- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 16408/30000] arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'x16' in asm
by kernel test robot 13 Sep '24

13 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8f53b22e47e98837db7830541a369ed0cd5df749 commit: 78568d28ad62c586e32e3989de5354fcb014c09f [16408/30000] scripts: Fix issue of module signing with openssl 3.x config: arm64-randconfig-002-20240913 (https://download.01.org/0day-ci/archive/20240913/202409130912.f9BTikpV-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project bf684034844c660b778f0eba103582f582b710c9) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240913/202409130912.f9BTikpV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409130912.f9BTikpV-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r1' in asm include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' 446 | arm_smccc_1_1_hvc(__VA_ARGS__); | ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' 412 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:370:33: note: expanded from macro '__arm_smccc_1_1' 370 | register unsigned long r1 asm("r1"); | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r2' in asm include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' 446 | arm_smccc_1_1_hvc(__VA_ARGS__); | ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' 412 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:371:33: note: expanded from macro '__arm_smccc_1_1' 371 | register unsigned long r2 asm("r2"); | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r3' in asm include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' 446 | arm_smccc_1_1_hvc(__VA_ARGS__); | ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' 412 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:372:33: note: expanded from macro '__arm_smccc_1_1' 372 | register unsigned long r3 asm("r3"); | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' 446 | arm_smccc_1_1_hvc(__VA_ARGS__); | ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' 412 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:373:3: note: expanded from macro '__arm_smccc_1_1' 373 | __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); | ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/arm-smccc.h:354:37: note: expanded from macro '___declare_args' 354 | #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) | ^ <scratch space>:28:1: note: expanded from here 28 | __declare_arg_0 | ^ include/linux/arm-smccc.h:308:34: note: expanded from macro '__declare_arg_0' 308 | register unsigned long arg0 asm("r0") = (u32)a0 | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: >> arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'x16' in asm include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' 446 | arm_smccc_1_1_hvc(__VA_ARGS__); | ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' 412 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:377:9: note: expanded from macro '__arm_smccc_1_1' 377 | __constraints(__count_args(__VA_ARGS__))); | ^ include/linux/arm-smccc.h:360:30: note: expanded from macro '__constraints' 360 | #define __constraints(count) ___constraints(count) | ^ include/linux/arm-smccc.h:359:4: note: expanded from macro '___constraints' 359 | : smccc_sve_clobbers "memory" | ^ include/linux/arm-smccc.h:283:28: note: expanded from macro 'smccc_sve_clobbers' 283 | #define smccc_sve_clobbers "x16", "x30", "cc", | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:449:4: note: expanded from macro 'arm_smccc_1_1_invoke' 449 | arm_smccc_1_1_smc(__VA_ARGS__); | ^ include/linux/arm-smccc.h:396:32: note: expanded from macro 'arm_smccc_1_1_smc' 396 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:369:33: note: expanded from macro '__arm_smccc_1_1' 369 | register unsigned long r0 asm("r0"); | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r1' in asm include/linux/arm-smccc.h:449:4: note: expanded from macro 'arm_smccc_1_1_invoke' 449 | arm_smccc_1_1_smc(__VA_ARGS__); | ^ include/linux/arm-smccc.h:396:32: note: expanded from macro 'arm_smccc_1_1_smc' 396 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:370:33: note: expanded from macro '__arm_smccc_1_1' 370 | register unsigned long r1 asm("r1"); | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r2' in asm include/linux/arm-smccc.h:449:4: note: expanded from macro 'arm_smccc_1_1_invoke' 449 | arm_smccc_1_1_smc(__VA_ARGS__); | ^ include/linux/arm-smccc.h:396:32: note: expanded from macro 'arm_smccc_1_1_smc' 396 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:371:33: note: expanded from macro '__arm_smccc_1_1' 371 | register unsigned long r2 asm("r2"); | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r3' in asm include/linux/arm-smccc.h:449:4: note: expanded from macro 'arm_smccc_1_1_invoke' 449 | arm_smccc_1_1_smc(__VA_ARGS__); | ^ include/linux/arm-smccc.h:396:32: note: expanded from macro 'arm_smccc_1_1_smc' 396 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:372:33: note: expanded from macro '__arm_smccc_1_1' 372 | register unsigned long r3 asm("r3"); | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:449:4: note: expanded from macro 'arm_smccc_1_1_invoke' 449 | arm_smccc_1_1_smc(__VA_ARGS__); | ^ include/linux/arm-smccc.h:396:32: note: expanded from macro 'arm_smccc_1_1_smc' 396 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:373:3: note: expanded from macro '__arm_smccc_1_1' 373 | __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); | ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/arm-smccc.h:354:37: note: expanded from macro '___declare_args' 354 | #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) | ^ <scratch space>:36:1: note: expanded from here 36 | __declare_arg_0 | ^ include/linux/arm-smccc.h:308:34: note: expanded from macro '__declare_arg_0' 308 | register unsigned long arg0 asm("r0") = (u32)a0 | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: >> arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'x16' in asm include/linux/arm-smccc.h:449:4: note: expanded from macro 'arm_smccc_1_1_invoke' 449 | arm_smccc_1_1_smc(__VA_ARGS__); | ^ include/linux/arm-smccc.h:396:32: note: expanded from macro 'arm_smccc_1_1_smc' 396 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:377:9: note: expanded from macro '__arm_smccc_1_1' 377 | __constraints(__count_args(__VA_ARGS__))); | ^ include/linux/arm-smccc.h:360:30: note: expanded from macro '__constraints' 360 | #define __constraints(count) ___constraints(count) | ^ include/linux/arm-smccc.h:359:4: note: expanded from macro '___constraints' 359 | : smccc_sve_clobbers "memory" | ^ include/linux/arm-smccc.h:283:28: note: expanded from macro 'smccc_sve_clobbers' 283 | #define smccc_sve_clobbers "x16", "x30", "cc", | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:452:4: note: expanded from macro 'arm_smccc_1_1_invoke' 452 | __fail_smccc_1_1(__VA_ARGS__); | ^ include/linux/arm-smccc.h:421:3: note: expanded from macro '__fail_smccc_1_1' 421 | __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); | ^ include/linux/arm-smccc.h:355:37: note: expanded from macro '__declare_args' 355 | #define __declare_args(count, ...) ___declare_args(count, __VA_ARGS__) | ^ include/linux/arm-smccc.h:354:37: note: expanded from macro '___declare_args' 354 | #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) | ^ <scratch space>:44:1: note: expanded from here 44 | __declare_arg_0 | ^ include/linux/arm-smccc.h:308:34: note: expanded from macro '__declare_arg_0' 308 | register unsigned long arg0 asm("r0") = (u32)a0 | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: >> arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'x16' in asm include/linux/arm-smccc.h:452:4: note: expanded from macro 'arm_smccc_1_1_invoke' 452 | __fail_smccc_1_1(__VA_ARGS__); | ^ include/linux/arm-smccc.h:422:13: note: expanded from macro '__fail_smccc_1_1' 422 | asm ("" : __constraints(__count_args(__VA_ARGS__))); | ^ include/linux/arm-smccc.h:360:30: note: expanded from macro '__constraints' 360 | #define __constraints(count) ___constraints(count) | ^ include/linux/arm-smccc.h:359:4: note: expanded from macro '___constraints' 359 | : smccc_sve_clobbers "memory" | ^ include/linux/arm-smccc.h:283:28: note: expanded from macro 'smccc_sve_clobbers' 283 | #define smccc_sve_clobbers "x16", "x30", "cc", | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:66:3: error: unknown register name 'r0' in asm 66 | arm_smccc_1_1_invoke(ARM_SMCCC_TRNG_RND64, 64, &res); | ^ include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' 446 | arm_smccc_1_1_hvc(__VA_ARGS__); | ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' 412 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:369:33: note: expanded from macro '__arm_smccc_1_1' 369 | register unsigned long r0 asm("r0"); | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:66:3: error: unknown register name 'r1' in asm include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' 446 | arm_smccc_1_1_hvc(__VA_ARGS__); | ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' 412 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:370:33: note: expanded from macro '__arm_smccc_1_1' 370 | register unsigned long r1 asm("r1"); | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:66:3: error: unknown register name 'r2' in asm include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' 446 | arm_smccc_1_1_hvc(__VA_ARGS__); | ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' 412 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:371:33: note: expanded from macro '__arm_smccc_1_1' 371 | register unsigned long r2 asm("r2"); | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:38: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:104: arch/arm64/include/asm/archrandom.h:66:3: error: unknown register name 'r3' in asm include/linux/arm-smccc.h:446:4: note: expanded from macro 'arm_smccc_1_1_invoke' 446 | arm_smccc_1_1_hvc(__VA_ARGS__); | ^ include/linux/arm-smccc.h:412:32: note: expanded from macro 'arm_smccc_1_1_hvc' 412 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) vim +/x16 +20 arch/arm64/include/asm/archrandom.h 78d8f4f7a298a5 Andre Przywara 2022-01-17 15 181f11fd395b9e Andre Przywara 2022-01-17 16 static inline bool __init smccc_probe_trng(void) 181f11fd395b9e Andre Przywara 2022-01-17 17 { 78d8f4f7a298a5 Andre Przywara 2022-01-17 18 struct arm_smccc_res res; 78d8f4f7a298a5 Andre Przywara 2022-01-17 19 78d8f4f7a298a5 Andre Przywara 2022-01-17 @20 arm_smccc_1_1_invoke(ARM_SMCCC_TRNG_VERSION, &res); 78d8f4f7a298a5 Andre Przywara 2022-01-17 21 if ((s32)res.a0 < 0) 181f11fd395b9e Andre Przywara 2022-01-17 22 return false; 78d8f4f7a298a5 Andre Przywara 2022-01-17 23 78d8f4f7a298a5 Andre Przywara 2022-01-17 24 return res.a0 >= ARM_SMCCC_TRNG_MIN_VERSION; 181f11fd395b9e Andre Przywara 2022-01-17 25 } 181f11fd395b9e Andre Przywara 2022-01-17 26 :::::: The code at line 20 was first introduced by commit :::::: 78d8f4f7a298a5d259b2163121ea20b9e60e93f7 arm64: Add support for SMCCC TRNG entropy source :::::: TO: Andre Przywara <andre.przywara(a)arm.com> :::::: CC: Zheng Zengkai <zhengzengkai(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 19446/30000] drivers/ub/urma/uburma/uburma_dev_ops.c:32:5: warning: no previous prototype for 'uburma_mmap'
by kernel test robot 13 Sep '24

13 Sep '24

Hi Yizhen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8f53b22e47e98837db7830541a369ed0cd5df749 commit: 7d130c6018dbfd09c6e1c5d91b347fdbf3924321 [19446/30000] ub: add mmap ops support in ubcore and uburma config: arm64-randconfig-004-20240912 (https://download.01.org/0day-ci/archive/20240913/202409130707.LQaWHUsI-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240913/202409130707.LQaWHUsI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409130707.LQaWHUsI-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/uburma/uburma_dev_ops.c:32:5: warning: no previous prototype for 'uburma_mmap' [-Wmissing-prototypes] 32 | int uburma_mmap(struct file *filp, struct vm_area_struct *vma) | ^~~~~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c:64:6: warning: no previous prototype for 'uburma_release_file' [-Wmissing-prototypes] 64 | void uburma_release_file(struct kref *ref) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c:81:5: warning: no previous prototype for 'uburma_open' [-Wmissing-prototypes] 81 | int uburma_open(struct inode *inode, struct file *filp) | ^~~~~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c: In function 'uburma_open': drivers/ub/urma/uburma/uburma_dev_ops.c:98:50: warning: the comparison will always evaluate as 'false' for the address of 'dev_name' will never be NULL [-Waddress] 98 | if (ubc_dev == NULL || ubc_dev->dev_name == NULL) { | ^~ In file included from drivers/ub/urma/uburma/uburma_dev_ops.c:25: include/urma/ubcore_types.h:1589:14: note: 'dev_name' declared here 1589 | char dev_name[UBCORE_MAX_DEV_NAME]; | ^~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c: At top level: drivers/ub/urma/uburma/uburma_dev_ops.c:134:5: warning: no previous prototype for 'uburma_close' [-Wmissing-prototypes] 134 | int uburma_close(struct inode *inode, struct file *filp) | ^~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/uburma_mmap +32 drivers/ub/urma/uburma/uburma_dev_ops.c 31 > 32 int uburma_mmap(struct file *filp, struct vm_area_struct *vma) 33 { 34 struct uburma_file *file = filp->private_data; 35 struct uburma_device *ubu_dev; 36 struct ubcore_device *ubc_dev; 37 int srcu_idx; 38 int ret; 39 40 if (file == NULL || file->ucontext == NULL) { 41 uburma_log_err("can not find ucontext.\n"); 42 return -EINVAL; 43 } 44 45 ubu_dev = file->ubu_dev; 46 uburma_cmd_inc(ubu_dev); 47 48 srcu_idx = srcu_read_lock(&ubu_dev->ubc_dev_srcu); 49 ubc_dev = srcu_dereference(ubu_dev->ubc_dev, &ubu_dev->ubc_dev_srcu); 50 if (ubc_dev == NULL || ubc_dev->ops == NULL || ubc_dev->ops->mmap == NULL) { 51 uburma_log_err("can not find ubcore device.\n"); 52 ret = -ENODEV; 53 goto out; 54 } 55 56 ret = ubc_dev->ops->mmap(file->ucontext, vma); 57 58 out: 59 srcu_read_unlock(&ubu_dev->ubc_dev_srcu, srcu_idx); 60 uburma_cmd_dec(ubu_dev); 61 return ret; 62 } 63 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 13785/30000] kernel/workqueue.c:4821:5: error: implicit declaration of function 'printk_safe_enter'
by kernel test robot 13 Sep '24

13 Sep '24

Hi Johan, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8f53b22e47e98837db7830541a369ed0cd5df749 commit: 3d01105a68b1318bdc3cef3bbcfcb544e2da856e [13785/30000] workqueue: fix state-dump console deadlock config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20240913/202409130657.OYQpiJvp-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240913/202409130657.OYQpiJvp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409130657.OYQpiJvp-lkp@intel.com/ All errors (new ones prefixed by >>): >> kernel/workqueue.c:4821:5: error: implicit declaration of function 'printk_safe_enter' [-Werror,-Wimplicit-function-declaration] 4821 | printk_safe_enter(); | ^ kernel/workqueue.c:4821:5: note: did you mean 'printk_nmi_enter'? include/linux/printk.h:158:20: note: 'printk_nmi_enter' declared here 158 | static inline void printk_nmi_enter(void) { } | ^ kernel/workqueue.c:4823:5: error: implicit declaration of function 'printk_safe_exit' [-Werror,-Wimplicit-function-declaration] 4823 | printk_safe_exit(); | ^ kernel/workqueue.c:4847:3: error: implicit declaration of function 'printk_safe_enter' [-Werror,-Wimplicit-function-declaration] 4847 | printk_safe_enter(); | ^ kernel/workqueue.c:4862:3: error: implicit declaration of function 'printk_safe_exit' [-Werror,-Wimplicit-function-declaration] 4862 | printk_safe_exit(); | ^ 4 errors generated. vim +/printk_safe_enter +4821 kernel/workqueue.c 4780 4781 /** 4782 * show_workqueue_state - dump workqueue state 4783 * 4784 * Called from a sysrq handler or try_to_freeze_tasks() and prints out 4785 * all busy workqueues and pools. 4786 */ 4787 void show_workqueue_state(void) 4788 { 4789 struct workqueue_struct *wq; 4790 struct worker_pool *pool; 4791 unsigned long flags; 4792 int pi; 4793 4794 rcu_read_lock(); 4795 4796 pr_info("Showing busy workqueues and worker pools:\n"); 4797 4798 list_for_each_entry_rcu(wq, &workqueues, list) { 4799 struct pool_workqueue *pwq; 4800 bool idle = true; 4801 4802 for_each_pwq(pwq, wq) { 4803 if (pwq->nr_active || !list_empty(&pwq->delayed_works)) { 4804 idle = false; 4805 break; 4806 } 4807 } 4808 if (idle) 4809 continue; 4810 4811 pr_info("workqueue %s: flags=0x%x\n", wq->name, wq->flags); 4812 4813 for_each_pwq(pwq, wq) { 4814 raw_spin_lock_irqsave(&pwq->pool->lock, flags); 4815 if (pwq->nr_active || !list_empty(&pwq->delayed_works)) { 4816 /* 4817 * Defer printing to avoid deadlocks in console 4818 * drivers that queue work while holding locks 4819 * also taken in their write paths. 4820 */ > 4821 printk_safe_enter(); 4822 show_pwq(pwq); 4823 printk_safe_exit(); 4824 } 4825 raw_spin_unlock_irqrestore(&pwq->pool->lock, flags); 4826 /* 4827 * We could be printing a lot from atomic context, e.g. 4828 * sysrq-t -> show_workqueue_state(). Avoid triggering 4829 * hard lockup. 4830 */ 4831 touch_nmi_watchdog(); 4832 } 4833 } 4834 4835 for_each_pool(pool, pi) { 4836 struct worker *worker; 4837 bool first = true; 4838 4839 raw_spin_lock_irqsave(&pool->lock, flags); 4840 if (pool->nr_workers == pool->nr_idle) 4841 goto next_pool; 4842 /* 4843 * Defer printing to avoid deadlocks in console drivers that 4844 * queue work while holding locks also taken in their write 4845 * paths. 4846 */ 4847 printk_safe_enter(); 4848 pr_info("pool %d:", pool->id); 4849 pr_cont_pool_info(pool); 4850 pr_cont(" hung=%us workers=%d", 4851 jiffies_to_msecs(jiffies - pool->watchdog_ts) / 1000, 4852 pool->nr_workers); 4853 if (pool->manager) 4854 pr_cont(" manager: %d", 4855 task_pid_nr(pool->manager->task)); 4856 list_for_each_entry(worker, &pool->idle_list, entry) { 4857 pr_cont(" %s%d", first ? "idle: " : "", 4858 task_pid_nr(worker->task)); 4859 first = false; 4860 } 4861 pr_cont("\n"); 4862 printk_safe_exit(); 4863 next_pool: 4864 raw_spin_unlock_irqrestore(&pool->lock, flags); 4865 /* 4866 * We could be printing a lot from atomic context, e.g. 4867 * sysrq-t -> show_workqueue_state(). Avoid triggering 4868 * hard lockup. 4869 */ 4870 touch_nmi_watchdog(); 4871 } 4872 4873 rcu_read_unlock(); 4874 } 4875 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 19445/30000] drivers/ub/urma/uburma/uburma_dev_ops.c:32:6: warning: no previous prototype for 'uburma_release_file'
by kernel test robot 13 Sep '24

13 Sep '24

Hi Yizhen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8f53b22e47e98837db7830541a369ed0cd5df749 commit: cd637a6dded9c0dce5f8d79898bb25be2edb927a [19445/30000] ub: uburma support open/release file ops config: arm64-randconfig-004-20240912 (https://download.01.org/0day-ci/archive/20240913/202409130325.7Mu8hINa-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240913/202409130325.7Mu8hINa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409130325.7Mu8hINa-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/uburma/uburma_dev_ops.c:32:6: warning: no previous prototype for 'uburma_release_file' [-Wmissing-prototypes] 32 | void uburma_release_file(struct kref *ref) | ^~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/uburma/uburma_dev_ops.c:49:5: warning: no previous prototype for 'uburma_open' [-Wmissing-prototypes] 49 | int uburma_open(struct inode *inode, struct file *filp) | ^~~~~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c: In function 'uburma_open': >> drivers/ub/urma/uburma/uburma_dev_ops.c:66:50: warning: the comparison will always evaluate as 'false' for the address of 'dev_name' will never be NULL [-Waddress] 66 | if (ubc_dev == NULL || ubc_dev->dev_name == NULL) { | ^~ In file included from drivers/ub/urma/uburma/uburma_dev_ops.c:25: include/urma/ubcore_types.h:1589:14: note: 'dev_name' declared here 1589 | char dev_name[UBCORE_MAX_DEV_NAME]; | ^~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c: At top level: >> drivers/ub/urma/uburma/uburma_dev_ops.c:102:5: warning: no previous prototype for 'uburma_close' [-Wmissing-prototypes] 102 | int uburma_close(struct inode *inode, struct file *filp) | ^~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/uburma_release_file +32 drivers/ub/urma/uburma/uburma_dev_ops.c 31 > 32 void uburma_release_file(struct kref *ref) 33 { 34 struct uburma_file *file = container_of(ref, struct uburma_file, ref); 35 int srcu_idx; 36 37 srcu_idx = srcu_read_lock(&file->ubu_dev->ubc_dev_srcu); 38 srcu_dereference(file->ubu_dev->ubc_dev, &file->ubu_dev->ubc_dev_srcu); 39 40 srcu_read_unlock(&file->ubu_dev->ubc_dev_srcu, srcu_idx); 41 42 if (atomic_dec_and_test(&file->ubu_dev->refcnt)) 43 complete(&file->ubu_dev->comp); 44 45 kobject_put(&file->ubu_dev->kobj); 46 kfree(file); 47 } 48 > 49 int uburma_open(struct inode *inode, struct file *filp) 50 { 51 struct uburma_device *ubu_dev; 52 struct ubcore_device *ubc_dev; 53 struct uburma_file *file; 54 int srcu_idx; 55 int ret; 56 57 ubu_dev = container_of(inode->i_cdev, struct uburma_device, cdev); 58 if (!atomic_inc_not_zero(&ubu_dev->refcnt)) { 59 uburma_log_err("device was not ready.\n"); 60 return -ENXIO; 61 } 62 63 srcu_idx = srcu_read_lock(&ubu_dev->ubc_dev_srcu); 64 mutex_lock(&ubu_dev->lists_mutex); 65 ubc_dev = srcu_dereference(ubu_dev->ubc_dev, &ubu_dev->ubc_dev_srcu); > 66 if (ubc_dev == NULL || ubc_dev->dev_name == NULL) { 67 uburma_log_err("can not find ubcore device.\n"); 68 ret = EIO; 69 goto err; 70 } 71 72 file = kzalloc(sizeof(struct uburma_file), GFP_KERNEL); 73 if (!file) { 74 ret = -ENOMEM; 75 uburma_log_err("can not alloc memory.\n"); 76 goto err; 77 } 78 79 file->ubu_dev = ubu_dev; 80 file->ucontext = NULL; 81 kref_init(&file->ref); 82 mutex_init(&file->mutex); 83 filp->private_data = file; 84 85 list_add_tail(&file->list, &ubu_dev->uburma_file_list); 86 kobject_get(&ubu_dev->kobj); // Increase reference count for file. 87 88 mutex_unlock(&ubu_dev->lists_mutex); 89 srcu_read_unlock(&ubu_dev->ubc_dev_srcu, srcu_idx); 90 91 uburma_log_info("device: %s open succeed.\n", ubc_dev->dev_name); 92 return nonseekable_open(inode, filp); 93 94 err: 95 mutex_unlock(&ubu_dev->lists_mutex); 96 srcu_read_unlock(&ubu_dev->ubc_dev_srcu, srcu_idx); 97 if (atomic_dec_and_test(&ubu_dev->refcnt)) 98 complete(&ubu_dev->comp); 99 return ret; 100 } 101 > 102 int uburma_close(struct inode *inode, struct file *filp) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7633/13930] drivers/ptp/ptp_hisi.c:731:36: warning: 'hisi_ptp_acpi_match' defined but not used
by kernel test robot 13 Sep '24

13 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 13706c950ff941dc015e16f76812077f9861e378 commit: e6aa0ecf50a8a0da6b742aacd9cbd47463275a30 [7633/13930] net: hns3: add support for Hisilicon ptp sync device config: arm64-randconfig-003-20240913 (https://download.01.org/0day-ci/archive/20240913/202409130201.5q7OutLm-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240913/202409130201.5q7OutLm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409130201.5q7OutLm-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ptp/ptp_hisi.c:731:36: warning: 'hisi_ptp_acpi_match' defined but not used [-Wunused-const-variable=] 731 | static const struct acpi_device_id hisi_ptp_acpi_match[] = { | ^~~~~~~~~~~~~~~~~~~ vim +/hisi_ptp_acpi_match +731 drivers/ptp/ptp_hisi.c 730 > 731 static const struct acpi_device_id hisi_ptp_acpi_match[] = { 732 { "HISI0411", 0 }, 733 { } 734 }; 735 MODULE_DEVICE_TABLE(acpi, hisi_ptp_acpi_match); 736 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 13706c950ff941dc015e16f76812077f9861e378
by kernel test robot 13 Sep '24

13 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 13706c950ff941dc015e16f76812077f9861e378 !11503 mm: mTHP user controls to pagecache large folio Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kernel-virtcca_cvm_host.c:warning:no-previous-prototype-for-function-is_virtcca_cvm_enable | |-- arch-arm64-kvm-tmi.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs | |-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:no-previous-prototype-for-function-virtcca_smmu_evtq_thread | `-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:no-previous-prototype-for-function-virtcca_smmu_gerror_handler |-- arm64-allnoconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-001-20240913 | |-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs | `-- mm-page_alloc.c:error:call-to-undeclared-function-dynamic_pool_should_alloc-ISO-C99-and-later-do-not-support-implicit-function-declarations-Werror-Wimplicit-function-declaration |-- arm64-randconfig-002-20240913 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-003-20240913 | |-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs | |-- drivers-platform-mpam-mpam_devices.c:error:implicit-declaration-of-function-__acpi_get_mem_attribute | `-- drivers-platform-mpam-mpam_devices.c:error:incompatible-types-when-assigning-to-type-pgprot_t-from-type-int |-- arm64-randconfig-004-20240913 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-allmodconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-allnoconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-randconfig-001-20240913 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-allyesconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-001-20240912 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | `-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier |-- x86_64-buildonly-randconfig-002-20240912 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-005-20240912 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-defconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs `-- x86_64-rhel-8.3-rust `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs elapsed time: 935m configs tested: 18 configs skipped: 134 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240913 clang-15 arm64 randconfig-002-20240913 clang-20 arm64 randconfig-003-20240913 gcc-14.1.0 arm64 randconfig-004-20240913 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240913 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240912 clang-18 x86_64 buildonly-randconfig-002-20240912 clang-18 x86_64 buildonly-randconfig-003-20240912 clang-18 x86_64 buildonly-randconfig-004-20240912 clang-18 x86_64 buildonly-randconfig-005-20240912 gcc-12 x86_64 defconfig gcc-11 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 19385/30000] drivers/ub/urma/ubcore/ubcore_umem.c:227:21: warning: no previous prototype for 'ubcore_umem_get'
by kernel test robot 13 Sep '24

13 Sep '24

Hi Yizhen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8f53b22e47e98837db7830541a369ed0cd5df749 commit: f6206cf05e28a7f455850a4e2de8162890f50073 [19385/30000] ub: add memory map api in ubcore config: arm64-randconfig-004-20240912 (https://download.01.org/0day-ci/archive/20240913/202409130030.E8xxPVNT-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240913/202409130030.E8xxPVNT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409130030.E8xxPVNT-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/ubcore/ubcore_umem.c:227:21: warning: no previous prototype for 'ubcore_umem_get' [-Wmissing-prototypes] 227 | struct ubcore_umem *ubcore_umem_get(struct ubcore_device *dev, uint64_t va, uint64_t len, | ^~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_umem.c:245:6: warning: no previous prototype for 'ubcore_umem_release' [-Wmissing-prototypes] 245 | void ubcore_umem_release(struct ubcore_umem *umem) | ^~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/ubcore_umem_get +227 drivers/ub/urma/ubcore/ubcore_umem.c 226 > 227 struct ubcore_umem *ubcore_umem_get(struct ubcore_device *dev, uint64_t va, uint64_t len, 228 union ubcore_umem_flag flag) 229 { 230 struct page **page_list; 231 int ret; 232 233 ret = umem_verify_input(dev, va, len, flag); 234 if (ret < 0) 235 return ERR_PTR(ret); 236 237 page_list = (struct page **)__get_free_page(GFP_KERNEL); 238 if (page_list == 0) 239 return ERR_PTR(-ENOMEM); 240 241 return ubcore_get_target_umem(dev, va, len, flag, page_list); 242 } 243 EXPORT_SYMBOL(ubcore_umem_get); 244 > 245 void ubcore_umem_release(struct ubcore_umem *umem) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 19377/30000] drivers/ub/urma/ubcore/ubcore_main.c:61:5: warning: no previous prototype for 'ubcore_open'
by kernel test robot 12 Sep '24

12 Sep '24

Hi Yizhen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8f53b22e47e98837db7830541a369ed0cd5df749 commit: 95c713224477ac3433652331dd715e9bbcbc793a [19377/30000] ub: init ubcore module config: arm64-randconfig-004-20240912 (https://download.01.org/0day-ci/archive/20240912/202409122243.XfSUhJlV-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240912/202409122243.XfSUhJlV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409122243.XfSUhJlV-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/ubcore/ubcore_main.c:61:5: warning: no previous prototype for 'ubcore_open' [-Wmissing-prototypes] 61 | int ubcore_open(struct inode *i_node, struct file *filp) | ^~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/ubcore_open +61 drivers/ub/urma/ubcore/ubcore_main.c 60 > 61 int ubcore_open(struct inode *i_node, struct file *filp) 62 { 63 return 0; 64 } 65 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH 0/5] perf arm: Fix workaround ARM PMUs cpu maps having
by Yushan Wang 12 Sep '24

12 Sep '24

This patchset includes a fix for the issue of which ARM will try to open events on offlined CPUs when PMUs have a cpu map, and its essential dependent patches. Some modifications are added to adapt to OpenEuler. Ian Rogers (4): perf cpumap: Add is_subset function perf cpumap: Add intersect function perf pmu: Add CPU map for "cpu" PMUs perf arm: Workaround ARM PMUs cpu maps having offline cpus Yushan Wang (1): perf cpumap: Fix incompatible perf_cpu type for perf_cpu_map__intersect tools/lib/perf/cpumap.c | 55 ++++++++++++++++++++++++ tools/lib/perf/include/internal/cpumap.h | 1 + tools/lib/perf/include/perf/cpumap.h | 2 + tools/perf/arch/arm/util/pmu.c | 10 ++++- tools/perf/util/cpumap.c | 4 +- tools/perf/util/cpumap.h | 2 +- 6 files changed, 70 insertions(+), 4 deletions(-) -- 2.33.0

1 5

[openeuler:OLK-5.10 17535/30000] mm/share_pool.c:2573:7: warning: no previous prototype for '__mg_sp_alloc_nodemask'
by kernel test robot 12 Sep '24

12 Sep '24

Hi Chen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8f53b22e47e98837db7830541a369ed0cd5df749 commit: 8deff3a60ce1a9dffb552210f065fc9ed6a55f84 [17535/30000] mm/sharepool: Add mg_sp_alloc_nodemask config: arm64-randconfig-004-20240912 (https://download.01.org/0day-ci/archive/20240912/202409121903.R7e8tX7R-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240912/202409121903.R7e8tX7R-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409121903.R7e8tX7R-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/share_pool.c:2573:7: warning: no previous prototype for '__mg_sp_alloc_nodemask' [-Wmissing-prototypes] 2573 | void *__mg_sp_alloc_nodemask(unsigned long size, unsigned long sp_flags, int spg_id, | ^~~~~~~~~~~~~~~~~~~~~~ mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:3037:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 3037 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:3037:21: error: invalid initializer mm/share_pool.c: In function 'sp_unshare_kva': mm/share_pool.c:3355:14: warning: variable 'is_hugepage' set but not used [-Wunused-but-set-variable] 3355 | bool is_hugepage = true; | ^~~~~~~~~~~ mm/share_pool.c: In function 'sharepool_no_page': mm/share_pool.c:4071:41: error: 'HUGETLB_ALLOC_BUDDY' undeclared (first use in this function) 4071 | HUGETLB_ALLOC_BUDDY | HUGETLB_ALLOC_NORECLAIM); | ^~~~~~~~~~~~~~~~~~~ mm/share_pool.c:4071:41: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:4071:63: error: 'HUGETLB_ALLOC_NORECLAIM' undeclared (first use in this function) 4071 | HUGETLB_ALLOC_BUDDY | HUGETLB_ALLOC_NORECLAIM); | ^~~~~~~~~~~~~~~~~~~~~~~ mm/share_pool.c:4079:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 4079 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock mm/share_pool.c:4099:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 4099 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache mm/share_pool.c:4121:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 4121 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at mm/share_pool.c:4123:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 4123 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub cc1: some warnings being treated as errors Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/__mg_sp_alloc_nodemask +2573 mm/share_pool.c 2572 > 2573 void *__mg_sp_alloc_nodemask(unsigned long size, unsigned long sp_flags, int spg_id, 2574 nodemask_t *nodemask) 2575 { 2576 struct sp_area *spa = NULL; 2577 int ret = 0; 2578 struct sp_alloc_context ac; 2579 2580 if (!sp_is_enabled()) 2581 return ERR_PTR(-EOPNOTSUPP); 2582 2583 ret = sp_alloc_prepare(size, sp_flags, spg_id, &ac); 2584 if (ret) 2585 return ERR_PTR(ret); 2586 2587 try_again: 2588 spa = sp_alloc_area(ac.size_aligned, ac.sp_flags, ac.spg, 2589 ac.type, current->tgid); 2590 if (IS_ERR(spa)) { 2591 pr_err_ratelimited("alloc spa failed in allocation(potential no enough virtual memory when -75): %ld\n", 2592 PTR_ERR(spa)); 2593 ret = PTR_ERR(spa); 2594 goto out; 2595 } 2596 2597 ret = sp_alloc_mmap_populate(spa, &ac, nodemask); 2598 if (ret && ac.state == ALLOC_RETRY) { 2599 /* 2600 * The mempolicy for shared memory is located at backend file, which varies 2601 * between normal pages and huge pages. So we should set the mbind policy again 2602 * when we retry using normal pages. 2603 */ 2604 ac.have_mbind = false; 2605 goto try_again; 2606 } 2607 2608 out: 2609 sp_alloc_finish(ret, spa, &ac); 2610 if (ret) 2611 return ERR_PTR(ret); 2612 else 2613 return (void *)(spa->va_start); 2614 } 2615 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS v2] usb: gadget: core: Check for unset descriptor
by Ye Bin 12 Sep '24

12 Sep '24

From: Chris Wulff <crwulff(a)gmail.com> stable inclusion from stable-v4.19.320 commit ba15815dd24cc5ec0d23e2170dc58c7db1e03b4a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZ1 CVE: CVE-2024-44960 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 973a57891608a98e894db2887f278777f564de18 upstream. Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set up the endpoint for the current speed, or the gadget descriptors are malformed and the descriptor for the speed/endpoint are not found. No current gadget driver is known to have this problem, but this may cause a hard-to-find bug during development of new gadgets. Fixes: 54f83b8c8ea9 ("USB: gadget: Reject endpoints with 0 maxpacket value") Cc: stable(a)vger.kernel.org Signed-off-by: Chris Wulff <crwulff(a)gmail.com> Link: https://lore.kernel.org/r/20240725010419.314430-2-crwulff@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/usb/gadget/udc/core.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index b45dd7827ff9..1335a715f5dd 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -99,12 +99,10 @@ int usb_ep_enable(struct usb_ep *ep) goto out; /* UDC drivers can't handle endpoints with maxpacket size 0 */ - if (usb_endpoint_maxp(ep->desc) == 0) { - /* - * We should log an error message here, but we can't call - * dev_err() because there's no way to find the gadget - * given only ep. - */ + if (!ep->desc || usb_endpoint_maxp(ep->desc) == 0) { + WARN_ONCE(1, "%s: ep%d (%s) has %s\n", __func__, ep->address, ep->name, + (!ep->desc) ? "NULL descriptor" : "maxpacket 0"); + ret = -EINVAL; goto out; } -- 2.34.1

2 1

[openeuler:OLK-5.10 26966/30000] arch/x86/kvm/x86.c:1076:6: sparse: sparse: symbol 'kvm_post_set_cr4' was not declared. Should it be static?
by kernel test robot 12 Sep '24

12 Sep '24

Hi Yu, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: edbc98270a614911e6064ff3675e6f8a0a6dde0b commit: 8a7e6f51a756aa6e88ebd5da8a5f3b6744cd07b5 [26966/30000] KVM: x86: Introduce kvm_post_set_cr4 to post handle the CR4 emulation config: x86_64-randconfig-123-20240910 (https://download.01.org/0day-ci/archive/20240912/202409121652.VtoLzgNf-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240912/202409121652.VtoLzgNf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409121652.VtoLzgNf-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/x86/kvm/x86.c:893:6: sparse: sparse: symbol 'kvm_post_set_cr0' was not declared. Should it be static? >> arch/x86/kvm/x86.c:1076:6: sparse: sparse: symbol 'kvm_post_set_cr4' was not declared. Should it be static? arch/x86/kvm/x86.c:3051:38: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] __user * @@ got unsigned char [usertype] * @@ arch/x86/kvm/x86.c:3051:38: sparse: expected void const [noderef] __user * arch/x86/kvm/x86.c:3051:38: sparse: got unsigned char [usertype] * arch/x86/kvm/x86.c:8615:15: sparse: sparse: incompatible types in comparison expression (different address spaces): arch/x86/kvm/x86.c:8615:15: sparse: struct kvm_apic_map [noderef] __rcu * arch/x86/kvm/x86.c:8615:15: sparse: struct kvm_apic_map * arch/x86/kvm/x86.c:11015:32: sparse: sparse: Using plain integer as NULL pointer arch/x86/kvm/x86.c:11068:16: sparse: sparse: incompatible types in comparison expression (different address spaces): arch/x86/kvm/x86.c:11068:16: sparse: struct kvm_apic_map [noderef] __rcu * arch/x86/kvm/x86.c:11068:16: sparse: struct kvm_apic_map * arch/x86/kvm/x86.c:11069:15: sparse: sparse: incompatible types in comparison expression (different address spaces): arch/x86/kvm/x86.c:11069:15: sparse: struct kvm_pmu_event_filter [noderef] __rcu * arch/x86/kvm/x86.c:11069:15: sparse: struct kvm_pmu_event_filter * arch/x86/kvm/x86.c:4141:42: sparse: sparse: self-comparison always evaluates to false arch/x86/kvm/x86.c: note: in included file (through include/linux/notifier.h, arch/x86/include/asm/uprobes.h, include/linux/uprobes.h, ...): include/linux/srcu.h:182:9: sparse: sparse: context imbalance in 'vcpu_enter_guest' - unexpected unlock vim +/kvm_post_set_cr4 +1076 arch/x86/kvm/x86.c 1075 > 1076 void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4) 1077 { 1078 unsigned long mmu_role_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE | 1079 X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE; 1080 1081 if (((cr4 ^ old_cr4) & mmu_role_bits) || 1082 (!(cr4 & X86_CR4_PCIDE) && (old_cr4 & X86_CR4_PCIDE))) 1083 kvm_mmu_reset_context(vcpu); 1084 } 1085 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 5685/30000] arch/arm64/mm/quick_kexec.c:21:13: warning: no previous prototype for 'reserve_quick_kexec'
by kernel test robot 12 Sep '24

12 Sep '24

Hi Kefeng, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 7c98201b2598a42ac2ce6a9036ee4e4349a406ac commit: d61f4ca086e99bb481961b1120e10e7a4296c392 [5685/30000] arm64: quick_kexec: Move to stand-alone file config: arm64-randconfig-004-20240912 (https://download.01.org/0day-ci/archive/20240912/202409121642.JnGeDDHC-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240912/202409121642.JnGeDDHC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409121642.JnGeDDHC-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/arm64/mm/quick_kexec.c:21:13: warning: no previous prototype for 'reserve_quick_kexec' [-Wmissing-prototypes] 21 | void __init reserve_quick_kexec(void) | ^~~~~~~~~~~~~~~~~~~ >> arch/arm64/mm/quick_kexec.c:47:13: warning: no previous prototype for 'request_quick_kexec_res' [-Wmissing-prototypes] 47 | void __init request_quick_kexec_res(struct resource *res) | ^~~~~~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/reserve_quick_kexec +21 arch/arm64/mm/quick_kexec.c 20 > 21 void __init reserve_quick_kexec(void) 22 { 23 unsigned long long mem_start, mem_len; 24 25 mem_len = quick_kexec_res.end; 26 if (mem_len == 0) 27 return; 28 29 /* Current arm64 boot protocol requires 2MB alignment */ 30 mem_start = memblock_find_in_range(0, arm64_dma_phys_limit, 31 mem_len, SZ_2M); 32 if (mem_start == 0) { 33 pr_warn("cannot allocate quick kexec mem (size:0x%llx)\n", 34 mem_len); 35 quick_kexec_res.end = 0; 36 return; 37 } 38 39 memblock_reserve(mem_start, mem_len); 40 pr_info("quick kexec mem reserved: 0x%016llx - 0x%016llx (%lld MB)\n", 41 mem_start, mem_start + mem_len, mem_len >> 20); 42 43 quick_kexec_res.start = mem_start; 44 quick_kexec_res.end = mem_start + mem_len - 1; 45 } 46 > 47 void __init request_quick_kexec_res(struct resource *res) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] ipv6: prevent UAF in ip6_send_skb()
by Zhang Changzhong 12 Sep '24

12 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.225 commit cb5880a0de12c7f618d2bdd84e2d985f1e06ed7e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZH CVE: CVE-2024-44987 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit faa389b2fbaaec7fd27a390b4896139f9da662e3 ] syzbot reported an UAF in ip6_send_skb() [1] After ip6_local_out() has returned, we no longer can safely dereference rt, unless we hold rcu_read_lock(). A similar issue has been fixed in commit a688caa34beb ("ipv6: take rcu lock in rawv6_send_hdrinc()") Another potential issue in ip6_finish_output2() is handled in a separate patch. [1] BUG: KASAN: slab-use-after-free in ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 Read of size 8 at addr ffff88806dde4858 by task syz.1.380/6530 CPU: 1 UID: 0 PID: 6530 Comm: syz.1.380 Not tainted 6.11.0-rc3-syzkaller-00306-gdf6cbc62cc9b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588 rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 do_iter_readv_writev+0x60a/0x890 vfs_writev+0x37c/0xbb0 fs/read_write.c:971 do_writev+0x1b1/0x350 fs/read_write.c:1018 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f936bf79e79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f936cd7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007f936c115f80 RCX: 00007f936bf79e79 RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000004 RBP: 00007f936bfe7916 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f936c115f80 R15: 00007fff2860a7a8 </TASK> Allocated by task 6530: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3988 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4044 dst_alloc+0x12b/0x190 net/core/dst.c:89 ip6_blackhole_route+0x59/0x340 net/ipv6/route.c:2670 make_blackhole net/xfrm/xfrm_policy.c:3120 [inline] xfrm_lookup_route+0xd1/0x1c0 net/xfrm/xfrm_policy.c:3313 ip6_dst_lookup_flow+0x13e/0x180 net/ipv6/ip6_output.c:1257 rawv6_sendmsg+0x1283/0x23c0 net/ipv6/raw.c:898 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 45: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kmem_cache_free+0x145/0x350 mm/slub.c:4548 dst_destroy+0x2ac/0x460 net/core/dst.c:124 rcu_do_batch kernel/rcu/tree.c:2569 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2843 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541 __call_rcu_common kernel/rcu/tree.c:3106 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3210 refdst_drop include/net/dst.h:263 [inline] skb_dst_drop include/net/dst.h:275 [inline] nf_ct_frag6_queue net/ipv6/netfilter/nf_conntrack_reasm.c:306 [inline] nf_ct_frag6_gather+0xb9a/0x2080 net/ipv6/netfilter/nf_conntrack_reasm.c:485 ipv6_defrag+0x2c8/0x3c0 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:67 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] __ip6_local_out+0x6fa/0x800 net/ipv6/output_core.c:143 ip6_local_out+0x26/0x70 net/ipv6/output_core.c:153 ip6_send_skb+0x112/0x230 net/ipv6/ip6_output.c:1959 rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588 rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 do_iter_readv_writev+0x60a/0x890 Fixes: 0625491493d9 ("ipv6: ip6_push_pending_frames() should increment IPSTATS_MIB_OUTDISCARDS") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reported-by: syzbot <syzkaller(a)googlegroups.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20240820160859.3786976-2-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv6/ip6_output.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 6d9571cb..2c4dd72 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1953,6 +1953,7 @@ int ip6_send_skb(struct sk_buff *skb) struct rt6_info *rt = (struct rt6_info *)skb_dst(skb); int err; + rcu_read_lock(); err = ip6_local_out(net, skb->sk, skb); if (err) { if (err > 0) @@ -1962,6 +1963,7 @@ int ip6_send_skb(struct sk_buff *skb) IPSTATS_MIB_OUTDISCARDS); } + rcu_read_unlock(); return err; } -- 2.9.5

2 1

[PATCH OLK-6.6] ipv6: prevent UAF in ip6_send_skb()
by Zhang Changzhong 12 Sep '24

12 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.48 commit af1dde074ee2ed7dd5bdca4e7e8ba17f44e7b011 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZH CVE: CVE-2024-44987 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit faa389b2fbaaec7fd27a390b4896139f9da662e3 ] syzbot reported an UAF in ip6_send_skb() [1] After ip6_local_out() has returned, we no longer can safely dereference rt, unless we hold rcu_read_lock(). A similar issue has been fixed in commit a688caa34beb ("ipv6: take rcu lock in rawv6_send_hdrinc()") Another potential issue in ip6_finish_output2() is handled in a separate patch. [1] BUG: KASAN: slab-use-after-free in ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 Read of size 8 at addr ffff88806dde4858 by task syz.1.380/6530 CPU: 1 UID: 0 PID: 6530 Comm: syz.1.380 Not tainted 6.11.0-rc3-syzkaller-00306-gdf6cbc62cc9b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588 rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 do_iter_readv_writev+0x60a/0x890 vfs_writev+0x37c/0xbb0 fs/read_write.c:971 do_writev+0x1b1/0x350 fs/read_write.c:1018 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f936bf79e79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f936cd7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007f936c115f80 RCX: 00007f936bf79e79 RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000004 RBP: 00007f936bfe7916 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f936c115f80 R15: 00007fff2860a7a8 </TASK> Allocated by task 6530: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3988 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4044 dst_alloc+0x12b/0x190 net/core/dst.c:89 ip6_blackhole_route+0x59/0x340 net/ipv6/route.c:2670 make_blackhole net/xfrm/xfrm_policy.c:3120 [inline] xfrm_lookup_route+0xd1/0x1c0 net/xfrm/xfrm_policy.c:3313 ip6_dst_lookup_flow+0x13e/0x180 net/ipv6/ip6_output.c:1257 rawv6_sendmsg+0x1283/0x23c0 net/ipv6/raw.c:898 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 45: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kmem_cache_free+0x145/0x350 mm/slub.c:4548 dst_destroy+0x2ac/0x460 net/core/dst.c:124 rcu_do_batch kernel/rcu/tree.c:2569 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2843 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541 __call_rcu_common kernel/rcu/tree.c:3106 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3210 refdst_drop include/net/dst.h:263 [inline] skb_dst_drop include/net/dst.h:275 [inline] nf_ct_frag6_queue net/ipv6/netfilter/nf_conntrack_reasm.c:306 [inline] nf_ct_frag6_gather+0xb9a/0x2080 net/ipv6/netfilter/nf_conntrack_reasm.c:485 ipv6_defrag+0x2c8/0x3c0 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:67 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] __ip6_local_out+0x6fa/0x800 net/ipv6/output_core.c:143 ip6_local_out+0x26/0x70 net/ipv6/output_core.c:153 ip6_send_skb+0x112/0x230 net/ipv6/ip6_output.c:1959 rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588 rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 do_iter_readv_writev+0x60a/0x890 Fixes: 0625491493d9 ("ipv6: ip6_push_pending_frames() should increment IPSTATS_MIB_OUTDISCARDS") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reported-by: syzbot <syzkaller(a)googlegroups.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20240820160859.3786976-2-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv6/ip6_output.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index db8d0e1..8d4aaa4 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -2023,6 +2023,7 @@ int ip6_send_skb(struct sk_buff *skb) struct rt6_info *rt = (struct rt6_info *)skb_dst(skb); int err; + rcu_read_lock(); err = ip6_local_out(net, skb->sk, skb); if (err) { if (err > 0) @@ -2032,6 +2033,7 @@ int ip6_send_skb(struct sk_buff *skb) IPSTATS_MIB_OUTDISCARDS); } + rcu_read_unlock(); return err; } -- 2.9.5

