGO1R8-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/hisilicon/qm.c:2726: warning: Excess function parameter 'ce' description in 'qm_hw_error_init' >> drivers/crypto/hisilicon/qm.c:2726: warning: Excess function parameter 'nfe' description in 'qm_hw_error_init' >> drivers/crypto/hisilicon/qm.c:2726: warning: Excess function parameter 'fe' description in 'qm_hw_error_init' >> drivers/crypto/hisilicon/qm.c:2726: warning: Excess function parameter 'msi' description in 'qm_hw_error_init' vim +2726 drivers/crypto/hisilicon/qm.c ae67d23af736c7 xuzaibo 2019-04-21 2706 ae67d23af736c7 xuzaibo 2019-04-21 2707 /** 73d33f5c59dc38 Yu'an Wang 2020-04-16 2708 * qm_hw_error_init() - Configure qm hardware error report method. ae67d23af736c7 xuzaibo 2019-04-21 2709 * @qm: The qm which we want to configure. ae67d23af736c7 xuzaibo 2019-04-21 2710 * @ce: Correctable error configure. ae67d23af736c7 xuzaibo 2019-04-21 2711 * @nfe: Non-fatal error configure. ae67d23af736c7 xuzaibo 2019-04-21 2712 * @fe: Fatal error configure. ae67d23af736c7 xuzaibo 2019-04-21 2713 * @msi: Error reported by message signal interrupt. ae67d23af736c7 xuzaibo 2019-04-21 2714 * ae67d23af736c7 xuzaibo 2019-04-21 2715 * Hardware errors of qm can be reported either by RAS interrupts which will ae67d23af736c7 xuzaibo 2019-04-21 2716 * be handled by UEFI and then PCIe AER or by device MSI. User can configure ae67d23af736c7 xuzaibo 2019-04-21 2717 * each error to use either of above two methods. For RAS interrupts, we can ae67d23af736c7 xuzaibo 2019-04-21 2718 * configure an error as one of correctable error, non-fatal error or ae67d23af736c7 xuzaibo 2019-04-21 2719 * fatal error. ae67d23af736c7 xuzaibo 2019-04-21 2720 * ae67d23af736c7 xuzaibo 2019-04-21 2721 * Bits indicating errors can be configured to ce, nfe, fe and msi to enable ae67d23af736c7 xuzaibo 2019-04-21 2722 * related report methods. Error report will be masked if related error bit ae67d23af736c7 xuzaibo 2019-04-21 2723 * does not configure. ae67d23af736c7 xuzaibo 2019-04-21 2724 */ 73d33f5c59dc38 Yu'an Wang 2020-04-16 2725 static void qm_hw_error_init(struct hisi_qm *qm) ae67d23af736c7 xuzaibo 2019-04-21 @2726 { 73d33f5c59dc38 Yu'an Wang 2020-04-16 2727 u32 nfe = qm->err_ini.err_info.nfe; 73d33f5c59dc38 Yu'an Wang 2020-04-16 2728 u32 msi = qm->err_ini.err_info.msi; 73d33f5c59dc38 Yu'an Wang 2020-04-16 2729 u32 ce = qm->err_ini.err_info.ce; 73d33f5c59dc38 Yu'an Wang 2020-04-16 2730 u32 fe = qm->err_ini.err_info.fe; 73d33f5c59dc38 Yu'an Wang 2020-04-16 2731 ae67d23af736c7 xuzaibo 2019-04-21 2732 if (!qm->ops->hw_error_init) { ae67d23af736c7 xuzaibo 2019-04-21 2733 dev_err(&qm->pdev->dev, ae67d23af736c7 xuzaibo 2019-04-21 2734 "QM version %d doesn't support hw error handling!\n", ae67d23af736c7 xuzaibo 2019-04-21 2735 qm->ver); ae67d23af736c7 xuzaibo 2019-04-21 2736 return; ae67d23af736c7 xuzaibo 2019-04-21 2737 } ae67d23af736c7 xuzaibo 2019-04-21 2738 efe221f95003ac Zhou Wang 2019-07-11 2739 qm->ops->hw_error_init(qm, ce, nfe, fe, msi); ae67d23af736c7 xuzaibo 2019-04-21 2740 } ae67d23af736c7 xuzaibo 2019-04-21 2741 :::::: The code at line 2726 was first introduced by commit :::::: ae67d23af736c75f90795297fddb86dc97e7b3c7 arm64: Add hisilicon Crypto drivers qm/hpre/zip and code format :::::: TO: xuzaibo <xuzaibo(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1369/14216] mm/share_pool.c:3305:12: warning: 'proc_usage_show' defined but not used
by kernel test robot 28 Sep '24

28 Sep '24

Hi Wang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c9fe32fed709da98069e8215f6ecf39ea63f5355 commit: df165ba49e6e4ce8b4f6076aded3b92e19918b03 [1369/14216] mm/sharepool: Add proc interfaces to show sp info config: arm64-randconfig-002-20240928 (https://download.01.org/0day-ci/archive/20240928/202409280347.fIsKo3PM-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409280347.fIsKo3PM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280347.fIsKo3PM-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/share_pool.c: In function 'sp_unshare_kva': mm/share_pool.c:2796:14: warning: variable 'is_hugepage' set but not used [-Wunused-but-set-variable] 2796 | bool is_hugepage = true; | ^~~~~~~~~~~ mm/share_pool.c: At top level: >> mm/share_pool.c:3305:12: warning: 'proc_usage_show' defined but not used [-Wunused-function] 3305 | static int proc_usage_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~~~ >> mm/share_pool.c:3285:12: warning: 'proc_group_usage_show' defined but not used [-Wunused-function] 3285 | static int proc_group_usage_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~~~~~~~~~ mm/share_pool.c:3234:12: warning: 'spa_stat_show' defined but not used [-Wunused-function] 3234 | static int spa_stat_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~ vim +/proc_usage_show +3305 mm/share_pool.c 3284 > 3285 static int proc_group_usage_show(struct seq_file *seq, void *offset) 3286 { 3287 if (!should_show_statistics()) 3288 return -EPERM; 3289 3290 spg_overview_show(seq); 3291 spa_overview_show(seq); 3292 3293 /* print the file header */ 3294 seq_printf(seq, "%-8s %-8s %-9s %-9s %-9s %-8s %-7s %-7s %-4s\n", 3295 "PID", "Group_ID", "SP_ALLOC", "SP_K2U", "SP_RES", 3296 "VIRT", "RES", "Shm", "PROT"); 3297 3298 down_read(&sp_global_sem); 3299 idr_for_each(&sp_group_idr, proc_usage_by_group, seq); 3300 up_read(&sp_global_sem); 3301 3302 return 0; 3303 } 3304 > 3305 static int proc_usage_show(struct seq_file *seq, void *offset) 3306 { 3307 struct sp_group_master *master = NULL; 3308 unsigned long anon, file, shmem, total_rss; 3309 long sp_res, sp_res_nsize, non_sp_res, non_sp_shm; 3310 struct sp_meminfo *meminfo; 3311 3312 if (!should_show_statistics()) 3313 return -EPERM; 3314 3315 seq_printf(seq, "%-8s %-16s %-9s %-9s %-9s %-10s %-10s %-8s\n", 3316 "PID", "COMM", "SP_ALLOC", "SP_K2U", "SP_RES", "Non-SP_RES", 3317 "Non-SP_Shm", "VIRT"); 3318 3319 down_read(&sp_global_sem); 3320 mutex_lock(&master_list_lock); 3321 list_for_each_entry(master, &master_list, list_node) { 3322 meminfo = &master->meminfo; 3323 get_mm_rss_info(master->mm, &anon, &file, &shmem, &total_rss); 3324 get_process_sp_res(master, &sp_res, &sp_res_nsize); 3325 get_process_non_sp_res(total_rss, shmem, sp_res_nsize, 3326 &non_sp_res, &non_sp_shm); 3327 seq_printf(seq, "%-8d %-16s %-9ld %-9ld %-9ld %-10ld %-10ld %-8ld\n", 3328 master->tgid, master->comm, 3329 meminfo_alloc_sum_byKB(meminfo), 3330 meminfo_k2u_size(meminfo), 3331 sp_res, non_sp_res, non_sp_shm, 3332 page2kb(master->mm->total_vm)); 3333 } 3334 mutex_unlock(&master_list_lock); 3335 up_read(&sp_global_sem); 3336 3337 return 0; 3338 } 3339 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21354/23799] drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:159:10: error: incompatible pointer to integer conversion returning 'void *' from a function with result type 'int'
by kernel test robot 28 Sep '24

28 Sep '24

Hi wangzhimin, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: af48889301db8235deab66a8822e3e00195ca14b [21354/23799] dwmac:add phytium dwmac driver config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240928/202409280354.ixZVRGmb-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409280354.ixZVRGmb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280354.ixZVRGmb-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:159:10: error: incompatible pointer to integer conversion returning 'void *' from a function with result type 'int' [-Wint-conversion] 159 | return stmmac_res.addr; | ^~~~~~~~~~~~~~~ drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:172:5: warning: no previous prototype for function 'phytium_dwmac_remove' [-Wmissing-prototypes] 172 | int phytium_dwmac_remove(struct platform_device *pdev) | ^ drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:172:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 172 | int phytium_dwmac_remove(struct platform_device *pdev) | ^ | static 1 warning and 1 error generated. vim +159 drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c 32 33 static int phytium_dwmac_probe(struct platform_device *pdev) 34 { 35 struct fwnode_handle *fwnode = dev_fwnode(&pdev->dev); 36 struct plat_stmmacenet_data *plat; 37 struct stmmac_resources stmmac_res; 38 struct device_node *np = pdev->dev.of_node; 39 struct resource *res; 40 u64 clk_freq; 41 char clk_name[20]; 42 int ret; 43 44 plat = devm_kzalloc(&pdev->dev, sizeof(*plat), GFP_KERNEL); 45 if (!plat) 46 return -ENOMEM; 47 48 plat->dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*plat->dma_cfg), 49 GFP_KERNEL); 50 if (!plat->dma_cfg) 51 return -ENOMEM; 52 53 plat->axi = devm_kzalloc(&pdev->dev, sizeof(*plat->axi), GFP_KERNEL); 54 if (!plat->axi) 55 return -ENOMEM; 56 57 plat->interface = device_get_phy_mode(&pdev->dev); 58 if (plat->interface < 0) 59 return plat->interface; 60 61 /* Configure PHY if using device-tree */ 62 if (pdev->dev.of_node) 63 plat->phy_node = of_parse_phandle(np, "phy-handle", 0); 64 65 if (pdev->dev.of_node) { 66 plat->bus_id = of_alias_get_id(np, "ethernet"); 67 if (plat->bus_id < 0) 68 plat->bus_id = 0; 69 } else if (fwnode_property_read_u32(fwnode, "bus_id", &plat->bus_id)) { 70 plat->bus_id = 2; 71 } 72 73 plat->phy_addr = -1; 74 plat->clk_csr = -1; 75 plat->has_gmac = 1; 76 plat->enh_desc = 1; 77 plat->bugged_jumbo = 1; 78 plat->pmt = 1; 79 plat->force_sf_dma_mode = 1; 80 81 if (fwnode_property_read_u32(fwnode, "max-speed", &plat->max_speed)) 82 plat->max_speed = -1; 83 84 if (fwnode_property_read_u32(fwnode, "max-frame-size", &plat->maxmtu)) 85 plat->maxmtu = JUMBO_LEN; 86 87 if (fwnode_property_read_u32(fwnode, "snps,multicast-filter-bins", 88 &plat->multicast_filter_bins)) 89 plat->multicast_filter_bins = HASH_TABLE_SIZE; 90 91 if (fwnode_property_read_u32(fwnode, "snps,perfect-filter-entries", 92 &plat->unicast_filter_entries)) 93 plat->unicast_filter_entries = 1; 94 95 if (fwnode_property_read_u32(fwnode, "tx-fifo-depth", 96 &plat->tx_fifo_size)) 97 plat->tx_fifo_size = 0x1000; 98 99 if (fwnode_property_read_u32(fwnode, "rx-fifo-depth", 100 &plat->rx_fifo_size)) 101 plat->rx_fifo_size = 0x1000; 102 103 if (phytium_dwmac_acpi_phy(plat, fwnode, &pdev->dev)) 104 return -ENODEV; 105 106 plat->rx_queues_to_use = 1; 107 plat->tx_queues_to_use = 1; 108 plat->rx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB; 109 plat->tx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB; 110 111 if (fwnode_property_read_u64(fwnode, "clock-frequency", &clk_freq)) 112 clk_freq = 125000000; 113 114 /* Set system clock */ 115 snprintf(clk_name, sizeof(clk_name), "%s-%d", "stmmaceth", 116 plat->bus_id); 117 118 plat->stmmac_clk = clk_register_fixed_rate(&pdev->dev, clk_name, 119 NULL, 0, clk_freq); 120 if (IS_ERR(plat->stmmac_clk)) { 121 dev_warn(&pdev->dev, "Fail to register stmmac-clk\n"); 122 plat->stmmac_clk = NULL; 123 } 124 125 ret = clk_prepare_enable(plat->stmmac_clk); 126 if (ret) { 127 clk_unregister_fixed_rate(plat->stmmac_clk); 128 return ret; 129 } 130 131 plat->clk_ptp_rate = clk_get_rate(plat->stmmac_clk); 132 plat->clk_ptp_ref = NULL; 133 134 if (fwnode_property_read_u32(fwnode, "snps,pbl", &plat->dma_cfg->pbl)) 135 plat->dma_cfg->pbl = 16; 136 137 fwnode_property_read_u32(fwnode, "snps,txpbl", &plat->dma_cfg->txpbl); 138 fwnode_property_read_u32(fwnode, "snps,rxpbl", &plat->dma_cfg->rxpbl); 139 140 plat->dma_cfg->pblx8 = !fwnode_property_read_bool(fwnode, 141 "snps,no-pbl-x8"); 142 plat->dma_cfg->aal = fwnode_property_read_bool(fwnode, "snps,aal"); 143 plat->dma_cfg->fixed_burst = fwnode_property_read_bool(fwnode, 144 "snps,fixed-burst"); 145 plat->dma_cfg->mixed_burst = fwnode_property_read_bool(fwnode, 146 "snps,mixed-burst"); 147 148 plat->axi->axi_lpi_en = false; 149 plat->axi->axi_xit_frm = false; 150 plat->axi->axi_wr_osr_lmt = 7; 151 plat->axi->axi_rd_osr_lmt = 7; 152 plat->axi->axi_blen[0] = 16; 153 154 memset(&stmmac_res, 0, sizeof(stmmac_res)); 155 res = platform_get_resource(pdev, IORESOURCE_MEM, 0); 156 stmmac_res.addr = devm_ioremap_resource(&pdev->dev, res); 157 if (stmmac_res.addr < 0) { 158 dev_err(&pdev->dev, "resource map failed.\n"); > 159 return stmmac_res.addr; 160 } 161 stmmac_res.irq = platform_get_irq(pdev, 0); 162 if (stmmac_res.irq < 0) { 163 dev_err(&pdev->dev, "IRQ not found.\n"); 164 return -ENXIO; 165 } 166 stmmac_res.wol_irq = stmmac_res.irq; 167 stmmac_res.lpi_irq = -1; 168 169 return stmmac_dvr_probe(&pdev->dev, plat, &stmmac_res); 170 } 171 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17967/23799] drivers/hwtracing/intel_th/msu-sink.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 28 Sep '24

28 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: 4d516770f81434cde260d33430626e3880b9902e [17967/23799] intel_th: msu-sink: An example msu buffer "sink" config: x86_64-buildonly-randconfig-001-20240926 (https://download.01.org/0day-ci/archive/20240928/202409280233.aF2FycBU-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409280233.aF2FycBU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280233.aF2FycBU-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/hwtracing/intel_th/msu-sink.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 13031/30000] drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5671:37: sparse: sparse: restricted __le32 degrades to integer
by kernel test robot 28 Sep '24

28 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 7b05030bb7ada6099be6aee436250b07e96a3901 [13031/30000] net: hns3: support set/get VxLAN rule of rx flow director by ethtool config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240928/202409280106.13pCWH1k-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240928/202409280106.13pCWH1k-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280106.13pCWH1k-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5671:37: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5672:37: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5906:17: sparse: sparse: restricted __be32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:6000:17: sparse: sparse: restricted __be32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5252:31: sparse: sparse: context imbalance in 'hclge_sync_fd_user_def_cfg' - unexpected unlock drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:12259:23: sparse: sparse: memset with byte count of 131072 vim +5671 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c 5613 5614 int offset, moffset, ip_offset; 5615 enum HCLGE_FD_KEY_OPT key_opt; 5616 u16 tmp_x_s, tmp_y_s; 5617 u32 tmp_x_l, tmp_y_l; 5618 u8 *p = (u8 *)rule; 5619 int i; 5620 5621 if (rule->unused_tuple & BIT(tuple_bit)) 5622 return true; 5623 5624 key_opt = tuple_key_info[tuple_bit].key_opt; 5625 offset = tuple_key_info[tuple_bit].offset; 5626 moffset = tuple_key_info[tuple_bit].moffset; 5627 5628 switch (key_opt) { 5629 case KEY_OPT_U8: 5630 calc_x(*key_x, p[offset], p[moffset]); 5631 calc_y(*key_y, p[offset], p[moffset]); 5632 5633 return true; 5634 case KEY_OPT_LE16: 5635 calc_x(tmp_x_s, *(u16 *)(&p[offset]), *(u16 *)(&p[moffset])); 5636 calc_y(tmp_y_s, *(u16 *)(&p[offset]), *(u16 *)(&p[moffset])); 5637 *(__le16 *)key_x = cpu_to_le16(tmp_x_s); 5638 *(__le16 *)key_y = cpu_to_le16(tmp_y_s); 5639 5640 return true; 5641 case KEY_OPT_LE32: 5642 calc_x(tmp_x_l, *(u32 *)(&p[offset]), *(u32 *)(&p[moffset])); 5643 calc_y(tmp_y_l, *(u32 *)(&p[offset]), *(u32 *)(&p[moffset])); 5644 *(__le32 *)key_x = cpu_to_le32(tmp_x_l); 5645 *(__le32 *)key_y = cpu_to_le32(tmp_y_l); 5646 5647 return true; 5648 case KEY_OPT_MAC: 5649 for (i = 0; i < ETH_ALEN; i++) { 5650 calc_x(key_x[ETH_ALEN - 1 - i], p[offset + i], 5651 p[moffset + i]); 5652 calc_y(key_y[ETH_ALEN - 1 - i], p[offset + i], 5653 p[moffset + i]); 5654 } 5655 5656 return true; 5657 case KEY_OPT_IP: 5658 ip_offset = IPV4_INDEX * sizeof(u32); 5659 calc_x(tmp_x_l, *(u32 *)(&p[offset + ip_offset]), 5660 *(u32 *)(&p[moffset + ip_offset])); 5661 calc_y(tmp_y_l, *(u32 *)(&p[offset + ip_offset]), 5662 *(u32 *)(&p[moffset + ip_offset])); 5663 *(__le32 *)key_x = cpu_to_le32(tmp_x_l); 5664 *(__le32 *)key_y = cpu_to_le32(tmp_y_l); 5665 5666 return true; 5667 case KEY_OPT_VNI: 5668 calc_x(tmp_x_l, *(u32 *)(&p[offset]), *(u32 *)(&p[moffset])); 5669 calc_y(tmp_y_l, *(u32 *)(&p[offset]), *(u32 *)(&p[moffset])); 5670 for (i = 0; i < HCLGE_VNI_LENGTH; i++) { > 5671 key_x[i] = (cpu_to_le32(tmp_x_l) >> (i * BITS_PER_BYTE)) & 0xFF; 5672 key_y[i] = (cpu_to_le32(tmp_y_l) >> (i * BITS_PER_BYTE)) & 0xFF; 5673 } 5674 return true; 5675 default: 5676 return false; 5677 } 5678 } 5679 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17809/23796] drivers/powercap/intel_rapl_common.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 27 Sep '24

27 Sep '24

Hi Zhang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: 74c448a8b8ad8801c117e98ccd0e399413c063bb [17809/23796] Intel: intel_rapl: Fix module autoloading issue config: x86_64-buildonly-randconfig-001-20240926 (https://download.01.org/0day-ci/archive/20240927/202409271931.90b1jljj-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409271931.90b1jljj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271931.90b1jljj-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/powercap/intel_rapl_common.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 12771/30000] drivers/hwtracing/coresight/coresight-core.c:26:1: sparse: sparse: symbol '__pcpu_scope_csdev_sink' was not declared. Should it be static?
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 078577fd8d76863149a3e8c7588ed0b457a095e9 [12771/30000] coresight: core: Add support for dedicated percpu sinks config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240927/202409271902.PwZin66T-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240927/202409271902.PwZin66T-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271902.PwZin66T-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/hwtracing/coresight/coresight-core.c:26:1: sparse: sparse: symbol '__pcpu_scope_csdev_sink' was not declared. Should it be static? vim +/__pcpu_scope_csdev_sink +26 drivers/hwtracing/coresight/coresight-core.c 24 25 static DEFINE_MUTEX(coresight_mutex); > 26 DEFINE_PER_CPU(struct coresight_device *, csdev_sink); 27 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/4] Merge some hns RoCE patches from the mainline to OLK-6.6
by Chengchang Tang 27 Sep '24

27 Sep '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Merge some hns RoCE patches from the mainline to OLK-6.6 Xinghai Cen (2): Revert "RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()" Revert "RDMA/hns: Fix Use-After-Free of rsv_qp" wenglianfa (2): RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08 RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() -- 2.33.0

2 5

[PATCH OLK-5.10 0/5] Some bug fix patches for OLK-5.10 hns RoCE
by Chengchang Tang 27 Sep '24

27 Sep '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some bug fix patches for OLK-5.10 hns RoCE Junxian Huang (1): RDMA/hns: Fix ah error counter in sw stat not increasing Xinghai Cen (1): Revert "RDMA/hns: Fix ah error counter in sw stat not increasing when sl is invalid" wenglianfa (3): RDMA/hns: Fix the inconsistency between input max_send_sge and output max_send_sge RDMA/hns: Use one CQ bank per context for HIP09 RDMA/hns: Fix RoCEE hang when multiple QP banks use EXT_SGE drivers/infiniband/hw/hns/hns_roce_ah.c | 6 ++- drivers/infiniband/hw/hns/hns_roce_cq.c | 21 ++++++--- drivers/infiniband/hw/hns/hns_roce_device.h | 7 +++ drivers/infiniband/hw/hns/hns_roce_main.c | 5 +++ drivers/infiniband/hw/hns/hns_roce_qp.c | 50 ++++++++++++++++----- 5 files changed, 69 insertions(+), 20 deletions(-) -- 2.33.0

2 6

[PATCH OLK-6.6] hwmon: (hp-wmi-sensors) Check if WMI event data exists
by Zhao Wenhui 27 Sep '24

27 Sep '24

From: Armin Wolf <W_Armin(a)gmx.de> stable inclusion from stable-v6.6.51 commit 217539e994e53206bbf3fb330261cc78c480d311 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWCY CVE: CVE-2024-46768 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a54da9df75cd1b4b5028f6c60f9a211532680585 ] The BIOS can choose to return no event data in response to a WMI event, so the ACPI object passed to the WMI notify handler can be NULL. Check for such a situation and ignore the event in such a case. Fixes: 23902f98f8d4 ("hwmon: add HP WMI Sensors driver") Signed-off-by: Armin Wolf <W_Armin(a)gmx.de> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Message-ID: <20240901031055.3030-2-W_Armin(a)gmx.de> Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/hwmon/hp-wmi-sensors.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/hwmon/hp-wmi-sensors.c b/drivers/hwmon/hp-wmi-sensors.c index b5325d0e72b9..dfa1d6926dea 100644 --- a/drivers/hwmon/hp-wmi-sensors.c +++ b/drivers/hwmon/hp-wmi-sensors.c @@ -1637,6 +1637,8 @@ static void hp_wmi_notify(u32 value, void *context) goto out_unlock; wobj = out.pointer; + if (!wobj) + goto out_unlock; err = populate_event_from_wobj(dev, &event, wobj); if (err) { -- 2.34.1

2 1

[PATCH OLK-6.6] nilfs2: protect references to superblock parameters exposed in sysfs
by Zhao Wenhui 27 Sep '24

27 Sep '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v6.6.51 commit 8c6e43b3d5f109cf9c61bc188fcc8175404e924f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYCR CVE: CVE-2024-46780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 683408258917541bdb294cd717c210a04381931e upstream. The superblock buffers of nilfs2 can not only be overwritten at runtime for modifications/repairs, but they are also regularly swapped, replaced during resizing, and even abandoned when degrading to one side due to backing device issues. So, accessing them requires mutual exclusion using the reader/writer semaphore "nilfs->ns_sem". Some sysfs attribute show methods read this superblock buffer without the necessary mutual exclusion, which can cause problems with pointer dereferencing and memory access, so fix it. Link: https://lkml.kernel.org/r/20240811100320.9913-1-konishi.ryusuke@gmail.com Fixes: da7141fb78db ("nilfs2: add /sys/fs/nilfs2/<device> group") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- fs/nilfs2/sysfs.c | 43 +++++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 10 deletions(-) diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c index 379d22e28ed6..905c7eadf967 100644 --- a/fs/nilfs2/sysfs.c +++ b/fs/nilfs2/sysfs.c @@ -836,9 +836,15 @@ ssize_t nilfs_dev_revision_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; - u32 major = le32_to_cpu(sbp[0]->s_rev_level); - u16 minor = le16_to_cpu(sbp[0]->s_minor_rev_level); + struct nilfs_super_block *raw_sb; + u32 major; + u16 minor; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + major = le32_to_cpu(raw_sb->s_rev_level); + minor = le16_to_cpu(raw_sb->s_minor_rev_level); + up_read(&nilfs->ns_sem); return sysfs_emit(buf, "%d.%d\n", major, minor); } @@ -856,8 +862,13 @@ ssize_t nilfs_dev_device_size_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; - u64 dev_size = le64_to_cpu(sbp[0]->s_dev_size); + struct nilfs_super_block *raw_sb; + u64 dev_size; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + dev_size = le64_to_cpu(raw_sb->s_dev_size); + up_read(&nilfs->ns_sem); return sysfs_emit(buf, "%llu\n", dev_size); } @@ -879,9 +890,15 @@ ssize_t nilfs_dev_uuid_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct nilfs_super_block *raw_sb; + ssize_t len; - return sysfs_emit(buf, "%pUb\n", sbp[0]->s_uuid); + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + len = sysfs_emit(buf, "%pUb\n", raw_sb->s_uuid); + up_read(&nilfs->ns_sem); + + return len; } static @@ -889,10 +906,16 @@ ssize_t nilfs_dev_volume_name_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct nilfs_super_block *raw_sb; + ssize_t len; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + len = scnprintf(buf, sizeof(raw_sb->s_volume_name), "%s\n", + raw_sb->s_volume_name); + up_read(&nilfs->ns_sem); - return scnprintf(buf, sizeof(sbp[0]->s_volume_name), "%s\n", - sbp[0]->s_volume_name); + return len; } static const char dev_readme_str[] = -- 2.34.1

2 1

[PATCH OLK-5.10] nilfs2: protect references to superblock parameters exposed in sysfs
by Zhao Wenhui 27 Sep '24

27 Sep '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.226 commit 157c0d94b4c40887329418c70ef4edd1a8d6b4ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYCR CVE: CVE-2024-46780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 683408258917541bdb294cd717c210a04381931e ] The superblock buffers of nilfs2 can not only be overwritten at runtime for modifications/repairs, but they are also regularly swapped, replaced during resizing, and even abandoned when degrading to one side due to backing device issues. So, accessing them requires mutual exclusion using the reader/writer semaphore "nilfs->ns_sem". Some sysfs attribute show methods read this superblock buffer without the necessary mutual exclusion, which can cause problems with pointer dereferencing and memory access, so fix it. Link: https://lkml.kernel.org/r/20240811100320.9913-1-konishi.ryusuke@gmail.com Fixes: da7141fb78db ("nilfs2: add /sys/fs/nilfs2/<device> group") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/nilfs2/sysfs.c [3bcd6c5bd483287f4a09d3d59a012d47677b6edc not merged.] Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- fs/nilfs2/sysfs.c | 43 +++++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 10 deletions(-) diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c index 57afd06db62d..fc1c10a4ee45 100644 --- a/fs/nilfs2/sysfs.c +++ b/fs/nilfs2/sysfs.c @@ -843,9 +843,15 @@ ssize_t nilfs_dev_revision_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; - u32 major = le32_to_cpu(sbp[0]->s_rev_level); - u16 minor = le16_to_cpu(sbp[0]->s_minor_rev_level); + struct nilfs_super_block *raw_sb; + u32 major; + u16 minor; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + major = le32_to_cpu(raw_sb->s_rev_level); + minor = le16_to_cpu(raw_sb->s_minor_rev_level); + up_read(&nilfs->ns_sem); return snprintf(buf, PAGE_SIZE, "%d.%d\n", major, minor); } @@ -863,8 +869,13 @@ ssize_t nilfs_dev_device_size_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; - u64 dev_size = le64_to_cpu(sbp[0]->s_dev_size); + struct nilfs_super_block *raw_sb; + u64 dev_size; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + dev_size = le64_to_cpu(raw_sb->s_dev_size); + up_read(&nilfs->ns_sem); return snprintf(buf, PAGE_SIZE, "%llu\n", dev_size); } @@ -886,9 +897,15 @@ ssize_t nilfs_dev_uuid_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct nilfs_super_block *raw_sb; + ssize_t len; - return snprintf(buf, PAGE_SIZE, "%pUb\n", sbp[0]->s_uuid); + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + len = snprintf(buf, PAGE_SIZE, "%pUb\n", raw_sb->s_uuid); + up_read(&nilfs->ns_sem); + + return len; } static @@ -896,10 +913,16 @@ ssize_t nilfs_dev_volume_name_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct nilfs_super_block *raw_sb; + ssize_t len; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + len = scnprintf(buf, sizeof(raw_sb->s_volume_name), "%s\n", + raw_sb->s_volume_name); + up_read(&nilfs->ns_sem); - return scnprintf(buf, sizeof(sbp[0]->s_volume_name), "%s\n", - sbp[0]->s_volume_name); + return len; } static const char dev_readme_str[] = -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] nilfs2: protect references to superblock parameters exposed in sysfs
by Zhao Wenhui 27 Sep '24

27 Sep '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v4.19.322 commit b90beafac05931cbfcb6b1bd4f67c1923f47040e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYCR CVE: CVE-2024-46780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 683408258917541bdb294cd717c210a04381931e ] The superblock buffers of nilfs2 can not only be overwritten at runtime for modifications/repairs, but they are also regularly swapped, replaced during resizing, and even abandoned when degrading to one side due to backing device issues. So, accessing them requires mutual exclusion using the reader/writer semaphore "nilfs->ns_sem". Some sysfs attribute show methods read this superblock buffer without the necessary mutual exclusion, which can cause problems with pointer dereferencing and memory access, so fix it. Link: https://lkml.kernel.org/r/20240811100320.9913-1-konishi.ryusuke@gmail.com Fixes: da7141fb78db ("nilfs2: add /sys/fs/nilfs2/<device> group") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/nilfs2/sysfs.c [3bcd6c5bd483287f4a09d3d59a012d47677b6edc not merged.] Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- fs/nilfs2/sysfs.c | 43 +++++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 10 deletions(-) diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c index e60be7bb55b0..14349d3625fc 100644 --- a/fs/nilfs2/sysfs.c +++ b/fs/nilfs2/sysfs.c @@ -845,9 +845,15 @@ ssize_t nilfs_dev_revision_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; - u32 major = le32_to_cpu(sbp[0]->s_rev_level); - u16 minor = le16_to_cpu(sbp[0]->s_minor_rev_level); + struct nilfs_super_block *raw_sb; + u32 major; + u16 minor; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + major = le32_to_cpu(raw_sb->s_rev_level); + minor = le16_to_cpu(raw_sb->s_minor_rev_level); + up_read(&nilfs->ns_sem); return snprintf(buf, PAGE_SIZE, "%d.%d\n", major, minor); } @@ -865,8 +871,13 @@ ssize_t nilfs_dev_device_size_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; - u64 dev_size = le64_to_cpu(sbp[0]->s_dev_size); + struct nilfs_super_block *raw_sb; + u64 dev_size; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + dev_size = le64_to_cpu(raw_sb->s_dev_size); + up_read(&nilfs->ns_sem); return snprintf(buf, PAGE_SIZE, "%llu\n", dev_size); } @@ -888,9 +899,15 @@ ssize_t nilfs_dev_uuid_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct nilfs_super_block *raw_sb; + ssize_t len; - return snprintf(buf, PAGE_SIZE, "%pUb\n", sbp[0]->s_uuid); + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + len = snprintf(buf, PAGE_SIZE, "%pUb\n", raw_sb->s_uuid); + up_read(&nilfs->ns_sem); + + return len; } static @@ -898,10 +915,16 @@ ssize_t nilfs_dev_volume_name_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct nilfs_super_block *raw_sb; + ssize_t len; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + len = scnprintf(buf, sizeof(raw_sb->s_volume_name), "%s\n", + raw_sb->s_volume_name); + up_read(&nilfs->ns_sem); - return scnprintf(buf, sizeof(sbp[0]->s_volume_name), "%s\n", - sbp[0]->s_volume_name); + return len; } static const char dev_readme_str[] = -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] hwmon: (lm95234) Fix underflows seen when writing limit attributes
by Xiongfeng Wang 27 Sep '24

27 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> mainline inclusion from mainline-v6.11-rc1 commit af64e3e1537896337405f880c1e9ac1f8c0c6198 category: bugfix bugzilla: hhttps://gitee.com/src-openeuler/kernel/issues/IAS0PZ CVE: CVE-2024-46758 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/hwmon/lm95234.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/hwmon/lm95234.c b/drivers/hwmon/lm95234.c index ac169a994ae00..db2aecdfbd17c 100644 --- a/drivers/hwmon/lm95234.c +++ b/drivers/hwmon/lm95234.c @@ -301,7 +301,8 @@ static ssize_t tcrit2_store(struct device *dev, struct device_attribute *attr, if (ret < 0) return ret; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, index ? 255 : 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, (index ? 255 : 127) * 1000), + 1000); mutex_lock(&data->update_lock); data->tcrit2[index] = val; @@ -350,7 +351,7 @@ static ssize_t tcrit1_store(struct device *dev, struct device_attribute *attr, if (ret < 0) return ret; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 255); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 255000), 1000); mutex_lock(&data->update_lock); data->tcrit1[index] = val; @@ -391,7 +392,7 @@ static ssize_t tcrit1_hyst_store(struct device *dev, if (ret < 0) return ret; - val = DIV_ROUND_CLOSEST(val, 1000); + val = DIV_ROUND_CLOSEST(clamp_val(val, -255000, 255000), 1000); val = clamp_val((int)data->tcrit1[index] - val, 0, 31); mutex_lock(&data->update_lock); @@ -431,7 +432,7 @@ static ssize_t offset_store(struct device *dev, struct device_attribute *attr, return ret; /* Accuracy is 1/2 degrees C */ - val = clamp_val(DIV_ROUND_CLOSEST(val, 500), -128, 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, -64000, 63500), 500); mutex_lock(&data->update_lock); data->toffset[index] = val; -- 2.20.1

2 1

[PATCH OLK-5.10] hwmon: (lm95234) Fix underflows seen when writing limit attributes
by Xiongfeng Wang 27 Sep '24

27 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> mainline inclusion from mainline-v6.11-rc1 commit af64e3e1537896337405f880c1e9ac1f8c0c6198 category: bugfix bugzilla: hhttps://gitee.com/src-openeuler/kernel/issues/IAS0PZ CVE: CVE-2024-46758 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/hwmon/lm95234.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/hwmon/lm95234.c b/drivers/hwmon/lm95234.c index ac169a994ae00..db2aecdfbd17c 100644 --- a/drivers/hwmon/lm95234.c +++ b/drivers/hwmon/lm95234.c @@ -301,7 +301,8 @@ static ssize_t tcrit2_store(struct device *dev, struct device_attribute *attr, if (ret < 0) return ret; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, index ? 255 : 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, (index ? 255 : 127) * 1000), + 1000); mutex_lock(&data->update_lock); data->tcrit2[index] = val; @@ -350,7 +351,7 @@ static ssize_t tcrit1_store(struct device *dev, struct device_attribute *attr, if (ret < 0) return ret; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 255); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 255000), 1000); mutex_lock(&data->update_lock); data->tcrit1[index] = val; @@ -391,7 +392,7 @@ static ssize_t tcrit1_hyst_store(struct device *dev, if (ret < 0) return ret; - val = DIV_ROUND_CLOSEST(val, 1000); + val = DIV_ROUND_CLOSEST(clamp_val(val, -255000, 255000), 1000); val = clamp_val((int)data->tcrit1[index] - val, 0, 31); mutex_lock(&data->update_lock); @@ -431,7 +432,7 @@ static ssize_t offset_store(struct device *dev, struct device_attribute *attr, return ret; /* Accuracy is 1/2 degrees C */ - val = clamp_val(DIV_ROUND_CLOSEST(val, 500), -128, 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, -64000, 63500), 500); mutex_lock(&data->update_lock); data->toffset[index] = val; -- 2.20.1

2 1

[PATCH openEuler-1.0-LTS] hwmon: (lm95234) Fix underflows seen when writing limit attributes
by Xiongfeng Wang 27 Sep '24

27 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> mainline inclusion from mainline-v6.11-rc1 commit af64e3e1537896337405f880c1e9ac1f8c0c6198 category: bugfix bugzilla: hhttps://gitee.com/src-openeuler/kernel/issues/IAS0PZ CVE: CVE-2024-46758 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/hwmon/lm95234.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/hwmon/lm95234.c b/drivers/hwmon/lm95234.c index c7fcc9e7f57a..13912ac7c69f 100644 --- a/drivers/hwmon/lm95234.c +++ b/drivers/hwmon/lm95234.c @@ -310,7 +310,8 @@ static ssize_t set_tcrit2(struct device *dev, struct device_attribute *attr, if (ret < 0) return ret; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, index ? 255 : 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, (index ? 255 : 127) * 1000), + 1000); mutex_lock(&data->update_lock); data->tcrit2[index] = val; @@ -359,7 +360,7 @@ static ssize_t set_tcrit1(struct device *dev, struct device_attribute *attr, if (ret < 0) return ret; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 255); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 255000), 1000); mutex_lock(&data->update_lock); data->tcrit1[index] = val; @@ -400,7 +401,7 @@ static ssize_t set_tcrit1_hyst(struct device *dev, if (ret < 0) return ret; - val = DIV_ROUND_CLOSEST(val, 1000); + val = DIV_ROUND_CLOSEST(clamp_val(val, -255000, 255000), 1000); val = clamp_val((int)data->tcrit1[index] - val, 0, 31); mutex_lock(&data->update_lock); @@ -440,7 +441,7 @@ static ssize_t set_offset(struct device *dev, struct device_attribute *attr, return ret; /* Accuracy is 1/2 degrees C */ - val = clamp_val(DIV_ROUND_CLOSEST(val, 500), -128, 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, -64000, 63500), 500); mutex_lock(&data->update_lock); data->toffset[index] = val; -- 2.20.1

2 1

[PATCH OLK-6.6] hwmon: (lm95234) Fix underflows seen when writing limit attributes
by Xiongfeng Wang 27 Sep '24

27 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> mainline inclusion from mainline-v6.11-rc1 commit af64e3e1537896337405f880c1e9ac1f8c0c6198 category: bugfix bugzilla: hhttps://gitee.com/src-openeuler/kernel/issues/IAS0PZ CVE: CVE-2024-46758 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/hwmon/lm95234.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/hwmon/lm95234.c b/drivers/hwmon/lm95234.c index 67b9d7636ee4..37e8e9679aeb 100644 --- a/drivers/hwmon/lm95234.c +++ b/drivers/hwmon/lm95234.c @@ -301,7 +301,8 @@ static ssize_t tcrit2_store(struct device *dev, struct device_attribute *attr, if (ret < 0) return ret; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, index ? 255 : 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, (index ? 255 : 127) * 1000), + 1000); mutex_lock(&data->update_lock); data->tcrit2[index] = val; @@ -350,7 +351,7 @@ static ssize_t tcrit1_store(struct device *dev, struct device_attribute *attr, if (ret < 0) return ret; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 255); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 255000), 1000); mutex_lock(&data->update_lock); data->tcrit1[index] = val; @@ -391,7 +392,7 @@ static ssize_t tcrit1_hyst_store(struct device *dev, if (ret < 0) return ret; - val = DIV_ROUND_CLOSEST(val, 1000); + val = DIV_ROUND_CLOSEST(clamp_val(val, -255000, 255000), 1000); val = clamp_val((int)data->tcrit1[index] - val, 0, 31); mutex_lock(&data->update_lock); @@ -431,7 +432,7 @@ static ssize_t offset_store(struct device *dev, struct device_attribute *attr, return ret; /* Accuracy is 1/2 degrees C */ - val = clamp_val(DIV_ROUND_CLOSEST(val, 500), -128, 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, -64000, 63500), 500); mutex_lock(&data->update_lock); data->toffset[index] = val; -- 2.20.1