2 1

[PATCH OLK-5.10] ipv6: prevent UAF in ip6_send_skb()
by Zhang Changzhong 12 Sep '24

12 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.225 commit cb5880a0de12c7f618d2bdd84e2d985f1e06ed7e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZH CVE: CVE-2024-44987 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit faa389b2fbaaec7fd27a390b4896139f9da662e3 ] syzbot reported an UAF in ip6_send_skb() [1] After ip6_local_out() has returned, we no longer can safely dereference rt, unless we hold rcu_read_lock(). A similar issue has been fixed in commit a688caa34beb ("ipv6: take rcu lock in rawv6_send_hdrinc()") Another potential issue in ip6_finish_output2() is handled in a separate patch. [1] BUG: KASAN: slab-use-after-free in ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 Read of size 8 at addr ffff88806dde4858 by task syz.1.380/6530 CPU: 1 UID: 0 PID: 6530 Comm: syz.1.380 Not tainted 6.11.0-rc3-syzkaller-00306-gdf6cbc62cc9b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588 rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 do_iter_readv_writev+0x60a/0x890 vfs_writev+0x37c/0xbb0 fs/read_write.c:971 do_writev+0x1b1/0x350 fs/read_write.c:1018 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f936bf79e79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f936cd7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007f936c115f80 RCX: 00007f936bf79e79 RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000004 RBP: 00007f936bfe7916 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f936c115f80 R15: 00007fff2860a7a8 </TASK> Allocated by task 6530: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3988 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4044 dst_alloc+0x12b/0x190 net/core/dst.c:89 ip6_blackhole_route+0x59/0x340 net/ipv6/route.c:2670 make_blackhole net/xfrm/xfrm_policy.c:3120 [inline] xfrm_lookup_route+0xd1/0x1c0 net/xfrm/xfrm_policy.c:3313 ip6_dst_lookup_flow+0x13e/0x180 net/ipv6/ip6_output.c:1257 rawv6_sendmsg+0x1283/0x23c0 net/ipv6/raw.c:898 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 45: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kmem_cache_free+0x145/0x350 mm/slub.c:4548 dst_destroy+0x2ac/0x460 net/core/dst.c:124 rcu_do_batch kernel/rcu/tree.c:2569 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2843 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541 __call_rcu_common kernel/rcu/tree.c:3106 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3210 refdst_drop include/net/dst.h:263 [inline] skb_dst_drop include/net/dst.h:275 [inline] nf_ct_frag6_queue net/ipv6/netfilter/nf_conntrack_reasm.c:306 [inline] nf_ct_frag6_gather+0xb9a/0x2080 net/ipv6/netfilter/nf_conntrack_reasm.c:485 ipv6_defrag+0x2c8/0x3c0 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:67 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] __ip6_local_out+0x6fa/0x800 net/ipv6/output_core.c:143 ip6_local_out+0x26/0x70 net/ipv6/output_core.c:153 ip6_send_skb+0x112/0x230 net/ipv6/ip6_output.c:1959 rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588 rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 do_iter_readv_writev+0x60a/0x890 Fixes: 0625491493d9 ("ipv6: ip6_push_pending_frames() should increment IPSTATS_MIB_OUTDISCARDS") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reported-by: syzbot <syzkaller(a)googlegroups.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20240820160859.3786976-2-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv6/ip6_output.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 6d9571cb..2c4dd72 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1953,6 +1953,7 @@ int ip6_send_skb(struct sk_buff *skb) struct rt6_info *rt = (struct rt6_info *)skb_dst(skb); int err; + rcu_read_lock(); err = ip6_local_out(net, skb->sk, skb); if (err) { if (err > 0) @@ -1962,6 +1963,7 @@ int ip6_send_skb(struct sk_buff *skb) IPSTATS_MIB_OUTDISCARDS); } + rcu_read_unlock(); return err; } -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS] ipv6: prevent UAF in ip6_send_skb()
by Zhang Changzhong 12 Sep '24

12 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.321 commit 571567e0277008459750f0728f246086b2659429 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZH CVE: CVE-2024-44987 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit faa389b2fbaaec7fd27a390b4896139f9da662e3 ] syzbot reported an UAF in ip6_send_skb() [1] After ip6_local_out() has returned, we no longer can safely dereference rt, unless we hold rcu_read_lock(). A similar issue has been fixed in commit a688caa34beb ("ipv6: take rcu lock in rawv6_send_hdrinc()") Another potential issue in ip6_finish_output2() is handled in a separate patch. [1] BUG: KASAN: slab-use-after-free in ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 Read of size 8 at addr ffff88806dde4858 by task syz.1.380/6530 CPU: 1 UID: 0 PID: 6530 Comm: syz.1.380 Not tainted 6.11.0-rc3-syzkaller-00306-gdf6cbc62cc9b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588 rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 do_iter_readv_writev+0x60a/0x890 vfs_writev+0x37c/0xbb0 fs/read_write.c:971 do_writev+0x1b1/0x350 fs/read_write.c:1018 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f936bf79e79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f936cd7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007f936c115f80 RCX: 00007f936bf79e79 RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000004 RBP: 00007f936bfe7916 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f936c115f80 R15: 00007fff2860a7a8 </TASK> Allocated by task 6530: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3988 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4044 dst_alloc+0x12b/0x190 net/core/dst.c:89 ip6_blackhole_route+0x59/0x340 net/ipv6/route.c:2670 make_blackhole net/xfrm/xfrm_policy.c:3120 [inline] xfrm_lookup_route+0xd1/0x1c0 net/xfrm/xfrm_policy.c:3313 ip6_dst_lookup_flow+0x13e/0x180 net/ipv6/ip6_output.c:1257 rawv6_sendmsg+0x1283/0x23c0 net/ipv6/raw.c:898 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 45: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kmem_cache_free+0x145/0x350 mm/slub.c:4548 dst_destroy+0x2ac/0x460 net/core/dst.c:124 rcu_do_batch kernel/rcu/tree.c:2569 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2843 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541 __call_rcu_common kernel/rcu/tree.c:3106 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3210 refdst_drop include/net/dst.h:263 [inline] skb_dst_drop include/net/dst.h:275 [inline] nf_ct_frag6_queue net/ipv6/netfilter/nf_conntrack_reasm.c:306 [inline] nf_ct_frag6_gather+0xb9a/0x2080 net/ipv6/netfilter/nf_conntrack_reasm.c:485 ipv6_defrag+0x2c8/0x3c0 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:67 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] __ip6_local_out+0x6fa/0x800 net/ipv6/output_core.c:143 ip6_local_out+0x26/0x70 net/ipv6/output_core.c:153 ip6_send_skb+0x112/0x230 net/ipv6/ip6_output.c:1959 rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588 rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 do_iter_readv_writev+0x60a/0x890 Fixes: 0625491493d9 ("ipv6: ip6_push_pending_frames() should increment IPSTATS_MIB_OUTDISCARDS") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reported-by: syzbot <syzkaller(a)googlegroups.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20240820160859.3786976-2-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv6/ip6_output.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 179fe59..972b7aa 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1758,6 +1758,7 @@ int ip6_send_skb(struct sk_buff *skb) struct rt6_info *rt = (struct rt6_info *)skb_dst(skb); int err; + rcu_read_lock(); err = ip6_local_out(net, skb->sk, skb); if (err) { if (err > 0) @@ -1767,6 +1768,7 @@ int ip6_send_skb(struct sk_buff *skb) IPSTATS_MIB_OUTDISCARDS); } + rcu_read_unlock(); return err; } -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] ipv6: fix possible UAF in ip6_finish_output2()
by Zhang Changzhong 12 Sep '24

12 Sep '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.11-rc5 commit da273b377ae0d9bd255281ed3c2adb228321687b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZO CVE: CVE-2024-44986 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to make sure the dst and associated idev are alive. Fixes: 5796015fa968 ("ipv6: allocate enough headroom in ip6_finish_output2()") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Vasily Averin <vasily.averin(a)linux.dev> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20240820160859.3786976-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/ip6_output.c [The conflict occurs because the commit e415ed3a4b8b ipv6: use skb_expand_head in ip6_finish_output2") is not merged] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv6/ip6_output.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index f0c94aa..8a36c16 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -81,6 +81,8 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * } skb = nskb; } + /* Make sure idev stays alive */ + rcu_read_lock(); if (skb && pskb_expand_head(skb, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) { kfree_skb(skb); @@ -88,8 +90,10 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * } if (!skb) { IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS); + rcu_read_unlock(); return -ENOMEM; } + rcu_read_unlock(); } if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) { -- 2.9.5

2 1

[PATCH OLK-6.6] ipv6: fix possible UAF in ip6_finish_output2()
by Zhang Changzhong 12 Sep '24

12 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.48 commit 6ab6bf731354a6fdbaa617d1ec194960db61cf3b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZO CVE: CVE-2024-44986 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit da273b377ae0d9bd255281ed3c2adb228321687b ] If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to make sure the dst and associated idev are alive. Fixes: 5796015fa968 ("ipv6: allocate enough headroom in ip6_finish_output2()") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Vasily Averin <vasily.averin(a)linux.dev> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20240820160859.3786976-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv6/ip6_output.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index db8d0e1..888b380 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -70,11 +70,15 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * /* Be paranoid, rather than too clever. */ if (unlikely(hh_len > skb_headroom(skb)) && dev->header_ops) { + /* Make sure idev stays alive */ + rcu_read_lock(); skb = skb_expand_head(skb, hh_len); if (!skb) { IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); + rcu_read_unlock(); return -ENOMEM; } + rcu_read_unlock(); } hdr = ipv6_hdr(skb); -- 2.9.5

2 1

[PATCH OLK-5.10] ipv6: fix possible UAF in ip6_finish_output2()
by Zhang Changzhong 12 Sep '24

12 Sep '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.11-rc5 commit da273b377ae0d9bd255281ed3c2adb228321687b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZO CVE: CVE-2024-44986 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to make sure the dst and associated idev are alive. Fixes: 5796015fa968 ("ipv6: allocate enough headroom in ip6_finish_output2()") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Vasily Averin <vasily.averin(a)linux.dev> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20240820160859.3786976-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/ip6_output.c [The conflict occurs because the commit e415ed3a4b8b ipv6: use skb_expand_head in ip6_finish_output2") is not merged] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv6/ip6_output.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 6d9571cb..153e906 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -81,6 +81,8 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * } skb = nskb; } + /* Make sure idev stays alive */ + rcu_read_lock(); if (skb && pskb_expand_head(skb, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) { kfree_skb(skb); @@ -88,8 +90,10 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * } if (!skb) { IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS); + rcu_read_unlock(); return -ENOMEM; } + rcu_read_unlock(); } if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) { -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] fix CVE-2024-44988
by Zhang Changzhong 12 Sep '24

12 Sep '24

fix CVE-2024-44988 Hans J. Schultz (1): net: dsa: mv88e6xxx: read FID when handling ATU violations Joseph Huang (1): net: dsa: mv88e6xxx: Fix out-of-bound access Vladimir Oltean (1): net: dsa: mv88e6xxx: replace ATU violation prints with trace points drivers/net/dsa/mv88e6xxx/Makefile | 4 ++ drivers/net/dsa/mv88e6xxx/global1_atu.c | 82 +++++++++++++++++++++++++++------ drivers/net/dsa/mv88e6xxx/trace.c | 6 +++ drivers/net/dsa/mv88e6xxx/trace.h | 66 ++++++++++++++++++++++++++ 4 files changed, 143 insertions(+), 15 deletions(-) create mode 100644 drivers/net/dsa/mv88e6xxx/trace.c create mode 100644 drivers/net/dsa/mv88e6xxx/trace.h -- 2.9.5

2 4

[PATCH OLK-6.6] net: dsa: mv88e6xxx: Fix out-of-bound access
by Zhang Changzhong 12 Sep '24

12 Sep '24

From: Joseph Huang <Joseph.Huang(a)garmin.com> stable inclusion from stable-v6.6.48 commit f7d8c2fabd39250cf2333fbf8eef67e837f90a5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZQ CVE: CVE-2024-44988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 528876d867a23b5198022baf2e388052ca67c952 ] If an ATU violation was caused by a CPU Load operation, the SPID could be larger than DSA_MAX_PORTS (the size of mv88e6xxx_chip.ports[] array). Fixes: 75c05a74e745 ("net: dsa: mv88e6xxx: Fix counting of ATU violations") Signed-off-by: Joseph Huang <Joseph.Huang(a)garmin.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://patch.msgid.link/20240819235251.1331763-1-Joseph.Huang@garmin.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/dsa/mv88e6xxx/global1_atu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/dsa/mv88e6xxx/global1_atu.c b/drivers/net/dsa/mv88e6xxx/global1_atu.c index ce3b369..c47f068 100644 --- a/drivers/net/dsa/mv88e6xxx/global1_atu.c +++ b/drivers/net/dsa/mv88e6xxx/global1_atu.c @@ -457,7 +457,8 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id) trace_mv88e6xxx_atu_full_violation(chip->dev, spid, entry.portvec, entry.mac, fid); - chip->ports[spid].atu_full_violation++; + if (spid < ARRAY_SIZE(chip->ports)) + chip->ports[spid].atu_full_violation++; } return IRQ_HANDLED; -- 2.9.5

2 1

[PATCH OLK-5.10 0/3] fix CVE-2024-44988
by Zhang Changzhong 12 Sep '24

12 Sep '24

fix CVE-2024-44988 Hans J. Schultz (1): net: dsa: mv88e6xxx: read FID when handling ATU violations Joseph Huang (1): net: dsa: mv88e6xxx: Fix out-of-bound access Vladimir Oltean (1): net: dsa: mv88e6xxx: replace ATU violation prints with trace points drivers/net/dsa/mv88e6xxx/Makefile | 4 ++ drivers/net/dsa/mv88e6xxx/global1_atu.c | 82 +++++++++++++++++++++++++++------ drivers/net/dsa/mv88e6xxx/trace.c | 6 +++ drivers/net/dsa/mv88e6xxx/trace.h | 66 ++++++++++++++++++++++++++ 4 files changed, 143 insertions(+), 15 deletions(-) create mode 100644 drivers/net/dsa/mv88e6xxx/trace.c create mode 100644 drivers/net/dsa/mv88e6xxx/trace.h -- 2.9.5

2 4

[PATCH OLK-6.6] ipv6: prevent possible UAF in ip6_xmit()
by Zhang Changzhong 12 Sep '24

12 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.48 commit 124b428fe28064c809e4237b0b38e97200a8a4a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZA CVE: CVE-2024-44985 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 2d5ff7e339d04622d8282661df36151906d0e1c7 ] If skb_expand_head() returns NULL, skb has been freed and the associated dst/idev could also have been freed. We must use rcu_read_lock() to prevent a possible UAF. Fixes: 0c9f227bee11 ("ipv6: use skb_expand_head in ip6_xmit") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Vasily Averin <vasily.averin(a)linux.dev> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20240820160859.3786976-4-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv6/ip6_output.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index db8d0e1..290ca82 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -277,11 +277,15 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, head_room += opt->opt_nflen + opt->opt_flen; if (unlikely(head_room > skb_headroom(skb))) { + /* Make sure idev stays alive */ + rcu_read_lock(); skb = skb_expand_head(skb, head_room); if (!skb) { IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); + rcu_read_unlock(); return -ENOBUFS; } + rcu_read_unlock(); } if (opt) { -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS] x86/mtrr: Check if fixed MTRRs exist before saving them
by Zeng Heng 12 Sep '24

12 Sep '24

From: Andi Kleen <ak(a)linux.intel.com> stable inclusion from stable-v4.19.320 commit 34f36e6ee5bd7eff8b2adcd9fcaef369f752d82e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYQ CVE: CVE-2024-44948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 919f18f961c03d6694aa726c514184f2311a4614 upstream. MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the MTRR capability MSR. So far all x86 CPUs which support MTRR have this separate bit set, so it went unnoticed that mtrr_save_state() does not check the capability bit before accessing the fixed MTRR MSRs. Though on a CPU that does not support the fixed MTRR capability this results in a #GP. The #GP itself is harmless because the RDMSR fault is handled gracefully, but results in a WARN_ON(). Add the missing capability check to prevent this. Fixes: 2b1f6278d77c ("[PATCH] x86: Save the MTRRs of the BSP before booting an AP") Signed-off-by: Andi Kleen <ak(a)linux.intel.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20240808000244.946864-1-ak@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/x86/kernel/cpu/mtrr/mtrr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/mtrr/mtrr.c b/arch/x86/kernel/cpu/mtrr/mtrr.c index 507039c20128..93ed6d3bf300 100644 --- a/arch/x86/kernel/cpu/mtrr/mtrr.c +++ b/arch/x86/kernel/cpu/mtrr/mtrr.c @@ -819,7 +819,7 @@ void mtrr_save_state(void) { int first_cpu; - if (!mtrr_enabled()) + if (!mtrr_enabled() || !mtrr_state.have_fixed) return; first_cpu = cpumask_first(cpu_online_mask); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] x86/mtrr: Check if fixed MTRRs exist before saving them
by Zeng Heng 12 Sep '24

12 Sep '24

From: Andi Kleen <ak(a)linux.intel.com> stable inclusion from stable-v5.10.224 commit 450b6b22acdaac67a18eaf5ed498421ffcf10051 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYQ CVE: CVE-2024-44948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 919f18f961c03d6694aa726c514184f2311a4614 upstream. MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the MTRR capability MSR. So far all x86 CPUs which support MTRR have this separate bit set, so it went unnoticed that mtrr_save_state() does not check the capability bit before accessing the fixed MTRR MSRs. Though on a CPU that does not support the fixed MTRR capability this results in a #GP. The #GP itself is harmless because the RDMSR fault is handled gracefully, but results in a WARN_ON(). Add the missing capability check to prevent this. Fixes: 2b1f6278d77c ("[PATCH] x86: Save the MTRRs of the BSP before booting an AP") Signed-off-by: Andi Kleen <ak(a)linux.intel.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20240808000244.946864-1-ak@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/x86/kernel/cpu/mtrr/mtrr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/mtrr/mtrr.c b/arch/x86/kernel/cpu/mtrr/mtrr.c index 5f436cb4f7c4..9d5313118660 100644 --- a/arch/x86/kernel/cpu/mtrr/mtrr.c +++ b/arch/x86/kernel/cpu/mtrr/mtrr.c @@ -817,7 +817,7 @@ void mtrr_save_state(void) { int first_cpu; - if (!mtrr_enabled()) + if (!mtrr_enabled() || !mtrr_state.have_fixed) return; first_cpu = cpumask_first(cpu_online_mask); -- 2.25.1

2 1

[PATCH OLK-5.10] x86/mtrr: Check if fixed MTRRs exist before saving them
by Zeng Heng 12 Sep '24

12 Sep '24

From: Andi Kleen <ak(a)linux.intel.com> stable inclusion from stable-v5.10.224 commit 450b6b22acdaac67a18eaf5ed498421ffcf10051 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYQ CVE: CVE-2024-44948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 919f18f961c03d6694aa726c514184f2311a4614 upstream. MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the MTRR capability MSR. So far all x86 CPUs which support MTRR have this separate bit set, so it went unnoticed that mtrr_save_state() does not check the capability bit before accessing the fixed MTRR MSRs. Though on a CPU that does not support the fixed MTRR capability this results in a #GP. The #GP itself is harmless because the RDMSR fault is handled gracefully, but results in a WARN_ON(). Add the missing capability check to prevent this. Fixes: 2b1f6278d77c ("[PATCH] x86: Save the MTRRs of the BSP before booting an AP") Signed-off-by: Andi Kleen <ak(a)linux.intel.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20240808000244.946864-1-ak@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/x86/kernel/cpu/mtrr/mtrr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/mtrr/mtrr.c b/arch/x86/kernel/cpu/mtrr/mtrr.c index 5f436cb4f7c4..9d5313118660 100644 --- a/arch/x86/kernel/cpu/mtrr/mtrr.c +++ b/arch/x86/kernel/cpu/mtrr/mtrr.c @@ -817,7 +817,7 @@ void mtrr_save_state(void) { int first_cpu; - if (!mtrr_enabled()) + if (!mtrr_enabled() || !mtrr_state.have_fixed) return; first_cpu = cpumask_first(cpu_online_mask); -- 2.25.1

2 1

[openeuler:OLK-5.10 5544/30000] include/trace/trace_events.h:27:23: warning: 'str__bonding__trace_system_name' defined but not used
by kernel test robot 12 Sep '24

12 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 7c98201b2598a42ac2ce6a9036ee4e4349a406ac commit: b88ceab57674d2035d500a42901eb2e603e8f00c [5544/30000] drivers: hooks: add bonding driver vendor hooks config: arm64-randconfig-004-20240912 (https://download.01.org/0day-ci/archive/20240912/202409121219.ZxGnKcyP-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240912/202409121219.ZxGnKcyP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409121219.ZxGnKcyP-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/trace/define_trace.h:102, from include/trace/hooks/bonding.h:27, from drivers/hooks/vendor_hooks.c:11: >> include/trace/trace_events.h:27:23: warning: 'str__bonding__trace_system_name' defined but not used [-Wunused-const-variable=] 27 | #define __app__(x, y) str__##x##y | ^~~~~ include/trace/trace_events.h:28:21: note: in expansion of macro '__app__' 28 | #define __app(x, y) __app__(x, y) | ^~~~~~~ include/trace/trace_events.h:30:29: note: in expansion of macro '__app' 30 | #define TRACE_SYSTEM_STRING __app(TRACE_SYSTEM_VAR,__trace_system_name) | ^~~~~ include/trace/trace_events.h:33:27: note: in expansion of macro 'TRACE_SYSTEM_STRING' 33 | static const char TRACE_SYSTEM_STRING[] = \ | ^~~~~~~~~~~~~~~~~~~ include/trace/trace_events.h:36:1: note: in expansion of macro 'TRACE_MAKE_SYSTEM_STR' 36 | TRACE_MAKE_SYSTEM_STR(); | ^~~~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/str__bonding__trace_system_name +27 include/trace/trace_events.h acd388fd3af350 include/trace/ftrace.h Steven Rostedt (Red Hat 2015-03-31 26) acd388fd3af350 include/trace/ftrace.h Steven Rostedt (Red Hat 2015-03-31 @27) #define __app__(x, y) str__##x##y acd388fd3af350 include/trace/ftrace.h Steven Rostedt (Red Hat 2015-03-31 28) #define __app(x, y) __app__(x, y) acd388fd3af350 include/trace/ftrace.h Steven Rostedt (Red Hat 2015-03-31 29) :::::: The code at line 27 was first introduced by commit :::::: acd388fd3af350ab24c6ab6f19b83fc4a4f3aa60 tracing: Give system name a pointer :::::: TO: Steven Rostedt (Red Hat) <rostedt(a)goodmis.org> :::::: CC: Steven Rostedt <rostedt(a)goodmis.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 26967/30000] arch/x86/kvm/x86.c:893:6: sparse: sparse: symbol 'kvm_post_set_cr0' was not declared. Should it be static?
by kernel test robot 12 Sep '24

12 Sep '24

Hi Yu, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 7c98201b2598a42ac2ce6a9036ee4e4349a406ac commit: 1686d271f795f8756b49151978b95b095c0598ad [26967/30000] KVM: x86: Introduce kvm_post_set_cr0 to post handle the CR0 emulation config: x86_64-randconfig-123-20240910 (https://download.01.org/0day-ci/archive/20240912/202409121221.f86WxXWu-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240912/202409121221.f86WxXWu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409121221.f86WxXWu-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/x86/kvm/x86.c:893:6: sparse: sparse: symbol 'kvm_post_set_cr0' was not declared. Should it be static? arch/x86/kvm/x86.c:3044:38: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] __user * @@ got unsigned char [usertype] * @@ arch/x86/kvm/x86.c:3044:38: sparse: expected void const [noderef] __user * arch/x86/kvm/x86.c:3044:38: sparse: got unsigned char [usertype] * arch/x86/kvm/x86.c:8608:15: sparse: sparse: incompatible types in comparison expression (different address spaces): arch/x86/kvm/x86.c:8608:15: sparse: struct kvm_apic_map [noderef] __rcu * arch/x86/kvm/x86.c:8608:15: sparse: struct kvm_apic_map * arch/x86/kvm/x86.c:11008:32: sparse: sparse: Using plain integer as NULL pointer arch/x86/kvm/x86.c:11061:16: sparse: sparse: incompatible types in comparison expression (different address spaces): arch/x86/kvm/x86.c:11061:16: sparse: struct kvm_apic_map [noderef] __rcu * arch/x86/kvm/x86.c:11061:16: sparse: struct kvm_apic_map * arch/x86/kvm/x86.c:11062:15: sparse: sparse: incompatible types in comparison expression (different address spaces): arch/x86/kvm/x86.c:11062:15: sparse: struct kvm_pmu_event_filter [noderef] __rcu * arch/x86/kvm/x86.c:11062:15: sparse: struct kvm_pmu_event_filter * arch/x86/kvm/x86.c:4134:42: sparse: sparse: self-comparison always evaluates to false arch/x86/kvm/x86.c: note: in included file (through include/linux/notifier.h, arch/x86/include/asm/uprobes.h, include/linux/uprobes.h, ...): include/linux/srcu.h:182:9: sparse: sparse: context imbalance in 'vcpu_enter_guest' - unexpected unlock vim +/kvm_post_set_cr0 +893 arch/x86/kvm/x86.c 892 > 893 void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) 894 { 895 unsigned long update_bits = X86_CR0_PG | X86_CR0_WP; 896 897 if ((cr0 ^ old_cr0) & X86_CR0_PG) { 898 kvm_clear_async_pf_completion_queue(vcpu); 899 kvm_async_pf_hash_reset(vcpu); 900 } 901 902 if ((cr0 ^ old_cr0) & update_bits) 903 kvm_mmu_reset_context(vcpu); 904 905 if (((cr0 ^ old_cr0) & X86_CR0_CD) && 906 kvm_arch_has_noncoherent_dma(vcpu->kvm) && 907 !kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED)) 908 kvm_zap_gfn_range(vcpu->kvm, 0, ~0ULL); 909 } 910 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] mm: backing-dev: set variables dev_attr_min,max_bytes storage-class-specifier to static
by Yifan Qiao 12 Sep '24

12 Sep '24

From: Tom Rix <trix(a)redhat.com> mainline inclusion from mainline-v6.4-rc1 commit f6365881bf797c734bf4cf1353bfa59ffd444f8f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAN96I Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- smatch reports mm/backing-dev.c:266:1: warning: symbol 'dev_attr_min_bytes' was not declared. Should it be static? mm/backing-dev.c:294:1: warning: symbol 'dev_attr_max_bytes' was not declared. Should it be static? These variables are only used in one file so should be static. Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202409120633.GHlgrbZp-lkp@intel.com/ Link: https://lkml.kernel.org/r/20230408141609.2703647-1-trix@redhat.com Signed-off-by: Tom Rix <trix(a)redhat.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- mm/backing-dev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/backing-dev.c b/mm/backing-dev.c index 6e9162004a91..9b1f1141407b 100644 --- a/mm/backing-dev.c +++ b/mm/backing-dev.c @@ -261,7 +261,7 @@ static ssize_t min_bytes_store(struct device *dev, return ret; } -DEVICE_ATTR_RW(min_bytes); +static DEVICE_ATTR_RW(min_bytes); static ssize_t max_bytes_show(struct device *dev, struct device_attribute *attr, @@ -289,7 +289,7 @@ static ssize_t max_bytes_store(struct device *dev, return ret; } -DEVICE_ATTR_RW(max_bytes); +static DEVICE_ATTR_RW(max_bytes); static ssize_t stable_pages_required_show(struct device *dev, struct device_attribute *attr, -- 2.39.2

2 1

[PATCH OLK-6.6] sched/core: Fix unbalance set_rq_online/offline() in sched_cpu_deactivate()
by He Yujie 12 Sep '24

12 Sep '24

From: Yang Yingliang <yangyingliang(a)huawei.com> mainline inclusion from mainline-v6.11-rc2 commit fe7a11c78d2a9bdb8b50afc278a31ac177000948 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQQQ1 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If cpuset_cpu_inactive() fails, set_rq_online() need be called to rollback. Fixes: 120455c514f7 ("sched: Fix hotplug vs CPU bandwidth control") Cc: stable(a)kernel.org Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lore.kernel.org/r/20240703031610.587047-5-yangyingliang@huaweicloud… Conflicts: kernel/sched/core.c [conflict because of mainline commit e22f910a26cc2a3ac9c66b8e935ef2a7dd881117 ("sched/smt: Fix unbalance sched_smt_present dec/inc") not merged yet] Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- kernel/sched/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 7dd2415d90b6..63f7a0daa709 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -9816,6 +9816,7 @@ int sched_cpu_deactivate(unsigned int cpu) sched_update_numa(cpu, false); ret = cpuset_cpu_inactive(cpu); if (ret) { + sched_set_rq_online(rq, cpu); balance_push_set(cpu, false); set_cpu_active(cpu, true); sched_update_numa(cpu, true); -- 2.34.1

2 1

[openeuler:OLK-5.10 29933/30000] mm/backing-dev.c:226:1: sparse: sparse: symbol 'dev_attr_min_bytes' was not declared. Should it be static?
by kernel test robot 12 Sep '24

12 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e23f76121de26a57b9f398c8b1ce5405a88acd8a commit: 9d961dd8f6989bee222015da75553f9800b46714 [29933/30000] mm: add /sys/class/bdi/<bdi>/min_bytes knob config: x86_64-randconfig-123-20240910 (https://download.01.org/0day-ci/archive/20240912/202409120855.xGnhP78f-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240912/202409120855.xGnhP78f-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409120855.xGnhP78f-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/backing-dev.c:226:1: sparse: sparse: symbol 'dev_attr_min_bytes' was not declared. Should it be static? mm/backing-dev.c:254:1: sparse: sparse: symbol 'dev_attr_max_bytes' was not declared. Should it be static? vim +/dev_attr_min_bytes +226 mm/backing-dev.c 208 209 static ssize_t min_bytes_store(struct device *dev, 210 struct device_attribute *attr, const char *buf, size_t count) 211 { 212 struct backing_dev_info *bdi = dev_get_drvdata(dev); 213 u64 bytes; 214 ssize_t ret; 215 216 ret = kstrtoull(buf, 10, &bytes); 217 if (ret < 0) 218 return ret; 219 220 ret = bdi_set_min_bytes(bdi, bytes); 221 if (!ret) 222 ret = count; 223 224 return ret; 225 } > 226 DEVICE_ATTR_RW(min_bytes); 227 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29992/30000] drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5484:43: warning: implicit conversion from 'enum hclge_ext_opcode_type' to 'enum hclge_opcode_type'
by kernel test robot 12 Sep '24

12 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e23f76121de26a57b9f398c8b1ce5405a88acd8a commit: 5008e61d36701b7908e5edae1dee581a40af6312 [29992/30000] net: hns3:support enable or disable pfc strom prevent config: arm64-defconfig (https://download.01.org/0day-ci/archive/20240912/202409120826.KCXBqer1-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240912/202409120826.KCXBqer1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409120826.KCXBqer1-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_event': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:4562:46: warning: implicit conversion from 'enum hnae3_reset_type' to 'enum hnae3_event_type_custom' [-Wenum-conversion] 4562 | ret = hclge_ext_call_event(hdev, hdev->reset_level); | ~~~~^~~~~~~~~~~~~ In file included from drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:23: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_get_pfc_storm_prevent': >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5484:43: warning: implicit conversion from 'enum hclge_ext_opcode_type' to 'enum hclge_opcode_type' [-Wenum-conversion] 5484 | hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CFG_PAUSE_STORM_PARA, true); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h:24:47: note: in definition of macro 'hclge_cmd_setup_basic_desc' 24 | hclge_comm_cmd_setup_basic_desc(desc, opcode, is_read) | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_enable_pfc_storm_prevent': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5525:43: warning: implicit conversion from 'enum hclge_ext_opcode_type' to 'enum hclge_opcode_type' [-Wenum-conversion] 5525 | hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CFG_PAUSE_STORM_PARA, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h:24:47: note: in definition of macro 'hclge_cmd_setup_basic_desc' 24 | hclge_comm_cmd_setup_basic_desc(desc, opcode, is_read) | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_set_vport_mtu': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:11407:30: warning: unused variable 'ae_dev' [-Wunused-variable] 11407 | struct hnae3_ae_dev *ae_dev = pci_get_drvdata(vport->nic.pdev); | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_get_strings': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:634:50: warning: '%s' directive output may be truncated writing up to 4895 bytes into a region of size 32 [-Wformat-truncation=] 634 | snprintf(buff, ETH_GSTRING_LEN, "%s", strs[i].desc); | ^~ In function 'hclge_comm_get_strings', inlined from 'hclge_get_strings' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:750:7: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:634:17: note: 'snprintf' output between 1 and 4896 bytes into a destination of size 32 634 | snprintf(buff, ETH_GSTRING_LEN, "%s", strs[i].desc); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +5484 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c 5476 5477 static int 5478 hclge_get_pfc_storm_prevent(struct hclge_dev *hdev, int dir, bool *enable) 5479 { 5480 struct hclge_pfc_storm_para_cmd *para_cmd; 5481 struct hclge_desc desc; 5482 int ret; 5483 > 5484 hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CFG_PAUSE_STORM_PARA, true); 5485 para_cmd = (struct hclge_pfc_storm_para_cmd *)desc.data; 5486 para_cmd->dir = cpu_to_le32(dir); 5487 ret = hclge_cmd_send(&hdev->hw, &desc, 1); 5488 if (ret) 5489 return ret; 5490 5491 *enable = !!le32_to_cpu(para_cmd->enable); 5492 return 0; 5493 } 5494 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION e23f76121de26a57b9f398c8b1ce5405a88acd8a
by kernel test robot 12 Sep '24

12 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: e23f76121de26a57b9f398c8b1ce5405a88acd8a !11479 【OLK 5.10】some bugfixes for hns3 driver Error/Warning: (recently discovered and may have been fixed) https://lore.kernel.org/oe-kbuild-all/202409112326.lXc9OUWp-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409120147.RVcM1s31-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409120353.B8gNzHgp-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409120441.dVS6opjE-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409120633.GHlgrbZp-lkp@intel.com arch/arm64/kernel/vdso-ilp32/../vdso/vgettimeofday.c:15:5: warning: no previous prototype for '__kernel_gettimeofday' [-Wmissing-prototypes] arch/arm64/kernel/vdso-ilp32/../vdso/vgettimeofday.c:21:5: warning: no previous prototype for '__kernel_clock_getres' [-Wmissing-prototypes] arch/arm64/kernel/vdso-ilp32/../vdso/vgettimeofday.c:9:5: warning: no previous prototype for '__kernel_clock_gettime' [-Wmissing-prototypes] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration |-- arm64-defconfig | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_supports_pmu | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_supports_sve | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-hclge_mbx_set_vf_multi_tc | `-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-hclge_tm_vf_tc_dwrr_cfg |-- arm64-randconfig-004-20240912 | |-- arch-arm64-kernel-vdso-ilp32-..-vdso-vgettimeofday.c:warning:no-previous-prototype-for-__kernel_clock_getres | |-- arch-arm64-kernel-vdso-ilp32-..-vdso-vgettimeofday.c:warning:no-previous-prototype-for-__kernel_clock_gettime | |-- arch-arm64-kernel-vdso-ilp32-..-vdso-vgettimeofday.c:warning:no-previous-prototype-for-__kernel_gettimeofday | |-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-mcp251xfd_tx_obj_write_sync | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-ctx-not-described-in-ubcore_update_uvs_eid_ret | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-dev-not-described-in-ubcore_asyn_send_fe2tpf_msg | `-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-req-not-described-in-ubcore_asyn_send_fe2tpf_msg |-- x86_64-allnoconfig | |-- drivers-misc-sdma-dae-sdma_cdev.c:linux-version.h-not-needed. | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-allyesconfig | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | |-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-function-mcp251xfd_tx_obj_write_sync | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_mbx_set_vf_multi_tc | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_tm_vf_tc_dwrr_cfg | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:variable-err-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-direction-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-queue-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-direction-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-queue-description-in-rnpvf_set_ring_vector | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_CTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_dispatch_event | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_net_exit | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-ctx-not-described-in-ubcore_update_uvs_eid_ret | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-dev-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-req-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-function-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-function-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TPG-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-function-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-function-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_UTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-function-ubcore_hash_table_rmv_vtpn | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_get_umap_ops | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_umap_priv_init | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_unmap_vma_pages | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-001-20240912 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-002-20240912 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-003-20240912 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-004-20240912 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-005-20240912 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | |-- drivers-usb-dwc2-core_intr.c:error:struct-dwc2_hsotg-has-no-member-named-bus_suspended | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-006-20240912 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE | |-- drivers-usb-dwc2-core_intr.c:error:no-member-named-bus_suspended-in-struct-dwc2_hsotg | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-defconfig | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-001-20240912 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-usb-dwc2-core_intr.c:error:no-member-named-bus_suspended-in-struct-dwc2_hsotg | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-002-20240912 | |-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-function-mcp251xfd_tx_obj_write_sync | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-003-20240912 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-004-20240912 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-005-20240912 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-006-20240912 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-011-20240912 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-012-20240912 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-013-20240912 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-014-20240912 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-123-20240910 | |-- arch-x86-kernel-alternative.c:sparse:sparse:symbol-x86nops-was-not-declared.-Should-it-be-static | |-- arch-x86-kernel-cpu-common.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-__percpu-got-unsigned-short | |-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-sched_domain-assigned-top-got-struct-sched_domain-noderef-__rcu-parent | |-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-sched_domain-top_p-got-struct-sched_domain-noderef-__rcu-parent | |-- kernel-sys_ni.c:sparse:sparse:symbol-__ia32_sys_set_mempolicy_home_node-was-not-declared.-Should-it-be-static | |-- kernel-sys_ni.c:sparse:sparse:symbol-__x64_sys_set_mempolicy_home_node-was-not-declared.-Should-it-be-static | `-- mm-backing-dev.c:sparse:sparse:symbol-dev_attr_max_bytes-was-not-declared.-Should-it-be-static `-- x86_64-rhel-8.3-rust |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register elapsed time: 729m configs tested: 27 configs skipped: 122 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240912 clang-20 arm64 randconfig-002-20240912 clang-20 arm64 randconfig-003-20240912 gcc-14.1.0 arm64 randconfig-004-20240912 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240912 clang-18 x86_64 buildonly-randconfig-002-20240912 clang-18 x86_64 buildonly-randconfig-003-20240912 clang-18 x86_64 buildonly-randconfig-004-20240912 clang-18 x86_64 buildonly-randconfig-005-20240912 gcc-12 x86_64 buildonly-randconfig-006-20240912 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240912 clang-18 x86_64 randconfig-002-20240912 clang-18 x86_64 randconfig-003-20240912 clang-18 x86_64 randconfig-004-20240912 clang-18 x86_64 randconfig-005-20240912 gcc-12 x86_64 randconfig-006-20240912 gcc-12 x86_64 randconfig-011-20240912 clang-18 x86_64 randconfig-012-20240912 clang-18 x86_64 randconfig-013-20240912 gcc-12 x86_64 randconfig-014-20240912 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29928/30000] mm/backing-dev.c:226:1: sparse: sparse: symbol 'dev_attr_max_bytes' was not declared. Should it be static?
by kernel test robot 12 Sep '24

12 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e23f76121de26a57b9f398c8b1ce5405a88acd8a commit: 5796e536bbd9187296ded6d4d1cb3152113c6e85 [29928/30000] mm: add knob /sys/class/bdi/<bdi>/max_bytes config: x86_64-randconfig-123-20240910 (https://download.01.org/0day-ci/archive/20240912/202409120633.GHlgrbZp-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240912/202409120633.GHlgrbZp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409120633.GHlgrbZp-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/backing-dev.c:226:1: sparse: sparse: symbol 'dev_attr_max_bytes' was not declared. Should it be static? vim +/dev_attr_max_bytes +226 mm/backing-dev.c 208 209 static ssize_t max_bytes_store(struct device *dev, 210 struct device_attribute *attr, const char *buf, size_t count) 211 { 212 struct backing_dev_info *bdi = dev_get_drvdata(dev); 213 u64 bytes; 214 ssize_t ret; 215 216 ret = kstrtoull(buf, 10, &bytes); 217 if (ret < 0) 218 return ret; 219 220 ret = bdi_set_max_bytes(bdi, bytes); 221 if (!ret) 222 ret = count; 223 224 return ret; 225 } > 226 DEVICE_ATTR_RW(max_bytes); 227 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 24990/30000] arch/x86/kernel/alternative.c:78:21: sparse: sparse: symbol 'x86nops' was not declared. Should it be static?
by kernel test robot 12 Sep '24

12 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e23f76121de26a57b9f398c8b1ce5405a88acd8a commit: 8243b036681b074fab34e18024d1ee24c656b432 [24990/30000] x86: Remove dynamic NOP selection config: x86_64-randconfig-123-20240910 (https://download.01.org/0day-ci/archive/20240912/202409120441.dVS6opjE-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240912/202409120441.dVS6opjE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409120441.dVS6opjE-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/x86/kernel/alternative.c:78:21: sparse: sparse: symbol 'x86nops' was not declared. Should it be static? vim +/x86nops +78 arch/x86/kernel/alternative.c 77 > 78 const unsigned char x86nops[] = 79 { 80 BYTES_NOP1, 81 BYTES_NOP2, 82 BYTES_NOP3, 83 BYTES_NOP4, 84 BYTES_NOP5, 85 BYTES_NOP6, 86 BYTES_NOP7, 87 BYTES_NOP8, 88 }; 89 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 63fb41399626bd7c0b102eec56b5790ef3909db6
by kernel test robot 12 Sep '24

12 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 63fb41399626bd7c0b102eec56b5790ef3909db6 !5453 Add GM Driver Support for Hygon platform（Cryptographic Coprocessor，OLK-6.6) Error/Warning: (recently discovered and may have been fixed) https://lore.kernel.org/oe-kbuild-all/202409111619.Ho8mrUHm-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409120059.aFjFwIVD-lkp@intel.com drivers/crypto/ccp/hygon/hct.c:1730:45: error: no member named 'numa_node' in 'struct device' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kernel-virtcca_cvm_host.c:warning:no-previous-prototype-for-function-is_virtcca_cvm_enable | |-- arch-arm64-kvm-tmi.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs | |-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:no-previous-prototype-for-function-virtcca_smmu_evtq_thread | `-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:no-previous-prototype-for-function-virtcca_smmu_gerror_handler |-- arm64-allnoconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-defconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-001-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-002-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-003-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-004-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-allmodconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-allnoconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-defconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-randconfig-001-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-randconfig-002-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-randconfig-r061-20240911 | `-- arch-loongarch-kernel-legacy_boot.c:WARNING-A-A-B-is-equivalent-to-A-B |-- x86_64-allyesconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-002-20240911 | |-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs | `-- drivers-crypto-ccp-hygon-hct.c:error:no-member-named-numa_node-in-struct-device |-- x86_64-buildonly-randconfig-004-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-defconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-003-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-006-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-011-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-012-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-071-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-075-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-076-20240911 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | `-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier `-- x86_64-rhel-8.3-rust `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs elapsed time: 736m configs tested: 40 configs skipped: 134 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240911 clang-20 arm64 randconfig-002-20240911 clang-15 arm64 randconfig-003-20240911 clang-20 arm64 randconfig-004-20240911 clang-15 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch defconfig gcc-14.1.0 loongarch randconfig-001-20240911 gcc-14.1.0 loongarch randconfig-002-20240911 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240911 clang-18 x86_64 buildonly-randconfig-002-20240911 clang-18 x86_64 buildonly-randconfig-003-20240911 gcc-12 x86_64 buildonly-randconfig-004-20240911 gcc-12 x86_64 buildonly-randconfig-005-20240911 gcc-12 x86_64 buildonly-randconfig-006-20240911 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240911 gcc-12 x86_64 randconfig-002-20240911 gcc-12 x86_64 randconfig-003-20240911 clang-18 x86_64 randconfig-004-20240911 clang-18 x86_64 randconfig-005-20240911 clang-18 x86_64 randconfig-006-20240911 gcc-12 x86_64 randconfig-011-20240911 clang-18 x86_64 randconfig-012-20240911 clang-18 x86_64 randconfig-013-20240911 gcc-12 x86_64 randconfig-014-20240911 clang-18 x86_64 randconfig-015-20240911 gcc-12 x86_64 randconfig-016-20240911 clang-18 x86_64 randconfig-071-20240911 clang-18 x86_64 randconfig-072-20240911 gcc-11 x86_64 randconfig-073-20240911 clang-18 x86_64 randconfig-074-20240911 clang-18 x86_64 randconfig-075-20240911 gcc-12 x86_64 randconfig-076-20240911 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 23430/30000] arch/x86/kernel/cpu/common.c:92:16: sparse: sparse: incorrect type in initializer (different address spaces)
by kernel test robot 12 Sep '24

12 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e23f76121de26a57b9f398c8b1ce5405a88acd8a commit: f4128ae8e6ff03b4c805707fe75d0345797f7f53 [23430/30000] sched: Add cluster scheduler level for x86 config: x86_64-randconfig-123-20240910 (https://download.01.org/0day-ci/archive/20240912/202409120353.B8gNzHgp-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240912/202409120353.B8gNzHgp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409120353.B8gNzHgp-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/x86/kernel/cpu/common.c:92:16: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got unsigned short * @@ arch/x86/kernel/cpu/common.c:92:16: sparse: expected void const [noderef] __percpu *__vpp_verify arch/x86/kernel/cpu/common.c:92:16: sparse: got unsigned short * arch/x86/kernel/cpu/common.c:144:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:145:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:146:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:147:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:148:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:149:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) vim +92 arch/x86/kernel/cpu/common.c f8b64d08dde271 Borislav Petkov 2018-04-27 89 6f01df96c462b7 Kim Phillips 2021-08-17 90 u16 get_llc_id(unsigned int cpu) 6f01df96c462b7 Kim Phillips 2021-08-17 91 { 6f01df96c462b7 Kim Phillips 2021-08-17 @92 return per_cpu(cpu_llc_id, cpu); 6f01df96c462b7 Kim Phillips 2021-08-17 93 } 6f01df96c462b7 Kim Phillips 2021-08-17 94 EXPORT_SYMBOL_GPL(get_llc_id); 6f01df96c462b7 Kim Phillips 2021-08-17 95 :::::: The code at line 92 was first introduced by commit :::::: 6f01df96c462b77915b27d404152c47e75e879cf x86/cpu: Add get_llc_id() helper function :::::: TO: Kim Phillips <kim.phillips(a)amd.com> :::::: CC: Xie Haocheng <haocheng.xie(a)amd.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 15762/30000] kernel/sys_ni.c:301:1: sparse: sparse: symbol '__x64_sys_set_mempolicy_home_node' was not declared. Should it be static?
by kernel test robot 12 Sep '24

12 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e23f76121de26a57b9f398c8b1ce5405a88acd8a commit: 1e3451e075c8d91e3be398e395b9cfc9cf487d6d [15762/30000] mm/mempolicy: wire up syscall set_mempolicy_home_node config: x86_64-randconfig-123-20240910 (https://download.01.org/0day-ci/archive/20240912/202409120147.RVcM1s31-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240912/202409120147.RVcM1s31-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409120147.RVcM1s31-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sys_ni.c:227:1: sparse: sparse: symbol '__ia32_sys_shmctl' was not declared. Should it be static? kernel/sys_ni.c:228:1: sparse: sparse: symbol '__ia32_compat_sys_shmctl' was not declared. Should it be static? kernel/sys_ni.c:229:1: sparse: sparse: symbol '__ia32_compat_sys_old_shmctl' was not declared. Should it be static? kernel/sys_ni.c:230:1: sparse: sparse: symbol '__ia32_sys_shmat' was not declared. Should it be static? kernel/sys_ni.c:231:1: sparse: sparse: symbol '__ia32_compat_sys_shmat' was not declared. Should it be static? kernel/sys_ni.c:243:1: sparse: sparse: symbol '__ia32_sys_setsockopt' was not declared. Should it be static? kernel/sys_ni.c:244:1: sparse: sparse: symbol '__ia32_compat_sys_setsockopt' was not declared. Should it be static? kernel/sys_ni.c:245:1: sparse: sparse: symbol '__ia32_sys_getsockopt' was not declared. Should it be static? kernel/sys_ni.c:246:1: sparse: sparse: symbol '__ia32_compat_sys_getsockopt' was not declared. Should it be static? kernel/sys_ni.c:249:1: sparse: sparse: symbol '__ia32_sys_recvfrom' was not declared. Should it be static? kernel/sys_ni.c:250:1: sparse: sparse: symbol '__ia32_compat_sys_recvfrom' was not declared. Should it be static? kernel/sys_ni.c:251:1: sparse: sparse: symbol '__ia32_sys_sendmsg' was not declared. Should it be static? kernel/sys_ni.c:252:1: sparse: sparse: symbol '__ia32_compat_sys_sendmsg' was not declared. Should it be static? kernel/sys_ni.c:253:1: sparse: sparse: symbol '__ia32_sys_recvmsg' was not declared. Should it be static? kernel/sys_ni.c:254:1: sparse: sparse: symbol '__ia32_compat_sys_recvmsg' was not declared. Should it be static? kernel/sys_ni.c:264:1: sparse: sparse: symbol '__ia32_sys_keyctl' was not declared. Should it be static? kernel/sys_ni.c:265:1: sparse: sparse: symbol '__ia32_compat_sys_keyctl' was not declared. Should it be static? kernel/sys_ni.c:268:1: sparse: sparse: symbol '__x64_sys_landlock_create_ruleset' was not declared. Should it be static? kernel/sys_ni.c:268:1: sparse: sparse: symbol '__ia32_sys_landlock_create_ruleset' was not declared. Should it be static? kernel/sys_ni.c:269:1: sparse: sparse: symbol '__x64_sys_landlock_add_rule' was not declared. Should it be static? kernel/sys_ni.c:269:1: sparse: sparse: symbol '__ia32_sys_landlock_add_rule' was not declared. Should it be static? kernel/sys_ni.c:270:1: sparse: sparse: symbol '__x64_sys_landlock_restrict_self' was not declared. Should it be static? kernel/sys_ni.c:270:1: sparse: sparse: symbol '__ia32_sys_landlock_restrict_self' was not declared. Should it be static? kernel/sys_ni.c:275:1: sparse: sparse: symbol '__x64_sys_fadvise64_64' was not declared. Should it be static? kernel/sys_ni.c:275:1: sparse: sparse: symbol '__ia32_sys_fadvise64_64' was not declared. Should it be static? kernel/sys_ni.c:276:1: sparse: sparse: symbol '__ia32_compat_sys_fadvise64_64' was not declared. Should it be static? kernel/sys_ni.c:292:1: sparse: sparse: symbol '__ia32_compat_sys_mbind' was not declared. Should it be static? kernel/sys_ni.c:293:1: sparse: sparse: symbol '__ia32_sys_get_mempolicy' was not declared. Should it be static? kernel/sys_ni.c:294:1: sparse: sparse: symbol '__ia32_compat_sys_get_mempolicy' was not declared. Should it be static? kernel/sys_ni.c:296:1: sparse: sparse: symbol '__ia32_compat_sys_set_mempolicy' was not declared. Should it be static? kernel/sys_ni.c:298:1: sparse: sparse: symbol '__ia32_compat_sys_migrate_pages' was not declared. Should it be static? kernel/sys_ni.c:299:1: sparse: sparse: symbol '__ia32_sys_move_pages' was not declared. Should it be static? kernel/sys_ni.c:300:1: sparse: sparse: symbol '__ia32_compat_sys_move_pages' was not declared. Should it be static? >> kernel/sys_ni.c:301:1: sparse: sparse: symbol '__x64_sys_set_mempolicy_home_node' was not declared. Should it be static? >> kernel/sys_ni.c:301:1: sparse: sparse: symbol '__ia32_sys_set_mempolicy_home_node' was not declared. Should it be static? kernel/sys_ni.c:305:1: sparse: sparse: symbol '__ia32_sys_recvmmsg' was not declared. Should it be static? kernel/sys_ni.c:306:1: sparse: sparse: symbol '__x64_sys_recvmmsg_time32' was not declared. Should it be static? kernel/sys_ni.c:306:1: sparse: sparse: symbol '__ia32_sys_recvmmsg_time32' was not declared. Should it be static? kernel/sys_ni.c:307:1: sparse: sparse: symbol '__ia32_compat_sys_recvmmsg_time32' was not declared. Should it be static? kernel/sys_ni.c:308:1: sparse: sparse: symbol '__ia32_compat_sys_recvmmsg_time64' was not declared. Should it be static? kernel/sys_ni.c:316:1: sparse: sparse: symbol '__ia32_sys_fanotify_mark' was not declared. Should it be static? kernel/sys_ni.c:320:1: sparse: sparse: symbol '__ia32_sys_open_by_handle_at' was not declared. Should it be static? kernel/sys_ni.c:321:1: sparse: sparse: symbol '__ia32_compat_sys_open_by_handle_at' was not declared. Should it be static? kernel/sys_ni.c:323:1: sparse: sparse: symbol '__ia32_sys_sendmmsg' was not declared. Should it be static? kernel/sys_ni.c:324:1: sparse: sparse: symbol '__ia32_compat_sys_sendmmsg' was not declared. Should it be static? kernel/sys_ni.c:325:1: sparse: sparse: symbol '__ia32_sys_process_vm_readv' was not declared. Should it be static? kernel/sys_ni.c:326:1: sparse: sparse: symbol '__ia32_compat_sys_process_vm_readv' was not declared. Should it be static? kernel/sys_ni.c:327:1: sparse: sparse: symbol '__ia32_sys_process_vm_writev' was not declared. Should it be static? kernel/sys_ni.c:328:1: sparse: sparse: symbol '__ia32_compat_sys_process_vm_writev' was not declared. Should it be static? kernel/sys_ni.c:344:1: sparse: sparse: symbol '__ia32_sys_execveat' was not declared. Should it be static? kernel/sys_ni.c:366:1: sparse: sparse: symbol '__x64_sys_pciconfig_read' was not declared. Should it be static? kernel/sys_ni.c:366:1: sparse: sparse: symbol '__ia32_sys_pciconfig_read' was not declared. Should it be static? kernel/sys_ni.c:367:1: sparse: sparse: symbol '__x64_sys_pciconfig_write' was not declared. Should it be static? kernel/sys_ni.c:367:1: sparse: sparse: symbol '__ia32_sys_pciconfig_write' was not declared. Should it be static? kernel/sys_ni.c:368:1: sparse: sparse: symbol '__x64_sys_pciconfig_iobase' was not declared. Should it be static? kernel/sys_ni.c:368:1: sparse: sparse: symbol '__ia32_sys_pciconfig_iobase' was not declared. Should it be static? kernel/sys_ni.c:371:1: sparse: sparse: symbol '__x64_sys_socketcall' was not declared. Should it be static? kernel/sys_ni.c:371:1: sparse: sparse: symbol '__ia32_sys_socketcall' was not declared. Should it be static? kernel/sys_ni.c:372:1: sparse: sparse: symbol '__ia32_compat_sys_socketcall' was not declared. Should it be static? kernel/sys_ni.c:375:1: sparse: sparse: symbol '__ia32_compat_sys_fanotify_mark' was not declared. Should it be static? kernel/sys_ni.c:378:1: sparse: sparse: symbol '__x64_sys_vm86old' was not declared. Should it be static? kernel/sys_ni.c:378:1: sparse: sparse: symbol '__ia32_sys_vm86old' was not declared. Should it be static? kernel/sys_ni.c:380:1: sparse: sparse: symbol '__x64_sys_vm86' was not declared. Should it be static? kernel/sys_ni.c:380:1: sparse: sparse: symbol '__ia32_sys_vm86' was not declared. Should it be static? kernel/sys_ni.c:381:1: sparse: sparse: symbol '__ia32_sys_kexec_file_load' was not declared. Should it be static? kernel/sys_ni.c:384:1: sparse: sparse: symbol '__x64_sys_s390_pci_mmio_read' was not declared. Should it be static? kernel/sys_ni.c:384:1: sparse: sparse: symbol '__ia32_sys_s390_pci_mmio_read' was not declared. Should it be static? kernel/sys_ni.c:385:1: sparse: sparse: symbol '__x64_sys_s390_pci_mmio_write' was not declared. Should it be static? kernel/sys_ni.c:385:1: sparse: sparse: symbol '__ia32_sys_s390_pci_mmio_write' was not declared. Should it be static? kernel/sys_ni.c:386:1: sparse: sparse: symbol '__x64_sys_s390_ipc' was not declared. Should it be static? kernel/sys_ni.c:386:1: sparse: sparse: symbol '__ia32_sys_s390_ipc' was not declared. Should it be static? kernel/sys_ni.c:387:1: sparse: sparse: symbol '__ia32_compat_sys_s390_ipc' was not declared. Should it be static? kernel/sys_ni.c:390:1: sparse: sparse: symbol '__x64_sys_rtas' was not declared. Should it be static? kernel/sys_ni.c:390:1: sparse: sparse: symbol '__ia32_sys_rtas' was not declared. Should it be static? kernel/sys_ni.c:391:1: sparse: sparse: symbol '__x64_sys_spu_run' was not declared. Should it be static? kernel/sys_ni.c:391:1: sparse: sparse: symbol '__ia32_sys_spu_run' was not declared. Should it be static? kernel/sys_ni.c:392:1: sparse: sparse: symbol '__x64_sys_spu_create' was not declared. Should it be static? kernel/sys_ni.c:392:1: sparse: sparse: symbol '__ia32_sys_spu_create' was not declared. Should it be static? kernel/sys_ni.c:393:1: sparse: sparse: symbol '__x64_sys_subpage_prot' was not declared. Should it be static? kernel/sys_ni.c:393:1: sparse: sparse: symbol '__ia32_sys_subpage_prot' was not declared. Should it be static? kernel/sys_ni.c:405:1: sparse: sparse: symbol '__ia32_sys_signalfd' was not declared. Should it be static? kernel/sys_ni.c:406:1: sparse: sparse: symbol '__ia32_compat_sys_signalfd' was not declared. Should it be static? kernel/sys_ni.c:409:1: sparse: sparse: symbol '__ia32_sys_fadvise64' was not declared. Should it be static? vim +/__x64_sys_set_mempolicy_home_node +301 kernel/sys_ni.c 277 278 /* mm/, CONFIG_MMU only */ 279 COND_SYSCALL(swapon); 280 COND_SYSCALL(swapoff); 281 COND_SYSCALL(mprotect); 282 COND_SYSCALL(msync); 283 COND_SYSCALL(mlock); 284 COND_SYSCALL(munlock); 285 COND_SYSCALL(mlockall); 286 COND_SYSCALL(munlockall); 287 COND_SYSCALL(mincore); 288 COND_SYSCALL(madvise); 289 COND_SYSCALL(process_madvise); 290 COND_SYSCALL(remap_file_pages); 291 COND_SYSCALL(mbind); 292 COND_SYSCALL_COMPAT(mbind); 293 COND_SYSCALL(get_mempolicy); 294 COND_SYSCALL_COMPAT(get_mempolicy); 295 COND_SYSCALL(set_mempolicy); 296 COND_SYSCALL_COMPAT(set_mempolicy); 297 COND_SYSCALL(migrate_pages); 298 COND_SYSCALL_COMPAT(migrate_pages); 299 COND_SYSCALL(move_pages); 300 COND_SYSCALL_COMPAT(move_pages); > 301 COND_SYSCALL(set_mempolicy_home_node); 302 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13473/13927] drivers/crypto/ccp/hygon/hct.c:1730:45: error: no member named 'numa_node' in 'struct device'
by kernel test robot 12 Sep '24

12 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 63fb41399626bd7c0b102eec56b5790ef3909db6 commit: c74ae2c5da57becf3f41c596d79b3dd30fa1baa6 [13473/13927] hct: add mediated ccp driver support for hygon crypto technology. config: x86_64-buildonly-randconfig-002-20240911 (https://download.01.org/0day-ci/archive/20240912/202409120059.aFjFwIVD-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240912/202409120059.aFjFwIVD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409120059.aFjFwIVD-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/crypto/ccp/hygon/hct.c:1333:15: warning: no previous prototype for function 'hct_pin_memory' [-Wmissing-prototypes] 1333 | struct page **hct_pin_memory(struct hct_private *private, unsigned long uaddr, | ^ drivers/crypto/ccp/hygon/hct.c:1333:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1333 | struct page **hct_pin_memory(struct hct_private *private, unsigned long uaddr, | ^ | static >> drivers/crypto/ccp/hygon/hct.c:1730:45: error: no member named 'numa_node' in 'struct device' 1730 | *node = hct_data.iommu[page_idx].pdev->dev.numa_node; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ 1 warning and 1 error generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for VFIO_MDEV Depends on [n]: VFIO [=n] Selected by [m]: - CRYPTO_DEV_HCT [=m] && CRYPTO [=y] && CRYPTO_HW [=y] && CRYPTO_DEV_CCP [=y] && X86_64 [=y] vim +1730 drivers/crypto/ccp/hygon/hct.c 1713 1714 static struct page *hct_get_page(pgoff_t page_idx) 1715 { 1716 u64 *node; 1717 1718 mutex_lock(&hct_share.lock); 1719 if (!hct_share.pages[page_idx]) { 1720 hct_share.pages[page_idx] = 1721 alloc_pages(GFP_HIGHUSER | __GFP_ZERO, 0); 1722 if (!hct_share.pages[page_idx]) { 1723 mutex_unlock(&hct_share.lock); 1724 return NULL; 1725 } 1726 } 1727 get_page(hct_share.pages[page_idx]); 1728 1729 node = page_to_virt(hct_share.pages[page_idx]) + PAGE_SIZE - 8; > 1730 *node = hct_data.iommu[page_idx].pdev->dev.numa_node; 1731 mutex_unlock(&hct_share.lock); 1732 1733 return hct_share.pages[page_idx]; 1734 } 1735 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 16407/30000] kernel/sched/topology.c:2385:39: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 11 Sep '24

11 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e23f76121de26a57b9f398c8b1ce5405a88acd8a commit: edd5e1effd36972e2b1910661daef5e4249fc3fd [16407/30000] sched/fair: Adjust the allowed NUMA imbalance when SD_NUMA spans multiple LLCs config: x86_64-randconfig-123-20240910 (https://download.01.org/0day-ci/archive/20240911/202409112326.lXc9OUWp-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240911/202409112326.lXc9OUWp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409112326.lXc9OUWp-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/topology.c:121:56: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/topology.c:121:56: sparse: expected struct sched_domain *sd kernel/sched/topology.c:121:56: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/topology.c:140:60: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/topology.c:140:60: sparse: expected struct sched_domain *sd kernel/sched/topology.c:140:60: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/topology.c:163:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/topology.c:163:20: sparse: expected struct sched_domain *sd kernel/sched/topology.c:163:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/topology.c:463:19: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct perf_domain *pd @@ got struct perf_domain [noderef] __rcu *pd @@ kernel/sched/topology.c:463:19: sparse: expected struct perf_domain *pd kernel/sched/topology.c:463:19: sparse: got struct perf_domain [noderef] __rcu *pd kernel/sched/topology.c:626:49: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *parent @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/topology.c:626:49: sparse: expected struct sched_domain *parent kernel/sched/topology.c:626:49: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/topology.c:724:50: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *parent @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/topology.c:724:50: sparse: expected struct sched_domain *parent kernel/sched/topology.c:724:50: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/topology.c:731:55: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain [noderef] __rcu *[noderef] __rcu child @@ got struct sched_domain *[assigned] tmp @@ kernel/sched/topology.c:731:55: sparse: expected struct sched_domain [noderef] __rcu *[noderef] __rcu child kernel/sched/topology.c:731:55: sparse: got struct sched_domain *[assigned] tmp kernel/sched/topology.c:741:29: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/topology.c:741:29: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/topology.c:741:29: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/topology.c:746:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/topology.c:746:20: sparse: expected struct sched_domain *sd kernel/sched/topology.c:746:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/topology.c:752:33: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/topology.c:752:33: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/topology.c:752:33: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/topology.c:758:13: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *sd @@ kernel/sched/topology.c:758:13: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/topology.c:758:13: sparse: got struct sched_domain [noderef] __rcu *sd kernel/sched/topology.c:920:70: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/topology.c:920:70: sparse: expected struct sched_domain *sd kernel/sched/topology.c:920:70: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/topology.c:949:59: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/topology.c:949:59: sparse: expected struct sched_domain *sd kernel/sched/topology.c:949:59: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/topology.c:993:57: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/topology.c:993:57: sparse: expected struct sched_domain *sd kernel/sched/topology.c:993:57: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/topology.c:995:25: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sibling @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/topology.c:995:25: sparse: expected struct sched_domain *sibling kernel/sched/topology.c:995:25: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/topology.c:1003:55: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/topology.c:1003:55: sparse: expected struct sched_domain *sd kernel/sched/topology.c:1003:55: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/topology.c:1005:25: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sibling @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/topology.c:1005:25: sparse: expected struct sched_domain *sibling kernel/sched/topology.c:1005:25: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/topology.c:1075:62: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/topology.c:1075:62: sparse: expected struct sched_domain *sd kernel/sched/topology.c:1075:62: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/topology.c:1179:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *child @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/topology.c:1179:40: sparse: expected struct sched_domain *child kernel/sched/topology.c:1179:40: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/topology.c:1482:43: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain [noderef] __rcu *child @@ got struct sched_domain *child @@ kernel/sched/topology.c:1482:43: sparse: expected struct sched_domain [noderef] __rcu *child kernel/sched/topology.c:1482:43: sparse: got struct sched_domain *child kernel/sched/topology.c:2163:31: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain [noderef] __rcu *parent @@ got struct sched_domain *sd @@ kernel/sched/topology.c:2163:31: sparse: expected struct sched_domain [noderef] __rcu *parent kernel/sched/topology.c:2163:31: sparse: got struct sched_domain *sd kernel/sched/topology.c:2334:57: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/topology.c:2334:57: sparse: expected struct sched_domain *[assigned] sd kernel/sched/topology.c:2334:57: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/topology.c:2355:56: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *child @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/topology.c:2355:56: sparse: expected struct sched_domain *child kernel/sched/topology.c:2355:56: sparse: got struct sched_domain [noderef] __rcu *child >> kernel/sched/topology.c:2385:39: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *top_p @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/topology.c:2385:39: sparse: expected struct sched_domain *top_p kernel/sched/topology.c:2385:39: sparse: got struct sched_domain [noderef] __rcu *parent >> kernel/sched/topology.c:2387:45: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] top @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/topology.c:2387:45: sparse: expected struct sched_domain *[assigned] top kernel/sched/topology.c:2387:45: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/topology.c:2388:47: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *top_p @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/topology.c:2388:47: sparse: expected struct sched_domain *top_p kernel/sched/topology.c:2388:47: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/topology.c:2354:57: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/topology.c:2354:57: sparse: expected struct sched_domain *[assigned] sd kernel/sched/topology.c:2354:57: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/topology.c:2404:57: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/topology.c:2404:57: sparse: expected struct sched_domain *[assigned] sd kernel/sched/topology.c:2404:57: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/topology.c:74:25: sparse: sparse: dereference of noderef expression kernel/sched/topology.c:79:25: sparse: sparse: dereference of noderef expression kernel/sched/topology.c: note: in included file: kernel/sched/sched.h:1792:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/sched.h:1792:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/sched.h:1792:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/sched.h:1805:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/sched.h:1805:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/sched.h:1805:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/sched.h:1805:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/sched.h:1805:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/sched.h:1805:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/sched.h:1792:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/sched.h:1792:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/sched.h:1792:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/sched.h:1805:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/sched.h:1805:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/sched.h:1805:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/topology.c:1497:19: sparse: sparse: dereference of noderef expression vim +2385 kernel/sched/topology.c 2277 2278 2279 /* 2280 * Build sched domains for a given set of CPUs and attach the sched domains 2281 * to the individual CPUs 2282 */ 2283 static int 2284 build_sched_domains(const struct cpumask *cpu_map, struct sched_domain_attr *attr) 2285 { 2286 enum s_alloc alloc_state = sa_none; 2287 struct sched_domain *sd; 2288 struct s_data d; 2289 struct rq *rq = NULL; 2290 int i, ret = -ENOMEM; 2291 struct sched_domain_topology_level *tl_asym; 2292 bool has_asym = false; 2293 bool has_cluster = false; 2294 2295 if (WARN_ON(cpumask_empty(cpu_map))) 2296 goto error; 2297 2298 alloc_state = __visit_domain_allocation_hell(&d, cpu_map); 2299 if (alloc_state != sa_rootdomain) 2300 goto error; 2301 2302 tl_asym = asym_cpu_capacity_level(cpu_map); 2303 2304 /* Set up domains for CPUs specified by the cpu_map: */ 2305 for_each_cpu(i, cpu_map) { 2306 struct sched_domain_topology_level *tl; 2307 int dflags = 0; 2308 2309 sd = NULL; 2310 for_each_sd_topology(tl) { 2311 if (tl == tl_asym) { 2312 dflags |= SD_ASYM_CPUCAPACITY; 2313 has_asym = true; 2314 } 2315 2316 if (WARN_ON(!topology_span_sane(tl, cpu_map, i))) 2317 goto error; 2318 2319 sd = build_sched_domain(tl, cpu_map, attr, sd, dflags, i); 2320 2321 has_cluster |= sd->flags & SD_CLUSTER; 2322 2323 if (tl == sched_domain_topology) 2324 *per_cpu_ptr(d.sd, i) = sd; 2325 if (tl->flags & SDTL_OVERLAP) 2326 sd->flags |= SD_OVERLAP; 2327 if (cpumask_equal(cpu_map, sched_domain_span(sd))) 2328 break; 2329 } 2330 } 2331 2332 /* Build the groups for the domains */ 2333 for_each_cpu(i, cpu_map) { 2334 for (sd = *per_cpu_ptr(d.sd, i); sd; sd = sd->parent) { 2335 sd->span_weight = cpumask_weight(sched_domain_span(sd)); 2336 if (sd->flags & SD_OVERLAP) { 2337 if (build_overlap_sched_groups(sd, i)) 2338 goto error; 2339 } else { 2340 if (build_sched_groups(sd, i)) 2341 goto error; 2342 } 2343 } 2344 } 2345 2346 /* 2347 * Calculate an allowed NUMA imbalance such that LLCs do not get 2348 * imbalanced. 2349 */ 2350 for_each_cpu(i, cpu_map) { 2351 unsigned int imb = 0; 2352 unsigned int imb_span = 1; 2353 2354 for (sd = *per_cpu_ptr(d.sd, i); sd; sd = sd->parent) { 2355 struct sched_domain *child = sd->child; 2356 2357 if (!(sd->flags & SD_SHARE_PKG_RESOURCES) && child && 2358 (child->flags & SD_SHARE_PKG_RESOURCES)) { 2359 struct sched_domain *top, *top_p; 2360 unsigned int nr_llcs; 2361 2362 /* 2363 * For a single LLC per node, allow an 2364 * imbalance up to 25% of the node. This is an 2365 * arbitrary cutoff based on SMT-2 to balance 2366 * between memory bandwidth and avoiding 2367 * premature sharing of HT resources and SMT-4 2368 * or SMT-8 *may* benefit from a different 2369 * cutoff. 2370 * 2371 * For multiple LLCs, allow an imbalance 2372 * until multiple tasks would share an LLC 2373 * on one node while LLCs on another node 2374 * remain idle. 2375 */ 2376 nr_llcs = sd->span_weight / child->span_weight; 2377 if (nr_llcs == 1) 2378 imb = sd->span_weight >> 2; 2379 else 2380 imb = nr_llcs; 2381 sd->imb_numa_nr = imb; 2382 2383 /* Set span based on the first NUMA domain. */ 2384 top = sd; > 2385 top_p = top->parent; 2386 while (top_p && !(top_p->flags & SD_NUMA)) { > 2387 top = top->parent; 2388 top_p = top->parent; 2389 } 2390 imb_span = top_p ? top_p->span_weight : sd->span_weight; 2391 } else { 2392 int factor = max(1U, (sd->span_weight / imb_span)); 2393 2394 sd->imb_numa_nr = imb * factor; 2395 } 2396 } 2397 } 2398 2399 /* Calculate CPU capacity for physical packages and nodes */ 2400 for (i = nr_cpumask_bits-1; i >= 0; i--) { 2401 if (!cpumask_test_cpu(i, cpu_map)) 2402 continue; 2403 2404 for (sd = *per_cpu_ptr(d.sd, i); sd; sd = sd->parent) { 2405 claim_allocations(i, sd); 2406 init_sched_groups_capacity(i, sd); 2407 } 2408 } 2409 2410 /* 2411 * Allocate shared sd data at last level cache. Must be done after 2412 * domains are built above, but before the data is used in 2413 * cpu_attach_domain and descendants below. 2414 */ 2415 if (sd_llc_alloc_all(cpu_map, &d)) 2416 goto error; 2417 2418 /* Attach the domains */ 2419 rcu_read_lock(); 2420 for_each_cpu(i, cpu_map) { 2421 rq = cpu_rq(i); 2422 sd = *per_cpu_ptr(d.sd, i); 2423 2424 /* Use READ_ONCE()/WRITE_ONCE() to avoid load/store tearing: */ 2425 if (rq->cpu_capacity_orig > READ_ONCE(d.rd->max_cpu_capacity)) 2426 WRITE_ONCE(d.rd->max_cpu_capacity, rq->cpu_capacity_orig); 2427 2428 cpu_attach_domain(sd, d.rd, i); 2429 } 2430 rcu_read_unlock(); 2431 2432 if (has_asym) 2433 static_branch_inc_cpuslocked(&sched_asym_cpucapacity); 2434 2435 if (has_cluster) 2436 static_branch_inc_cpuslocked(&sched_cluster_active); 2437 2438 if (rq && sched_debug_enabled) { 2439 pr_info("root domain span: %*pbl (max cpu_capacity = %lu)\n", 2440 cpumask_pr_args(cpu_map), rq->rd->max_cpu_capacity); 2441 } 2442 2443 ret = 0; 2444 error: 2445 __free_domain_allocs(&d, alloc_state, cpu_map); 2446 2447 return ret; 2448 } 2449 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/5] Misc minor bugfix for HNS RoCE
by Chengchang Tang 11 Sep '24

11 Sep '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Fix a probability overflow of AEQ and some sparse warnings. Junxian Huang (4): RDMA/hns: Fix dereference of noderef expression RDMA/hns: Fix "Should it be static?" warnings RDMA/hns: Fix ah error counter in sw stat not increasing when sl is invalid RDMA/hns: Fix endian issues wenglianfa (1): RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci drivers/infiniband/hw/hns/hns_roce_ah.c | 3 +- drivers/infiniband/hw/hns/hns_roce_bond.c | 8 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 102 +++++++++++++-------- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 5 + drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- drivers/infiniband/hw/hns/hns_roce_sysfs.c | 36 ++++---- 6 files changed, 99 insertions(+), 57 deletions(-) -- 2.33.0

2 6

[openeuler:OLK-5.10 14827/30000] kernel/sys_ni.c:268:1: sparse: sparse: symbol '__x64_sys_landlock_create_ruleset' was not declared. Should it be static?
by kernel test robot 11 Sep '24

11 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: fb74b7c6ee60eaba8d843255f6a09f6d1d6b8c33 commit: 21dd31f58b64b122a2d9fb62669d6191d1cf2c0f [14827/30000] landlock: Add syscall implementations config: x86_64-randconfig-123-20240910 (https://download.01.org/0day-ci/archive/20240911/202409112049.JSlQcsk7-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240911/202409112049.JSlQcsk7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409112049.JSlQcsk7-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sys_ni.c:195:1: sparse: sparse: symbol '__x64_sys_mq_timedsend_time32' was not declared. Should it be static? kernel/sys_ni.c:197:1: sparse: sparse: symbol '__x64_sys_mq_timedreceive_time32' was not declared. Should it be static? kernel/sys_ni.c:198:1: sparse: sparse: symbol '__ia32_sys_mq_notify' was not declared. Should it be static? kernel/sys_ni.c:199:1: sparse: sparse: symbol '__ia32_compat_sys_mq_notify' was not declared. Should it be static? kernel/sys_ni.c:200:1: sparse: sparse: symbol '__ia32_sys_mq_getsetattr' was not declared. Should it be static? kernel/sys_ni.c:201:1: sparse: sparse: symbol '__ia32_compat_sys_mq_getsetattr' was not declared. Should it be static? kernel/sys_ni.c:205:1: sparse: sparse: symbol '__x64_sys_old_msgctl' was not declared. Should it be static? kernel/sys_ni.c:205:1: sparse: sparse: symbol '__ia32_sys_old_msgctl' was not declared. Should it be static? kernel/sys_ni.c:206:1: sparse: sparse: symbol '__ia32_sys_msgctl' was not declared. Should it be static? kernel/sys_ni.c:207:1: sparse: sparse: symbol '__ia32_compat_sys_msgctl' was not declared. Should it be static? kernel/sys_ni.c:208:1: sparse: sparse: symbol '__ia32_compat_sys_old_msgctl' was not declared. Should it be static? kernel/sys_ni.c:209:1: sparse: sparse: symbol '__ia32_sys_msgrcv' was not declared. Should it be static? kernel/sys_ni.c:210:1: sparse: sparse: symbol '__ia32_compat_sys_msgrcv' was not declared. Should it be static? kernel/sys_ni.c:211:1: sparse: sparse: symbol '__ia32_sys_msgsnd' was not declared. Should it be static? kernel/sys_ni.c:212:1: sparse: sparse: symbol '__ia32_compat_sys_msgsnd' was not declared. Should it be static? kernel/sys_ni.c:216:1: sparse: sparse: symbol '__x64_sys_old_semctl' was not declared. Should it be static? kernel/sys_ni.c:216:1: sparse: sparse: symbol '__ia32_sys_old_semctl' was not declared. Should it be static? kernel/sys_ni.c:217:1: sparse: sparse: symbol '__ia32_sys_semctl' was not declared. Should it be static? kernel/sys_ni.c:218:1: sparse: sparse: symbol '__ia32_compat_sys_semctl' was not declared. Should it be static? kernel/sys_ni.c:219:1: sparse: sparse: symbol '__ia32_compat_sys_old_semctl' was not declared. Should it be static? kernel/sys_ni.c:221:1: sparse: sparse: symbol '__x64_sys_semtimedop_time32' was not declared. Should it be static? kernel/sys_ni.c:221:1: sparse: sparse: symbol '__ia32_sys_semtimedop_time32' was not declared. Should it be static? kernel/sys_ni.c:222:1: sparse: sparse: symbol '__ia32_sys_semop' was not declared. Should it be static? kernel/sys_ni.c:226:1: sparse: sparse: symbol '__x64_sys_old_shmctl' was not declared. Should it be static? kernel/sys_ni.c:226:1: sparse: sparse: symbol '__ia32_sys_old_shmctl' was not declared. Should it be static? kernel/sys_ni.c:227:1: sparse: sparse: symbol '__ia32_sys_shmctl' was not declared. Should it be static? kernel/sys_ni.c:228:1: sparse: sparse: symbol '__ia32_compat_sys_shmctl' was not declared. Should it be static? kernel/sys_ni.c:229:1: sparse: sparse: symbol '__ia32_compat_sys_old_shmctl' was not declared. Should it be static? kernel/sys_ni.c:230:1: sparse: sparse: symbol '__ia32_sys_shmat' was not declared. Should it be static? kernel/sys_ni.c:231:1: sparse: sparse: symbol '__ia32_compat_sys_shmat' was not declared. Should it be static? kernel/sys_ni.c:243:1: sparse: sparse: symbol '__ia32_sys_setsockopt' was not declared. Should it be static? kernel/sys_ni.c:244:1: sparse: sparse: symbol '__ia32_compat_sys_setsockopt' was not declared. Should it be static? kernel/sys_ni.c:245:1: sparse: sparse: symbol '__ia32_sys_getsockopt' was not declared. Should it be static? kernel/sys_ni.c:246:1: sparse: sparse: symbol '__ia32_compat_sys_getsockopt' was not declared. Should it be static? kernel/sys_ni.c:249:1: sparse: sparse: symbol '__ia32_sys_recvfrom' was not declared. Should it be static? kernel/sys_ni.c:250:1: sparse: sparse: symbol '__ia32_compat_sys_recvfrom' was not declared. Should it be static? kernel/sys_ni.c:251:1: sparse: sparse: symbol '__ia32_sys_sendmsg' was not declared. Should it be static? kernel/sys_ni.c:252:1: sparse: sparse: symbol '__ia32_compat_sys_sendmsg' was not declared. Should it be static? kernel/sys_ni.c:253:1: sparse: sparse: symbol '__ia32_sys_recvmsg' was not declared. Should it be static? kernel/sys_ni.c:254:1: sparse: sparse: symbol '__ia32_compat_sys_recvmsg' was not declared. Should it be static? kernel/sys_ni.c:264:1: sparse: sparse: symbol '__ia32_sys_keyctl' was not declared. Should it be static? kernel/sys_ni.c:265:1: sparse: sparse: symbol '__ia32_compat_sys_keyctl' was not declared. Should it be static? >> kernel/sys_ni.c:268:1: sparse: sparse: symbol '__x64_sys_landlock_create_ruleset' was not declared. Should it be static? >> kernel/sys_ni.c:268:1: sparse: sparse: symbol '__ia32_sys_landlock_create_ruleset' was not declared. Should it be static? >> kernel/sys_ni.c:269:1: sparse: sparse: symbol '__x64_sys_landlock_add_rule' was not declared. Should it be static? >> kernel/sys_ni.c:269:1: sparse: sparse: symbol '__ia32_sys_landlock_add_rule' was not declared. Should it be static? >> kernel/sys_ni.c:270:1: sparse: sparse: symbol '__x64_sys_landlock_restrict_self' was not declared. Should it be static? >> kernel/sys_ni.c:270:1: sparse: sparse: symbol '__ia32_sys_landlock_restrict_self' was not declared. Should it be static? kernel/sys_ni.c:275:1: sparse: sparse: symbol '__x64_sys_fadvise64_64' was not declared. Should it be static? kernel/sys_ni.c:275:1: sparse: sparse: symbol '__ia32_sys_fadvise64_64' was not declared. Should it be static? kernel/sys_ni.c:276:1: sparse: sparse: symbol '__ia32_compat_sys_fadvise64_64' was not declared. Should it be static? kernel/sys_ni.c:292:1: sparse: sparse: symbol '__ia32_compat_sys_mbind' was not declared. Should it be static? kernel/sys_ni.c:293:1: sparse: sparse: symbol '__ia32_sys_get_mempolicy' was not declared. Should it be static? kernel/sys_ni.c:294:1: sparse: sparse: symbol '__ia32_compat_sys_get_mempolicy' was not declared. Should it be static? kernel/sys_ni.c:296:1: sparse: sparse: symbol '__ia32_compat_sys_set_mempolicy' was not declared. Should it be static? kernel/sys_ni.c:298:1: sparse: sparse: symbol '__ia32_compat_sys_migrate_pages' was not declared. Should it be static? kernel/sys_ni.c:299:1: sparse: sparse: symbol '__ia32_sys_move_pages' was not declared. Should it be static? kernel/sys_ni.c:300:1: sparse: sparse: symbol '__ia32_compat_sys_move_pages' was not declared. Should it be static? kernel/sys_ni.c:304:1: sparse: sparse: symbol '__ia32_sys_recvmmsg' was not declared. Should it be static? kernel/sys_ni.c:305:1: sparse: sparse: symbol '__x64_sys_recvmmsg_time32' was not declared. Should it be static? kernel/sys_ni.c:305:1: sparse: sparse: symbol '__ia32_sys_recvmmsg_time32' was not declared. Should it be static? kernel/sys_ni.c:306:1: sparse: sparse: symbol '__ia32_compat_sys_recvmmsg_time32' was not declared. Should it be static? kernel/sys_ni.c:307:1: sparse: sparse: symbol '__ia32_compat_sys_recvmmsg_time64' was not declared. Should it be static? kernel/sys_ni.c:315:1: sparse: sparse: symbol '__ia32_sys_fanotify_mark' was not declared. Should it be static? kernel/sys_ni.c:319:1: sparse: sparse: symbol '__ia32_sys_open_by_handle_at' was not declared. Should it be static? kernel/sys_ni.c:320:1: sparse: sparse: symbol '__ia32_compat_sys_open_by_handle_at' was not declared. Should it be static? kernel/sys_ni.c:322:1: sparse: sparse: symbol '__ia32_sys_sendmmsg' was not declared. Should it be static? kernel/sys_ni.c:323:1: sparse: sparse: symbol '__ia32_compat_sys_sendmmsg' was not declared. Should it be static? kernel/sys_ni.c:324:1: sparse: sparse: symbol '__ia32_sys_process_vm_readv' was not declared. Should it be static? kernel/sys_ni.c:325:1: sparse: sparse: symbol '__ia32_compat_sys_process_vm_readv' was not declared. Should it be static? kernel/sys_ni.c:326:1: sparse: sparse: symbol '__ia32_sys_process_vm_writev' was not declared. Should it be static? kernel/sys_ni.c:327:1: sparse: sparse: symbol '__ia32_compat_sys_process_vm_writev' was not declared. Should it be static? kernel/sys_ni.c:343:1: sparse: sparse: symbol '__ia32_sys_execveat' was not declared. Should it be static? kernel/sys_ni.c:365:1: sparse: sparse: symbol '__x64_sys_pciconfig_read' was not declared. Should it be static? kernel/sys_ni.c:365:1: sparse: sparse: symbol '__ia32_sys_pciconfig_read' was not declared. Should it be static? kernel/sys_ni.c:366:1: sparse: sparse: symbol '__x64_sys_pciconfig_write' was not declared. Should it be static? kernel/sys_ni.c:366:1: sparse: sparse: symbol '__ia32_sys_pciconfig_write' was not declared. Should it be static? vim +/__x64_sys_landlock_create_ruleset +268 kernel/sys_ni.c 257 258 /* mm/nommu.c, also with MMU */ > 259 COND_SYSCALL(mremap); 260 261 /* security/keys/keyctl.c */ > 262 COND_SYSCALL(add_key); > 263 COND_SYSCALL(request_key); 264 COND_SYSCALL(keyctl); 265 COND_SYSCALL_COMPAT(keyctl); 266 267 /* security/landlock/syscalls.c */ > 268 COND_SYSCALL(landlock_create_ruleset); > 269 COND_SYSCALL(landlock_add_rule); > 270 COND_SYSCALL(landlock_restrict_self); 271 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] mm: mTHP user controls to pagecache large folio
by Liu Shixin 11 Sep '24

11 Sep '24

Liu Shixin (2): mm/huge_memory: mTHP user controls to pagecache large folio mm/huge_memory: allow to enable 64K anouymous mapping align alone Documentation/admin-guide/mm/transhuge.rst | 16 +-- include/linux/huge_mm.h | 7 +- mm/filemap.c | 2 + mm/huge_memory.c | 118 ++++++++++++--------- mm/mmap.c | 3 +- mm/readahead.c | 2 + 6 files changed, 84 insertions(+), 64 deletions(-) -- 2.34.1

2 3

[openeuler:OLK-5.10 13879/30000] drivers/vdpa/vdpa.c:759:19: sparse: sparse: cast to restricted __le16
by kernel test robot 11 Sep '24

11 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: fb74b7c6ee60eaba8d843255f6a09f6d1d6b8c33 commit: 661b972e802c8e252911361538651db906c084bb [13879/30000] vdpa: Introduce query of device config layout config: x86_64-randconfig-123-20240910 (https://download.01.org/0day-ci/archive/20240911/202409111741.8Hd9TwMf-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240911/202409111741.8Hd9TwMf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409111741.8Hd9TwMf-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/vdpa/vdpa.c:759:19: sparse: sparse: cast to restricted __le16 >> drivers/vdpa/vdpa.c:759:19: sparse: sparse: cast from restricted __virtio16 drivers/vdpa/vdpa.c:775:19: sparse: sparse: cast to restricted __le16 drivers/vdpa/vdpa.c:775:19: sparse: sparse: cast from restricted __virtio16 drivers/vdpa/vdpa.c:779:19: sparse: sparse: cast to restricted __le16 drivers/vdpa/vdpa.c:779:19: sparse: sparse: cast from restricted __virtio16 vim +759 drivers/vdpa/vdpa.c 749 750 static int vdpa_dev_net_mq_config_fill(struct vdpa_device *vdev, 751 struct sk_buff *msg, u64 features, 752 const struct virtio_net_config *config) 753 { 754 u16 val_u16; 755 756 if ((features & (1ULL << VIRTIO_NET_F_MQ)) == 0) 757 return 0; 758 > 759 val_u16 = le16_to_cpu(config->max_virtqueue_pairs); 760 return nla_put_u16(msg, VDPA_ATTR_DEV_NET_CFG_MAX_VQP, val_u16); 761 } 762 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 777/13927] arch/loongarch/kernel/legacy_boot.c:439:25-27: WARNING !A || A && B is equivalent to !A || B
by kernel test robot 11 Sep '24

11 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 63fb41399626bd7c0b102eec56b5790ef3909db6 commit: db5bb24abc8dd120fd81b7ce21819e96578d011e [777/13927] LoongArch: Old BPI compatibility config: loongarch-randconfig-r061-20240911 (https://download.01.org/0day-ci/archive/20240911/202409111619.Ho8mrUHm-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409111619.Ho8mrUHm-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> arch/loongarch/kernel/legacy_boot.c:439:25-27: WARNING !A || A && B is equivalent to !A || B vim +439 arch/loongarch/kernel/legacy_boot.c 423 424 static struct fwnode_handle * __init parse_isa_base(u64 *cpu_addr) 425 { 426 struct device_node *np; 427 const __be32 *ranges = NULL; 428 int len; 429 struct device_node *node; 430 431 for_each_node_by_name(np, "isa") { 432 node = of_node_get(np); 433 434 if (!node) 435 break; 436 437 ranges = of_get_property(node, "ranges", &len); 438 > 439 if (!ranges || (ranges && len > 0)) 440 break; 441 } 442 if (ranges) { 443 ranges += 2; 444 *cpu_addr = of_translate_address(np, ranges); 445 return &np->fwnode; 446 } 447 448 return NULL; 449 } 450 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] docs: perf: Add description for HiSilicon PCIe PMU driver
by Yushan Wang 11 Sep '24

11 Sep '24

From: Qi Liu <liuqi115(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAQG34 CVE: NA ---------------------------------------------------------------------- PCIe PMU Root Complex Integrated End Point(RCiEP) device is supported on HiSilicon HIP09 platform. Document it to provide guidance on how to use it. Reviewed-by: John Garry <john.garry(a)huawei.com> Signed-off-by: Qi Liu <liuqi115(a)huawei.com> Reviewed-by: Shaokun Zhang <zhangshaokun(a)hisilicon.com> Link: https://lore.kernel.org/r/20211202080633.2919-2-liuqi115@huawei.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: zhangqz <14294317+zwx1160575(a)user.noreply.gitee.com> --- .../admin-guide/perf/hisi-pcie-pmu.rst | 106 ++++++++++++++++++ 1 file changed, 106 insertions(+) create mode 100644 Documentation/admin-guide/perf/hisi-pcie-pmu.rst diff --git a/Documentation/admin-guide/perf/hisi-pcie-pmu.rst b/Documentation/admin-guide/perf/hisi-pcie-pmu.rst new file mode 100644 index 000000000000..294ebbdb22af --- /dev/null +++ b/Documentation/admin-guide/perf/hisi-pcie-pmu.rst @@ -0,0 +1,106 @@ +================================================ +HiSilicon PCIe Performance Monitoring Unit (PMU) +================================================ + +On Hip09, HiSilicon PCIe Performance Monitoring Unit (PMU) could monitor +bandwidth, latency, bus utilization and buffer occupancy data of PCIe. + +Each PCIe Core has a PMU to monitor multi Root Ports of this PCIe Core and +all Endpoints downstream these Root Ports. + + +HiSilicon PCIe PMU driver +========================= + +The PCIe PMU driver registers a perf PMU with the name of its sicl-id and PCIe +Core id.:: + + /sys/bus/event_source/hisi_pcie<sicl>_<core> + +PMU driver provides description of available events and filter options in sysfs, +see /sys/bus/event_source/devices/hisi_pcie<sicl>_<core>. + +The "format" directory describes all formats of the config (events) and config1 +(filter options) fields of the perf_event_attr structure. The "events" directory +describes all documented events shown in perf list. + +The "identifier" sysfs file allows users to identify the version of the +PMU hardware device. + +The "bus" sysfs file allows users to get the bus number of Root Ports +monitored by PMU. + +Example usage of perf:: + + $# perf list + hisi_pcie0_0/rx_mwr_latency/ [kernel PMU event] + hisi_pcie0_0/rx_mwr_cnt/ [kernel PMU event] + ------------------------------------------ + + $# perf stat -e hisi_pcie0_0/rx_mwr_latency/ + $# perf stat -e hisi_pcie0_0/rx_mwr_cnt/ + $# perf stat -g -e hisi_pcie0_0/rx_mwr_latency/ -e hisi_pcie0_0/rx_mwr_cnt/ + +The current driver does not support sampling. So "perf record" is unsupported. +Also attach to a task is unsupported for PCIe PMU. + +Filter options +-------------- + +1. Target filter +PMU could only monitor the performance of traffic downstream target Root Ports +or downstream target Endpoint. PCIe PMU driver support "port" and "bdf" +interfaces for users, and these two interfaces aren't supported at the same +time. + +-port +"port" filter can be used in all PCIe PMU events, target Root Port can be +selected by configuring the 16-bits-bitmap "port". Multi ports can be selected +for AP-layer-events, and only one port can be selected for TL/DL-layer-events. + +For example, if target Root Port is 0000:00:00.0 (x8 lanes), bit0 of bitmap +should be set, port=0x1; if target Root Port is 0000:00:04.0 (x4 lanes), +bit8 is set, port=0x100; if these two Root Ports are both monitored, port=0x101. + +Example usage of perf:: + + $# perf stat -e hisi_pcie0_0/rx_mwr_latency,port=0x1/ sleep 5 + +-bdf + +"bdf" filter can only be used in bandwidth events, target Endpoint is selected +by configuring BDF to "bdf". Counter only counts the bandwidth of message +requested by target Endpoint. + +For example, "bdf=0x3900" means BDF of target Endpoint is 0000:39:00.0. + +Example usage of perf:: + + $# perf stat -e hisi_pcie0_0/rx_mrd_flux,bdf=0x3900/ sleep 5 + +2. Trigger filter +Event statistics start when the first time TLP length is greater/smaller +than trigger condition. You can set the trigger condition by writing "trig_len", +and set the trigger mode by writing "trig_mode". This filter can only be used +in bandwidth events. + +For example, "trig_len=4" means trigger condition is 2^4 DW, "trig_mode=0" +means statistics start when TLP length > trigger condition, "trig_mode=1" +means start when TLP length < condition. + +Example usage of perf:: + + $# perf stat -e hisi_pcie0_0/rx_mrd_flux,trig_len=0x4,trig_mode=1/ sleep 5 + +3. Threshold filter +Counter counts when TLP length within the specified range. You can set the +threshold by writing "thr_len", and set the threshold mode by writing +"thr_mode". This filter can only be used in bandwidth events. + +For example, "thr_len=4" means threshold is 2^4 DW, "thr_mode=0" means +counter counts when TLP length >= threshold, and "thr_mode=1" means counts +when TLP length < threshold. + +Example usage of perf:: + + $# perf stat -e hisi_pcie0_0/rx_mrd_flux,thr_len=0x4,thr_mode=1/ sleep 5 -- 2.33.0

2 1

[openeuler:OLK-5.10 23170/30000] drivers/md/md.c:4884:38: sparse: sparse: dereference of noderef expression
by kernel test robot 11 Sep '24