2 1

[PATCH OLK-6.6] btrfs: fix race between direct IO write and fsync when using same fd
by Xiongfeng Wang 27 Sep '24

27 Sep '24

From: Filipe Manana <fdmanana(a)suse.com> stable inclusion from stable-v6.6.51 commit 7b5595f33c3c273613b590892a578d78186bb400 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1Z CVE: CVE-2024-46734 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit cd9253c23aedd61eb5ff11f37a36247cd46faf86 upstream. If we have 2 threads that are using the same file descriptor and one of them is doing direct IO writes while the other is doing fsync, we have a race where we can end up either: 1) Attempt a fsync without holding the inode's lock, triggering an assertion failures when assertions are enabled; 2) Do an invalid memory access from the fsync task because the file private points to memory allocated on stack by the direct IO task and it may be used by the fsync task after the stack was destroyed. The race happens like this: 1) A user space program opens a file descriptor with O_DIRECT; 2) The program spawns 2 threads using libpthread for example; 3) One of the threads uses the file descriptor to do direct IO writes, while the other calls fsync using the same file descriptor. 4) Call task A the thread doing direct IO writes and task B the thread doing fsyncs; 5) Task A does a direct IO write, and at btrfs_direct_write() sets the file's private to an on stack allocated private with the member 'fsync_skip_inode_lock' set to true; 6) Task B enters btrfs_sync_file() and sees that there's a private structure associated to the file which has 'fsync_skip_inode_lock' set to true, so it skips locking the inode's VFS lock; 7) Task A completes the direct IO write, and resets the file's private to NULL since it had no prior private and our private was stack allocated. Then it unlocks the inode's VFS lock; 8) Task B enters btrfs_get_ordered_extents_for_logging(), then the assertion that checks the inode's VFS lock is held fails, since task B never locked it and task A has already unlocked it. The stack trace produced is the following: assertion failed: inode_is_locked(&inode->vfs_inode), in fs/btrfs/ordered-data.c:983 ------------[ cut here ]------------ kernel BUG at fs/btrfs/ordered-data.c:983! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 9 PID: 5072 Comm: worker Tainted: G U OE 6.10.5-1-default #1 openSUSE Tumbleweed 69f48d427608e1c09e60ea24c6c55e2ca1b049e8 Hardware name: Acer Predator PH315-52/Covini_CFS, BIOS V1.12 07/28/2020 RIP: 0010:btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs] Code: 50 d6 86 c0 e8 (...) RSP: 0018:ffff9e4a03dcfc78 EFLAGS: 00010246 RAX: 0000000000000054 RBX: ffff9078a9868e98 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff907dce4a7800 RDI: ffff907dce4a7800 RBP: ffff907805518800 R08: 0000000000000000 R09: ffff9e4a03dcfb38 R10: ffff9e4a03dcfb30 R11: 0000000000000003 R12: ffff907684ae7800 R13: 0000000000000001 R14: ffff90774646b600 R15: 0000000000000000 FS: 00007f04b96006c0(0000) GS:ffff907dce480000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f32acbfc000 CR3: 00000001fd4fa005 CR4: 00000000003726f0 Call Trace: <TASK> ? __die_body.cold+0x14/0x24 ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x6a/0x90 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? exc_invalid_op+0x50/0x70 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? asm_exc_invalid_op+0x1a/0x20 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] btrfs_sync_file+0x21a/0x4d0 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? __seccomp_filter+0x31d/0x4f0 __x64_sys_fdatasync+0x4f/0x90 do_syscall_64+0x82/0x160 ? do_futex+0xcb/0x190 ? __x64_sys_futex+0x10e/0x1d0 ? switch_fpu_return+0x4f/0xd0 ? syscall_exit_to_user_mode+0x72/0x220 ? do_syscall_64+0x8e/0x160 ? syscall_exit_to_user_mode+0x72/0x220 ? do_syscall_64+0x8e/0x160 ? syscall_exit_to_user_mode+0x72/0x220 ? do_syscall_64+0x8e/0x160 ? syscall_exit_to_user_mode+0x72/0x220 ? do_syscall_64+0x8e/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e Another problem here is if task B grabs the private pointer and then uses it after task A has finished, since the private was allocated in the stack of task A, it results in some invalid memory access with a hard to predict result. This issue, triggering the assertion, was observed with QEMU workloads by two users in the Link tags below. Fix this by not relying on a file's private to pass information to fsync that it should skip locking the inode and instead pass this information through a special value stored in current->journal_info. This is safe because in the relevant section of the direct IO write path we are not holding a transaction handle, so current->journal_info is NULL. The following C program triggers the issue: $ cat repro.c /* Get the O_DIRECT definition. */ #ifndef _GNU_SOURCE #define _GNU_SOURCE #endif #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <stdint.h> #include <fcntl.h> #include <errno.h> #include <string.h> #include <pthread.h> static int fd; static ssize_t do_write(int fd, const void *buf, size_t count, off_t offset) { while (count > 0) { ssize_t ret; ret = pwrite(fd, buf, count, offset); if (ret < 0) { if (errno == EINTR) continue; return ret; } count -= ret; buf += ret; } return 0; } static void *fsync_loop(void *arg) { while (1) { int ret; ret = fsync(fd); if (ret != 0) { perror("Fsync failed"); exit(6); } } } int main(int argc, char *argv[]) { long pagesize; void *write_buf; pthread_t fsyncer; int ret; if (argc != 2) { fprintf(stderr, "Use: %s <file path>\n", argv[0]); return 1; } fd = open(argv[1], O_WRONLY | O_CREAT | O_TRUNC | O_DIRECT, 0666); if (fd == -1) { perror("Failed to open/create file"); return 1; } pagesize = sysconf(_SC_PAGE_SIZE); if (pagesize == -1) { perror("Failed to get page size"); return 2; } ret = posix_memalign(&write_buf, pagesize, pagesize); if (ret) { perror("Failed to allocate buffer"); return 3; } ret = pthread_create(&fsyncer, NULL, fsync_loop, NULL); if (ret != 0) { fprintf(stderr, "Failed to create writer thread: %d\n", ret); return 4; } while (1) { ret = do_write(fd, write_buf, pagesize, 0); if (ret != 0) { perror("Write failed"); exit(5); } } return 0; } $ mkfs.btrfs -f /dev/sdi $ mount /dev/sdi /mnt/sdi $ timeout 10 ./repro /mnt/sdi/foo Usually the race is triggered within less than 1 second. A test case for fstests will follow soon. Reported-by: Paulo Dias <paulo.miguel.dias(a)gmail.com> Link: https://bugzilla.kernel.org/show_bug.cgi?id=219187 Reported-by: Andreas Jahn <jahn-andi(a)web.de> Link: https://bugzilla.kernel.org/show_bug.cgi?id=219199 Reported-by: syzbot+4704b3cc972bd76024f1(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/00000000000044ff540620d7dee2@google.com/ Fixes: 939b656bc8ab ("btrfs: fix corruption after buffer fault in during direct IO append write") CC: stable(a)vger.kernel.org # 5.15+ Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- fs/btrfs/ctree.h | 1 - fs/btrfs/file.c | 25 ++++++++++--------------- fs/btrfs/transaction.h | 6 ++++++ 3 files changed, 16 insertions(+), 16 deletions(-) diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h index 86c7f8ce1715..06333a74d6c4 100644 --- a/fs/btrfs/ctree.h +++ b/fs/btrfs/ctree.h @@ -445,7 +445,6 @@ struct btrfs_file_private { void *filldir_buf; u64 last_index; struct extent_state *llseek_cached_state; - bool fsync_skip_inode_lock; }; static inline u32 BTRFS_LEAF_DATA_SIZE(const struct btrfs_fs_info *info) diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c index 952cf145c629..15fd8c00f4c0 100644 --- a/fs/btrfs/file.c +++ b/fs/btrfs/file.c @@ -1543,13 +1543,6 @@ static ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from) if (IS_ERR_OR_NULL(dio)) { err = PTR_ERR_OR_ZERO(dio); } else { - struct btrfs_file_private stack_private = { 0 }; - struct btrfs_file_private *private; - const bool have_private = (file->private_data != NULL); - - if (!have_private) - file->private_data = &stack_private; - /* * If we have a synchoronous write, we must make sure the fsync * triggered by the iomap_dio_complete() call below doesn't @@ -1558,13 +1551,10 @@ static ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from) * partial writes due to the input buffer (or parts of it) not * being already faulted in. */ - private = file->private_data; - private->fsync_skip_inode_lock = true; + ASSERT(current->journal_info == NULL); + current->journal_info = BTRFS_TRANS_DIO_WRITE_STUB; err = iomap_dio_complete(dio); - private->fsync_skip_inode_lock = false; - - if (!have_private) - file->private_data = NULL; + current->journal_info = NULL; } /* No increment (+=) because iomap returns a cumulative value. */ @@ -1796,7 +1786,6 @@ static inline bool skip_inode_logging(const struct btrfs_log_ctx *ctx) */ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) { - struct btrfs_file_private *private = file->private_data; struct dentry *dentry = file_dentry(file); struct inode *inode = d_inode(dentry); struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); @@ -1806,7 +1795,13 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) int ret = 0, err; u64 len; bool full_sync; - const bool skip_ilock = (private ? private->fsync_skip_inode_lock : false); + bool skip_ilock = false; + + if (current->journal_info == BTRFS_TRANS_DIO_WRITE_STUB) { + skip_ilock = true; + current->journal_info = NULL; + lockdep_assert_held(&inode->i_rwsem); + } trace_btrfs_sync_file(file, datasync); diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h index 238a0ab85df9..7623db359881 100644 --- a/fs/btrfs/transaction.h +++ b/fs/btrfs/transaction.h @@ -12,6 +12,12 @@ #include "ctree.h" #include "misc.h" +/* + * Signal that a direct IO write is in progress, to avoid deadlock for sync + * direct IO writes when fsync is called during the direct IO write path. + */ +#define BTRFS_TRANS_DIO_WRITE_STUB ((void *) 1) + /* Radix-tree tag for roots that are part of the trasaction. */ #define BTRFS_ROOT_TRANS_TAG 0 -- 2.20.1

2 1

[PATCH openEuler-1.0-LTS 0/3] dhugetlb: make spin_lock irq save
by Liu Shixin 27 Sep '24

27 Sep '24

Liu Shixin (3): dhugetlb: Use helper function to lock/unlock dhugetlb: avoid lockdep warning with spin_lock_nested dhugetlb: make free_huge_page_to_dhugetlb_pool irq safe include/linux/hugetlb.h | 2 + mm/hugetlb.c | 115 ++++++++++++++++++++++++++-------------- mm/memcontrol.c | 8 +-- 3 files changed, 78 insertions(+), 47 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS-SP1] ethtool: check device is present when getting link settings
by Wang Liang 27 Sep '24

27 Sep '24

From: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> stable inclusion from stable-v5.10.225 commit 842a40c7273ba1c1cb30dda50405b328de1d860e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR4EU CVE: CVE-2024-46679 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a699781c79ecf6cfe67fb00a0331b4088c7c8466 ] A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. eg: [exception RIP: qed_get_current_link+17] #8 [ffffb9e4f2907c48] qede_get_link_ksettings at ffffffffc07a994a [qede] #9 [ffffb9e4f2907cd8] __rh_call_get_link_ksettings at ffffffff992b01a3 #10 [ffffb9e4f2907d38] __ethtool_get_link_ksettings at ffffffff992b04e4 #11 [ffffb9e4f2907d90] duplex_show at ffffffff99260300 #12 [ffffb9e4f2907e38] dev_attr_show at ffffffff9905a01c #13 [ffffb9e4f2907e50] sysfs_kf_seq_show at ffffffff98e0145b #14 [ffffb9e4f2907e68] seq_read at ffffffff98d902e3 #15 [ffffb9e4f2907ec8] vfs_read at ffffffff98d657d1 #16 [ffffb9e4f2907f00] ksys_read at ffffffff98d65c3f #17 [ffffb9e4f2907f38] do_syscall_64 at ffffffff98a052fb crash> struct net_device.state ffff9a9d21336000 state = 5, state 5 is __LINK_STATE_START (0b1) and __LINK_STATE_NOCARRIER (0b100). The device is not present, note lack of __LINK_STATE_PRESENT (0b10). This is the same sort of panic as observed in commit 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show"). There are many other callers of __ethtool_get_link_ksettings() which don't have a device presence check. Move this check into ethtool to protect all callers. Fixes: d519e17e2d01 ("net: export device speed and duplex via sysfs") Fixes: 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show") Signed-off-by: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> Link: https://patch.msgid.link/8bae218864beaa44ed01628140475b9bf641c5b0.172439367… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/core/net-sysfs.c | 2 +- net/ethtool/ioctl.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index 989b3f7ee85f..99303897b7bb 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -213,7 +213,7 @@ static ssize_t speed_show(struct device *dev, if (!rtnl_trylock()) return restart_syscall(); - if (netif_running(netdev) && netif_device_present(netdev)) { + if (netif_running(netdev)) { struct ethtool_link_ksettings cmd; if (!__ethtool_get_link_ksettings(netdev, &cmd)) diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index 63a88b3e861d..f11b5e3a78b1 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -432,6 +432,9 @@ int __ethtool_get_link_ksettings(struct net_device *dev, if (!dev->ethtool_ops->get_link_ksettings) return -EOPNOTSUPP; + if (!netif_device_present(dev)) + return -ENODEV; + memset(link_ksettings, 0, sizeof(*link_ksettings)); return dev->ethtool_ops->get_link_ksettings(dev, link_ksettings); } -- 2.34.1

2 1

[PATCH OLK-5.10] ethtool: check device is present when getting link settings
by Wang Liang 27 Sep '24

27 Sep '24

From: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> stable inclusion from stable-v5.10.225 commit 842a40c7273ba1c1cb30dda50405b328de1d860e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR4EU CVE: CVE-2024-46679 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a699781c79ecf6cfe67fb00a0331b4088c7c8466 ] A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. eg: [exception RIP: qed_get_current_link+17] #8 [ffffb9e4f2907c48] qede_get_link_ksettings at ffffffffc07a994a [qede] #9 [ffffb9e4f2907cd8] __rh_call_get_link_ksettings at ffffffff992b01a3 #10 [ffffb9e4f2907d38] __ethtool_get_link_ksettings at ffffffff992b04e4 #11 [ffffb9e4f2907d90] duplex_show at ffffffff99260300 #12 [ffffb9e4f2907e38] dev_attr_show at ffffffff9905a01c #13 [ffffb9e4f2907e50] sysfs_kf_seq_show at ffffffff98e0145b #14 [ffffb9e4f2907e68] seq_read at ffffffff98d902e3 #15 [ffffb9e4f2907ec8] vfs_read at ffffffff98d657d1 #16 [ffffb9e4f2907f00] ksys_read at ffffffff98d65c3f #17 [ffffb9e4f2907f38] do_syscall_64 at ffffffff98a052fb crash> struct net_device.state ffff9a9d21336000 state = 5, state 5 is __LINK_STATE_START (0b1) and __LINK_STATE_NOCARRIER (0b100). The device is not present, note lack of __LINK_STATE_PRESENT (0b10). This is the same sort of panic as observed in commit 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show"). There are many other callers of __ethtool_get_link_ksettings() which don't have a device presence check. Move this check into ethtool to protect all callers. Fixes: d519e17e2d01 ("net: export device speed and duplex via sysfs") Fixes: 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show") Signed-off-by: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> Link: https://patch.msgid.link/8bae218864beaa44ed01628140475b9bf641c5b0.172439367… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/core/net-sysfs.c | 2 +- net/ethtool/ioctl.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index 989b3f7ee85f..99303897b7bb 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -213,7 +213,7 @@ static ssize_t speed_show(struct device *dev, if (!rtnl_trylock()) return restart_syscall(); - if (netif_running(netdev) && netif_device_present(netdev)) { + if (netif_running(netdev)) { struct ethtool_link_ksettings cmd; if (!__ethtool_get_link_ksettings(netdev, &cmd)) diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index 61a002f5dec6..bc956c346037 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -432,6 +432,9 @@ int __ethtool_get_link_ksettings(struct net_device *dev, if (!dev->ethtool_ops->get_link_ksettings) return -EOPNOTSUPP; + if (!netif_device_present(dev)) + return -ENODEV; + memset(link_ksettings, 0, sizeof(*link_ksettings)); return dev->ethtool_ops->get_link_ksettings(dev, link_ksettings); } -- 2.34.1

2 1

[PATCH OLK-6.6] ethtool: check device is present when getting link settings
by Wang Liang 27 Sep '24

27 Sep '24

From: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> stable inclusion from stable-v6.6.49 commit 94ab317024ba373d37340893d1c0358638935fbb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR4EU CVE: CVE-2024-46679 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a699781c79ecf6cfe67fb00a0331b4088c7c8466 ] A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. eg: [exception RIP: qed_get_current_link+17] #8 [ffffb9e4f2907c48] qede_get_link_ksettings at ffffffffc07a994a [qede] #9 [ffffb9e4f2907cd8] __rh_call_get_link_ksettings at ffffffff992b01a3 #10 [ffffb9e4f2907d38] __ethtool_get_link_ksettings at ffffffff992b04e4 #11 [ffffb9e4f2907d90] duplex_show at ffffffff99260300 #12 [ffffb9e4f2907e38] dev_attr_show at ffffffff9905a01c #13 [ffffb9e4f2907e50] sysfs_kf_seq_show at ffffffff98e0145b #14 [ffffb9e4f2907e68] seq_read at ffffffff98d902e3 #15 [ffffb9e4f2907ec8] vfs_read at ffffffff98d657d1 #16 [ffffb9e4f2907f00] ksys_read at ffffffff98d65c3f #17 [ffffb9e4f2907f38] do_syscall_64 at ffffffff98a052fb crash> struct net_device.state ffff9a9d21336000 state = 5, state 5 is __LINK_STATE_START (0b1) and __LINK_STATE_NOCARRIER (0b100). The device is not present, note lack of __LINK_STATE_PRESENT (0b10). This is the same sort of panic as observed in commit 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show"). There are many other callers of __ethtool_get_link_ksettings() which don't have a device presence check. Move this check into ethtool to protect all callers. Fixes: d519e17e2d01 ("net: export device speed and duplex via sysfs") Fixes: 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show") Signed-off-by: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> Link: https://patch.msgid.link/8bae218864beaa44ed01628140475b9bf641c5b0.172439367… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/core/net-sysfs.c | 2 +- net/ethtool/ioctl.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index 5a9487af44e0..f7404bc67974 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -216,7 +216,7 @@ static ssize_t speed_show(struct device *dev, if (!rtnl_trylock()) return restart_syscall(); - if (netif_running(netdev) && netif_device_present(netdev)) { + if (netif_running(netdev)) { struct ethtool_link_ksettings cmd; if (!__ethtool_get_link_ksettings(netdev, &cmd)) diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index 7cb23bcf8ef7..4486cbe2faf0 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -438,6 +438,9 @@ int __ethtool_get_link_ksettings(struct net_device *dev, if (!dev->ethtool_ops->get_link_ksettings) return -EOPNOTSUPP; + if (!netif_device_present(dev)) + return -ENODEV; + memset(link_ksettings, 0, sizeof(*link_ksettings)); return dev->ethtool_ops->get_link_ksettings(dev, link_ksettings); } -- 2.34.1

2 1

[PATCH OLK-5.10] sched: fix a deadlock in task_net_group()
by Hui Tang 27 Sep '24

27 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATU6E CVE: NA -------------------------------- If req->tx_pid == req->tx_pid when sched_net_relationship_submit() called, which cause rship->net_lock AA deadlock in task_net_group(). Fixes: 2ac826b258e9 ("sched: Introduce task relationship by net and memory") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- kernel/sched/relationship.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/sched/relationship.c b/kernel/sched/relationship.c index 515c913aeb33..d17041585c39 100644 --- a/kernel/sched/relationship.c +++ b/kernel/sched/relationship.c @@ -141,6 +141,9 @@ int sched_net_relationship_submit(struct net_relationship_req *req) req->net_rship_type == NET_RS_TYPE_TX) return remote_rxtx_process(req); + if (req->rx_pid == req->tx_pid) + return -EINVAL; + rcu_read_lock(); rx_tsk = find_task_by_pid_ns(req->rx_pid, &init_pid_ns); -- 2.34.1

2 1

[PATCH OLK-6.6] smb: client: fix double put of @cfile in smb2_set_path_size()
by Zheng Qixing 27 Sep '24

27 Sep '24

From: Paulo Alcantara <pc(a)manguebit.com> stable inclusion from stable-v6.6.51 commit 5a72d1edb0843e4c927a4096f81e631031c25c28 category: kasan bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWCG CVE: CVE-2024-46796 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f9c169b51b6ce20394594ef674d6b10efba31220 upstream. If smb2_compound_op() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() before retrying it as the reference of @cfile was already dropped by previous call. This fixes the following KASAN splat when running fstests generic/013 against Windows Server 2022: CIFS: Attempting to mount //w22-fs0/scratch run fstests generic/013 at 2024-09-02 19:48:59 ================================================================== BUG: KASAN: slab-use-after-free in detach_if_pending+0xab/0x200 Write of size 8 at addr ffff88811f1a3730 by task kworker/3:2/176 CPU: 3 UID: 0 PID: 176 Comm: kworker/3:2 Not tainted 6.11.0-rc6 #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 Workqueue: cifsoplockd cifs_oplock_break [cifs] Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ? detach_if_pending+0xab/0x200 print_report+0x156/0x4d9 ? detach_if_pending+0xab/0x200 ? __virt_addr_valid+0x145/0x300 ? __phys_addr+0x46/0x90 ? detach_if_pending+0xab/0x200 kasan_report+0xda/0x110 ? detach_if_pending+0xab/0x200 detach_if_pending+0xab/0x200 timer_delete+0x96/0xe0 ? __pfx_timer_delete+0x10/0x10 ? rcu_is_watching+0x20/0x50 try_to_grab_pending+0x46/0x3b0 __cancel_work+0x89/0x1b0 ? __pfx___cancel_work+0x10/0x10 ? kasan_save_track+0x14/0x30 cifs_close_deferred_file+0x110/0x2c0 [cifs] ? __pfx_cifs_close_deferred_file+0x10/0x10 [cifs] ? __pfx_down_read+0x10/0x10 cifs_oplock_break+0x4c1/0xa50 [cifs] ? __pfx_cifs_oplock_break+0x10/0x10 [cifs] ? lock_is_held_type+0x85/0xf0 ? mark_held_locks+0x1a/0x90 process_one_work+0x4c6/0x9f0 ? find_held_lock+0x8a/0xa0 ? __pfx_process_one_work+0x10/0x10 ? lock_acquired+0x220/0x550 ? __list_add_valid_or_report+0x37/0x100 worker_thread+0x2e4/0x570 ? __kthread_parkme+0xd1/0xf0 ? __pfx_worker_thread+0x10/0x10 kthread+0x17f/0x1c0 ? kthread+0xda/0x1c0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1118: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 cifs_new_fileinfo+0xc8/0x9d0 [cifs] cifs_atomic_open+0x467/0x770 [cifs] lookup_open.isra.0+0x665/0x8b0 path_openat+0x4c3/0x1380 do_filp_open+0x167/0x270 do_sys_openat2+0x129/0x160 __x64_sys_creat+0xad/0xe0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 83: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 poison_slab_object+0xe9/0x160 __kasan_slab_free+0x32/0x50 kfree+0xf2/0x300 process_one_work+0x4c6/0x9f0 worker_thread+0x2e4/0x570 kthread+0x17f/0x1c0 ret_from_fork+0x31/0x60 ret_from_fork_asm+0x1a/0x30 Last potentially related work creation: kasan_save_stack+0x30/0x50 __kasan_record_aux_stack+0xad/0xc0 insert_work+0x29/0xe0 __queue_work+0x5ea/0x760 queue_work_on+0x6d/0x90 _cifsFileInfo_put+0x3f6/0x770 [cifs] smb2_compound_op+0x911/0x3940 [cifs] smb2_set_path_size+0x228/0x270 [cifs] cifs_set_file_size+0x197/0x460 [cifs] cifs_setattr+0xd9c/0x14b0 [cifs] notify_change+0x4e3/0x740 do_truncate+0xfa/0x180 vfs_truncate+0x195/0x200 __x64_sys_truncate+0x109/0x150 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 71f15c90e785 ("smb: client: retry compound request without reusing lease") Cc: stable(a)vger.kernel.org Signed-off-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.com> Cc: David Howells <dhowells(a)redhat.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- fs/smb/client/smb2inode.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c index 28031c7ba6b1..c51ec2e1adb0 100644 --- a/fs/smb/client/smb2inode.c +++ b/fs/smb/client/smb2inode.c @@ -1148,6 +1148,7 @@ smb2_set_path_size(const unsigned int xid, struct cifs_tcon *tcon, cfile, NULL, NULL, dentry); if (rc == -EINVAL) { cifs_dbg(FYI, "invalid lease key, resending request without lease"); + cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile); rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, &oparms, &in_iov, &(int){SMB2_OP_SET_EOF}, 1, -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] ksmbd: unset the binding mark of a reused connection
by Long Li 27 Sep '24

27 Sep '24

From: Namjae Jeon <linkinjeon(a)kernel.org> stable inclusion from stable-v5.15.166 commit 9914f1bd61d5e838bb1ab15a71076d37a6db65d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWIK CVE: CVE-2024-46795 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78c5a6f1f630172b19af4912e755e1da93ef0ab5 ] Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding session, conn->binding can still remain true and generate_preauth_hash() will not set sess->Preauth_HashValue and it will be NULL. It is used as a material to create an encryption key in ksmbd_gen_smb311_encryptionkey. ->Preauth_HashValue cause null pointer dereference error from crypto_shash_update(). BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 8 PID: 429254 Comm: kworker/8:39 Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 ) Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] RIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] <TASK> ? show_regs+0x6d/0x80 ? __die+0x24/0x80 ? page_fault_oops+0x99/0x1b0 ? do_user_addr_fault+0x2ee/0x6b0 ? exc_page_fault+0x83/0x1b0 ? asm_exc_page_fault+0x27/0x30 ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] _sha256_update+0x77/0xa0 [sha256_ssse3] sha256_avx2_update+0x15/0x30 [sha256_ssse3] crypto_shash_update+0x1e/0x40 hmac_update+0x12/0x20 crypto_shash_update+0x1e/0x40 generate_key+0x234/0x380 [ksmbd] generate_smb3encryptionkey+0x40/0x1c0 [ksmbd] ksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd] ntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd] smb2_sess_setup+0x952/0xaa0 [ksmbd] __process_request+0xa3/0x1d0 [ksmbd] __handle_ksmbd_work+0x1c4/0x2f0 [ksmbd] handle_ksmbd_work+0x2d/0xa0 [ksmbd] process_one_work+0x16c/0x350 worker_thread+0x306/0x440 ? __pfx_worker_thread+0x10/0x10 kthread+0xef/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x44/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Fixes: f5a544e3bab7 ("ksmbd: add support for SMB3 multichannel") Cc: stable(a)vger.kernel.org # v5.15+ Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 50ef53115cab..f4aeca5e7e57 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -1704,6 +1704,8 @@ int smb2_sess_setup(struct ksmbd_work *work) rc = ksmbd_session_register(conn, sess); if (rc) goto out_err; + + conn->binding = false; } else if (conn->dialect >= SMB30_PROT_ID && (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) && req->Flags & SMB2_SESSION_REQ_FLAG_BINDING) { @@ -1782,6 +1784,8 @@ int smb2_sess_setup(struct ksmbd_work *work) sess = NULL; goto out_err; } + + conn->binding = false; } work->sess = sess; -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] ext4: dax: Fix inconsistent isize during writing
by Zhihao Cheng 27 Sep '24

27 Sep '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> Zhihao Cheng (1): ext4: dax: fix overflowing extents beyond inode size when partially writing yangerkun (1): ext4: dax: keep orphan list before truncate overflow allocated blocks fs/ext4/file.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6] ksmbd: unset the binding mark of a reused connection
by Long Li 27 Sep '24

27 Sep '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.10-rc2 commit 78c5a6f1f630172b19af4912e755e1da93ef0ab5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWIK CVE: CVE-2024-46795 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding session, conn->binding can still remain true and generate_preauth_hash() will not set sess->Preauth_HashValue and it will be NULL. It is used as a material to create an encryption key in ksmbd_gen_smb311_encryptionkey. ->Preauth_HashValue cause null pointer dereference error from crypto_shash_update(). BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 8 PID: 429254 Comm: kworker/8:39 Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 ) Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] RIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] <TASK> ? show_regs+0x6d/0x80 ? __die+0x24/0x80 ? page_fault_oops+0x99/0x1b0 ? do_user_addr_fault+0x2ee/0x6b0 ? exc_page_fault+0x83/0x1b0 ? asm_exc_page_fault+0x27/0x30 ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] _sha256_update+0x77/0xa0 [sha256_ssse3] sha256_avx2_update+0x15/0x30 [sha256_ssse3] crypto_shash_update+0x1e/0x40 hmac_update+0x12/0x20 crypto_shash_update+0x1e/0x40 generate_key+0x234/0x380 [ksmbd] generate_smb3encryptionkey+0x40/0x1c0 [ksmbd] ksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd] ntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd] smb2_sess_setup+0x952/0xaa0 [ksmbd] __process_request+0xa3/0x1d0 [ksmbd] __handle_ksmbd_work+0x1c4/0x2f0 [ksmbd] handle_ksmbd_work+0x2d/0xa0 [ksmbd] process_one_work+0x16c/0x350 worker_thread+0x306/0x440 ? __pfx_worker_thread+0x10/0x10 kthread+0xef/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x44/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Fixes: f5a544e3bab7 ("ksmbd: add support for SMB3 multichannel") Cc: stable(a)vger.kernel.org # v5.15+ Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/smb/server/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 4d91210e6acf..28684316bccb 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -1681,6 +1681,8 @@ int smb2_sess_setup(struct ksmbd_work *work) rc = ksmbd_session_register(conn, sess); if (rc) goto out_err; + + conn->binding = false; } else if (conn->dialect >= SMB30_PROT_ID && (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) && req->Flags & SMB2_SESSION_REQ_FLAG_BINDING) { @@ -1759,6 +1761,8 @@ int smb2_sess_setup(struct ksmbd_work *work) sess = NULL; goto out_err; } + + conn->binding = false; } work->sess = sess; -- 2.39.2

2 1

[PATCH OLK-6.6] HID: amd_sfh: free driver_data after destroying hid device
by He Yujie 27 Sep '24

27 Sep '24

From: Olivier Sobrie <olivier(a)sobrie.be> stable inclusion from stable-v6.6.51 commit 60dc4ee0428d70bcbb41436b6729d29f1cbdfb89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV9S CVE: CVE-2024-46746 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 97155021ae17b86985121b33cf8098bcde00d497 ] HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks. I observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling KASAN to debug memory allocation, I got this output: [ 13.050438] ================================================================== [ 13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh] [ 13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3 [ 13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479 [ 13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.067860] Call Trace: [ 13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8 [ 13.071486] <TASK> [ 13.071492] dump_stack_lvl+0x5d/0x80 [ 13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -> 0002) [ 13.078296] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.082199] print_report+0x174/0x505 [ 13.085776] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.089367] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.093255] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.097464] kasan_report+0xc8/0x150 [ 13.101461] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.105802] amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.110303] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.114879] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.119450] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.124097] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.127404] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.131925] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.136455] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.140197] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.143602] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.147234] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.150446] ? __devm_add_action+0x167/0x1d0 [ 13.155061] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.158581] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.161814] platform_probe+0xa2/0x150 [ 13.165029] really_probe+0x1e3/0x8a0 [ 13.168243] __driver_probe_device+0x18c/0x370 [ 13.171500] driver_probe_device+0x4a/0x120 [ 13.175000] __driver_attach+0x190/0x4a0 [ 13.178521] ? __pfx___driver_attach+0x10/0x10 [ 13.181771] bus_for_each_dev+0x106/0x180 [ 13.185033] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.188229] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.191446] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.194382] bus_add_driver+0x29e/0x4d0 [ 13.197328] driver_register+0x1a5/0x360 [ 13.200283] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.203362] do_one_initcall+0xa7/0x380 [ 13.206432] ? __pfx_do_one_initcall+0x10/0x10 [ 13.210175] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.213211] ? kasan_unpoison+0x44/0x70 [ 13.216688] do_init_module+0x238/0x750 [ 13.219696] load_module+0x5011/0x6af0 [ 13.223096] ? kasan_save_stack+0x30/0x50 [ 13.226743] ? kasan_save_track+0x14/0x30 [ 13.230080] ? kasan_save_free_info+0x3b/0x60 [ 13.233323] ? poison_slab_object+0x109/0x180 [ 13.236778] ? __pfx_load_module+0x10/0x10 [ 13.239703] ? poison_slab_object+0x109/0x180 [ 13.243070] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.245924] ? init_module_from_file+0x13d/0x150 [ 13.248745] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.251503] ? init_module_from_file+0xdf/0x150 [ 13.254198] init_module_from_file+0xdf/0x150 [ 13.256826] ? __pfx_init_module_from_file+0x10/0x10 [ 13.259428] ? kasan_save_track+0x14/0x30 [ 13.261959] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.264471] ? kasan_save_free_info+0x3b/0x60 [ 13.267026] ? poison_slab_object+0x109/0x180 [ 13.269494] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.271949] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.274324] ? _raw_spin_lock+0x85/0xe0 [ 13.276671] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.278963] ? __rseq_handle_notify_resume+0x1a6/0xad0 [ 13.281193] idempotent_init_module+0x23b/0x650 [ 13.283420] ? __pfx_idempotent_init_module+0x10/0x10 [ 13.285619] ? __pfx___seccomp_filter+0x10/0x10 [ 13.287714] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.289828] ? __fget_light+0x57/0x420 [ 13.291870] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.293880] ? security_capable+0x74/0xb0 [ 13.295820] __x64_sys_finit_module+0xbe/0x130 [ 13.297874] do_syscall_64+0x82/0x190 [ 13.299898] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.301905] ? irqtime_account_irq+0x3d/0x1f0 [ 13.303877] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.305753] ? __irq_exit_rcu+0x4e/0x130 [ 13.307577] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.309489] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 13.311371] RIP: 0033:0x7a21f96ade9d [ 13.313234] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 63 de 0c 00 f7 d8 64 89 01 48 [ 13.317051] RSP: 002b:00007ffeae934e78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 13.319024] RAX: ffffffffffffffda RBX: 00005987276bfcf0 RCX: 00007a21f96ade9d [ 13.321100] RDX: 0000000000000004 RSI: 00007a21f8eda376 RDI: 000000000000001c [ 13.323314] RBP: 00007a21f8eda376 R08: 0000000000000001 R09: 00007ffeae934ec0 [ 13.325505] R10: 0000000000000050 R11: 0000000000000246 R12: 0000000000020000 [ 13.327637] R13: 00005987276c1250 R14: 0000000000000000 R15: 00005987276c4530 [ 13.329737] </TASK> [ 13.333945] Allocated by task 139: [ 13.336111] kasan_save_stack+0x30/0x50 [ 13.336121] kasan_save_track+0x14/0x30 [ 13.336125] __kasan_kmalloc+0xaa/0xb0 [ 13.336129] amdtp_hid_probe+0xb1/0x440 [amd_sfh] [ 13.336138] amd_sfh_hid_client_init+0xb8a/0x10f0 [amd_sfh] [ 13.336144] sfh_init_work+0x47/0x120 [amd_sfh] [ 13.336150] process_one_work+0x673/0xeb0 [ 13.336155] worker_thread+0x795/0x1250 [ 13.336160] kthread+0x290/0x350 [ 13.336164] ret_from_fork+0x34/0x70 [ 13.336169] ret_from_fork_asm+0x1a/0x30 [ 13.338175] Freed by task 139: [ 13.340064] kasan_save_stack+0x30/0x50 [ 13.340072] kasan_save_track+0x14/0x30 [ 13.340076] kasan_save_free_info+0x3b/0x60 [ 13.340081] poison_slab_object+0x109/0x180 [ 13.340085] __kasan_slab_free+0x32/0x50 [ 13.340089] kfree+0xe5/0x310 [ 13.340094] amdtp_hid_remove+0xb2/0x160 [amd_sfh] [ 13.340102] amd_sfh_hid_client_deinit+0x324/0x640 [amd_sfh] [ 13.340107] amd_sfh_hid_client_init+0x94a/0x10f0 [amd_sfh] [ 13.340113] sfh_init_work+0x47/0x120 [amd_sfh] [ 13.340118] process_one_work+0x673/0xeb0 [ 13.340123] worker_thread+0x795/0x1250 [ 13.340127] kthread+0x290/0x350 [ 13.340132] ret_from_fork+0x34/0x70 [ 13.340136] ret_from_fork_asm+0x1a/0x30 [ 13.342482] The buggy address belongs to the object at ffff88813152f400 which belongs to the cache kmalloc-64 of size 64 [ 13.347357] The buggy address is located 8 bytes inside of freed 64-byte region [ffff88813152f400, ffff88813152f440) [ 13.347367] The buggy address belongs to the physical page: [ 13.355409] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13152f [ 13.355416] anon flags: 0x2ffff8000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 13.355423] page_type: 0xffffefff(slab) [ 13.355429] raw: 02ffff8000000000 ffff8881000428c0 ffffea0004c43a00 0000000000000005 [ 13.355435] raw: 0000000000000000 0000000000200020 00000001ffffefff 0000000000000000 [ 13.355439] page dumped because: kasan: bad access detected [ 13.357295] Memory state around the buggy address: [ 13.357299] ffff88813152f300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357303] ffff88813152f380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357306] >ffff88813152f400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357309] ^ [ 13.357311] ffff88813152f480: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 13.357315] ffff88813152f500: 00 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc [ 13.357318] ================================================================== [ 13.357405] Disabling lock debugging due to kernel taint [ 13.383534] Oops: general protection fault, probably for non-canonical address 0xe0a1bc4140000013: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 13.383544] KASAN: maybe wild-memory-access in range [0x050e020a00000098-0x050e020a0000009f] [ 13.383551] CPU: 3 PID: 479 Comm: (udev-worker) Tainted: G B 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.383561] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.383565] RIP: 0010:amd_sfh_get_report+0x81/0x530 [amd_sfh] [ 13.383580] Code: 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 78 03 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 63 08 49 8d 7c 24 10 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 1a 03 00 00 45 8b 74 24 10 45 [ 13.383585] RSP: 0018:ffff8881261f7388 EFLAGS: 00010212 [ 13.383592] RAX: dffffc0000000000 RBX: ffff88813152f400 RCX: 0000000000000002 [ 13.383597] RDX: 00a1c04140000013 RSI: 0000000000000008 RDI: 050e020a0000009b [ 13.383600] RBP: ffff88814d010000 R08: 0000000000000002 R09: fffffbfff3ddb8c0 [ 13.383604] R10: ffffffff9eedc607 R11: ffff88810ce98000 R12: 050e020a0000008b [ 13.383607] R13: ffff88814d010000 R14: dffffc0000000000 R15: 0000000000000004 [ 13.383611] FS: 00007a21f94d0880(0000) GS:ffff8887e7d80000(0000) knlGS:0000000000000000 [ 13.383615] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 13.383618] CR2: 00007e0014c438f0 CR3: 000000012614c000 CR4: 0000000000f50ef0 [ 13.383622] PKRU: 55555554 [ 13.383625] Call Trace: [ 13.383629] <TASK> [ 13.383632] ? __die_body.cold+0x19/0x27 [ 13.383644] ? die_addr+0x46/0x70 [ 13.383652] ? exc_general_protection+0x150/0x240 [ 13.383664] ? asm_exc_general_protection+0x26/0x30 [ 13.383674] ? amd_sfh_get_report+0x81/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383686] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383697] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383706] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383713] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.383727] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.383739] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383745] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.383753] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.383762] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.383768] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.383790] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383795] ? __devm_add_action+0x167/0x1d0 [ 13.383806] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.383818] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383826] platform_probe+0xa2/0x150 [ 13.383832] really_probe+0x1e3/0x8a0 [ 13.383838] __driver_probe_device+0x18c/0x370 [ 13.383844] driver_probe_device+0x4a/0x120 [ 13.383851] __driver_attach+0x190/0x4a0 [ 13.383857] ? __pfx___driver_attach+0x10/0x10 [ 13.383863] bus_for_each_dev+0x106/0x180 [ 13.383868] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.383874] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.383880] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383887] bus_add_driver+0x29e/0x4d0 [ 13.383895] driver_register+0x1a5/0x360 [ 13.383902] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.383910] do_one_initcall+0xa7/0x380 [ 13.383919] ? __pfx_do_one_initcall+0x10/0x10 [ 13.383927] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383933] ? kasan_unpoison+0x44/0x70 [ 13.383943] do_init_module+0x238/0x750 [ 13.383955] load_module+0x5011/0x6af0 [ 13.383962] ? kasan_save_stack+0x30/0x50 [ 13.383968] ? kasan_save_track+0x14/0x30 [ 13.383973] ? kasan_save_free_info+0x3b/0x60 [ 13.383980] ? poison_slab_object+0x109/0x180 [ 13.383993] ? __pfx_load_module+0x10/0x10 [ 13.384007] ? poison_slab_object+0x109/0x180 [ 13.384012] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384018] ? init_module_from_file+0x13d/0x150 [ 13.384025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384032] ? init_module_from_file+0xdf/0x150 [ 13.384037] init_module_from_file+0xdf/0x150 [ 13.384044] ? __pfx_init_module_from_file+0x10/0x10 [ 13.384050] ? kasan_save_track+0x14/0x30 [ 13.384055] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384060] ? kasan_save_free_info+0x3b/0x60 [ 13.384066] ? poison_slab_object+0x109/0x180 [ 13.384071] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384080] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384085] ? _raw_spin_lock+0x85/0xe0 [ 13.384091] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.384096] ? __rseq_handle_notify_resume+0x1a6/0xad0 [ 13.384106] idempotent_init_module+0x23b/0x650 [ 13.384114] ? __pfx_idempotent_init_module+0x10/0x10 [ 13.384120] ? __pfx___seccomp_filter+0x10/0x10 [ 13.384129] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384135] ? __fget_light+0x57/0x420 [ 13.384142] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384147] ? security_capable+0x74/0xb0 [ 13.384157] __x64_sys_finit_module+0xbe/0x130 [ 13.384164] do_syscall_64+0x82/0x190 [ 13.384174] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384179] ? irqtime_account_irq+0x3d/0x1f0 [ 13.384188] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384193] ? __irq_exit_rcu+0x4e/0x130 [ 13.384201] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384206] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 13.384212] RIP: 0033:0x7a21f96ade9d [ 13.384263] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 63 de 0c 00 f7 d8 64 89 01 48 [ 13.384267] RSP: 002b:00007ffeae934e78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 13.384273] RAX: ffffffffffffffda RBX: 00005987276bfcf0 RCX: 00007a21f96ade9d [ 13.384277] RDX: 0000000000000004 RSI: 00007a21f8eda376 RDI: 000000000000001c [ 13.384280] RBP: 00007a21f8eda376 R08: 0000000000000001 R09: 00007ffeae934ec0 [ 13.384284] R10: 0000000000000050 R11: 0000000000000246 R12: 0000000000020000 [ 13.384288] R13: 00005987276c1250 R14: 0000000000000000 R15: 00005987276c4530 [ 13.384297] </TASK> [ 13.384299] Modules linked in: soundwire_amd(+) hid_sensor_gyro_3d(+) hid_sensor_magn_3d hid_sensor_accel_3d soundwire_generic_allocation amdxcp hid_sensor_trigger drm_exec industrialio_triggered_buffer soundwire_bus gpu_sched kvm_amd kfifo_buf qmi_helpers joydev drm_buddy hid_sensor_iio_common mousedev snd_soc_core industrialio i2c_algo_bit mac80211 snd_compress drm_suballoc_helper kvm snd_hda_intel drm_ttm_helper ac97_bus snd_pcm_dmaengine snd_intel_dspcfg ttm thinkpad_acpi(+) snd_intel_sdw_acpi hid_sensor_hub snd_rpl_pci_acp6x drm_display_helper snd_hda_codec hid_multitouch libarc4 snd_acp_pci platform_profile think_lmi(+) hid_generic firmware_attributes_class wmi_bmof cec snd_acp_legacy_common sparse_keymap rapl snd_hda_core psmouse cfg80211 pcspkr snd_pci_acp6x snd_hwdep video snd_pcm snd_pci_acp5x snd_timer snd_rn_pci_acp3x ucsi_acpi snd_acp_config snd sp5100_tco rfkill snd_soc_acpi typec_ucsi thunderbolt amd_sfh k10temp mhi soundcore i2c_piix4 snd_pci_acp3x typec i2c_hid_acpi roles i2c_hid wmi acpi_tad amd_pmc [ 13.384454] mac_hid i2c_dev crypto_user loop nfnetlink zram ip_tables x_tables dm_crypt cbc encrypted_keys trusted asn1_encoder tee dm_mod crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic gf128mul ghash_clmulni_intel serio_raw sha512_ssse3 atkbd sha256_ssse3 libps2 sha1_ssse3 vivaldi_fmap nvme aesni_intel crypto_simd nvme_core cryptd ccp xhci_pci i8042 nvme_auth xhci_pci_renesas serio vfat fat btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq [ 13.384552] ---[ end trace 0000000000000000 ]--- KASAN reports a use-after-free of hid->driver_data in function amd_sfh_get_report(). The backtrace indicates that the function is called by amdtp_hid_request() which is one of the callbacks of hid device. The current make sure that driver_data is freed only once hid_destroy_device() returned. Note that I observed the crash both on v6.9.9 and v6.10.0. The code seems to be as it was from the early days of the driver. Signed-off-by: Olivier Sobrie <olivier(a)sobrie.be> Acked-by: Basavaraj Natikar <Basavaraj.Natikar(a)amd.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_hid.c b/drivers/hid/amd-sfh-hid/amd_sfh_hid.c index 705b52337068..81f3024b7b1b 100644 --- a/drivers/hid/amd-sfh-hid/amd_sfh_hid.c +++ b/drivers/hid/amd-sfh-hid/amd_sfh_hid.c @@ -171,11 +171,13 @@ int amdtp_hid_probe(u32 cur_hid_dev, struct amdtp_cl_data *cli_data) void amdtp_hid_remove(struct amdtp_cl_data *cli_data) { int i; + struct amdtp_hid_data *hid_data; for (i = 0; i < cli_data->num_hid_devices; ++i) { if (cli_data->hid_sensor_hubs[i]) { - kfree(cli_data->hid_sensor_hubs[i]->driver_data); + hid_data = cli_data->hid_sensor_hubs[i]->driver_data; hid_destroy_device(cli_data->hid_sensor_hubs[i]); + kfree(hid_data); cli_data->hid_sensor_hubs[i] = NULL; } } -- 2.34.1