11 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 5cdf8021f6f20b488b2592811728b3f934fae628 commit: 448fbeaf0f07ea578841346b938245f5c5220b9b [23170/30000] md: protect md_thread with rcu config: x86_64-randconfig-121-20240910 (https://download.01.org/0day-ci/archive/20240911/202409111647.nFxvLIVx-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240911/202409111647.nFxvLIVx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409111647.nFxvLIVx-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/md/md.c:3392:29: sparse: sparse: self-comparison always evaluates to false drivers/md/md.c:3561:33: sparse: sparse: self-comparison always evaluates to false drivers/md/md.c:4341:36: sparse: sparse: self-comparison always evaluates to false >> drivers/md/md.c:4884:38: sparse: sparse: dereference of noderef expression drivers/md/md.c:5247:30: sparse: sparse: self-comparison always evaluates to false drivers/md/md.c:5284:30: sparse: sparse: self-comparison always evaluates to false drivers/md/md.c:5326:30: sparse: sparse: self-comparison always evaluates to false vim +4884 drivers/md/md.c 24dd469d728dae NeilBrown 2005-11-08 4857 e98a235fdfce57 Yu Kuai 2023-05-31 4858 static void stop_sync_thread(struct mddev *mddev) 24dd469d728dae NeilBrown 2005-11-08 4859 { e98a235fdfce57 Yu Kuai 2023-05-31 4860 if (!test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)) e98a235fdfce57 Yu Kuai 2023-05-31 4861 return; 7eec314d7512d5 NeilBrown 2005-11-08 4862 e98a235fdfce57 Yu Kuai 2023-05-31 4863 if (mddev_lock(mddev)) e98a235fdfce57 Yu Kuai 2023-05-31 4864 return; e98a235fdfce57 Yu Kuai 2023-05-31 4865 e98a235fdfce57 Yu Kuai 2023-05-31 4866 /* e98a235fdfce57 Yu Kuai 2023-05-31 4867 * Check again in case MD_RECOVERY_RUNNING is cleared before lock is e98a235fdfce57 Yu Kuai 2023-05-31 4868 * held. e98a235fdfce57 Yu Kuai 2023-05-31 4869 */ e98a235fdfce57 Yu Kuai 2023-05-31 4870 if (!test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)) { e98a235fdfce57 Yu Kuai 2023-05-31 4871 mddev_unlock(mddev); e98a235fdfce57 Yu Kuai 2023-05-31 4872 return; e98a235fdfce57 Yu Kuai 2023-05-31 4873 } 56ccc1125bc141 NeilBrown 2015-05-28 4874 cc1ffe61c026e2 Guoqing Jiang 2020-04-04 4875 if (work_pending(&mddev->del_work)) f851b60db0fd83 NeilBrown 2014-12-11 4876 flush_workqueue(md_misc_wq); e98a235fdfce57 Yu Kuai 2023-05-31 4877 7eec314d7512d5 NeilBrown 2005-11-08 4878 set_bit(MD_RECOVERY_INTR, &mddev->recovery); 1ade24b66e5223 Yu Kuai 2023-05-31 4879 /* 1ade24b66e5223 Yu Kuai 2023-05-31 4880 * Thread might be blocked waiting for metadata update which will now 1ade24b66e5223 Yu Kuai 2023-05-31 4881 * never happen. 1ade24b66e5223 Yu Kuai 2023-05-31 4882 */ 1ade24b66e5223 Yu Kuai 2023-05-31 4883 if (mddev->sync_thread) 1ade24b66e5223 Yu Kuai 2023-05-31 @4884 wake_up_process(mddev->sync_thread->tsk); e98a235fdfce57 Yu Kuai 2023-05-31 4885 8e8e2518fceca4 NeilBrown 2015-06-12 4886 mddev_unlock(mddev); 7eec314d7512d5 NeilBrown 2005-11-08 4887 } e98a235fdfce57 Yu Kuai 2023-05-31 4888 :::::: The code at line 4884 was first introduced by commit :::::: 1ade24b66e52235723afa4554f8cf6ecc2fb29b4 md: refactor idle/frozen_sync_thread() :::::: TO: Yu Kuai <yukuai3(a)huawei.com> :::::: CC: Jialin Zhang <zhangjialin11(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 4865/30000] arch/x86/lib/copy_highpages.c:10:1: sparse: sparse: symbol 'hugepage_nocache_copy' was not declared. Should it be static?
by kernel test robot 11 Sep '24

11 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: a6042799048d28282f37a2a254f2757cea2c780a commit: 50d5bf1b6da9f74bf93f9dec601c09d45d6d8406 [4865/30000] x86: hugepage: use nt copy hugepage to AEP in x86 config: x86_64-randconfig-123-20240910 (https://download.01.org/0day-ci/archive/20240911/202409111327.wMHIgHKQ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240911/202409111327.wMHIgHKQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409111327.wMHIgHKQ-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/x86/lib/copy_highpages.c:10:1: sparse: sparse: symbol 'hugepage_nocache_copy' was not declared. Should it be static? >> arch/x86/lib/copy_highpages.c:33:47: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ arch/x86/lib/copy_highpages.c:33:47: sparse: expected void * arch/x86/lib/copy_highpages.c:33:47: sparse: got void [noderef] __user *buffer >> arch/x86/lib/copy_highpages.c:20:5: sparse: sparse: symbol 'sysctl_hugepage_nocache_copy' was not declared. Should it be static? >> arch/x86/lib/copy_highpages.c:47:35: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ arch/x86/lib/copy_highpages.c:47:35: sparse: expected int ( [usertype] *proc_handler )( ... ) arch/x86/lib/copy_highpages.c:47:35: sparse: got int ( * )( ... ) vim +/hugepage_nocache_copy +10 arch/x86/lib/copy_highpages.c 9 > 10 DEFINE_STATIC_KEY_FALSE(hugepage_nocache_copy); 11 #ifdef CONFIG_SYSCTL 12 static void set_hugepage_nocache_copy(bool enabled) 13 { 14 if (enabled) 15 static_branch_enable(&hugepage_nocache_copy); 16 else 17 static_branch_disable(&hugepage_nocache_copy); 18 } 19 > 20 int sysctl_hugepage_nocache_copy(struct ctl_table *table, int write, 21 void __user *buffer, size_t *lenp, loff_t *ppos) 22 { 23 struct ctl_table t; 24 int err; 25 int state; 26 27 if (write && !capable(CAP_SYS_ADMIN)) 28 return -EPERM; 29 30 state = static_branch_unlikely(&hugepage_nocache_copy); 31 t = *table; 32 t.data = &state; > 33 err = proc_dointvec_minmax(&t, write, buffer, lenp, ppos); 34 if (err < 0) 35 return err; 36 if (write) 37 set_hugepage_nocache_copy(state); 38 return err; 39 } 40 41 static struct ctl_table copy_highpages_table[] = { 42 { 43 .procname = "hugepage_nocache_copy", 44 .data = NULL, 45 .maxlen = sizeof(unsigned int), 46 .mode = 0600, > 47 .proc_handler = sysctl_hugepage_nocache_copy, 48 .extra1 = SYSCTL_ZERO, 49 .extra2 = SYSCTL_ONE, 50 }, 51 {} 52 }; 53 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 5003/30000] kernel/watchdog_hld.c:502:12: sparse: sparse: symbol '__hardlockup_detector_perf_init' was not declared. Should it be static?
by kernel test robot 11 Sep '24

11 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: a6042799048d28282f37a2a254f2757cea2c780a commit: 364de98eacea8dbfe4f926f62085aebf8534f403 [5003/30000] watchdog: Fix sleeping function called from atomic context config: x86_64-randconfig-121-20240910 (https://download.01.org/0day-ci/archive/20240911/202409111340.yXGUhELN-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240911/202409111340.yXGUhELN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409111340.yXGUhELN-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/watchdog_hld.c:502:12: sparse: sparse: symbol '__hardlockup_detector_perf_init' was not declared. Should it be static? vim +/__hardlockup_detector_perf_init +502 kernel/watchdog_hld.c 501 > 502 int __init __hardlockup_detector_perf_init(void *not_used) 503 { 504 int ret = hardlockup_detector_event_create(); 505 506 if (ret) { 507 pr_info("Perf NMI watchdog permanently disabled\n"); 508 } else { 509 perf_event_release_kernel(this_cpu_read(watchdog_ev)); 510 this_cpu_write(watchdog_ev, NULL); 511 } 512 return ret; 513 } 514 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 14935/23703] lib/.tmp_test_free_pages.o: warning: objtool: missing symbol for section .text
by kernel test robot 11 Sep '24

11 Sep '24

Hi Matthew, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bf039567abd9303dc03746afaaf0854f41ed853b commit: 07bfcd6945a587611c2812377494457fd2c4c452 [14935/23703] mm/page_alloc.c: fix freeing non-compound pages config: x86_64-buildonly-randconfig-006-20240911 (https://download.01.org/0day-ci/archive/20240911/202409111103.p0J9Jp9h-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240911/202409111103.p0J9Jp9h-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409111103.p0J9Jp9h-lkp@intel.com/ All warnings (new ones prefixed by >>): >> lib/.tmp_test_free_pages.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS 45123fed2e3c4f1226b2fe97dac23441dabb6926
by kernel test robot 11 Sep '24

11 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 45123fed2e3c4f1226b2fe97dac23441dabb6926 !11485 Bugfix introduced when support folio Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kernel-virtcca_cvm_host.c:warning:no-previous-prototype-for-function-is_virtcca_cvm_enable | |-- arch-arm64-kvm-tmi.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs | |-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:no-previous-prototype-for-function-virtcca_smmu_evtq_thread | `-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:no-previous-prototype-for-function-virtcca_smmu_gerror_handler |-- arm64-allnoconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-defconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-001-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-002-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-003-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-004-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-allmodconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-allnoconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-defconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-randconfig-001-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-randconfig-002-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-allyesconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-002-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-004-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-defconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-003-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-006-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-011-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-012-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-071-20240911 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs `-- x86_64-rhel-8.3-rust `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs elapsed time: 833m configs tested: 36 configs skipped: 117 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240911 clang-20 arm64 randconfig-002-20240911 clang-15 arm64 randconfig-003-20240911 clang-20 arm64 randconfig-004-20240911 clang-15 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch defconfig gcc-14.1.0 loongarch randconfig-001-20240911 gcc-14.1.0 loongarch randconfig-002-20240911 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240911 clang-18 x86_64 buildonly-randconfig-002-20240911 clang-18 x86_64 buildonly-randconfig-003-20240911 gcc-12 x86_64 buildonly-randconfig-004-20240911 gcc-12 x86_64 buildonly-randconfig-005-20240911 gcc-12 x86_64 buildonly-randconfig-006-20240911 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240911 gcc-12 x86_64 randconfig-002-20240911 gcc-12 x86_64 randconfig-003-20240911 clang-18 x86_64 randconfig-004-20240911 clang-18 x86_64 randconfig-005-20240911 clang-18 x86_64 randconfig-006-20240911 gcc-12 x86_64 randconfig-011-20240911 clang-18 x86_64 randconfig-012-20240911 clang-18 x86_64 randconfig-013-20240911 gcc-12 x86_64 randconfig-014-20240911 clang-18 x86_64 randconfig-015-20240911 gcc-12 x86_64 randconfig-016-20240911 clang-18 x86_64 randconfig-071-20240911 clang-18 x86_64 randconfig-072-20240911 gcc-11 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/3] Fix CVE-2022-48887
by Huang Xiaojia 11 Sep '24

11 Sep '24

Huang Xiaojia (2): drm/vmwgfx: Introduce ttm reference object find function drm/vmwgfx: Remove vmw_user_bo_noref_release Zack Rusin (1): drm/vmwgfx: Remove rcu locks from user resources drivers/gpu/drm/drm_hashtab.c | 5 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 55 +++---- drivers/gpu/drm/vmwgfx/ttm_object.h | 14 -- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 42 ------ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 27 +--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 176 +++++++++++------------ drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 35 ----- include/drm/drm_hashtab.h | 2 + 8 files changed, 105 insertions(+), 251 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS-SP1 0/3] Fix CVE-2022-48887
by Huang Xiaojia 11 Sep '24

11 Sep '24

Huang Xiaojia (2): drm/vmwgfx: Introduce ttm reference object find function drm/vmwgfx: Remove vmw_user_bo_noref_release Zack Rusin (1): drm/vmwgfx: Remove rcu locks from user resources drivers/gpu/drm/drm_hashtab.c | 5 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 55 +++---- drivers/gpu/drm/vmwgfx/ttm_object.h | 14 -- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 42 ------ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 27 +--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 176 +++++++++++------------ drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 35 ----- include/drm/drm_hashtab.h | 2 + 8 files changed, 105 insertions(+), 251 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] ext4: Fix race in buffer_head read fault injection
by Long Li 11 Sep '24

11 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAQ487 CVE: NA -------------------------------- When I enabled ext4 debug for fault injection testing, I encountered the following warning: EXT4-fs error (device sda): ext4_read_inode_bitmap:201: comm fsstress: Cannot read inode bitmap - block_group = 8, inode_bitmap = 1051 WARNING: CPU: 0 PID: 511 at fs/buffer.c:1181 mark_buffer_dirty+0x1b3/0x1d0 The root cause of the issue lies in the improper implementation of ext4's buffer_head read fault injection. The actual completion of buffer_head read and the buffer_head fault injection are not atomic, which can lead to the uptodate flag being cleared on normally used buffer_heads in race conditions. [CPU0] [CPU1] [CPU2] ext4_read_inode_bitmap ext4_read_bh() <bh read complete> ext4_read_inode_bitmap if (buffer_uptodate(bh)) return bh jbd2_journal_commit_transaction __jbd2_journal_refile_buffer __jbd2_journal_unfile_buffer __jbd2_journal_temp_unlink_buffer ext4_simulate_fail_bh() clear_buffer_uptodate mark_buffer_dirty <report warning> WARN_ON_ONCE(!buffer_uptodate(bh)) The best approach would be to perform fault injection in the IO completion callback function, rather than after IO completion. However, the IO completion callback function cannot get the fault injection code in sb. Fix it by passing the result of fault injection into the bh read function, we simulate faults within the bh read function itself. This requires adding an extra parameter to the bh read functions that need fault injection. Fixes: 46f870d690fe ("ext4: simulate various I/O and checksum errors when reading metadata") Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ext4/balloc.c | 4 ++-- fs/ext4/ext4.h | 12 ++---------- fs/ext4/extents.c | 2 +- fs/ext4/ialloc.c | 5 +++-- fs/ext4/indirect.c | 2 +- fs/ext4/inode.c | 4 ++-- fs/ext4/mmp.c | 2 +- fs/ext4/move_extent.c | 2 +- fs/ext4/resize.c | 2 +- fs/ext4/super.c | 23 +++++++++++++++-------- 10 files changed, 29 insertions(+), 29 deletions(-) diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c index 79b20d6ae39e..396474e9e2bf 100644 --- a/fs/ext4/balloc.c +++ b/fs/ext4/balloc.c @@ -545,7 +545,8 @@ ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group, trace_ext4_read_block_bitmap_load(sb, block_group, ignore_locked); ext4_read_bh_nowait(bh, REQ_META | REQ_PRIO | (ignore_locked ? REQ_RAHEAD : 0), - ext4_end_bitmap_read); + ext4_end_bitmap_read, + ext4_simulate_fail(sb, EXT4_SIM_BBITMAP_EIO)); return bh; verify: err = ext4_validate_block_bitmap(sb, desc, block_group, bh); @@ -569,7 +570,6 @@ int ext4_wait_block_bitmap(struct super_block *sb, ext4_group_t block_group, if (!desc) return -EFSCORRUPTED; wait_on_buffer(bh); - ext4_simulate_fail_bh(sb, bh, EXT4_SIM_BBITMAP_EIO); if (!buffer_uptodate(bh)) { ext4_error_err(sb, EIO, "Cannot read block bitmap - " "block_group = %u, block_bitmap = %llu", diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index a6a2981526ef..3f914d4c6d98 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -1866,14 +1866,6 @@ static inline bool ext4_simulate_fail(struct super_block *sb, return false; } -static inline void ext4_simulate_fail_bh(struct super_block *sb, - struct buffer_head *bh, - unsigned long code) -{ - if (!IS_ERR(bh) && ext4_simulate_fail(sb, code)) - clear_buffer_uptodate(bh); -} - /* * Error number codes for s_{first,last}_error_errno * @@ -3092,9 +3084,9 @@ extern struct buffer_head *ext4_sb_bread(struct super_block *sb, extern struct buffer_head *ext4_sb_bread_unmovable(struct super_block *sb, sector_t block); extern void ext4_read_bh_nowait(struct buffer_head *bh, blk_opf_t op_flags, - bh_end_io_t *end_io); + bh_end_io_t *end_io, bool simu_fail); extern int ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags, - bh_end_io_t *end_io); + bh_end_io_t *end_io, bool simu_fail); extern int ext4_read_bh_lock(struct buffer_head *bh, blk_opf_t op_flags, bool wait); extern void ext4_sb_breadahead_unmovable(struct super_block *sb, sector_t block); extern int ext4_seq_options_show(struct seq_file *seq, void *offset); diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 2f73c0d9e9e9..d618ff9b6b94 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -564,7 +564,7 @@ __read_extent_tree_block(const char *function, unsigned int line, if (!bh_uptodate_or_lock(bh)) { trace_ext4_ext_load_extent(inode, pblk, _RET_IP_); - err = ext4_read_bh(bh, 0, NULL); + err = ext4_read_bh(bh, 0, NULL, false); if (err < 0) goto errout; } diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c index a72c7167c33f..ea0fe973aca0 100644 --- a/fs/ext4/ialloc.c +++ b/fs/ext4/ialloc.c @@ -194,8 +194,9 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group) * submit the buffer_head for reading */ trace_ext4_load_inode_bitmap(sb, block_group); - ext4_read_bh(bh, REQ_META | REQ_PRIO, ext4_end_bitmap_read); - ext4_simulate_fail_bh(sb, bh, EXT4_SIM_IBITMAP_EIO); + ext4_read_bh(bh, REQ_META | REQ_PRIO, + ext4_end_bitmap_read, + ext4_simulate_fail(sb, EXT4_SIM_IBITMAP_EIO)); if (!buffer_uptodate(bh)) { put_bh(bh); ext4_error_err(sb, EIO, "Cannot read inode bitmap - " diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c index a9f3716119d3..f2c495b745f1 100644 --- a/fs/ext4/indirect.c +++ b/fs/ext4/indirect.c @@ -170,7 +170,7 @@ static Indirect *ext4_get_branch(struct inode *inode, int depth, } if (!bh_uptodate_or_lock(bh)) { - if (ext4_read_bh(bh, 0, NULL) < 0) { + if (ext4_read_bh(bh, 0, NULL, false) < 0) { put_bh(bh); goto failure; } diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index ef5dfb994f0e..c0b2c6720a66 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -5083,10 +5083,10 @@ static int __ext4_get_inode_loc(struct super_block *sb, unsigned long ino, * Read the block from disk. */ trace_ext4_load_inode(sb, ino); - ext4_read_bh_nowait(bh, REQ_META | REQ_PRIO, NULL); + ext4_read_bh_nowait(bh, REQ_META | REQ_PRIO, NULL, + ext4_simulate_fail(sb, EXT4_SIM_INODE_EIO)); blk_finish_plug(&plug); wait_on_buffer(bh); - ext4_simulate_fail_bh(sb, bh, EXT4_SIM_INODE_EIO); if (!buffer_uptodate(bh)) { if (ret_block) *ret_block = block; diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c index bd946d0c71b7..d64c04ed061a 100644 --- a/fs/ext4/mmp.c +++ b/fs/ext4/mmp.c @@ -94,7 +94,7 @@ static int read_mmp_block(struct super_block *sb, struct buffer_head **bh, } lock_buffer(*bh); - ret = ext4_read_bh(*bh, REQ_META | REQ_PRIO, NULL); + ret = ext4_read_bh(*bh, REQ_META | REQ_PRIO, NULL, false); if (ret) goto warn_exit; diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c index afd7869cae9a..2b6288c2df43 100644 --- a/fs/ext4/move_extent.c +++ b/fs/ext4/move_extent.c @@ -221,7 +221,7 @@ mext_page_mkuptodate(struct folio *folio, unsigned from, unsigned to) for (i = 0; i < nr; i++) { bh = arr[i]; if (!bh_uptodate_or_lock(bh)) { - err = ext4_read_bh(bh, 0, NULL); + err = ext4_read_bh(bh, 0, NULL, false); if (err) return err; } diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index 5f105171df7b..b34007541e08 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1301,7 +1301,7 @@ static struct buffer_head *ext4_get_bitmap(struct super_block *sb, __u64 block) if (unlikely(!bh)) return NULL; if (!bh_uptodate_or_lock(bh)) { - if (ext4_read_bh(bh, 0, NULL) < 0) { + if (ext4_read_bh(bh, 0, NULL, false) < 0) { brelse(bh); return NULL; } diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 9f3c7855095d..78a4324178db 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -185,8 +185,14 @@ MODULE_ALIAS("ext3"); static inline void __ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags, - bh_end_io_t *end_io) + bh_end_io_t *end_io, bool simu_fail) { + if (simu_fail) { + clear_buffer_uptodate(bh); + unlock_buffer(bh); + return; + } + /* * buffer's verified bit is no longer valid after reading from * disk again due to write out error, clear it to make sure we @@ -200,7 +206,7 @@ static inline void __ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags, } void ext4_read_bh_nowait(struct buffer_head *bh, blk_opf_t op_flags, - bh_end_io_t *end_io) + bh_end_io_t *end_io, bool simu_fail) { BUG_ON(!buffer_locked(bh)); @@ -208,10 +214,11 @@ void ext4_read_bh_nowait(struct buffer_head *bh, blk_opf_t op_flags, unlock_buffer(bh); return; } - __ext4_read_bh(bh, op_flags, end_io); + __ext4_read_bh(bh, op_flags, end_io, simu_fail); } -int ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags, bh_end_io_t *end_io) +int ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags, + bh_end_io_t *end_io, bool simu_fail) { BUG_ON(!buffer_locked(bh)); @@ -220,7 +227,7 @@ int ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags, bh_end_io_t *end_io return 0; } - __ext4_read_bh(bh, op_flags, end_io); + __ext4_read_bh(bh, op_flags, end_io, simu_fail); wait_on_buffer(bh); if (buffer_uptodate(bh)) @@ -232,10 +239,10 @@ int ext4_read_bh_lock(struct buffer_head *bh, blk_opf_t op_flags, bool wait) { lock_buffer(bh); if (!wait) { - ext4_read_bh_nowait(bh, op_flags, NULL); + ext4_read_bh_nowait(bh, op_flags, NULL, false); return 0; } - return ext4_read_bh(bh, op_flags, NULL); + return ext4_read_bh(bh, op_flags, NULL, false); } /* @@ -283,7 +290,7 @@ void ext4_sb_breadahead_unmovable(struct super_block *sb, sector_t block) if (likely(bh)) { if (trylock_buffer(bh)) - ext4_read_bh_nowait(bh, REQ_RAHEAD, NULL); + ext4_read_bh_nowait(bh, REQ_RAHEAD, NULL, false); brelse(bh); } } -- 2.39.2

2 1

[PATCH OLK-5.10] ext4: Fix race in buffer_head read fault injection
by Long Li 11 Sep '24

11 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAQ8ED CVE: NA -------------------------------- When I enabled ext4 debug for fault injection testing, I encountered the following warning: EXT4-fs error (device sda): ext4_read_inode_bitmap:201: comm fsstress: Cannot read inode bitmap - block_group = 8, inode_bitmap = 1051 WARNING: CPU: 0 PID: 511 at fs/buffer.c:1181 mark_buffer_dirty+0x1b3/0x1d0 The root cause of the issue lies in the improper implementation of ext4's buffer_head read fault injection. The actual completion of buffer_head read and the buffer_head fault injection are not atomic, which can lead to the uptodate flag being cleared on normally used buffer_heads in race conditions. [CPU0] [CPU1] [CPU2] ext4_read_inode_bitmap ext4_read_bh() <bh read complete> ext4_read_inode_bitmap if (buffer_uptodate(bh)) return bh jbd2_journal_commit_transaction __jbd2_journal_refile_buffer __jbd2_journal_unfile_buffer __jbd2_journal_temp_unlink_buffer ext4_simulate_fail_bh() clear_buffer_uptodate mark_buffer_dirty <report warning> WARN_ON_ONCE(!buffer_uptodate(bh)) The best approach would be to perform fault injection in the IO completion callback function, rather than after IO completion. However, the IO completion callback function cannot get the fault injection code in sb. Fix it by passing the result of fault injection into the bh read function, we simulate faults within the bh read function itself. This requires adding an extra parameter to the bh read functions that need fault injection. Fixes: 46f870d690fe ("ext4: simulate various I/O and checksum errors when reading metadata") Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ext4/balloc.c | 4 ++-- fs/ext4/ext4.h | 12 ++---------- fs/ext4/extents.c | 2 +- fs/ext4/ialloc.c | 5 +++-- fs/ext4/indirect.c | 2 +- fs/ext4/inode.c | 4 ++-- fs/ext4/mmp.c | 2 +- fs/ext4/move_extent.c | 2 +- fs/ext4/resize.c | 2 +- fs/ext4/super.c | 22 ++++++++++++++-------- 10 files changed, 28 insertions(+), 29 deletions(-) diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c index bdbf130416c7..43ce0f3266b5 100644 --- a/fs/ext4/balloc.c +++ b/fs/ext4/balloc.c @@ -541,7 +541,8 @@ ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group, trace_ext4_read_block_bitmap_load(sb, block_group, ignore_locked); ext4_read_bh_nowait(bh, REQ_META | REQ_PRIO | (ignore_locked ? REQ_RAHEAD : 0), - ext4_end_bitmap_read); + ext4_end_bitmap_read, + ext4_simulate_fail(sb, EXT4_SIM_BBITMAP_EIO)); return bh; verify: err = ext4_validate_block_bitmap(sb, desc, block_group, bh); @@ -565,7 +566,6 @@ int ext4_wait_block_bitmap(struct super_block *sb, ext4_group_t block_group, if (!desc) return -EFSCORRUPTED; wait_on_buffer(bh); - ext4_simulate_fail_bh(sb, bh, EXT4_SIM_BBITMAP_EIO); if (!buffer_uptodate(bh)) { ext4_error_err(sb, EIO, "Cannot read block bitmap - " "block_group = %u, block_bitmap = %llu", diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index b701f7ac7f66..99a767123ebf 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -1779,14 +1779,6 @@ static inline bool ext4_simulate_fail(struct super_block *sb, return false; } -static inline void ext4_simulate_fail_bh(struct super_block *sb, - struct buffer_head *bh, - unsigned long code) -{ - if (!IS_ERR(bh) && ext4_simulate_fail(sb, code)) - clear_buffer_uptodate(bh); -} - /* * Error number codes for s_{first,last}_error_errno * @@ -2995,9 +2987,9 @@ extern struct buffer_head *ext4_sb_bread(struct super_block *sb, extern struct buffer_head *ext4_sb_bread_unmovable(struct super_block *sb, sector_t block); extern void ext4_read_bh_nowait(struct buffer_head *bh, int op_flags, - bh_end_io_t *end_io); + bh_end_io_t *end_io, bool simu_fail); extern int ext4_read_bh(struct buffer_head *bh, int op_flags, - bh_end_io_t *end_io); + bh_end_io_t *end_io, bool simu_fail); extern int ext4_read_bh_lock(struct buffer_head *bh, int op_flags, bool wait); extern void ext4_sb_breadahead_unmovable(struct super_block *sb, sector_t block); extern int ext4_seq_options_show(struct seq_file *seq, void *offset); diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 71503987d313..31d5061f1408 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -544,7 +544,7 @@ __read_extent_tree_block(const char *function, unsigned int line, if (!bh_uptodate_or_lock(bh)) { trace_ext4_ext_load_extent(inode, pblk, _RET_IP_); - err = ext4_read_bh(bh, 0, NULL); + err = ext4_read_bh(bh, 0, NULL, false); if (err < 0) goto errout; } diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c index d178543ca13f..b0d0ca8f4389 100644 --- a/fs/ext4/ialloc.c +++ b/fs/ext4/ialloc.c @@ -194,8 +194,9 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group) * submit the buffer_head for reading */ trace_ext4_load_inode_bitmap(sb, block_group); - ext4_read_bh(bh, REQ_META | REQ_PRIO, ext4_end_bitmap_read); - ext4_simulate_fail_bh(sb, bh, EXT4_SIM_IBITMAP_EIO); + ext4_read_bh(bh, REQ_META | REQ_PRIO, + ext4_end_bitmap_read, + ext4_simulate_fail(sb, EXT4_SIM_IBITMAP_EIO)); if (!buffer_uptodate(bh)) { put_bh(bh); ext4_error_err(sb, EIO, "Cannot read inode bitmap - " diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c index c2bb2ff3fbb6..f1e62f40341e 100644 --- a/fs/ext4/indirect.c +++ b/fs/ext4/indirect.c @@ -170,7 +170,7 @@ static Indirect *ext4_get_branch(struct inode *inode, int depth, } if (!bh_uptodate_or_lock(bh)) { - if (ext4_read_bh(bh, 0, NULL) < 0) { + if (ext4_read_bh(bh, 0, NULL, false) < 0) { put_bh(bh); goto failure; } diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index ad7918c8df7b..d956ba3cd6f7 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -4625,10 +4625,10 @@ static int __ext4_get_inode_loc(struct super_block *sb, unsigned long ino, * Read the block from disk. */ trace_ext4_load_inode(sb, ino); - ext4_read_bh_nowait(bh, REQ_META | REQ_PRIO, NULL); + ext4_read_bh_nowait(bh, REQ_META | REQ_PRIO, NULL, + ext4_simulate_fail(sb, EXT4_SIM_INODE_EIO)); blk_finish_plug(&plug); wait_on_buffer(bh); - ext4_simulate_fail_bh(sb, bh, EXT4_SIM_INODE_EIO); if (!buffer_uptodate(bh)) { if (ret_block) *ret_block = block; diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c index 3e8bce19ad16..4a6d7488d1ec 100644 --- a/fs/ext4/mmp.c +++ b/fs/ext4/mmp.c @@ -94,7 +94,7 @@ static int read_mmp_block(struct super_block *sb, struct buffer_head **bh, } lock_buffer(*bh); - ret = ext4_read_bh(*bh, REQ_META | REQ_PRIO, NULL); + ret = ext4_read_bh(*bh, REQ_META | REQ_PRIO, NULL, false); if (ret) goto warn_exit; diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c index f8dd5d972c33..f3d06beb79b2 100644 --- a/fs/ext4/move_extent.c +++ b/fs/ext4/move_extent.c @@ -215,7 +215,7 @@ mext_page_mkuptodate(struct page *page, unsigned from, unsigned to) for (i = 0; i < nr; i++) { bh = arr[i]; if (!bh_uptodate_or_lock(bh)) { - err = ext4_read_bh(bh, 0, NULL); + err = ext4_read_bh(bh, 0, NULL, false); if (err) return err; } diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index 9edc8da921f4..84184c40f99b 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1266,7 +1266,7 @@ static struct buffer_head *ext4_get_bitmap(struct super_block *sb, __u64 block) if (unlikely(!bh)) return NULL; if (!bh_uptodate_or_lock(bh)) { - if (ext4_read_bh(bh, 0, NULL) < 0) { + if (ext4_read_bh(bh, 0, NULL, false) < 0) { brelse(bh); return NULL; } diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 0a20e0734904..b07fb8abe813 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -168,8 +168,13 @@ MODULE_ALIAS("ext3"); static inline void __ext4_read_bh(struct buffer_head *bh, int op_flags, - bh_end_io_t *end_io) + bh_end_io_t *end_io, bool simu_fail) { + if (simu_fail) { + clear_buffer_uptodate(bh); + unlock_buffer(bh); + return; + } /* * buffer's verified bit is no longer valid after reading from * disk again due to write out error, clear it to make sure we @@ -183,7 +188,7 @@ static inline void __ext4_read_bh(struct buffer_head *bh, int op_flags, } void ext4_read_bh_nowait(struct buffer_head *bh, int op_flags, - bh_end_io_t *end_io) + bh_end_io_t *end_io, bool simu_fail) { BUG_ON(!buffer_locked(bh)); @@ -191,10 +196,11 @@ void ext4_read_bh_nowait(struct buffer_head *bh, int op_flags, unlock_buffer(bh); return; } - __ext4_read_bh(bh, op_flags, end_io); + __ext4_read_bh(bh, op_flags, end_io, simu_fail); } -int ext4_read_bh(struct buffer_head *bh, int op_flags, bh_end_io_t *end_io) +int ext4_read_bh(struct buffer_head *bh, int op_flags, + bh_end_io_t *end_io, bool simu_fail) { BUG_ON(!buffer_locked(bh)); @@ -203,7 +209,7 @@ int ext4_read_bh(struct buffer_head *bh, int op_flags, bh_end_io_t *end_io) return 0; } - __ext4_read_bh(bh, op_flags, end_io); + __ext4_read_bh(bh, op_flags, end_io, simu_fail); wait_on_buffer(bh); if (buffer_uptodate(bh)) @@ -215,10 +221,10 @@ int ext4_read_bh_lock(struct buffer_head *bh, int op_flags, bool wait) { lock_buffer(bh); if (!wait) { - ext4_read_bh_nowait(bh, op_flags, NULL); + ext4_read_bh_nowait(bh, op_flags, NULL, false); return 0; } - return ext4_read_bh(bh, op_flags, NULL); + return ext4_read_bh(bh, op_flags, NULL, false); } /* @@ -266,7 +272,7 @@ void ext4_sb_breadahead_unmovable(struct super_block *sb, sector_t block) if (likely(bh)) { if (trylock_buffer(bh)) - ext4_read_bh_nowait(bh, REQ_RAHEAD, NULL); + ext4_read_bh_nowait(bh, REQ_RAHEAD, NULL, false); brelse(bh); } } -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 20076/23703] arch/x86/power/cpu.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 11 Sep '24

11 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bf039567abd9303dc03746afaaf0854f41ed853b commit: 27dd57ae7b305c8c1bcf55eab82c45d85b605149 [20076/23703] x86/cpu: Load microcode during restore_processor_state() config: x86_64-buildonly-randconfig-003-20240911 (https://download.01.org/0day-ci/archive/20240911/202409110927.XJnvEERE-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240911/202409110927.XJnvEERE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409110927.XJnvEERE-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/power/cpu.c:78: warning: Function parameter or member 'ctxt' not described in '__save_processor_state' arch/x86/power/cpu.c:200: warning: Function parameter or member 'ctxt' not described in '__restore_processor_state' >> arch/x86/power/cpu.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 26326/30000] fs/quota/dquot.c:1699:25: sparse: sparse: incompatible types in comparison expression (different address spaces):
by kernel test robot 11 Sep '24

11 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: cbfb00d89c3b9971c3f0732b4f34d4e674bff5d8 commit: b6c35c29c4b795fa72f7acecb07e94502f159bec [26326/30000] quota: Fix potential NULL pointer dereference config: x86_64-randconfig-122-20240910 (https://download.01.org/0day-ci/archive/20240911/202409110955.mmx8Aa4b-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240911/202409110955.mmx8Aa4b-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409110955.mmx8Aa4b-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> fs/quota/dquot.c:1699:25: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:1699:25: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:1699:25: sparse: struct dquot * fs/quota/dquot.c:1710:41: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:1710:41: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:1710:41: sparse: struct dquot * fs/quota/dquot.c:1760:25: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:1760:25: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:1760:25: sparse: struct dquot * fs/quota/dquot.c:1766:41: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:1766:41: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:1766:41: sparse: struct dquot * fs/quota/dquot.c:1810:25: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:1810:25: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:1810:25: sparse: struct dquot * fs/quota/dquot.c:1852:25: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:1852:25: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:1852:25: sparse: struct dquot * fs/quota/dquot.c:1901:25: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:1901:25: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:1901:25: sparse: struct dquot * fs/quota/dquot.c:1949:25: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:1949:25: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:1949:25: sparse: struct dquot * fs/quota/dquot.c:409:25: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:409:25: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:409:25: sparse: struct dquot * fs/quota/dquot.c:409:25: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:409:25: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:409:25: sparse: struct dquot * fs/quota/dquot.c:409:25: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:409:25: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:409:25: sparse: struct dquot * fs/quota/dquot.c:409:25: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:409:25: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:409:25: sparse: struct dquot * fs/quota/dquot.c:409:25: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:409:25: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:409:25: sparse: struct dquot * fs/quota/dquot.c:409:25: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:409:25: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:409:25: sparse: struct dquot * fs/quota/dquot.c:409:25: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:409:25: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:409:25: sparse: struct dquot * fs/quota/dquot.c:409:25: sparse: sparse: incompatible types in comparison expression (different address spaces): fs/quota/dquot.c:409:25: sparse: struct dquot [noderef] __rcu * fs/quota/dquot.c:409:25: sparse: struct dquot * vim +1699 fs/quota/dquot.c 1659 1660 /* 1661 * This functions updates i_blocks+i_bytes fields and quota information 1662 * (together with appropriate checks). 1663 * 1664 * NOTE: We absolutely rely on the fact that caller dirties the inode 1665 * (usually helpers in quotaops.h care about this) and holds a handle for 1666 * the current transaction so that dquot write and inode write go into the 1667 * same transaction. 1668 */ 1669 1670 /* 1671 * This operation can block, but only after everything is updated 1672 */ 1673 int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) 1674 { 1675 int cnt, ret = 0, index; 1676 struct dquot_warn warn[MAXQUOTAS]; 1677 int reserve = flags & DQUOT_SPACE_RESERVE; 1678 struct dquot **dquots; 1679 struct dquot *dquot; 1680 1681 if (!inode_quota_active(inode)) { 1682 if (reserve) { 1683 spin_lock(&inode->i_lock); 1684 *inode_reserved_space(inode) += number; 1685 spin_unlock(&inode->i_lock); 1686 } else { 1687 inode_add_bytes(inode, number); 1688 } 1689 goto out; 1690 } 1691 1692 for (cnt = 0; cnt < MAXQUOTAS; cnt++) 1693 warn[cnt].w_type = QUOTA_NL_NOWARN; 1694 1695 dquots = i_dquot(inode); 1696 index = srcu_read_lock(&dquot_srcu); 1697 spin_lock(&inode->i_lock); 1698 for (cnt = 0; cnt < MAXQUOTAS; cnt++) { > 1699 dquot = srcu_dereference(dquots[cnt], &dquot_srcu); 1700 if (!dquot) 1701 continue; 1702 if (reserve) { 1703 ret = dquot_add_space(dquot, 0, number, flags, &warn[cnt]); 1704 } else { 1705 ret = dquot_add_space(dquot, number, 0, flags, &warn[cnt]); 1706 } 1707 if (ret) { 1708 /* Back out changes we already did */ 1709 for (cnt--; cnt >= 0; cnt--) { 1710 dquot = srcu_dereference(dquots[cnt], &dquot_srcu); 1711 if (!dquot) 1712 continue; 1713 spin_lock(&dquot->dq_dqb_lock); 1714 if (reserve) 1715 dquot_free_reserved_space(dquot, number); 1716 else 1717 dquot_decr_space(dquot, number); 1718 spin_unlock(&dquot->dq_dqb_lock); 1719 } 1720 spin_unlock(&inode->i_lock); 1721 goto out_flush_warn; 1722 } 1723 } 1724 if (reserve) 1725 *inode_reserved_space(inode) += number; 1726 else 1727 __inode_add_bytes(inode, number); 1728 spin_unlock(&inode->i_lock); 1729 1730 if (reserve) 1731 goto out_flush_warn; 1732 mark_all_dquot_dirty(dquots); 1733 out_flush_warn: 1734 srcu_read_unlock(&dquot_srcu, index); 1735 flush_warnings(warn); 1736 out: 1737 return ret; 1738 } 1739 EXPORT_SYMBOL(__dquot_alloc_space); 1740 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS WITH WARNING bf039567abd9303dc03746afaaf0854f41ed853b
by kernel test robot 11 Sep '24

11 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: bf039567abd9303dc03746afaaf0854f41ed853b !11434 v3 cifs: Fix pages leak when cifs_writedata allocate fails in cifs_writedata_direct_alloc() Warning reports: https://lore.kernel.org/oe-kbuild-all/202409110303.bhVqMzMo-lkp@intel.com Warning: (recently discovered and may have been fixed) arch/arm64/include/asm/irqflags.h:88:9: warning: 'flags' may be used uninitialized [-Wmaybe-uninitialized] Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | `-- include-linux-thread_info.h:warning:b-may-be-used-uninitialized |-- arm64-randconfig-002-20240911 | `-- arch-arm64-include-asm-irqflags.h:warning:flags-may-be-used-uninitialized |-- arm64-randconfig-003-20240911 | `-- drivers-tty-serial-sc16is7xx.c:warning:label-err_i2c-defined-but-not-used |-- x86_64-allyesconfig | `-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start `-- x86_64-buildonly-randconfig-005-20240911 `-- drivers-tty-serial-sc16is7xx.c:warning:label-err_i2c-defined-but-not-used elapsed time: 797m configs tested: 20 configs skipped: 139 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240911 gcc-14.1.0 arm64 randconfig-002-20240911 gcc-14.1.0 arm64 randconfig-003-20240911 gcc-14.1.0 arm64 randconfig-004-20240911 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240911 clang-18 x86_64 buildonly-randconfig-002-20240911 clang-18 x86_64 buildonly-randconfig-003-20240911 gcc-12 x86_64 buildonly-randconfig-004-20240911 gcc-12 x86_64 buildonly-randconfig-005-20240911 gcc-12 x86_64 buildonly-randconfig-006-20240911 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240911 gcc-12 x86_64 randconfig-002-20240911 gcc-12 x86_64 randconfig-003-20240911 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 16131/30000] net/core/sock_map.c:1501:5: sparse: sparse: symbol 'sock_map_prog_lookup' was not declared. Should it be static?
by kernel test robot 11 Sep '24

11 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: cbfb00d89c3b9971c3f0732b4f34d4e674bff5d8 commit: 050383882de382969e4fb8362235749b232cccae [16131/30000] bpf: support BPF_PROG_QUERY for progs attached to sockmap config: x86_64-randconfig-122-20240910 (https://download.01.org/0day-ci/archive/20240911/202409110644.OlZbU3Ny-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240911/202409110644.OlZbU3Ny-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409110644.OlZbU3Ny-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> net/core/sock_map.c:1501:5: sparse: sparse: symbol 'sock_map_prog_lookup' was not declared. Should it be static? vim +/sock_map_prog_lookup +1501 net/core/sock_map.c 1500 > 1501 int sock_map_prog_lookup(struct bpf_map *map, struct bpf_prog ***pprog, 1502 u32 which) 1503 { 1504 struct sk_psock_progs *progs = sock_map_progs(map); 1505 1506 if (!progs) 1507 return -EOPNOTSUPP; 1508 1509 switch (which) { 1510 case BPF_SK_MSG_VERDICT: 1511 *pprog = &progs->msg_parser; 1512 break; 1513 case BPF_SK_SKB_STREAM_PARSER: 1514 *pprog = &progs->skb_parser; 1515 break; 1516 case BPF_SK_SKB_STREAM_VERDICT: 1517 *pprog = &progs->skb_verdict; 1518 break; 1519 default: 1520 return -EOPNOTSUPP; 1521 } 1522 return 0; 1523 } 1524 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3790/30000] kernel/pid.c:623:50: sparse: sparse: incorrect type in argument 3 (different address spaces)
by kernel test robot 11 Sep '24

11 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: cbfb00d89c3b9971c3f0732b4f34d4e674bff5d8 commit: c649babf7cf25e545a7dc3eb6d59392ac3355cb9 [3790/30000] pid_ns: Make pid_max per namespace config: x86_64-randconfig-123-20240910 (https://download.01.org/0day-ci/archive/20240911/202409110524.f822gNQG-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240911/202409110524.f822gNQG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409110524.f822gNQG-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/pid.c:385:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/pid.c:385:9: sparse: struct pid [noderef] __rcu * kernel/pid.c:385:9: sparse: struct pid * kernel/pid.c:386:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/pid.c:386:9: sparse: struct pid [noderef] __rcu * kernel/pid.c:386:9: sparse: struct pid * kernel/pid.c:449:23: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/pid.c:449:23: sparse: struct pid [noderef] __rcu * kernel/pid.c:449:23: sparse: struct pid * kernel/pid.c:507:24: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/pid.c:507:24: sparse: struct pid [noderef] __rcu * kernel/pid.c:507:24: sparse: struct pid * >> kernel/pid.c:623:50: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ kernel/pid.c:623:50: sparse: expected void * kernel/pid.c:623:50: sparse: got void [noderef] __user *buffer >> kernel/pid.c:632:35: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ kernel/pid.c:632:35: sparse: expected int ( [usertype] *proc_handler )( ... ) kernel/pid.c:632:35: sparse: got int ( * )( ... ) kernel/pid.c: note: in included file (through include/linux/pid.h, include/linux/sched.h, include/linux/mm.h): include/linux/rculist.h:553:9: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/rculist.h:553:9: sparse: struct hlist_node [noderef] __rcu * include/linux/rculist.h:553:9: sparse: struct hlist_node * include/linux/rculist.h:554:9: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/rculist.h:554:9: sparse: struct hlist_node [noderef] __rcu * include/linux/rculist.h:554:9: sparse: struct hlist_node * vim +623 kernel/pid.c 614 615 static int proc_dointvec_pidmax(struct ctl_table *table, int write, 616 void __user *buffer, size_t *lenp, loff_t *ppos) 617 { 618 struct ctl_table tmp; 619 620 tmp = *table; 621 tmp.data = &task_active_pid_ns(current)->pid_max; 622 > 623 return proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 624 } 625 626 static struct ctl_table pid_ctl_table[] = { 627 { 628 .procname = "pid_max", 629 .data = &init_pid_ns.pid_max, 630 .maxlen = sizeof(int), 631 .mode = 0644, > 632 .proc_handler = proc_dointvec_pidmax, 633 .extra1 = &pid_max_min, 634 .extra2 = &pid_max_max, 635 }, 636 {} 637 }; 638 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 2662/23703] arch/arm64/include/asm/irqflags.h:88:9: warning: 'flags' may be used uninitialized
by kernel test robot 11 Sep '24

11 Sep '24

Hi Geert, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bf039567abd9303dc03746afaaf0854f41ed853b commit: 9dae7e237a64858407b7626260bad53aa13c9198 [2662/23703] serial: sh-sci: Fix locking in sci_submit_rx() config: arm64-randconfig-002-20240911 (https://download.01.org/0day-ci/archive/20240911/202409110303.bhVqMzMo-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240911/202409110303.bhVqMzMo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409110303.bhVqMzMo-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from include/linux/irqflags.h:16, from include/linux/spinlock.h:54, from include/linux/rwsem.h:16, from include/linux/notifier.h:15, from include/linux/clk.h:17, from drivers/tty/serial/sh-sci.c:24: In function 'arch_local_irq_restore', inlined from '__raw_spin_unlock_irqrestore' at include/linux/spinlock_api_smp.h:160:2, inlined from 'spin_unlock_irqrestore' at include/linux/spinlock.h:384:2, inlined from 'sci_submit_rx' at drivers/tty/serial/sh-sci.c:1376:3: >> arch/arm64/include/asm/irqflags.h:88:9: warning: 'flags' may be used uninitialized [-Wmaybe-uninitialized] 88 | asm volatile( | ^~~ drivers/tty/serial/sh-sci.c: In function 'sci_submit_rx': drivers/tty/serial/sh-sci.c:1338:23: note: 'flags' was declared here 1338 | unsigned long flags; | ^~~~~ In file included from drivers/tty/serial/sh-sci.c:53: In function 'tty_insert_flip_char', inlined from 'sci_handle_errors' at drivers/tty/serial/sh-sci.c:940:7: include/linux/tty_flip.h:27:53: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 27 | *flag_buf_ptr(tb, tb->used) = flag; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~ In file included from include/linux/serial_core.h:29, from include/linux/serial_sci.h:6, from drivers/tty/serial/sh-sci.c:46: include/linux/tty.h: In function 'sci_handle_errors': include/linux/tty.h:69:23: note: destination object 'data' of size 0 69 | unsigned long data[0]; | ^~~~ In function 'tty_insert_flip_char', inlined from 'sci_handle_errors' at drivers/tty/serial/sh-sci.c:940:7: include/linux/tty_flip.h:28:47: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 28 | *char_buf_ptr(tb, tb->used++) = ch; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~ include/linux/tty.h: In function 'sci_handle_errors': include/linux/tty.h:69:23: note: destination object 'data' of size 0 69 | unsigned long data[0]; | ^~~~ In function 'tty_insert_flip_char', inlined from 'sci_handle_errors' at drivers/tty/serial/sh-sci.c:950:7: include/linux/tty_flip.h:27:53: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 27 | *flag_buf_ptr(tb, tb->used) = flag; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~ include/linux/tty.h: In function 'sci_handle_errors': include/linux/tty.h:69:23: note: destination object 'data' of size 0 69 | unsigned long data[0]; | ^~~~ In function 'tty_insert_flip_char', inlined from 'sci_handle_errors' at drivers/tty/serial/sh-sci.c:950:7: include/linux/tty_flip.h:28:47: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 28 | *char_buf_ptr(tb, tb->used++) = ch; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~ include/linux/tty.h: In function 'sci_handle_errors': include/linux/tty.h:69:23: note: destination object 'data' of size 0 69 | unsigned long data[0]; | ^~~~ In function 'tty_insert_flip_char', inlined from 'sci_handle_errors' at drivers/tty/serial/sh-sci.c:960:7: include/linux/tty_flip.h:27:53: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 27 | *flag_buf_ptr(tb, tb->used) = flag; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~ include/linux/tty.h: In function 'sci_handle_errors': include/linux/tty.h:69:23: note: destination object 'data' of size 0 69 | unsigned long data[0]; | ^~~~ In function 'tty_insert_flip_char', inlined from 'sci_handle_errors' at drivers/tty/serial/sh-sci.c:960:7: include/linux/tty_flip.h:28:47: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 28 | *char_buf_ptr(tb, tb->used++) = ch; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~ include/linux/tty.h: In function 'sci_handle_errors': include/linux/tty.h:69:23: note: destination object 'data' of size 0 69 | unsigned long data[0]; | ^~~~ In function 'tty_insert_flip_char', inlined from 'sci_receive_chars' at drivers/tty/serial/sh-sci.c:906:5: include/linux/tty_flip.h:27:53: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 27 | *flag_buf_ptr(tb, tb->used) = flag; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~ include/linux/tty.h: In function 'sci_receive_chars': include/linux/tty.h:69:23: note: destination object 'data' of size 0 69 | unsigned long data[0]; | ^~~~ In function 'tty_insert_flip_char', inlined from 'sci_receive_chars' at drivers/tty/serial/sh-sci.c:906:5: include/linux/tty_flip.h:28:47: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 28 | *char_buf_ptr(tb, tb->used++) = ch; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~ include/linux/tty.h: In function 'sci_receive_chars': include/linux/tty.h:69:23: note: destination object 'data' of size 0 69 | unsigned long data[0]; | ^~~~ In function 'tty_insert_flip_char', inlined from 'sci_receive_chars' at drivers/tty/serial/sh-sci.c:883:5: include/linux/tty_flip.h:27:53: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 27 | *flag_buf_ptr(tb, tb->used) = flag; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~ include/linux/tty.h: In function 'sci_receive_chars': include/linux/tty.h:69:23: note: destination object 'data' of size 0 69 | unsigned long data[0]; | ^~~~ In function 'tty_insert_flip_char', inlined from 'sci_receive_chars' at drivers/tty/serial/sh-sci.c:883:5: include/linux/tty_flip.h:28:47: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 28 | *char_buf_ptr(tb, tb->used++) = ch; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~ include/linux/tty.h: In function 'sci_receive_chars': include/linux/tty.h:69:23: note: destination object 'data' of size 0 69 | unsigned long data[0]; | ^~~~ vim +/flags +88 arch/arm64/include/asm/irqflags.h fb9bd7d6df81ddf Marc Zyngier 2012-03-05 82 fb9bd7d6df81ddf Marc Zyngier 2012-03-05 83 /* fb9bd7d6df81ddf Marc Zyngier 2012-03-05 84 * restore saved IRQ state fb9bd7d6df81ddf Marc Zyngier 2012-03-05 85 */ fb9bd7d6df81ddf Marc Zyngier 2012-03-05 86 static inline void arch_local_irq_restore(unsigned long flags) fb9bd7d6df81ddf Marc Zyngier 2012-03-05 87 { fb9bd7d6df81ddf Marc Zyngier 2012-03-05 @88 asm volatile( fb9bd7d6df81ddf Marc Zyngier 2012-03-05 89 "msr daif, %0 // arch_local_irq_restore" fb9bd7d6df81ddf Marc Zyngier 2012-03-05 90 : fb9bd7d6df81ddf Marc Zyngier 2012-03-05 91 : "r" (flags) fb9bd7d6df81ddf Marc Zyngier 2012-03-05 92 : "memory"); fb9bd7d6df81ddf Marc Zyngier 2012-03-05 93 } fb9bd7d6df81ddf Marc Zyngier 2012-03-05 94 :::::: The code at line 88 was first introduced by commit :::::: fb9bd7d6df81ddf1e7ab6648ac89ddbe0625b26b arm64: IRQ handling :::::: TO: Marc Zyngier <marc.zyngier(a)arm.com> :::::: CC: Catalin Marinas <catalin.marinas(a)arm.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3775/30000] mm/page_alloc.c:3036:6: sparse: sparse: symbol '__drain_all_pages' was not declared. Should it be static?
by kernel test robot 11 Sep '24

11 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: cbfb00d89c3b9971c3f0732b4f34d4e674bff5d8 commit: e037ee4a8deaff7c579618c0aba1f066d6d14b11 [3775/30000] mm, page_alloc: disable pcplists during memory offline config: x86_64-randconfig-123-20240910 (https://download.01.org/0day-ci/archive/20240911/202409110302.AhDyE0gr-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240911/202409110302.AhDyE0gr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409110302.AhDyE0gr-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/page_alloc.c:3036:6: sparse: sparse: symbol '__drain_all_pages' was not declared. Should it be static? >> mm/page_alloc.c:6634:6: sparse: sparse: symbol '__zone_set_pageset_high_and_batch' was not declared. Should it be static? mm/page_alloc.c: note: in included file (through include/linux/mm.h): include/linux/gfp.h:327:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:327:27: sparse: sparse: restricted gfp_t degrades to integer vim +/__drain_all_pages +3036 mm/page_alloc.c 3025 3026 /* 3027 * The implementation of drain_all_pages(), exposing an extra parameter to 3028 * drain on all cpus. 3029 * 3030 * drain_all_pages() is optimized to only execute on cpus where pcplists are 3031 * not empty. The check for non-emptiness can however race with a free to 3032 * pcplist that has not yet increased the pcp->count from 0 to 1. Callers 3033 * that need the guarantee that every CPU has drained can disable the 3034 * optimizing racy check. 3035 */ > 3036 void __drain_all_pages(struct zone *zone, bool force_all_cpus) 3037 { 3038 int cpu; 3039 3040 /* 3041 * Allocate in the BSS so we wont require allocation in 3042 * direct reclaim path for CONFIG_CPUMASK_OFFSTACK=y 3043 */ 3044 static cpumask_t cpus_with_pcps; 3045 3046 /* 3047 * Make sure nobody triggers this path before mm_percpu_wq is fully 3048 * initialized. 3049 */ 3050 if (WARN_ON_ONCE(!mm_percpu_wq)) 3051 return; 3052 3053 /* 3054 * Do not drain if one is already in progress unless it's specific to 3055 * a zone. Such callers are primarily CMA and memory hotplug and need 3056 * the drain to be complete when the call returns. 3057 */ 3058 if (unlikely(!mutex_trylock(&pcpu_drain_mutex))) { 3059 if (!zone) 3060 return; 3061 mutex_lock(&pcpu_drain_mutex); 3062 } 3063 3064 /* 3065 * We don't care about racing with CPU hotplug event 3066 * as offline notification will cause the notified 3067 * cpu to drain that CPU pcps and on_each_cpu_mask 3068 * disables preemption as part of its processing 3069 */ 3070 for_each_online_cpu(cpu) { 3071 struct per_cpu_pageset *pcp; 3072 struct zone *z; 3073 bool has_pcps = false; 3074 3075 if (force_all_cpus) { 3076 /* 3077 * The pcp.count check is racy, some callers need a 3078 * guarantee that no cpu is missed. 3079 */ 3080 has_pcps = true; 3081 } else if (zone) { 3082 pcp = per_cpu_ptr(zone->pageset, cpu); 3083 if (pcp->pcp.count) 3084 has_pcps = true; 3085 } else { 3086 for_each_populated_zone(z) { 3087 pcp = per_cpu_ptr(z->pageset, cpu); 3088 if (pcp->pcp.count) { 3089 has_pcps = true; 3090 break; 3091 } 3092 } 3093 } 3094 3095 if (has_pcps) 3096 cpumask_set_cpu(cpu, &cpus_with_pcps); 3097 else 3098 cpumask_clear_cpu(cpu, &cpus_with_pcps); 3099 } 3100 3101 for_each_cpu(cpu, &cpus_with_pcps) { 3102 struct pcpu_drain *drain = per_cpu_ptr(&pcpu_drain, cpu); 3103 3104 drain->zone = zone; 3105 INIT_WORK(&drain->work, drain_local_pages_wq); 3106 queue_work_on(cpu, mm_percpu_wq, &drain->work); 3107 } 3108 for_each_cpu(cpu, &cpus_with_pcps) 3109 flush_work(&per_cpu_ptr(&pcpu_drain, cpu)->work); 3110 3111 mutex_unlock(&pcpu_drain_mutex); 3112 } 3113 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 5704/30000] include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces):
by kernel test robot 10 Sep '24

10 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: cbfb00d89c3b9971c3f0732b4f34d4e674bff5d8 commit: 8a6bee347626968d467aef07453c4547bc23cb64 [5704/30000] blk-mq: fix potential uaf for 'queue_hw_ctx' config: x86_64-randconfig-122-20240910 (https://download.01.org/0day-ci/archive/20240910/202409102355.6lrxEzuT-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240910/202409102355.6lrxEzuT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409102355.6lrxEzuT-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) block/blk-mq-sched.c: note: in included file: >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** -- >> block/blk-mq-sysfs.c:339:55: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct blk_mq_hw_ctx *hctx @@ got struct blk_mq_hw_ctx [noderef] __rcu * @@ block/blk-mq-sysfs.c:339:55: sparse: expected struct blk_mq_hw_ctx *hctx block/blk-mq-sysfs.c:339:55: sparse: got struct blk_mq_hw_ctx [noderef] __rcu * block/blk-mq-sysfs.c: note: in included file: >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** -- block/blk-sysfs.c: note: in included file: >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** -- block/blk-mq-tag.c: note: in included file: >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** -- >> block/blk-mq.c:485:19: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct blk_mq_hw_ctx *hctx @@ got struct blk_mq_hw_ctx [noderef] __rcu * @@ block/blk-mq.c:485:19: sparse: expected struct blk_mq_hw_ctx *hctx block/blk-mq.c:485:19: sparse: got struct blk_mq_hw_ctx [noderef] __rcu * >> block/blk-mq.c:3270:41: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct blk_mq_hw_ctx **hctxs @@ got struct blk_mq_hw_ctx [noderef] __rcu **queue_hw_ctx @@ block/blk-mq.c:3270:41: sparse: expected struct blk_mq_hw_ctx **hctxs block/blk-mq.c:3270:41: sparse: got struct blk_mq_hw_ctx [noderef] __rcu **queue_hw_ctx >> block/blk-mq.c:3284:17: sparse: sparse: incompatible types in comparison expression (different address spaces): block/blk-mq.c:3284:17: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * block/blk-mq.c:3284:17: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** block/blk-mq.c:4033:14: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct blk_mq_hw_ctx *hctx @@ got struct blk_mq_hw_ctx [noderef] __rcu * @@ block/blk-mq.c: note: in included file: >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** >> include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** vim +620 include/linux/blk-mq.h 614 615 static inline struct blk_mq_hw_ctx *queue_hctx(struct request_queue *q, int id) 616 { 617 struct blk_mq_hw_ctx *hctx; 618 619 rcu_read_lock(); > 620 hctx = *(rcu_dereference(q->queue_hw_ctx) + id); 621 rcu_read_unlock(); 622 623 return hctx; 624 } 625 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/3] Fix CVE-2022-48887
by Huang Xiaojia 10 Sep '24

10 Sep '24

*** BLURB HERE *** Huang Xiaojia (2): drm/vmwgfx: Introduce ttm reference object find function drm/vmwgfx: Remove vmw_user_bo_noref_release Zack Rusin (1): drm/vmwgfx: Remove rcu locks from user resources drivers/gpu/drm/drm_hashtab.c | 5 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 55 +++---- drivers/gpu/drm/vmwgfx/ttm_object.h | 14 -- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 42 ------ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 27 +--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 176 +++++++++++------------ drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 35 ----- include/drm/drm_hashtab.h | 2 + 8 files changed, 105 insertions(+), 251 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/3] Fix CVE-2022-48887
by Huang Xiaojia 10 Sep '24

10 Sep '24

*** BLURB HERE *** Huang Xiaojia (2): drm/vmwgfx: Introduce ttm reference object find function drm/vmwgfx: Remove vmw_user_bo_noref_release Zack Rusin (1): drm/vmwgfx: Remove rcu locks from user resources drivers/gpu/drm/drm_hashtab.c | 5 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 55 +++---- drivers/gpu/drm/vmwgfx/ttm_object.h | 14 -- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 42 ------ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 27 +--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 176 +++++++++++------------ drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 35 ----- include/drm/drm_hashtab.h | 2 + 8 files changed, 105 insertions(+), 251 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] wifi: nl80211: don't free NULL coalescing rule
by Zhang Zekun 10 Sep '24

10 Sep '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v6.9-rc6 commit 801ea33ae82d6a9d954074fbcf8ea9d18f1543a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U96L CVE: CVE-2024-36941 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------- If the parsing fails, we can dereference a NULL pointer here. Cc: stable(a)vger.kernel.org Fixes: be29b99a9b51 ("cfg80211/nl80211: Add packet coalesce support") Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit(a)intel.com> Link: https://msgid.link/20240418105220.b328f80406e7.Id75d961050deb05b3e4e354e024… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- net/wireless/nl80211.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 674a0d54aff8..43dfc2fbcf35 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -12646,6 +12646,8 @@ static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) error: for (i = 0; i < new_coalesce.n_rules; i++) { tmp_rule = &new_coalesce.rules[i]; + if (!tmp_rule) + continue; for (j = 0; j < tmp_rule->n_patterns; j++) kfree(tmp_rule->patterns[j].mask); kfree(tmp_rule->patterns); -- 2.17.1

2 1

[PATCH OLK-5.10] bna: ensure the copied buf is NUL terminated
by Zhang Zekun 10 Sep '24

10 Sep '24

From: Bui Quang Minh <minhquangbui99(a)gmail.com> mainline inclusion from mainline-v6.9-rc7 commit 8c34096c7fdf272fd4c0c37fe411cd2e3ed0ee9f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U1KE CVE: CVE-2024-36934 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ----------------------------------------------------------- Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user. Fixes: 7afc5dbde091 ("bna: Add debugfs interface.") Signed-off-by: Bui Quang Minh <minhquangbui99(a)gmail.com> Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-2-f1f1b53a10f4@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/net/ethernet/brocade/bna/bnad_debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c index 04ad0f2b9677..777f0d7e4819 100644 --- a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c +++ b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c @@ -312,7 +312,7 @@ bnad_debugfs_write_regrd(struct file *file, const char __user *buf, void *kern_buf; /* Copy the user space buf */ - kern_buf = memdup_user(buf, nbytes); + kern_buf = memdup_user_nul(buf, nbytes); if (IS_ERR(kern_buf)) return PTR_ERR(kern_buf); @@ -372,7 +372,7 @@ bnad_debugfs_write_regwr(struct file *file, const char __user *buf, void *kern_buf; /* Copy the user space buf */ - kern_buf = memdup_user(buf, nbytes); + kern_buf = memdup_user_nul(buf, nbytes); if (IS_ERR(kern_buf)) return PTR_ERR(kern_buf); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net: USB: Fix wrong-direction WARNING in plusb.c
by Zhang Zekun 10 Sep '24

10 Sep '24

From: Alan Stern <stern(a)rowland.harvard.edu> stable inclusion from stable-v5.10.168 commit 1be271c52bf3554edcb8d124d1f8c7f777ee5727 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4KG CVE: CVE-2023-52742 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------- commit 811d581194f7412eda97acc03d17fc77824b561f upstream. The syzbot fuzzer detected a bug in the plusb network driver: A zero-length control-OUT transfer was treated as a read instead of a write. In modern kernels this error provokes a WARNING: usb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 WARNING: CPU: 0 PID: 4645 at drivers/usb/core/urb.c:411 usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Modules linked in: CPU: 1 PID: 4645 Comm: dhcpcd Not tainted 6.2.0-rc6-syzkaller-00050-g9f266ccaa2f5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 RIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 ... Call Trace: <TASK> usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153 __usbnet_read_cmd+0xb9/0x390 drivers/net/usb/usbnet.c:2010 usbnet_read_cmd+0x96/0xf0 drivers/net/usb/usbnet.c:2068 pl_vendor_req drivers/net/usb/plusb.c:60 [inline] pl_set_QuickLink_features drivers/net/usb/plusb.c:75 [inline] pl_reset+0x2f/0xf0 drivers/net/usb/plusb.c:85 usbnet_open+0xcc/0x5d0 drivers/net/usb/usbnet.c:889 __dev_open+0x297/0x4d0 net/core/dev.c:1417 __dev_change_flags+0x587/0x750 net/core/dev.c:8530 dev_change_flags+0x97/0x170 net/core/dev.c:8602 devinet_ioctl+0x15a2/0x1d70 net/ipv4/devinet.c:1147 inet_ioctl+0x33f/0x380 net/ipv4/af_inet.c:979 sock_do_ioctl+0xcc/0x230 net/socket.c:1169 sock_ioctl+0x1f8/0x680 net/socket.c:1286 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The fix is to call usbnet_write_cmd() instead of usbnet_read_cmd() and remove the USB_DIR_IN flag. Reported-and-tested-by: syzbot+2a0e7abd24f1eb90ce25(a)syzkaller.appspotmail.com Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Fixes: 090ffa9d0e90 ("[PATCH] USB: usbnet (9/9) module for pl2301/2302 cables") CC: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/00000000000052099f05f3b3e298@google.com/ Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/net/usb/plusb.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/net/usb/plusb.c b/drivers/net/usb/plusb.c index 17c9c63b8eeb..ce7862dac2b7 100644 --- a/drivers/net/usb/plusb.c +++ b/drivers/net/usb/plusb.c @@ -57,9 +57,7 @@ static inline int pl_vendor_req(struct usbnet *dev, u8 req, u8 val, u8 index) { - return usbnet_read_cmd(dev, req, - USB_DIR_IN | USB_TYPE_VENDOR | - USB_RECIP_DEVICE, + return usbnet_write_cmd(dev, req, USB_TYPE_VENDOR | USB_RECIP_DEVICE, val, index, NULL, 0); } -- 2.17.1

2 2

[PATCH] wifi: nl80211: don't free NULL coalescing rule
by Zhang Zekun 10 Sep '24

10 Sep '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v6.9-rc6 commit 801ea33ae82d6a9d954074fbcf8ea9d18f1543a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U96L CVE: CVE-2024-36941 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------- If the parsing fails, we can dereference a NULL pointer here. Cc: stable(a)vger.kernel.org Fixes: be29b99a9b51 ("cfg80211/nl80211: Add packet coalesce support") Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit(a)intel.com> Link: https://msgid.link/20240418105220.b328f80406e7.Id75d961050deb05b3e4e354e024… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- net/wireless/nl80211.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 674a0d54aff8..43dfc2fbcf35 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -12646,6 +12646,8 @@ static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) error: for (i = 0; i < new_coalesce.n_rules; i++) { tmp_rule = &new_coalesce.rules[i]; + if (!tmp_rule) + continue; for (j = 0; j < tmp_rule->n_patterns; j++) kfree(tmp_rule->patterns[j].mask); kfree(tmp_rule->patterns); -- 2.17.1

1 0

[PATCH OLK-6.6 0/3] Bugfix introduced when support folio
by Liu Shixin 10 Sep '24

10 Sep '24

Liu Shixin (3): mm: limit order to 0 when allocated from dynamic pool mm: huge_memory: add memory reliable count in __discard_anon_folio_pmd_locked() mm/shmem: replace HPAGE_PMD_ORDER with PMD_ORDER in shmem_alloc_folio() mm/filemap.c | 3 +++ mm/huge_memory.c | 1 + mm/memory.c | 2 ++ mm/readahead.c | 3 +++ mm/shmem.c | 2 +- 5 files changed, 10 insertions(+), 1 deletion(-) -- 2.34.1

2 4

[PATCH OLK-5.10] [Backport] drm/qxl: Add check for drm_cvt_mode
by Wang Hai 10 Sep '24

10 Sep '24

From: Chen Ni <nichen(a)iscas.ac.cn> stable inclusion from stable-v5.10.224 commit 4e87f592a46bb804d8f833da6ce702ae4b55053f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5J CVE: CVE-2024-43829 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7bd09a2db0f617377027a2bb0b9179e6959edff3 ] Add check for the return value of drm_cvt_mode() and return the error if it fails in order to avoid NULL pointer dereference. Fixes: 1b043677d4be ("drm/qxl: add qxl_add_mode helper function") Signed-off-by: Chen Ni <nichen(a)iscas.ac.cn> Reviewed-by: Heng Qi <hengqi(a)linux.alibaba.com> Signed-off-by: Maxime Ripard <mripard(a)kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240621071031.1987974-1-nich… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/gpu/drm/qxl/qxl_display.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c index f22a1b776f4b..3ffa721d777b 100644 --- a/drivers/gpu/drm/qxl/qxl_display.c +++ b/drivers/gpu/drm/qxl/qxl_display.c @@ -232,6 +232,9 @@ static int qxl_add_mode(struct drm_connector *connector, return 0; mode = drm_cvt_mode(dev, width, height, 60, false, false, false); + if (!mode) + return 0; + if (preferred) mode->type |= DRM_MODE_TYPE_PREFERRED; mode->hdisplay = width; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] [Backport] drm/qxl: Add check for drm_cvt_mode
by Wang Hai 10 Sep '24

10 Sep '24

From: Chen Ni <nichen(a)iscas.ac.cn> stable inclusion from stable-v5.10.224 commit 4e87f592a46bb804d8f833da6ce702ae4b55053f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5J CVE: CVE-2024-43829 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7bd09a2db0f617377027a2bb0b9179e6959edff3 ] Add check for the return value of drm_cvt_mode() and return the error if it fails in order to avoid NULL pointer dereference. Fixes: 1b043677d4be ("drm/qxl: add qxl_add_mode helper function") Signed-off-by: Chen Ni <nichen(a)iscas.ac.cn> Reviewed-by: Heng Qi <hengqi(a)linux.alibaba.com> Signed-off-by: Maxime Ripard <mripard(a)kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240621071031.1987974-1-nich… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/gpu/drm/qxl/qxl_display.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c index f22a1b776f4b..3ffa721d777b 100644 --- a/drivers/gpu/drm/qxl/qxl_display.c +++ b/drivers/gpu/drm/qxl/qxl_display.c @@ -232,6 +232,9 @@ static int qxl_add_mode(struct drm_connector *connector, return 0; mode = drm_cvt_mode(dev, width, height, 60, false, false, false); + if (!mode) + return 0; + if (preferred) mode->type |= DRM_MODE_TYPE_PREFERRED; mode->hdisplay = width; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] Fix CVE-2022-48887
by Huang Xiaojia 10 Sep '24

10 Sep '24

*** BLURB HERE *** Huang Xiaojia (2): drm/vmwgfx: Introduce ttm reference object find function drm/vmwgfx: Remove vmw_user_bo_noref_release Zack Rusin (1): drm/vmwgfx: Remove rcu locks from user resources drivers/gpu/drm/drm_hashtab.c | 5 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 55 +++---- drivers/gpu/drm/vmwgfx/ttm_object.h | 14 -- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 42 ------ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 27 +--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 176 +++++++++++------------ drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 35 ----- include/drm/drm_hashtab.h | 2 + 8 files changed, 105 insertions(+), 251 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS-SP1 1/3] drm/vmwgfx: Introduce ttm reference object find function
by Huang Xiaojia 10 Sep '24

10 Sep '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIFE -------------------------------- For CVE-2022-48887, ttm_base_object_lookup requires a non-RCU lookup function to solve buggy RCU paths. But there is none, hence introduce it to handle this CVE. Fixes: e14c02e6b699 ("drm/vmwgfx: Look up objects without taking a reference") Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/gpu/drm/drm_hashtab.c | 5 +++-- drivers/gpu/drm/vmwgfx/ttm_object.c | 14 ++++++++++++++ include/drm/drm_hashtab.h | 2 ++ 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_hashtab.c b/drivers/gpu/drm/drm_hashtab.c index c50fa6f0709f..a61642835542 100644 --- a/drivers/gpu/drm/drm_hashtab.c +++ b/drivers/gpu/drm/drm_hashtab.c @@ -74,8 +74,8 @@ void drm_ht_verbose_list(struct drm_open_hash *ht, unsigned long key) DRM_DEBUG("count %d, key: 0x%08lx\n", count++, entry->key); } -static struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, - unsigned long key) +struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, + unsigned long key) { struct drm_hash_item *entry; struct hlist_head *h_list; @@ -91,6 +91,7 @@ static struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, } return NULL; } +EXPORT_SYMBOL(drm_ht_find_key); static struct hlist_node *drm_ht_find_key_rcu(struct drm_open_hash *ht, unsigned long key) diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.c b/drivers/gpu/drm/vmwgfx/ttm_object.c index 16077785ad47..03bf50e87d97 100644 --- a/drivers/gpu/drm/vmwgfx/ttm_object.c +++ b/drivers/gpu/drm/vmwgfx/ttm_object.c @@ -137,6 +137,20 @@ ttm_object_file_ref(struct ttm_object_file *tfile) return tfile; } +static int ttm_tfile_find_ref(struct drm_open_hash *ht, + uint32_t key, + struct drm_hash_item **item) +{ + struct hlist_node *h_node; + + h_node = drm_ht_find_key(ht, key); + if (!h_node) + return -EINVAL; + + *item = hlist_entry(h_node, struct drm_hash_item, head); + return 0; +} + static void ttm_object_file_destroy(struct kref *kref) { struct ttm_object_file *tfile = diff --git a/include/drm/drm_hashtab.h b/include/drm/drm_hashtab.h index bb95ff011baf..fe5ad4793a15 100644 --- a/include/drm/drm_hashtab.h +++ b/include/drm/drm_hashtab.h @@ -49,6 +49,8 @@ struct drm_open_hash { u8 order; }; +struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, unsigned long key); + int drm_ht_create(struct drm_open_hash *ht, unsigned int order); int drm_ht_insert_item(struct drm_open_hash *ht, struct drm_hash_item *item); int drm_ht_just_insert_please(struct drm_open_hash *ht, struct drm_hash_item *item, -- 2.34.1

2 4

[PATCH OLK-5.10 0/3] FIX CVE-2022-48887
by Huang Xiaojia 10 Sep '24

10 Sep '24

*** BLURB HERE *** Huang Xiaojia (2): drm/vmwgfx: Introduce ttm reference object find function drm/vmwgfx: Remove vmw_user_bo_noref_release Zack Rusin (1): drm/vmwgfx: Remove rcu locks from user resources drivers/gpu/drm/drm_hashtab.c | 5 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 55 +++---- drivers/gpu/drm/vmwgfx/ttm_object.h | 14 -- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 42 ------ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 27 +--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 176 +++++++++++------------ drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 35 ----- include/drm/drm_hashtab.h | 2 + 8 files changed, 105 insertions(+), 251 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 1/3] drm/vmwgfx: Introduce ttm reference object find function
by Huang Xiaojia 10 Sep '24

10 Sep '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIFE -------------------------------- For CVE-2022-48887, ttm_base_object_lookup requires a non-RCU lookup function to solve buggy RCU paths. But there is none, hence introduce it to handle this CVE. Fixes: e14c02e6b699 ("drm/vmwgfx: Look up objects without taking a reference") Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/gpu/drm/drm_hashtab.c | 5 +++-- drivers/gpu/drm/vmwgfx/ttm_object.c | 14 ++++++++++++++ include/drm/drm_hashtab.h | 2 ++ 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_hashtab.c b/drivers/gpu/drm/drm_hashtab.c index c50fa6f0709f..a61642835542 100644 --- a/drivers/gpu/drm/drm_hashtab.c +++ b/drivers/gpu/drm/drm_hashtab.c @@ -74,8 +74,8 @@ void drm_ht_verbose_list(struct drm_open_hash *ht, unsigned long key) DRM_DEBUG("count %d, key: 0x%08lx\n", count++, entry->key); } -static struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, - unsigned long key) +struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, + unsigned long key) { struct drm_hash_item *entry; struct hlist_head *h_list; @@ -91,6 +91,7 @@ static struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, } return NULL; } +EXPORT_SYMBOL(drm_ht_find_key); static struct hlist_node *drm_ht_find_key_rcu(struct drm_open_hash *ht, unsigned long key) diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.c b/drivers/gpu/drm/vmwgfx/ttm_object.c index 16077785ad47..03bf50e87d97 100644 --- a/drivers/gpu/drm/vmwgfx/ttm_object.c +++ b/drivers/gpu/drm/vmwgfx/ttm_object.c @@ -137,6 +137,20 @@ ttm_object_file_ref(struct ttm_object_file *tfile) return tfile; } +static int ttm_tfile_find_ref(struct drm_open_hash *ht, + uint32_t key, + struct drm_hash_item **item) +{ + struct hlist_node *h_node; + + h_node = drm_ht_find_key(ht, key); + if (!h_node) + return -EINVAL; + + *item = hlist_entry(h_node, struct drm_hash_item, head); + return 0; +} + static void ttm_object_file_destroy(struct kref *kref) { struct ttm_object_file *tfile = diff --git a/include/drm/drm_hashtab.h b/include/drm/drm_hashtab.h index bb95ff011baf..fe5ad4793a15 100644 --- a/include/drm/drm_hashtab.h +++ b/include/drm/drm_hashtab.h @@ -49,6 +49,8 @@ struct drm_open_hash { u8 order; }; +struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, unsigned long key); + int drm_ht_create(struct drm_open_hash *ht, unsigned int order); int drm_ht_insert_item(struct drm_open_hash *ht, struct drm_hash_item *item); int drm_ht_just_insert_please(struct drm_open_hash *ht, struct drm_hash_item *item, -- 2.34.1

2 4

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2023-52915
by Ye Bin 10 Sep '24

10 Sep '24

Hans Verkuil (1): media: dvb-usb-v2: af9035: fix missing unlock Zhang Shurong (1): media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer drivers/media/usb/dvb-usb-v2/af9035.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[openeuler:OLK-6.6] BUILD REGRESSION db19e0325ea842cbe7263402cdf73ee4e750b42b
by kernel test robot 10 Sep '24

10 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: db19e0325ea842cbe7263402cdf73ee4e750b42b !11464 mm/ksm: fix ksm_zero_pages accounting Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kernel-virtcca_cvm_host.c:warning:no-previous-prototype-for-function-is_virtcca_cvm_enable | |-- arch-arm64-kvm-tmi.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs | |-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:no-previous-prototype-for-function-virtcca_smmu_evtq_thread | `-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:no-previous-prototype-for-function-virtcca_smmu_gerror_handler |-- arm64-allnoconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-001-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-002-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-003-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-004-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-allmodconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-allnoconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-randconfig-002-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-allyesconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-001-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-002-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-003-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-004-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-defconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-001-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-002-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-004-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-006-20240910 | `-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:error:use-of-undeclared-identifier-NR_syscalls |-- x86_64-randconfig-011-20240910 | |-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs | `-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:error:NR_syscalls-undeclared-(first-use-in-this-function) |-- x86_64-randconfig-012-20240910 | |-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs | `-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:error:use-of-undeclared-identifier-NR_syscalls |-- x86_64-randconfig-013-20240910 | `-- mm-shmem.c:error:call-to-__compiletime_assert_NNN-declared-with-error-attribute:BUILD_BUG-failed |-- x86_64-randconfig-071-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-074-20240910 | `-- mm-shmem.c:error:call-to-__compiletime_assert_NNN-declared-with-error-attribute:BUILD_BUG-failed `-- x86_64-rhel-8.3-rust `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs elapsed time: 788m configs tested: 38 configs skipped: 107 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240910 gcc-14.1.0 arm64 randconfig-002-20240910 clang-20 arm64 randconfig-003-20240910 gcc-14.1.0 arm64 randconfig-004-20240910 gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240910 gcc-14.1.0 loongarch randconfig-002-20240910 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240910 gcc-12 x86_64 buildonly-randconfig-002-20240910 gcc-12 x86_64 buildonly-randconfig-003-20240910 clang-18 x86_64 buildonly-randconfig-004-20240910 gcc-12 x86_64 buildonly-randconfig-005-20240910 gcc-11 x86_64 buildonly-randconfig-006-20240910 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240910 gcc-12 x86_64 randconfig-002-20240910 gcc-12 x86_64 randconfig-003-20240910 gcc-12 x86_64 randconfig-004-20240910 gcc-12 x86_64 randconfig-005-20240910 clang-18 x86_64 randconfig-006-20240910 clang-18 x86_64 randconfig-011-20240910 gcc-12 x86_64 randconfig-012-20240910 clang-18 x86_64 randconfig-013-20240910 clang-18 x86_64 randconfig-014-20240910 clang-18 x86_64 randconfig-015-20240910 gcc-12 x86_64 randconfig-016-20240910 clang-18 x86_64 randconfig-071-20240910 clang-18 x86_64 randconfig-072-20240910 gcc-12 x86_64 randconfig-073-20240910 clang-18 x86_64 randconfig-074-20240910 clang-18 x86_64 randconfig-075-20240910 clang-18 x86_64 randconfig-076-20240910 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/5] coresight: etm4x: Fix CPU idle PM support for ETE
by Junhao He 10 Sep '24

10 Sep '24

Our CPUidle state save restore has some bugs which are triggered for an ETM with system instructions (e.g. ETE). This is a series of fixes to address them. Add CPU hotplug support for probing. Suzuki K Poulose (4): coresight: etm4x: Do not hardcode IOMEM access for register restore coresight: etm4x: Do not save/restore Data trace control registers coresight: etm4x: Safe access for TRCQCLTR coresight: etm4x: Fix access to resource selector registers Tamas Zsoldos (1): coresight: etm4x: add CPU hotplug support for probing .../coresight/coresight-etm4x-core.c | 162 +++++++++++++----- drivers/hwtracing/coresight/coresight-etm4x.h | 29 +--- 2 files changed, 119 insertions(+), 72 deletions(-) -- 2.33.0

2 6

[PATCH openEuler-22.03-LTS-SP1 0/2] Fix CVE-2023-52916
by Ye Bin 10 Sep '24

10 Sep '24

Jammy Huang (2): media: aspeed: Fix no complete irq for non-64-aligned width media: aspeed: Fix memory overwrite if timing is 1600x900 drivers/media/platform/aspeed-video.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] RDMA/hns: Fix missing unlock of scc_mutex in error path
by Chengchang Tang 10 Sep '24

10 Sep '24

From: Junxian Huang <huangjunxian6(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAPZGZ ---------------------------------------------------------------------- Fix missing unlock of scc_mutex in error path. Fixes: 5ea5896ecced ("RDMA/hns: Fix concurrency between sysfs store and FW configuration of scc params") Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index e2ba5a003567..8bff09f348f8 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -7611,6 +7611,7 @@ static int hns_roce_v2_config_scc_param(struct hns_roce_dev *hr_dev, ibdev_err_ratelimited(&hr_dev->ib_dev, "failed to configure scc param, opcode: 0x%x, ret = %d.\n", le16_to_cpu(desc.opcode), ret); + mutex_unlock(&scc_param->scc_mutex); return ret; } -- 2.33.0

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2023-52916
by Ye Bin 10 Sep '24

10 Sep '24

Jammy Huang (2): media: aspeed: Fix no complete irq for non-64-aligned width media: aspeed: Fix memory overwrite if timing is 1600x900 drivers/media/platform/aspeed-video.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) -- 2.34.1

2 3

[openeuler:OLK-5.10] BUILD REGRESSION 49cb18ca62c5763a7eb26376e62a63172470762d
by kernel test robot 10 Sep '24

10 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 49cb18ca62c5763a7eb26376e62a63172470762d !11276 [OLK-5.10]perf: Support event alias in form foo-bar-baz Error/Warning ids grouped by kconfigs: recent_errors |-- x86_64-allnoconfig | |-- drivers-misc-sdma-dae-sdma_cdev.c:linux-version.h-not-needed. | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-allyesconfig | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | |-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-function-mcp251xfd_tx_obj_write_sync | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_mbx_set_vf_multi_tc | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_tm_vf_tc_dwrr_cfg | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:variable-err-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-direction-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-queue-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-direction-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-queue-description-in-rnpvf_set_ring_vector | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_CTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_dispatch_event | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_net_exit | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-ctx-not-described-in-ubcore_update_uvs_eid_ret | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-dev-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-req-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-function-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-function-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TPG-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-function-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-function-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_UTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-function-ubcore_hash_table_rmv_vtpn | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_get_umap_ops | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_umap_priv_init | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_unmap_vma_pages | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-001-20240910 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-002-20240910 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-003-20240910 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-004-20240910 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-005-20240910 | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-006-20240910 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-defconfig | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-001-20240910 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-002-20240910 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-003-20240910 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-004-20240910 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register `-- x86_64-rhel-8.3-rust |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register elapsed time: 751m configs tested: 19 configs skipped: 99 tested configs: arm64 allmodconfig clang-20 arm64 randconfig-001-20240910 gcc-14.1.0 arm64 randconfig-002-20240910 clang-20 arm64 randconfig-003-20240910 gcc-14.1.0 arm64 randconfig-004-20240910 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240910 gcc-12 x86_64 buildonly-randconfig-002-20240910 gcc-12 x86_64 buildonly-randconfig-003-20240910 clang-18 x86_64 buildonly-randconfig-004-20240910 gcc-12 x86_64 buildonly-randconfig-005-20240910 gcc-11 x86_64 buildonly-randconfig-006-20240910 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240910 gcc-12 x86_64 randconfig-002-20240910 gcc-12 x86_64 randconfig-003-20240910 gcc-12 x86_64 randconfig-004-20240910 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/3] CVE-2024-35879
by Zhang Zekun 10 Sep '24

10 Sep '24

Fix CVE-2024-35879 Herve Codina (2): driver core: Introduce device_link_wait_removal() of: dynamic: Synchronize of_changeset_destroy() with the devlink removals Zhang Zekun (1): driver core: Fix kabi broken drivers/base/core.c | 26 +++++++++++++++++++++++--- drivers/of/dynamic.c | 11 +++++++++++ include/linux/of.h | 2 ++ 3 files changed, 36 insertions(+), 3 deletions(-) -- 2.17.1

2 4

[PATCH OLK-6.6] fs/netfs/fscache_cookie: add missing "n_accesses" check
by Long Li 09 Sep '24

09 Sep '24

From: Max Kellermann <max.kellermann(a)ionos.com> stable inclusion from stable-v6.6.47 commit dfaa39b05a6cf34a16c525a2759ee6ab26b5fef6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZM CVE: CVE-2024-45000 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit f71aa06398aabc2e3eaac25acdf3d62e0094ba70 upstream. This fixes a NULL pointer dereference bug due to a data race which looks like this: BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 33 PID: 16573 Comm: kworker/u97:799 Not tainted 6.8.7-cm4all1-hp+ #43 Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018 Workqueue: events_unbound netfs_rreq_write_to_cache_work RIP: 0010:cachefiles_prepare_write+0x30/0xa0 Code: 57 41 56 45 89 ce 41 55 49 89 cd 41 54 49 89 d4 55 53 48 89 fb 48 83 ec 08 48 8b 47 08 48 83 7f 10 00 48 89 34 24 48 8b 68 20 <48> 8b 45 08 4c 8b 38 74 45 49 8b 7f 50 e8 4e a9 b0 ff 48 8b 73 10 RSP: 0018:ffffb4e78113bde0 EFLAGS: 00010286 RAX: ffff976126be6d10 RBX: ffff97615cdb8438 RCX: 0000000000020000 RDX: ffff97605e6c4c68 RSI: ffff97605e6c4c60 RDI: ffff97615cdb8438 RBP: 0000000000000000 R08: 0000000000278333 R09: 0000000000000001 R10: ffff97605e6c4600 R11: 0000000000000001 R12: ffff97605e6c4c68 R13: 0000000000020000 R14: 0000000000000001 R15: ffff976064fe2c00 FS: 0000000000000000(0000) GS:ffff9776dfd40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000005942c002 CR4: 00000000001706f0 Call Trace: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x15d/0x440 ? search_module_extables+0xe/0x40 ? fixup_exception+0x22/0x2f0 ? exc_page_fault+0x5f/0x100 ? asm_exc_page_fault+0x22/0x30 ? cachefiles_prepare_write+0x30/0xa0 netfs_rreq_write_to_cache_work+0x135/0x2e0 process_one_work+0x137/0x2c0 worker_thread+0x2e9/0x400 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x30/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Modules linked in: CR2: 0000000000000008 ---[ end trace 0000000000000000 ]--- This happened because fscache_cookie_state_machine() was slow and was still running while another process invoked fscache_unuse_cookie(); this led to a fscache_cookie_lru_do_one() call, setting the FSCACHE_COOKIE_DO_LRU_DISCARD flag, which was picked up by fscache_cookie_state_machine(), withdrawing the cookie via cachefiles_withdraw_cookie(), clearing cookie->cache_priv. At the same time, yet another process invoked cachefiles_prepare_write(), which found a NULL pointer in this code line: struct cachefiles_object *object = cachefiles_cres_object(cres); The next line crashes, obviously: struct cachefiles_cache *cache = object->volume->cache; During cachefiles_prepare_write(), the "n_accesses" counter is non-zero (via fscache_begin_operation()). The cookie must not be withdrawn until it drops to zero. The counter is checked by fscache_cookie_state_machine() before switching to FSCACHE_COOKIE_STATE_RELINQUISHING and FSCACHE_COOKIE_STATE_WITHDRAWING (in "case FSCACHE_COOKIE_STATE_FAILED"), but not for FSCACHE_COOKIE_STATE_LRU_DISCARDING ("case FSCACHE_COOKIE_STATE_ACTIVE"). This patch adds the missing check. With a non-zero access counter, the function returns and the next fscache_end_cookie_access() call will queue another fscache_cookie_state_machine() call to handle the still-pending FSCACHE_COOKIE_DO_LRU_DISCARD. Fixes: 12bb21a29c19 ("fscache: Implement cookie user counting and resource pinning") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Signed-off-by: David Howells <dhowells(a)redhat.com> Link: https://lore.kernel.org/r/20240729162002.3436763-2-dhowells@redhat.com cc: Jeff Layton <jlayton(a)kernel.org> cc: netfs(a)lists.linux.dev cc: linux-fsdevel(a)vger.kernel.org cc: stable(a)vger.kernel.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/fscache/cookie.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c index bce2492186d0..d4d4b3a8b106 100644 --- a/fs/fscache/cookie.c +++ b/fs/fscache/cookie.c @@ -741,6 +741,10 @@ static void fscache_cookie_state_machine(struct fscache_cookie *cookie) spin_lock(&cookie->lock); } if (test_bit(FSCACHE_COOKIE_DO_LRU_DISCARD, &cookie->flags)) { + if (atomic_read(&cookie->n_accesses) != 0) + /* still being accessed: postpone it */ + break; + __fscache_set_cookie_state(cookie, FSCACHE_COOKIE_STATE_LRU_DISCARDING); wake = true; -- 2.39.2

2 1

[PATCH OLK-6.6] tracefs: Use generic inode RCU for synchronizing freeing
by Long Li 09 Sep '24