2 1

[PATCH OLK-5.10] ksmbd: unset the binding mark of a reused connection
by Long Li 27 Sep '24

27 Sep '24

From: Namjae Jeon <linkinjeon(a)kernel.org> stable inclusion from stable-v5.15.166 commit 9914f1bd61d5e838bb1ab15a71076d37a6db65d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWIK CVE: CVE-2024-46795 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78c5a6f1f630172b19af4912e755e1da93ef0ab5 ] Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding session, conn->binding can still remain true and generate_preauth_hash() will not set sess->Preauth_HashValue and it will be NULL. It is used as a material to create an encryption key in ksmbd_gen_smb311_encryptionkey. ->Preauth_HashValue cause null pointer dereference error from crypto_shash_update(). BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 8 PID: 429254 Comm: kworker/8:39 Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 ) Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] RIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] <TASK> ? show_regs+0x6d/0x80 ? __die+0x24/0x80 ? page_fault_oops+0x99/0x1b0 ? do_user_addr_fault+0x2ee/0x6b0 ? exc_page_fault+0x83/0x1b0 ? asm_exc_page_fault+0x27/0x30 ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] _sha256_update+0x77/0xa0 [sha256_ssse3] sha256_avx2_update+0x15/0x30 [sha256_ssse3] crypto_shash_update+0x1e/0x40 hmac_update+0x12/0x20 crypto_shash_update+0x1e/0x40 generate_key+0x234/0x380 [ksmbd] generate_smb3encryptionkey+0x40/0x1c0 [ksmbd] ksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd] ntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd] smb2_sess_setup+0x952/0xaa0 [ksmbd] __process_request+0xa3/0x1d0 [ksmbd] __handle_ksmbd_work+0x1c4/0x2f0 [ksmbd] handle_ksmbd_work+0x2d/0xa0 [ksmbd] process_one_work+0x16c/0x350 worker_thread+0x306/0x440 ? __pfx_worker_thread+0x10/0x10 kthread+0xef/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x44/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Fixes: f5a544e3bab7 ("ksmbd: add support for SMB3 multichannel") Cc: stable(a)vger.kernel.org # v5.15+ Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 50ef53115cab..f4aeca5e7e57 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -1704,6 +1704,8 @@ int smb2_sess_setup(struct ksmbd_work *work) rc = ksmbd_session_register(conn, sess); if (rc) goto out_err; + + conn->binding = false; } else if (conn->dialect >= SMB30_PROT_ID && (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) && req->Flags & SMB2_SESSION_REQ_FLAG_BINDING) { @@ -1782,6 +1784,8 @@ int smb2_sess_setup(struct ksmbd_work *work) sess = NULL; goto out_err; } + + conn->binding = false; } work->sess = sess; -- 2.39.2

2 1

[PATCH OLK-6.6] HID: amd_sfh: free driver_data after destroying hid device
by He Yujie 27 Sep '24

27 Sep '24

From: Olivier Sobrie <olivier(a)sobrie.be> stable inclusion from stable-v6.6.51 commit 60dc4ee0428d70bcbb41436b6729d29f1cbdfb89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV9S?from=project-issue CVE: CVE-2024-46746 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 97155021ae17b86985121b33cf8098bcde00d497 ] HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks. I observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling KASAN to debug memory allocation, I got this output: [ 13.050438] ================================================================== [ 13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh] [ 13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3 [ 13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479 [ 13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.067860] Call Trace: [ 13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8 [ 13.071486] <TASK> [ 13.071492] dump_stack_lvl+0x5d/0x80 [ 13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -> 0002) [ 13.078296] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.082199] print_report+0x174/0x505 [ 13.085776] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.089367] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.093255] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.097464] kasan_report+0xc8/0x150 [ 13.101461] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.105802] amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.110303] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.114879] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.119450] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.124097] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.127404] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.131925] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.136455] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.140197] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.143602] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.147234] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.150446] ? __devm_add_action+0x167/0x1d0 [ 13.155061] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.158581] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.161814] platform_probe+0xa2/0x150 [ 13.165029] really_probe+0x1e3/0x8a0 [ 13.168243] __driver_probe_device+0x18c/0x370 [ 13.171500] driver_probe_device+0x4a/0x120 [ 13.175000] __driver_attach+0x190/0x4a0 [ 13.178521] ? __pfx___driver_attach+0x10/0x10 [ 13.181771] bus_for_each_dev+0x106/0x180 [ 13.185033] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.188229] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.191446] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.194382] bus_add_driver+0x29e/0x4d0 [ 13.197328] driver_register+0x1a5/0x360 [ 13.200283] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.203362] do_one_initcall+0xa7/0x380 [ 13.206432] ? __pfx_do_one_initcall+0x10/0x10 [ 13.210175] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.213211] ? kasan_unpoison+0x44/0x70 [ 13.216688] do_init_module+0x238/0x750 [ 13.219696] load_module+0x5011/0x6af0 [ 13.223096] ? kasan_save_stack+0x30/0x50 [ 13.226743] ? kasan_save_track+0x14/0x30 [ 13.230080] ? kasan_save_free_info+0x3b/0x60 [ 13.233323] ? poison_slab_object+0x109/0x180 [ 13.236778] ? __pfx_load_module+0x10/0x10 [ 13.239703] ? poison_slab_object+0x109/0x180 [ 13.243070] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.245924] ? init_module_from_file+0x13d/0x150 [ 13.248745] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.251503] ? init_module_from_file+0xdf/0x150 [ 13.254198] init_module_from_file+0xdf/0x150 [ 13.256826] ? __pfx_init_module_from_file+0x10/0x10 [ 13.259428] ? kasan_save_track+0x14/0x30 [ 13.261959] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.264471] ? kasan_save_free_info+0x3b/0x60 [ 13.267026] ? poison_slab_object+0x109/0x180 [ 13.269494] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.271949] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.274324] ? _raw_spin_lock+0x85/0xe0 [ 13.276671] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.278963] ? __rseq_handle_notify_resume+0x1a6/0xad0 [ 13.281193] idempotent_init_module+0x23b/0x650 [ 13.283420] ? __pfx_idempotent_init_module+0x10/0x10 [ 13.285619] ? __pfx___seccomp_filter+0x10/0x10 [ 13.287714] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.289828] ? __fget_light+0x57/0x420 [ 13.291870] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.293880] ? security_capable+0x74/0xb0 [ 13.295820] __x64_sys_finit_module+0xbe/0x130 [ 13.297874] do_syscall_64+0x82/0x190 [ 13.299898] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.301905] ? irqtime_account_irq+0x3d/0x1f0 [ 13.303877] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.305753] ? __irq_exit_rcu+0x4e/0x130 [ 13.307577] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.309489] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 13.311371] RIP: 0033:0x7a21f96ade9d [ 13.313234] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 63 de 0c 00 f7 d8 64 89 01 48 [ 13.317051] RSP: 002b:00007ffeae934e78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 13.319024] RAX: ffffffffffffffda RBX: 00005987276bfcf0 RCX: 00007a21f96ade9d [ 13.321100] RDX: 0000000000000004 RSI: 00007a21f8eda376 RDI: 000000000000001c [ 13.323314] RBP: 00007a21f8eda376 R08: 0000000000000001 R09: 00007ffeae934ec0 [ 13.325505] R10: 0000000000000050 R11: 0000000000000246 R12: 0000000000020000 [ 13.327637] R13: 00005987276c1250 R14: 0000000000000000 R15: 00005987276c4530 [ 13.329737] </TASK> [ 13.333945] Allocated by task 139: [ 13.336111] kasan_save_stack+0x30/0x50 [ 13.336121] kasan_save_track+0x14/0x30 [ 13.336125] __kasan_kmalloc+0xaa/0xb0 [ 13.336129] amdtp_hid_probe+0xb1/0x440 [amd_sfh] [ 13.336138] amd_sfh_hid_client_init+0xb8a/0x10f0 [amd_sfh] [ 13.336144] sfh_init_work+0x47/0x120 [amd_sfh] [ 13.336150] process_one_work+0x673/0xeb0 [ 13.336155] worker_thread+0x795/0x1250 [ 13.336160] kthread+0x290/0x350 [ 13.336164] ret_from_fork+0x34/0x70 [ 13.336169] ret_from_fork_asm+0x1a/0x30 [ 13.338175] Freed by task 139: [ 13.340064] kasan_save_stack+0x30/0x50 [ 13.340072] kasan_save_track+0x14/0x30 [ 13.340076] kasan_save_free_info+0x3b/0x60 [ 13.340081] poison_slab_object+0x109/0x180 [ 13.340085] __kasan_slab_free+0x32/0x50 [ 13.340089] kfree+0xe5/0x310 [ 13.340094] amdtp_hid_remove+0xb2/0x160 [amd_sfh] [ 13.340102] amd_sfh_hid_client_deinit+0x324/0x640 [amd_sfh] [ 13.340107] amd_sfh_hid_client_init+0x94a/0x10f0 [amd_sfh] [ 13.340113] sfh_init_work+0x47/0x120 [amd_sfh] [ 13.340118] process_one_work+0x673/0xeb0 [ 13.340123] worker_thread+0x795/0x1250 [ 13.340127] kthread+0x290/0x350 [ 13.340132] ret_from_fork+0x34/0x70 [ 13.340136] ret_from_fork_asm+0x1a/0x30 [ 13.342482] The buggy address belongs to the object at ffff88813152f400 which belongs to the cache kmalloc-64 of size 64 [ 13.347357] The buggy address is located 8 bytes inside of freed 64-byte region [ffff88813152f400, ffff88813152f440) [ 13.347367] The buggy address belongs to the physical page: [ 13.355409] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13152f [ 13.355416] anon flags: 0x2ffff8000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 13.355423] page_type: 0xffffefff(slab) [ 13.355429] raw: 02ffff8000000000 ffff8881000428c0 ffffea0004c43a00 0000000000000005 [ 13.355435] raw: 0000000000000000 0000000000200020 00000001ffffefff 0000000000000000 [ 13.355439] page dumped because: kasan: bad access detected [ 13.357295] Memory state around the buggy address: [ 13.357299] ffff88813152f300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357303] ffff88813152f380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357306] >ffff88813152f400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357309] ^ [ 13.357311] ffff88813152f480: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 13.357315] ffff88813152f500: 00 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc [ 13.357318] ================================================================== [ 13.357405] Disabling lock debugging due to kernel taint [ 13.383534] Oops: general protection fault, probably for non-canonical address 0xe0a1bc4140000013: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 13.383544] KASAN: maybe wild-memory-access in range [0x050e020a00000098-0x050e020a0000009f] [ 13.383551] CPU: 3 PID: 479 Comm: (udev-worker) Tainted: G B 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.383561] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.383565] RIP: 0010:amd_sfh_get_report+0x81/0x530 [amd_sfh] [ 13.383580] Code: 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 78 03 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 63 08 49 8d 7c 24 10 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 1a 03 00 00 45 8b 74 24 10 45 [ 13.383585] RSP: 0018:ffff8881261f7388 EFLAGS: 00010212 [ 13.383592] RAX: dffffc0000000000 RBX: ffff88813152f400 RCX: 0000000000000002 [ 13.383597] RDX: 00a1c04140000013 RSI: 0000000000000008 RDI: 050e020a0000009b [ 13.383600] RBP: ffff88814d010000 R08: 0000000000000002 R09: fffffbfff3ddb8c0 [ 13.383604] R10: ffffffff9eedc607 R11: ffff88810ce98000 R12: 050e020a0000008b [ 13.383607] R13: ffff88814d010000 R14: dffffc0000000000 R15: 0000000000000004 [ 13.383611] FS: 00007a21f94d0880(0000) GS:ffff8887e7d80000(0000) knlGS:0000000000000000 [ 13.383615] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 13.383618] CR2: 00007e0014c438f0 CR3: 000000012614c000 CR4: 0000000000f50ef0 [ 13.383622] PKRU: 55555554 [ 13.383625] Call Trace: [ 13.383629] <TASK> [ 13.383632] ? __die_body.cold+0x19/0x27 [ 13.383644] ? die_addr+0x46/0x70 [ 13.383652] ? exc_general_protection+0x150/0x240 [ 13.383664] ? asm_exc_general_protection+0x26/0x30 [ 13.383674] ? amd_sfh_get_report+0x81/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383686] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383697] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383706] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383713] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.383727] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.383739] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383745] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.383753] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.383762] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.383768] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.383790] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383795] ? __devm_add_action+0x167/0x1d0 [ 13.383806] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.383818] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383826] platform_probe+0xa2/0x150 [ 13.383832] really_probe+0x1e3/0x8a0 [ 13.383838] __driver_probe_device+0x18c/0x370 [ 13.383844] driver_probe_device+0x4a/0x120 [ 13.383851] __driver_attach+0x190/0x4a0 [ 13.383857] ? __pfx___driver_attach+0x10/0x10 [ 13.383863] bus_for_each_dev+0x106/0x180 [ 13.383868] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.383874] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.383880] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383887] bus_add_driver+0x29e/0x4d0 [ 13.383895] driver_register+0x1a5/0x360 [ 13.383902] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.383910] do_one_initcall+0xa7/0x380 [ 13.383919] ? __pfx_do_one_initcall+0x10/0x10 [ 13.383927] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383933] ? kasan_unpoison+0x44/0x70 [ 13.383943] do_init_module+0x238/0x750 [ 13.383955] load_module+0x5011/0x6af0 [ 13.383962] ? kasan_save_stack+0x30/0x50 [ 13.383968] ? kasan_save_track+0x14/0x30 [ 13.383973] ? kasan_save_free_info+0x3b/0x60 [ 13.383980] ? poison_slab_object+0x109/0x180 [ 13.383993] ? __pfx_load_module+0x10/0x10 [ 13.384007] ? poison_slab_object+0x109/0x180 [ 13.384012] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384018] ? init_module_from_file+0x13d/0x150 [ 13.384025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384032] ? init_module_from_file+0xdf/0x150 [ 13.384037] init_module_from_file+0xdf/0x150 [ 13.384044] ? __pfx_init_module_from_file+0x10/0x10 [ 13.384050] ? kasan_save_track+0x14/0x30 [ 13.384055] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384060] ? kasan_save_free_info+0x3b/0x60 [ 13.384066] ? poison_slab_object+0x109/0x180 [ 13.384071] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384080] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384085] ? _raw_spin_lock+0x85/0xe0 [ 13.384091] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.384096] ? __rseq_handle_notify_resume+0x1a6/0xad0 [ 13.384106] idempotent_init_module+0x23b/0x650 [ 13.384114] ? __pfx_idempotent_init_module+0x10/0x10 [ 13.384120] ? __pfx___seccomp_filter+0x10/0x10 [ 13.384129] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384135] ? __fget_light+0x57/0x420 [ 13.384142] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384147] ? security_capable+0x74/0xb0 [ 13.384157] __x64_sys_finit_module+0xbe/0x130 [ 13.384164] do_syscall_64+0x82/0x190 [ 13.384174] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384179] ? irqtime_account_irq+0x3d/0x1f0 [ 13.384188] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384193] ? __irq_exit_rcu+0x4e/0x130 [ 13.384201] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384206] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 13.384212] RIP: 0033:0x7a21f96ade9d [ 13.384263] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 63 de 0c 00 f7 d8 64 89 01 48 [ 13.384267] RSP: 002b:00007ffeae934e78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 13.384273] RAX: ffffffffffffffda RBX: 00005987276bfcf0 RCX: 00007a21f96ade9d [ 13.384277] RDX: 0000000000000004 RSI: 00007a21f8eda376 RDI: 000000000000001c [ 13.384280] RBP: 00007a21f8eda376 R08: 0000000000000001 R09: 00007ffeae934ec0 [ 13.384284] R10: 0000000000000050 R11: 0000000000000246 R12: 0000000000020000 [ 13.384288] R13: 00005987276c1250 R14: 0000000000000000 R15: 00005987276c4530 [ 13.384297] </TASK> [ 13.384299] Modules linked in: soundwire_amd(+) hid_sensor_gyro_3d(+) hid_sensor_magn_3d hid_sensor_accel_3d soundwire_generic_allocation amdxcp hid_sensor_trigger drm_exec industrialio_triggered_buffer soundwire_bus gpu_sched kvm_amd kfifo_buf qmi_helpers joydev drm_buddy hid_sensor_iio_common mousedev snd_soc_core industrialio i2c_algo_bit mac80211 snd_compress drm_suballoc_helper kvm snd_hda_intel drm_ttm_helper ac97_bus snd_pcm_dmaengine snd_intel_dspcfg ttm thinkpad_acpi(+) snd_intel_sdw_acpi hid_sensor_hub snd_rpl_pci_acp6x drm_display_helper snd_hda_codec hid_multitouch libarc4 snd_acp_pci platform_profile think_lmi(+) hid_generic firmware_attributes_class wmi_bmof cec snd_acp_legacy_common sparse_keymap rapl snd_hda_core psmouse cfg80211 pcspkr snd_pci_acp6x snd_hwdep video snd_pcm snd_pci_acp5x snd_timer snd_rn_pci_acp3x ucsi_acpi snd_acp_config snd sp5100_tco rfkill snd_soc_acpi typec_ucsi thunderbolt amd_sfh k10temp mhi soundcore i2c_piix4 snd_pci_acp3x typec i2c_hid_acpi roles i2c_hid wmi acpi_tad amd_pmc [ 13.384454] mac_hid i2c_dev crypto_user loop nfnetlink zram ip_tables x_tables dm_crypt cbc encrypted_keys trusted asn1_encoder tee dm_mod crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic gf128mul ghash_clmulni_intel serio_raw sha512_ssse3 atkbd sha256_ssse3 libps2 sha1_ssse3 vivaldi_fmap nvme aesni_intel crypto_simd nvme_core cryptd ccp xhci_pci i8042 nvme_auth xhci_pci_renesas serio vfat fat btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq [ 13.384552] ---[ end trace 0000000000000000 ]--- KASAN reports a use-after-free of hid->driver_data in function amd_sfh_get_report(). The backtrace indicates that the function is called by amdtp_hid_request() which is one of the callbacks of hid device. The current make sure that driver_data is freed only once hid_destroy_device() returned. Note that I observed the crash both on v6.9.9 and v6.10.0. The code seems to be as it was from the early days of the driver. Signed-off-by: Olivier Sobrie <olivier(a)sobrie.be> Acked-by: Basavaraj Natikar <Basavaraj.Natikar(a)amd.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_hid.c b/drivers/hid/amd-sfh-hid/amd_sfh_hid.c index 705b52337068..81f3024b7b1b 100644 --- a/drivers/hid/amd-sfh-hid/amd_sfh_hid.c +++ b/drivers/hid/amd-sfh-hid/amd_sfh_hid.c @@ -171,11 +171,13 @@ int amdtp_hid_probe(u32 cur_hid_dev, struct amdtp_cl_data *cli_data) void amdtp_hid_remove(struct amdtp_cl_data *cli_data) { int i; + struct amdtp_hid_data *hid_data; for (i = 0; i < cli_data->num_hid_devices; ++i) { if (cli_data->hid_sensor_hubs[i]) { - kfree(cli_data->hid_sensor_hubs[i]->driver_data); + hid_data = cli_data->hid_sensor_hubs[i]->driver_data; hid_destroy_device(cli_data->hid_sensor_hubs[i]); + kfree(hid_data); cli_data->hid_sensor_hubs[i] = NULL; } } -- 2.34.1

2 1

[openeuler:OLK-6.6 11427/14193] loongarch64-linux-ld: rpm-traces.c:undefined reference to `__trace_trigger_soft_disabled'
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 515984f18a6f359887b37e95ef5a785b04ae2da7 commit: d14435b8c5cdcdadede980b086f439a7d6747d0c [11427/14193] LoongArch: Fix callchain parse error with kernel tracepoint events again config: loongarch-randconfig-002-20240925 (https://download.01.org/0day-ci/archive/20240927/202409271347.SHAKNDVo-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409271347.SHAKNDVo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271347.SHAKNDVo-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L572': power-traces.c:(.text+0x359c): undefined reference to `trace_event_printf' loongarch64-linux-ld: power-traces.c:(.text+0x35c0): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L580': power-traces.c:(.text+0x3678): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L581': power-traces.c:(.text+0x36ac): undefined reference to `trace_output_call' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L587': power-traces.c:(.text+0x3788): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_raw_output_pm_qos_update': power-traces.c:(.text+0x37dc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L100011': power-traces.c:(.text+0x39d8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L606': power-traces.c:(.text+0x3a3c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_wakeup_source': power-traces.c:(.text+0x3ae8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L615': power-traces.c:(.text+0x3b84): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L613': power-traces.c:(.text+0x3c0c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L638': power-traces.c:(.text+0x3f10): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L654': power-traces.c:(.text+0x3fcc): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L659': power-traces.c:(.text+0x40a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L667': power-traces.c:(.text+0x414c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L678': power-traces.c:(.text+0x4230): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L697': power-traces.c:(.text+0x43f4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L690': power-traces.c:(.text+0x4420): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: power-traces.c:(.text+0x4474): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L708': power-traces.c:(.text+0x44c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0xf0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x118): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x138): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x160): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x180): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x1a8): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x1c8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x1f0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x210): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x238): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x258): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x280): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x2a0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x2c8): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x2e8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x310): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x330): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x358): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x378): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x3a0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x3c0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x3e8): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x408): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x430): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `trace_raw_output_rpm_internal': rpm-traces.c:(.text+0x2a4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L49': rpm-traces.c:(.text+0x338): undefined reference to `trace_event_printf' loongarch64-linux-ld: rpm-traces.c:(.text+0x358): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `trace_raw_output_rpm_return_int': rpm-traces.c:(.text+0x384): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: rpm-traces.c:(.text+0x3dc): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L55': rpm-traces.c:(.text+0x3fc): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L59': rpm-traces.c:(.text+0x4bc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L62': rpm-traces.c:(.text+0x514): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `perf_trace_rpm_internal': rpm-traces.c:(.text+0x694): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L83': rpm-traces.c:(.text+0x734): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L96': rpm-traces.c:(.text+0x8a4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `trace_event_raw_event_rpm_return_int': rpm-traces.c:(.text+0x8d4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L118': rpm-traces.c:(.text+0x95c): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L101': rpm-traces.c:(.text+0x9c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L117': rpm-traces.c:(.text+0xa5c): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `trace_event_raw_event_rpm_internal': rpm-traces.c:(.text+0xad4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L130': rpm-traces.c:(.text+0xb5c): undefined reference to `trace_event_buffer_reserve' >> loongarch64-linux-ld: rpm-traces.c:(.text+0xba8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/rpm-traces.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/rpm-traces.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/rpm-traces.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/rpm-traces.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/rseq.o: in function `perf_trace_rseq_update': rseq.c:(.text+0x3d4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/rseq.o: in function `.L34': rseq.c:(.text+0x430): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/rseq.o: in function `perf_trace_rseq_ip_fixup': rseq.c:(.text+0x52c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/rseq.o: in function `.L46': rseq.c:(.text+0x568): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/rseq.o: in function `trace_event_raw_event_rseq_update': rseq.c:(.text+0x650): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/rseq.o: in function `.L61': rseq.c:(.text+0x690): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/rseq.o: in function `.L57': rseq.c:(.text+0x6e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/rseq.o: in function `trace_event_raw_event_rseq_ip_fixup': rseq.c:(.text+0x770): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: rseq.c:(.text+0x78c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/rseq.o: in function `.L68': rseq.c:(.text+0x7e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: rseq.c:(.text+0x81c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/rseq.o: in function `trace_raw_output_rseq_update': rseq.c:(.text+0x878): undefined reference to `trace_event_printf' loongarch64-linux-ld: rseq.c:(.text+0x898): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/rseq.o: in function `.L84': rseq.c:(.text+0x8c4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/rseq.o: in function `trace_raw_output_rseq_ip_fixup': rseq.c:(.text+0x91c): undefined reference to `trace_event_printf' loongarch64-linux-ld: rseq.c:(.text+0x93c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/rseq.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/rseq.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/rseq.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/rseq.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/filemap.o: in function `perf_trace_mm_filemap_op_page_cache': filemap.c:(.text+0x2ac): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/filemap.o: in function `.L54': filemap.c:(.text+0x390): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/filemap.o: in function `perf_trace_filemap_set_wb_err': filemap.c:(.text+0x494): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/filemap.o: in function `.L68': filemap.c:(.text+0x4e4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/filemap.o: in function `perf_trace_file_check_and_advance_wb_err': filemap.c:(.text+0x5d4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/filemap.o: in function `.L82': filemap.c:(.text+0x638): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/filemap.o: in function `.L94': filemap.c:(.text+0x720): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/filemap.o: in function `.L99': filemap.c:(.text+0x7e4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/filemap.o: in function `.L95': filemap.c:(.text+0x86c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/filemap.o: in function `.L96': filemap.c:(.text+0x8e8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/filemap.o: in function `trace_event_raw_event_filemap_set_wb_err': filemap.c:(.text+0x918): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/filemap.o: in function `.L115': filemap.c:(.text+0x988): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/filemap.o: in function `.L116': filemap.c:(.text+0x9f8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/filemap.o: in function `trace_event_raw_event_file_check_and_advance_wb_err': filemap.c:(.text+0xa40): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/filemap.o: in function `.L128': filemap.c:(.text+0xaac): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/filemap.o: in function `.L124': filemap.c:(.text+0xae4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/filemap.o: in function `trace_raw_output_mm_filemap_op_page_cache': filemap.c:(.text+0xb6c): undefined reference to `trace_event_printf' loongarch64-linux-ld: filemap.c:(.text+0xb8c): undefined reference to `trace_handle_return' loongarch64-linux-ld: filemap.c:(.text+0xbb4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/filemap.o: in function `.L142': filemap.c:(.text+0xc20): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/filemap.o: in function `trace_raw_output_filemap_set_wb_err': filemap.c:(.text+0xc40): undefined reference to `trace_handle_return' loongarch64-linux-ld: filemap.c:(.text+0xc6c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/filemap.o: in function `.L148': filemap.c:(.text+0xce8): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/filemap.o: in function `trace_raw_output_file_check_and_advance_wb_err': filemap.c:(.text+0xd08): undefined reference to `trace_handle_return' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_oom_score_adj_update': oom_kill.c:(.text+0x4a0): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `.L83': oom_kill.c:(.text+0x4fc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L82': oom_kill.c:(.text+0x578): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_reclaim_retry_zone': oom_kill.c:(.text+0x66c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `.L85': oom_kill.c:(.text+0x6c4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_mark_victim': oom_kill.c:(.text+0x7b4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `.L97': oom_kill.c:(.text+0x7e4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_wake_reaper': oom_kill.c:(.text+0x8b4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `.L109': oom_kill.c:(.text+0x8e4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_start_task_reaping': oom_kill.c:(.text+0x9b4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `.L121': oom_kill.c:(.text+0x9e4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_finish_task_reaping': oom_kill.c:(.text+0xab4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: oom_kill.c:(.text+0xae4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_skip_task_reaping': oom_kill.c:(.text+0xbb4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: oom_kill.c:(.text+0xbe4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_compact_retry': oom_kill.c:(.text+0xcdc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: oom_kill.c:(.text+0xd38): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L156': oom_kill.c:(.text+0xe0c): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_oom_score_adj_update': oom_kill.c:(.text+0xe40): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L175': oom_kill.c:(.text+0xe8c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_reclaim_retry_zone': oom_kill.c:(.text+0xf30): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: oom_kill.c:(.text+0xf6c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L187': oom_kill.c:(.text+0xfe8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `.L183': oom_kill.c:(.text+0x1058): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: oom_kill.c:(.text+0x1068): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_mark_victim': oom_kill.c:(.text+0x10a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `.L194': oom_kill.c:(.text+0x1118): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: oom_kill.c:(.text+0x1128): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_wake_reaper': oom_kill.c:(.text+0x1168): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `.L205': oom_kill.c:(.text+0x11d8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: oom_kill.c:(.text+0x11e8): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L206': oom_kill.c:(.text+0x1228): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `.L220': oom_kill.c:(.text+0x1298): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/oom_kill.o: in function `.L216': oom_kill.c:(.text+0x12a8): undefined reference to `trace_event_buffer_commit' >> loongarch64-linux-ld: oom_kill.c:(.text+0x12e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_finish_task_reaping': oom_kill.c:(.text+0x1358): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/oom_kill.o: in function `.L231': oom_kill.c:(.text+0x1368): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L227': oom_kill.c:(.text+0x13a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `.L242': oom_kill.c:(.text+0x1438): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/oom_kill.o: in function `.L238': oom_kill.c:(.text+0x1474): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_compact_retry': oom_kill.c:(.text+0x14ec): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: oom_kill.c:(.text+0x1524): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `.L249': oom_kill.c:(.text+0x1578): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x1598): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x15c4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_oom_score_adj_update': oom_kill.c:(.text+0x1610): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x1630): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x165c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_mark_victim': oom_kill.c:(.text+0x16b0): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x16d0): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x16fc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_wake_reaper': oom_kill.c:(.text+0x1750): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x1770): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x179c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `.L280': oom_kill.c:(.text+0x17f0): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_start_task_reaping': oom_kill.c:(.text+0x1810): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x183c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `.L286': oom_kill.c:(.text+0x1890): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_finish_task_reaping': oom_kill.c:(.text+0x18b0): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x18dc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `.L292': oom_kill.c:(.text+0x1938): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_skip_task_reaping': oom_kill.c:(.text+0x1970): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x1994): undefined reference to `trace_handle_return' loongarch64-linux-ld: mm/oom_kill.o: in function `.L298': oom_kill.c:(.text+0x19bc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_reclaim_retry_zone': oom_kill.c:(.text+0x1a28): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: oom_kill.c:(.text+0x1a40): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: mm/oom_kill.o: in function `.L304': oom_kill.c:(.text+0x1a68): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x1a94): undefined reference to `trace_handle_return' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0xf0): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x118): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x138): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x160): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x180): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x1a8): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x1c8): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x1f0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x210): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x238): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/swap.o: in function `.L20': swap.c:(.text+0x13c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: swap.c:(.text+0x1dc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/swap.o: in function `.L32': swap.c:(.text+0x2d4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/swap.o: in function `.L38': swap.c:(.text+0x42c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/swap.o: in function `trace_event_raw_event_mm_lru_insertion': swap.c:(.text+0x560): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/swap.o: in function `.L63': swap.c:(.text+0x69c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/swap.o: in function `.L75': swap.c:(.text+0x72c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/swap.o: in function `trace_event_raw_event_mm_lru_activate': swap.c:(.text+0x7c0): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/swap.o: in function `.L80': swap.c:(.text+0x844): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/swap.o: in function `.L76': swap.c:(.text+0x8ac): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: swap.c:(.text+0x8e4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/swap.o: in function `.L105': swap.c:(.text+0x978): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/swap.o: in function `.L107': swap.c:(.text+0x998): undefined reference to `trace_handle_return' loongarch64-linux-ld: mm/swap.o: in function `.L102': swap.c:(.text+0xa64): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/swap.o: in function `.L100': swap.c:(.text+0xab4): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/swap.o: in function `trace_raw_output_mm_lru_activate': swap.c:(.text+0xad4): undefined reference to `trace_handle_return' loongarch64-linux-ld: mm/swap.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/swap.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17806/23779] drivers/powercap/intel_rapl_msr.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: f9510969035e796a27375a80d9d6489440e17a1a commit: 0ea5d304521b68fb459c57e55f3f1bd853127bc7 [17806/23779] intel_rapl: abstract RAPL common code config: x86_64-buildonly-randconfig-001-20240926 (https://download.01.org/0day-ci/archive/20240927/202409271226.X7vYNpq3-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409271226.X7vYNpq3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271226.X7vYNpq3-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/powercap/intel_rapl_msr.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 11316/30000] arch/arm64/mm/init.c:730:6: sparse: sparse: symbol 'ascend_enable_all_features' was not declared. Should it be static?
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 6be8d57e8dd89fb93f6a1801c246e70ae85fbfaf commit: 66ae8ddda388386daea0623a65ea2ac85c24ca00 [11316/30000] ascend/arm64: Add ascend_enable_all kernel parameter config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240927/202409271256.FaGlmrJY-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240927/202409271256.FaGlmrJY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271256.FaGlmrJY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/arm64/mm/init.c:746:9: sparse: sparse: mixing declarations and code >> arch/arm64/mm/init.c:730:6: sparse: sparse: symbol 'ascend_enable_all_features' was not declared. Should it be static? vim +/ascend_enable_all_features +730 arch/arm64/mm/init.c 729 > 730 void ascend_enable_all_features(void) 731 { 732 if (IS_ENABLED(CONFIG_ASCEND_DVPP_MMAP)) 733 enable_mmap_dvpp = 1; 734 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 13350/23779] ld.lld: error: undefined symbol: kfree_skb
by kernel test robot 27 Sep '24

27 Sep '24

Hi Zhao, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: f9510969035e796a27375a80d9d6489440e17a1a commit: 6636f4434a9c5c9c645694db206188ee5a6626dd [13350/23779] ext4: report error to userspace by netlink config: x86_64-buildonly-randconfig-002-20240927 (https://download.01.org/0day-ci/archive/20240927/202409271130.zkdDo9UH-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409271130.zkdDo9UH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271130.zkdDo9UH-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: undefined symbol: __alloc_skb >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: kfree_skb >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: __nlmsg_put >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: netlink_broadcast >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: init_net >>> referenced by super.c >>> fs/ext4/super.o:(ext4_init_fs) in archive built-in.a -- >> ld.lld: error: undefined symbol: __netlink_kernel_create >>> referenced by super.c >>> fs/ext4/super.o:(ext4_init_fs) in archive built-in.a -- >> ld.lld: error: undefined symbol: netlink_kernel_release >>> referenced by super.c >>> fs/ext4/super.o:(ext4_exit_fs) in archive built-in.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] scsi: aacraid: Fix double-free on probe failure
by Zheng Qixing 27 Sep '24

27 Sep '24

From: Ben Hutchings <benh(a)debian.org> stable inclusion from stable-v4.19.321 commit d237c7d06ffddcdb5d36948c527dc01284388218 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR60F CVE: CVE-2024-46673 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 919ddf8336f0b84c0453bac583808c9f165a85c2 ] aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free. Reported-by: Michael Gordon <m.gordon.zelenoborsky(a)gmail.com> Link: https://bugs.debian.org/1075855 Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support") Signed-off-by: Ben Hutchings <benh(a)debian.org> Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/aacraid/comminit.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c index 0dc7b5a4fea2..0378fd3eb039 100644 --- a/drivers/scsi/aacraid/comminit.c +++ b/drivers/scsi/aacraid/comminit.c @@ -652,6 +652,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) if (aac_comm_init(dev)<0){ kfree(dev->queues); + dev->queues = NULL; return NULL; } /* @@ -659,6 +660,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) */ if (aac_fib_setup(dev) < 0) { kfree(dev->queues); + dev->queues = NULL; return NULL; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] scsi: aacraid: Fix double-free on probe failure
by Zheng Qixing 27 Sep '24