09 Sep '24

From: Steven Rostedt <rostedt(a)goodmis.org> commit 0b6743bd60a56a701070b89fb80c327a44b7b3e2 upstream. With structure layout randomization enabled for 'struct inode' we need to avoid overlapping any of the RCU-used / initialized-only-once members, e.g. i_lru or i_sb_list to not corrupt related list traversals when making use of the rcu_head. For an unlucky structure layout of 'struct inode' we may end up with the following splat when running the ftrace selftests: [<...>] list_del corruption, ffff888103ee2cb0->next (tracefs_inode_cache+0x0/0x4e0 [slab object]) is NULL (prev is tracefs_inode_cache+0x78/0x4e0 [slab object]) [<...>] ------------[ cut here ]------------ [<...>] kernel BUG at lib/list_debug.c:54! [<...>] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [<...>] CPU: 3 PID: 2550 Comm: mount Tainted: G N 6.8.12-grsec+ #122 ed2f536ca62f28b087b90e3cc906a8d25b3ddc65 [<...>] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [<...>] RIP: 0010:[<ffffffff84656018>] __list_del_entry_valid_or_report+0x138/0x3e0 [<...>] Code: 48 b8 99 fb 65 f2 ff ff ff ff e9 03 5c d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff e9 33 5a d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff <0f> 0b 4c 89 e9 48 89 ea 48 89 ee 48 c7 c7 60 8f dd 89 31 c0 e8 2f [<...>] RSP: 0018:fffffe80416afaf0 EFLAGS: 00010283 [<...>] RAX: 0000000000000098 RBX: ffff888103ee2cb0 RCX: 0000000000000000 [<...>] RDX: ffffffff84655fe8 RSI: ffffffff89dd8b60 RDI: 0000000000000001 [<...>] RBP: ffff888103ee2cb0 R08: 0000000000000001 R09: fffffbd0082d5f25 [<...>] R10: fffffe80416af92f R11: 0000000000000001 R12: fdf99c16731d9b6d [<...>] R13: 0000000000000000 R14: ffff88819ad4b8b8 R15: 0000000000000000 [<...>] RBX: tracefs_inode_cache+0x0/0x4e0 [slab object] [<...>] RDX: __list_del_entry_valid_or_report+0x108/0x3e0 [<...>] RSI: __func__.47+0x4340/0x4400 [<...>] RBP: tracefs_inode_cache+0x0/0x4e0 [slab object] [<...>] RSP: process kstack fffffe80416afaf0+0x7af0/0x8000 [mount 2550 2550] [<...>] R09: kasan shadow of process kstack fffffe80416af928+0x7928/0x8000 [mount 2550 2550] [<...>] R10: process kstack fffffe80416af92f+0x792f/0x8000 [mount 2550 2550] [<...>] R14: tracefs_inode_cache+0x78/0x4e0 [slab object] [<...>] FS: 00006dcb380c1840(0000) GS:ffff8881e0600000(0000) knlGS:0000000000000000 [<...>] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [<...>] CR2: 000076ab72b30e84 CR3: 000000000b088004 CR4: 0000000000360ef0 shadow CR4: 0000000000360ef0 [<...>] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [<...>] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [<...>] ASID: 0003 [<...>] Stack: [<...>] ffffffff818a2315 00000000f5c856ee ffffffff896f1840 ffff888103ee2cb0 [<...>] ffff88812b6b9750 0000000079d714b6 fffffbfff1e9280b ffffffff8f49405f [<...>] 0000000000000001 0000000000000000 ffff888104457280 ffffffff8248b392 [<...>] Call Trace: [<...>] <TASK> [<...>] [<ffffffff818a2315>] ? lock_release+0x175/0x380 fffffe80416afaf0 [<...>] [<ffffffff8248b392>] list_lru_del+0x152/0x740 fffffe80416afb48 [<...>] [<ffffffff8248ba93>] list_lru_del_obj+0x113/0x280 fffffe80416afb88 [<...>] [<ffffffff8940fd19>] ? _atomic_dec_and_lock+0x119/0x200 fffffe80416afb90 [<...>] [<ffffffff8295b244>] iput_final+0x1c4/0x9a0 fffffe80416afbb8 [<...>] [<ffffffff8293a52b>] dentry_unlink_inode+0x44b/0xaa0 fffffe80416afbf8 [<...>] [<ffffffff8293fefc>] __dentry_kill+0x23c/0xf00 fffffe80416afc40 [<...>] [<ffffffff8953a85f>] ? __this_cpu_preempt_check+0x1f/0xa0 fffffe80416afc48 [<...>] [<ffffffff82949ce5>] ? shrink_dentry_list+0x1c5/0x760 fffffe80416afc70 [<...>] [<ffffffff82949b71>] ? shrink_dentry_list+0x51/0x760 fffffe80416afc78 [<...>] [<ffffffff82949da8>] shrink_dentry_list+0x288/0x760 fffffe80416afc80 [<...>] [<ffffffff8294ae75>] shrink_dcache_sb+0x155/0x420 fffffe80416afcc8 [<...>] [<ffffffff8953a7c3>] ? debug_smp_processor_id+0x23/0xa0 fffffe80416afce0 [<...>] [<ffffffff8294ad20>] ? do_one_tree+0x140/0x140 fffffe80416afcf8 [<...>] [<ffffffff82997349>] ? do_remount+0x329/0xa00 fffffe80416afd18 [<...>] [<ffffffff83ebf7a1>] ? security_sb_remount+0x81/0x1c0 fffffe80416afd38 [<...>] [<ffffffff82892096>] reconfigure_super+0x856/0x14e0 fffffe80416afd70 [<...>] [<ffffffff815d1327>] ? ns_capable_common+0xe7/0x2a0 fffffe80416afd90 [<...>] [<ffffffff82997436>] do_remount+0x416/0xa00 fffffe80416afdd0 [<...>] [<ffffffff829b2ba4>] path_mount+0x5c4/0x900 fffffe80416afe28 [<...>] [<ffffffff829b25e0>] ? finish_automount+0x13a0/0x13a0 fffffe80416afe60 [<...>] [<ffffffff82903812>] ? user_path_at_empty+0xb2/0x140 fffffe80416afe88 [<...>] [<ffffffff829b2ff5>] do_mount+0x115/0x1c0 fffffe80416afeb8 [<...>] [<ffffffff829b2ee0>] ? path_mount+0x900/0x900 fffffe80416afed8 [<...>] [<ffffffff8272461c>] ? __kasan_check_write+0x1c/0xa0 fffffe80416afee0 [<...>] [<ffffffff829b31cf>] __do_sys_mount+0x12f/0x280 fffffe80416aff30 [<...>] [<ffffffff829b36cd>] __x64_sys_mount+0xcd/0x2e0 fffffe80416aff70 [<...>] [<ffffffff819f8818>] ? syscall_trace_enter+0x218/0x380 fffffe80416aff88 [<...>] [<ffffffff8111655e>] x64_sys_call+0x5d5e/0x6720 fffffe80416affa8 [<...>] [<ffffffff8952756d>] do_syscall_64+0xcd/0x3c0 fffffe80416affb8 [<...>] [<ffffffff8100119b>] entry_SYSCALL_64_safe_stack+0x4c/0x87 fffffe80416affe8 [<...>] </TASK> [<...>] <PTREGS> [<...>] RIP: 0033:[<00006dcb382ff66a>] vm_area_struct[mount 2550 2550 file 6dcb38225000-6dcb3837e000 22 55(read|exec|mayread|mayexec)]+0x0/0xb8 [userland map] [<...>] Code: 48 8b 0d 29 18 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d f6 17 0d 00 f7 d8 64 89 01 48 [<...>] RSP: 002b:0000763d68192558 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [<...>] RAX: ffffffffffffffda RBX: 00006dcb38433264 RCX: 00006dcb382ff66a [<...>] RDX: 000017c3e0d11210 RSI: 000017c3e0d1a5a0 RDI: 000017c3e0d1ae70 [<...>] RBP: 000017c3e0d10fb0 R08: 000017c3e0d11260 R09: 00006dcb383d1be0 [<...>] R10: 000000000020002e R11: 0000000000000246 R12: 0000000000000000 [<...>] R13: 000017c3e0d1ae70 R14: 000017c3e0d11210 R15: 000017c3e0d10fb0 [<...>] RBX: vm_area_struct[mount 2550 2550 file 6dcb38433000-6dcb38434000 5b 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RCX: vm_area_struct[mount 2550 2550 file 6dcb38225000-6dcb3837e000 22 55(read|exec|mayread|mayexec)]+0x0/0xb8 [userland map] [<...>] RDX: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RSI: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RDI: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RBP: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RSP: vm_area_struct[mount 2550 2550 anon 763d68173000-763d68195000 7ffffffdd 100133(read|write|mayread|maywrite|growsdown|account)]+0x0/0xb8 [userland map] [<...>] R08: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R09: vm_area_struct[mount 2550 2550 file 6dcb383d1000-6dcb383d3000 1cd 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R13: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R14: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R15: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] </PTREGS> [<...>] Modules linked in: [<...>] ---[ end trace 0000000000000000 ]--- The list debug message as well as RBX's symbolic value point out that the object in question was allocated from 'tracefs_inode_cache' and that the list's '->next' member is at offset 0. Dumping the layout of the relevant parts of 'struct tracefs_inode' gives the following: struct tracefs_inode { union { struct inode { struct list_head { struct list_head * next; /* 0 8 */ struct list_head * prev; /* 8 8 */ } i_lru; [...] } vfs_inode; struct callback_head { void (*func)(struct callback_head *); /* 0 8 */ struct callback_head * next; /* 8 8 */ } rcu; }; [...] }; Above shows that 'vfs_inode.i_lru' overlaps with 'rcu' which will destroy the 'i_lru' list as soon as the 'rcu' member gets used, e.g. in call_rcu() or later when calling the RCU callback. This will disturb concurrent list traversals as well as object reuse which assumes these list heads will keep their integrity. For reproduction, the following diff manually overlays 'i_lru' with 'rcu' as, otherwise, one would require some good portion of luck for gambling an unlucky RANDSTRUCT seed: --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -629,6 +629,7 @@ struct inode { umode_t i_mode; unsigned short i_opflags; kuid_t i_uid; + struct list_head i_lru; /* inode LRU list */ kgid_t i_gid; unsigned int i_flags; @@ -690,7 +691,6 @@ struct inode { u16 i_wb_frn_avg_time; u16 i_wb_frn_history; #endif - struct list_head i_lru; /* inode LRU list */ struct list_head i_sb_list; struct list_head i_wb_list; /* backing dev writeback list */ union { The tracefs inode does not need to supply its own RCU delayed destruction of its inode. The inode code itself offers both a "destroy_inode()" callback that gets called when the last reference of the inode is released, and the "free_inode()" which is called after a RCU synchronization period from the "destroy_inode()". The tracefs code can unlink the inode from its list in the destroy_inode() callback, and the simply free it from the free_inode() callback. This should provide the same protection. Link: https://lore.kernel.org/all/20240807115143.45927-3-minipli@grsecurity.net/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Ajay Kaher <ajay.kaher(a)broadcom.com> Cc: Ilkka =?utf-8?b?TmF1bGFww6TDpA==?= <digirigawa(a)gmail.com> Link: https://lore.kernel.org/20240807185402.61410544@gandalf.local.home Fixes: baa23a8d4360 ("tracefs: Reset permissions on remount if permissions are options") Reported-by: Mathias Krause <minipli(a)grsecurity.net> Reported-by: Brad Spengler <spender(a)grsecurity.net> Suggested-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: include/linux/fs.h [The patch which merged into stable-v6.6 has error, it shouldn't modify include/linux/fs.h] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/tracefs/inode.c | 10 ++++------ fs/tracefs/internal.h | 5 +---- 2 files changed, 5 insertions(+), 10 deletions(-) diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c index 859442b5371e..7d389dd5ed51 100644 --- a/fs/tracefs/inode.c +++ b/fs/tracefs/inode.c @@ -53,15 +53,14 @@ static struct inode *tracefs_alloc_inode(struct super_block *sb) return &ti->vfs_inode; } -static void tracefs_free_inode_rcu(struct rcu_head *rcu) +static void tracefs_free_inode(struct inode *inode) { - struct tracefs_inode *ti; + struct tracefs_inode *ti = get_tracefs(inode); - ti = container_of(rcu, struct tracefs_inode, rcu); kmem_cache_free(tracefs_inode_cachep, ti); } -static void tracefs_free_inode(struct inode *inode) +static void tracefs_destroy_inode(struct inode *inode) { struct tracefs_inode *ti = get_tracefs(inode); unsigned long flags; @@ -69,8 +68,6 @@ static void tracefs_free_inode(struct inode *inode) spin_lock_irqsave(&tracefs_inode_lock, flags); list_del_rcu(&ti->list); spin_unlock_irqrestore(&tracefs_inode_lock, flags); - - call_rcu(&ti->rcu, tracefs_free_inode_rcu); } static ssize_t default_read_file(struct file *file, char __user *buf, @@ -458,6 +455,7 @@ static int tracefs_drop_inode(struct inode *inode) static const struct super_operations tracefs_super_operations = { .alloc_inode = tracefs_alloc_inode, .free_inode = tracefs_free_inode, + .destroy_inode = tracefs_destroy_inode, .drop_inode = tracefs_drop_inode, .statfs = simple_statfs, .remount_fs = tracefs_remount, diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h index f704d8348357..d83c2a25f288 100644 --- a/fs/tracefs/internal.h +++ b/fs/tracefs/internal.h @@ -10,10 +10,7 @@ enum { }; struct tracefs_inode { - union { - struct inode vfs_inode; - struct rcu_head rcu; - }; + struct inode vfs_inode; /* The below gets initialized with memset_after(ti, 0, vfs_inode) */ struct list_head list; unsigned long flags; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] mptcp: pm: avoid possible UaF when selecting endp
by Liu Jian 09 Sep '24

09 Sep '24

From: "Matthieu Baerts (NGI0)" <matttbe(a)kernel.org> mainline inclusion from mainline-v6.11-rc5 commit 48e50dcbcbaaf713d82bf2da5c16aeced94ad07d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY17 CVE: CVE-2024-44974 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free. A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with. Reported-by: Paolo Abeni <pabeni(a)redhat.com> Closes: https://lore.kernel.org/45cd30d3-7710-491c-ae4d-a1368c00beb1@redhat.com Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") Cc: stable(a)vger.kernel.org Reviewed-by: Mat Martineau <martineau(a)kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-14-38035d40de5… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/mptcp/pm_netlink.c [Did not backport 90d930882139 ("mptcp: constify a bunch of of helpers"), 85df533a787b ("mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set"), 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/mptcp/pm_netlink.c | 44 ++++++++++++++++++++++++------------------ 1 file changed, 25 insertions(+), 19 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index 0d6f3d912891..824420c4e8f9 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -128,11 +128,13 @@ static bool lookup_subflow_by_saddr(const struct list_head *list, return false; } -static struct mptcp_pm_addr_entry * +static bool select_local_address(const struct pm_nl_pernet *pernet, - struct mptcp_sock *msk) + struct mptcp_sock *msk, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; rcu_read_lock(); spin_lock_bh(&msk->join_list_lock); @@ -146,19 +148,23 @@ select_local_address(const struct pm_nl_pernet *pernet, if (entry->addr.family == ((struct sock *)msk)->sk_family && !lookup_subflow_by_saddr(&msk->conn_list, &entry->addr) && !lookup_subflow_by_saddr(&msk->join_list, &entry->addr)) { - ret = entry; + *new_entry = *entry; + found = true; break; } } spin_unlock_bh(&msk->join_list_lock); rcu_read_unlock(); - return ret; + + return found; } -static struct mptcp_pm_addr_entry * -select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) +static bool +select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; int i = 0; rcu_read_lock(); @@ -171,12 +177,14 @@ select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) if (!(entry->addr.flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) continue; if (i++ == pos) { - ret = entry; + *new_entry = *entry; + found = true; break; } } rcu_read_unlock(); - return ret; + + return found; } static void check_work_pending(struct mptcp_sock *msk) @@ -306,7 +314,7 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) { struct mptcp_addr_info remote = { 0 }; struct sock *sk = (struct sock *)msk; - struct mptcp_pm_addr_entry *local; + struct mptcp_pm_addr_entry local; struct pm_nl_pernet *pernet; pernet = net_generic(sock_net((struct sock *)msk), pm_nl_pernet_id); @@ -318,13 +326,12 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) /* check first for announce */ if (msk->pm.add_addr_signaled < msk->pm.add_addr_signal_max) { - local = select_signal_address(pernet, - msk->pm.add_addr_signaled); - if (local) { - if (mptcp_pm_alloc_anno_list(msk, local)) { + if (select_signal_address(pernet, + msk->pm.add_addr_signaled, &local)) { + if (mptcp_pm_alloc_anno_list(msk, &local)) { msk->pm.add_addr_signaled++; - mptcp_pm_announce_addr(msk, &local->addr, false); + mptcp_pm_announce_addr(msk, &local.addr, false); } } else { /* pick failed, avoid fourther attempts later */ @@ -339,13 +346,12 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) msk->pm.subflows < msk->pm.subflows_max) { remote_address((struct sock_common *)sk, &remote); - local = select_local_address(pernet, msk); - if (local) { + if (select_local_address(pernet, msk, &local)) { msk->pm.local_addr_used++; msk->pm.subflows++; check_work_pending(msk); spin_unlock_bh(&msk->pm.lock); - __mptcp_subflow_connect(sk, &local->addr, &remote); + __mptcp_subflow_connect(sk, &local.addr, &remote); spin_lock_bh(&msk->pm.lock); return; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
by Liu Jian 09 Sep '24

09 Sep '24

From: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> stable inclusion from stable-v5.10.224 commit b7b8d9f5e679af60c94251fd6728dde34be69a71 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYL CVE: CVE-2024-44971 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit e3862093ee93fcfbdadcb7957f5f8974fffa806a ] bcm_sf2_mdio_register() calls of_phy_find_device() and then phy_device_remove() in a loop to remove existing PHY devices. of_phy_find_device() eventually calls bus_find_device(), which calls get_device() on the returned struct device * to increment the refcount. The current implementation does not decrement the refcount, which causes memory leak. This commit adds the missing phy_device_free() call to decrement the refcount via put_device() to balance the refcount. Fixes: 771089c2a485 ("net: dsa: bcm_sf2: Ensure that MDIO diversion is used") Signed-off-by: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> Tested-by: Florian Fainelli <florian.fainelli(a)broadcom.com> Reviewed-by: Florian Fainelli <florian.fainelli(a)broadcom.com> Link: https://patch.msgid.link/20240806011327.3817861-1-joe@pf.is.s.u-tokyo.ac.jp Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/dsa/bcm_sf2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c index c6563d212476..7b8bdc34caa5 100644 --- a/drivers/net/dsa/bcm_sf2.c +++ b/drivers/net/dsa/bcm_sf2.c @@ -559,8 +559,10 @@ static int bcm_sf2_mdio_register(struct dsa_switch *ds) of_remove_property(child, prop); phydev = of_phy_find_device(child); - if (phydev) + if (phydev) { phy_device_remove(phydev); + phy_device_free(phydev); + } } err = mdiobus_register(priv->slave_mii_bus); -- 2.34.1

2 1

[openeuler:OLK-5.10 29989/30000] versioncheck: ./drivers/misc/sdma-dae/sdma_cdev.c: 9 linux/version.h not needed.
by kernel test robot 09 Sep '24

09 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 3e6d44ea60eb8609ba59273c12276e3236cd76b2 commit: 1eb55075d727b4f06ceeb95a71670e2a0d7d026c [29989/30000] drivers:misc:sdma-dae: fix icsl code check problems reproduce: (https://download.01.org/0day-ci/archive/20240909/202409091107.diXxqb2W-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409091107.diXxqb2W-lkp@intel.com/ versioncheck warnings: (new ones prefixed by >>) INFO PATH=/opt/cross/rustc-1.58.0-bindgen-0.56.0/cargo/bin:/opt/cross/clang-18/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/timeout -k 100 3h /usr/bin/make KCFLAGS= -Wtautological-compare -Wno-error=return-type -Wreturn-type -Wcast-function-type -funsigned-char -Wundef -fstrict-flex-arrays=3 -Wformat-overflow -Wformat-truncation -Wenum-conversion W=1 --keep-going LLVM=1 -j32 ARCH=x86_64 versioncheck find ./* $ -name SCCS -o -name BitKeeper -o -name .svn -o -name CVS -o -name .pc -o -name .hg -o -name .git $ -prune -o \ -name '*.[hcS]' -type f -print | sort \ | xargs perl -w ./scripts/checkversion.pl ./arch/csky/include/asm/atomic.h: 6 linux/version.h not needed. ./arch/csky/include/asm/io.h: 9 linux/version.h not needed. ./arch/csky/include/asm/thread_info.h: 9 linux/version.h not needed. ./arch/csky/include/asm/uaccess.h: 15 linux/version.h not needed. ./arch/csky/kernel/process.c: 5 linux/version.h not needed. ./arch/csky/mm/dma-mapping.c: 12 linux/version.h not needed. ./arch/csky/mm/fault.c: 16 linux/version.h not needed. ./arch/s390/include/asm/setup.h: 183: need linux/version.h ./arch/um/drivers/vector_kern.c: 11 linux/version.h not needed. ./drivers/block/rsxx/rsxx_priv.h: 14 linux/version.h not needed. ./drivers/char/ipmi/ipmi_si_ls2k500.c: 19 linux/version.h not needed. ./drivers/crypto/cavium/cpt/cptpf_main.c: 13 linux/version.h not needed. ./drivers/crypto/cavium/zip/common.h: 59 linux/version.h not needed. ./drivers/crypto/ccree/cc_driver.h: 26 linux/version.h not needed. ./drivers/crypto/montage/tsse/tsse_vuart.c: 21 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c: 62 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c: 28 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c: 26 linux/version.h not needed. ./drivers/gpu/drm/inspur/inspur_drm_de.c: 513: need linux/version.h ./drivers/gpu/drm/inspur/inspur_drm_drv.c: 456: need linux/version.h ./drivers/gpu/drm/pl111/pl111_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/pl111/pl111_drv.c: 47 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_drv.c: 38 linux/version.h not needed. ./drivers/hv/hv.c: 16 linux/version.h not needed. ./drivers/i2c/busses/i2c-brcmstb.c: 25 linux/version.h not needed. ./drivers/i2c/busses/i2c-xgene-slimpro.c: 22 linux/version.h not needed. ./drivers/media/pci/cx25821/cx25821.h: 31 linux/version.h not needed. ./drivers/media/platform/s3c-camif/camif-core.c: 26 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-common.h: 16 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c: 31 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-dvb.c: 14 linux/version.h not needed. ./drivers/media/usb/uvc/uvc_driver.c: 18 linux/version.h not needed. >> ./drivers/misc/sdma-dae/sdma_cdev.c: 9 linux/version.h not needed. ./drivers/net/ethernet/3snic/sssnic/include/kernel/sss_linux_kernel.h: 12 linux/version.h not needed. ./drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c: 21 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h: 32 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c: 17 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h: 20 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic/ossl_knl.h: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h: 12 linux/version.h not needed. ./drivers/net/ethernet/mucse/rnpm/rnpm_common.h: 7 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/common.h: 12 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/txrx.c: 9 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede.h: 10 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_ethtool.c: 7 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_main.c: 10 linux/version.h not needed. ./drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h: 26 linux/version.h not needed. ./drivers/net/usb/lan78xx.c: 5 linux/version.h not needed. ./drivers/net/wireless/rsi/rsi_91x_ps.c: 19 linux/version.h not needed. ./drivers/scsi/cxgbi/libcxgbi.h: 27 linux/version.h not needed. ./drivers/scsi/hisi_raid/hiraid_main.c: 9 linux/version.h not needed. ./drivers/scsi/huawei/hifc/hifc_knl_adp.h: 23 linux/version.h not needed. ./drivers/scsi/qedf/qedf.h: 15 linux/version.h not needed. ./drivers/scsi/qedf/qedf_dbg.h: 13 linux/version.h not needed. ./drivers/scsi/qedi/qedi_dbg.h: 14 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_fw.c: 6 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_os.c: 6 linux/version.h not needed. ./drivers/soc/tegra/powergate-bpmp.c: 10 linux/version.h not needed. ./drivers/staging/media/atomisp/include/linux/atomisp.h: 23 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/drv_types.h: 17 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/ioctl_cfg80211.h: 10 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_cdev_file.c: 23 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_device.c: 33 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_genl.c: 26 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_genl_admin.c: 20 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_main.c: 28 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_tp.c: 26 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_umem.c: 26 linux/version.h not needed. ./drivers/ub/urma/uburma/uburma_main.c: 29 linux/version.h not needed. ./drivers/ub/urma/uburma/uburma_mmap.c: 21 linux/version.h not needed. ./drivers/watchdog/ziirave_wdt.c: 21 linux/version.h not needed. ./fs/eulerfs/euler.h: 20 linux/version.h not needed. ./fs/eulerfs/euler_common.h: 25 linux/version.h not needed. ./fs/proc/etmem_scan.c: 13 linux/version.h not needed. ./include/linux/qed/qed_ll2_if.h: 15 linux/version.h not needed. ./kernel/bpf/syscall.c: 20 linux/version.h not needed. ./samples/bpf/sampleip_kern.c: 7 linux/version.h not needed. ./samples/bpf/trace_event_kern.c: 8 linux/version.h not needed. ./sound/soc/codecs/cs35l35.c: 12 linux/version.h not needed. ./sound/soc/codecs/cs42l42.c: 14 linux/version.h not needed. ./tools/lib/bpf/libbpf_sched.h: 21 linux/version.h not needed. ./tools/perf/include/bpf/bpf.h: 70: need linux/version.h ./tools/perf/tests/bpf-script-example.c: 49: need linux/version.h ./tools/perf/tests/bpf-script-test-kbuild.c: 21: need linux/version.h ./tools/perf/tests/bpf-script-test-prologue.c: 47: need linux/version.h ./tools/perf/tests/bpf-script-test-relocation.c: 51: need linux/version.h ./tools/testing/selftests/bpf/progs/test_map_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_send_signal_kern.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_spin_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_tcp_estats.c: 37 linux/version.h not needed. ./tools/testing/selftests/wireguard/qemu/init.c: 25 linux/version.h not needed. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] mm/ksm: fix ksm_zero_pages accounting
by Kaixiong Yu 09 Sep '24

09 Sep '24

fix the bug from mainline inclusion commits e2942062e01d ("ksm: count all zero pages placed by KSM") and 6080d19f0704 ("ksm: add ksm zero pages for each process") Chengming Zhou (1): mm/ksm: fix ksm_zero_pages accounting Kaixiong Yu (1): mm_types: Fix kabi breakage in struct mm_struct fs/proc/base.c | 2 +- include/linux/ksm.h | 17 ++++++++++++++--- include/linux/mm_types.h | 3 ++- mm/ksm.c | 11 +++++------ 4 files changed, 22 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[openeuler:OLK-5.10 4121/30000] fs/xfs/xfs_icache.c:52 xfs_icwalk_tag() warn: unsigned 'goal' is never less than zero.
by kernel test robot 09 Sep '24

09 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 3e6d44ea60eb8609ba59273c12276e3236cd76b2 commit: b12b4a14e6dc13b75697ebc80f513fedd068345e [4121/30000] xfs: remove xfs_dqrele_all_inodes config: x86_64-randconfig-161-20240906 (https://download.01.org/0day-ci/archive/20240909/202409091024.XP4R6muy-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409091024.XP4R6muy-lkp@intel.com/ New smatch warnings: fs/xfs/xfs_icache.c:52 xfs_icwalk_tag() warn: unsigned 'goal' is never less than zero. Old smatch warnings: fs/xfs/xfs_icache.c:534 xfs_iget_cache_hit() warn: missing unwind goto? vim +/goal +52 fs/xfs/xfs_icache.c 656d89e710ffc0 Darrick J. Wong 2022-01-07 47 656d89e710ffc0 Darrick J. Wong 2022-01-07 48 /* Compute the inode radix tree tag for this goal. */ 656d89e710ffc0 Darrick J. Wong 2022-01-07 49 static inline unsigned int 656d89e710ffc0 Darrick J. Wong 2022-01-07 50 xfs_icwalk_tag(enum xfs_icwalk_goal goal) 656d89e710ffc0 Darrick J. Wong 2022-01-07 51 { 656d89e710ffc0 Darrick J. Wong 2022-01-07 @52 return goal < 0 ? XFS_ICWALK_NULL_TAG : goal; 656d89e710ffc0 Darrick J. Wong 2022-01-07 53 } 656d89e710ffc0 Darrick J. Wong 2022-01-07 54 :::::: The code at line 52 was first introduced by commit :::::: 656d89e710ffc01bc169a476208c84a0048cb554 xfs: pass the goal of the incore inode walk to xfs_inode_walk() :::::: TO: Darrick J. Wong <djwong(a)kernel.org> :::::: CC: Zheng Zengkai <zhengzengkai(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
by Liu Jian 09 Sep '24

09 Sep '24

From: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> stable inclusion from stable-v5.10.224 commit b7b8d9f5e679af60c94251fd6728dde34be69a71 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYL CVE: CVE-2024-44971 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit e3862093ee93fcfbdadcb7957f5f8974fffa806a ] bcm_sf2_mdio_register() calls of_phy_find_device() and then phy_device_remove() in a loop to remove existing PHY devices. of_phy_find_device() eventually calls bus_find_device(), which calls get_device() on the returned struct device * to increment the refcount. The current implementation does not decrement the refcount, which causes memory leak. This commit adds the missing phy_device_free() call to decrement the refcount via put_device() to balance the refcount. Fixes: 771089c2a485 ("net: dsa: bcm_sf2: Ensure that MDIO diversion is used") Signed-off-by: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> Tested-by: Florian Fainelli <florian.fainelli(a)broadcom.com> Reviewed-by: Florian Fainelli <florian.fainelli(a)broadcom.com> Link: https://patch.msgid.link/20240806011327.3817861-1-joe@pf.is.s.u-tokyo.ac.jp Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/dsa/bcm_sf2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c index a5849663f65c..d0f94a5fae5a 100644 --- a/drivers/net/dsa/bcm_sf2.c +++ b/drivers/net/dsa/bcm_sf2.c @@ -558,8 +558,10 @@ static int bcm_sf2_mdio_register(struct dsa_switch *ds) of_remove_property(child, prop); phydev = of_phy_find_device(child); - if (phydev) + if (phydev) { phy_device_remove(phydev); + phy_device_free(phydev); + } } err = mdiobus_register(priv->slave_mii_bus); -- 2.34.1

2 1

[PATCH OLK-5.10] mptcp: pm: avoid possible UaF when selecting endp
by Liu Jian 09 Sep '24

09 Sep '24

From: "Matthieu Baerts (NGI0)" <matttbe(a)kernel.org> mainline inclusion from mainline-v6.11-rc5 commit 48e50dcbcbaaf713d82bf2da5c16aeced94ad07d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY17 CVE: CVE-2024-44974 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free. A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with. Reported-by: Paolo Abeni <pabeni(a)redhat.com> Closes: https://lore.kernel.org/45cd30d3-7710-491c-ae4d-a1368c00beb1@redhat.com Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") Cc: stable(a)vger.kernel.org Reviewed-by: Mat Martineau <martineau(a)kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-14-38035d40de5… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/mptcp/pm_netlink.c [Did not backport 90d930882139 ("mptcp: constify a bunch of of helpers"), 85df533a787b ("mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set"), 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/mptcp/pm_netlink.c | 44 ++++++++++++++++++++++++------------------ 1 file changed, 25 insertions(+), 19 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index 0d6f3d912891..824420c4e8f9 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -128,11 +128,13 @@ static bool lookup_subflow_by_saddr(const struct list_head *list, return false; } -static struct mptcp_pm_addr_entry * +static bool select_local_address(const struct pm_nl_pernet *pernet, - struct mptcp_sock *msk) + struct mptcp_sock *msk, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; rcu_read_lock(); spin_lock_bh(&msk->join_list_lock); @@ -146,19 +148,23 @@ select_local_address(const struct pm_nl_pernet *pernet, if (entry->addr.family == ((struct sock *)msk)->sk_family && !lookup_subflow_by_saddr(&msk->conn_list, &entry->addr) && !lookup_subflow_by_saddr(&msk->join_list, &entry->addr)) { - ret = entry; + *new_entry = *entry; + found = true; break; } } spin_unlock_bh(&msk->join_list_lock); rcu_read_unlock(); - return ret; + + return found; } -static struct mptcp_pm_addr_entry * -select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) +static bool +select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; int i = 0; rcu_read_lock(); @@ -171,12 +177,14 @@ select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) if (!(entry->addr.flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) continue; if (i++ == pos) { - ret = entry; + *new_entry = *entry; + found = true; break; } } rcu_read_unlock(); - return ret; + + return found; } static void check_work_pending(struct mptcp_sock *msk) @@ -306,7 +314,7 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) { struct mptcp_addr_info remote = { 0 }; struct sock *sk = (struct sock *)msk; - struct mptcp_pm_addr_entry *local; + struct mptcp_pm_addr_entry local; struct pm_nl_pernet *pernet; pernet = net_generic(sock_net((struct sock *)msk), pm_nl_pernet_id); @@ -318,13 +326,12 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) /* check first for announce */ if (msk->pm.add_addr_signaled < msk->pm.add_addr_signal_max) { - local = select_signal_address(pernet, - msk->pm.add_addr_signaled); - if (local) { - if (mptcp_pm_alloc_anno_list(msk, local)) { + if (select_signal_address(pernet, + msk->pm.add_addr_signaled, &local)) { + if (mptcp_pm_alloc_anno_list(msk, &local)) { msk->pm.add_addr_signaled++; - mptcp_pm_announce_addr(msk, &local->addr, false); + mptcp_pm_announce_addr(msk, &local.addr, false); } } else { /* pick failed, avoid fourther attempts later */ @@ -339,13 +346,12 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) msk->pm.subflows < msk->pm.subflows_max) { remote_address((struct sock_common *)sk, &remote); - local = select_local_address(pernet, msk); - if (local) { + if (select_local_address(pernet, msk, &local)) { msk->pm.local_addr_used++; msk->pm.subflows++; check_work_pending(msk); spin_unlock_bh(&msk->pm.lock); - __mptcp_subflow_connect(sk, &local->addr, &remote); + __mptcp_subflow_connect(sk, &local.addr, &remote); spin_lock_bh(&msk->pm.lock); return; } -- 2.34.1

2 1

[PATCH OLK-6.6] bnxt_en: Fix double DMA unmapping for XDP_REDIRECT
by Liu Jian 09 Sep '24

09 Sep '24

From: Somnath Kotur <somnath.kotur(a)broadcom.com> stable inclusion from stable-v6.6.48 commit fa4e6ae38574d0fc5596272bee64727d8ab7052b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZU CVE: CVE-2024-44984 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 8baeef7616d5194045c5a6b97fd1246b87c55b13 ] Remove the dma_unmap_page_attrs() call in the driver's XDP_REDIRECT code path. This should have been removed when we let the page pool handle the DMA mapping. This bug causes the warning: WARNING: CPU: 7 PID: 59 at drivers/iommu/dma-iommu.c:1198 iommu_dma_unmap_page+0xd5/0x100 CPU: 7 PID: 59 Comm: ksoftirqd/7 Tainted: G W 6.8.0-1010-gcp #11-Ubuntu Hardware name: Dell Inc. PowerEdge R7525/0PYVT1, BIOS 2.15.2 04/02/2024 RIP: 0010:iommu_dma_unmap_page+0xd5/0x100 Code: 89 ee 48 89 df e8 cb f2 69 ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff 45 31 c0 e9 ab 17 71 00 <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 RSP: 0018:ffffab1fc0597a48 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff99ff838280c8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffab1fc0597a78 R08: 0000000000000002 R09: ffffab1fc0597c1c R10: ffffab1fc0597cd3 R11: ffff99ffe375acd8 R12: 00000000e65b9000 R13: 0000000000000050 R14: 0000000000001000 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffff9a06efb80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000565c34c37210 CR3: 00000005c7e3e000 CR4: 0000000000350ef0 ? show_regs+0x6d/0x80 ? __warn+0x89/0x150 ? iommu_dma_unmap_page+0xd5/0x100 ? report_bug+0x16a/0x190 ? handle_bug+0x51/0xa0 ? exc_invalid_op+0x18/0x80 ? iommu_dma_unmap_page+0xd5/0x100 ? iommu_dma_unmap_page+0x35/0x100 dma_unmap_page_attrs+0x55/0x220 ? bpf_prog_4d7e87c0d30db711_xdp_dispatcher+0x64/0x9f bnxt_rx_xdp+0x237/0x520 [bnxt_en] bnxt_rx_pkt+0x640/0xdd0 [bnxt_en] __bnxt_poll_work+0x1a1/0x3d0 [bnxt_en] bnxt_poll+0xaa/0x1e0 [bnxt_en] __napi_poll+0x33/0x1e0 net_rx_action+0x18a/0x2f0 Fixes: 578fcfd26e2a ("bnxt_en: Let the page pool manage the DMA mapping") Reviewed-by: Andy Gospodarek <andrew.gospodarek(a)broadcom.com> Reviewed-by: Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> Signed-off-by: Somnath Kotur <somnath.kotur(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Reviewed-by: Jacob Keller <jacob.e.keller(a)intel.com> Link: https://patch.msgid.link/20240820203415.168178-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c index 8cb9a99154aa..2845796f782c 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c @@ -297,11 +297,6 @@ bool bnxt_rx_xdp(struct bnxt *bp, struct bnxt_rx_ring_info *rxr, u16 cons, * redirect is coming from a frame received by the * bnxt_en driver. */ - rx_buf = &rxr->rx_buf_ring[cons]; - mapping = rx_buf->mapping - bp->rx_dma_offset; - dma_unmap_page_attrs(&pdev->dev, mapping, - BNXT_RX_PAGE_SIZE, bp->rx_dir, - DMA_ATTR_WEAK_ORDERING); /* if we are unable to allocate a new buffer, abort and reuse */ if (bnxt_alloc_rx_data(bp, rxr, rxr->rx_prod, GFP_ATOMIC)) { -- 2.34.1

2 1

[PATCH OLK-6.6] mptcp: pm: avoid possible UaF when selecting endp
by Liu Jian 09 Sep '24

09 Sep '24

From: "Matthieu Baerts (NGI0)" <matttbe(a)kernel.org> stable inclusion from stable-v6.6.48 commit 9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY17 CVE: CVE-2024-44974 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- commit 48e50dcbcbaaf713d82bf2da5c16aeced94ad07d upstream. select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free. A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with. Reported-by: Paolo Abeni <pabeni(a)redhat.com> Closes: https://lore.kernel.org/45cd30d3-7710-491c-ae4d-a1368c00beb1@redhat.com Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") Cc: stable(a)vger.kernel.org Reviewed-by: Mat Martineau <martineau(a)kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-14-38035d40de5… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/mptcp/pm_netlink.c | 64 ++++++++++++++++++++++-------------------- 1 file changed, 34 insertions(+), 30 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index b81fa77ce054..aa56696cdc78 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -148,11 +148,13 @@ static bool lookup_subflow_by_daddr(const struct list_head *list, return false; } -static struct mptcp_pm_addr_entry * +static bool select_local_address(const struct pm_nl_pernet *pernet, - const struct mptcp_sock *msk) + const struct mptcp_sock *msk, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; msk_owned_by_me(msk); @@ -164,17 +166,21 @@ select_local_address(const struct pm_nl_pernet *pernet, if (!test_bit(entry->addr.id, msk->pm.id_avail_bitmap)) continue; - ret = entry; + *new_entry = *entry; + found = true; break; } rcu_read_unlock(); - return ret; + + return found; } -static struct mptcp_pm_addr_entry * -select_signal_address(struct pm_nl_pernet *pernet, const struct mptcp_sock *msk) +static bool +select_signal_address(struct pm_nl_pernet *pernet, const struct mptcp_sock *msk, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; rcu_read_lock(); /* do not keep any additional per socket state, just signal @@ -189,11 +195,13 @@ select_signal_address(struct pm_nl_pernet *pernet, const struct mptcp_sock *msk) if (!(entry->flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) continue; - ret = entry; + *new_entry = *entry; + found = true; break; } rcu_read_unlock(); - return ret; + + return found; } unsigned int mptcp_pm_get_add_addr_signal_max(const struct mptcp_sock *msk) @@ -520,9 +528,10 @@ __lookup_addr(struct pm_nl_pernet *pernet, const struct mptcp_addr_info *info, static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) { - struct mptcp_pm_addr_entry *local, *signal_and_subflow = NULL; struct sock *sk = (struct sock *)msk; + struct mptcp_pm_addr_entry local; unsigned int add_addr_signal_max; + bool signal_and_subflow = false; unsigned int local_addr_max; struct pm_nl_pernet *pernet; unsigned int subflows_max; @@ -573,23 +582,22 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) if (msk->pm.addr_signal & BIT(MPTCP_ADD_ADDR_SIGNAL)) return; - local = select_signal_address(pernet, msk); - if (!local) + if (!select_signal_address(pernet, msk, &local)) goto subflow; /* If the alloc fails, we are on memory pressure, not worth * continuing, and trying to create subflows. */ - if (!mptcp_pm_alloc_anno_list(msk, &local->addr)) + if (!mptcp_pm_alloc_anno_list(msk, &local.addr)) return; - __clear_bit(local->addr.id, msk->pm.id_avail_bitmap); + __clear_bit(local.addr.id, msk->pm.id_avail_bitmap); msk->pm.add_addr_signaled++; - mptcp_pm_announce_addr(msk, &local->addr, false); + mptcp_pm_announce_addr(msk, &local.addr, false); mptcp_pm_nl_addr_send_ack(msk); - if (local->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW) - signal_and_subflow = local; + if (local.flags & MPTCP_PM_ADDR_FLAG_SUBFLOW) + signal_and_subflow = true; } subflow: @@ -600,26 +608,22 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) bool fullmesh; int i, nr; - if (signal_and_subflow) { - local = signal_and_subflow; - signal_and_subflow = NULL; - } else { - local = select_local_address(pernet, msk); - if (!local) - break; - } + if (signal_and_subflow) + signal_and_subflow = false; + else if (!select_local_address(pernet, msk, &local)) + break; - fullmesh = !!(local->flags & MPTCP_PM_ADDR_FLAG_FULLMESH); + fullmesh = !!(local.flags & MPTCP_PM_ADDR_FLAG_FULLMESH); msk->pm.local_addr_used++; - __clear_bit(local->addr.id, msk->pm.id_avail_bitmap); - nr = fill_remote_addresses_vec(msk, &local->addr, fullmesh, addrs); + __clear_bit(local.addr.id, msk->pm.id_avail_bitmap); + nr = fill_remote_addresses_vec(msk, &local.addr, fullmesh, addrs); if (nr == 0) continue; spin_unlock_bh(&msk->pm.lock); for (i = 0; i < nr; i++) - __mptcp_subflow_connect(sk, &local->addr, &addrs[i]); + __mptcp_subflow_connect(sk, &local.addr, &addrs[i]); spin_lock_bh(&msk->pm.lock); } mptcp_pm_nl_check_work_pending(msk); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] usb: gadget: core: Check for unset descriptor
by Ye Bin 09 Sep '24

09 Sep '24

From: Chris Wulff <crwulff(a)gmail.com> mainline inclusion from mainline-v6.11-rc3 commit 973a57891608a98e894db2887f278777f564de18 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZ1 CVE: CVE-2024-44960 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set up the endpoint for the current speed, or the gadget descriptors are malformed and the descriptor for the speed/endpoint are not found. No current gadget driver is known to have this problem, but this may cause a hard-to-find bug during development of new gadgets. Fixes: 54f83b8c8ea9 ("USB: gadget: Reject endpoints with 0 maxpacket value") Cc: stable(a)vger.kernel.org Signed-off-by: Chris Wulff <crwulff(a)gmail.com> Link: https://lore.kernel.org/r/20240725010419.314430-2-crwulff@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/usb/gadget/udc/core.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index b45dd7827ff9..1335a715f5dd 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -99,12 +99,10 @@ int usb_ep_enable(struct usb_ep *ep) goto out; /* UDC drivers can't handle endpoints with maxpacket size 0 */ - if (usb_endpoint_maxp(ep->desc) == 0) { - /* - * We should log an error message here, but we can't call - * dev_err() because there's no way to find the gadget - * given only ep. - */ + if (!ep->desc || usb_endpoint_maxp(ep->desc) == 0) { + WARN_ONCE(1, "%s: ep%d (%s) has %s\n", __func__, ep->address, ep->name, + (!ep->desc) ? "NULL descriptor" : "maxpacket 0"); + ret = -EINVAL; goto out; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] usb: gadget: core: Check for unset descriptor
by Ye Bin 09 Sep '24

09 Sep '24

From: Chris Wulff <crwulff(a)gmail.com> mainline inclusion from mainline-v6.11-rc3 commit 973a57891608a98e894db2887f278777f564de18 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZ1 CVE: CVE-2024-44960 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set up the endpoint for the current speed, or the gadget descriptors are malformed and the descriptor for the speed/endpoint are not found. No current gadget driver is known to have this problem, but this may cause a hard-to-find bug during development of new gadgets. Fixes: 54f83b8c8ea9 ("USB: gadget: Reject endpoints with 0 maxpacket value") Cc: stable(a)vger.kernel.org Signed-off-by: Chris Wulff <crwulff(a)gmail.com> Link: https://lore.kernel.org/r/20240725010419.314430-2-crwulff@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/usb/gadget/udc/core.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 7330c1999104..77ee0dbc52c5 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -99,12 +99,10 @@ int usb_ep_enable(struct usb_ep *ep) goto out; /* UDC drivers can't handle endpoints with maxpacket size 0 */ - if (usb_endpoint_maxp(ep->desc) == 0) { - /* - * We should log an error message here, but we can't call - * dev_err() because there's no way to find the gadget - * given only ep. - */ + if (!ep->desc || usb_endpoint_maxp(ep->desc) == 0) { + WARN_ONCE(1, "%s: ep%d (%s) has %s\n", __func__, ep->address, ep->name, + (!ep->desc) ? "NULL descriptor" : "maxpacket 0"); + ret = -EINVAL; goto out; } -- 2.34.1

2 1

[PATCH OLK-5.10] usb: gadget: core: Check for unset descriptor
by Ye Bin 09 Sep '24

09 Sep '24

From: Chris Wulff <crwulff(a)gmail.com> mainline inclusion from mainline-v6.11-rc3 commit 973a57891608a98e894db2887f278777f564de18 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZ1 CVE: CVE-2024-44960 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set up the endpoint for the current speed, or the gadget descriptors are malformed and the descriptor for the speed/endpoint are not found. No current gadget driver is known to have this problem, but this may cause a hard-to-find bug during development of new gadgets. Fixes: 54f83b8c8ea9 ("USB: gadget: Reject endpoints with 0 maxpacket value") Cc: stable(a)vger.kernel.org Signed-off-by: Chris Wulff <crwulff(a)gmail.com> Link: https://lore.kernel.org/r/20240725010419.314430-2-crwulff@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/usb/gadget/udc/core.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index e80aa717c8b5..dd2fafc5b0c3 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -99,12 +99,10 @@ int usb_ep_enable(struct usb_ep *ep) goto out; /* UDC drivers can't handle endpoints with maxpacket size 0 */ - if (usb_endpoint_maxp(ep->desc) == 0) { - /* - * We should log an error message here, but we can't call - * dev_err() because there's no way to find the gadget - * given only ep. - */ + if (!ep->desc || usb_endpoint_maxp(ep->desc) == 0) { + WARN_ONCE(1, "%s: ep%d (%s) has %s\n", __func__, ep->address, ep->name, + (!ep->desc) ? "NULL descriptor" : "maxpacket 0"); + ret = -EINVAL; goto out; } -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 14696/23701] drivers/base/node.c:429:5: sparse: sparse: symbol 'register_mem_block_under_node_early' was not declared. Should it be static?
by kernel test robot 07 Sep '24

07 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 13b424f97ef548612c760cfd0892f96de96707e0 commit: f38a43c2e1f2214acbda5d46af4518aa1d9d5e92 [14696/23701] mm: don't rely on system state to detect hot-plug operations config: x86_64-randconfig-123-20240906 (https://download.01.org/0day-ci/archive/20240907/202409072051.qFE23qXy-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240907/202409072051.qFE23qXy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409072051.qFE23qXy-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/base/node.c:429:5: sparse: sparse: symbol 'register_mem_block_under_node_early' was not declared. Should it be static? drivers/base/node.c:429:5: warning: no previous prototype for 'register_mem_block_under_node_early' [-Wmissing-prototypes] 429 | int register_mem_block_under_node_early(struct memory_block *mem_blk, void *arg) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/register_mem_block_under_node_early +429 drivers/base/node.c 427 428 /* register memory section under specified node if it spans that node */ > 429 int register_mem_block_under_node_early(struct memory_block *mem_blk, void *arg) 430 { 431 int nid = *(int *)arg; 432 unsigned long pfn, sect_start_pfn, sect_end_pfn; 433 434 sect_start_pfn = section_nr_to_pfn(mem_blk->start_section_nr); 435 sect_end_pfn = section_nr_to_pfn(mem_blk->end_section_nr); 436 sect_end_pfn += PAGES_PER_SECTION - 1; 437 for (pfn = sect_start_pfn; pfn <= sect_end_pfn; pfn++) { 438 int page_nid; 439 440 /* 441 * memory block could have several absent sections from start. 442 * skip pfn range from absent section 443 */ 444 if (!pfn_present(pfn)) { 445 pfn = round_down(pfn + PAGES_PER_SECTION, 446 PAGES_PER_SECTION) - 1; 447 continue; 448 } 449 450 /* 451 * We need to check if page belongs to nid only at the boot 452 * case because node's ranges can be interleaved. 453 */ 454 page_nid = get_nid_for_pfn(pfn); 455 if (page_nid < 0) 456 continue; 457 if (page_nid != nid) 458 continue; 459 460 return do_register_memory_block_under_node(nid, mem_blk); 461 } 462 /* mem section does not span the specified node */ 463 return 0; 464 } 465 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 7679/30000] kernel/locking/lockdep.o: warning: objtool: lockdep_unregister_key()+0x30b: unreachable instruction
by kernel test robot 07 Sep '24

07 Sep '24

Hi Waiman, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c431540f5e2720652e293713c7358952cd0148de commit: b91170be2b1f1ef673f5e79c7a4beb5673a8f881 [7679/30000] locking/lockdep: Avoid potential access of invalid memory in lock_class config: x86_64-randconfig-073-20240907 (https://download.01.org/0day-ci/archive/20240907/202409071717.JoTK5KQp-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240907/202409071717.JoTK5KQp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409071717.JoTK5KQp-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/locking/lockdep.o: warning: objtool: lockdep_unregister_key()+0x30b: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v2 0/2] CVE-2024-44972
by Yifan Qiao 07 Sep '24

07 Sep '24

Change Log: v2: Add CVE number inside the commit msg. Naohiro Aota (1): btrfs: fix invalid mapping of extent xarray state Qu Wenruo (1): btrfs: do not clear page dirty inside extent_write_locked_range() fs/btrfs/extent_io.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) -- 2.39.2

2 3

[openeuler:OLK-5.10] BUILD REGRESSION c431540f5e2720652e293713c7358952cd0148de
by kernel test robot 07 Sep '24

07 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: c431540f5e2720652e293713c7358952cd0148de !11041 coresight: etm4x: Fix unbalanced pm_runtime_enable() Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202409062029.0Fv1YZCJ-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `fmgr_usr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration |-- arm64-randconfig-002-20240907 | `-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration |-- arm64-randconfig-004-20240907 | `-- mm-memcontrol.c:error:implicit-declaration-of-function-ksm_process_profit |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-allyesconfig | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | |-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-function-mcp251xfd_tx_obj_write_sync | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_mbx_set_vf_multi_tc | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_tm_vf_tc_dwrr_cfg | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:variable-err-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-direction-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-queue-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-direction-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-queue-description-in-rnpvf_set_ring_vector | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_CTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_dispatch_event | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_net_exit | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-ctx-not-described-in-ubcore_update_uvs_eid_ret | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-dev-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-req-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-function-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-function-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TPG-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-function-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-function-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_UTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-function-ubcore_hash_table_rmv_vtpn | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_get_umap_ops | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_umap_priv_init | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_unmap_vma_pages | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-001-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-002-20240907 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-003-20240907 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-004-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-005-20240907 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-006-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-defconfig | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-001-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-002-20240907 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-003-20240906 | `-- multiple-definition-of-fmgr_usr_cmd_op-drivers-net-ethernet-netswift-txgbe-txgbe_hw.o:drivers-net-ethernet-netswift-txgbe-txgbe_type.h:first-defined-here |-- x86_64-randconfig-003-20240907 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-004-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-005-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-006-20240907 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-011-20240907 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-usb-dwc2-core_intr.c:error:struct-dwc2_hsotg-has-no-member-named-bus_suspended | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-012-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-013-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-014-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-015-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register `-- x86_64-rhel-8.3-rust |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register elapsed time: 1235m configs tested: 27 configs skipped: 128 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240907 gcc-14.1.0 arm64 randconfig-002-20240907 gcc-14.1.0 arm64 randconfig-003-20240907 gcc-14.1.0 arm64 randconfig-004-20240907 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240907 gcc-12 x86_64 buildonly-randconfig-002-20240907 gcc-12 x86_64 buildonly-randconfig-003-20240907 gcc-11 x86_64 buildonly-randconfig-004-20240907 clang-18 x86_64 buildonly-randconfig-005-20240907 gcc-12 x86_64 buildonly-randconfig-006-20240907 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240907 clang-18 x86_64 randconfig-002-20240907 gcc-12 x86_64 randconfig-003-20240907 gcc-12 x86_64 randconfig-004-20240907 clang-18 x86_64 randconfig-005-20240907 gcc-12 x86_64 randconfig-006-20240907 gcc-11 x86_64 randconfig-011-20240907 gcc-12 x86_64 randconfig-012-20240907 gcc-12 x86_64 randconfig-013-20240907 gcc-12 x86_64 randconfig-014-20240907 gcc-12 x86_64 randconfig-015-20240907 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13801/13880] include/linux/compiler_types.h:451:45: error: call to '__compiletime_assert_465' declared with attribute error: BUILD_BUG failed
by kernel test robot 07 Sep '24