27 Sep '24

From: Ben Hutchings <benh(a)debian.org> stable inclusion from stable-v5.10.225 commit 9e96dea7eff6f2bbcd0b42a098012fc66af9eb69 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR60F CVE: CVE-2024-46673 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 919ddf8336f0b84c0453bac583808c9f165a85c2 ] aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free. Reported-by: Michael Gordon <m.gordon.zelenoborsky(a)gmail.com> Link: https://bugs.debian.org/1075855 Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support") Signed-off-by: Ben Hutchings <benh(a)debian.org> Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/aacraid/comminit.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c index 355b16f0b145..34e45c87cae0 100644 --- a/drivers/scsi/aacraid/comminit.c +++ b/drivers/scsi/aacraid/comminit.c @@ -642,6 +642,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) if (aac_comm_init(dev)<0){ kfree(dev->queues); + dev->queues = NULL; return NULL; } /* @@ -649,6 +650,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) */ if (aac_fib_setup(dev) < 0) { kfree(dev->queues); + dev->queues = NULL; return NULL; } -- 2.39.2

2 1

[PATCH OLK-5.10] scsi: aacraid: Fix double-free on probe failure
by Zheng Qixing 27 Sep '24

27 Sep '24

From: Ben Hutchings <benh(a)debian.org> stable inclusion from stable-v5.10.225 commit 9e96dea7eff6f2bbcd0b42a098012fc66af9eb69 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR60F CVE: CVE-2024-46673 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 919ddf8336f0b84c0453bac583808c9f165a85c2 ] aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free. Reported-by: Michael Gordon <m.gordon.zelenoborsky(a)gmail.com> Link: https://bugs.debian.org/1075855 Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support") Signed-off-by: Ben Hutchings <benh(a)debian.org> Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/aacraid/comminit.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c index 355b16f0b145..34e45c87cae0 100644 --- a/drivers/scsi/aacraid/comminit.c +++ b/drivers/scsi/aacraid/comminit.c @@ -642,6 +642,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) if (aac_comm_init(dev)<0){ kfree(dev->queues); + dev->queues = NULL; return NULL; } /* @@ -649,6 +650,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) */ if (aac_fib_setup(dev) < 0) { kfree(dev->queues); + dev->queues = NULL; return NULL; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2022-48878
by Yuan Can 27 Sep '24

27 Sep '24

Fix patch of CVE-2022-48878 and its pre requests. Krzysztof Kozlowski (1): Bluetooth: hci_qca: Fix driver shutdown on closed serdev Venkata Lakshmi Narayana Gubba (1): Bluetooth: hci_qca: Wait for timeout during suspend Yang Yingliang (1): Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() drivers/bluetooth/hci_qca.c | 57 ++++++++++++++++++++++++++++++------- 1 file changed, 47 insertions(+), 10 deletions(-) -- 2.17.1

2 4

[PATCH OLK-6.6] scsi: aacraid: Fix double-free on probe failure
by Zheng Qixing 27 Sep '24

27 Sep '24

From: Ben Hutchings <benh(a)debian.org> stable inclusion from stable-v6.6.49 commit 8a3995a3ffeca280a961b59f5c99843d81b15929 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR60F CVE: CVE-2024-46673 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free. Reported-by: Michael Gordon <m.gordon.zelenoborsky(a)gmail.com> Link: https://bugs.debian.org/1075855 Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support") Signed-off-by: Ben Hutchings <benh(a)debian.org> Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/aacraid/comminit.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c index bd99c5492b7d..0f64b0244303 100644 --- a/drivers/scsi/aacraid/comminit.c +++ b/drivers/scsi/aacraid/comminit.c @@ -642,6 +642,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) if (aac_comm_init(dev)<0){ kfree(dev->queues); + dev->queues = NULL; return NULL; } /* @@ -649,6 +650,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) */ if (aac_fib_setup(dev) < 0) { kfree(dev->queues); + dev->queues = NULL; return NULL; } -- 2.39.2

2 1

[PATCH OLK-6.6] tracing/osnoise: Use a cpumask to know what threads are kthreads
by Zheng Yejian 27 Sep '24

27 Sep '24

From: Steven Rostedt <rostedt(a)goodmis.org> stable inclusion from stable-v6.6.51 commit 7a5f01828edf152c144d27cf63de446fdf2dc222 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYEK CVE: CVE-2024-46788 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 177e1cc2f41235c145041eed03ef5bab18f32328 upstream. The start_kthread() and stop_thread() code was not always called with the interface_lock held. This means that the kthread variable could be unexpectedly changed causing the kthread_stop() to be called on it when it should not have been, leading to: while true; do rtla timerlat top -u -q & PID=$!; sleep 5; kill -INT $PID; sleep 0.001; kill -TERM $PID; wait $PID; done Causing the following OOPS: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:hrtimer_active+0x58/0x300 Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 <0f> b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f RSP: 0018:ffff88811d97f940 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28 RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60 R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28 FS: 0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0 Call Trace: <TASK> ? die_addr+0x40/0xa0 ? exc_general_protection+0x154/0x230 ? asm_exc_general_protection+0x26/0x30 ? hrtimer_active+0x58/0x300 ? __pfx_mutex_lock+0x10/0x10 ? __pfx_locks_remove_file+0x10/0x10 hrtimer_cancel+0x15/0x40 timerlat_fd_release+0x8e/0x1f0 ? security_file_release+0x43/0x80 __fput+0x372/0xb10 task_work_run+0x11e/0x1f0 ? _raw_spin_lock+0x85/0xe0 ? __pfx_task_work_run+0x10/0x10 ? poison_slab_object+0x109/0x170 ? do_exit+0x7a0/0x24b0 do_exit+0x7bd/0x24b0 ? __pfx_migrate_enable+0x10/0x10 ? __pfx_do_exit+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x64/0x140 ? _raw_spin_lock_irq+0x86/0xe0 do_group_exit+0xb0/0x220 get_signal+0x17ba/0x1b50 ? vfs_read+0x179/0xa40 ? timerlat_fd_read+0x30b/0x9d0 ? __pfx_get_signal+0x10/0x10 ? __pfx_timerlat_fd_read+0x10/0x10 arch_do_signal_or_restart+0x8c/0x570 ? __pfx_arch_do_signal_or_restart+0x10/0x10 ? vfs_read+0x179/0xa40 ? ksys_read+0xfe/0x1d0 ? __pfx_ksys_read+0x10/0x10 syscall_exit_to_user_mode+0xbc/0x130 do_syscall_64+0x74/0x110 ? __pfx___rseq_handle_notify_resume+0x10/0x10 ? __pfx_ksys_read+0x10/0x10 ? fpregs_restore_userregs+0xdb/0x1e0 ? fpregs_restore_userregs+0xdb/0x1e0 ? syscall_exit_to_user_mode+0x116/0x130 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 entry_SYSCALL_64_after_hwframe+0x71/0x79 RIP: 0033:0x7ff0070eca9c Code: Unable to access opcode bytes at 0x7ff0070eca72. RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003 RBP: 00007ff006dffde0 R08: 0000000000000000 R09: 00007ff000000ba0 R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003 R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008 </TASK> Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core ---[ end trace 0000000000000000 ]--- This is because it would mistakenly call kthread_stop() on a user space thread making it "exit" before it actually exits. Since kthreads are created based on global behavior, use a cpumask to know when kthreads are running and that they need to be shutdown before proceeding to do new work. Link: https://lore.kernel.org/all/20240820130001.124768-1-tglozar@redhat.com/ This was debugged by using the persistent ring buffer: Link: https://lore.kernel.org/all/20240823013902.135036960@goodmis.org/ Note, locking was originally used to fix this, but that proved to cause too many deadlocks to work around: https://lore.kernel.org/linux-trace-kernel/20240823102816.5e55753b@gandalf.… Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: "Luis Claudio R. Goncalves" <lgoncalv(a)redhat.com> Link: https://lore.kernel.org/20240904103428.08efdf4c@gandalf.local.home Fixes: e88ed227f639e ("tracing/timerlat: Add user-space interface") Reported-by: Tomas Glozar <tglozar(a)redhat.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/trace_osnoise.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c index a8e28f9b9271..49f10c7f7fd0 100644 --- a/kernel/trace/trace_osnoise.c +++ b/kernel/trace/trace_osnoise.c @@ -1612,6 +1612,7 @@ static int run_osnoise(void) static struct cpumask osnoise_cpumask; static struct cpumask save_cpumask; +static struct cpumask kthread_cpumask; /* * osnoise_sleep - sleep until the next period @@ -1675,6 +1676,7 @@ static inline int osnoise_migration_pending(void) */ mutex_lock(&interface_lock); this_cpu_osn_var()->kthread = NULL; + cpumask_clear_cpu(smp_processor_id(), &kthread_cpumask); mutex_unlock(&interface_lock); return 1; @@ -1947,9 +1949,10 @@ static void stop_kthread(unsigned int cpu) kthread = per_cpu(per_cpu_osnoise_var, cpu).kthread; if (kthread) { - if (test_bit(OSN_WORKLOAD, &osnoise_options)) { + if (cpumask_test_and_clear_cpu(cpu, &kthread_cpumask) && + !WARN_ON(!test_bit(OSN_WORKLOAD, &osnoise_options))) { kthread_stop(kthread); - } else { + } else if (!WARN_ON(test_bit(OSN_WORKLOAD, &osnoise_options))) { /* * This is a user thread waiting on the timerlat_fd. We need * to close all users, and the best way to guarantee this is @@ -2021,6 +2024,7 @@ static int start_kthread(unsigned int cpu) } per_cpu(per_cpu_osnoise_var, cpu).kthread = kthread; + cpumask_set_cpu(cpu, &kthread_cpumask); return 0; } @@ -2048,8 +2052,16 @@ static int start_per_cpu_kthreads(void) */ cpumask_and(current_mask, cpu_online_mask, &osnoise_cpumask); - for_each_possible_cpu(cpu) + for_each_possible_cpu(cpu) { + if (cpumask_test_and_clear_cpu(cpu, &kthread_cpumask)) { + struct task_struct *kthread; + + kthread = per_cpu(per_cpu_osnoise_var, cpu).kthread; + if (!WARN_ON(!kthread)) + kthread_stop(kthread); + } per_cpu(per_cpu_osnoise_var, cpu).kthread = NULL; + } for_each_cpu(cpu, current_mask) { retval = start_kthread(cpu); -- 2.25.1

2 1

[PATCH OLK-6.6] wifi: rtw88: usb: schedule rx work after everything is set up
by Chen Zhongjin 27 Sep '24

27 Sep '24

From: Marcin Ślusarz <mslusarz(a)renau.com> mainline inclusion from mainline-v6.11-rc1 commit adc539784c98a7cc602cbf557debfc2e7b9be8b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYFO CVE: CVE-2024-46760 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Right now it's possible to hit NULL pointer dereference in rtw_rx_fill_rx_status on hw object and/or its fields because initialization routine can start getting USB replies before rtw_dev is fully setup. The stack trace looks like this: rtw_rx_fill_rx_status rtw8821c_query_rx_desc rtw_usb_rx_handler ... queue_work rtw_usb_read_port_complete ... usb_submit_urb rtw_usb_rx_resubmit rtw_usb_init_rx rtw_usb_probe So while we do the async stuff rtw_usb_probe continues and calls rtw_register_hw, which does all kinds of initialization (e.g. via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on. Fix this by moving the first usb_submit_urb after everything is set up. For me, this bug manifested as: [ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped [ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_status because I'm using Larry's backport of rtw88 driver with the NULL checks in rtw_rx_fill_rx_status. Link: https://lore.kernel.org/linux-wireless/CA+shoWQ7P49jhQasofDcTdQhiuarPTjYEDa… Signed-off-by: Marcin Ślusarz <mslusarz(a)renau.com> Cc: Tim K <tpkuester(a)gmail.com> Cc: Ping-Ke Shih <pkshih(a)realtek.com> Cc: Larry Finger <Larry.Finger(a)lwfinger.net> Cc: Kalle Valo <kvalo(a)kernel.org> Cc: linux-wireless(a)vger.kernel.org Cc: linux-kernel(a)vger.kernel.org Signed-off-by: Ping-Ke Shih <pkshih(a)realtek.com> Link: https://patch.msgid.link/20240528110246.477321-1-marcin.slusarz@gmail.com Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/net/wireless/realtek/rtw88/usb.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c index efd0c2915a05..04a64afcbf8a 100644 --- a/drivers/net/wireless/realtek/rtw88/usb.c +++ b/drivers/net/wireless/realtek/rtw88/usb.c @@ -742,7 +742,6 @@ static struct rtw_hci_ops rtw_usb_ops = { static int rtw_usb_init_rx(struct rtw_dev *rtwdev) { struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev); - int i; rtwusb->rxwq = create_singlethread_workqueue("rtw88_usb: rx wq"); if (!rtwusb->rxwq) { @@ -754,13 +753,19 @@ static int rtw_usb_init_rx(struct rtw_dev *rtwdev) INIT_WORK(&rtwusb->rx_work, rtw_usb_rx_handler); + return 0; +} + +static void rtw_usb_setup_rx(struct rtw_dev *rtwdev) +{ + struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev); + int i; + for (i = 0; i < RTW_USB_RXCB_NUM; i++) { struct rx_usb_ctrl_block *rxcb = &rtwusb->rx_cb[i]; rtw_usb_rx_resubmit(rtwusb, rxcb); } - - return 0; } static void rtw_usb_deinit_rx(struct rtw_dev *rtwdev) @@ -897,6 +902,8 @@ int rtw_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) goto err_destroy_rxwq; } + rtw_usb_setup_rx(rtwdev); + return 0; err_destroy_rxwq: -- 2.25.1

2 1

[PATCH OLK-5.10] hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
by Tong Tiangen 27 Sep '24

27 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> stable inclusion from stable-v5.10.226 commit 56cfdeb2c77291f0b5e4592731adfb6ca8fc7c24 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX5F CVE: CVE-2024-46756 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5c1de37969b7bc0abcb20b86e91e70caebbd4f89 ] DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- drivers/hwmon/w83627ehf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c index 3964ceab2817..acf36862851a 100644 --- a/drivers/hwmon/w83627ehf.c +++ b/drivers/hwmon/w83627ehf.c @@ -897,7 +897,7 @@ store_target_temp(struct device *dev, struct device_attribute *attr, if (err < 0) return err; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 127000), 1000); mutex_lock(&data->update_lock); data->target_temp[nr] = val; @@ -922,7 +922,7 @@ store_tolerance(struct device *dev, struct device_attribute *attr, return err; /* Limit the temp to 0C - 15C */ - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 15); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 15000), 1000); mutex_lock(&data->update_lock); reg = w83627ehf_read_value(data, W83627EHF_REG_TOLERANCE[nr]); -- 2.25.1

2 1

[openeuler:OLK-5.10 5206/30000] drivers/gpu/drm/radeon/radeon_vce.c:247:25: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 6be8d57e8dd89fb93f6a1801c246e70ae85fbfaf commit: ec4ae62c07d56281aacec51770e0453414a76ded [5206/30000] sw64: gpu/drm: solve driver load cause kernel crash config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240927/202409270508.u8KdTEFv-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240927/202409270508.u8KdTEFv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270508.u8KdTEFv-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/gpu/drm/radeon/radeon_vce.c:247:25: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got void *[addressable] cpu_addr @@ drivers/gpu/drm/radeon/radeon_vce.c:247:25: sparse: expected void volatile [noderef] __iomem * drivers/gpu/drm/radeon/radeon_vce.c:247:25: sparse: got void *[addressable] cpu_addr drivers/gpu/drm/radeon/radeon_vce.c:368:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:368:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:368:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:369:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:369:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:369:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:370:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:370:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:370:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:372:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:372:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:372:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:373:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:373:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:373:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:374:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:374:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:374:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:375:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:375:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:375:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:376:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:376:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:376:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:377:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:377:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:377:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:378:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:378:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:378:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:379:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:379:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:379:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:380:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:380:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:380:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:381:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:381:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:381:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:382:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:382:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:382:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:383:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:383:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:383:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:385:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:385:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:385:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:386:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:386:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:386:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:387:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:387:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:387:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:388:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:388:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:388:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:389:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:389:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:389:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:392:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:392:27: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:392:27: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:435:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:435:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:435:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:436:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:436:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:436:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:437:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:437:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:437:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:439:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:439:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:439:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:440:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:440:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:440:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:441:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:441:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:441:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:442:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:442:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:442:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:443:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:443:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:443:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:445:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:445:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:445:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:446:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:446:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:446:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:449:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:449:27: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:449:27: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:706:33: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected unsigned int [usertype] v @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:706:33: sparse: expected unsigned int [usertype] v vim +247 drivers/gpu/drm/radeon/radeon_vce.c 214 215 /** 216 * radeon_vce_resume - pin VCE fw memory 217 * 218 * @rdev: radeon_device pointer 219 * 220 */ 221 int radeon_vce_resume(struct radeon_device *rdev) 222 { 223 void *cpu_addr; 224 int r; 225 226 if (rdev->vce.vcpu_bo == NULL) 227 return -EINVAL; 228 229 r = radeon_bo_reserve(rdev->vce.vcpu_bo, false); 230 if (r) { 231 dev_err(rdev->dev, "(%d) failed to reserve VCE bo\n", r); 232 return r; 233 } 234 235 r = radeon_bo_kmap(rdev->vce.vcpu_bo, &cpu_addr); 236 if (r) { 237 radeon_bo_unreserve(rdev->vce.vcpu_bo); 238 dev_err(rdev->dev, "(%d) VCE map failed\n", r); 239 return r; 240 } 241 242 memset(cpu_addr, 0, radeon_bo_size(rdev->vce.vcpu_bo)); 243 if (rdev->family < CHIP_BONAIRE) 244 r = vce_v1_0_load_fw(rdev, cpu_addr); 245 else { 246 if (IS_ENABLED(CONFIG_SW64)) > 247 memcpy_toio(cpu_addr, rdev->vce_fw->data, rdev->vce_fw->size); 248 else 249 memcpy(cpu_addr, rdev->vce_fw->data, rdev->vce_fw->size); 250 } 251 252 radeon_bo_kunmap(rdev->vce.vcpu_bo); 253 254 radeon_bo_unreserve(rdev->vce.vcpu_bo); 255 256 return r; 257 } 258 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9419/14172] main.c:undefined reference to `perf_trace_run_bpf_submit'
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2e95e7bae9486cc775ed2aa319bf323f6ba2677b commit: c03a541494af4fb1504917412d762247b90380da [9419/14172] LoongArch: Fix callchain parse error with kernel tracepoint events config: loongarch-randconfig-002-20240925 (https://download.01.org/0day-ci/archive/20240927/202409270442.VcOKC2UZ-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409270442.VcOKC2UZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270442.VcOKC2UZ-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/oom_kill.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/oom_kill.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/swap.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/vmscan.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/vmscan.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/percpu.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/percpu.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/slab_common.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/slab_common.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/compaction.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/compaction.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/mmap_lock.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/mmap.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/rmap.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/rmap.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/vmalloc.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/huge_memory.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/khugepaged.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/khugepaged.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/page_isolation.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/cma.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/damon/core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/fs-writeback.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/fs-writeback.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/locks.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/iomap/trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/ext4/super.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/ext4/super.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/ext2/trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/jbd2/journal.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/xfs/xfs_trace.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/xfs/xfs_trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/xfs/scrub/trace.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/xfs/scrub/trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/btrfs/super.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/btrfs/super.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/gfs2/glock.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/f2fs/super.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/f2fs/super.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/zonefs/super.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `block/blk-core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `block/blk-iocost.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `block/blk-wbt.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `io_uring/io_uring.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpio/gpiolib.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/clk/clk.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/dma/tegra20-apb-dma.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/soc/qcom/rpmh-rsc.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/regulator/core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/iommu/iommu-traces.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/host1x/dev.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/drm_trace_points.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/scheduler/sched_main.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/radeon/radeon_trace_points.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/amd/amdgpu/amdgpu_trace_points.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/v3d/v3d_trace_points.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/msm/disp/dpu1/dpu_kms.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/msm/msm_atomic_tracepoints.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/msm/msm_gpu_tracepoints.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/tegra/trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/lima/lima_trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/base/regmap/regmap.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/dma-buf/dma-fence.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/dma-buf/sw_sync.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/scsi/scsi.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/scsi/sd_zbc.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/nvme/host/core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/target/target_core_transport.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/spi/spi.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/spmi/spmi.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/usb/host/xhci-trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/usb/musb/musb_trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/input/keyboard/applespi.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/i2c/i2c-core-base.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/i2c/i2c-core-smbus.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `drivers/i2c/i2c-core-slave.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/i2c/i2c-core-slave.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/hwmon/hwmon.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `drivers/thermal/thermal_core.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/thermal/thermal_core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/mmc/core/core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `drivers/ufs/core/ufshcd.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/ufs/core/ufshcd.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/platform/chrome/cros_ec_trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/devfreq/devfreq.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/android/binder.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/fsi/fsi-core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/fsi/fsi-master-aspeed.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/fsi/fsi-master-gpio.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/fsi/fsi-master-ast-cf.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/interconnect/core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `sound/core/pcm_native.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `sound/core/pcm_lib.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `lib/maple_tree.o' being placed in section `_ftrace_events' loongarch64-linux-ld: init/main.o: in function `.L199': main.c:(.text+0x200): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: main.c:(.text+0x250): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: init/main.o: in function `perf_trace_initcall_start': main.c:(.text+0x36c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: init/main.o: in function `.L213': >> main.c:(.text+0x3a0): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: init/main.o: in function `perf_trace_initcall_finish': main.c:(.text+0x47c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: init/main.o: in function `.L225': main.c:(.text+0x4b4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: init/main.o: in function `trace_event_raw_event_initcall_start': main.c:(.text+0x590): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: main.c:(.text+0x5a0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: init/main.o: in function `.L236': main.c:(.text+0x5e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: init/main.o: in function `trace_event_raw_event_initcall_finish': main.c:(.text+0x660): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: main.c:(.text+0x674): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: init/main.o: in function `.L247': main.c:(.text+0x6c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: main.c:(.text+0x6fc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: init/main.o: in function `trace_raw_output_initcall_level': main.c:(.text+0x754): undefined reference to `trace_event_printf' loongarch64-linux-ld: main.c:(.text+0x774): undefined reference to `trace_handle_return' loongarch64-linux-ld: init/main.o: in function `.L263': main.c:(.text+0x79c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: init/main.o: in function `trace_raw_output_initcall_start': main.c:(.text+0x7f0): undefined reference to `trace_event_printf' loongarch64-linux-ld: main.c:(.text+0x810): undefined reference to `trace_handle_return' loongarch64-linux-ld: main.c:(.text+0x83c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: init/main.o: in function `trace_raw_output_initcall_finish': main.c:(.text+0x894): undefined reference to `trace_event_printf' loongarch64-linux-ld: main.c:(.text+0x8b4): undefined reference to `trace_handle_return' loongarch64-linux-ld: init/main.o: in function `trace_event_raw_event_initcall_level': main.c:(.text+0x938): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: main.c:(.text+0x954): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: init/main.o: in function `.L312': main.c:(.text+0x9bc): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: init/main.o: in function `.L299': main.c:(.text+0xa08): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: init/main.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: init/main.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: init/main.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: init/main.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: init/main.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: init/main.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/fork.o: in function `perf_trace_task_newtask': fork.c:(.text+0x178): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `.L34': fork.c:(.text+0x1dc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/fork.o: in function `.L21': fork.c:(.text+0x258): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `trace_event_raw_event_task_newtask': fork.c:(.text+0x2d4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/fork.o: in function `.L39': fork.c:(.text+0x30c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/fork.o: in function `.L35': fork.c:(.text+0x34c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/fork.o: in function `.L36': fork.c:(.text+0x384): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/fork.o: in function `trace_raw_output_task_newtask': fork.c:(.text+0x3dc): undefined reference to `trace_event_printf' loongarch64-linux-ld: fork.c:(.text+0x3fc): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/fork.o: in function `.L52': fork.c:(.text+0x424): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/fork.o: in function `trace_raw_output_task_rename': fork.c:(.text+0x47c): undefined reference to `trace_event_printf' loongarch64-linux-ld: fork.c:(.text+0x49c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/fork.o: in function `.L58': fork.c:(.text+0x510): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `perf_trace_task_rename': fork.c:(.text+0x580): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/fork.o: in function `.L72': fork.c:(.text+0x5f8): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `.L71': fork.c:(.text+0x678): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/fork.o: in function `trace_event_raw_event_task_rename': fork.c:(.text+0x6bc): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/fork.o: in function `.L77': fork.c:(.text+0x708): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cpu.o: in function `perf_trace_cpuhp_enter': cpu.c:(.text+0x2dc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cpu.o: in function `.L35': cpu.c:(.text+0x31c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cpu.o: in function `perf_trace_cpuhp_multi_enter': cpu.c:(.text+0x40c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cpu.o: in function `.L47': cpu.c:(.text+0x44c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cpu.o: in function `perf_trace_cpuhp_exit': cpu.c:(.text+0x54c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cpu.o: in function `.L59': cpu.c:(.text+0x58c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cpu.o: in function `trace_event_raw_event_cpuhp_enter': cpu.c:(.text+0x688): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: cpu.c:(.text+0x6a4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cpu.o: in function `.L70': cpu.c:(.text+0x708): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cpu.o: in function `trace_event_raw_event_cpuhp_multi_enter': cpu.c:(.text+0x790): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: cpu.c:(.text+0x7ac): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cpu.o: in function `.L81': cpu.c:(.text+0x808): undefined reference to `__trace_trigger_soft_disabled' -- loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/smp.o: in function `perf_trace_csd_queue_cpu': smp.c:(.text+0x224): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/smp.o: in function `.L30': smp.c:(.text+0x264): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/smp.o: in function `perf_trace_csd_function': smp.c:(.text+0x33c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/smp.o: in function `.L42': smp.c:(.text+0x374): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/smp.o: in function `trace_event_raw_event_csd_queue_cpu': smp.c:(.text+0x468): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: smp.c:(.text+0x484): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/smp.o: in function `.L53': smp.c:(.text+0x4e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/smp.o: in function `trace_event_raw_event_csd_function': smp.c:(.text+0x560): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: smp.c:(.text+0x574): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/smp.o: in function `.L64': smp.c:(.text+0x5c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/smp.o: in function `.L65': smp.c:(.text+0x5fc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/smp.o: in function `trace_raw_output_csd_queue_cpu': smp.c:(.text+0x65c): undefined reference to `trace_event_printf' loongarch64-linux-ld: smp.c:(.text+0x67c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/smp.o: in function `.L80': smp.c:(.text+0x6a4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/smp.o: in function `trace_raw_output_csd_function': smp.c:(.text+0x6f4): undefined reference to `trace_event_printf' loongarch64-linux-ld: smp.c:(.text+0x714): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L255': kexec_core.c:(.text+0x1b10): undefined reference to `machine_kexec_cleanup' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L296': kexec_core.c:(.text+0x1d70): undefined reference to `machine_crash_shutdown' loongarch64-linux-ld: kexec_core.c:(.text+0x1d78): undefined reference to `machine_kexec' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L383': kexec_core.c:(.text+0x2350): undefined reference to `machine_shutdown' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L380': kexec_core.c:(.text+0x2360): undefined reference to `machine_kexec' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L128': cgroup.c:(.text+0x868): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L129': cgroup.c:(.text+0x8d4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `perf_trace_cgroup_event': cgroup.c:(.text+0xa40): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L147': cgroup.c:(.text+0xab4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L169': cgroup.c:(.text+0xd70): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L21': cgroup.c:(.text+0xdb4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L193': cgroup.c:(.text+0xe68): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L192': cgroup.c:(.text+0xe9c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L189': cgroup.c:(.text+0xefc): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L200': cgroup.c:(.text+0xf1c): undefined reference to `trace_handle_return' loongarch64-linux-ld: cgroup.c:(.text+0xf44): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L201': cgroup.c:(.text+0xfa0): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `trace_raw_output_cgroup_root': cgroup.c:(.text+0xfc0): undefined reference to `trace_handle_return' loongarch64-linux-ld: cgroup.c:(.text+0xfec): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L207': cgroup.c:(.text+0x106c): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `trace_raw_output_cgroup': cgroup.c:(.text+0x108c): undefined reference to `trace_handle_return' loongarch64-linux-ld: cgroup.c:(.text+0x10b4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L213': cgroup.c:(.text+0x1124): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `trace_raw_output_cgroup_migrate': cgroup.c:(.text+0x1144): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L730': cgroup.c:(.text+0x3e5c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L15': cgroup.c:(.text+0x3ef4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L756': cgroup.c:(.text+0x4050): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `css_create': cgroup.c:(.text+0x40c0): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L769': cgroup.c:(.text+0x4234): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: cgroup.c:(.text+0x4278): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L772': cgroup.c:(.text+0x42d4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L775': cgroup.c:(.text+0x4328): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `perf_trace_cgroup_migrate': cgroup.c:(.text+0x43c4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L782': cgroup.c:(.text+0x43f4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L784': cgroup.c:(.text+0x444c): undefined reference to `trace_event_buffer_reserve' >> loongarch64-linux-ld: cgroup.c:(.text+0x44a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L788': cgroup.c:(.text+0x4580): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `perf_trace_cgroup': cgroup.c:(.text+0x45e8): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L802': cgroup.c:(.text+0x46c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0xf0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x118): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L12': error_report-traces.c:(.text+0xec): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: error_report-traces.c:(.text+0x124): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `trace_event_raw_event_error_report_template': error_report-traces.c:(.text+0x1f8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L27': error_report-traces.c:(.text+0x20c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L23': error_report-traces.c:(.text+0x248): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L24': error_report-traces.c:(.text+0x27c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `trace_raw_output_error_report_template': error_report-traces.c:(.text+0x2d0): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: error_report-traces.c:(.text+0x2e8): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L39': error_report-traces.c:(.text+0x308): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/trace/error_report-traces.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/error_report-traces.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_cpu': power-traces.c:(.text+0xdb4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L209': power-traces.c:(.text+0xdec): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_cpu_idle_miss': power-traces.c:(.text+0xec4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L221': power-traces.c:(.text+0xf00): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_pstate_sample': power-traces.c:(.text+0x1010): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L233': power-traces.c:(.text+0x106c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_cpu_frequency_limits': power-traces.c:(.text+0x1154): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: power-traces.c:(.text+0x119c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_suspend_resume': power-traces.c:(.text+0x1284): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: power-traces.c:(.text+0x12c0): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L267': power-traces.c:(.text+0x1394): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_cpu_latency_qos_request': power-traces.c:(.text+0x13c8): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L268': power-traces.c:(.text+0x14a4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_pm_qos_update': power-traces.c:(.text+0x14e0): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L280': power-traces.c:(.text+0x15c4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_guest_halt_poll_ns': power-traces.c:(.text+0x1600): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L292': power-traces.c:(.text+0x16d8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x16ec): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_cpu': power-traces.c:(.text+0x1728): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L304': power-traces.c:(.text+0x17a8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x17c0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_cpu_idle_miss': power-traces.c:(.text+0x1808): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L315': power-traces.c:(.text+0x18b0): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x18e0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_pstate_sample': power-traces.c:(.text+0x194c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L330': power-traces.c:(.text+0x19b8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L326': power-traces.c:(.text+0x19e0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: power-traces.c:(.text+0x1a2c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L341': power-traces.c:(.text+0x1ab0): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x1ac8): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L338': power-traces.c:(.text+0x1b28): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_suspend_resume': power-traces.c:(.text+0x1b98): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x1ba8): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L348': power-traces.c:(.text+0x1be8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_cpu_latency_qos_request': power-traces.c:(.text+0x1c68): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x1c80): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L359': power-traces.c:(.text+0x1cc8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_pm_qos_update': power-traces.c:(.text+0x1d48): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x1d60): undefined reference to `trace_event_buffer_commit' Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20217/23779] mm/hugetlb.c:1370:6: sparse: sparse: symbol 'free_huge_page_to_dhugetlb_pool' was not declared. Should it be static?
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b1d54e6f06c518a52f83edade0da2b959e1c9a4e commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [20217/23779] dhugetlb: backport dynamic hugetlb feature config: x86_64-randconfig-123-20240926 (https://download.01.org/0day-ci/archive/20240927/202409270316.mecxJZQM-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409270316.mecxJZQM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270316.mecxJZQM-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/hugetlb.c:1370:6: sparse: sparse: symbol 'free_huge_page_to_dhugetlb_pool' was not declared. Should it be static? mm/hugetlb.c:4438:58: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void [noderef] <asn:1> * @@ got void *buffer @@ mm/hugetlb.c:4438:58: sparse: expected void [noderef] <asn:1> * mm/hugetlb.c:4438:58: sparse: got void *buffer mm/hugetlb.c:4452:60: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void *buffer @@ got void [noderef] <asn:1> *buffer @@ mm/hugetlb.c:4452:60: sparse: expected void *buffer mm/hugetlb.c:4452:60: sparse: got void [noderef] <asn:1> *buffer mm/hugetlb.c:4510:60: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void *buffer @@ got void [noderef] <asn:1> *buffer @@ mm/hugetlb.c:4510:60: sparse: expected void *buffer mm/hugetlb.c:4510:60: sparse: got void [noderef] <asn:1> *buffer mm/hugetlb.c:2018:20: sparse: sparse: context imbalance in 'gather_surplus_pages' - unexpected unlock mm/hugetlb.c:5168:17: sparse: sparse: context imbalance in 'hugetlb_cow' - unexpected unlock mm/hugetlb.c:5881:25: sparse: sparse: context imbalance in 'follow_hugetlb_page' - different lock contexts for basic block mm/hugetlb.c:1370:6: warning: no previous prototype for 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/hugetlb.c:14: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ vim +/free_huge_page_to_dhugetlb_pool +1370 mm/hugetlb.c 1324 1325 #ifdef CONFIG_DYNAMIC_HUGETLB 1326 static void free_huge_page_to_dhugetlb_pool(struct page *page, 1327 bool restore_reserve) 1328 { 1329 struct hstate *h = page_hstate(page); 1330 struct dhugetlb_pool *hpool; 1331 1332 hpool = get_dhugetlb_pool_from_dhugetlb_pagelist(page); 1333 if (unlikely(!hpool)) { 1334 pr_err("dhugetlb: free error: get hpool failed\n"); 1335 return; 1336 } 1337 1338 spin_lock(&hpool->lock); 1339 ClearPagePool(page); 1340 set_compound_page_dtor(page, NULL_COMPOUND_DTOR); 1341 if (!hstate_is_gigantic(h)) { 1342 list_add(&page->lru, &hpool->dhugetlb_2M_freelists); 1343 hpool->free_reserved_2M++; 1344 hpool->used_2M--; 1345 if (restore_reserve) { 1346 hpool->mmap_reserved_2M++; 1347 trace_dhugetlb_acct_memory(hpool, 1348 hpool->mmap_reserved_2M, 1349 DHUGETLB_RESV_2M); 1350 } 1351 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_2M, 1352 DHUGETLB_FREE_2M); 1353 } else { 1354 list_add(&page->lru, &hpool->dhugetlb_1G_freelists); 1355 hpool->free_reserved_1G++; 1356 hpool->used_1G--; 1357 if (restore_reserve) { 1358 hpool->mmap_reserved_1G++; 1359 trace_dhugetlb_acct_memory(hpool, 1360 hpool->mmap_reserved_1G, 1361 DHUGETLB_RESV_1G); 1362 } 1363 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_1G, 1364 DHUGETLB_FREE_1G); 1365 } 1366 spin_unlock(&hpool->lock); 1367 dhugetlb_pool_put(hpool); 1368 } 1369 #else > 1370 void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) 1371 { 1372 } 1373 #endif 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 5053/23779] drivers/platform/x86/intel_atomisp2_pm.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b1d54e6f06c518a52f83edade0da2b959e1c9a4e commit: 1073f9d006321689fb82bdac7b7af58e8617f128 [5053/23779] platform/x86: Add Intel AtomISP2 dummy / power-management driver config: x86_64-buildonly-randconfig-001-20240926 (https://download.01.org/0day-ci/archive/20240927/202409270224.SJPfAkVu-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409270224.SJPfAkVu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270224.SJPfAkVu-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/platform/x86/intel_atomisp2_pm.c:15: include/linux/module.h:140:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'isp_pci_driver_exit': 'cold' [-Wmissing-attributes] 140 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ include/linux/device.h:1637:1: note: in expansion of macro 'module_exit' 1637 | module_exit(__driver##_exit); | ^~~~~~~~~~~ include/linux/pci.h:1335:9: note: in expansion of macro 'module_driver' 1335 | module_driver(__pci_driver, pci_register_driver, pci_unregister_driver) | ^~~~~~~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ In file included from include/linux/pci.h:32, from drivers/platform/x86/intel_atomisp2_pm.c:17: drivers/platform/x86/intel_atomisp2_pm.c:115:19: note: 'cleanup_module' target declared here 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~ include/linux/device.h:1633:20: note: in definition of macro 'module_driver' 1633 | static void __exit __driver##_exit(void) \ | ^~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ include/linux/module.h:134:13: warning: 'init_module' specifies less restrictive attribute than its target 'isp_pci_driver_init': 'cold' [-Wmissing-attributes] 134 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/device.h:1632:1: note: in expansion of macro 'module_init' 1632 | module_init(__driver##_init); \ | ^~~~~~~~~~~ include/linux/pci.h:1335:9: note: in expansion of macro 'module_driver' 1335 | module_driver(__pci_driver, pci_register_driver, pci_unregister_driver) | ^~~~~~~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:19: note: 'init_module' target declared here 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~ include/linux/device.h:1628:19: note: in definition of macro 'module_driver' 1628 | static int __init __driver##_init(void) \ | ^~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ >> drivers/platform/x86/intel_atomisp2_pm.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 14067/14172] drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:403:15: error: no member named 'start' in 'struct iommu_iotlb_gather'
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2e95e7bae9486cc775ed2aa319bf323f6ba2677b commit: e4a624e3e991f56f3783c5fafe8fd075a2be861b [14067/14172] net: hns3: add sync command to sync io-pgtable config: arm64-randconfig-r123-20240926 (https://download.01.org/0day-ci/archive/20240927/202409270232.uDTz2n2f-lkp@…) compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1) reproduce: (https://download.01.org/0day-ci/archive/20240927/202409270232.uDTz2n2f-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270232.uDTz2n2f-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:403:15: error: no member named 'start' in 'struct iommu_iotlb_gather' iotlb_gather.start = iova; ~~~~~~~~~~~~ ^ >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:404:15: error: no member named 'end' in 'struct iommu_iotlb_gather' iotlb_gather.end = iova + granule - 1; ~~~~~~~~~~~~ ^ >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:405:15: error: no member named 'pgsize' in 'struct iommu_iotlb_gather' iotlb_gather.pgsize = granule; ~~~~~~~~~~~~ ^ 3 errors generated. vim +403 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c 388 389 #define HNS3_INVALID_PTYPE \ 390 ARRAY_SIZE(hns3_rx_ptype_tbl) 391 392 static void hns3_dma_map_sync(struct device *dev, unsigned long iova) 393 { 394 struct iommu_domain *domain = iommu_get_domain_for_dev(dev); 395 struct iommu_iotlb_gather iotlb_gather; 396 size_t granule; 397 398 if (!domain || domain->type != IOMMU_DOMAIN_DMA) 399 return; 400 401 granule = 1 << __ffs(domain->pgsize_bitmap); 402 iova = ALIGN_DOWN(iova, granule); > 403 iotlb_gather.start = iova; > 404 iotlb_gather.end = iova + granule - 1; > 405 iotlb_gather.pgsize = granule; 406 407 iommu_iotlb_sync(domain, &iotlb_gather); 408 } 409 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1336/14122] include/linux/uaccess.h:213:16: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 81a41d2ac1de43215c014bc71d907a026042e55b commit: 975e216e36aa3f7aba9d8e1e1d6cbba7cf692ad7 [1336/14122] arm64: add support for machine check error safe config: arm64-randconfig-r123-20240926 (https://download.01.org/0day-ci/archive/20240927/202409270023.ToC1weNo-lkp@…) compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1) reproduce: (https://download.01.org/0day-ci/archive/20240927/202409270023.ToC1weNo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270023.ToC1weNo-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) lib/iov_iter.c: note: in included file (through include/linux/sched/task.h, include/linux/sched/signal.h, include/linux/rcuwait.h, ...): >> include/linux/uaccess.h:213:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] __user *ptr @@ got void *dst @@ include/linux/uaccess.h:213:16: sparse: expected void const [noderef] __user *ptr include/linux/uaccess.h:213:16: sparse: got void *dst lib/iov_iter.c: note: in included file: include/net/checksum.h:33:39: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __wsum [usertype] sum @@ got unsigned int @@ include/net/checksum.h:33:39: sparse: expected restricted __wsum [usertype] sum include/net/checksum.h:33:39: sparse: got unsigned int include/net/checksum.h:33:39: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __wsum [usertype] sum @@ got unsigned int @@ include/net/checksum.h:33:39: sparse: expected restricted __wsum [usertype] sum include/net/checksum.h:33:39: sparse: got unsigned int include/net/checksum.h:41:45: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __wsum [usertype] sum @@ got unsigned int @@ include/net/checksum.h:41:45: sparse: expected restricted __wsum [usertype] sum include/net/checksum.h:41:45: sparse: got unsigned int include/net/checksum.h:41:45: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __wsum [usertype] sum @@ got unsigned int @@ include/net/checksum.h:41:45: sparse: expected restricted __wsum [usertype] sum include/net/checksum.h:41:45: sparse: got unsigned int vim +213 include/linux/uaccess.h ec6347bb43395c Dan Williams 2020-10-05 207 59feaaa04e929c Tong Tiangen 2023-12-07 208 #ifndef copy_mc_to_user 59feaaa04e929c Tong Tiangen 2023-12-07 209 static inline unsigned long __must_check 59feaaa04e929c Tong Tiangen 2023-12-07 210 copy_mc_to_user(void *dst, const void *src, size_t cnt) 59feaaa04e929c Tong Tiangen 2023-12-07 211 { 59feaaa04e929c Tong Tiangen 2023-12-07 212 check_object_size(src, cnt, true); 59feaaa04e929c Tong Tiangen 2023-12-07 @213 return raw_copy_to_user(dst, src, cnt); 59feaaa04e929c Tong Tiangen 2023-12-07 214 } 59feaaa04e929c Tong Tiangen 2023-12-07 215 #endif 59feaaa04e929c Tong Tiangen 2023-12-07 216 :::::: The code at line 213 was first introduced by commit :::::: 59feaaa04e929cf051c9b29e28fb9e1299785280 uaccess: add generic fallback version of copy_mc_to_user() :::::: TO: Tong Tiangen <tongtiangen(a)huawei.com> :::::: CC: Tong Tiangen <tongtiangen(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
by Zeng Heng 26 Sep '24

26 Sep '24

From: Krishna Kumar <krishnak(a)linux.ibm.com> stable inclusion from stable-v4.19.322 commit 4eb4085c1346d19d4a05c55246eb93e74e671048 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWMF CVE: CVE-2024-46761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 335e35b748527f0c06ded9eebb65387f60647fda ] The hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel crash when we try to hot-unplug/disable the PCIe switch/bridge from the PHB. The crash occurs because although the MSI data structure has been released during disable/hot-unplug path and it has been assigned with NULL, still during unregistration the code was again trying to explicitly disable the MSI which causes the NULL pointer dereference and kernel crash. The patch fixes the check during unregistration path to prevent invoking pci_disable_msi/msix() since its data structure is already freed. Reported-by: Timothy Pearson <tpearson(a)raptorengineering.com> Closes: https://lore.kernel.org/all/1981605666.2142272.1703742465927.JavaMail.zimbr… Acked-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Shawn Anastasio <sanastasio(a)raptorengineering.com> Signed-off-by: Krishna Kumar <krishnak(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240701074513.94873-2-krishnak@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pci/hotplug/pnv_php.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c index 3276a5e4c430..486fad430958 100644 --- a/drivers/pci/hotplug/pnv_php.c +++ b/drivers/pci/hotplug/pnv_php.c @@ -35,7 +35,6 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, bool disable_device) { struct pci_dev *pdev = php_slot->pdev; - int irq = php_slot->irq; u16 ctrl; if (php_slot->irq > 0) { @@ -54,7 +53,7 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, php_slot->wq = NULL; } - if (disable_device || irq > 0) { + if (disable_device) { if (pdev->msix_enabled) pci_disable_msix(pdev); else if (pdev->msi_enabled) -- 2.25.1

2 1

[PATCH OLK-5.10] pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
by Zeng Heng 26 Sep '24

26 Sep '24

From: Krishna Kumar <krishnak(a)linux.ibm.com> stable inclusion from stable-v5.10.226 commit bc1faed19db95abf0933b104910a3fb01b138f59 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWMF CVE: CVE-2024-46761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 335e35b748527f0c06ded9eebb65387f60647fda ] The hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel crash when we try to hot-unplug/disable the PCIe switch/bridge from the PHB. The crash occurs because although the MSI data structure has been released during disable/hot-unplug path and it has been assigned with NULL, still during unregistration the code was again trying to explicitly disable the MSI which causes the NULL pointer dereference and kernel crash. The patch fixes the check during unregistration path to prevent invoking pci_disable_msi/msix() since its data structure is already freed. Reported-by: Timothy Pearson <tpearson(a)raptorengineering.com> Closes: https://lore.kernel.org/all/1981605666.2142272.1703742465927.JavaMail.zimbr… Acked-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Shawn Anastasio <sanastasio(a)raptorengineering.com> Signed-off-by: Krishna Kumar <krishnak(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240701074513.94873-2-krishnak@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pci/hotplug/pnv_php.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c index 04565162a449..cf9c0e75f0be 100644 --- a/drivers/pci/hotplug/pnv_php.c +++ b/drivers/pci/hotplug/pnv_php.c @@ -38,7 +38,6 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, bool disable_device) { struct pci_dev *pdev = php_slot->pdev; - int irq = php_slot->irq; u16 ctrl; if (php_slot->irq > 0) { @@ -57,7 +56,7 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, php_slot->wq = NULL; } - if (disable_device || irq > 0) { + if (disable_device) { if (pdev->msix_enabled) pci_disable_msix(pdev); else if (pdev->msi_enabled) -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
by Zeng Heng 26 Sep '24

26 Sep '24

From: Krishna Kumar <krishnak(a)linux.ibm.com> stable inclusion from stable-v5.10.226 commit bc1faed19db95abf0933b104910a3fb01b138f59 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWMF CVE: CVE-2024-46761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 335e35b748527f0c06ded9eebb65387f60647fda ] The hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel crash when we try to hot-unplug/disable the PCIe switch/bridge from the PHB. The crash occurs because although the MSI data structure has been released during disable/hot-unplug path and it has been assigned with NULL, still during unregistration the code was again trying to explicitly disable the MSI which causes the NULL pointer dereference and kernel crash. The patch fixes the check during unregistration path to prevent invoking pci_disable_msi/msix() since its data structure is already freed. Reported-by: Timothy Pearson <tpearson(a)raptorengineering.com> Closes: https://lore.kernel.org/all/1981605666.2142272.1703742465927.JavaMail.zimbr… Acked-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Shawn Anastasio <sanastasio(a)raptorengineering.com> Signed-off-by: Krishna Kumar <krishnak(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240701074513.94873-2-krishnak@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pci/hotplug/pnv_php.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c index 04565162a449..cf9c0e75f0be 100644 --- a/drivers/pci/hotplug/pnv_php.c +++ b/drivers/pci/hotplug/pnv_php.c @@ -38,7 +38,6 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, bool disable_device) { struct pci_dev *pdev = php_slot->pdev; - int irq = php_slot->irq; u16 ctrl; if (php_slot->irq > 0) { @@ -57,7 +56,7 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, php_slot->wq = NULL; } - if (disable_device || irq > 0) { + if (disable_device) { if (pdev->msix_enabled) pci_disable_msix(pdev); else if (pdev->msi_enabled) -- 2.25.1

2 1

[PATCH OLK-6.6] pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
by Zeng Heng 26 Sep '24

26 Sep '24

From: Krishna Kumar <krishnak(a)linux.ibm.com> stable inclusion from stable-v6.6.51 commit b82d4d5c736f4fd2ed224c35f554f50d1953d21e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWMF CVE: CVE-2024-46761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 335e35b748527f0c06ded9eebb65387f60647fda ] The hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel crash when we try to hot-unplug/disable the PCIe switch/bridge from the PHB. The crash occurs because although the MSI data structure has been released during disable/hot-unplug path and it has been assigned with NULL, still during unregistration the code was again trying to explicitly disable the MSI which causes the NULL pointer dereference and kernel crash. The patch fixes the check during unregistration path to prevent invoking pci_disable_msi/msix() since its data structure is already freed. Reported-by: Timothy Pearson <tpearson(a)raptorengineering.com> Closes: https://lore.kernel.org/all/1981605666.2142272.1703742465927.JavaMail.zimbr… Acked-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Shawn Anastasio <sanastasio(a)raptorengineering.com> Signed-off-by: Krishna Kumar <krishnak(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240701074513.94873-2-krishnak@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pci/hotplug/pnv_php.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c index 881d420637bf..092c9ac0d26d 100644 --- a/drivers/pci/hotplug/pnv_php.c +++ b/drivers/pci/hotplug/pnv_php.c @@ -39,7 +39,6 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, bool disable_device) { struct pci_dev *pdev = php_slot->pdev; - int irq = php_slot->irq; u16 ctrl; if (php_slot->irq > 0) { @@ -58,7 +57,7 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, php_slot->wq = NULL; } - if (disable_device || irq > 0) { + if (disable_device) { if (pdev->msix_enabled) pci_disable_msix(pdev); else if (pdev->msi_enabled) -- 2.25.1

2 1

[PATCH OLK-6.6] PCI: Add missing bridge lock to pci_bus_lock()
by liwei 26 Sep '24

26 Sep '24

From: Dan Williams <dan.j.williams(a)intel.com> mainline inclusion from mainline-v6.11-rc1 commit a4e772898f8bf2e7e1cf661a12c60a5612c4afab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWL9 CVE: CVE-2024-46750 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70 RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70 Call Trace: <TASK> ? __warn+0x8c/0x190 ? pci_bridge_secondary_bus_reset+0x5d/0x70 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? pci_bridge_secondary_bus_reset+0x5d/0x70 pci_reset_bus+0x1d8/0x270 vmd_probe+0x778/0xa10 pci_device_probe+0x95/0x120 Where pci_reset_bus() users are triggering unlocked secondary bus resets. Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses pci_bus_lock() before issuing the reset which locks everything *but* the bridge itself. For the same motivation as adding: bridge = pci_upstream_bridge(dev); if (bridge) pci_dev_lock(bridge); to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add pci_dev_lock() for @bus->self to pci_bus_lock(). Link: https://lore.kernel.org/r/171711747501.1628941.15217746952476635316.stgit@d… Reported-by: Imre Deak <imre.deak(a)intel.com> Closes: http://lore.kernel.org/r/6657833b3b5ae_14984b29437@dwillia2-xfh.jf.intel.co… Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> [bhelgaas: squash in recursive locking deadlock fix from Keith Busch: https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com] Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Hans de Goede <hdegoede(a)redhat.com> Tested-by: Kalle Valo <kvalo(a)kernel.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/pci.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 21ae34013c35..1e60458e72ff 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5737,10 +5737,12 @@ static void pci_bus_lock(struct pci_bus *bus) { struct pci_dev *dev; + pci_dev_lock(bus->self); list_for_each_entry(dev, &bus->devices, bus_list) { - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5752,8 +5754,10 @@ static void pci_bus_unlock(struct pci_bus *bus) list_for_each_entry(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); } /* Return 1 on successful lock, 0 on contention */ @@ -5761,15 +5765,15 @@ static int pci_bus_trylock(struct pci_bus *bus) { struct pci_dev *dev; + if (!pci_dev_trylock(bus->self)) + return 0; + list_for_each_entry(dev, &bus->devices, bus_list) { - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5777,8 +5781,10 @@ static int pci_bus_trylock(struct pci_bus *bus) list_for_each_entry_continue_reverse(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); return 0; } @@ -5810,9 +5816,10 @@ static void pci_slot_lock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5838,14 +5845,13 @@ static int pci_slot_trylock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); goto unlock; } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5856,7 +5862,8 @@ static int pci_slot_trylock(struct pci_slot *slot) continue; if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } return 0; } -- 2.25.1

2 1

[PATCH OLK-6.6] usb: dwc3: st: fix probed platform device ref count on probe error path
by liwei 26 Sep '24

26 Sep '24

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> mainline inclusion from mainline-v6.11-rc6 commit ddfcfeba891064b88bb844208b43bef2ef970f0c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR624 CVE: CVE-2024-46674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable(a)vger.kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Acked-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Reviewed-by: Patrice Chotard <patrice.chotard(a)foss.st.com> Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c index 211360eee95a..a9cb04043f08 100644 --- a/drivers/usb/dwc3/dwc3-st.c +++ b/drivers/usb/dwc3/dwc3-st.c @@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform_device *pdev) dwc3_data->regmap = regmap; res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); - if (!res) { - ret = -ENXIO; - goto undo_platform_dev_alloc; - } + if (!res) + return -ENXIO; dwc3_data->syscfg_reg_off = res->start; @@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev) devm_reset_control_get_exclusive(dev, "powerdown"); if (IS_ERR(dwc3_data->rstc_pwrdn)) { dev_err(&pdev->dev, "could not get power controller\n"); - ret = PTR_ERR(dwc3_data->rstc_pwrdn); - goto undo_platform_dev_alloc; + return PTR_ERR(dwc3_data->rstc_pwrdn); } /* Manage PowerDown */ @@ -300,8 +297,6 @@ static int st_dwc3_probe(struct platform_device *pdev) reset_control_assert(dwc3_data->rstc_rst); undo_powerdown: reset_control_assert(dwc3_data->rstc_pwrdn); -undo_platform_dev_alloc: - platform_device_put(pdev); return ret; } -- 2.25.1

2 1

[PATCH OLK-5.10] usb: dwc3: st: fix probed platform device ref count on probe error path
by liwei 26 Sep '24

26 Sep '24

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> mainline inclusion from mainline-v6.11-rc6 commit ddfcfeba891064b88bb844208b43bef2ef970f0c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR624 CVE: CVE-2024-46674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable(a)vger.kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Acked-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Reviewed-by: Patrice Chotard <patrice.chotard(a)foss.st.com> Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c index e733be840545..a150855b4b05 100644 --- a/drivers/usb/dwc3/dwc3-st.c +++ b/drivers/usb/dwc3/dwc3-st.c @@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform_device *pdev) dwc3_data->regmap = regmap; res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); - if (!res) { - ret = -ENXIO; - goto undo_platform_dev_alloc; - } + if (!res) + return -ENXIO; dwc3_data->syscfg_reg_off = res->start; @@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev) devm_reset_control_get_exclusive(dev, "powerdown"); if (IS_ERR(dwc3_data->rstc_pwrdn)) { dev_err(&pdev->dev, "could not get power controller\n"); - ret = PTR_ERR(dwc3_data->rstc_pwrdn); - goto undo_platform_dev_alloc; + return PTR_ERR(dwc3_data->rstc_pwrdn); } /* Manage PowerDown */ @@ -300,8 +297,6 @@ static int st_dwc3_probe(struct platform_device *pdev) reset_control_assert(dwc3_data->rstc_rst); undo_powerdown: reset_control_assert(dwc3_data->rstc_pwrdn); -undo_platform_dev_alloc: - platform_device_put(pdev); return ret; } -- 2.25.1

2 1

[PATCH OLK-5.10] PCI: Add missing bridge lock to pci_bus_lock()
by liwei 26 Sep '24

26 Sep '24

From: Dan Williams <dan.j.williams(a)intel.com> mainline inclusion from mainline-v6.11-rc1 commit a4e772898f8bf2e7e1cf661a12c60a5612c4afab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWL9 CVE: CVE-2024-46750 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70 RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70 Call Trace: <TASK> ? __warn+0x8c/0x190 ? pci_bridge_secondary_bus_reset+0x5d/0x70 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? pci_bridge_secondary_bus_reset+0x5d/0x70 pci_reset_bus+0x1d8/0x270 vmd_probe+0x778/0xa10 pci_device_probe+0x95/0x120 Where pci_reset_bus() users are triggering unlocked secondary bus resets. Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses pci_bus_lock() before issuing the reset which locks everything *but* the bridge itself. For the same motivation as adding: bridge = pci_upstream_bridge(dev); if (bridge) pci_dev_lock(bridge); to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add pci_dev_lock() for @bus->self to pci_bus_lock(). Link: https://lore.kernel.org/r/171711747501.1628941.15217746952476635316.stgit@d… Reported-by: Imre Deak <imre.deak(a)intel.com> Closes: http://lore.kernel.org/r/6657833b3b5ae_14984b29437@dwillia2-xfh.jf.intel.co… Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> [bhelgaas: squash in recursive locking deadlock fix from Keith Busch: https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com] Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Hans de Goede <hdegoede(a)redhat.com> Tested-by: Kalle Valo <kvalo(a)kernel.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/pci.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 336daa667fb1..269fb2419325 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5268,10 +5268,12 @@ static void pci_bus_lock(struct pci_bus *bus) { struct pci_dev *dev; + pci_dev_lock(bus->self); list_for_each_entry(dev, &bus->devices, bus_list) { - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5283,8 +5285,10 @@ static void pci_bus_unlock(struct pci_bus *bus) list_for_each_entry(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); } /* Return 1 on successful lock, 0 on contention */ @@ -5292,15 +5296,15 @@ static int pci_bus_trylock(struct pci_bus *bus) { struct pci_dev *dev; + if (!pci_dev_trylock(bus->self)) + return 0; + list_for_each_entry(dev, &bus->devices, bus_list) { - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5308,8 +5312,10 @@ static int pci_bus_trylock(struct pci_bus *bus) list_for_each_entry_continue_reverse(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); return 0; } @@ -5341,9 +5347,10 @@ static void pci_slot_lock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5369,14 +5376,13 @@ static int pci_slot_trylock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); goto unlock; } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5387,7 +5393,8 @@ static int pci_slot_trylock(struct pci_slot *slot) continue; if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } return 0; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] PCI: Add missing bridge lock to pci_bus_lock()
by liwei 26 Sep '24

26 Sep '24

From: Dan Williams <dan.j.williams(a)intel.com> mainline inclusion from mainline-v6.11-rc1 commit a4e772898f8bf2e7e1cf661a12c60a5612c4afab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWL9 CVE: CVE-2024-46750 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70 RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70 Call Trace: <TASK> ? __warn+0x8c/0x190 ? pci_bridge_secondary_bus_reset+0x5d/0x70 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? pci_bridge_secondary_bus_reset+0x5d/0x70 pci_reset_bus+0x1d8/0x270 vmd_probe+0x778/0xa10 pci_device_probe+0x95/0x120 Where pci_reset_bus() users are triggering unlocked secondary bus resets. Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses pci_bus_lock() before issuing the reset which locks everything *but* the bridge itself. For the same motivation as adding: bridge = pci_upstream_bridge(dev); if (bridge) pci_dev_lock(bridge); to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add pci_dev_lock() for @bus->self to pci_bus_lock(). Link: https://lore.kernel.org/r/171711747501.1628941.15217746952476635316.stgit@d… Reported-by: Imre Deak <imre.deak(a)intel.com> Closes: http://lore.kernel.org/r/6657833b3b5ae_14984b29437@dwillia2-xfh.jf.intel.co… Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> [bhelgaas: squash in recursive locking deadlock fix from Keith Busch: https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com] Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Hans de Goede <hdegoede(a)redhat.com> Tested-by: Kalle Valo <kvalo(a)kernel.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/pci.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 8ace56c8141b..5ca3201d4f3e 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5265,10 +5265,12 @@ static void pci_bus_lock(struct pci_bus *bus) { struct pci_dev *dev; + pci_dev_lock(bus->self); list_for_each_entry(dev, &bus->devices, bus_list) { - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5280,8 +5282,10 @@ static void pci_bus_unlock(struct pci_bus *bus) list_for_each_entry(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); } /* Return 1 on successful lock, 0 on contention */ @@ -5289,15 +5293,15 @@ static int pci_bus_trylock(struct pci_bus *bus) { struct pci_dev *dev; + if (!pci_dev_trylock(bus->self)) + return 0; + list_for_each_entry(dev, &bus->devices, bus_list) { - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5305,8 +5309,10 @@ static int pci_bus_trylock(struct pci_bus *bus) list_for_each_entry_continue_reverse(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); return 0; } @@ -5338,9 +5344,10 @@ static void pci_slot_lock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5366,14 +5373,13 @@ static int pci_slot_trylock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); goto unlock; } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5384,7 +5390,8 @@ static int pci_slot_trylock(struct pci_slot *slot) continue; if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } return 0; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] usb: dwc3: st: fix probed platform device ref count on probe error path
by liwei 26 Sep '24

26 Sep '24

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> mainline inclusion from mainline-v6.11-rc6 commit ddfcfeba891064b88bb844208b43bef2ef970f0c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR624 CVE: CVE-2024-46674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable(a)vger.kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Acked-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Reviewed-by: Patrice Chotard <patrice.chotard(a)foss.st.com> Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c index e733be840545..a150855b4b05 100644 --- a/drivers/usb/dwc3/dwc3-st.c +++ b/drivers/usb/dwc3/dwc3-st.c @@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform_device *pdev) dwc3_data->regmap = regmap; res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); - if (!res) { - ret = -ENXIO; - goto undo_platform_dev_alloc; - } + if (!res) + return -ENXIO; dwc3_data->syscfg_reg_off = res->start; @@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev) devm_reset_control_get_exclusive(dev, "powerdown"); if (IS_ERR(dwc3_data->rstc_pwrdn)) { dev_err(&pdev->dev, "could not get power controller\n"); - ret = PTR_ERR(dwc3_data->rstc_pwrdn); - goto undo_platform_dev_alloc; + return PTR_ERR(dwc3_data->rstc_pwrdn); } /* Manage PowerDown */ @@ -300,8 +297,6 @@ static int st_dwc3_probe(struct platform_device *pdev) reset_control_assert(dwc3_data->rstc_rst); undo_powerdown: reset_control_assert(dwc3_data->rstc_pwrdn); -undo_platform_dev_alloc: - platform_device_put(pdev); return ret; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] PCI: Add missing bridge lock to pci_bus_lock()
by liwei 26 Sep '24

26 Sep '24

From: Dan Williams <dan.j.williams(a)intel.com> mainline inclusion from mainline-v6.11-rc1 commit a4e772898f8bf2e7e1cf661a12c60a5612c4afab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWL9 CVE: CVE-2024-46750 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70 RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70 Call Trace: <TASK> ? __warn+0x8c/0x190 ? pci_bridge_secondary_bus_reset+0x5d/0x70 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? pci_bridge_secondary_bus_reset+0x5d/0x70 pci_reset_bus+0x1d8/0x270 vmd_probe+0x778/0xa10 pci_device_probe+0x95/0x120 Where pci_reset_bus() users are triggering unlocked secondary bus resets. Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses pci_bus_lock() before issuing the reset which locks everything *but* the bridge itself. For the same motivation as adding: bridge = pci_upstream_bridge(dev); if (bridge) pci_dev_lock(bridge); to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add pci_dev_lock() for @bus->self to pci_bus_lock(). Link: https://lore.kernel.org/r/171711747501.1628941.15217746952476635316.stgit@d… Reported-by: Imre Deak <imre.deak(a)intel.com> Closes: http://lore.kernel.org/r/6657833b3b5ae_14984b29437@dwillia2-xfh.jf.intel.co… Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> [bhelgaas: squash in recursive locking deadlock fix from Keith Busch: https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com] Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Hans de Goede <hdegoede(a)redhat.com> Tested-by: Kalle Valo <kvalo(a)kernel.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/pci.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index e58fe13c99e1..b93605616d4e 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5035,10 +5035,12 @@ static void pci_bus_lock(struct pci_bus *bus) { struct pci_dev *dev; + pci_dev_lock(bus->self); list_for_each_entry(dev, &bus->devices, bus_list) { - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5050,8 +5052,10 @@ static void pci_bus_unlock(struct pci_bus *bus) list_for_each_entry(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); } /* Return 1 on successful lock, 0 on contention */ @@ -5059,15 +5063,15 @@ static int pci_bus_trylock(struct pci_bus *bus) { struct pci_dev *dev; + if (!pci_dev_trylock(bus->self)) + return 0; + list_for_each_entry(dev, &bus->devices, bus_list) { - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5075,8 +5079,10 @@ static int pci_bus_trylock(struct pci_bus *bus) list_for_each_entry_continue_reverse(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); return 0; } @@ -5108,9 +5114,10 @@ static void pci_slot_lock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5136,14 +5143,13 @@ static int pci_slot_trylock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); goto unlock; } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5154,7 +5160,8 @@ static int pci_slot_trylock(struct pci_slot *slot) continue; if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } return 0; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] usb: dwc3: st: fix probed platform device ref count on probe error path
by liwei 26 Sep '24

26 Sep '24

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> mainline inclusion from mainline-v6.11-rc6 commit ddfcfeba891064b88bb844208b43bef2ef970f0c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR624 CVE: CVE-2024-46674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable(a)vger.kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Acked-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Reviewed-by: Patrice Chotard <patrice.chotard(a)foss.st.com> Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c index 16081383c401..6127505770ce 100644 --- a/drivers/usb/dwc3/dwc3-st.c +++ b/drivers/usb/dwc3/dwc3-st.c @@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform_device *pdev) dwc3_data->regmap = regmap; res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); - if (!res) { - ret = -ENXIO; - goto undo_platform_dev_alloc; - } + if (!res) + return -ENXIO; dwc3_data->syscfg_reg_off = res->start; @@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev) devm_reset_control_get_exclusive(dev, "powerdown"); if (IS_ERR(dwc3_data->rstc_pwrdn)) { dev_err(&pdev->dev, "could not get power controller\n"); - ret = PTR_ERR(dwc3_data->rstc_pwrdn); - goto undo_platform_dev_alloc; + return PTR_ERR(dwc3_data->rstc_pwrdn); } /* Manage PowerDown */ @@ -296,8 +293,6 @@ static int st_dwc3_probe(struct platform_device *pdev) reset_control_assert(dwc3_data->rstc_rst); undo_powerdown: reset_control_assert(dwc3_data->rstc_pwrdn); -undo_platform_dev_alloc: - platform_device_put(pdev); return ret; } -- 2.25.1

2 1

[PATCH OLK-6.6] btrfs: handle errors from btrfs_dec_ref() properly
by Long Li 26 Sep '24

26 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.10-rc2 commit 5eb178f373b4f16f3b42d55ff88fc94dd95b93b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYDJ CVE: CVE-2024-46753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref(). This is incorrect, we have proper error handling here, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Conflict due to not merge mainline commit e094f48040cd] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/extent-tree.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index c6ecfd05e1db..b6be2e2f1994 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5505,7 +5505,10 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, ret = btrfs_dec_ref(trans, root, eb, 1); else ret = btrfs_dec_ref(trans, root, eb, 0); - BUG_ON(ret); /* -ENOMEM */ + if (ret) { + btrfs_abort_transaction(trans, ret); + return ret; + } if (is_fstree(root->root_key.objectid)) { ret = btrfs_qgroup_trace_leaf_items(trans, eb); if (ret) { -- 2.39.2

2 1

[PATCH OLK-5.10] btrfs: handle errors from btrfs_dec_ref() properly
by Long Li 26 Sep '24

26 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.10-rc2 commit 5eb178f373b4f16f3b42d55ff88fc94dd95b93b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYDJ CVE: CVE-2024-46753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref(). This is incorrect, we have proper error handling here, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Conflict due to not merge mainline commit e094f48040cd] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/extent-tree.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 1cf787209798..42617407feb1 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5227,7 +5227,10 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, ret = btrfs_dec_ref(trans, root, eb, 1); else ret = btrfs_dec_ref(trans, root, eb, 0); - BUG_ON(ret); /* -ENOMEM */ + if (ret) { + btrfs_abort_transaction(trans, ret); + return ret; + } if (is_fstree(root->root_key.objectid)) { ret = btrfs_qgroup_trace_leaf_items(trans, eb); if (ret) { -- 2.39.2

2 1

[PATCH OLK-6.6 0/8] fix CVE-2024-46701
by Yu Kuai 26 Sep '24

26 Sep '24

Chuck Lever (5): libfs: Re-arrange locking in offset_iterate_dir() libfs: Define a minimum directory offset libfs: Add simple_offset_empty() maple_tree: Add mtree_alloc_cyclic() libfs: Convert simple directory offsets to use a Maple Tree Liam R. Howlett (1): test_maple_tree: testing the cyclic allocation Yu Kuai (1): fs: fix kabi kroken in struct offset_ctx yangerkun (1): libfs: fix infinite directory reads for offset dir fs/libfs.c | 129 +++++++++++++++++++++++++------------ include/linux/fs.h | 15 ++++- include/linux/maple_tree.h | 7 ++ lib/maple_tree.c | 93 ++++++++++++++++++++++++++ lib/test_maple_tree.c | 44 +++++++++++++ mm/shmem.c | 4 +- 6 files changed, 247 insertions(+), 45 deletions(-) -- 2.39.2

2 9

[PATCH OLK-5.10] NFSD: Reset cb_seq_status after NFS4ERR_DELAY
by Li Lingfeng 26 Sep '24

26 Sep '24

From: Chuck Lever <chuck.lever(a)oracle.com> mainline inclusion from mainline-v6.9-rc1 commit 961b4b5e86bf56a2e4b567f81682defa5cba957e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATOAX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- I noticed that once an NFSv4.1 callback operation gets a NFS4ERR_DELAY status on CB_SEQUENCE and then the connection is lost, the callback client loops, resending it indefinitely. The switch arm in nfsd4_cb_sequence_done() that handles NFS4ERR_DELAY uses rpc_restart_call() to rearm the RPC state machine for the retransmit, but that path does not call the rpc_prepare_call callback again. Thus cb_seq_status is set to -10008 by the first NFS4ERR_DELAY result, but is never set back to 1 for the retransmits. nfsd4_cb_sequence_done() thinks it's getting nothing but a long series of CB_SEQUENCE NFS4ERR_DELAY replies. Fixes: 7ba6cad6c88f ("nfsd: New helper nfsd4_cb_sequence_done() for processing more cb errors") Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Reviewed-by: Benjamin Coddington <bcodding(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4callback.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c index f5b7ad0847f2..bd79fc4934f0 100644 --- a/fs/nfsd/nfs4callback.c +++ b/fs/nfsd/nfs4callback.c @@ -1126,6 +1126,7 @@ static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback ret = false; break; case -NFS4ERR_DELAY: + cb->cb_seq_status = 1; if (!rpc_restart_call(task)) goto out; -- 2.31.1

2 1

[PATCH OLK-6.6] NFSD: Reset cb_seq_status after NFS4ERR_DELAY
by Li Lingfeng 26 Sep '24

26 Sep '24

From: Chuck Lever <chuck.lever(a)oracle.com> mainline inclusion from mainline-v6.9-rc1 commit 961b4b5e86bf56a2e4b567f81682defa5cba957e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATOAX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- I noticed that once an NFSv4.1 callback operation gets a NFS4ERR_DELAY status on CB_SEQUENCE and then the connection is lost, the callback client loops, resending it indefinitely. The switch arm in nfsd4_cb_sequence_done() that handles NFS4ERR_DELAY uses rpc_restart_call() to rearm the RPC state machine for the retransmit, but that path does not call the rpc_prepare_call callback again. Thus cb_seq_status is set to -10008 by the first NFS4ERR_DELAY result, but is never set back to 1 for the retransmits. nfsd4_cb_sequence_done() thinks it's getting nothing but a long series of CB_SEQUENCE NFS4ERR_DELAY replies. Fixes: 7ba6cad6c88f ("nfsd: New helper nfsd4_cb_sequence_done() for processing more cb errors") Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Reviewed-by: Benjamin Coddington <bcodding(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4callback.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c index 4039ffcf90ba..49a88dde9631 100644 --- a/fs/nfsd/nfs4callback.c +++ b/fs/nfsd/nfs4callback.c @@ -1202,6 +1202,7 @@ static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback ret = false; break; case -NFS4ERR_DELAY: + cb->cb_seq_status = 1; if (!rpc_restart_call(task)) goto out; -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> stable inclusion from stable-v5.10.226 commit 6c563a29857aa8053b67ee141191f69757f27f6e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 upstream. When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Link: https://lore.kernel.org/r/20240828154338.754746-1-david.fernandez.gonzalez@… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index 692daa9eff34..19c9d2cdd277 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -144,7 +144,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] pktgen: use cpus_read_lock() in pg_net_init()
by Wang Liang 26 Sep '24

26 Sep '24

mainline inclusion from mainline-v6.11-rc6 commit 979b581e4c69257acab1af415ddad6b2d78a2fa5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR4B3 CVE: CVE-2024-46681 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We must use cpus_read_lock()/cpus_read_unlock() around the for_each_online_cpu(cpu) loop. While we are at it use WARN_ON_ONCE() to avoid a possible syslog flood. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240821175339.1191779-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/core/pktgen.c [conflicts due to not mergered f568a3d49af9 ("bpf,lsm: Add BPF token LSM hooks") which include linux/bpf.h, and lead to inclusion of linux/cpu.h indirectly. The commit(f568a3d49af9) is complex and irrelevant to this problem. To solve the compile error, include linux/cpu.h manually.] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/core/pktgen.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/pktgen.c b/net/core/pktgen.c index 3fba429f1f57..89ac59ff6598 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -170,6 +170,7 @@ #include <linux/uaccess.h> #include <asm/dma.h> #include <asm/div64.h> /* do_div */ +#include <linux/cpu.h> #define VERSION "2.75" #define IP_NAME_SZ 32 @@ -3464,7 +3465,7 @@ static int pktgen_thread_worker(void *arg) struct pktgen_dev *pkt_dev = NULL; int cpu = t->cpu; - WARN_ON(smp_processor_id() != cpu); + WARN_ON_ONCE(smp_processor_id() != cpu); init_waitqueue_head(&t->queue); complete(&t->start_done); @@ -3800,6 +3801,7 @@ static int __net_init pg_net_init(struct net *net) goto remove; } + cpus_read_lock(); for_each_online_cpu(cpu) { int err; @@ -3808,6 +3810,7 @@ static int __net_init pg_net_init(struct net *net) pr_warn("Cannot create thread for cpu %d (%d)\n", cpu, err); } + cpus_read_unlock(); if (list_empty(&pn->pktgen_threads)) { pr_err("Initialization failed for all threads\n"); -- 2.34.1

2 1

[PATCH OLK-5.10] pktgen: use cpus_read_lock() in pg_net_init()
by Wang Liang 26 Sep '24

26 Sep '24

mainline inclusion from mainline-v6.11-rc6 commit 979b581e4c69257acab1af415ddad6b2d78a2fa5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR4B3 CVE: CVE-2024-46681 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We must use cpus_read_lock()/cpus_read_unlock() around the for_each_online_cpu(cpu) loop. While we are at it use WARN_ON_ONCE() to avoid a possible syslog flood. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240821175339.1191779-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/core/pktgen.c [conflicts due to not mergered f568a3d49af9 ("bpf,lsm: Add BPF token LSM hooks") which include linux/bpf.h, and lead to inclusion of linux/cpu.h indirectly. The commit(f568a3d49af9) is complex and irrelevant to this problem. To solve the compile error, include linux/cpu.h manually.] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/core/pktgen.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/pktgen.c b/net/core/pktgen.c index c1e3d3bea128..28ba48d836d5 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -170,6 +170,7 @@ #include <linux/uaccess.h> #include <asm/dma.h> #include <asm/div64.h> /* do_div */ +#include <linux/cpu.h> #define VERSION "2.75" #define IP_NAME_SZ 32 @@ -3464,7 +3465,7 @@ static int pktgen_thread_worker(void *arg) struct pktgen_dev *pkt_dev = NULL; int cpu = t->cpu; - WARN_ON(smp_processor_id() != cpu); + WARN_ON_ONCE(smp_processor_id() != cpu); init_waitqueue_head(&t->queue); complete(&t->start_done); @@ -3800,6 +3801,7 @@ static int __net_init pg_net_init(struct net *net) goto remove; } + cpus_read_lock(); for_each_online_cpu(cpu) { int err; @@ -3808,6 +3810,7 @@ static int __net_init pg_net_init(struct net *net) pr_warn("Cannot create thread for cpu %d (%d)\n", cpu, err); } + cpus_read_unlock(); if (list_empty(&pn->pktgen_threads)) { pr_err("Initialization failed for all threads\n"); -- 2.34.1

2 1

[PATCH OLK-5.10 v2] drm/amd/display: Ensure index calculation will not overflow
by Tong Tiangen 26 Sep '24

26 Sep '24

mainline inclusion from mainline-v6.1-rc1 commit 8e2734bf444767fed787305ccdcb36a2be5301a2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV8L CVE: CVE-2024-46726 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [WHY & HOW] Make sure vmid0p72_idx, vnom0p8_idx and vmax0p9_idx calculation will never overflow and exceess array size. This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c [Conflicts from: 1) commit 552b7cb0eed1 move drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c to drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c; 2) commit 91954c6c904b move dcn_bw_update_from_pplib() to dcn_bw_update_from_pplib_fclks() and the code logic is the same.] Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c index 51397b565ddf..2186603d915c 100644 --- a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c +++ b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c @@ -1498,10 +1498,9 @@ void dcn_bw_update_from_pplib(struct dc *dc) ASSERT(fclks.num_levels); vmin0p65_idx = 0; - vmid0p72_idx = fclks.num_levels - - (fclks.num_levels > 2 ? 3 : (fclks.num_levels > 1 ? 2 : 1)); - vnom0p8_idx = fclks.num_levels - (fclks.num_levels > 1 ? 2 : 1); - vmax0p9_idx = fclks.num_levels - 1; + vmid0p72_idx = fclks.num_levels > 2 ? fclks.num_levels - 3 : 0; + vnom0p8_idx = fclks.num_levels > 1 ? fclks.num_levels - 2 : 0; + vmax0p9_idx = fclks.num_levels > 0 ? fclks.num_levels - 1 : 0; dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 = 32 * (fclks.data[vmin0p65_idx].clocks_in_khz / 1000.0) / 1000.0; -- 2.25.1

2 1

[PATCH OLK-6.6] pktgen: use cpus_read_lock() in pg_net_init()
by Wang Liang 26 Sep '24

26 Sep '24

mainline inclusion from mainline-v6.11-rc6 commit 979b581e4c69257acab1af415ddad6b2d78a2fa5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR4B3 CVE: CVE-2024-46681 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We must use cpus_read_lock()/cpus_read_unlock() around the for_each_online_cpu(cpu) loop. While we are at it use WARN_ON_ONCE() to avoid a possible syslog flood. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240821175339.1191779-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/core/pktgen.c [conflicts due to not mergered f568a3d49af9 ("bpf,lsm: Add BPF token LSM hooks") which include linux/bpf.h, and lead to inclusion of linux/cpu.h indirectly. The commit(f568a3d49af9) is complex and irrelevant to this problem. To solve the compile error, include linux/cpu.h manually.] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/core/pktgen.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/pktgen.c b/net/core/pktgen.c index 0e472f6fab85..473503217201 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -170,6 +170,7 @@ #include <linux/uaccess.h> #include <asm/dma.h> #include <asm/div64.h> /* do_div */ +#include <linux/cpu.h> #define VERSION "2.75" #define IP_NAME_SZ 32 @@ -3605,7 +3606,7 @@ static int pktgen_thread_worker(void *arg) struct pktgen_dev *pkt_dev = NULL; int cpu = t->cpu; - WARN_ON(smp_processor_id() != cpu); + WARN_ON_ONCE(smp_processor_id() != cpu); init_waitqueue_head(&t->queue); complete(&t->start_done); @@ -3941,6 +3942,7 @@ static int __net_init pg_net_init(struct net *net) goto remove; } + cpus_read_lock(); for_each_online_cpu(cpu) { int err; @@ -3949,6 +3951,7 @@ static int __net_init pg_net_init(struct net *net) pr_warn("Cannot create thread for cpu %d (%d)\n", cpu, err); } + cpus_read_unlock(); if (list_empty(&pn->pktgen_threads)) { pr_err("Initialization failed for all threads\n"); -- 2.34.1

2 1

[PATCH OLK-5.10] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> stable inclusion from stable-v5.10.226 commit 6c563a29857aa8053b67ee141191f69757f27f6e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 upstream. When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Link: https://lore.kernel.org/r/20240828154338.754746-1-david.fernandez.gonzalez@… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index 692daa9eff34..19c9d2cdd277 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -144,7 +144,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] memcg_write_event_control(): fix a user-triggerable oops
by Jinjiang Tu 26 Sep '24

26 Sep '24

From: Al Viro <viro(a)zeniv.linux.org.uk> stable inclusion from stable-v4.19.321 commit fa5bfdf6cb5846a00e712d630a43e3cf55ccb411 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJK CVE: CVE-2024-45021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 046667c4d3196938e992fba0dfcde570aa85cd0e upstream. we are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane). Fixes: 0dea116876ee ("cgroup: implement eventfd-based generic API for notifications") Cc: stable(a)vger.kernel.org Cc: Andrew Morton <akpm(a)linux-foundation.org> Acked-by: Michal Hocko <mhocko(a)suse.com> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/memcontrol.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index f6b6a6c4b491..778e1b5bf80a 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4578,9 +4578,12 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, buf = endp + 1; cfd = simple_strtoul(buf, &endp, 10); - if ((*endp != ' ') && (*endp != '\0')) + if (*endp == '\0') + buf = endp; + else if (*endp == ' ') + buf = endp + 1; + else return -EINVAL; - buf = endp + 1; event = kzalloc(sizeof(*event), GFP_KERNEL); if (!event) -- 2.34.1

2 1

[PATCH OLK-6.6] hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
by Tong Tiangen 26 Sep '24

26 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> stable inclusion from stable-v6.6.51 commit 8fecb75bff1b7d87a071c32a37aa0700f2be379d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX5F CVE: CVE-2024-46756 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5c1de37969b7bc0abcb20b86e91e70caebbd4f89 ] DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/hwmon/w83627ehf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c index fe960c0a624f..7d7d70afde65 100644 --- a/drivers/hwmon/w83627ehf.c +++ b/drivers/hwmon/w83627ehf.c @@ -895,7 +895,7 @@ store_target_temp(struct device *dev, struct device_attribute *attr, if (err < 0) return err; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 127000), 1000); mutex_lock(&data->update_lock); data->target_temp[nr] = val; @@ -920,7 +920,7 @@ store_tolerance(struct device *dev, struct device_attribute *attr, return err; /* Limit the temp to 0C - 15C */ - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 15); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 15000), 1000); mutex_lock(&data->update_lock); reg = w83627ehf_read_value(data, W83627EHF_REG_TOLERANCE[nr]); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
by Tong Tiangen 26 Sep '24