07 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 10e0ea7796b38b1d35a6969966016d7a42d77b7f commit: c7fcbe1041758d0dedc32502609a73a22884d7b8 [13801/13880] mm: shmem: Merge shmem_alloc_hugefolio() with shmem_alloc_folio() config: arm64-randconfig-001-20240907 (https://download.01.org/0day-ci/archive/20240907/202409071355.c5MmsI6J-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240907/202409071355.c5MmsI6J-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409071355.c5MmsI6J-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from <command-line>: mm/shmem.c: In function 'shmem_alloc_folio.constprop.isra': >> include/linux/compiler_types.h:451:45: error: call to '__compiletime_assert_465' declared with attribute error: BUILD_BUG failed 451 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | ^ include/linux/compiler_types.h:432:25: note: in definition of macro '__compiletime_assert' 432 | prefix ## suffix(); \ | ^~~~~~ include/linux/compiler_types.h:451:9: note: in expansion of macro '_compiletime_assert' 451 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | ^~~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert' 39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) | ^~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:59:21: note: in expansion of macro 'BUILD_BUG_ON_MSG' 59 | #define BUILD_BUG() BUILD_BUG_ON_MSG(1, "BUILD_BUG failed") | ^~~~~~~~~~~~~~~~ include/linux/huge_mm.h:106:28: note: in expansion of macro 'BUILD_BUG' 106 | #define HPAGE_PMD_SHIFT ({ BUILD_BUG(); 0; }) | ^~~~~~~~~ include/linux/huge_mm.h:110:26: note: in expansion of macro 'HPAGE_PMD_SHIFT' 110 | #define HPAGE_PMD_ORDER (HPAGE_PMD_SHIFT-PAGE_SHIFT) | ^~~~~~~~~~~~~~~ mm/shmem.c:1641:64: note: in expansion of macro 'HPAGE_PMD_ORDER' 1641 | folio = vma_alloc_folio(gfp, order, &pvma, 0, order == HPAGE_PMD_ORDER); | ^~~~~~~~~~~~~~~ vim +/__compiletime_assert_465 +451 include/linux/compiler_types.h eb5c2d4b45e3d2 Will Deacon 2020-07-21 437 eb5c2d4b45e3d2 Will Deacon 2020-07-21 438 #define _compiletime_assert(condition, msg, prefix, suffix) \ eb5c2d4b45e3d2 Will Deacon 2020-07-21 439 __compiletime_assert(condition, msg, prefix, suffix) eb5c2d4b45e3d2 Will Deacon 2020-07-21 440 eb5c2d4b45e3d2 Will Deacon 2020-07-21 441 /** eb5c2d4b45e3d2 Will Deacon 2020-07-21 442 * compiletime_assert - break build and emit msg if condition is false eb5c2d4b45e3d2 Will Deacon 2020-07-21 443 * @condition: a compile-time constant condition to check eb5c2d4b45e3d2 Will Deacon 2020-07-21 444 * @msg: a message to emit if condition is false eb5c2d4b45e3d2 Will Deacon 2020-07-21 445 * eb5c2d4b45e3d2 Will Deacon 2020-07-21 446 * In tradition of POSIX assert, this macro will break the build if the eb5c2d4b45e3d2 Will Deacon 2020-07-21 447 * supplied condition is *false*, emitting the supplied error message if the eb5c2d4b45e3d2 Will Deacon 2020-07-21 448 * compiler has support to do so. eb5c2d4b45e3d2 Will Deacon 2020-07-21 449 */ eb5c2d4b45e3d2 Will Deacon 2020-07-21 450 #define compiletime_assert(condition, msg) \ eb5c2d4b45e3d2 Will Deacon 2020-07-21 @451 _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) eb5c2d4b45e3d2 Will Deacon 2020-07-21 452 :::::: The code at line 451 was first introduced by commit :::::: eb5c2d4b45e3d2d5d052ea6b8f1463976b1020d5 compiler.h: Move compiletime_assert() macros into compiler_types.h :::::: TO: Will Deacon <will(a)kernel.org> :::::: CC: Will Deacon <will(a)kernel.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13863/13880] arch/arm64/kernel/virtcca_cvm_host.c:37:6: warning: no previous prototype for function 'is_virtcca_cvm_enable'
by kernel test robot 07 Sep '24

07 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 10e0ea7796b38b1d35a6969966016d7a42d77b7f commit: ed007ade0cef81fb47328683b8a7eec5edfa8494 [13863/13880] virtcca feature: secure smmu init config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240907/202409071200.Tf9aVoeY-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 05f5a91d00b02f4369f46d076411c700755ae041) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240907/202409071200.Tf9aVoeY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409071200.Tf9aVoeY-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/arm64/kernel/virtcca_cvm_host.c:6: In file included from include/linux/mm.h:2242: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kernel/virtcca_cvm_host.c:37:6: warning: no previous prototype for function 'is_virtcca_cvm_enable' [-Wmissing-prototypes] 37 | bool is_virtcca_cvm_enable(void) | ^ arch/arm64/kernel/virtcca_cvm_host.c:37:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 37 | bool is_virtcca_cvm_enable(void) | ^ | static 6 warnings generated. -- >> arch/arm64/kvm/tmi.c:142: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write command to command queue arch/arm64/kvm/tmi.c:166: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Map mmio stage2 translation for device arch/arm64/kvm/tmi.c:180: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Unmap mmio stage2 translation for device arch/arm64/kvm/tmi.c:193: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write device mmio arch/arm64/kvm/tmi.c:208: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Read device mmio arch/arm64/kvm/tmi.c:233: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Attach device and configure L2 ste before activate CVM arch/arm64/kvm/tmi.c:276: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write smmu secure register arch/arm64/kvm/tmi.c:290: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Read smmu secure register -- In file included from drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:6: In file included from include/linux/pci.h:1669: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2242: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:509:13: warning: no previous prototype for function 'virtcca_smmu_evtq_thread' [-Wmissing-prototypes] 509 | irqreturn_t virtcca_smmu_evtq_thread(int irq, void *dev) | ^ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:509:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 509 | irqreturn_t virtcca_smmu_evtq_thread(int irq, void *dev) | ^ | static >> drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:527:13: warning: no previous prototype for function 'virtcca_smmu_gerror_handler' [-Wmissing-prototypes] 527 | irqreturn_t virtcca_smmu_gerror_handler(int irq, void *dev) | ^ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:527:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 527 | irqreturn_t virtcca_smmu_gerror_handler(int irq, void *dev) | ^ | static 7 warnings generated. -- >> drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:58: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Traverse pcie topology to find the root <bus,device> number drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:80: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Traverse pcie topology to find child devices drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:118: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Get all devices which share the same root_bd as dev drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:146: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Add device obj to hash tablse drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:183: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Whether the root port is secure or not drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:204: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Whether the vm is confidential vm drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:225: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Whether the stream id of dev is confidential drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:246: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Whether the cmd queue need transfer to secure world drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:298: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write queue command to TMM drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:328: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write a batch of queue command to TMM, if need sync, will send additional cmd queue drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:383: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Initialize a queue of the corresponding type drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:424: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write values to secure smmu registers and wait for completion drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:449: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write values to glabal bypass register drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:485: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Disable the secure smmu drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:505: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * The secure evt queue thread drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:520: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * The secure gerror handler drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:590: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Disable secure smmu irq function drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:603: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Enable secure smmu irq function drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:617: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Get irq index from platform drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:636: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Complete the stage2 page table establishment for the security device drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:691: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Setting up the STE config content for the security device drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:729: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Add secure device to hash table drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:766: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Delegate device to secure state drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:815: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Enable the PCIe protection controller function of the security device drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:844: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write secure smmu msi msg drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:877: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Enable secure smmu msi drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:907: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Set secure irq handle drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:945: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write value to smmu registers and wait for completion drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:965: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Initialize the smmu irq drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:1016: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * For SMMU, it has various uses. In virtCCA scenario, drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:1044: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Enable the smmu secure state drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:1079: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Whether the smmu support secure registers and secure stage2 translate drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:1113: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Implement security settings for corresponding devices targeting the secure smmu domain drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:1171: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Initialize the smmu security features vim +/is_virtcca_cvm_enable +37 arch/arm64/kernel/virtcca_cvm_host.c 36 > 37 bool is_virtcca_cvm_enable(void) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 5435/23701] drivers/tty/serial/sc16is7xx.c:1501:1: warning: label 'err_i2c' defined but not used
by kernel test robot 07 Sep '24

07 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 13b424f97ef548612c760cfd0892f96de96707e0 commit: 1c30433d9fa5c5b48039990ba214c0e8e199a22d [5435/23701] sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init() config: x86_64-randconfig-121-20240906 (https://download.01.org/0day-ci/archive/20240907/202409071206.ARybrxJe-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240907/202409071206.ARybrxJe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409071206.ARybrxJe-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/tty/serial/sc16is7xx.c:1501:1: sparse: sparse: unused label 'err_i2c' drivers/tty/serial/sc16is7xx.c: In function 'sc16is7xx_init': >> drivers/tty/serial/sc16is7xx.c:1501:1: warning: label 'err_i2c' defined but not used [-Wunused-label] 1501 | err_i2c: | ^~~~~~~ vim +/err_i2c +1501 drivers/tty/serial/sc16is7xx.c 1487 1488 #ifdef CONFIG_SERIAL_SC16IS7XX_SPI 1489 ret = spi_register_driver(&sc16is7xx_spi_uart_driver); 1490 if (ret < 0) { 1491 pr_err("failed to init sc16is7xx spi --> %d\n", ret); 1492 goto err_spi; 1493 } 1494 #endif 1495 return ret; 1496 1497 err_spi: 1498 #ifdef CONFIG_SERIAL_SC16IS7XX_I2C 1499 i2c_del_driver(&sc16is7xx_i2c_uart_driver); 1500 #endif > 1501 err_i2c: 1502 uart_unregister_driver(&sc16is7xx_uart); 1503 return ret; 1504 } 1505 module_init(sc16is7xx_init); 1506 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] nfs: fix memory leak in error path of nfs4_do_reclaim
by Li Lingfeng 07 Sep '24

07 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAPAZ3 -------------------------------- Commit c77e22834ae9 ("NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()") separate out the freeing of the state owners from nfs4_purge_state_owners() and finish it outside the rcu lock. However, the error path is omitted. As a result, the state owners in "freeme" will not be released. Fix it by adding freeing in the error path. Fixes: c77e22834ae9 ("NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4state.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c index 9a5d911a7edc..ae031c89251b 100644 --- a/fs/nfs/nfs4state.c +++ b/fs/nfs/nfs4state.c @@ -1957,6 +1957,7 @@ static int nfs4_do_reclaim(struct nfs_client *clp, const struct nfs4_state_recov set_bit(ops->owner_flag_bit, &sp->so_flags); nfs4_put_state_owner(sp); status = nfs4_recovery_handle_error(clp, status); + nfs4_free_state_owners(&freeme); return (status != 0) ? status : -EAGAIN; } -- 2.31.1

2 1

[PATCH OLK-5.10] nfs: fix memory leak in error path of nfs4_do_reclaim
by Li Lingfeng 07 Sep '24

07 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAOYZS -------------------------------- Commit c77e22834ae9 ("NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()") separate out the freeing of the state owners from nfs4_purge_state_owners() and finish it outside the rcu lock. However, the error path is omitted. As a result, the state owners in "freeme" will not be released. Fix it by adding freeing in the error path. Fixes: c77e22834ae9 ("NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4state.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c index afb617a4a7e4..f5ebb747ddf4 100644 --- a/fs/nfs/nfs4state.c +++ b/fs/nfs/nfs4state.c @@ -1948,6 +1948,7 @@ static int nfs4_do_reclaim(struct nfs_client *clp, const struct nfs4_state_recov set_bit(ops->owner_flag_bit, &sp->so_flags); nfs4_put_state_owner(sp); status = nfs4_recovery_handle_error(clp, status); + nfs4_free_state_owners(&freeme); return (status != 0) ? status : -EAGAIN; } -- 2.31.1

2 1

[openeuler:openEuler-1.0-LTS 5421/23701] arch/arm64/kernel/ptrace.c:1379:38: sparse: sparse: incorrect type in argument 6 (different address spaces)
by kernel test robot 07 Sep '24