26 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> stable inclusion from stable-v4.19.322 commit 93cf73a7bfdce683bde3a7bb65f270d3bd24497b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX5F CVE: CVE-2024-46756 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5c1de37969b7bc0abcb20b86e91e70caebbd4f89 ] DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- drivers/hwmon/w83627ehf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c index ad68b6d9ff17..8da5f77b8987 100644 --- a/drivers/hwmon/w83627ehf.c +++ b/drivers/hwmon/w83627ehf.c @@ -1519,7 +1519,7 @@ store_target_temp(struct device *dev, struct device_attribute *attr, if (err < 0) return err; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 127000), 1000); mutex_lock(&data->update_lock); data->target_temp[nr] = val; @@ -1545,7 +1545,7 @@ store_tolerance(struct device *dev, struct device_attribute *attr, return err; /* Limit the temp to 0C - 15C */ - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 15); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 15000), 1000); mutex_lock(&data->update_lock); if (sio_data->kind == nct6775 || sio_data->kind == nct6776) { -- 2.25.1

2 1

[PATCH OLK-6.6] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> stable inclusion from stable-v6.6.51 commit 39e7e593418ccdbd151f2925fa6be1a616d16c96 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 upstream. When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Link: https://lore.kernel.org/r/20240828154338.754746-1-david.fernandez.gonzalez@… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index 692daa9eff34..19c9d2cdd277 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -144,7 +144,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH OLK-6.6] char: xillybus: Check USB endpoints when probing device
by Ye Bin 26 Sep '24

26 Sep '24

From: Eli Billauer <eli.billauer(a)gmail.com> stable inclusion from stable-v6.6.48 commit 5cff754692ad45d5086b75fef8cc3a99c30a1005 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJN CVE: CVE-2024-45011 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2374bf7558de915edc6ec8cb10ec3291dfab9594 upstream. Ensure, as the driver probes the device, that all endpoints that the driver may attempt to access exist and are of the correct type. All XillyUSB devices must have a Bulk IN and Bulk OUT endpoint at address 1. This is verified in xillyusb_setup_base_eps(). On top of that, a XillyUSB device may have additional Bulk OUT endpoints. The information about these endpoints' addresses is deduced from a data structure (the IDT) that the driver fetches from the device while probing it. These endpoints are checked in setup_channels(). A XillyUSB device never has more than one IN endpoint, as all data towards the host is multiplexed in this single Bulk IN endpoint. This is why setup_channels() only checks OUT endpoints. Reported-by: syzbot+eac39cba052f2e750dbe(a)syzkaller.appspotmail.com Cc: stable <stable(a)kernel.org> Closes: https://lore.kernel.org/all/0000000000001d44a6061f7a54ee@google.com/T/ Fixes: a53d1202aef1 ("char: xillybus: Add driver for XillyUSB (Xillybus variant for USB)"). Signed-off-by: Eli Billauer <eli.billauer(a)gmail.com> Link: https://lore.kernel.org/r/20240816070200.50695-2-eli.billauer@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/char/xillybus/xillyusb.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/drivers/char/xillybus/xillyusb.c b/drivers/char/xillybus/xillyusb.c index 5a5afa14ca8c..613c366a2df6 100644 --- a/drivers/char/xillybus/xillyusb.c +++ b/drivers/char/xillybus/xillyusb.c @@ -1906,6 +1906,13 @@ static const struct file_operations xillyusb_fops = { static int xillyusb_setup_base_eps(struct xillyusb_dev *xdev) { + struct usb_device *udev = xdev->udev; + + /* Verify that device has the two fundamental bulk in/out endpoints */ + if (usb_pipe_type_check(udev, usb_sndbulkpipe(udev, MSG_EP_NUM)) || + usb_pipe_type_check(udev, usb_rcvbulkpipe(udev, IN_EP_NUM))) + return -ENODEV; + xdev->msg_ep = endpoint_alloc(xdev, MSG_EP_NUM | USB_DIR_OUT, bulk_out_work, 1, 2); if (!xdev->msg_ep) @@ -1935,14 +1942,15 @@ static int setup_channels(struct xillyusb_dev *xdev, __le16 *chandesc, int num_channels) { - struct xillyusb_channel *chan; + struct usb_device *udev = xdev->udev; + struct xillyusb_channel *chan, *new_channels; int i; chan = kcalloc(num_channels, sizeof(*chan), GFP_KERNEL); if (!chan) return -ENOMEM; - xdev->channels = chan; + new_channels = chan; for (i = 0; i < num_channels; i++, chan++) { unsigned int in_desc = le16_to_cpu(*chandesc++); @@ -1971,6 +1979,15 @@ static int setup_channels(struct xillyusb_dev *xdev, */ if ((out_desc & 0x80) && i < 14) { /* Entry is valid */ + if (usb_pipe_type_check(udev, + usb_sndbulkpipe(udev, i + 2))) { + dev_err(xdev->dev, + "Missing BULK OUT endpoint %d\n", + i + 2); + kfree(new_channels); + return -ENODEV; + } + chan->writable = 1; chan->out_synchronous = !!(out_desc & 0x40); chan->out_seekable = !!(out_desc & 0x20); @@ -1980,6 +1997,7 @@ static int setup_channels(struct xillyusb_dev *xdev, } } + xdev->channels = new_channels; return 0; } -- 2.34.1

2 1

[openeuler:OLK-6.6 8439/14122] cpu.c:undefined reference to `trace_event_buffer_commit'
by kernel test robot 26 Sep '24

26 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 81a41d2ac1de43215c014bc71d907a026042e55b commit: 4c7a7e37c75ec2611be134d953ae976bc25c793b [8439/14122] LoongArch: Change __my_cpu_offset definition to avoid mis-optimization config: loongarch-randconfig-002-20240925 (https://download.01.org/0day-ci/archive/20240926/202409261955.pho8kSov-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240926/202409261955.pho8kSov-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409261955.pho8kSov-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `sound/core/pcm_lib.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `lib/maple_tree.o' being placed in section `_ftrace_events' loongarch64-linux-ld: init/main.o: in function `.L199': main.c:(.text+0x1f0): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: main.c:(.text+0x22c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: init/main.o: in function `perf_trace_initcall_start': main.c:(.text+0x364): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: main.c:(.text+0x38c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: init/main.o: in function `perf_trace_initcall_finish': main.c:(.text+0x44c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: main.c:(.text+0x478): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: init/main.o: in function `trace_event_raw_event_initcall_start': main.c:(.text+0x550): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: main.c:(.text+0x560): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: init/main.o: in function `.L240': main.c:(.text+0x5a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: init/main.o: in function `trace_event_raw_event_initcall_finish': main.c:(.text+0x620): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: main.c:(.text+0x634): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: init/main.o: in function `.L251': main.c:(.text+0x688): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: init/main.o: in function `.L247': main.c:(.text+0x6bc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: init/main.o: in function `trace_raw_output_initcall_level': main.c:(.text+0x714): undefined reference to `trace_event_printf' loongarch64-linux-ld: main.c:(.text+0x734): undefined reference to `trace_handle_return' loongarch64-linux-ld: main.c:(.text+0x75c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: init/main.o: in function `trace_raw_output_initcall_start': main.c:(.text+0x7b0): undefined reference to `trace_event_printf' loongarch64-linux-ld: main.c:(.text+0x7d0): undefined reference to `trace_handle_return' loongarch64-linux-ld: main.c:(.text+0x7fc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: init/main.o: in function `trace_raw_output_initcall_finish': main.c:(.text+0x854): undefined reference to `trace_event_printf' loongarch64-linux-ld: main.c:(.text+0x874): undefined reference to `trace_handle_return' loongarch64-linux-ld: init/main.o: in function `trace_event_raw_event_initcall_level': main.c:(.text+0x8f8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: main.c:(.text+0x914): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: init/main.o: in function `.L312': main.c:(.text+0x97c): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: init/main.o: in function `.L299': main.c:(.text+0x9c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: init/main.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: init/main.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: init/main.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: init/main.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: init/main.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: init/main.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/fork.o: in function `perf_trace_task_newtask': fork.c:(.text+0x168): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `.L34': fork.c:(.text+0x1bc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/fork.o: in function `.L33': fork.c:(.text+0x238): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `trace_event_raw_event_task_newtask': fork.c:(.text+0x2f4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/fork.o: in function `.L39': fork.c:(.text+0x32c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/fork.o: in function `.L35': fork.c:(.text+0x36c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/fork.o: in function `.L36': fork.c:(.text+0x3a4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/fork.o: in function `trace_raw_output_task_newtask': fork.c:(.text+0x3fc): undefined reference to `trace_event_printf' loongarch64-linux-ld: fork.c:(.text+0x41c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/fork.o: in function `.L52': fork.c:(.text+0x444): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/fork.o: in function `trace_raw_output_task_rename': fork.c:(.text+0x49c): undefined reference to `trace_event_printf' loongarch64-linux-ld: fork.c:(.text+0x4bc): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/fork.o: in function `.L58': fork.c:(.text+0x520): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `perf_trace_task_rename': fork.c:(.text+0x580): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/fork.o: in function `.L59': fork.c:(.text+0x5f8): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `.L70': fork.c:(.text+0x6b8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/fork.o: in function `trace_event_raw_event_task_rename': fork.c:(.text+0x6fc): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/fork.o: in function `.L77': fork.c:(.text+0x748): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cpu.o: in function `perf_trace_cpuhp_enter': cpu.c:(.text+0x2cc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cpu.o: in function `.L35': cpu.c:(.text+0x300): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cpu.o: in function `perf_trace_cpuhp_multi_enter': cpu.c:(.text+0x3dc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cpu.o: in function `.L47': cpu.c:(.text+0x410): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cpu.o: in function `perf_trace_cpuhp_exit': cpu.c:(.text+0x4fc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cpu.o: in function `.L59': cpu.c:(.text+0x530): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cpu.o: in function `trace_event_raw_event_cpuhp_enter': cpu.c:(.text+0x628): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cpu.o: in function `.L74': >> cpu.c:(.text+0x644): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cpu.o: in function `.L70': cpu.c:(.text+0x6a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cpu.o: in function `trace_event_raw_event_cpuhp_multi_enter': cpu.c:(.text+0x730): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: cpu.c:(.text+0x74c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cpu.o: in function `.L81': cpu.c:(.text+0x7a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cpu.o: in function `trace_event_raw_event_cpuhp_exit': cpu.c:(.text+0x830): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: cpu.c:(.text+0x84c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cpu.o: in function `.L92': cpu.c:(.text+0x8a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: cpu.c:(.text+0x8dc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cpu.o: in function `trace_raw_output_cpuhp_enter': cpu.c:(.text+0x93c): undefined reference to `trace_event_printf' loongarch64-linux-ld: cpu.c:(.text+0x95c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/cpu.o: in function `.L108': >> cpu.c:(.text+0x984): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cpu.o: in function `trace_raw_output_cpuhp_multi_enter': cpu.c:(.text+0x9dc): undefined reference to `trace_event_printf' loongarch64-linux-ld: cpu.c:(.text+0x9fc): undefined reference to `trace_handle_return' loongarch64-linux-ld: cpu.c:(.text+0xa24): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cpu.o: in function `trace_raw_output_cpuhp_exit': cpu.c:(.text+0xa7c): undefined reference to `trace_event_printf' loongarch64-linux-ld: cpu.c:(.text+0xa9c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/cpu.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cpu.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cpu.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cpu.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cpu.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cpu.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/softirq.o: in function `perf_trace_irq_handler_exit': softirq.c:(.text+0x454): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/softirq.o: in function `.L74': softirq.c:(.text+0x480): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/softirq.o: in function `perf_trace_softirq': softirq.c:(.text+0x544): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/softirq.o: in function `.L86': softirq.c:(.text+0x56c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/softirq.o: in function `perf_trace_tasklet': softirq.c:(.text+0x62c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/softirq.o: in function `.L98': softirq.c:(.text+0x658): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/softirq.o: in function `trace_event_raw_event_irq_handler_exit': softirq.c:(.text+0x738): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: softirq.c:(.text+0x74c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/softirq.o: in function `.L109': softirq.c:(.text+0x7a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/softirq.o: in function `trace_event_raw_event_softirq': softirq.c:(.text+0x818): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: softirq.c:(.text+0x828): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/softirq.o: in function `.L120': softirq.c:(.text+0x868): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/softirq.o: in function `trace_event_raw_event_tasklet': softirq.c:(.text+0x8e0): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: softirq.c:(.text+0x8f4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/softirq.o: in function `.L131': softirq.c:(.text+0x948): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: softirq.c:(.text+0x97c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/softirq.o: in function `trace_raw_output_irq_handler_entry': softirq.c:(.text+0x9d8): undefined reference to `trace_event_printf' loongarch64-linux-ld: softirq.c:(.text+0x9f8): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/softirq.o: in function `.L147': softirq.c:(.text+0xa24): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/softirq.o: in function `trace_raw_output_irq_handler_exit': softirq.c:(.text+0xa50): undefined reference to `trace_event_printf' loongarch64-linux-ld: softirq.c:(.text+0xa70): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/softirq.o: in function `.L153': softirq.c:(.text+0xaf4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/softirq.o: in function `trace_raw_output_tasklet': softirq.c:(.text+0xb54): undefined reference to `trace_event_printf' loongarch64-linux-ld: softirq.c:(.text+0xb74): undefined reference to `trace_handle_return' loongarch64-linux-ld: softirq.c:(.text+0xb9c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/softirq.o: in function `trace_raw_output_softirq': softirq.c:(.text+0xbf4): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: softirq.c:(.text+0xc0c): undefined reference to `trace_event_printf' loongarch64-linux-ld: softirq.c:(.text+0xc2c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/softirq.o: in function `.L206': softirq.c:(.text+0xff4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/softirq.o: in function `.L205': softirq.c:(.text+0x1044): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/softirq.o: in function `.L230': softirq.c:(.text+0x11d4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/softirq.o: in function `.L227': softirq.c:(.text+0x1204): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/softirq.o: in function `trace_event_raw_event_irq_handler_entry': softirq.c:(.text+0x1288): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0xf0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0x118): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/signal.o: in function `perf_trace_signal_generate': signal.c:(.text+0x260): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/signal.o: in function `.L30': signal.c:(.text+0x2cc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/signal.o: in function `.L41': signal.c:(.text+0x358): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/signal.o: in function `perf_trace_signal_deliver': signal.c:(.text+0x414): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/signal.o: in function `.L49': signal.c:(.text+0x468): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/signal.o: in function `trace_event_raw_event_signal_generate': signal.c:(.text+0x590): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/signal.o: in function `.L66': signal.c:(.text+0x5e0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/signal.o: in function `.L62': signal.c:(.text+0x688): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/signal.o: in function `trace_event_raw_event_signal_deliver': signal.c:(.text+0x708): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: signal.c:(.text+0x748): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/signal.o: in function `.L78': signal.c:(.text+0x7e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/signal.o: in function `.L92': signal.c:(.text+0x81c): undefined reference to `trace_raw_output_prep' -- update.c:(.text+0x630): undefined reference to `trace_event_printf' loongarch64-linux-ld: update.c:(.text+0x650): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/rcu/update.o: in function `.L88': update.c:(.text+0x67c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/rcu/update.o: in function `trace_raw_output_rcu_stall_warning': update.c:(.text+0x6d4): undefined reference to `trace_event_printf' loongarch64-linux-ld: update.c:(.text+0x6f4): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/rcu/update.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/rcu/update.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/rcu/update.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/rcu/update.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `.L51': swiotlb.c:(.text+0x46c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `trace_raw_output_swiotlb_bounced': swiotlb.c:(.text+0x4a8): undefined reference to `trace_event_printf' loongarch64-linux-ld: swiotlb.c:(.text+0x4c8): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `.L237': swiotlb.c:(.text+0x11c4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `perf_trace_swiotlb_bounced': swiotlb.c:(.text+0x1234): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `.L239': swiotlb.c:(.text+0x1394): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `.L264': swiotlb.c:(.text+0x13ec): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `trace_event_raw_event_swiotlb_bounced': swiotlb.c:(.text+0x147c): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `.L293': swiotlb.c:(.text+0x14e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/dma/swiotlb.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/dma/swiotlb.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/entry/common.o: in function `.L22': common.c:(.text+0x154): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: common.c:(.text+0x184): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/entry/common.o: in function `perf_trace_sys_enter': common.c:(.text+0x250): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/entry/common.o: in function `.L46': common.c:(.text+0x298): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/entry/common.o: in function `.L33': common.c:(.text+0x318): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/entry/common.o: in function `trace_event_raw_event_sys_enter': common.c:(.text+0x3d8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/entry/common.o: in function `.L51': common.c:(.text+0x404): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/entry/common.o: in function `.L47': common.c:(.text+0x448): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/entry/common.o: in function `trace_event_raw_event_sys_exit': common.c:(.text+0x4c0): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: common.c:(.text+0x4dc): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/entry/common.o: in function `.L58': common.c:(.text+0x528): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: common.c:(.text+0x55c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/entry/common.o: in function `trace_raw_output_sys_enter': common.c:(.text+0x5cc): undefined reference to `trace_event_printf' loongarch64-linux-ld: common.c:(.text+0x5ec): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/entry/common.o: in function `.L74': common.c:(.text+0x614): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/entry/common.o: in function `trace_raw_output_sys_exit': common.c:(.text+0x674): undefined reference to `trace_event_printf' loongarch64-linux-ld: common.c:(.text+0x694): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/entry/common.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/entry/common.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/entry/common.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/entry/common.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o: in function `.L114': timer.c:(.text+0x814): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/timer.o: in function `perf_trace_timer_class': timer.c:(.text+0x83c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `perf_trace_timer_start': timer.c:(.text+0x914): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: timer.c:(.text+0x958): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L143': timer.c:(.text+0xa2c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/timer.o: in function `perf_trace_timer_expire_entry': timer.c:(.text+0xa6c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L144': timer.c:(.text+0xb34): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/timer.o: in function `perf_trace_hrtimer_init': timer.c:(.text+0xb64): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L156': timer.c:(.text+0xc2c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/timer.o: in function `perf_trace_hrtimer_start': timer.c:(.text+0xc70): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L168': timer.c:(.text+0xd2c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/timer.o: in function `.L179': timer.c:(.text+0xd64): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L180': timer.c:(.text+0xe24): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: timer.c:(.text+0xe4c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L192': timer.c:(.text+0xf14): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/timer.o: in function `.L203': timer.c:(.text+0xf60): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L204': timer.c:(.text+0x1034): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: timer.c:(.text+0x1070): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L219': timer.c:(.text+0x1130): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/time/timer.o: in function `.L216': timer.c:(.text+0x1140): undefined reference to `trace_event_buffer_commit' >> loongarch64-linux-ld: timer.c:(.text+0x1188): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_timer_class': timer.c:(.text+0x1208): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/time/timer.o: in function `.L231': timer.c:(.text+0x1238): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L232': timer.c:(.text+0x1288): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `.L246': timer.c:(.text+0x1300): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: timer.c:(.text+0x132c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L242': timer.c:(.text+0x1368): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_timer_expire_entry': timer.c:(.text+0x13e8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/time/timer.o: in function `.L257': timer.c:(.text+0x1400): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L253': timer.c:(.text+0x1448): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_hrtimer_init': timer.c:(.text+0x14b8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: timer.c:(.text+0x14e8): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L264': timer.c:(.text+0x152c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_hrtimer_start': timer.c:(.text+0x15a8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: timer.c:(.text+0x15cc): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L279': timer.c:(.text+0x1608): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `.L276': timer.c:(.text+0x1678): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: timer.c:(.text+0x1688): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_hrtimer_expire_entry': timer.c:(.text+0x16c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `.L286': timer.c:(.text+0x1748): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/time/timer.o: in function `.L287': timer.c:(.text+0x1780): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_hrtimer_class': timer.c:(.text+0x17c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `.L298': timer.c:(.text+0x1848): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_itimer_state': timer.c:(.text+0x186c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L312': timer.c:(.text+0x18c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: timer.c:(.text+0x18fc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `.L308': timer.c:(.text+0x1950): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_itimer_expire': timer.c:(.text+0x1970): undefined reference to `trace_handle_return' loongarch64-linux-ld: timer.c:(.text+0x199c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `.L324': timer.c:(.text+0x19fc): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/time/timer.o: in function `.L319': timer.c:(.text+0x1a1c): undefined reference to `trace_handle_return' loongarch64-linux-ld: timer.c:(.text+0x1a44): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_raw_output_timer_class': timer.c:(.text+0x1a98): undefined reference to `trace_event_printf' loongarch64-linux-ld: timer.c:(.text+0x1ab8): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/time/timer.o: in function `.L338': timer.c:(.text+0x1ae4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_raw_output_timer_expire_entry': timer.c:(.text+0x1b30): undefined reference to `trace_event_printf' loongarch64-linux-ld: timer.c:(.text+0x1b50): undefined reference to `trace_handle_return' loongarch64-linux-ld: timer.c:(.text+0x1b7c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_raw_output_hrtimer_expire_entry': timer.c:(.text+0x1bf0): undefined reference to `trace_event_printf' loongarch64-linux-ld: timer.c:(.text+0x1c10): undefined reference to `trace_handle_return' loongarch64-linux-ld: timer.c:(.text+0x1c3c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_raw_output_hrtimer_class': timer.c:(.text+0x1c98): undefined reference to `trace_event_printf' loongarch64-linux-ld: timer.c:(.text+0x1cb8): undefined reference to `trace_handle_return' loongarch64-linux-ld: timer.c:(.text+0x1ce4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_raw_output_itimer_state': timer.c:(.text+0x1d84): undefined reference to `trace_print_flags_seq' loongarch64-linux-ld: kernel/time/timer.o: in function `.L362': timer.c:(.text+0x1db0): undefined reference to `trace_event_printf' loongarch64-linux-ld: timer.c:(.text+0x1de0): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_raw_output_itimer_expire': timer.c:(.text+0x1e0c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: timer.c:(.text+0x1e68): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: kernel/time/timer.o: in function `.L368': timer.c:(.text+0x1e80): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: timer.c:(.text+0x1e9c): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_raw_output_timer_start': timer.c:(.text+0x1ec8): undefined reference to `trace_handle_return' loongarch64-linux-ld: timer.c:(.text+0x1ef4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `.L374': timer.c:(.text+0x1f70): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: timer.c:(.text+0x1f94): undefined reference to `trace_event_printf' loongarch64-linux-ld: timer.c:(.text+0x1fc0): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0xf0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x118): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x138): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x160): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x180): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x1a8): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x1c8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x1f0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x210): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x238): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x258): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x280): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `perf_trace_alarmtimer_suspend': alarmtimer.c:(.text+0x2d4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `.L46': alarmtimer.c:(.text+0x300): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `perf_trace_alarm_class': alarmtimer.c:(.text+0x3cc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `.L58': alarmtimer.c:(.text+0x408): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `trace_event_raw_event_alarmtimer_suspend': alarmtimer.c:(.text+0x4d8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: alarmtimer.c:(.text+0x4ec): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `.L73': alarmtimer.c:(.text+0x528): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `.L70': alarmtimer.c:(.text+0x598): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `trace_event_raw_event_alarm_class': alarmtimer.c:(.text+0x5c0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `.L84': alarmtimer.c:(.text+0x60c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `.L80': alarmtimer.c:(.text+0x644): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `trace_raw_output_alarmtimer_suspend': alarmtimer.c:(.text+0x6a0): undefined reference to `trace_print_flags_seq' loongarch64-linux-ld: alarmtimer.c:(.text+0x6b8): undefined reference to `trace_event_printf' loongarch64-linux-ld: alarmtimer.c:(.text+0x6d8): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `.L96': alarmtimer.c:(.text+0x704): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `trace_raw_output_alarm_class': alarmtimer.c:(.text+0x76c): undefined reference to `trace_print_flags_seq' loongarch64-linux-ld: alarmtimer.c:(.text+0x78c): undefined reference to `trace_event_printf' loongarch64-linux-ld: alarmtimer.c:(.text+0x7b0): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/smp.o: in function `perf_trace_csd_queue_cpu': smp.c:(.text+0x214): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/smp.o: in function `.L30': smp.c:(.text+0x248): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/smp.o: in function `perf_trace_csd_function': smp.c:(.text+0x30c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/smp.o: in function `.L42': smp.c:(.text+0x338): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/smp.o: in function `trace_event_raw_event_csd_queue_cpu': smp.c:(.text+0x428): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/smp.o: in function `.L57': smp.c:(.text+0x444): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/smp.o: in function `.L53': smp.c:(.text+0x4a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/smp.o: in function `trace_event_raw_event_csd_function': smp.c:(.text+0x520): undefined reference to `trace_event_buffer_reserve' >> loongarch64-linux-ld: smp.c:(.text+0x534): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/smp.o: in function `.L64': smp.c:(.text+0x588): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/smp.o: in function `.L65': smp.c:(.text+0x5bc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/smp.o: in function `trace_raw_output_csd_queue_cpu': smp.c:(.text+0x61c): undefined reference to `trace_event_printf' loongarch64-linux-ld: smp.c:(.text+0x63c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/smp.o: in function `.L80': smp.c:(.text+0x664): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/smp.o: in function `trace_raw_output_csd_function': smp.c:(.text+0x6b4): undefined reference to `trace_event_printf' loongarch64-linux-ld: smp.c:(.text+0x6d4): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L255': kexec_core.c:(.text+0x1b10): undefined reference to `machine_kexec_cleanup' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L296': kexec_core.c:(.text+0x1d70): undefined reference to `machine_crash_shutdown' loongarch64-linux-ld: kexec_core.c:(.text+0x1d78): undefined reference to `machine_kexec' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L383': kexec_core.c:(.text+0x2350): undefined reference to `machine_shutdown' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L380': kexec_core.c:(.text+0x2360): undefined reference to `machine_kexec' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L128': cgroup.c:(.text+0x858): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L129': cgroup.c:(.text+0x8b0): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `perf_trace_cgroup_event': cgroup.c:(.text+0xa58): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L147': cgroup.c:(.text+0xab8): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L168': cgroup.c:(.text+0xd70): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L21': cgroup.c:(.text+0xdb4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L192': cgroup.c:(.text+0xe68): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: cgroup.c:(.text+0xe9c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L189': cgroup.c:(.text+0xefc): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L200': cgroup.c:(.text+0xf1c): undefined reference to `trace_handle_return' loongarch64-linux-ld: cgroup.c:(.text+0xf44): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L190': cgroup.c:(.text+0xfa0): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `trace_raw_output_cgroup_root': cgroup.c:(.text+0xfc0): undefined reference to `trace_handle_return' loongarch64-linux-ld: cgroup.c:(.text+0xfec): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `trace_raw_output_cgroup': cgroup.c:(.text+0x106c): undefined reference to `trace_event_printf' loongarch64-linux-ld: cgroup.c:(.text+0x108c): undefined reference to `trace_handle_return' loongarch64-linux-ld: cgroup.c:(.text+0x10b4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `trace_raw_output_cgroup_migrate': cgroup.c:(.text+0x1124): undefined reference to `trace_event_printf' loongarch64-linux-ld: cgroup.c:(.text+0x1144): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L725': cgroup.c:(.text+0x3e50): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L15': cgroup.c:(.text+0x3ed4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L756': cgroup.c:(.text+0x4020): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L761': cgroup.c:(.text+0x407c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L779': cgroup.c:(.text+0x41d4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L769': cgroup.c:(.text+0x4218): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: cgroup.c:(.text+0x4274): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L772': cgroup.c:(.text+0x42c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `perf_trace_cgroup_migrate': cgroup.c:(.text+0x4364): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: cgroup.c:(.text+0x4394): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L783': cgroup.c:(.text+0x43ec): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L784': cgroup.c:(.text+0x4448): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L799': cgroup.c:(.text+0x4520): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `perf_trace_cgroup': cgroup.c:(.text+0x4588): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L802': cgroup.c:(.text+0x4668): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0xf0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x118): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L12': error_report-traces.c:(.text+0xdc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: error_report-traces.c:(.text+0x108): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `trace_event_raw_event_error_report_template': error_report-traces.c:(.text+0x1d8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L27': error_report-traces.c:(.text+0x1ec): undefined reference to `trace_event_buffer_commit' .. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 v2 0/5] Fix CVE-2024-45025
by Long Li 26 Sep '24

26 Sep '24

This patch set fix cve-2024-45025 Al Viro (1): fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE Alexander Lobakin (4): tools: move alignment-related macros to new <linux/align.h> fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64() bitmap: introduce generic optimized bitmap_size() s390/cio: rename bitmap_size() -> idset_bitmap_size() drivers/md/dm-clone-metadata.c | 5 --- drivers/s390/cio/idset.c | 12 ++++--- fs/file.c | 30 +++++++--------- fs/ntfs3/bitmap.c | 4 +-- fs/ntfs3/fsntfs.c | 2 +- fs/ntfs3/index.c | 11 +++--- fs/ntfs3/ntfs_fs.h | 4 +-- fs/ntfs3/super.c | 2 +- include/linux/bitmap.h | 20 +++++++++-- include/linux/cpumask.h | 2 +- lib/math/prime_numbers.c | 2 -- tools/include/linux/align.h | 12 +++++++ tools/include/linux/bitmap.h | 9 ++--- .../testing/selftests/core/close_range_test.c | 35 +++++++++++++++++++ 14 files changed, 102 insertions(+), 48 deletions(-) create mode 100644 tools/include/linux/align.h -- 2.39.2

2 6

[PATCH OLK-6.6] arm64/mpam: Fix redefined reference of 'mpam_detect_is_enabled'
by Zeng Heng 26 Sep '24

26 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATSCU -------------------------------- Fix re-defined reference of 'mpam_detect_is_enabled' when CONFIG_ARM64_MPAM is enabled. Fixes: 797c68d3b52d ("arm64/mpam: Check mpam_detect_is_enabled() before accessing MPAM registers") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/include/asm/cpufeature.h | 7 ------- 1 file changed, 7 deletions(-) diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h index f8ec4b20fa69..4c759e0dcc21 100644 --- a/arch/arm64/include/asm/cpufeature.h +++ b/arch/arm64/include/asm/cpufeature.h @@ -858,14 +858,7 @@ static inline bool cpus_support_mpam(void) cpus_have_final_cap(ARM64_MPAM); } -#ifdef CONFIG_ARM64_MPAM bool mpam_detect_is_enabled(void); -#else -static inline bool mpam_detect_is_enabled(void) -{ - return false; -} -#endif int do_emulate_mrs(struct pt_regs *regs, u32 sys_reg, u32 rt); bool try_emulate_mrs(struct pt_regs *regs, u32 isn); -- 2.25.1

2 1

[PATCH OLK-5.10] acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
by Xiongfeng Wang 26 Sep '24

26 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATDZ5 CVE: NA -------------------------------- When two vCPUs of NUMA1 are hot added and then taken to online, e.g.: In qemu monitor: device_add host-arm-cpu,socket-id=1,cluster-id=0,core-id=0, thread-id=0,id=core4 device_add host-arm-cpu,socket-id=1,cluster-id=0,core-id=0, thread-id=1,id=core5 In guest: echo 1 > /sys/devices/system/cpu/cpu4/online it will appear calltrace as below: WARNING: CPU: 4 PID: 286 at kernel/sched/core.c:2293 __set_cpus_allowed_ptr+0x468/0x4d4 Modules linked in: ... CPU: 4 PID: 286 Comm: cpuhp/4 Tainted: G W OE 5.10.0 #1 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 20400085 (nzCv daIf +PAN -UAO -TCO BTYPE=--) pc : __set_cpus_allowed_ptr+0x468/0x4d4 lr : __set_cpus_allowed_ptr+0x440/0x4d4 sp : ffff800010a43c30 x29: ffff800010a43c30 x28: ffff4e2fbffe7c40 x27: ffffa34037fcb450 x26: ffffa340372f2000 x25: 0000000000000004 x24: ffffa34037c47140 x23: ffff4e2f3ffc7480 x22: 0000000000000000 x21: ffff4e2ec0fee040 x20: ffffa34037cb8530 x19: ffffa34037cb7c80 x18: ffff4e2f80242787 x17: 00000000248943a4 x16: 0000000000000000 x15: ffff800010760000 x14: 0000000000001000 x13: ffff80000fffffff x12: 0000000000007290 x11: ffff4e2fbffeeed0 x10: ffffa3403826eea8 x9 : ffffa340341b8290 x8 : 0000000000000000 x7 : ffffa3403826a3c8 x6 : ffff4e2ec0fee4f8 x5 : 0000000000000000 x4 : 00000000000007c7 x3 : ffffffffffffffff x2 : 00000000000000ff x1 : 0000000000000004 x0 : 0000000000000001 Call trace: __set_cpus_allowed_ptr+0x468/0x4d4 set_cpus_allowed_ptr+0x38/0x5c kcompactd_cpu_online+0xb0/0x190 cpuhp_invoke_callback+0x274/0xbb0 cpuhp_thread_fun+0x188/0x36c smpboot_thread_fn+0x144/0x380 kthread+0x190/0x1fc ret_from_fork+0x10/0x18 When the WARN_ON occurs, the mask variables is as follows. new_mask: 0-4 activ_mask:0-3 nr_cpus_allowed:2 numa_add_cpu() is called in secondary_start_kernel() when the CPU is brought up online. We need to remove numa_add_cpu() in acpi_map_cpu(). So it is for arch/x86. Also fix it in acpi_unmap_cpu() as well. Fixes: 7eaf6534f708 ("arm64: Add CPU hotplug support") Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Zhou Wang <wangzhou1(a)hisilicon.com> --- arch/arm64/kernel/acpi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/arch/arm64/kernel/acpi.c b/arch/arm64/kernel/acpi.c index a81105cfe57e2..f043bec3ba50f 100644 --- a/arch/arm64/kernel/acpi.c +++ b/arch/arm64/kernel/acpi.c @@ -417,7 +417,6 @@ int acpi_map_cpu(acpi_handle handle, phys_cpuid_t physid, u32 acpi_id, nid = acpi_get_node(handle); if (nid != NUMA_NO_NODE) { set_cpu_numa_node(cpu, nid); - numa_add_cpu(cpu); } *pcpu = cpu; @@ -430,7 +429,7 @@ EXPORT_SYMBOL(acpi_map_cpu); int acpi_unmap_cpu(int cpu) { set_cpu_present(cpu, false); - numa_clear_node(cpu); + set_cpu_numa_node(cpu, NUMA_NO_NODE); return 0; } -- 2.20.1

2 1

[PATCH openEuler-1.0-LTS] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> stable inclusion from stable-v4.19.322 commit f6365931bf7c07b2b397dbb06a4f6573cc9fae73 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 upstream. When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Link: https://lore.kernel.org/r/20240828154338.754746-1-david.fernandez.gonzalez@… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index da1ee2e1ba99..2779704e128a 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -152,7 +152,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2024-46777 for 4.19
by Wupeng Ma 26 Sep '24

26 Sep '24

From: Ma Wupeng <mawupeng1(a)huawei.com> fix cve for CVE-2024-46777. Jan Kara (2): udf: Define EFSCORRUPTED error code udf: Avoid excessive partition lengths fs/udf/super.c | 15 +++++++++++++++ fs/udf/udf_sb.h | 2 ++ 2 files changed, 17 insertions(+) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1] bcache: fix variable length array abuse in btree_iter
by Yuan Can 26 Sep '24

26 Sep '24

From: Matthew Mirvish <matthew(a)mm12.xyz> stable inclusion from stable-v5.10.221 commit 2c3d7b03b658dc8bfa6112b194b67b92a87e081b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB04K CVE: CVE-2024-39482 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31 upstream. btree_iter is used in two ways: either allocated on the stack with a fixed size MAX_BSETS, or from a mempool with a dynamic size based on the specific cache set. Previously, the struct had a fixed-length array of size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized iterators, which causes UBSAN to complain. This patch uses the same approach as in bcachefs's sort_iter and splits the iterator into a btree_iter with a flexible array member and a btree_iter_stack which embeds a btree_iter as well as a fixed-length data array. Cc: stable(a)vger.kernel.org Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039368 Signed-off-by: Matthew Mirvish <matthew(a)mm12.xyz> Signed-off-by: Coly Li <colyli(a)suse.de> Link: https://lore.kernel.org/r/20240509011117.2697-3-colyli@suse.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/md/bcache/bset.c | 44 +++++++++++++++++------------------ drivers/md/bcache/bset.h | 28 ++++++++++++++-------- drivers/md/bcache/btree.c | 40 ++++++++++++++++--------------- drivers/md/bcache/super.c | 5 ++-- drivers/md/bcache/sysfs.c | 2 +- drivers/md/bcache/writeback.c | 10 ++++---- 6 files changed, 70 insertions(+), 59 deletions(-) diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c index 94d38e8a59b3..cb544207427b 100644 --- a/drivers/md/bcache/bset.c +++ b/drivers/md/bcache/bset.c @@ -54,7 +54,7 @@ void bch_dump_bucket(struct btree_keys *b) int __bch_count_data(struct btree_keys *b) { unsigned int ret = 0; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey *k; if (b->ops->is_extents) @@ -67,7 +67,7 @@ void __bch_check_keys(struct btree_keys *b, const char *fmt, ...) { va_list args; struct bkey *k, *p = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; const char *err; for_each_key(b, k, &iter) { @@ -879,7 +879,7 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k, unsigned int status = BTREE_INSERT_STATUS_NO_INSERT; struct bset *i = bset_tree_last(b)->data; struct bkey *m, *prev = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey preceding_key_on_stack = ZERO_KEY; struct bkey *preceding_key_p = &preceding_key_on_stack; @@ -895,9 +895,9 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k, else preceding_key(k, &preceding_key_p); - m = bch_btree_iter_init(b, &iter, preceding_key_p); + m = bch_btree_iter_stack_init(b, &iter, preceding_key_p); - if (b->ops->insert_fixup(b, k, &iter, replace_key)) + if (b->ops->insert_fixup(b, k, &iter.iter, replace_key)) return status; status = BTREE_INSERT_STATUS_INSERT; @@ -1100,33 +1100,33 @@ void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k, btree_iter_cmp)); } -static struct bkey *__bch_btree_iter_init(struct btree_keys *b, - struct btree_iter *iter, - struct bkey *search, - struct bset_tree *start) +static struct bkey *__bch_btree_iter_stack_init(struct btree_keys *b, + struct btree_iter_stack *iter, + struct bkey *search, + struct bset_tree *start) { struct bkey *ret = NULL; - iter->size = ARRAY_SIZE(iter->data); - iter->used = 0; + iter->iter.size = ARRAY_SIZE(iter->stack_data); + iter->iter.used = 0; #ifdef CONFIG_BCACHE_DEBUG - iter->b = b; + iter->iter.b = b; #endif for (; start <= bset_tree_last(b); start++) { ret = bch_bset_search(b, start, search); - bch_btree_iter_push(iter, ret, bset_bkey_last(start->data)); + bch_btree_iter_push(&iter->iter, ret, bset_bkey_last(start->data)); } return ret; } -struct bkey *bch_btree_iter_init(struct btree_keys *b, - struct btree_iter *iter, +struct bkey *bch_btree_iter_stack_init(struct btree_keys *b, + struct btree_iter_stack *iter, struct bkey *search) { - return __bch_btree_iter_init(b, iter, search, b->set); + return __bch_btree_iter_stack_init(b, iter, search, b->set); } static inline struct bkey *__bch_btree_iter_next(struct btree_iter *iter, @@ -1293,10 +1293,10 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start, struct bset_sort_state *state) { size_t order = b->page_order, keys = 0; - struct btree_iter iter; + struct btree_iter_stack iter; int oldsize = bch_count_data(b); - __bch_btree_iter_init(b, &iter, NULL, &b->set[start]); + __bch_btree_iter_stack_init(b, &iter, NULL, &b->set[start]); if (start) { unsigned int i; @@ -1307,7 +1307,7 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start, order = get_order(__set_bytes(b->set->data, keys)); } - __btree_sort(b, &iter, start, order, false, state); + __btree_sort(b, &iter.iter, start, order, false, state); EBUG_ON(oldsize >= 0 && bch_count_data(b) != oldsize); } @@ -1323,11 +1323,11 @@ void bch_btree_sort_into(struct btree_keys *b, struct btree_keys *new, struct bset_sort_state *state) { uint64_t start_time = local_clock(); - struct btree_iter iter; + struct btree_iter_stack iter; - bch_btree_iter_init(b, &iter, NULL); + bch_btree_iter_stack_init(b, &iter, NULL); - btree_mergesort(b, new->set->data, &iter, false, true); + btree_mergesort(b, new->set->data, &iter.iter, false, true); bch_time_stats_update(&state->time, start_time); diff --git a/drivers/md/bcache/bset.h b/drivers/md/bcache/bset.h index d795c84246b0..011f6062c4c0 100644 --- a/drivers/md/bcache/bset.h +++ b/drivers/md/bcache/bset.h @@ -321,7 +321,14 @@ struct btree_iter { #endif struct btree_iter_set { struct bkey *k, *end; - } data[MAX_BSETS]; + } data[]; +}; + +/* Fixed-size btree_iter that can be allocated on the stack */ + +struct btree_iter_stack { + struct btree_iter iter; + struct btree_iter_set stack_data[MAX_BSETS]; }; typedef bool (*ptr_filter_fn)(struct btree_keys *b, const struct bkey *k); @@ -333,9 +340,9 @@ struct bkey *bch_btree_iter_next_filter(struct btree_iter *iter, void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k, struct bkey *end); -struct bkey *bch_btree_iter_init(struct btree_keys *b, - struct btree_iter *iter, - struct bkey *search); +struct bkey *bch_btree_iter_stack_init(struct btree_keys *b, + struct btree_iter_stack *iter, + struct bkey *search); struct bkey *__bch_bset_search(struct btree_keys *b, struct bset_tree *t, const struct bkey *search); @@ -350,13 +357,14 @@ static inline struct bkey *bch_bset_search(struct btree_keys *b, return search ? __bch_bset_search(b, t, search) : t->data->start; } -#define for_each_key_filter(b, k, iter, filter) \ - for (bch_btree_iter_init((b), (iter), NULL); \ - ((k) = bch_btree_iter_next_filter((iter), (b), filter));) +#define for_each_key_filter(b, k, stack_iter, filter) \ + for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \ + ((k) = bch_btree_iter_next_filter(&((stack_iter)->iter), (b), \ + filter));) -#define for_each_key(b, k, iter) \ - for (bch_btree_iter_init((b), (iter), NULL); \ - ((k) = bch_btree_iter_next(iter));) +#define for_each_key(b, k, stack_iter) \ + for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \ + ((k) = bch_btree_iter_next(&((stack_iter)->iter)));) /* Sorting */ diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c index 98daa9d200f7..da24a3ca69e5 100644 --- a/drivers/md/bcache/btree.c +++ b/drivers/md/bcache/btree.c @@ -1274,7 +1274,7 @@ static bool btree_gc_mark_node(struct btree *b, struct gc_stat *gc) uint8_t stale = 0; unsigned int keys = 0, good_keys = 0; struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; struct bset_tree *t; gc->nodes++; @@ -1533,7 +1533,7 @@ static int btree_gc_rewrite_node(struct btree *b, struct btree_op *op, static unsigned int btree_gc_count_keys(struct btree *b) { struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; unsigned int ret = 0; for_each_key_filter(&b->keys, k, &iter, bch_ptr_bad) @@ -1574,17 +1574,18 @@ static int btree_gc_recurse(struct btree *b, struct btree_op *op, int ret = 0; bool should_rewrite; struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; struct gc_merge_info r[GC_MERGE_NODES]; struct gc_merge_info *i, *last = r + ARRAY_SIZE(r) - 1; - bch_btree_iter_init(&b->keys, &iter, &b->c->gc_done); + bch_btree_iter_stack_init(&b->keys, &iter, &b->c->gc_done); for (i = r; i < r + ARRAY_SIZE(r); i++) i->b = ERR_PTR(-EINTR); while (1) { - k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad); + k = bch_btree_iter_next_filter(&iter.iter, &b->keys, + bch_ptr_bad); if (k) { r->b = bch_btree_node_get(b->c, op, k, b->level - 1, true, b); @@ -1874,7 +1875,7 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op) { int ret = 0; struct bkey *k, *p = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; for_each_key_filter(&b->keys, k, &iter, bch_ptr_invalid) bch_initial_mark_key(b->c, b->level, k); @@ -1882,10 +1883,10 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op) bch_initial_mark_key(b->c, b->level + 1, &b->key); if (b->level) { - bch_btree_iter_init(&b->keys, &iter, NULL); + bch_btree_iter_stack_init(&b->keys, &iter, NULL); do { - k = bch_btree_iter_next_filter(&iter, &b->keys, + k = bch_btree_iter_next_filter(&iter.iter, &b->keys, bch_ptr_bad); if (k) { btree_node_prefetch(b, k); @@ -1913,7 +1914,7 @@ static int bch_btree_check_thread(void *arg) struct btree_check_info *info = arg; struct btree_check_state *check_state = info->state; struct cache_set *c = check_state->c; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey *k, *p; int cur_idx, prev_idx, skip_nr; @@ -1922,8 +1923,8 @@ static int bch_btree_check_thread(void *arg) ret = 0; /* root node keys are checked before thread created */ - bch_btree_iter_init(&c->root->keys, &iter, NULL); - k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad); + bch_btree_iter_stack_init(&c->root->keys, &iter, NULL); + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); BUG_ON(!k); p = k; @@ -1941,7 +1942,7 @@ static int bch_btree_check_thread(void *arg) skip_nr = cur_idx - prev_idx; while (skip_nr) { - k = bch_btree_iter_next_filter(&iter, + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); if (k) @@ -2005,7 +2006,7 @@ int bch_btree_check(struct cache_set *c) int ret = 0; int i; struct bkey *k = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; struct btree_check_state check_state; /* check and mark root node keys */ @@ -2501,11 +2502,11 @@ static int bch_btree_map_nodes_recurse(struct btree *b, struct btree_op *op, if (b->level) { struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; - bch_btree_iter_init(&b->keys, &iter, from); + bch_btree_iter_stack_init(&b->keys, &iter, from); - while ((k = bch_btree_iter_next_filter(&iter, &b->keys, + while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys, bch_ptr_bad))) { ret = bcache_btree(map_nodes_recurse, k, b, op, from, fn, flags); @@ -2534,11 +2535,12 @@ int bch_btree_map_keys_recurse(struct btree *b, struct btree_op *op, { int ret = MAP_CONTINUE; struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; - bch_btree_iter_init(&b->keys, &iter, from); + bch_btree_iter_stack_init(&b->keys, &iter, from); - while ((k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad))) { + while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys, + bch_ptr_bad))) { ret = !b->level ? fn(op, b, k) : bcache_btree(map_keys_recurse, k, diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index b5601f200c09..c778862f4f33 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -1928,8 +1928,9 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) INIT_LIST_HEAD(&c->btree_cache_freed); INIT_LIST_HEAD(&c->data_buckets); - iter_size = ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size + 1) * - sizeof(struct btree_iter_set); + iter_size = sizeof(struct btree_iter) + + ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size) * + sizeof(struct btree_iter_set); c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL); if (!c->devices) diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c index 8467e37411a7..84b8e9e90ee6 100644 --- a/drivers/md/bcache/sysfs.c +++ b/drivers/md/bcache/sysfs.c @@ -660,7 +660,7 @@ static unsigned int bch_root_usage(struct cache_set *c) unsigned int bytes = 0; struct bkey *k; struct btree *b; - struct btree_iter iter; + struct btree_iter_stack iter; goto lock_root; diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c index 83dcdd85abc0..9502cc9b0c80 100644 --- a/drivers/md/bcache/writeback.c +++ b/drivers/md/bcache/writeback.c @@ -899,15 +899,15 @@ static int bch_dirty_init_thread(void *arg) struct dirty_init_thrd_info *info = arg; struct bch_dirty_init_state *state = info->state; struct cache_set *c = state->c; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey *k, *p; int cur_idx, prev_idx, skip_nr; k = p = NULL; cur_idx = prev_idx = 0; - bch_btree_iter_init(&c->root->keys, &iter, NULL); - k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad); + bch_btree_iter_stack_init(&c->root->keys, &iter, NULL); + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); BUG_ON(!k); p = k; @@ -921,7 +921,7 @@ static int bch_dirty_init_thread(void *arg) skip_nr = cur_idx - prev_idx; while (skip_nr) { - k = bch_btree_iter_next_filter(&iter, + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); if (k) @@ -969,7 +969,7 @@ void bch_sectors_dirty_init(struct bcache_device *d) { int i; struct bkey *k = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; struct sectors_dirty_init op; struct cache_set *c = d->c; struct bch_dirty_init_state state; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
by Yuan Can 26 Sep '24

26 Sep '24

From: Wesley Cheng <quic_wcheng(a)quicinc.com> stable inclusion from stable-v5.10.221 commit e500b1c4e29ad0bd1c1332a1eaea2913627a92dd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TXIA CVE: CVE-2024-36894 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 24729b307eefcd7c476065cd7351c1a018082c19 ] FFS based applications can utilize the aio_cancel() callback to dequeue pending USB requests submitted to the UDC. There is a scenario where the FFS application issues an AIO cancel call, while the UDC is handling a soft disconnect. For a DWC3 based implementation, the callstack looks like the following: DWC3 Gadget FFS Application dwc3_gadget_soft_disconnect() ... --> dwc3_stop_active_transfers() --> dwc3_gadget_giveback(-ESHUTDOWN) --> ffs_epfile_async_io_complete() ffs_aio_cancel() --> usb_ep_free_request() --> usb_ep_dequeue() There is currently no locking implemented between the AIO completion handler and AIO cancel, so the issue occurs if the completion routine is running in parallel to an AIO cancel call coming from the FFS application. As the completion call frees the USB request (io_data->req) the FFS application is also referencing it for the usb_ep_dequeue() call. This can lead to accessing a stale/hanging pointer. commit b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently") relocated the usb_ep_free_request() into ffs_epfile_async_io_complete(). However, in order to properly implement locking to mitigate this issue, the spinlock can't be added to ffs_epfile_async_io_complete(), as usb_ep_dequeue() (if successfully dequeuing a USB request) will call the function driver's completion handler in the same context. Hence, leading into a deadlock. Fix this issue by moving the usb_ep_free_request() back to ffs_user_copy_worker(), and ensuring that it explicitly sets io_data->req to NULL after freeing it within the ffs->eps_lock. This resolves the race condition above, as the ffs_aio_cancel() routine will not continue attempting to dequeue a request that has already been freed, or the ffs_user_copy_work() not freeing the USB request until the AIO cancel is done referencing it. This fix depends on commit b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently") Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support") Cc: stable <stable(a)kernel.org> # b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently") Signed-off-by: Wesley Cheng <quic_wcheng(a)quicinc.com> Link: https://lore.kernel.org/r/20240409014059.6740-1-quic_wcheng@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/usb/gadget/function/f_fs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index bb0d92837f67..f98a6010fa50 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -822,6 +822,7 @@ static void ffs_user_copy_worker(struct work_struct *work) int ret = io_data->req->status ? io_data->req->status : io_data->req->actual; bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD; + unsigned long flags; if (io_data->read && ret > 0) { kthread_use_mm(io_data->mm); @@ -834,7 +835,10 @@ static void ffs_user_copy_worker(struct work_struct *work) if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd) eventfd_signal(io_data->ffs->ffs_eventfd, 1); + spin_lock_irqsave(&io_data->ffs->eps_lock, flags); usb_ep_free_request(io_data->ep, io_data->req); + io_data->req = NULL; + spin_unlock_irqrestore(&io_data->ffs->eps_lock, flags); if (io_data->read) kfree(io_data->to_free); -- 2.17.1

2 1

[PATCH OLK-6.6] misc: fastrpc: Fix double free of 'buf' in error path
by Xiaomeng Zhang 26 Sep '24

26 Sep '24

From: Sukrut Bellary <sukrut.bellary(a)linux.com> stable inclusion from stable-v6.10.10 commit bfc1704d909dc9911a558b1a5833d3d61a43a1f2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IATRLJ CVE: CVE-2024-46741 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e8c276d4dc0e19ee48385f74426aebc855b49aaf upstream. smatch warning: drivers/misc/fastrpc.c:1926 fastrpc_req_mmap() error: double free of 'buf' In fastrpc_req_mmap() error path, the fastrpc buffer is freed in fastrpc_req_munmap_impl() if unmap is successful. But in the end, there is an unconditional call to fastrpc_buf_free(). So the above case triggers the double free of fastrpc buf. Fixes: 72fa6f7820c4 ("misc: fastrpc: Rework fastrpc_req_munmap") Reviewed-by: Shuah Khan <skhan(a)linuxfoundation.org> Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> Signed-off-by: Sukrut Bellary <sukrut.bellary(a)linux.com> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20240902141409.70371-2-srinivas.kandagatla@linaro… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/misc/fastrpc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index bbcbc921f3ab..8be1504baf53 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1912,7 +1912,8 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) &args[0]); if (err) { dev_err(dev, "mmap error (len 0x%08llx)\n", buf->size); - goto err_invoke; + fastrpc_buf_free(buf); + return err; } /* update the buffer to be able to deallocate the memory on the DSP */ @@ -1950,8 +1951,6 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) err_assign: fastrpc_req_munmap_impl(fl, buf); -err_invoke: - fastrpc_buf_free(buf); return err; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bcache: fix variable length array abuse in btree_iter
by Yuan Can 26 Sep '24

26 Sep '24

From: Matthew Mirvish <matthew(a)mm12.xyz> stable inclusion from stable-v5.10.221 commit 2c3d7b03b658dc8bfa6112b194b67b92a87e081b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB04K CVE: CVE-2024-39482 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31 upstream. btree_iter is used in two ways: either allocated on the stack with a fixed size MAX_BSETS, or from a mempool with a dynamic size based on the specific cache set. Previously, the struct had a fixed-length array of size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized iterators, which causes UBSAN to complain. This patch uses the same approach as in bcachefs's sort_iter and splits the iterator into a btree_iter with a flexible array member and a btree_iter_stack which embeds a btree_iter as well as a fixed-length data array. Cc: stable(a)vger.kernel.org Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039368 Signed-off-by: Matthew Mirvish <matthew(a)mm12.xyz> Signed-off-by: Coly Li <colyli(a)suse.de> Link: https://lore.kernel.org/r/20240509011117.2697-3-colyli@suse.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/md/bcache/bset.c | 44 +++++++++++++++++------------------ drivers/md/bcache/bset.h | 28 ++++++++++++++-------- drivers/md/bcache/btree.c | 40 ++++++++++++++++--------------- drivers/md/bcache/super.c | 5 ++-- drivers/md/bcache/sysfs.c | 2 +- drivers/md/bcache/writeback.c | 10 ++++---- 6 files changed, 70 insertions(+), 59 deletions(-) diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c index 94d38e8a59b3..cb544207427b 100644 --- a/drivers/md/bcache/bset.c +++ b/drivers/md/bcache/bset.c @@ -54,7 +54,7 @@ void bch_dump_bucket(struct btree_keys *b) int __bch_count_data(struct btree_keys *b) { unsigned int ret = 0; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey *k; if (b->ops->is_extents) @@ -67,7 +67,7 @@ void __bch_check_keys(struct btree_keys *b, const char *fmt, ...) { va_list args; struct bkey *k, *p = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; const char *err; for_each_key(b, k, &iter) { @@ -879,7 +879,7 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k, unsigned int status = BTREE_INSERT_STATUS_NO_INSERT; struct bset *i = bset_tree_last(b)->data; struct bkey *m, *prev = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey preceding_key_on_stack = ZERO_KEY; struct bkey *preceding_key_p = &preceding_key_on_stack; @@ -895,9 +895,9 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k, else preceding_key(k, &preceding_key_p); - m = bch_btree_iter_init(b, &iter, preceding_key_p); + m = bch_btree_iter_stack_init(b, &iter, preceding_key_p); - if (b->ops->insert_fixup(b, k, &iter, replace_key)) + if (b->ops->insert_fixup(b, k, &iter.iter, replace_key)) return status; status = BTREE_INSERT_STATUS_INSERT; @@ -1100,33 +1100,33 @@ void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k, btree_iter_cmp)); } -static struct bkey *__bch_btree_iter_init(struct btree_keys *b, - struct btree_iter *iter, - struct bkey *search, - struct bset_tree *start) +static struct bkey *__bch_btree_iter_stack_init(struct btree_keys *b, + struct btree_iter_stack *iter, + struct bkey *search, + struct bset_tree *start) { struct bkey *ret = NULL; - iter->size = ARRAY_SIZE(iter->data); - iter->used = 0; + iter->iter.size = ARRAY_SIZE(iter->stack_data); + iter->iter.used = 0; #ifdef CONFIG_BCACHE_DEBUG - iter->b = b; + iter->iter.b = b; #endif for (; start <= bset_tree_last(b); start++) { ret = bch_bset_search(b, start, search); - bch_btree_iter_push(iter, ret, bset_bkey_last(start->data)); + bch_btree_iter_push(&iter->iter, ret, bset_bkey_last(start->data)); } return ret; } -struct bkey *bch_btree_iter_init(struct btree_keys *b, - struct btree_iter *iter, +struct bkey *bch_btree_iter_stack_init(struct btree_keys *b, + struct btree_iter_stack *iter, struct bkey *search) { - return __bch_btree_iter_init(b, iter, search, b->set); + return __bch_btree_iter_stack_init(b, iter, search, b->set); } static inline struct bkey *__bch_btree_iter_next(struct btree_iter *iter, @@ -1293,10 +1293,10 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start, struct bset_sort_state *state) { size_t order = b->page_order, keys = 0; - struct btree_iter iter; + struct btree_iter_stack iter; int oldsize = bch_count_data(b); - __bch_btree_iter_init(b, &iter, NULL, &b->set[start]); + __bch_btree_iter_stack_init(b, &iter, NULL, &b->set[start]); if (start) { unsigned int i; @@ -1307,7 +1307,7 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start, order = get_order(__set_bytes(b->set->data, keys)); } - __btree_sort(b, &iter, start, order, false, state); + __btree_sort(b, &iter.iter, start, order, false, state); EBUG_ON(oldsize >= 0 && bch_count_data(b) != oldsize); } @@ -1323,11 +1323,11 @@ void bch_btree_sort_into(struct btree_keys *b, struct btree_keys *new, struct bset_sort_state *state) { uint64_t start_time = local_clock(); - struct btree_iter iter; + struct btree_iter_stack iter; - bch_btree_iter_init(b, &iter, NULL); + bch_btree_iter_stack_init(b, &iter, NULL); - btree_mergesort(b, new->set->data, &iter, false, true); + btree_mergesort(b, new->set->data, &iter.iter, false, true); bch_time_stats_update(&state->time, start_time); diff --git a/drivers/md/bcache/bset.h b/drivers/md/bcache/bset.h index d795c84246b0..011f6062c4c0 100644 --- a/drivers/md/bcache/bset.h +++ b/drivers/md/bcache/bset.h @@ -321,7 +321,14 @@ struct btree_iter { #endif struct btree_iter_set { struct bkey *k, *end; - } data[MAX_BSETS]; + } data[]; +}; + +/* Fixed-size btree_iter that can be allocated on the stack */ + +struct btree_iter_stack { + struct btree_iter iter; + struct btree_iter_set stack_data[MAX_BSETS]; }; typedef bool (*ptr_filter_fn)(struct btree_keys *b, const struct bkey *k); @@ -333,9 +340,9 @@ struct bkey *bch_btree_iter_next_filter(struct btree_iter *iter, void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k, struct bkey *end); -struct bkey *bch_btree_iter_init(struct btree_keys *b, - struct btree_iter *iter, - struct bkey *search); +struct bkey *bch_btree_iter_stack_init(struct btree_keys *b, + struct btree_iter_stack *iter, + struct bkey *search); struct bkey *__bch_bset_search(struct btree_keys *b, struct bset_tree *t, const struct bkey *search); @@ -350,13 +357,14 @@ static inline struct bkey *bch_bset_search(struct btree_keys *b, return search ? __bch_bset_search(b, t, search) : t->data->start; } -#define for_each_key_filter(b, k, iter, filter) \ - for (bch_btree_iter_init((b), (iter), NULL); \ - ((k) = bch_btree_iter_next_filter((iter), (b), filter));) +#define for_each_key_filter(b, k, stack_iter, filter) \ + for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \ + ((k) = bch_btree_iter_next_filter(&((stack_iter)->iter), (b), \ + filter));) -#define for_each_key(b, k, iter) \ - for (bch_btree_iter_init((b), (iter), NULL); \ - ((k) = bch_btree_iter_next(iter));) +#define for_each_key(b, k, stack_iter) \ + for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \ + ((k) = bch_btree_iter_next(&((stack_iter)->iter)));) /* Sorting */ diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c index 98daa9d200f7..da24a3ca69e5 100644 --- a/drivers/md/bcache/btree.c +++ b/drivers/md/bcache/btree.c @@ -1274,7 +1274,7 @@ static bool btree_gc_mark_node(struct btree *b, struct gc_stat *gc) uint8_t stale = 0; unsigned int keys = 0, good_keys = 0; struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; struct bset_tree *t; gc->nodes++; @@ -1533,7 +1533,7 @@ static int btree_gc_rewrite_node(struct btree *b, struct btree_op *op, static unsigned int btree_gc_count_keys(struct btree *b) { struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; unsigned int ret = 0; for_each_key_filter(&b->keys, k, &iter, bch_ptr_bad) @@ -1574,17 +1574,18 @@ static int btree_gc_recurse(struct btree *b, struct btree_op *op, int ret = 0; bool should_rewrite; struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; struct gc_merge_info r[GC_MERGE_NODES]; struct gc_merge_info *i, *last = r + ARRAY_SIZE(r) - 1; - bch_btree_iter_init(&b->keys, &iter, &b->c->gc_done); + bch_btree_iter_stack_init(&b->keys, &iter, &b->c->gc_done); for (i = r; i < r + ARRAY_SIZE(r); i++) i->b = ERR_PTR(-EINTR); while (1) { - k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad); + k = bch_btree_iter_next_filter(&iter.iter, &b->keys, + bch_ptr_bad); if (k) { r->b = bch_btree_node_get(b->c, op, k, b->level - 1, true, b); @@ -1874,7 +1875,7 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op) { int ret = 0; struct bkey *k, *p = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; for_each_key_filter(&b->keys, k, &iter, bch_ptr_invalid) bch_initial_mark_key(b->c, b->level, k); @@ -1882,10 +1883,10 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op) bch_initial_mark_key(b->c, b->level + 1, &b->key); if (b->level) { - bch_btree_iter_init(&b->keys, &iter, NULL); + bch_btree_iter_stack_init(&b->keys, &iter, NULL); do { - k = bch_btree_iter_next_filter(&iter, &b->keys, + k = bch_btree_iter_next_filter(&iter.iter, &b->keys, bch_ptr_bad); if (k) { btree_node_prefetch(b, k); @@ -1913,7 +1914,7 @@ static int bch_btree_check_thread(void *arg) struct btree_check_info *info = arg; struct btree_check_state *check_state = info->state; struct cache_set *c = check_state->c; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey *k, *p; int cur_idx, prev_idx, skip_nr; @@ -1922,8 +1923,8 @@ static int bch_btree_check_thread(void *arg) ret = 0; /* root node keys are checked before thread created */ - bch_btree_iter_init(&c->root->keys, &iter, NULL); - k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad); + bch_btree_iter_stack_init(&c->root->keys, &iter, NULL); + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); BUG_ON(!k); p = k; @@ -1941,7 +1942,7 @@ static int bch_btree_check_thread(void *arg) skip_nr = cur_idx - prev_idx; while (skip_nr) { - k = bch_btree_iter_next_filter(&iter, + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); if (k) @@ -2005,7 +2006,7 @@ int bch_btree_check(struct cache_set *c) int ret = 0; int i; struct bkey *k = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; struct btree_check_state check_state; /* check and mark root node keys */ @@ -2501,11 +2502,11 @@ static int bch_btree_map_nodes_recurse(struct btree *b, struct btree_op *op, if (b->level) { struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; - bch_btree_iter_init(&b->keys, &iter, from); + bch_btree_iter_stack_init(&b->keys, &iter, from); - while ((k = bch_btree_iter_next_filter(&iter, &b->keys, + while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys, bch_ptr_bad))) { ret = bcache_btree(map_nodes_recurse, k, b, op, from, fn, flags); @@ -2534,11 +2535,12 @@ int bch_btree_map_keys_recurse(struct btree *b, struct btree_op *op, { int ret = MAP_CONTINUE; struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; - bch_btree_iter_init(&b->keys, &iter, from); + bch_btree_iter_stack_init(&b->keys, &iter, from); - while ((k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad))) { + while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys, + bch_ptr_bad))) { ret = !b->level ? fn(op, b, k) : bcache_btree(map_keys_recurse, k, diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index b5601f200c09..c778862f4f33 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -1928,8 +1928,9 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) INIT_LIST_HEAD(&c->btree_cache_freed); INIT_LIST_HEAD(&c->data_buckets); - iter_size = ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size + 1) * - sizeof(struct btree_iter_set); + iter_size = sizeof(struct btree_iter) + + ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size) * + sizeof(struct btree_iter_set); c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL); if (!c->devices) diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c index 8467e37411a7..84b8e9e90ee6 100644 --- a/drivers/md/bcache/sysfs.c +++ b/drivers/md/bcache/sysfs.c @@ -660,7 +660,7 @@ static unsigned int bch_root_usage(struct cache_set *c) unsigned int bytes = 0; struct bkey *k; struct btree *b; - struct btree_iter iter; + struct btree_iter_stack iter; goto lock_root; diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c index 83dcdd85abc0..9502cc9b0c80 100644 --- a/drivers/md/bcache/writeback.c +++ b/drivers/md/bcache/writeback.c @@ -899,15 +899,15 @@ static int bch_dirty_init_thread(void *arg) struct dirty_init_thrd_info *info = arg; struct bch_dirty_init_state *state = info->state; struct cache_set *c = state->c; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey *k, *p; int cur_idx, prev_idx, skip_nr; k = p = NULL; cur_idx = prev_idx = 0; - bch_btree_iter_init(&c->root->keys, &iter, NULL); - k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad); + bch_btree_iter_stack_init(&c->root->keys, &iter, NULL); + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); BUG_ON(!k); p = k; @@ -921,7 +921,7 @@ static int bch_dirty_init_thread(void *arg) skip_nr = cur_idx - prev_idx; while (skip_nr) { - k = bch_btree_iter_next_filter(&iter, + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); if (k) @@ -969,7 +969,7 @@ void bch_sectors_dirty_init(struct bcache_device *d) { int i; struct bkey *k = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; struct sectors_dirty_init op; struct cache_set *c = d->c; struct bch_dirty_init_state state; -- 2.17.1

2 1

[PATCH OLK-6.6] fix: fix version showed in ethtool
by s00851154 26 Sep '24

26 Sep '24

Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 5a1995956a555..4ea526329d155 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strscpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strscpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strscpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311aab76c..5868187eafa99 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-5.10] bpf: verifier: prevent userspace memory access
by Pu Lehui 26 Sep '24

26 Sep '24

From: Puranjay Mohan <puranjay12(a)gmail.com> mainline inclusion from mainline-v6.9-rc7 commit 66e13b615a0ce76b785d780ecc9776ba71983629 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATK7C Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With BPF_PROBE_MEM, BPF allows de-referencing an untrusted pointer. To thwart invalid memory accesses, the JITs add an exception table entry for all such accesses. But in case the src_reg + offset is a userspace address, the BPF program might read that memory if the user has mapped it. Make the verifier add guard instructions around such memory accesses and skip the load if the address falls into the userspace region. The JITs need to implement bpf_arch_uaddress_limit() to define where the userspace addresses end for that architecture or TASK_SIZE is taken as default. The implementation is as follows: REG_AX = SRC_REG if(offset) REG_AX += offset; REG_AX >>= 32; if (REG_AX <= (uaddress_limit >> 32)) DST_REG = 0; else DST_REG = *(size *)(SRC_REG + offset); Comparing just the upper 32 bits of the load address with the upper 32 bits of uaddress_limit implies that the values are being aligned down to a 4GB boundary before comparison. The above means that all loads with address <= uaddress_limit + 4GB are skipped. This is acceptable because there is a large hole (much larger than 4GB) between userspace and kernel space memory, therefore a correctly functioning BPF program should not access this 4GB memory above the userspace. Let's analyze what this patch does to the following fentry program dereferencing an untrusted pointer: SEC("fentry/tcp_v4_connect") int BPF_PROG(fentry_tcp_v4_connect, struct sock *sk) { *(volatile long *)sk; return 0; } BPF Program before | BPF Program after ------------------ | ----------------- 0: (79) r1 = *(u64 *)(r1 +0) 0: (79) r1 = *(u64 *)(r1 +0) ----------------------------------------------------------------------- 1: (79) r1 = *(u64 *)(r1 +0) --\ 1: (bf) r11 = r1 ----------------------------\ \ 2: (77) r11 >>= 32 2: (b7) r0 = 0 \ \ 3: (b5) if r11 <= 0x8000 goto pc+2 3: (95) exit \ \-> 4: (79) r1 = *(u64 *)(r1 +0) \ 5: (05) goto pc+1 \ 6: (b7) r1 = 0 \-------------------------------------- 7: (b7) r0 = 0 8: (95) exit As you can see from above, in the best case (off=0), 5 extra instructions are emitted. Now, we analyze the same program after it has gone through the JITs of ARM64 and RISC-V architectures. We follow the single load instruction that has the untrusted pointer and see what instrumentation has been added around it. x86-64 JIT ========== JIT's Instrumentation (upstream) --------------------- 0: nopl 0x0(%rax,%rax,1) 5: xchg %ax,%ax 7: push %rbp 8: mov %rsp,%rbp b: mov 0x0(%rdi),%rdi --------------------------------- f: movabs $0x800000000000,%r11 19: cmp %r11,%rdi 1c: jb 0x000000000000002a 1e: mov %rdi,%r11 21: add $0x0,%r11 28: jae 0x000000000000002e 2a: xor %edi,%edi 2c: jmp 0x0000000000000032 2e: mov 0x0(%rdi),%rdi --------------------------------- 32: xor %eax,%eax 34: leave 35: ret The x86-64 JIT already emits some instructions to protect against user memory access. This patch doesn't make any changes for the x86-64 JIT. ARM64 JIT ========= No Intrumentation Verifier's Instrumentation (upstream) (This patch) ----------------- -------------------------- 0: add x9, x30, #0x0 0: add x9, x30, #0x0 4: nop 4: nop 8: paciasp 8: paciasp c: stp x29, x30, [sp, #-16]! c: stp x29, x30, [sp, #-16]! 10: mov x29, sp 10: mov x29, sp 14: stp x19, x20, [sp, #-16]! 14: stp x19, x20, [sp, #-16]! 18: stp x21, x22, [sp, #-16]! 18: stp x21, x22, [sp, #-16]! 1c: stp x25, x26, [sp, #-16]! 1c: stp x25, x26, [sp, #-16]! 20: stp x27, x28, [sp, #-16]! 20: stp x27, x28, [sp, #-16]! 24: mov x25, sp 24: mov x25, sp 28: mov x26, #0x0 28: mov x26, #0x0 2c: sub x27, x25, #0x0 2c: sub x27, x25, #0x0 30: sub sp, sp, #0x0 30: sub sp, sp, #0x0 34: ldr x0, [x0] 34: ldr x0, [x0] -------------------------------------------------------------------------------- 38: ldr x0, [x0] ----------\ 38: add x9, x0, #0x0 -----------------------------------\\ 3c: lsr x9, x9, #32 3c: mov x7, #0x0 \\ 40: cmp x9, #0x10, lsl #12 40: mov sp, sp \\ 44: b.ls 0x0000000000000050 44: ldp x27, x28, [sp], #16 \\--> 48: ldr x0, [x0] 48: ldp x25, x26, [sp], #16 \ 4c: b 0x0000000000000054 4c: ldp x21, x22, [sp], #16 \ 50: mov x0, #0x0 50: ldp x19, x20, [sp], #16 \--------------------------------------- 54: ldp x29, x30, [sp], #16 54: mov x7, #0x0 58: add x0, x7, #0x0 58: mov sp, sp 5c: autiasp 5c: ldp x27, x28, [sp], #16 60: ret 60: ldp x25, x26, [sp], #16 64: nop 64: ldp x21, x22, [sp], #16 68: ldr x10, 0x0000000000000070 68: ldp x19, x20, [sp], #16 6c: br x10 6c: ldp x29, x30, [sp], #16 70: add x0, x7, #0x0 74: autiasp 78: ret 7c: nop 80: ldr x10, 0x0000000000000088 84: br x10 There are 6 extra instructions added in ARM64 in the best case. This will become 7 in the worst case (off != 0). RISC-V JIT (RISCV_ISA_C Disabled) ========== No Intrumentation Verifier's Instrumentation (upstream) (This patch) ----------------- -------------------------- 0: nop 0: nop 4: nop 4: nop 8: li a6, 33 8: li a6, 33 c: addi sp, sp, -16 c: addi sp, sp, -16 10: sd s0, 8(sp) 10: sd s0, 8(sp) 14: addi s0, sp, 16 14: addi s0, sp, 16 18: ld a0, 0(a0) 18: ld a0, 0(a0) --------------------------------------------------------------- 1c: ld a0, 0(a0) --\ 1c: mv t0, a0 --------------------------\ \ 20: srli t0, t0, 32 20: li a5, 0 \ \ 24: lui t1, 4096 24: ld s0, 8(sp) \ \ 28: sext.w t1, t1 28: addi sp, sp, 16 \ \ 2c: bgeu t1, t0, 12 2c: sext.w a0, a5 \ \--> 30: ld a0, 0(a0) 30: ret \ 34: j 8 \ 38: li a0, 0 \------------------------------ 3c: li a5, 0 40: ld s0, 8(sp) 44: addi sp, sp, 16 48: sext.w a0, a5 4c: ret There are 7 extra instructions added in RISC-V. Fixes: 800834285361 ("bpf, arm64: Add BPF exception tables") Reported-by: Breno Leitao <leitao(a)debian.org> Suggested-by: Alexei Starovoitov <ast(a)kernel.org> Acked-by: Ilya Leoshkevich <iii(a)linux.ibm.com> Signed-off-by: Puranjay Mohan <puranjay12(a)gmail.com> Link: https://lore.kernel.org/r/20240424100210.11982-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: arch/x86/net/bpf_jit_comp.c kernel/bpf/core.c kernel/bpf/verifier.c include/linux/filter.h [The conflicts were due to not support BPF_PROBE_MEMSX and refactoring about do_misc_fixups] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/x86/net/bpf_jit_comp.c | 6 ++++++ include/linux/filter.h | 1 + kernel/bpf/core.c | 9 +++++++++ kernel/bpf/verifier.c | 29 +++++++++++++++++++++++++++++ 4 files changed, 45 insertions(+) diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index 8e3c3d8916dd..6c8b9151eda8 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -2156,3 +2156,9 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) tmp : orig_prog); return prog; } + +/* x86-64 JIT emits its own code to filter user addresses so return 0 here */ +u64 bpf_arch_uaddress_limit(void) +{ + return 0; +} diff --git a/include/linux/filter.h b/include/linux/filter.h index ee12183ffad9..8ee00f20614f 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -908,6 +908,7 @@ u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5); struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog); void bpf_jit_compile(struct bpf_prog *prog); bool bpf_jit_needs_zext(void); +u64 bpf_arch_uaddress_limit(void); bool bpf_helper_changes_pkt_data(void *func); static inline bool bpf_dump_raw_ok(const struct cred *cred) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 681070bf910b..7db8a815e835 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2321,6 +2321,15 @@ bool __weak bpf_helper_changes_pkt_data(void *func) return false; } +u64 __weak bpf_arch_uaddress_limit(void) +{ +#if defined(CONFIG_64BIT) && defined(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) + return TASK_SIZE; +#else + return 0; +#endif +} + /* Return TRUE if the JIT backend wants verifier to enable sub-register usage * analysis code and wants explicit zero extension inserted by verifier. * Otherwise, return FALSE. diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 18ab413ef2ba..a2a77348fa60 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -11464,6 +11464,35 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) continue; } + /* Make it impossible to de-reference a userspace address */ + if (BPF_CLASS(insn->code) == BPF_LDX && + BPF_MODE(insn->code) == BPF_PROBE_MEM) { + struct bpf_insn *patch = &insn_buf[0]; + u64 uaddress_limit = bpf_arch_uaddress_limit(); + + if (!uaddress_limit) + continue; + + *patch++ = BPF_MOV64_REG(BPF_REG_AX, insn->src_reg); + if (insn->off) + *patch++ = BPF_ALU64_IMM(BPF_ADD, BPF_REG_AX, insn->off); + *patch++ = BPF_ALU64_IMM(BPF_RSH, BPF_REG_AX, 32); + *patch++ = BPF_JMP_IMM(BPF_JLE, BPF_REG_AX, uaddress_limit >> 32, 2); + *patch++ = *insn; + *patch++ = BPF_JMP_IMM(BPF_JA, 0, 0, 1); + *patch++ = BPF_MOV64_IMM(insn->dst_reg, 0); + + cnt = patch - insn_buf; + new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt); + if (!new_prog) + return -ENOMEM; + + delta += cnt - 1; + env->prog = prog = new_prog; + insn = new_prog->insnsi + i + delta; + continue; + } + if (BPF_CLASS(insn->code) == BPF_LD && (BPF_MODE(insn->code) == BPF_ABS || BPF_MODE(insn->code) == BPF_IND)) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bpf: verifier: prevent userspace memory access
by Pu Lehui 26 Sep '24

26 Sep '24

From: Puranjay Mohan <puranjay12(a)gmail.com> mainline inclusion from mainline-v6.9-rc7 commit 66e13b615a0ce76b785d780ecc9776ba71983629 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATK7C Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With BPF_PROBE_MEM, BPF allows de-referencing an untrusted pointer. To thwart invalid memory accesses, the JITs add an exception table entry for all such accesses. But in case the src_reg + offset is a userspace address, the BPF program might read that memory if the user has mapped it. Make the verifier add guard instructions around such memory accesses and skip the load if the address falls into the userspace region. The JITs need to implement bpf_arch_uaddress_limit() to define where the userspace addresses end for that architecture or TASK_SIZE is taken as default. The implementation is as follows: REG_AX = SRC_REG if(offset) REG_AX += offset; REG_AX >>= 32; if (REG_AX <= (uaddress_limit >> 32)) DST_REG = 0; else DST_REG = *(size *)(SRC_REG + offset); Comparing just the upper 32 bits of the load address with the upper 32 bits of uaddress_limit implies that the values are being aligned down to a 4GB boundary before comparison. The above means that all loads with address <= uaddress_limit + 4GB are skipped. This is acceptable because there is a large hole (much larger than 4GB) between userspace and kernel space memory, therefore a correctly functioning BPF program should not access this 4GB memory above the userspace. Let's analyze what this patch does to the following fentry program dereferencing an untrusted pointer: SEC("fentry/tcp_v4_connect") int BPF_PROG(fentry_tcp_v4_connect, struct sock *sk) { *(volatile long *)sk; return 0; } BPF Program before | BPF Program after ------------------ | ----------------- 0: (79) r1 = *(u64 *)(r1 +0) 0: (79) r1 = *(u64 *)(r1 +0) ----------------------------------------------------------------------- 1: (79) r1 = *(u64 *)(r1 +0) --\ 1: (bf) r11 = r1 ----------------------------\ \ 2: (77) r11 >>= 32 2: (b7) r0 = 0 \ \ 3: (b5) if r11 <= 0x8000 goto pc+2 3: (95) exit \ \-> 4: (79) r1 = *(u64 *)(r1 +0) \ 5: (05) goto pc+1 \ 6: (b7) r1 = 0 \-------------------------------------- 7: (b7) r0 = 0 8: (95) exit As you can see from above, in the best case (off=0), 5 extra instructions are emitted. Now, we analyze the same program after it has gone through the JITs of ARM64 and RISC-V architectures. We follow the single load instruction that has the untrusted pointer and see what instrumentation has been added around it. x86-64 JIT ========== JIT's Instrumentation (upstream) --------------------- 0: nopl 0x0(%rax,%rax,1) 5: xchg %ax,%ax 7: push %rbp 8: mov %rsp,%rbp b: mov 0x0(%rdi),%rdi --------------------------------- f: movabs $0x800000000000,%r11 19: cmp %r11,%rdi 1c: jb 0x000000000000002a 1e: mov %rdi,%r11 21: add $0x0,%r11 28: jae 0x000000000000002e 2a: xor %edi,%edi 2c: jmp 0x0000000000000032 2e: mov 0x0(%rdi),%rdi --------------------------------- 32: xor %eax,%eax 34: leave 35: ret The x86-64 JIT already emits some instructions to protect against user memory access. This patch doesn't make any changes for the x86-64 JIT. ARM64 JIT ========= No Intrumentation Verifier's Instrumentation (upstream) (This patch) ----------------- -------------------------- 0: add x9, x30, #0x0 0: add x9, x30, #0x0 4: nop 4: nop 8: paciasp 8: paciasp c: stp x29, x30, [sp, #-16]! c: stp x29, x30, [sp, #-16]! 10: mov x29, sp 10: mov x29, sp 14: stp x19, x20, [sp, #-16]! 14: stp x19, x20, [sp, #-16]! 18: stp x21, x22, [sp, #-16]! 18: stp x21, x22, [sp, #-16]! 1c: stp x25, x26, [sp, #-16]! 1c: stp x25, x26, [sp, #-16]! 20: stp x27, x28, [sp, #-16]! 20: stp x27, x28, [sp, #-16]! 24: mov x25, sp 24: mov x25, sp 28: mov x26, #0x0 28: mov x26, #0x0 2c: sub x27, x25, #0x0 2c: sub x27, x25, #0x0 30: sub sp, sp, #0x0 30: sub sp, sp, #0x0 34: ldr x0, [x0] 34: ldr x0, [x0] -------------------------------------------------------------------------------- 38: ldr x0, [x0] ----------\ 38: add x9, x0, #0x0 -----------------------------------\\ 3c: lsr x9, x9, #32 3c: mov x7, #0x0 \\ 40: cmp x9, #0x10, lsl #12 40: mov sp, sp \\ 44: b.ls 0x0000000000000050 44: ldp x27, x28, [sp], #16 \\--> 48: ldr x0, [x0] 48: ldp x25, x26, [sp], #16 \ 4c: b 0x0000000000000054 4c: ldp x21, x22, [sp], #16 \ 50: mov x0, #0x0 50: ldp x19, x20, [sp], #16 \--------------------------------------- 54: ldp x29, x30, [sp], #16 54: mov x7, #0x0 58: add x0, x7, #0x0 58: mov sp, sp 5c: autiasp 5c: ldp x27, x28, [sp], #16 60: ret 60: ldp x25, x26, [sp], #16 64: nop 64: ldp x21, x22, [sp], #16 68: ldr x10, 0x0000000000000070 68: ldp x19, x20, [sp], #16 6c: br x10 6c: ldp x29, x30, [sp], #16 70: add x0, x7, #0x0 74: autiasp 78: ret 7c: nop 80: ldr x10, 0x0000000000000088 84: br x10 There are 6 extra instructions added in ARM64 in the best case. This will become 7 in the worst case (off != 0). RISC-V JIT (RISCV_ISA_C Disabled) ========== No Intrumentation Verifier's Instrumentation (upstream) (This patch) ----------------- -------------------------- 0: nop 0: nop 4: nop 4: nop 8: li a6, 33 8: li a6, 33 c: addi sp, sp, -16 c: addi sp, sp, -16 10: sd s0, 8(sp) 10: sd s0, 8(sp) 14: addi s0, sp, 16 14: addi s0, sp, 16 18: ld a0, 0(a0) 18: ld a0, 0(a0) --------------------------------------------------------------- 1c: ld a0, 0(a0) --\ 1c: mv t0, a0 --------------------------\ \ 20: srli t0, t0, 32 20: li a5, 0 \ \ 24: lui t1, 4096 24: ld s0, 8(sp) \ \ 28: sext.w t1, t1 28: addi sp, sp, 16 \ \ 2c: bgeu t1, t0, 12 2c: sext.w a0, a5 \ \--> 30: ld a0, 0(a0) 30: ret \ 34: j 8 \ 38: li a0, 0 \------------------------------ 3c: li a5, 0 40: ld s0, 8(sp) 44: addi sp, sp, 16 48: sext.w a0, a5 4c: ret There are 7 extra instructions added in RISC-V. Fixes: 800834285361 ("bpf, arm64: Add BPF exception tables") Reported-by: Breno Leitao <leitao(a)debian.org> Suggested-by: Alexei Starovoitov <ast(a)kernel.org> Acked-by: Ilya Leoshkevich <iii(a)linux.ibm.com> Signed-off-by: Puranjay Mohan <puranjay12(a)gmail.com> Link: https://lore.kernel.org/r/20240424100210.11982-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: arch/x86/net/bpf_jit_comp.c kernel/bpf/core.c kernel/bpf/verifier.c include/linux/filter.h [The conflicts were due to not support BPF_PROBE_MEMSX and refactoring about do_misc_fixups] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/x86/net/bpf_jit_comp.c | 6 ++++++ include/linux/filter.h | 1 + kernel/bpf/core.c | 9 +++++++++ kernel/bpf/verifier.c | 29 +++++++++++++++++++++++++++++ 4 files changed, 45 insertions(+) diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index 8e3c3d8916dd..6c8b9151eda8 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -2156,3 +2156,9 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) tmp : orig_prog); return prog; } + +/* x86-64 JIT emits its own code to filter user addresses so return 0 here */ +u64 bpf_arch_uaddress_limit(void) +{ + return 0; +} diff --git a/include/linux/filter.h b/include/linux/filter.h index ee12183ffad9..8ee00f20614f 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -908,6 +908,7 @@ u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5); struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog); void bpf_jit_compile(struct bpf_prog *prog); bool bpf_jit_needs_zext(void); +u64 bpf_arch_uaddress_limit(void); bool bpf_helper_changes_pkt_data(void *func); static inline bool bpf_dump_raw_ok(const struct cred *cred) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 681070bf910b..7db8a815e835 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2321,6 +2321,15 @@ bool __weak bpf_helper_changes_pkt_data(void *func) return false; } +u64 __weak bpf_arch_uaddress_limit(void) +{ +#if defined(CONFIG_64BIT) && defined(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) + return TASK_SIZE; +#else + return 0; +#endif +} + /* Return TRUE if the JIT backend wants verifier to enable sub-register usage * analysis code and wants explicit zero extension inserted by verifier. * Otherwise, return FALSE. diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 18ab413ef2ba..a2a77348fa60 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -11464,6 +11464,35 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) continue; } + /* Make it impossible to de-reference a userspace address */ + if (BPF_CLASS(insn->code) == BPF_LDX && + BPF_MODE(insn->code) == BPF_PROBE_MEM) { + struct bpf_insn *patch = &insn_buf[0]; + u64 uaddress_limit = bpf_arch_uaddress_limit(); + + if (!uaddress_limit) + continue; + + *patch++ = BPF_MOV64_REG(BPF_REG_AX, insn->src_reg); + if (insn->off) + *patch++ = BPF_ALU64_IMM(BPF_ADD, BPF_REG_AX, insn->off); + *patch++ = BPF_ALU64_IMM(BPF_RSH, BPF_REG_AX, 32); + *patch++ = BPF_JMP_IMM(BPF_JLE, BPF_REG_AX, uaddress_limit >> 32, 2); + *patch++ = *insn; + *patch++ = BPF_JMP_IMM(BPF_JA, 0, 0, 1); + *patch++ = BPF_MOV64_IMM(insn->dst_reg, 0); + + cnt = patch - insn_buf; + new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt); + if (!new_prog) + return -ENOMEM; + + delta += cnt - 1; + env->prog = prog = new_prog; + insn = new_prog->insnsi + i + delta; + continue; + } + if (BPF_CLASS(insn->code) == BPF_LD && (BPF_MODE(insn->code) == BPF_ABS || BPF_MODE(insn->code) == BPF_IND)) { -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: verifier: prevent userspace memory access
by Pu Lehui 26 Sep '24

26 Sep '24

From: Puranjay Mohan <puranjay12(a)gmail.com> mainline inclusion from mainline-v6.9-rc7 commit 66e13b615a0ce76b785d780ecc9776ba71983629 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATK7C Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With BPF_PROBE_MEM, BPF allows de-referencing an untrusted pointer. To thwart invalid memory accesses, the JITs add an exception table entry for all such accesses. But in case the src_reg + offset is a userspace address, the BPF program might read that memory if the user has mapped it. Make the verifier add guard instructions around such memory accesses and skip the load if the address falls into the userspace region. The JITs need to implement bpf_arch_uaddress_limit() to define where the userspace addresses end for that architecture or TASK_SIZE is taken as default. The implementation is as follows: REG_AX = SRC_REG if(offset) REG_AX += offset; REG_AX >>= 32; if (REG_AX <= (uaddress_limit >> 32)) DST_REG = 0; else DST_REG = *(size *)(SRC_REG + offset); Comparing just the upper 32 bits of the load address with the upper 32 bits of uaddress_limit implies that the values are being aligned down to a 4GB boundary before comparison. The above means that all loads with address <= uaddress_limit + 4GB are skipped. This is acceptable because there is a large hole (much larger than 4GB) between userspace and kernel space memory, therefore a correctly functioning BPF program should not access this 4GB memory above the userspace. Let's analyze what this patch does to the following fentry program dereferencing an untrusted pointer: SEC("fentry/tcp_v4_connect") int BPF_PROG(fentry_tcp_v4_connect, struct sock *sk) { *(volatile long *)sk; return 0; } BPF Program before | BPF Program after ------------------ | ----------------- 0: (79) r1 = *(u64 *)(r1 +0) 0: (79) r1 = *(u64 *)(r1 +0) ----------------------------------------------------------------------- 1: (79) r1 = *(u64 *)(r1 +0) --\ 1: (bf) r11 = r1 ----------------------------\ \ 2: (77) r11 >>= 32 2: (b7) r0 = 0 \ \ 3: (b5) if r11 <= 0x8000 goto pc+2 3: (95) exit \ \-> 4: (79) r1 = *(u64 *)(r1 +0) \ 5: (05) goto pc+1 \ 6: (b7) r1 = 0 \-------------------------------------- 7: (b7) r0 = 0 8: (95) exit As you can see from above, in the best case (off=0), 5 extra instructions are emitted. Now, we analyze the same program after it has gone through the JITs of ARM64 and RISC-V architectures. We follow the single load instruction that has the untrusted pointer and see what instrumentation has been added around it. x86-64 JIT ========== JIT's Instrumentation (upstream) --------------------- 0: nopl 0x0(%rax,%rax,1) 5: xchg %ax,%ax 7: push %rbp 8: mov %rsp,%rbp b: mov 0x0(%rdi),%rdi --------------------------------- f: movabs $0x800000000000,%r11 19: cmp %r11,%rdi 1c: jb 0x000000000000002a 1e: mov %rdi,%r11 21: add $0x0,%r11 28: jae 0x000000000000002e 2a: xor %edi,%edi 2c: jmp 0x0000000000000032 2e: mov 0x0(%rdi),%rdi --------------------------------- 32: xor %eax,%eax 34: leave 35: ret The x86-64 JIT already emits some instructions to protect against user memory access. This patch doesn't make any changes for the x86-64 JIT. ARM64 JIT ========= No Intrumentation Verifier's Instrumentation (upstream) (This patch) ----------------- -------------------------- 0: add x9, x30, #0x0 0: add x9, x30, #0x0 4: nop 4: nop 8: paciasp 8: paciasp c: stp x29, x30, [sp, #-16]! c: stp x29, x30, [sp, #-16]! 10: mov x29, sp 10: mov x29, sp 14: stp x19, x20, [sp, #-16]! 14: stp x19, x20, [sp, #-16]! 18: stp x21, x22, [sp, #-16]! 18: stp x21, x22, [sp, #-16]! 1c: stp x25, x26, [sp, #-16]! 1c: stp x25, x26, [sp, #-16]! 20: stp x27, x28, [sp, #-16]! 20: stp x27, x28, [sp, #-16]! 24: mov x25, sp 24: mov x25, sp 28: mov x26, #0x0 28: mov x26, #0x0 2c: sub x27, x25, #0x0 2c: sub x27, x25, #0x0 30: sub sp, sp, #0x0 30: sub sp, sp, #0x0 34: ldr x0, [x0] 34: ldr x0, [x0] -------------------------------------------------------------------------------- 38: ldr x0, [x0] ----------\ 38: add x9, x0, #0x0 -----------------------------------\\ 3c: lsr x9, x9, #32 3c: mov x7, #0x0 \\ 40: cmp x9, #0x10, lsl #12 40: mov sp, sp \\ 44: b.ls 0x0000000000000050 44: ldp x27, x28, [sp], #16 \\--> 48: ldr x0, [x0] 48: ldp x25, x26, [sp], #16 \ 4c: b 0x0000000000000054 4c: ldp x21, x22, [sp], #16 \ 50: mov x0, #0x0 50: ldp x19, x20, [sp], #16 \--------------------------------------- 54: ldp x29, x30, [sp], #16 54: mov x7, #0x0 58: add x0, x7, #0x0 58: mov sp, sp 5c: autiasp 5c: ldp x27, x28, [sp], #16 60: ret 60: ldp x25, x26, [sp], #16 64: nop 64: ldp x21, x22, [sp], #16 68: ldr x10, 0x0000000000000070 68: ldp x19, x20, [sp], #16 6c: br x10 6c: ldp x29, x30, [sp], #16 70: add x0, x7, #0x0 74: autiasp 78: ret 7c: nop 80: ldr x10, 0x0000000000000088 84: br x10 There are 6 extra instructions added in ARM64 in the best case. This will become 7 in the worst case (off != 0). RISC-V JIT (RISCV_ISA_C Disabled) ========== No Intrumentation Verifier's Instrumentation (upstream) (This patch) ----------------- -------------------------- 0: nop 0: nop 4: nop 4: nop 8: li a6, 33 8: li a6, 33 c: addi sp, sp, -16 c: addi sp, sp, -16 10: sd s0, 8(sp) 10: sd s0, 8(sp) 14: addi s0, sp, 16 14: addi s0, sp, 16 18: ld a0, 0(a0) 18: ld a0, 0(a0) --------------------------------------------------------------- 1c: ld a0, 0(a0) --\ 1c: mv t0, a0 --------------------------\ \ 20: srli t0, t0, 32 20: li a5, 0 \ \ 24: lui t1, 4096 24: ld s0, 8(sp) \ \ 28: sext.w t1, t1 28: addi sp, sp, 16 \ \ 2c: bgeu t1, t0, 12 2c: sext.w a0, a5 \ \--> 30: ld a0, 0(a0) 30: ret \ 34: j 8 \ 38: li a0, 0 \------------------------------ 3c: li a5, 0 40: ld s0, 8(sp) 44: addi sp, sp, 16 48: sext.w a0, a5 4c: ret There are 7 extra instructions added in RISC-V. Fixes: 800834285361 ("bpf, arm64: Add BPF exception tables") Reported-by: Breno Leitao <leitao(a)debian.org> Suggested-by: Alexei Starovoitov <ast(a)kernel.org> Acked-by: Ilya Leoshkevich <iii(a)linux.ibm.com> Signed-off-by: Puranjay Mohan <puranjay12(a)gmail.com> Link: https://lore.kernel.org/r/20240424100210.11982-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: arch/x86/net/bpf_jit_comp.c kernel/bpf/core.c kernel/bpf/verifier.c include/linux/filter.h [The conflicts were due to refactoring about do_misc_fixups] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/x86/net/bpf_jit_comp.c | 6 ++++++ include/linux/filter.h | 1 + kernel/bpf/core.c | 9 +++++++++ kernel/bpf/verifier.c | 30 ++++++++++++++++++++++++++++++ 4 files changed, 46 insertions(+) diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index 878a4c6dd756..989b409f0cee 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -2968,3 +2968,9 @@ void bpf_arch_poke_desc_update(struct bpf_jit_poke_descriptor *poke, BUG_ON(ret < 0); } } + +/* x86-64 JIT emits its own code to filter user addresses so return 0 here */ +u64 bpf_arch_uaddress_limit(void) +{ + return 0; +} diff --git a/include/linux/filter.h b/include/linux/filter.h index 20b777ef5531..29f6a10b3acf 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -916,6 +916,7 @@ bool bpf_jit_needs_zext(void); bool bpf_jit_supports_subprog_tailcalls(void); bool bpf_jit_supports_kfunc_call(void); bool bpf_jit_supports_far_kfunc_call(void); +u64 bpf_arch_uaddress_limit(void); bool bpf_helper_changes_pkt_data(void *func); static inline bool bpf_dump_raw_ok(const struct cred *cred) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index d568244f5ae8..caea5f14ac99 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2906,6 +2906,15 @@ bool __weak bpf_jit_supports_far_kfunc_call(void) return false; } +u64 __weak bpf_arch_uaddress_limit(void) +{ +#if defined(CONFIG_64BIT) && defined(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) + return TASK_SIZE; +#else + return 0; +#endif +} + /* To execute LD_ABS/LD_IND instructions __bpf_prog_run() may call * skb_copy_bits(), so provide a weak definition of it for NET-less config. */ diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 6a94f341587a..cbaa7dbf5f20 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -18942,6 +18942,36 @@ static int do_misc_fixups(struct bpf_verifier_env *env) continue; } + /* Make it impossible to de-reference a userspace address */ + if (BPF_CLASS(insn->code) == BPF_LDX && + (BPF_MODE(insn->code) == BPF_PROBE_MEM || + BPF_MODE(insn->code) == BPF_PROBE_MEMSX)) { + struct bpf_insn *patch = &insn_buf[0]; + u64 uaddress_limit = bpf_arch_uaddress_limit(); + + if (!uaddress_limit) + continue; + + *patch++ = BPF_MOV64_REG(BPF_REG_AX, insn->src_reg); + if (insn->off) + *patch++ = BPF_ALU64_IMM(BPF_ADD, BPF_REG_AX, insn->off); + *patch++ = BPF_ALU64_IMM(BPF_RSH, BPF_REG_AX, 32); + *patch++ = BPF_JMP_IMM(BPF_JLE, BPF_REG_AX, uaddress_limit >> 32, 2); + *patch++ = *insn; + *patch++ = BPF_JMP_IMM(BPF_JA, 0, 0, 1); + *patch++ = BPF_MOV64_IMM(insn->dst_reg, 0); + + cnt = patch - insn_buf; + new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt); + if (!new_prog) + return -ENOMEM; + + delta += cnt - 1; + env->prog = prog = new_prog; + insn = new_prog->insnsi + i + delta; + continue; + } + /* Implement LD_ABS and LD_IND with a rewrite, if supported by the program type. */ if (BPF_CLASS(insn->code) == BPF_LD && (BPF_MODE(insn->code) == BPF_ABS || -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] fix CVE-2024-46771
by Zhang Changzhong 26 Sep '24

26 Sep '24

Kuniyuki Iwashima (2): can: bcm: Remove proc entry when dev is unregistered. can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). net/can/bcm.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.9.5

2 3

[PATCH OLK-5.10 0/2] CVE-2024-46771
by Zhang Changzhong 26 Sep '24

26 Sep '24

Kuniyuki Iwashima (2): can: bcm: Remove proc entry when dev is unregistered. can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). net/can/bcm.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.9.5

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-46771
by Zhang Changzhong 26 Sep '24

26 Sep '24

Kuniyuki Iwashima (2): can: bcm: Remove proc entry when dev is unregistered. can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). net/can/bcm.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.9.5

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] fix CVE-2024-46771
by Zhang Changzhong 26 Sep '24

26 Sep '24

Kuniyuki Iwashima (2): can: bcm: Remove proc entry when dev is unregistered. can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). net/can/bcm.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.9.5

2 3

[PATCH OLK-6.6] userfaultfd: fix checks for huge PMDs
by Liu Shixin 26 Sep '24

26 Sep '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v6.6.51 commit 3c6b4bcf37845c9359aed926324bed66bdd2448d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWOX CVE: CVE-2024-46787 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 71c186efc1b2cf1aeabfeff3b9bd5ac4c5ac14d8 upstream. Patch series "userfaultfd: fix races around pmd_trans_huge() check", v2. The pmd_trans_huge() code in mfill_atomic() is wrong in three different ways depending on kernel version: 1. The pmd_trans_huge() check is racy and can lead to a BUG_ON() (if you hit the right two race windows) - I've tested this in a kernel build with some extra mdelay() calls. See the commit message for a description of the race scenario. On older kernels (before 6.5), I think the same bug can even theoretically lead to accessing transhuge page contents as a page table if you hit the right 5 narrow race windows (I haven't tested this case). 2. As pointed out by Qi Zheng, pmd_trans_huge() is not sufficient for detecting PMDs that don't point to page tables. On older kernels (before 6.5), you'd just have to win a single fairly wide race to hit this. I've tested this on 6.1 stable by racing migration (with a mdelay() patched into try_to_migrate()) against UFFDIO_ZEROPAGE - on my x86 VM, that causes a kernel oops in ptlock_ptr(). 3. On newer kernels (>=6.5), for shmem mappings, khugepaged is allowed to yank page tables out from under us (though I haven't tested that), so I think the BUG_ON() checks in mfill_atomic() are just wrong. I decided to write two separate fixes for these (one fix for bugs 1+2, one fix for bug 3), so that the first fix can be backported to kernels affected by bugs 1+2. This patch (of 2): This fixes two issues. I discovered that the following race can occur: mfill_atomic other thread ============ ============ <zap PMD> pmdp_get_lockless() [reads none pmd] <bail if trans_huge> <if none:> <pagefault creates transhuge zeropage> __pte_alloc [no-op] <zap PMD> <bail if pmd_trans_huge(*dst_pmd)> BUG_ON(pmd_none(*dst_pmd)) I have experimentally verified this in a kernel with extra mdelay() calls; the BUG_ON(pmd_none(*dst_pmd)) triggers. On kernels newer than commit 0d940a9b270b ("mm/pgtable: allow pte_offset_map[_lock]() to fail"), this can't lead to anything worse than a BUG_ON(), since the page table access helpers are actually designed to deal with page tables concurrently disappearing; but on older kernels (<=6.4), I think we could probably theoretically race past the two BUG_ON() checks and end up treating a hugepage as a page table. The second issue is that, as Qi Zheng pointed out, there are other types of huge PMDs that pmd_trans_huge() can't catch: devmap PMDs and swap PMDs (in particular, migration PMDs). On <=6.4, this is worse than the first issue: If mfill_atomic() runs on a PMD that contains a migration entry (which just requires winning a single, fairly wide race), it will pass the PMD to pte_offset_map_lock(), which assumes that the PMD points to a page table. Breakage follows: First, the kernel tries to take the PTE lock (which will crash or maybe worse if there is no "struct page" for the address bits in the migration entry PMD - I think at least on X86 there usually is no corresponding "struct page" thanks to the PTE inversion mitigation, amd64 looks different). If that didn't crash, the kernel would next try to write a PTE into what it wrongly thinks is a page table. As part of fixing these issues, get rid of the check for pmd_trans_huge() before __pte_alloc() - that's redundant, we're going to have to check for that after the __pte_alloc() anyway. Backport note: pmdp_get_lockless() is pmd_read_atomic() in older kernels. Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-0-5efa61078a41@goog… Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-1-5efa61078a41@goog… Fixes: c1a4de99fada ("userfaultfd: mcopy_atomic|mfill_zeropage: UFFDIO_COPY|UFFDIO_ZEROPAGE preparation") Signed-off-by: Jann Horn <jannh(a)google.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Jann Horn <jannh(a)google.com> Cc: Pavel Emelyanov <xemul(a)virtuozzo.com> Cc: Qi Zheng <zhengqi.arch(a)bytedance.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/userfaultfd.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c index 8c22dd4e5e15..b7562e6847b2 100644 --- a/mm/userfaultfd.c +++ b/mm/userfaultfd.c @@ -704,21 +704,23 @@ static __always_inline ssize_t mfill_atomic(struct mm_struct *dst_mm, } dst_pmdval = pmdp_get_lockless(dst_pmd); - /* - * If the dst_pmd is mapped as THP don't - * override it and just be strict. - */ - if (unlikely(pmd_trans_huge(dst_pmdval))) { - err = -EEXIST; - break; - } if (unlikely(pmd_none(dst_pmdval)) && unlikely(__pte_alloc(dst_mm, dst_pmd))) { err = -ENOMEM; break; } - /* If an huge pmd materialized from under us fail */ - if (unlikely(pmd_trans_huge(*dst_pmd))) { + dst_pmdval = pmdp_get_lockless(dst_pmd); + /* + * If the dst_pmd is THP don't override it and just be strict. + * (This includes the case where the PMD used to be THP and + * changed back to none after __pte_alloc().) + */ + if (unlikely(!pmd_present(dst_pmdval) || pmd_trans_huge(dst_pmdval) || + pmd_devmap(dst_pmdval))) { + err = -EEXIST; + break; + } + if (unlikely(pmd_bad(dst_pmdval))) { err = -EFAULT; break; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> mainline inclusion from mainline-v6.11-rc7 commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index da1ee2e1ba99..2779704e128a 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -152,7 +152,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH OLK-6.6] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> mainline inclusion from mainline-v6.11-rc7 commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index 692daa9eff34..19c9d2cdd277 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -144,7 +144,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH OLK-5.10] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> mainline inclusion from mainline-v6.11-rc7 commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index 692daa9eff34..19c9d2cdd277 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -144,7 +144,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> mainline inclusion from mainline-v6.11-rc7 commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index 692daa9eff34..19c9d2cdd277 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -144,7 +144,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/display: Ensure index calculation will not overflow
by Tong Tiangen 26 Sep '24

26 Sep '24

mainline inclusion from mainline-v6.1-rc1 commit 91954c6c904b515baafaee6a1f35c94409a3bb68 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV8L CVE: CVE-2024-46726 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [WHY & HOW] Make sure vmid0p72_idx, vnom0p8_idx and vmax0p9_idx calculation will never overflow and exceess array size. This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c [Conflicts from: 1) commit 552b7cb0eed1 move drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c to drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c; 2) commit 91954c6c904b move dcn_bw_update_from_pplib() to dcn_bw_update_from_pplib_fclks() and the code logic is the same.] Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c index 51397b565ddf..2186603d915c 100644 --- a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c +++ b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c @@ -1498,10 +1498,9 @@ void dcn_bw_update_from_pplib(struct dc *dc) ASSERT(fclks.num_levels); vmin0p65_idx = 0; - vmid0p72_idx = fclks.num_levels - - (fclks.num_levels > 2 ? 3 : (fclks.num_levels > 1 ? 2 : 1)); - vnom0p8_idx = fclks.num_levels - (fclks.num_levels > 1 ? 2 : 1); - vmax0p9_idx = fclks.num_levels - 1; + vmid0p72_idx = fclks.num_levels > 2 ? fclks.num_levels - 3 : 0; + vnom0p8_idx = fclks.num_levels > 1 ? fclks.num_levels - 2 : 0; + vmax0p9_idx = fclks.num_levels > 0 ? fclks.num_levels - 1 : 0; dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 = 32 * (fclks.data[vmin0p65_idx].clocks_in_khz / 1000.0) / 1000.0; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] scsi: bfa: Ensure the copied buf is NUL terminated
by Yuan Can 26 Sep '24

26 Sep '24

From: Bui Quang Minh <minhquangbui99(a)gmail.com> stable inclusion from stable-v5.10.219 commit 00b425ff0891283207d7bad607a2412225274d7a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SFW CVE: CVE-2024-38560 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 13d0cecb4626fae67c00c84d3c7851f6b62f7df3 ] Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user. Fixes: 9f30b674759b ("bfa: replace 2 kzalloc/copy_from_user by memdup_user") Signed-off-by: Bui Quang Minh <minhquangbui99(a)gmail.com> Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-3-f1f1b53a10f4@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/scsi/bfa/bfad_debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/bfa/bfad_debugfs.c b/drivers/scsi/bfa/bfad_debugfs.c index fd1b378a263a..d3c7d4423c51 100644 --- a/drivers/scsi/bfa/bfad_debugfs.c +++ b/drivers/scsi/bfa/bfad_debugfs.c @@ -250,7 +250,7 @@ bfad_debugfs_write_regrd(struct file *file, const char __user *buf, unsigned long flags; void *kern_buf; - kern_buf = memdup_user(buf, nbytes); + kern_buf = memdup_user_nul(buf, nbytes); if (IS_ERR(kern_buf)) return PTR_ERR(kern_buf); @@ -317,7 +317,7 @@ bfad_debugfs_write_regwr(struct file *file, const char __user *buf, unsigned long flags; void *kern_buf; - kern_buf = memdup_user(buf, nbytes); + kern_buf = memdup_user_nul(buf, nbytes); if (IS_ERR(kern_buf)) return PTR_ERR(kern_buf); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] enic: Validate length of nl attributes in enic_set_vf_port
by Yuan Can 26 Sep '24

26 Sep '24

From: Roded Zats <rzats(a)paloaltonetworks.com> stable inclusion from stable-v5.10.219 commit 3c0d36972edbe56fcf98899622d9b90ac9965227 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D2T CVE: CVE-2024-38659 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8021b94b0412c37bcc79027c2e382086b6ce449 ] enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE is of length PORT_PROFILE_MAX and that the nl attributes IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX. These attributes are validated (in the function do_setlink in rtnetlink.c) using the nla_policy ifla_port_policy. The policy defines IFLA_PORT_PROFILE as NLA_STRING, IFLA_PORT_INSTANCE_UUID as NLA_BINARY and IFLA_PORT_HOST_UUID as NLA_STRING. That means that the length validation using the policy is for the max size of the attributes and not on exact size so the length of these attributes might be less than the sizes that enic_set_vf_port expects. This might cause an out of bands read access in the memcpys of the data of these attributes in enic_set_vf_port. Fixes: f8bd909183ac ("net: Add ndo_{set|get}_vf_port support for enic dynamic vnics") Signed-off-by: Roded Zats <rzats(a)paloaltonetworks.com> Link: https://lore.kernel.org/r/20240522073044.33519-1-rzats@paloaltonetworks.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/net/ethernet/cisco/enic/enic_main.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c index 548d8095c0a7..b695f3f23328 100644 --- a/drivers/net/ethernet/cisco/enic/enic_main.c +++ b/drivers/net/ethernet/cisco/enic/enic_main.c @@ -1117,18 +1117,30 @@ static int enic_set_vf_port(struct net_device *netdev, int vf, pp->request = nla_get_u8(port[IFLA_PORT_REQUEST]); if (port[IFLA_PORT_PROFILE]) { + if (nla_len(port[IFLA_PORT_PROFILE]) != PORT_PROFILE_MAX) { + memcpy(pp, &prev_pp, sizeof(*pp)); + return -EINVAL; + } pp->set |= ENIC_SET_NAME; memcpy(pp->name, nla_data(port[IFLA_PORT_PROFILE]), PORT_PROFILE_MAX); } if (port[IFLA_PORT_INSTANCE_UUID]) { + if (nla_len(port[IFLA_PORT_INSTANCE_UUID]) != PORT_UUID_MAX) { + memcpy(pp, &prev_pp, sizeof(*pp)); + return -EINVAL; + } pp->set |= ENIC_SET_INSTANCE; memcpy(pp->instance_uuid, nla_data(port[IFLA_PORT_INSTANCE_UUID]), PORT_UUID_MAX); } if (port[IFLA_PORT_HOST_UUID]) { + if (nla_len(port[IFLA_PORT_HOST_UUID]) != PORT_UUID_MAX) { + memcpy(pp, &prev_pp, sizeof(*pp)); + return -EINVAL; + } pp->set |= ENIC_SET_HOST; memcpy(pp->host_uuid, nla_data(port[IFLA_PORT_HOST_UUID]), PORT_UUID_MAX); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
by Yuan Can 26 Sep '24

26 Sep '24

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v5.10.221 commit 259549b2ccf795b7f91f7b5aba47286addcfa389 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGENV CVE: CVE-2024-41095 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 66edf3fb331b6c55439b10f9862987b0916b3726 upstream. In nv17_tv_get_ld_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Cc: stable(a)vger.kernel.org Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Signed-off-by: Lyude Paul <lyude(a)redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240625081828.2620794-1-make… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/gpu/drm/nouveau/dispnv04/tvnv17.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c index f6ecc774193f..1da9d1e89f91 100644 --- a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c +++ b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c @@ -208,6 +208,8 @@ static int nv17_tv_get_ld_modes(struct drm_encoder *encoder, struct drm_display_mode *mode; mode = drm_mode_duplicate(encoder->dev, tv_mode); + if (!mode) + continue; mode->clock = tv_norm->tv_enc_mode.vrefresh * mode->htotal / 1000 * -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ALSA: usb-audio: Stop parsing channels bits when all channels are found.
by Yuan Can 26 Sep '24

26 Sep '24

From: Johan Carlsson <johan.carlsson(a)teenage.engineering> stable inclusion from stable-v5.10.214 commit 5cd466673b34bac369334f66cbe14bb77b7d7827 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q91N CVE: CVE-2024-27436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a39d51ff1f52cd0b6fe7d379ac93bd8b4237d1b7 ] If a usb audio device sets more bits than the amount of channels it could write outside of the map array. Signed-off-by: Johan Carlsson <johan.carlsson(a)teenage.engineering> Fixes: 04324ccc75f9 ("ALSA: usb-audio: add channel map support") Message-ID: <20240313081509.9801-1-johan.carlsson(a)teenage.engineering> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- sound/usb/stream.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sound/usb/stream.c b/sound/usb/stream.c index c4f4585f9b85..f51e901a9689 100644 --- a/sound/usb/stream.c +++ b/sound/usb/stream.c @@ -301,9 +301,12 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits, c = 0; if (bits) { - for (; bits && *maps; maps++, bits >>= 1) + for (; bits && *maps; maps++, bits >>= 1) { if (bits & 1) chmap->map[c++] = *maps; + if (c == chmap->channels) + break; + } } else { /* If we're missing wChannelConfig, then guess something to make sure the channel map is not skipped entirely */ -- 2.17.1

2 1

[PATCH] fix: fix version showed in ethtool
by s00851154 26 Sep '24

26 Sep '24

Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 5a1995956a555..4ea526329d155 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strscpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strscpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strscpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311aab76c..5868187eafa99 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

1 0

[PATCH openEuler-22.03-LTS-SP1 v2] drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
by Wang Hai 26 Sep '24

26 Sep '24

From: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> mainline inclusion from mainline-v6.11-rc5 commit bfa1a6283be390947d3649c482e5167186a37016 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZV CVE: CVE-2024-44982 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the dpu_format_populate_layout() fails, then FB is prepared, but not cleaned up. This ends up leaking the pin_count on the GEM object and causes a splat during DRM file closure: msm_obj->pin_count WARNING: CPU: 2 PID: 569 at drivers/gpu/drm/msm/msm_gem.c:121 update_lru_locked+0xc4/0xcc [...] Call trace: update_lru_locked+0xc4/0xcc put_pages+0xac/0x100 msm_gem_free_object+0x138/0x180 drm_gem_object_free+0x1c/0x30 drm_gem_object_handle_put_unlocked+0x108/0x10c drm_gem_object_release_handle+0x58/0x70 idr_for_each+0x68/0xec drm_gem_release+0x28/0x40 drm_file_free+0x174/0x234 drm_release+0xb0/0x160 __fput+0xc0/0x2c8 __fput_sync+0x50/0x5c __arm64_sys_close+0x38/0x7c invoke_syscall+0x48/0x118 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x4c/0x120 el0t_64_sync_handler+0x100/0x12c el0t_64_sync+0x190/0x194 irq event stamp: 129818 hardirqs last enabled at (129817): [<ffffa5f6d953fcc0>] console_unlock+0x118/0x124 hardirqs last disabled at (129818): [<ffffa5f6da7dcf04>] el1_dbg+0x24/0x8c softirqs last enabled at (129808): [<ffffa5f6d94afc18>] handle_softirqs+0x4c8/0x4e8 softirqs last disabled at (129785): [<ffffa5f6d94105e4>] __do_softirq+0x14/0x20 Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Reviewed-by: Abhinav Kumar <quic_abhinavk(a)quicinc.com> Patchwork: https://patchwork.freedesktop.org/patch/600714/ Link: https://lore.kernel.org/r/20240625-dpu-mode-config-width-v5-1-501d984d634f@… Signed-off-by: Abhinav Kumar <quic_abhinavk(a)quicinc.com> Conflicts: drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c [Conflict due to commit 9e4dde28e9cd ("drm/msm: Avoid dirtyfb stalls on video mode displays (v2)") didn't merge.] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- v1->v2: fix build failed drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c index 8aa9f2335f57..e9a9522f3904 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c @@ -891,6 +891,8 @@ static int dpu_plane_prepare_fb(struct drm_plane *plane, new_state->fb, &layout); if (ret) { DPU_ERROR_PLANE(pdpu, "failed to get format layout, %d\n", ret); + if (pstate->aspace) + msm_framebuffer_cleanup(new_state->fb, pstate->aspace); return ret; } -- 2.17.1

2 1

[PATCH OLK-5.10 v2] drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
by Wang Hai 26 Sep '24

26 Sep '24

From: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> mainline inclusion from mainline-v6.11-rc5 commit bfa1a6283be390947d3649c482e5167186a37016 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZV CVE: CVE-2024-44982 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the dpu_format_populate_layout() fails, then FB is prepared, but not cleaned up. This ends up leaking the pin_count on the GEM object and causes a splat during DRM file closure: msm_obj->pin_count WARNING: CPU: 2 PID: 569 at drivers/gpu/drm/msm/msm_gem.c:121 update_lru_locked+0xc4/0xcc [...] Call trace: update_lru_locked+0xc4/0xcc put_pages+0xac/0x100 msm_gem_free_object+0x138/0x180 drm_gem_object_free+0x1c/0x30 drm_gem_object_handle_put_unlocked+0x108/0x10c drm_gem_object_release_handle+0x58/0x70 idr_for_each+0x68/0xec drm_gem_release+0x28/0x40 drm_file_free+0x174/0x234 drm_release+0xb0/0x160 __fput+0xc0/0x2c8 __fput_sync+0x50/0x5c __arm64_sys_close+0x38/0x7c invoke_syscall+0x48/0x118 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x4c/0x120 el0t_64_sync_handler+0x100/0x12c el0t_64_sync+0x190/0x194 irq event stamp: 129818 hardirqs last enabled at (129817): [<ffffa5f6d953fcc0>] console_unlock+0x118/0x124 hardirqs last disabled at (129818): [<ffffa5f6da7dcf04>] el1_dbg+0x24/0x8c softirqs last enabled at (129808): [<ffffa5f6d94afc18>] handle_softirqs+0x4c8/0x4e8 softirqs last disabled at (129785): [<ffffa5f6d94105e4>] __do_softirq+0x14/0x20 Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Reviewed-by: Abhinav Kumar <quic_abhinavk(a)quicinc.com> Patchwork: https://patchwork.freedesktop.org/patch/600714/ Link: https://lore.kernel.org/r/20240625-dpu-mode-config-width-v5-1-501d984d634f@… Signed-off-by: Abhinav Kumar <quic_abhinavk(a)quicinc.com> Conflicts: drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c [Conflict due to commit 9e4dde28e9cd ("drm/msm: Avoid dirtyfb stalls on video mode displays (v2)") didn't merge.] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- v1->v2: fix build failed drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c index 8aa9f2335f57..e9a9522f3904 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c @@ -891,6 +891,8 @@ static int dpu_plane_prepare_fb(struct drm_plane *plane, new_state->fb, &layout); if (ret) { DPU_ERROR_PLANE(pdpu, "failed to get format layout, %d\n", ret); + if (pstate->aspace) + msm_framebuffer_cleanup(new_state->fb, pstate->aspace); return ret; } -- 2.17.1

2 1

[openeuler:OLK-6.6 2385/14122] kernel/cgroup/cgroup.c:3968:29: error: 'cgroup_psi_stat_show' undeclared here (not in a function); did you mean 'cgroup_stat_show'?
by kernel test robot 26 Sep '24

26 Sep '24

Hi Lu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 81a41d2ac1de43215c014bc71d907a026042e55b commit: 4a69b56540f40550585b9f93c35e415ac90bdecc [2385/14122] sched/psi: Introduce pressure.stat in psi config: loongarch-randconfig-r061-20240926 (https://download.01.org/0day-ci/archive/20240926/202409260923.Yh7ALQqg-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240926/202409260923.Yh7ALQqg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409260923.Yh7ALQqg-lkp@intel.com/ All errors (new ones prefixed by >>): >> kernel/cgroup/cgroup.c:3968:29: error: 'cgroup_psi_stat_show' undeclared here (not in a function); did you mean 'cgroup_stat_show'? 3968 | .seq_show = cgroup_psi_stat_show, | ^~~~~~~~~~~~~~~~~~~~ | cgroup_stat_show vim +3968 kernel/cgroup/cgroup.c 3929 3930 struct cftype cgroup_v1_psi_files[] = { 3931 { 3932 .name = "io.pressure", 3933 .flags = CFTYPE_NO_PREFIX, 3934 .seq_show = cgroup_io_pressure_show, 3935 .write = cgroup_io_pressure_write, 3936 .poll = cgroup_pressure_poll, 3937 .release = cgroup_pressure_release, 3938 }, 3939 { 3940 .name = "memory.pressure", 3941 .flags = CFTYPE_NO_PREFIX, 3942 .seq_show = cgroup_memory_pressure_show, 3943 .write = cgroup_memory_pressure_write, 3944 .poll = cgroup_pressure_poll, 3945 .release = cgroup_pressure_release, 3946 }, 3947 { 3948 .name = "cpu.pressure", 3949 .flags = CFTYPE_NO_PREFIX, 3950 .seq_show = cgroup_cpu_pressure_show, 3951 .write = cgroup_cpu_pressure_write, 3952 .poll = cgroup_pressure_poll, 3953 .release = cgroup_pressure_release, 3954 }, 3955 #ifdef CONFIG_IRQ_TIME_ACCOUNTING 3956 { 3957 .name = "irq.pressure", 3958 .flags = CFTYPE_NO_PREFIX, 3959 .seq_show = cgroup_irq_pressure_show, 3960 .write = cgroup_irq_pressure_write, 3961 .poll = cgroup_pressure_poll, 3962 .release = cgroup_pressure_release, 3963 }, 3964 #endif 3965 { 3966 .name = "pressure.stat", 3967 .flags = CFTYPE_NO_PREFIX, > 3968 .seq_show = cgroup_psi_stat_show, 3969 }, 3970 { } /* terminate */ 3971 }; 3972 #endif 3973 #else /* CONFIG_PSI */ 3974 bool cgroup_psi_enabled(void) 3975 { 3976 return false; 3977 } 3978 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0