07 Sep '24

Hi Paulo, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 13b424f97ef548612c760cfd0892f96de96707e0 commit: 71e217e85c3dff8a9151707ed3afc7b4b054a2d4 [5421/23701] selinux: use kernel linux/socket.h for genheaders and mdp config: arm64-randconfig-r131-20240906 (https://download.01.org/0day-ci/archive/20240907/202409071155.6ow4kT3d-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240907/202409071155.6ow4kT3d-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409071155.6ow4kT3d-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/arm64/kernel/ptrace.c:1379:38: sparse: sparse: incorrect type in argument 6 (different address spaces) @@ expected void const [noderef] <asn:1> *data @@ got unsigned int * @@ arch/arm64/kernel/ptrace.c:1379:38: sparse: expected void const [noderef] <asn:1> *data arch/arm64/kernel/ptrace.c:1379:38: sparse: got unsigned int * arch/arm64/kernel/ptrace.c:1637:5: warning: no previous prototype for 'syscall_trace_enter' [-Wmissing-prototypes] 1637 | int syscall_trace_enter(struct pt_regs *regs) | ^~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/ptrace.c:1655:6: warning: no previous prototype for 'syscall_trace_exit' [-Wmissing-prototypes] 1655 | void syscall_trace_exit(struct pt_regs *regs) | ^~~~~~~~~~~~~~~~~~ -- >> arch/arm64/kernel/traps.c:77:23: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected unsigned int [noderef] <asn:1> *__p @@ got unsigned int [usertype] * @@ arch/arm64/kernel/traps.c:77:23: sparse: expected unsigned int [noderef] <asn:1> *__p arch/arm64/kernel/traps.c:77:23: sparse: got unsigned int [usertype] * arch/arm64/kernel/traps.c:408:29: warning: no previous prototype for 'do_undefinstr' [-Wmissing-prototypes] 408 | asmlinkage void __exception do_undefinstr(struct pt_regs *regs) | ^~~~~~~~~~~~~ arch/arm64/kernel/traps.c:541:29: warning: no previous prototype for 'do_sysinstr' [-Wmissing-prototypes] 541 | asmlinkage void __exception do_sysinstr(unsigned int esr, struct pt_regs *regs) | ^~~~~~~~~~~ arch/arm64/kernel/traps.c:561:43: warning: initialized field overwritten [-Woverride-init] 561 | [ESR_ELx_EC_UNKNOWN] = "Unknown/Uncategorized", | ^~~~~~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:561:43: note: (near initialization for 'esr_class_str[0]') arch/arm64/kernel/traps.c:562:43: warning: initialized field overwritten [-Woverride-init] 562 | [ESR_ELx_EC_WFx] = "WFI/WFE", | ^~~~~~~~~ arch/arm64/kernel/traps.c:562:43: note: (near initialization for 'esr_class_str[1]') arch/arm64/kernel/traps.c:563:43: warning: initialized field overwritten [-Woverride-init] 563 | [ESR_ELx_EC_CP15_32] = "CP15 MCR/MRC", | ^~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:563:43: note: (near initialization for 'esr_class_str[3]') arch/arm64/kernel/traps.c:564:43: warning: initialized field overwritten [-Woverride-init] 564 | [ESR_ELx_EC_CP15_64] = "CP15 MCRR/MRRC", | ^~~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:564:43: note: (near initialization for 'esr_class_str[4]') arch/arm64/kernel/traps.c:565:43: warning: initialized field overwritten [-Woverride-init] 565 | [ESR_ELx_EC_CP14_MR] = "CP14 MCR/MRC", | ^~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:565:43: note: (near initialization for 'esr_class_str[5]') arch/arm64/kernel/traps.c:566:43: warning: initialized field overwritten [-Woverride-init] 566 | [ESR_ELx_EC_CP14_LS] = "CP14 LDC/STC", | ^~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:566:43: note: (near initialization for 'esr_class_str[6]') arch/arm64/kernel/traps.c:567:43: warning: initialized field overwritten [-Woverride-init] 567 | [ESR_ELx_EC_FP_ASIMD] = "ASIMD", | ^~~~~~~ arch/arm64/kernel/traps.c:567:43: note: (near initialization for 'esr_class_str[7]') arch/arm64/kernel/traps.c:568:43: warning: initialized field overwritten [-Woverride-init] 568 | [ESR_ELx_EC_CP10_ID] = "CP10 MRC/VMRS", | ^~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:568:43: note: (near initialization for 'esr_class_str[8]') arch/arm64/kernel/traps.c:569:43: warning: initialized field overwritten [-Woverride-init] 569 | [ESR_ELx_EC_CP14_64] = "CP14 MCRR/MRRC", | ^~~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:569:43: note: (near initialization for 'esr_class_str[12]') arch/arm64/kernel/traps.c:570:43: warning: initialized field overwritten [-Woverride-init] 570 | [ESR_ELx_EC_ILL] = "PSTATE.IL", | ^~~~~~~~~~~ arch/arm64/kernel/traps.c:570:43: note: (near initialization for 'esr_class_str[14]') arch/arm64/kernel/traps.c:571:43: warning: initialized field overwritten [-Woverride-init] 571 | [ESR_ELx_EC_SVC32] = "SVC (AArch32)", | ^~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:571:43: note: (near initialization for 'esr_class_str[17]') arch/arm64/kernel/traps.c:572:43: warning: initialized field overwritten [-Woverride-init] 572 | [ESR_ELx_EC_HVC32] = "HVC (AArch32)", | ^~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:572:43: note: (near initialization for 'esr_class_str[18]') arch/arm64/kernel/traps.c:573:43: warning: initialized field overwritten [-Woverride-init] 573 | [ESR_ELx_EC_SMC32] = "SMC (AArch32)", | ^~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:573:43: note: (near initialization for 'esr_class_str[19]') arch/arm64/kernel/traps.c:574:43: warning: initialized field overwritten [-Woverride-init] 574 | [ESR_ELx_EC_SVC64] = "SVC (AArch64)", | ^~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:574:43: note: (near initialization for 'esr_class_str[21]') arch/arm64/kernel/traps.c:575:43: warning: initialized field overwritten [-Woverride-init] 575 | [ESR_ELx_EC_HVC64] = "HVC (AArch64)", | ^~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:575:43: note: (near initialization for 'esr_class_str[22]') arch/arm64/kernel/traps.c:576:43: warning: initialized field overwritten [-Woverride-init] 576 | [ESR_ELx_EC_SMC64] = "SMC (AArch64)", | ^~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:576:43: note: (near initialization for 'esr_class_str[23]') arch/arm64/kernel/traps.c:577:43: warning: initialized field overwritten [-Woverride-init] 577 | [ESR_ELx_EC_SYS64] = "MSR/MRS (AArch64)", | ^~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:577:43: note: (near initialization for 'esr_class_str[24]') arch/arm64/kernel/traps.c:578:43: warning: initialized field overwritten [-Woverride-init] 578 | [ESR_ELx_EC_SVE] = "SVE", | ^~~~~ arch/arm64/kernel/traps.c:578:43: note: (near initialization for 'esr_class_str[25]') arch/arm64/kernel/traps.c:579:43: warning: initialized field overwritten [-Woverride-init] 579 | [ESR_ELx_EC_IMP_DEF] = "EL3 IMP DEF", | ^~~~~~~~~~~~~ arch/arm64/kernel/traps.c:579:43: note: (near initialization for 'esr_class_str[31]') arch/arm64/kernel/traps.c:580:43: warning: initialized field overwritten [-Woverride-init] 580 | [ESR_ELx_EC_IABT_LOW] = "IABT (lower EL)", | ^~~~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:580:43: note: (near initialization for 'esr_class_str[32]') arch/arm64/kernel/traps.c:581:43: warning: initialized field overwritten [-Woverride-init] 581 | [ESR_ELx_EC_IABT_CUR] = "IABT (current EL)", | ^~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:581:43: note: (near initialization for 'esr_class_str[33]') arch/arm64/kernel/traps.c:582:43: warning: initialized field overwritten [-Woverride-init] -- >> arch/arm64/kernel/cpu_errata.c:277:1: sparse: sparse: symbol '__pcpu_scope_arm64_ssbd_callback_required' was not declared. Should it be static? arch/arm64/kernel/cpu_errata.c:311:13: warning: no previous prototype for 'arm64_update_smccc_conduit' [-Wmissing-prototypes] 311 | void __init arm64_update_smccc_conduit(struct alt_instr *alt, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/cpu_errata.c:333:13: warning: no previous prototype for 'arm64_enable_wa2_handling' [-Wmissing-prototypes] 333 | void __init arm64_enable_wa2_handling(struct alt_instr *alt, | ^~~~~~~~~~~~~~~~~~~~~~~~~ -- >> crypto/testmgr.c:1915:17: sparse: sparse: Variable length array is used. >> crypto/testmgr.c:1921:24: sparse: sparse: cast to restricted __le32 >> crypto/testmgr.c:1921:24: sparse: sparse: cast to restricted __le32 >> crypto/testmgr.c:1921:24: sparse: sparse: cast to restricted __le32 >> crypto/testmgr.c:1921:24: sparse: sparse: cast to restricted __le32 >> crypto/testmgr.c:1921:24: sparse: sparse: cast to restricted __le32 >> crypto/testmgr.c:1921:24: sparse: sparse: cast to restricted __le32 -- >> drivers/base/regmap/regmap.c:335:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] @@ got unsigned short [usertype] @@ drivers/base/regmap/regmap.c:335:14: sparse: expected restricted __be16 [usertype] drivers/base/regmap/regmap.c:335:14: sparse: got unsigned short [usertype] >> drivers/base/regmap/regmap.c:342:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] @@ got int @@ drivers/base/regmap/regmap.c:342:14: sparse: expected restricted __le16 [usertype] drivers/base/regmap/regmap.c:342:14: sparse: got int >> drivers/base/regmap/regmap.c:378:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] @@ got unsigned int [usertype] @@ drivers/base/regmap/regmap.c:378:14: sparse: expected restricted __be32 [usertype] drivers/base/regmap/regmap.c:378:14: sparse: got unsigned int [usertype] >> drivers/base/regmap/regmap.c:385:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] @@ got unsigned int @@ drivers/base/regmap/regmap.c:385:14: sparse: expected restricted __le32 [usertype] drivers/base/regmap/regmap.c:385:14: sparse: got unsigned int >> drivers/base/regmap/regmap.c:412:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be64 [usertype] @@ got unsigned long long [usertype] @@ drivers/base/regmap/regmap.c:412:14: sparse: expected restricted __be64 [usertype] drivers/base/regmap/regmap.c:412:14: sparse: got unsigned long long [usertype] >> drivers/base/regmap/regmap.c:419:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le64 [usertype] @@ got unsigned long long @@ drivers/base/regmap/regmap.c:419:14: sparse: expected restricted __le64 [usertype] drivers/base/regmap/regmap.c:419:14: sparse: got unsigned long long -- >> drivers/bluetooth/btmtkuart.c:479:59: sparse: sparse: Using plain integer as NULL pointer -- >> drivers/clk/hisilicon/clk-hi3660.c:336:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:338:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:340:70: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:342:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:344:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:346:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:348:70: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:350:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:352:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:354:70: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:356:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:358:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:360:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:362:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:364:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:366:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:368:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:370:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:372:70: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:374:70: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:376:70: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:378:71: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:423:68: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:425:68: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:427:68: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:429:68: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:449:70: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:451:71: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:453:71: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:455:71: sparse: sparse: Using plain integer as NULL pointer -- >> drivers/clk/tegra/clk-super.c:124:22: sparse: sparse: symbol 'tegra_clk_super_mux_ops' was not declared. Should it be static? drivers/clk/tegra/clk-super.c:121:9: sparse: sparse: context imbalance in 'clk_super_set_parent' - different lock contexts for basic block -- >> drivers/clk/tegra/clk-tegra210.c:2952:9: sparse: sparse: Using plain integer as NULL pointer >> drivers/clk/tegra/clk-tegra210.c:2952:9: sparse: sparse: Using plain integer as NULL pointer -- drivers/clocksource/timer-of.c:39:55: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] <asn:3> * @@ got struct clock_event_device *clkevt @@ drivers/clocksource/timer-of.c:39:55: sparse: expected void [noderef] <asn:3> * drivers/clocksource/timer-of.c:39:55: sparse: got struct clock_event_device *clkevt >> drivers/clocksource/timer-of.c:39:24: sparse: sparse: incompatible types in conditional expression (different types): drivers/clocksource/timer-of.c:39:24: sparse: void drivers/clocksource/timer-of.c:39:24: sparse: void const * drivers/clocksource/timer-of.c:83:51: sparse: sparse: incorrect type in argument 4 (different address spaces) @@ expected void [noderef] <asn:3> *percpu_dev_id @@ got struct clock_event_device *clkevt @@ drivers/clocksource/timer-of.c:83:51: sparse: expected void [noderef] <asn:3> *percpu_dev_id drivers/clocksource/timer-of.c:83:51: sparse: got struct clock_event_device *clkevt -- >> drivers/cpufreq/tegra186-cpufreq.c:79:37: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *driver_data @@ got void [noderef] <asn:2> * @@ drivers/cpufreq/tegra186-cpufreq.c:79:37: sparse: expected void *driver_data drivers/cpufreq/tegra186-cpufreq.c:79:37: sparse: got void [noderef] <asn:2> * >> drivers/cpufreq/tegra186-cpufreq.c:94:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void [noderef] <asn:2> *edvd_reg @@ got void *driver_data @@ drivers/cpufreq/tegra186-cpufreq.c:94:40: sparse: expected void [noderef] <asn:2> *edvd_reg drivers/cpufreq/tegra186-cpufreq.c:94:40: sparse: got void *driver_data -- >> drivers/crypto/bcm/spu.c:26:6: sparse: sparse: symbol 'tag_to_hash_idx' was not declared. Should it be static? drivers/crypto/bcm/spu.c:77:26: sparse: sparse: cast to restricted __be32 drivers/crypto/bcm/spu.c:82:26: sparse: sparse: cast to restricted __be32 drivers/crypto/bcm/spu.c:102:23: sparse: sparse: cast to restricted __be32 drivers/crypto/bcm/spu.c:410:18: sparse: sparse: cast to restricted __be16 drivers/crypto/bcm/spu.c:799:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] proto_flags @@ got restricted __be32 [usertype] @@ drivers/crypto/bcm/spu.c:799:30: sparse: expected unsigned int [usertype] proto_flags drivers/crypto/bcm/spu.c:799:30: sparse: got restricted __be32 [usertype] drivers/crypto/bcm/spu.c:800:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] cipher_flags @@ got restricted __be32 [usertype] @@ drivers/crypto/bcm/spu.c:800:31: sparse: expected unsigned int [usertype] cipher_flags drivers/crypto/bcm/spu.c:800:31: sparse: got restricted __be32 [usertype] drivers/crypto/bcm/spu.c:801:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] ecf @@ got restricted __be32 [usertype] @@ drivers/crypto/bcm/spu.c:801:22: sparse: expected unsigned int [usertype] ecf drivers/crypto/bcm/spu.c:801:22: sparse: got restricted __be32 [usertype] drivers/crypto/bcm/spu.c:806:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] offset_mac @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:806:27: sparse: expected unsigned short [usertype] offset_mac drivers/crypto/bcm/spu.c:806:27: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:807:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] length_mac @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:807:27: sparse: expected unsigned short [usertype] length_mac drivers/crypto/bcm/spu.c:807:27: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:808:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] offset_crypto @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:808:30: sparse: expected unsigned short [usertype] offset_crypto drivers/crypto/bcm/spu.c:808:30: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:809:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] length_crypto @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:809:30: sparse: expected unsigned short [usertype] length_crypto drivers/crypto/bcm/spu.c:809:30: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:818:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] offset_icv @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:818:27: sparse: expected unsigned short [usertype] offset_icv drivers/crypto/bcm/spu.c:818:27: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:819:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] offset_iv @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:819:26: sparse: expected unsigned short [usertype] offset_iv drivers/crypto/bcm/spu.c:819:26: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:830:18: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] size @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:830:18: sparse: expected unsigned short [usertype] size drivers/crypto/bcm/spu.c:830:18: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:914:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] proto_flags @@ got restricted __be32 [usertype] @@ drivers/crypto/bcm/spu.c:914:30: sparse: expected unsigned int [usertype] proto_flags drivers/crypto/bcm/spu.c:914:30: sparse: got restricted __be32 [usertype] drivers/crypto/bcm/spu.c:917:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] cipher_flags @@ got restricted __be32 [usertype] @@ drivers/crypto/bcm/spu.c:917:31: sparse: expected unsigned int [usertype] cipher_flags drivers/crypto/bcm/spu.c:917:31: sparse: got restricted __be32 [usertype] drivers/crypto/bcm/spu.c:918:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] ecf @@ got restricted __be32 [usertype] @@ drivers/crypto/bcm/spu.c:918:22: sparse: expected unsigned int [usertype] ecf drivers/crypto/bcm/spu.c:918:22: sparse: got restricted __be32 [usertype] drivers/crypto/bcm/spu.c:990:23: sparse: sparse: cast to restricted __be32 drivers/crypto/bcm/spu.c:1010:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] cipher_flags @@ got restricted __be32 [usertype] @@ drivers/crypto/bcm/spu.c:1010:31: sparse: expected unsigned int [usertype] cipher_flags drivers/crypto/bcm/spu.c:1010:31: sparse: got restricted __be32 [usertype] drivers/crypto/bcm/spu.c:1020:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] length_crypto @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:1020:38: sparse: expected unsigned short [usertype] length_crypto drivers/crypto/bcm/spu.c:1020:38: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:1023:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] length_crypto @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:1023:38: sparse: expected unsigned short [usertype] length_crypto drivers/crypto/bcm/spu.c:1023:38: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:1033:18: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] size @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:1033:18: sparse: expected unsigned short [usertype] size drivers/crypto/bcm/spu.c:1033:18: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:1037:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] size @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:1037:26: sparse: expected unsigned short [usertype] size drivers/crypto/bcm/spu.c:1037:26: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:1039:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] size @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:1039:26: sparse: expected unsigned short [usertype] size drivers/crypto/bcm/spu.c:1039:26: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:1094:45: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu.c:1094:45: sparse: expected unsigned long long [usertype] drivers/crypto/bcm/spu.c:1094:45: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu.c:1096:45: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __be64 [usertype] @@ drivers/crypto/bcm/spu.c:1096:45: sparse: expected unsigned long long [usertype] drivers/crypto/bcm/spu.c:1096:45: sparse: got restricted __be64 [usertype] drivers/crypto/bcm/spu.c: In function 'spum_dump_msg_hdr': drivers/crypto/bcm/spu.c:121:31: warning: variable 'name' set but not used [-Wunused-but-set-variable] 121 | char *name = "NONE"; | ^~~~ drivers/crypto/bcm/spu.c:162:31: warning: variable 'name' set but not used [-Wunused-but-set-variable] 162 | char *name = "NONE"; | ^~~~ drivers/crypto/bcm/spu.c:186:31: warning: variable 'name' set but not used [-Wunused-but-set-variable] 186 | char *name = "NONE"; | ^~~~ drivers/crypto/bcm/spu.c:228:31: warning: variable 'name' set but not used [-Wunused-but-set-variable] 228 | char *name = "NONE"; | ^~~~ drivers/crypto/bcm/spu.c:484: warning: Excess function parameter 'Return' description in 'spum_gcm_ccm_pad_len' drivers/crypto/bcm/spu.c:544: warning: Function parameter or member 'iv_len' not described in 'spum_aead_ivlen' drivers/crypto/bcm/spu.c:544: warning: Excess function parameter 'iv_ctr_len' description in 'spum_aead_ivlen' drivers/crypto/bcm/spu.c:576: warning: Function parameter or member 'alg_digest_size' not described in 'spum_digest_size' drivers/crypto/bcm/spu.c:576: warning: Function parameter or member 'alg' not described in 'spum_digest_size' drivers/crypto/bcm/spu.c:576: warning: Function parameter or member 'htype' not described in 'spum_digest_size' drivers/crypto/bcm/spu.c:603: warning: bad line: drivers/crypto/bcm/spu.c:952: warning: Function parameter or member 'is_inbound' not described in 'spum_cipher_req_finish' drivers/crypto/bcm/spu.c:952: warning: Excess function parameter 'isInbound' description in 'spum_cipher_req_finish' -- >> drivers/crypto/bcm/spu2.c:52:6: sparse: sparse: symbol 'spu2_cipher_type_names' was not declared. Should it be static? >> drivers/crypto/bcm/spu2.c:56:6: sparse: sparse: symbol 'spu2_cipher_mode_names' was not declared. Should it be static? >> drivers/crypto/bcm/spu2.c:60:6: sparse: sparse: symbol 'spu2_hash_type_names' was not declared. Should it be static? >> drivers/crypto/bcm/spu2.c:66:6: sparse: sparse: symbol 'spu2_hash_mode_names' was not declared. Should it be static? drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:599:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl0 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:599:20: sparse: expected unsigned long long [usertype] ctrl0 drivers/crypto/bcm/spu2.c:599:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:600:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl1 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:600:20: sparse: expected unsigned long long [usertype] ctrl1 drivers/crypto/bcm/spu2.c:600:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:601:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl2 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:601:20: sparse: expected unsigned long long [usertype] ctrl2 drivers/crypto/bcm/spu2.c:601:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:602:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl3 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:602:20: sparse: expected unsigned long long [usertype] ctrl3 drivers/crypto/bcm/spu2.c:602:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:647:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl0 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:647:20: sparse: expected unsigned long long [usertype] ctrl0 drivers/crypto/bcm/spu2.c:647:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:727:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl1 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:727:20: sparse: expected unsigned long long [usertype] ctrl1 drivers/crypto/bcm/spu2.c:727:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:761:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl2 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:761:20: sparse: expected unsigned long long [usertype] ctrl2 drivers/crypto/bcm/spu2.c:761:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:775:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl3 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:775:20: sparse: expected unsigned long long [usertype] ctrl3 drivers/crypto/bcm/spu2.c:775:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1231:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl0 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:1231:20: sparse: expected unsigned long long [usertype] ctrl0 drivers/crypto/bcm/spu2.c:1231:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:1239:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1239:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1239:17: sparse: sparse: cast to restricted __le64 -- >> drivers/crypto/bcm/cipher.c:99:6: sparse: sparse: symbol 'BCMHEADER' was not declared. Should it be static? >> drivers/crypto/bcm/cipher.c:2100:6: sparse: sparse: symbol 'spu_no_incr_hash' was not declared. Should it be static? >> drivers/crypto/bcm/cipher.c:4826:5: sparse: sparse: symbol 'bcm_spu_probe' was not declared. Should it be static? >> drivers/crypto/bcm/cipher.c:4870:5: sparse: sparse: symbol 'bcm_spu_remove' was not declared. Should it be static? drivers/crypto/bcm/cipher.c: In function 'handle_ahash_req': drivers/crypto/bcm/cipher.c:720:22: warning: variable 'chunk_start' set but not used [-Wunused-but-set-variable] 720 | unsigned int chunk_start = 0; | ^~~~~~~~~~~ drivers/crypto/bcm/cipher.c: In function 'spu_rx_callback': drivers/crypto/bcm/cipher.c:1679:38: warning: variable 'areq' set but not used [-Wunused-but-set-variable] 1679 | struct crypto_async_request *areq; | ^~~~ drivers/crypto/bcm/cipher.c:1678:29: warning: variable 'ctx' set but not used [-Wunused-but-set-variable] 1678 | struct iproc_ctx_s *ctx; | ^~~ drivers/crypto/bcm/cipher.c: At top level: drivers/crypto/bcm/cipher.c:2100:6: warning: no previous prototype for 'spu_no_incr_hash' [-Wmissing-prototypes] 2100 | bool spu_no_incr_hash(struct iproc_ctx_s *ctx) | ^~~~~~~~~~~~~~~~ drivers/crypto/bcm/cipher.c:4826:5: warning: no previous prototype for 'bcm_spu_probe' [-Wmissing-prototypes] 4826 | int bcm_spu_probe(struct platform_device *pdev) | ^~~~~~~~~~~~~ drivers/crypto/bcm/cipher.c:4870:5: warning: no previous prototype for 'bcm_spu_remove' [-Wmissing-prototypes] 4870 | int bcm_spu_remove(struct platform_device *pdev) | ^~~~~~~~~~~~~~ drivers/crypto/bcm/cipher.c:1097: warning: Function parameter or member 'req' not described in 'spu_aead_rx_sg_create' drivers/crypto/bcm/cipher.c:3087: warning: Function parameter or member 'cipher' not described in 'rfc4543_gcm_esp_setkey' drivers/crypto/bcm/cipher.c:3087: warning: Function parameter or member 'key' not described in 'rfc4543_gcm_esp_setkey' drivers/crypto/bcm/cipher.c:3087: warning: Function parameter or member 'keylen' not described in 'rfc4543_gcm_esp_setkey' -- >> drivers/crypto/qce/ablkcipher.c:215:17: sparse: sparse: Variable length array is used. -- >> drivers/firmware/google/coreboot_table.c:117:22: sparse: sparse: cast removes address space '<asn:2>' of expression >> drivers/firmware/google/coreboot_table.c:119:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const volatile [noderef] <asn:2> * @@ got void *[assigned] ptr_entry @@ drivers/firmware/google/coreboot_table.c:119:17: sparse: expected void const volatile [noderef] <asn:2> * drivers/firmware/google/coreboot_table.c:119:17: sparse: got void *[assigned] ptr_entry drivers/firmware/google/coreboot_table.c:131:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const volatile [noderef] <asn:2> * @@ got void *[assigned] ptr_entry @@ drivers/firmware/google/coreboot_table.c:131:17: sparse: expected void const volatile [noderef] <asn:2> * drivers/firmware/google/coreboot_table.c:131:17: sparse: got void *[assigned] ptr_entry -- >> drivers/firmware/google/memconsole-coreboot.c:70:45: sparse: sparse: incorrect type in argument 4 (different address spaces) @@ expected void const *from @@ got unsigned char [noderef] <asn:2> * @@ drivers/firmware/google/memconsole-coreboot.c:70:45: sparse: expected void const *from drivers/firmware/google/memconsole-coreboot.c:70:45: sparse: got unsigned char [noderef] <asn:2> * >> drivers/firmware/google/memconsole-coreboot.c:80:18: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct cbmem_cons [noderef] <asn:2> *tmp_cbmc @@ got void * @@ drivers/firmware/google/memconsole-coreboot.c:80:18: sparse: expected struct cbmem_cons [noderef] <asn:2> *tmp_cbmc drivers/firmware/google/memconsole-coreboot.c:80:18: sparse: got void * >> drivers/firmware/google/memconsole-coreboot.c:88:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct cbmem_cons [noderef] <asn:2> *static [toplevel] cbmem_console @@ got void * @@ drivers/firmware/google/memconsole-coreboot.c:88:23: sparse: expected struct cbmem_cons [noderef] <asn:2> *static [toplevel] cbmem_console drivers/firmware/google/memconsole-coreboot.c:88:23: sparse: got void * >> drivers/firmware/google/memconsole-coreboot.c:91:18: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *addr @@ got struct cbmem_cons [noderef] <asn:2> *tmp_cbmc @@ drivers/firmware/google/memconsole-coreboot.c:91:18: sparse: expected void *addr drivers/firmware/google/memconsole-coreboot.c:91:18: sparse: got struct cbmem_cons [noderef] <asn:2> *tmp_cbmc >> drivers/firmware/google/memconsole-coreboot.c:106:26: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *addr @@ got struct cbmem_cons [noderef] <asn:2> *static [toplevel] cbmem_console @@ drivers/firmware/google/memconsole-coreboot.c:106:26: sparse: expected void *addr drivers/firmware/google/memconsole-coreboot.c:106:26: sparse: got struct cbmem_cons [noderef] <asn:2> *static [toplevel] cbmem_console >> drivers/firmware/google/memconsole-coreboot.c:49:22: sparse: sparse: dereference of noderef expression drivers/firmware/google/memconsole-coreboot.c:50:21: sparse: sparse: dereference of noderef expression drivers/firmware/google/memconsole-coreboot.c:87:30: sparse: sparse: dereference of noderef expression -- >> drivers/firmware/meson/meson_sm.c:43:22: sparse: sparse: symbol 'gxbb_chip' was not declared. Should it be static? drivers/firmware/meson/meson_sm.c:89:24: sparse: sparse: Using plain integer as NULL pointer >> drivers/firmware/meson/meson_sm.c:171:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const * @@ got void [noderef] <asn:2> *static [toplevel] sm_shmem_out_base @@ drivers/firmware/meson/meson_sm.c:171:17: sparse: expected void const * drivers/firmware/meson/meson_sm.c:171:17: sparse: got void [noderef] <asn:2> *static [toplevel] sm_shmem_out_base >> drivers/firmware/meson/meson_sm.c:205:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void * @@ got void [noderef] <asn:2> *static [toplevel] sm_shmem_in_base @@ drivers/firmware/meson/meson_sm.c:205:9: sparse: expected void * drivers/firmware/meson/meson_sm.c:205:9: sparse: got void [noderef] <asn:2> *static [toplevel] sm_shmem_in_base -- >> drivers/firmware/tegra/bpmp-debugfs.c:62:14: sparse: sparse: cast to restricted __le32 >> drivers/firmware/tegra/bpmp-debugfs.c:62:14: sparse: sparse: cast to restricted __le32 >> drivers/firmware/tegra/bpmp-debugfs.c:62:14: sparse: sparse: cast to restricted __le32 >> drivers/firmware/tegra/bpmp-debugfs.c:62:14: sparse: sparse: cast to restricted __le32 >> drivers/firmware/tegra/bpmp-debugfs.c:62:14: sparse: sparse: cast to restricted __le32 >> drivers/firmware/tegra/bpmp-debugfs.c:62:14: sparse: sparse: cast to restricted __le32 >> drivers/firmware/tegra/bpmp-debugfs.c:114:24: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] cmd @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:114:24: sparse: expected unsigned int [usertype] cmd drivers/firmware/tegra/bpmp-debugfs.c:114:24: sparse: got restricted __le32 [usertype] >> drivers/firmware/tegra/bpmp-debugfs.c:116:38: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] fnameaddr @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:116:38: sparse: expected unsigned int [usertype] fnameaddr drivers/firmware/tegra/bpmp-debugfs.c:116:38: sparse: got restricted __le32 [usertype] >> drivers/firmware/tegra/bpmp-debugfs.c:117:37: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] fnamelen @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:117:37: sparse: expected unsigned int [usertype] fnamelen drivers/firmware/tegra/bpmp-debugfs.c:117:37: sparse: got restricted __le32 [usertype] >> drivers/firmware/tegra/bpmp-debugfs.c:118:37: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] dataaddr @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:118:37: sparse: expected unsigned int [usertype] dataaddr drivers/firmware/tegra/bpmp-debugfs.c:118:37: sparse: got restricted __le32 [usertype] >> drivers/firmware/tegra/bpmp-debugfs.c:119:36: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] datalen @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:119:36: sparse: expected unsigned int [usertype] datalen drivers/firmware/tegra/bpmp-debugfs.c:119:36: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:150:24: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] cmd @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:150:24: sparse: expected unsigned int [usertype] cmd drivers/firmware/tegra/bpmp-debugfs.c:150:24: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:152:38: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] fnameaddr @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:152:38: sparse: expected unsigned int [usertype] fnameaddr drivers/firmware/tegra/bpmp-debugfs.c:152:38: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:153:37: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] fnamelen @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:153:37: sparse: expected unsigned int [usertype] fnamelen drivers/firmware/tegra/bpmp-debugfs.c:153:37: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:154:37: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] dataaddr @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:154:37: sparse: expected unsigned int [usertype] dataaddr drivers/firmware/tegra/bpmp-debugfs.c:154:37: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:155:36: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] datalen @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:155:36: sparse: expected unsigned int [usertype] datalen drivers/firmware/tegra/bpmp-debugfs.c:155:36: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:173:24: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] cmd @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:173:24: sparse: expected unsigned int [usertype] cmd drivers/firmware/tegra/bpmp-debugfs.c:173:24: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:175:37: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] dataaddr @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:175:37: sparse: expected unsigned int [usertype] dataaddr drivers/firmware/tegra/bpmp-debugfs.c:175:37: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:176:36: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] datalen @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:176:36: sparse: expected unsigned int [usertype] datalen drivers/firmware/tegra/bpmp-debugfs.c:176:36: sparse: got restricted __le32 [usertype] >> drivers/firmware/tegra/bpmp-debugfs.c:384:53: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] mrq @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:384:53: sparse: expected unsigned int [usertype] mrq drivers/firmware/tegra/bpmp-debugfs.c:384:53: sparse: got restricted __le32 [usertype] -- drivers/infiniband/core/ud_header.c: note: in included file (through include/net/checksum.h, include/linux/skbuff.h, include/linux/if_ether.h): >> arch/arm64/include/asm/checksum.h:45:27: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted __wsum [usertype] csum @@ got unsigned int [usertype] @@ arch/arm64/include/asm/checksum.h:45:27: sparse: expected restricted __wsum [usertype] csum arch/arm64/include/asm/checksum.h:45:27: sparse: got unsigned int [usertype] -- drivers/infiniband/core/verbs.c: note: in included file (through include/net/checksum.h, include/linux/skbuff.h, include/linux/if_ether.h, ...): >> arch/arm64/include/asm/checksum.h:45:27: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted __wsum [usertype] csum @@ got unsigned int [usertype] @@ arch/arm64/include/asm/checksum.h:45:27: sparse: expected restricted __wsum [usertype] csum arch/arm64/include/asm/checksum.h:45:27: sparse: got unsigned int [usertype] drivers/infiniband/core/verbs.c:242: warning: Function parameter or member 'flags' not described in '__ib_alloc_pd' drivers/infiniband/core/verbs.c:242: warning: Function parameter or member 'caller' not described in '__ib_alloc_pd' drivers/infiniband/core/verbs.c:1581: warning: Function parameter or member 'qp' not described in '_ib_modify_qp' drivers/infiniband/core/verbs.c:1581: warning: Function parameter or member 'attr' not described in '_ib_modify_qp' drivers/infiniband/core/verbs.c:1581: warning: Function parameter or member 'attr_mask' not described in '_ib_modify_qp' drivers/infiniband/core/verbs.c:1581: warning: Function parameter or member 'udata' not described in '_ib_modify_qp' -- >> drivers/irqchip/irq-brcmstb-l2.c:278:12: sparse: sparse: symbol 'brcmstb_l2_edge_intc_of_init' was not declared. Should it be static? >> drivers/irqchip/irq-brcmstb-l2.c:285:12: sparse: sparse: symbol 'brcmstb_l2_lvl_intc_of_init' was not declared. Should it be static? drivers/irqchip/irq-brcmstb-l2.c:278:12: warning: no previous prototype for 'brcmstb_l2_edge_intc_of_init' [-Wmissing-prototypes] 278 | int __init brcmstb_l2_edge_intc_of_init(struct device_node *np, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-brcmstb-l2.c:285:12: warning: no previous prototype for 'brcmstb_l2_lvl_intc_of_init' [-Wmissing-prototypes] 285 | int __init brcmstb_l2_lvl_intc_of_init(struct device_node *np, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/mtd/nand/raw/nand_base.c:277:17: sparse: sparse: cast from restricted __le16 drivers/mtd/nand/raw/nand_base.c: In function 'nand_command': drivers/mtd/nand/raw/nand_base.c:848:20: warning: this statement may fall through [-Wimplicit-fallthrough=] 848 | if (column == -1 && page_addr == -1) | ^ drivers/mtd/nand/raw/nand_base.c:851:9: note: here 851 | default: | ^~~~~~~ drivers/mtd/nand/raw/nand_base.c: In function 'nand_command_lp': drivers/mtd/nand/raw/nand_base.c:998:17: warning: this statement may fall through [-Wimplicit-fallthrough=] 998 | chip->cmd_ctrl(mtd, NAND_CMD_NONE, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 999 | NAND_NCE | NAND_CTRL_CHANGE); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/mtd/nand/raw/nand_base.c:1002:9: note: here 1002 | default: | ^~~~~~~ drivers/mtd/nand/raw/nand_base.c: In function 'nand_scan_tail': drivers/mtd/nand/raw/nand_base.c:6511:20: warning: this statement may fall through [-Wimplicit-fallthrough=] 6511 | if (!ecc->read_page) | ^ drivers/mtd/nand/raw/nand_base.c:6514:9: note: here 6514 | case NAND_ECC_HW: | ^~~~ drivers/mtd/nand/raw/nand_base.c:6530:20: warning: this statement may fall through [-Wimplicit-fallthrough=] 6530 | if (!ecc->write_subpage && ecc->hwctl && ecc->calculate) | ^ drivers/mtd/nand/raw/nand_base.c:6533:9: note: here 6533 | case NAND_ECC_HW_SYNDROME: | ^~~~ drivers/mtd/nand/raw/nand_base.c:6568:27: warning: this statement may fall through [-Wimplicit-fallthrough=] 6568 | ecc->algo = NAND_ECC_HAMMING; | ~~~~~~~~~~^~~~~~~~~~~~~~~~~~ drivers/mtd/nand/raw/nand_base.c:6570:9: note: here 6570 | case NAND_ECC_SOFT: | ^~~~ -- >> drivers/mtd/nand/raw/hisi504_nand.c:373:26: sparse: sparse: cast removes address space '<asn:2>' of expression drivers/mtd/nand/raw/hisi504_nand.c:378:26: sparse: sparse: cast removes address space '<asn:2>' of expression >> drivers/mtd/nand/raw/hisi504_nand.c:487:17: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void * @@ got void [noderef] <asn:2> *mmio @@ drivers/mtd/nand/raw/hisi504_nand.c:487:17: sparse: expected void * drivers/mtd/nand/raw/hisi504_nand.c:487:17: sparse: got void [noderef] <asn:2> *mmio drivers/mtd/nand/raw/hisi504_nand.c:499:17: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void * @@ got void [noderef] <asn:2> *mmio @@ drivers/mtd/nand/raw/hisi504_nand.c:499:17: sparse: expected void * drivers/mtd/nand/raw/hisi504_nand.c:499:17: sparse: got void [noderef] <asn:2> *mmio drivers/mtd/nand/raw/hisi504_nand.c:622:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void * @@ got void [noderef] <asn:2> *mmio @@ drivers/mtd/nand/raw/hisi504_nand.c:622:9: sparse: expected void * drivers/mtd/nand/raw/hisi504_nand.c:622:9: sparse: got void [noderef] <asn:2> *mmio -- >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/control.c: In function 'i2400m_get_device_info': drivers/net/wimax/i2400m/control.c:961:31: warning: implicit conversion from 'enum <anonymous>' to 'enum i2400m_tlv' [-Wenum-conversion] 961 | I2400M_TLV_DETAILED_DEVICE_INFO, sizeof(*ddi)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/wimax/i2400m/debug-levels.h:30, from drivers/net/wimax/i2400m/control.c:86: drivers/net/wimax/i2400m/control.c: In function 'i2400m_report_tlv_system_state': include/linux/wimax/debug.h:200:4: warning: this statement may fall through [-Wimplicit-fallthrough=] 200 | do { 22- | ^ include/linux/wimax/debug.h:404:36: note: in expansion of macro '_d_printf' 404 | #define d_printf(l, _dev, f, a...) _d_printf(l, "", _dev, f, ## a) | ^~~~~~~~~ drivers/net/wimax/i2400m/control.c:354:17: note: in expansion of macro 'd_printf' 354 | d_printf(1, dev, "entering BS-negotiated idle moden"); | ^~~~~~~~ drivers/net/wimax/i2400m/control.c:355:9: note: here 355 | case I2400M_SS_DISCONNECTING: | ^~~~ drivers/net/wimax/i2400m/control.c:708: warning: Excess function parameter 'msg_skb' description in 'i2400m_msg_to_dev' drivers/net/wimax/i2400m/control.c:1196: warning: Function parameter or member 'arg' not described in 'i2400m_set_init_config' drivers/net/wimax/i2400m/control.c:1196: warning: Excess function parameter 'arg_size' description in 'i2400m_set_init_config' -- >> drivers/net/wimax/i2400m/fw.c:194:36: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/wimax/i2400m/fw.c:195:34: sparse: sparse: invalid assignment: += drivers/net/wimax/i2400m/fw.c:195:34: sparse: left side has type unsigned int drivers/net/wimax/i2400m/fw.c:195:34: sparse: right side has type restricted __le32 drivers/net/wimax/i2400m/fw.c:196:32: sparse: sparse: restricted __le32 degrades to integer drivers/net/wimax/i2400m/fw.c:196:47: sparse: sparse: restricted __le32 degrades to integer drivers/net/wimax/i2400m/fw.c:196:66: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/wimax/i2400m/fw.c:261:27: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/fw.c:261:27: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/fw.c:261:27: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/fw.c:261:27: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/fw.c:261:27: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/fw.c:261:27: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/fw.c:261:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/wimax/i2400m/fw.c:261:25: sparse: expected restricted __le32 drivers/net/wimax/i2400m/fw.c:261:25: sparse: got unsigned int drivers/net/wimax/i2400m/fw.c:262:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:262:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:262:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:262:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:262:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:262:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:262:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/wimax/i2400m/fw.c:262:25: sparse: expected restricted __le32 drivers/net/wimax/i2400m/fw.c:262:25: sparse: got unsigned int drivers/net/wimax/i2400m/fw.c:263:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:263:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:263:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:263:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:263:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:263:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:263:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/wimax/i2400m/fw.c:263:25: sparse: expected restricted __le32 drivers/net/wimax/i2400m/fw.c:263:25: sparse: got unsigned int drivers/net/wimax/i2400m/fw.c:264:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:264:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:264:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:264:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:264:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:264:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:264:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/wimax/i2400m/fw.c:264:25: sparse: expected restricted __le32 drivers/net/wimax/i2400m/fw.c:264:25: sparse: got unsigned int drivers/net/wimax/i2400m/fw.c:417:48: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:417:48: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:417:48: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:417:48: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:417:48: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:417:48: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:417:41: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/wimax/i2400m/fw.c:485:24: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] data_size @@ got unsigned int @@ drivers/net/wimax/i2400m/fw.c:485:24: sparse: expected restricted __le32 [usertype] data_size drivers/net/wimax/i2400m/fw.c:485:24: sparse: got unsigned int >> drivers/net/wimax/i2400m/fw.c:486:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] target_addr @@ got unsigned int @@ drivers/net/wimax/i2400m/fw.c:486:26: sparse: expected restricted __le32 [usertype] target_addr drivers/net/wimax/i2400m/fw.c:486:26: sparse: got unsigned int >> drivers/net/wimax/i2400m/fw.c:487:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] block_checksum @@ got unsigned int @@ drivers/net/wimax/i2400m/fw.c:487:29: sparse: expected restricted __le32 [usertype] block_checksum drivers/net/wimax/i2400m/fw.c:487:29: sparse: got unsigned int drivers/net/wimax/i2400m/fw.c:512:27: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/wimax/i2400m/fw.c:1085:62: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected unsigned long addr @@ got restricted __le32 const [usertype] address @@ drivers/net/wimax/i2400m/fw.c:1085:62: sparse: expected unsigned long addr drivers/net/wimax/i2400m/fw.c:1085:62: sparse: got restricted __le32 const [usertype] address drivers/net/wimax/i2400m/fw.c:587: warning: Function parameter or member 'i2400m' not described in 'i2400m_bm_cmd' drivers/net/wimax/i2400m/fw.c:587: warning: Excess function parameter 'returns' description in 'i2400m_bm_cmd' drivers/net/wimax/i2400m/fw.c:649: warning: Function parameter or member 'chunk' not described in 'i2400m_download_chunk' drivers/net/wimax/i2400m/fw.c:649: warning: Function parameter or member '__chunk_len' not described in 'i2400m_download_chunk' drivers/net/wimax/i2400m/fw.c:649: warning: Excess function parameter 'buf' description in 'i2400m_download_chunk' drivers/net/wimax/i2400m/fw.c:649: warning: Excess function parameter 'buf_len' description in 'i2400m_download_chunk' drivers/net/wimax/i2400m/fw.c:1551: warning: Function parameter or member 'flags' not described in 'i2400m_dev_bootstrap' -- >> drivers/net/wimax/i2400m/op-rfkill.c:104:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] length @@ got unsigned long @@ drivers/net/wimax/i2400m/op-rfkill.c:104:25: sparse: expected restricted __le16 [usertype] length drivers/net/wimax/i2400m/op-rfkill.c:104:25: sparse: got unsigned long >> drivers/net/wimax/i2400m/op-rfkill.c:173:14: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/op-rfkill.c:173:14: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/op-rfkill.c:173:14: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/op-rfkill.c:173:14: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/op-rfkill.c:173:14: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/op-rfkill.c:173:14: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/op-rfkill.c:174:14: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/op-rfkill.c:174:14: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/op-rfkill.c:174:14: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/op-rfkill.c:174:14: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/op-rfkill.c:174:14: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/op-rfkill.c:174:14: sparse: sparse: cast to restricted __le32 -- >> drivers/net/wimax/i2400m/tx.c:788:35: sparse: sparse: cast to restricted __le16 >> drivers/net/wimax/i2400m/tx.c:788:35: sparse: sparse: cast to restricted __le16 >> drivers/net/wimax/i2400m/tx.c:788:35: sparse: sparse: cast to restricted __le16 >> drivers/net/wimax/i2400m/tx.c:788:35: sparse: sparse: cast to restricted __le16 >> drivers/net/wimax/i2400m/tx.c:788:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] num_pls @@ got int @@ drivers/net/wimax/i2400m/tx.c:788:33: sparse: expected restricted __le16 [usertype] num_pls drivers/net/wimax/i2400m/tx.c:788:33: sparse: got int >> drivers/net/wimax/i2400m/tx.c:896:32: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:896:32: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:896:32: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:896:32: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:896:32: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:896:32: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:896:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] barker @@ got unsigned int @@ drivers/net/wimax/i2400m/tx.c:896:30: sparse: expected restricted __le32 [usertype] barker drivers/net/wimax/i2400m/tx.c:896:30: sparse: got unsigned int drivers/net/wimax/i2400m/tx.c:897:34: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/tx.c:897:34: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/tx.c:897:34: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/tx.c:897:34: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/tx.c:897:34: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/tx.c:897:34: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:897:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] sequence @@ got unsigned int @@ drivers/net/wimax/i2400m/tx.c:897:32: sparse: expected restricted __le32 [usertype] sequence drivers/net/wimax/i2400m/tx.c:897:32: sparse: got unsigned int drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast from restricted __le16 drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast from restricted __le16 drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast from restricted __le16 drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast from restricted __le16 drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast from restricted __le16 drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast from restricted __le16 drivers/net/wimax/i2400m/tx.c: In function 'i2400m_tx': drivers/net/wimax/i2400m/tx.c:784:44: warning: array subscript <unknown> is outside array bounds of 'struct i2400m_pld[0]' [-Warray-bounds=] 784 | i2400m_pld_set(&tx_msg->pld[num_pls], buf_len, pl_type); | ~~~~~~~~~~~^~~~~~~~~ In file included from drivers/net/wimax/i2400m/i2400m.h:160, from drivers/net/wimax/i2400m/tx.c:249: include/uapi/linux/wimax/i2400m.h:322:27: note: while referencing 'pld' 322 | struct i2400m_pld pld[0]; | ^~~ In file included from include/linux/swab.h:5, from include/uapi/linux/byteorder/big_endian.h:13, from include/linux/byteorder/big_endian.h:5, from arch/arm64/include/uapi/asm/byteorder.h:21, from include/asm-generic/bitops/le.h:6, from arch/arm64/include/asm/bitops.h:40, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from include/linux/list.h:9, from include/linux/timer.h:6, from include/linux/netdevice.h:29, from drivers/net/wimax/i2400m/tx.c:246: drivers/net/wimax/i2400m/tx.c:786:49: warning: array subscript <unknown> is outside array bounds of 'struct i2400m_pld[0]' [-Warray-bounds=] 786 | le32_to_cpu(tx_msg->pld[num_pls].val), | ~~~~~~~~~~~^~~~~~~~~ include/uapi/linux/swab.h:117:39: note: in definition of macro '__swab32' 117 | (__builtin_constant_p((__u32)(x)) ? 64- | ^ include/linux/byteorder/generic.h:89:21: note: in expansion of macro '__le32_to_cpu' 89 | #define le32_to_cpu __le32_to_cpu | ^~~~~~~~~~~~~ include/linux/wimax/debug.h:404:36: note: in expansion of macro '_d_printf' 404 | #define d_printf(l, _dev, f, a...) _d_printf(l, "", _dev, f, ## a) | ^~~~~~~~~ drivers/net/wimax/i2400m/tx.c:785:17: note: in expansion of macro 'd_printf' 785 | d_printf(3, dev, "pld 0x%08x (type 0x%1x len 0x%04zxn", | ^~~~~~~~ include/uapi/linux/wimax/i2400m.h:322:27: note: while referencing 'pld' 322 | struct i2400m_pld pld[0]; | ^~~ drivers/net/wimax/i2400m/tx.c:717: warning: Function parameter or member 'i2400m' not described in 'i2400m_tx' drivers/net/wimax/i2400m/tx.c:966: warning: Function parameter or member 'i2400m' not described in 'i2400m_tx_setup' drivers/net/wimax/i2400m/tx.c:1007: warning: Function parameter or member 'i2400m' not described in 'i2400m_tx_release' -- >> drivers/phy/qualcomm/phy-qcom-ufs.c:93:21: sparse: sparse: cast removes address space '<asn:2>' of expression drivers/phy/qualcomm/phy-qcom-ufs.c:94:32: sparse: sparse: cast removes address space '<asn:2>' of expression drivers/phy/qualcomm/phy-qcom-ufs.c:105:21: sparse: sparse: cast removes address space '<asn:2>' of expression >> drivers/phy/qualcomm/phy-qcom-ufs.c:512:6: sparse: sparse: symbol 'ufs_qcom_phy_disable_iface_clk' was not declared. Should it be static? drivers/phy/qualcomm/phy-qcom-ufs.c:512:6: warning: no previous prototype for 'ufs_qcom_phy_disable_iface_clk' [-Wmissing-prototypes] 512 | void ufs_qcom_phy_disable_iface_clk(struct ufs_qcom_phy *phy) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/phy/rockchip/phy-rockchip-typec.c:403:16: sparse: sparse: symbol 'usb3_pll_cfg' was not declared. Should it be static? >> drivers/phy/rockchip/phy-rockchip-typec.c:420:16: sparse: sparse: symbol 'dp_pll_cfg' was not declared. Should it be static? drivers/phy/rockchip/phy-rockchip-typec.c:369: warning: cannot understand function prototype: 'struct rockchip_usb3phy_port_cfg ' -- >> drivers/platform/chrome/cros_ec_debugfs.c:266:30: sparse: sparse: symbol 'cros_ec_console_log_fops' was not declared. Should it be static? >> drivers/platform/chrome/cros_ec_debugfs.c:275:30: sparse: sparse: symbol 'cros_ec_pdinfo_fops' was not declared. Should it be static? drivers/platform/chrome/cros_ec_debugfs.c: In function 'cros_ec_pdinfo_read': drivers/platform/chrome/cros_ec_debugfs.c:234:15: warning: taking address of packed member of 'struct <anonymous>' may result in an unaligned pointer value [-Waddress-of-packed-member] 234 | msg = &ec_buf.msg; | ^~~~~~~~~~~ -- >> drivers/usb/gadget/udc/renesas_usb3.c:1539:17: sparse: sparse: restricted __le16 degrades to integer >> drivers/usb/gadget/udc/renesas_usb3.c:1542:43: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected unsigned short [usertype] addr @@ got restricted __le16 [usertype] wValue @@ drivers/usb/gadget/udc/renesas_usb3.c:1542:43: sparse: expected unsigned short [usertype] addr drivers/usb/gadget/udc/renesas_usb3.c:1542:43: sparse: got restricted __le16 [usertype] wValue >> drivers/usb/gadget/udc/renesas_usb3.c:1599:24: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [assigned] [usertype] status @@ got restricted __le16 [usertype] @@ drivers/usb/gadget/udc/renesas_usb3.c:1599:24: sparse: expected unsigned short [assigned] [usertype] status drivers/usb/gadget/udc/renesas_usb3.c:1599:24: sparse: got restricted __le16 [usertype] drivers/usb/gadget/udc/renesas_usb3.c:1767:17: sparse: sparse: restricted __le16 degrades to integer drivers/usb/gadget/udc/renesas_usb3.c: In function 'renesas_usb3_init_ep.isra': drivers/usb/gadget/udc/renesas_usb3.c:2516:73: warning: '%d' directive output may be truncated writing between 1 and 11 bytes into a region of size 6 [-Wformat-truncation=] 2516 | snprintf(usb3_ep->ep_name, sizeof(usb3_ep->ep_name), "ep%d", i); | ^~ drivers/usb/gadget/udc/renesas_usb3.c:2516:70: note: directive argument in the range [-2147483639, 2147483646] 2516 | snprintf(usb3_ep->ep_name, sizeof(usb3_ep->ep_name), "ep%d", i); | ^~~~~~ drivers/usb/gadget/udc/renesas_usb3.c:2516:17: note: 'snprintf' output between 4 and 14 bytes into a destination of size 8 2516 | snprintf(usb3_ep->ep_name, sizeof(usb3_ep->ep_name), "ep%d", i); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/usb/isp1760/isp1760-udc.c:212:24: sparse: sparse: cast to restricted __le32 drivers/usb/isp1760/isp1760-udc.c:212:24: sparse: sparse: cast to restricted __le32 drivers/usb/isp1760/isp1760-udc.c:212:24: sparse: sparse: cast to restricted __le32 drivers/usb/isp1760/isp1760-udc.c:212:24: sparse: sparse: cast to restricted __le32 drivers/usb/isp1760/isp1760-udc.c:212:24: sparse: sparse: cast to restricted __le32 drivers/usb/isp1760/isp1760-udc.c:212:24: sparse: sparse: cast to restricted __le32 drivers/usb/isp1760/isp1760-udc.c:214:31: sparse: sparse: cast to restricted __le16 drivers/usb/isp1760/isp1760-udc.c:214:31: sparse: sparse: cast to restricted __le16 drivers/usb/isp1760/isp1760-udc.c:214:31: sparse: sparse: cast to restricted __le16 drivers/usb/isp1760/isp1760-udc.c:214:31: sparse: sparse: cast to restricted __le16 drivers/usb/isp1760/isp1760-udc.c:268:53: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned int [usertype] val @@ got restricted __le32 [usertype] @@ drivers/usb/isp1760/isp1760-udc.c:268:53: sparse: expected unsigned int [usertype] val drivers/usb/isp1760/isp1760-udc.c:268:53: sparse: got restricted __le32 [usertype] drivers/usb/isp1760/isp1760-udc.c:270:17: sparse: sparse: cast from restricted __le16 >> drivers/usb/isp1760/isp1760-udc.c:270:17: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned short [usertype] val @@ got restricted __le16 [usertype] @@ drivers/usb/isp1760/isp1760-udc.c:270:17: sparse: expected unsigned short [usertype] val drivers/usb/isp1760/isp1760-udc.c:270:17: sparse: got restricted __le16 [usertype] drivers/usb/isp1760/isp1760-udc.c:270:17: sparse: sparse: cast from restricted __le16 drivers/usb/isp1760/isp1760-udc.c:270:17: sparse: sparse: cast from restricted __le16 drivers/usb/isp1760/isp1760-udc.c:485:9: sparse: sparse: cast from restricted __le16 drivers/usb/isp1760/isp1760-udc.c:485:9: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned short [usertype] val @@ got restricted __le16 [usertype] @@ drivers/usb/isp1760/isp1760-udc.c:485:9: sparse: expected unsigned short [usertype] val drivers/usb/isp1760/isp1760-udc.c:485:9: sparse: got restricted __le16 [usertype] drivers/usb/isp1760/isp1760-udc.c:485:9: sparse: sparse: cast from restricted __le16 drivers/usb/isp1760/isp1760-udc.c:485:9: sparse: sparse: cast from restricted __le16 -- >> drivers/usb/misc/usb251xb.c:448:36: sparse: sparse: cast to restricted __be32 drivers/usb/misc/usb251xb.c:462:36: sparse: sparse: cast to restricted __be32 drivers/usb/misc/usb251xb.c:476:36: sparse: sparse: cast to restricted __be32 -- >> drivers/usb/renesas_usbhs/common.c:164:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] wValue @@ got unsigned short @@ drivers/usb/renesas_usbhs/common.c:164:25: sparse: expected restricted __le16 [usertype] wValue drivers/usb/renesas_usbhs/common.c:164:25: sparse: got unsigned short >> drivers/usb/renesas_usbhs/common.c:165:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] wIndex @@ got unsigned short @@ drivers/usb/renesas_usbhs/common.c:165:25: sparse: expected restricted __le16 [usertype] wIndex drivers/usb/renesas_usbhs/common.c:165:25: sparse: got unsigned short >> drivers/usb/renesas_usbhs/common.c:166:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] wLength @@ got unsigned short @@ drivers/usb/renesas_usbhs/common.c:166:25: sparse: expected restricted __le16 [usertype] wLength drivers/usb/renesas_usbhs/common.c:166:25: sparse: got unsigned short >> drivers/usb/renesas_usbhs/common.c:172:39: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned short [usertype] data @@ got restricted __le16 [usertype] wValue @@ drivers/usb/renesas_usbhs/common.c:172:39: sparse: expected unsigned short [usertype] data drivers/usb/renesas_usbhs/common.c:172:39: sparse: got restricted __le16 [usertype] wValue >> drivers/usb/renesas_usbhs/common.c:173:39: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned short [usertype] data @@ got restricted __le16 [usertype] wIndex @@ drivers/usb/renesas_usbhs/common.c:173:39: sparse: expected unsigned short [usertype] data drivers/usb/renesas_usbhs/common.c:173:39: sparse: got restricted __le16 [usertype] wIndex >> drivers/usb/renesas_usbhs/common.c:174:39: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned short [usertype] data @@ got restricted __le16 [usertype] wLength @@ drivers/usb/renesas_usbhs/common.c:174:39: sparse: expected unsigned short [usertype] data drivers/usb/renesas_usbhs/common.c:174:39: sparse: got restricted __le16 [usertype] wLength -- >> drivers/watchdog/zx2967_wdt.c:181:16: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] <asn:2> *regmap @@ got struct regmap * @@ drivers/watchdog/zx2967_wdt.c:181:16: sparse: expected void [noderef] <asn:2> *regmap drivers/watchdog/zx2967_wdt.c:181:16: sparse: got struct regmap * >> drivers/watchdog/zx2967_wdt.c:187:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct regmap *map @@ got void [noderef] <asn:2> *regmap @@ drivers/watchdog/zx2967_wdt.c:187:9: sparse: expected struct regmap *map drivers/watchdog/zx2967_wdt.c:187:9: sparse: got void [noderef] <asn:2> *regmap -- fs/compat_ioctl.c:602:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char *iomem_base @@ got void [noderef] <asn:1> * @@ fs/compat_ioctl.c:602:28: sparse: expected unsigned char *iomem_base fs/compat_ioctl.c:602:28: sparse: got void [noderef] <asn:1> * >> fs/compat_ioctl.c:613:21: sparse: sparse: Using plain integer as NULL pointer -- >> kernel/dma/coherent.c:56:18: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] <asn:2> *mem_base @@ got void * @@ kernel/dma/coherent.c:56:18: sparse: expected void [noderef] <asn:2> *mem_base kernel/dma/coherent.c:56:18: sparse: got void * >> kernel/dma/coherent.c:72:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *virt_base @@ got void [noderef] <asn:2> *mem_base @@ kernel/dma/coherent.c:72:28: sparse: expected void *virt_base kernel/dma/coherent.c:72:28: sparse: got void [noderef] <asn:2> *mem_base >> kernel/dma/coherent.c:85:26: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *addr @@ got void [noderef] <asn:2> *mem_base @@ kernel/dma/coherent.c:85:26: sparse: expected void *addr kernel/dma/coherent.c:85:26: sparse: got void [noderef] <asn:2> *mem_base -- kernel/locking/rwsem-xadd.c: note: in included file (through arch/arm64/include/asm/atomic.h, include/linux/atomic.h, include/asm-generic/bitops/atomic.h, ...): >> arch/arm64/include/asm/cmpxchg.h:141:1: sparse: sparse: cast truncates bits from constant value (ffffffff00000000 becomes 0) >> arch/arm64/include/asm/cmpxchg.h:141:1: sparse: sparse: cast truncates bits from constant value (ffffffff00000000 becomes 0) >> arch/arm64/include/asm/cmpxchg.h:141:1: sparse: sparse: cast truncates bits from constant value (ffffffff00000000 becomes 0) >> arch/arm64/include/asm/cmpxchg.h:141:1: sparse: sparse: cast truncates bits from constant value (ffffffff00000000 becomes 0) -- >> lib/test_overflow.c:381:16: sparse: sparse: cast truncates bits from constant value (12c becomes 2c) >> lib/test_overflow.c:383:16: sparse: sparse: cast truncates bits from constant value (1112c becomes 112c) >> lib/test_overflow.c:385:16: sparse: sparse: cast truncates bits from constant value (10811112c becomes 811112c) lib/test_overflow.c:386:16: sparse: sparse: cast truncates bits from constant value (10811112c becomes 811112c) lib/test_overflow.c:403:16: sparse: sparse: cast truncates bits from constant value (12c becomes 2c) lib/test_overflow.c:405:16: sparse: sparse: cast truncates bits from constant value (1112c becomes 112c) lib/test_overflow.c:407:16: sparse: sparse: cast truncates bits from constant value (10811112c becomes 811112c) lib/test_overflow.c:408:16: sparse: sparse: cast truncates bits from constant value (10811112c becomes 811112c) >> lib/test_overflow.c:413:16: sparse: sparse: cast truncates bits from constant value (100 becomes 0) lib/test_overflow.c:415:16: sparse: sparse: cast truncates bits from constant value (10000 becomes 0) lib/test_overflow.c:417:16: sparse: sparse: cast truncates bits from constant value (100000000 becomes 0) lib/test_overflow.c:418:16: sparse: sparse: cast truncates bits from constant value (100000000 becomes 0) In file included from include/linux/device.h:29, from lib/test_overflow.c:7: lib/test_overflow.c: In function 'test_overflow_shift': include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 18- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 21- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:337:16: note: in expansion of macro 'TEST_ONE_SHIFT' 337 | err |= TEST_ONE_SHIFT(1, 0, unsigned int, 1U << 0, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 27- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 30- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:338:16: note: in expansion of macro 'TEST_ONE_SHIFT' 338 | err |= TEST_ONE_SHIFT(1, 20, unsigned int, 1U << 20, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 36- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 39- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:339:16: note: in expansion of macro 'TEST_ONE_SHIFT' 339 | err |= TEST_ONE_SHIFT(1, 31, unsigned int, 1U << 31, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 45- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 48- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:340:16: note: in expansion of macro 'TEST_ONE_SHIFT' 340 | err |= TEST_ONE_SHIFT(0xFFFFU, 16, unsigned int, 0xFFFFU << 16, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:43: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 54- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 57- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:340:16: note: in expansion of macro 'TEST_ONE_SHIFT' 340 | err |= TEST_ONE_SHIFT(0xFFFFU, 16, unsigned int, 0xFFFFU << 16, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 63- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 66- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:341:16: note: in expansion of macro 'TEST_ONE_SHIFT' 341 | err |= TEST_ONE_SHIFT(1, 0, u32, 1U << 0, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 72- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 75- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:342:16: note: in expansion of macro 'TEST_ONE_SHIFT' 342 | err |= TEST_ONE_SHIFT(1, 20, u32, 1U << 20, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 81- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 84- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:343:16: note: in expansion of macro 'TEST_ONE_SHIFT' 343 | err |= TEST_ONE_SHIFT(1, 31, u32, 1U << 31, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 90- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 93- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:344:16: note: in expansion of macro 'TEST_ONE_SHIFT' 344 | err |= TEST_ONE_SHIFT(0xFFFFU, 16, u32, 0xFFFFU << 16, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:43: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 99- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 102- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:344:16: note: in expansion of macro 'TEST_ONE_SHIFT' 344 | err |= TEST_ONE_SHIFT(0xFFFFU, 16, u32, 0xFFFFU << 16, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 108- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' -- >> mm/kmemleak.c:920:39: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] <asn:3> *ptr @@ got void const *ptr @@ mm/kmemleak.c:920:39: sparse: expected void const [noderef] <asn:3> *ptr mm/kmemleak.c:920:39: sparse: got void const *ptr >> mm/kmemleak.c:979:50: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const *ptr @@ got void const [noderef] <asn:3> *ptr @@ mm/kmemleak.c:979:50: sparse: expected void const *ptr mm/kmemleak.c:979:50: sparse: got void const [noderef] <asn:3> *ptr mm/kmemleak.c:1069:49: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const *ptr @@ got void const [noderef] <asn:3> *ptr @@ mm/kmemleak.c:1069:49: sparse: expected void const *ptr mm/kmemleak.c:1069:49: sparse: got void const [noderef] <asn:3> *ptr >> mm/kmemleak.c:2061:49: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] <asn:3> *ptr @@ got void const *ptr @@ mm/kmemleak.c:2061:49: sparse: expected void const [noderef] <asn:3> *ptr mm/kmemleak.c:2061:49: sparse: got void const *ptr mm/kmemleak.c:1685:13: sparse: sparse: context imbalance in 'kmemleak_seq_start' - different lock contexts for basic block mm/kmemleak.c: note: in included file (through include/linux/rculist.h, include/linux/sched/signal.h): include/linux/rcupdate.h:681:9: sparse: sparse: context imbalance in 'kmemleak_seq_stop' - unexpected unlock In file included from arch/arm64/include/asm/atomic.h:36, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from mm/kmemleak.c:74: In function '__cmpxchg_case_mb_4', inlined from '__cmpxchg_mb' at arch/arm64/include/asm/cmpxchg.h:143:1, inlined from 'kmemleak_disable' at mm/kmemleak.c:1958:6: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'int[1]' [-Warray-bounds=] 259 | asm volatile( 28- | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:291:1: note: in expansion of macro '__CMPXCHG_CASE' 291 | __CMPXCHG_CASE(w, , mb_4, dmb ish, , l, "memory") | ^~~~~~~~~~~~~~ mm/kmemleak.c: In function 'kmemleak_disable': mm/kmemleak.c:217:12: note: object 'kmemleak_error' of size 4 217 | static int kmemleak_error; | ^~~~~~~~~~~~~~ In function '__cmpxchg_case_mb_4', inlined from '__cmpxchg_mb' at arch/arm64/include/asm/cmpxchg.h:143:1, inlined from 'kmemleak_disable' at mm/kmemleak.c:1958:6: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'int[1]' [-Warray-bounds=] 259 | asm volatile( 41- | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:291:1: note: in expansion of macro '__CMPXCHG_CASE' 291 | __CMPXCHG_CASE(w, , mb_4, dmb ish, , l, "memory") | ^~~~~~~~~~~~~~ mm/kmemleak.c: In function 'kmemleak_disable': mm/kmemleak.c:217:12: note: object 'kmemleak_error' of size 4 217 | static int kmemleak_error; | ^~~~~~~~~~~~~~ -- >> net/bridge/netfilter/ebtables.c:747:16: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned char [usertype] proto @@ got restricted __be16 [usertype] ethproto @@ net/bridge/netfilter/ebtables.c:747:16: sparse: expected unsigned char [usertype] proto net/bridge/netfilter/ebtables.c:747:16: sparse: got restricted __be16 [usertype] ethproto >> net/bridge/netfilter/ebtables.c:384:16: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned char [usertype] proto @@ got restricted __be16 const [usertype] ethproto @@ net/bridge/netfilter/ebtables.c:384:16: sparse: expected unsigned char [usertype] proto net/bridge/netfilter/ebtables.c:384:16: sparse: got restricted __be16 const [usertype] ethproto net/bridge/netfilter/ebtables.c:421:16: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned char [usertype] proto @@ got restricted __be16 const [usertype] ethproto @@ net/bridge/netfilter/ebtables.c:421:16: sparse: expected unsigned char [usertype] proto net/bridge/netfilter/ebtables.c:421:16: sparse: got restricted __be16 const [usertype] ethproto In file included from include/linux/netfilter/x_tables.h:9, from net/bridge/netfilter/ebtables.c:21: net/bridge/netfilter/ebtables.c: In function 'do_update_counters.isra': net/bridge/netfilter/ebtables.c:1292:49: warning: array subscript i is outside array bounds of 'struct ebt_counter[0]' [-Warray-bounds=] 1292 | ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt); include/uapi/linux/netfilter/x_tables.h:108:34: note: in definition of macro 'ADD_COUNTER' 108 | #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0) | ^ In file included from net/bridge/netfilter/ebtables.c:22: include/linux/netfilter_bridge/ebtables.h:88:28: note: while referencing 'counters' 88 | struct ebt_counter counters[0] ____cacheline_aligned; | ^~~~~~~~ net/bridge/netfilter/ebtables.c:1292:49: warning: array subscript i is outside array bounds of 'struct ebt_counter[0]' [-Warray-bounds=] 1292 | ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt); include/uapi/linux/netfilter/x_tables.h:108:34: note: in definition of macro 'ADD_COUNTER' 108 | #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0) | ^ include/linux/netfilter_bridge/ebtables.h:88:28: note: while referencing 'counters' 88 | struct ebt_counter counters[0] ____cacheline_aligned; | ^~~~~~~~ net/bridge/netfilter/ebtables.c:1292:49: warning: array subscript i is outside array bounds of 'struct ebt_counter[0]' [-Warray-bounds=] 1292 | ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt); include/uapi/linux/netfilter/x_tables.h:108:51: note: in definition of macro 'ADD_COUNTER' 108 | #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0) | ^ include/linux/netfilter_bridge/ebtables.h:88:28: note: while referencing 'counters' 88 | struct ebt_counter counters[0] ____cacheline_aligned; | ^~~~~~~~ net/bridge/netfilter/ebtables.c:1292:49: warning: array subscript i is outside array bounds of 'struct ebt_counter[0]' [-Warray-bounds=] 1292 | ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt); include/uapi/linux/netfilter/x_tables.h:108:51: note: in definition of macro 'ADD_COUNTER' 108 | #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0) | ^ include/linux/netfilter_bridge/ebtables.h:88:28: note: while referencing 'counters' 88 | struct ebt_counter counters[0] ____cacheline_aligned; | ^~~~~~~~ -- >> net/ceph/crypto.c:219:9: sparse: sparse: Variable length array is used. In file included from include/linux/ceph/ceph_fs.h:16, from include/linux/ceph/types.h:11, from include/linux/ceph/decode.h:11, from net/ceph/crypto.c:16: include/linux/ceph/msgr.h:67:1: warning: alignment 1 of 'struct ceph_entity_addr' is less than 8 [-Wpacked-not-aligned] 67 | } __attribute__ ((packed)); | ^ -- >> net/dsa/legacy.c:474:44: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted __be32 const [usertype] *p @@ got unsigned int const *[assigned] sw_addr @@ net/dsa/legacy.c:474:44: sparse: expected restricted __be32 const [usertype] *p net/dsa/legacy.c:474:44: sparse: got unsigned int const *[assigned] sw_addr >> net/dsa/legacy.c:502:51: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted __be32 const [usertype] *p @@ got unsigned int const *[assigned] port_reg @@ net/dsa/legacy.c:502:51: sparse: expected restricted __be32 const [usertype] *p net/dsa/legacy.c:502:51: sparse: got unsigned int const *[assigned] port_reg -- >> net/dsa/tag_mtk.c:80:13: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] hdr @@ got unsigned short [usertype] @@ net/dsa/tag_mtk.c:80:13: sparse: expected restricted __be16 [usertype] hdr net/dsa/tag_mtk.c:80:13: sparse: got unsigned short [usertype] net/dsa/tag_mtk.c:90:17: sparse: sparse: restricted __be16 degrades to integer -- net/dsa/tag_qca.c:59:15: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] @@ got restricted __be16 [usertype] @@ net/dsa/tag_qca.c:59:15: sparse: expected unsigned short [usertype] net/dsa/tag_qca.c:59:15: sparse: got restricted __be16 [usertype] >> net/dsa/tag_qca.c:79:13: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] hdr @@ got unsigned short [usertype] @@ net/dsa/tag_qca.c:79:13: sparse: expected restricted __be16 [usertype] hdr net/dsa/tag_qca.c:79:13: sparse: got unsigned short [usertype] net/dsa/tag_qca.c:82:16: sparse: sparse: restricted __be16 degrades to integer net/dsa/tag_qca.c:92:17: sparse: sparse: restricted __be16 degrades to integer -- >> net/netfilter/core.c:586:26: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile *p @@ got void ( *[noderef] <asn:4> * )( ... ) @@ net/netfilter/core.c:586:26: sparse: expected void const volatile *p net/netfilter/core.c:586:26: sparse: got void ( *[noderef] <asn:4> * )( ... ) >> net/netfilter/core.c:586:26: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile *p @@ got void ( *[noderef] <asn:4> * )( ... ) @@ net/netfilter/core.c:586:26: sparse: expected void const volatile *p net/netfilter/core.c:586:26: sparse: got void ( *[noderef] <asn:4> * )( ... ) net/netfilter/core.c:586:26: sparse: sparse: incompatible types in comparison expression (different address spaces): net/netfilter/core.c:586:26: sparse: void ( [noderef] <asn:4> * )( ... ) net/netfilter/core.c:586:26: sparse: void ( * )( ... ) -- >> net/netfilter/nf_nat_core.c:707:25: sparse: sparse: incompatible types in comparison expression (different address spaces): net/netfilter/nf_nat_core.c:707:25: sparse: struct nf_nat_l4proto const [noderef] <asn:4> * net/netfilter/nf_nat_core.c:707:25: sparse: struct nf_nat_l4proto const * In file included from include/net/ip_tunnels.h:16, from include/net/gre.h:6, from include/linux/netfilter/nf_conntrack_proto_gre.h:5, from include/net/netfilter/nf_conntrack.h:25, from net/netfilter/nf_nat_core.c:22: In function 'net_generic', inlined from 'nf_nat_register_fn' at net/netfilter/nf_nat_core.c:908:28: include/net/netns/generic.h:46:22: warning: array subscript <unknown> is outside array bounds of 'void *[0]' [-Warray-bounds=] 46 | ptr = ng->ptr[id]; | ~~~~~~~^~~~ include/net/netns/generic.h: In function 'nf_nat_register_fn': include/net/netns/generic.h:35:23: note: while referencing 'ptr' 35 | void *ptr[0]; | ^~~ In function 'net_generic', inlined from 'nf_nat_unregister_fn' at net/netfilter/nf_nat_core.c:986:28: include/net/netns/generic.h:46:22: warning: array subscript <unknown> is outside array bounds of 'void *[0]' [-Warray-bounds=] 46 | ptr = ng->ptr[id]; | ~~~~~~~^~~~ include/net/netns/generic.h: In function 'nf_nat_unregister_fn': include/net/netns/generic.h:35:23: note: while referencing 'ptr' 35 | void *ptr[0]; | ^~~ -- >> net/netfilter/nft_counter.c:158:35: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct nft_counter_percpu_priv [noderef] <asn:3> *priv @@ got struct nft_counter_percpu_priv *priv @@ net/netfilter/nft_counter.c:158:35: sparse: expected struct nft_counter_percpu_priv [noderef] <asn:3> *priv net/netfilter/nft_counter.c:158:35: sparse: got struct nft_counter_percpu_priv *priv >> net/netfilter/nft_counter.c:113:20: sparse: sparse: dereference of noderef expression -- >> net/tls/tls_main.c:746:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __poll_t ( *static [addressable] [assigned] [toplevel] poll )( ... ) @@ got unsigned int ( * )( ... ) @@ net/tls/tls_main.c:746:31: sparse: expected restricted __poll_t ( *static [addressable] [assigned] [toplevel] poll )( ... ) net/tls/tls_main.c:746:31: sparse: got unsigned int ( * )( ... ) -- >> net/tls/tls_sw.c:1302:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int ( *sk_poll )( ... ) @@ got restricted __poll_t ( *const poll )( ... ) @@ net/tls/tls_sw.c:1302:36: sparse: expected unsigned int ( *sk_poll )( ... ) net/tls/tls_sw.c:1302:36: sparse: got restricted __poll_t ( *const poll )( ... ) -- >> net/tls/tls_device.c:559:19: sparse: sparse: cast to restricted __be32 -- >> security/selinux/ss/ebitmap.c:389:28: sparse: sparse: cast to restricted __le32 >> security/selinux/ss/ebitmap.c:389:28: sparse: sparse: cast to restricted __le32 >> security/selinux/ss/ebitmap.c:389:28: sparse: sparse: cast to restricted __le32 >> security/selinux/ss/ebitmap.c:389:28: sparse: sparse: cast to restricted __le32 >> security/selinux/ss/ebitmap.c:389:28: sparse: sparse: cast to restricted __le32 >> security/selinux/ss/ebitmap.c:389:28: sparse: sparse: cast to restricted __le32 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 -- >> security/smack/smack_lsm.c:2588:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] dport @@ got unsigned short [usertype] @@ security/smack/smack_lsm.c:2588:27: sparse: expected restricted __be16 [usertype] dport security/smack/smack_lsm.c:2588:27: sparse: got unsigned short [usertype] security/smack/smack_lsm.c:4880:17: sparse: sparse: cast removes address space '<asn:4>' of expression >> security/smack/smack_lsm.c:1845:50: sparse: sparse: dereference of noderef expression >> security/smack/smack_lsm.c:1845:50: sparse: sparse: dereference of noderef expression security/smack/smack_lsm.c: In function 'smack_d_instantiate': security/smack/smack_lsm.c:3475:23: warning: this statement may fall through [-Wimplicit-fallthrough=] 3475 | final = &smack_known_star; | ~~~~~~^~~~~~~~~~~~~~~~~~~ security/smack/smack_lsm.c:3484:9: note: here 3484 | default: | ^~~~~~~ security/smack/smack_lsm.c:398: warning: Function parameter or member 'mode' not described in 'smk_ptrace_mode' security/smack/smack_lsm.c:514: warning: Function parameter or member 'typefrom_file' not described in 'smack_syslog' security/smack/smack_lsm.c:514: warning: Excess function parameter 'type' description in 'smack_syslog' security/smack/smack_lsm.c:1279: warning: Function parameter or member 'path' not described in 'smack_inode_getattr' security/smack/smack_lsm.c:1279: warning: Excess function parameter 'mnt' description in 'smack_inode_getattr' security/smack/smack_lsm.c:1279: warning: Excess function parameter 'dentry' description in 'smack_inode_getattr' security/smack/smack_lsm.c:1721: warning: Function parameter or member 'file' not described in 'smack_mmap_file' security/smack/smack_lsm.c:1721: warning: Function parameter or member 'reqprot' not described in 'smack_mmap_file' security/smack/smack_lsm.c:1721: warning: Function parameter or member 'prot' not described in 'smack_mmap_file' security/smack/smack_lsm.c:1721: warning: Function parameter or member 'flags' not described in 'smack_mmap_file' security/smack/smack_lsm.c:1939: warning: Excess function parameter 'cred' description in 'smack_file_open' security/smack/smack_lsm.c:1967: warning: Function parameter or member 'cred' not described in 'smack_cred_alloc_blank' security/smack/smack_lsm.c:1967: warning: Excess function parameter 'new' description in 'smack_cred_alloc_blank' security/smack/smack_lsm.c:2225: warning: Excess function parameter 'policy' description in 'smack_task_setscheduler' security/smack/smack_lsm.c:2225: warning: Excess function parameter 'lp' description in 'smack_task_setscheduler' security/smack/smack_lsm.c:2697: warning: Function parameter or member 'sk' not described in 'smk_ipv6_port_check' security/smack/smack_lsm.c:2697: warning: Function parameter or member 'act' not described in 'smk_ipv6_port_check' security/smack/smack_lsm.c:2697: warning: Excess function parameter 'sock' description in 'smk_ipv6_port_check' security/smack/smack_lsm.c:3110: warning: Function parameter or member 'ipc' not described in 'smack_shm_shmat' security/smack/smack_lsm.c:3110: warning: Excess function parameter 'isp' description in 'smack_shm_shmat' -- sound/core/pcm_native.c:591:51: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted snd_pcm_state_t [usertype] state @@ got int state @@ sound/core/pcm_native.c:591:51: sparse: expected restricted snd_pcm_state_t [usertype] state sound/core/pcm_native.c:591:51: sparse: got int state sound/core/pcm_native.c:756:38: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:756:38: sparse: expected int state sound/core/pcm_native.c:756:38: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:768:38: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:768:38: sparse: expected int state sound/core/pcm_native.c:768:38: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:817:38: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:817:38: sparse: expected int state sound/core/pcm_native.c:817:38: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:1227:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted snd_pcm_state_t [usertype] state @@ got int state @@ sound/core/pcm_native.c:1227:32: sparse: expected restricted snd_pcm_state_t [usertype] state sound/core/pcm_native.c:1227:32: sparse: got int state sound/core/pcm_native.c:1251:31: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:1251:31: sparse: expected int state sound/core/pcm_native.c:1251:31: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:1258:40: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:1258:40: sparse: expected int state sound/core/pcm_native.c:1258:40: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:1284:28: sparse: sparse: restricted snd_pcm_state_t degrades to integer sound/core/pcm_native.c:1286:40: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted snd_pcm_state_t [usertype] state @@ got int state @@ sound/core/pcm_native.c:1286:40: sparse: expected restricted snd_pcm_state_t [usertype] state sound/core/pcm_native.c:1286:40: sparse: got int state sound/core/pcm_native.c:1310:64: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] state @@ sound/core/pcm_native.c:1310:64: sparse: expected int state sound/core/pcm_native.c:1310:64: sparse: got restricted snd_pcm_state_t [usertype] state sound/core/pcm_native.c:1326:38: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:1326:38: sparse: expected int state sound/core/pcm_native.c:1326:38: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:1700:38: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:1700:38: sparse: expected int state sound/core/pcm_native.c:1700:38: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:1766:61: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:1766:61: sparse: expected int state sound/core/pcm_native.c:1766:61: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:1767:63: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:1767:63: sparse: expected int state sound/core/pcm_native.c:1767:63: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:1784:76: sparse: sparse: incorrect type in initializer (different base types) @@ expected int new_state @@ got restricted snd_pcm_state_t @@ sound/core/pcm_native.c:1784:76: sparse: expected int new_state sound/core/pcm_native.c:1784:76: sparse: got restricted snd_pcm_state_t sound/core/pcm_native.c:2105:26: sparse: sparse: restricted snd_pcm_format_t degrades to integer sound/core/pcm_native.c:2109:54: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted snd_pcm_format_t [usertype] format @@ got unsigned int [assigned] k @@ sound/core/pcm_native.c:2109:54: sparse: expected restricted snd_pcm_format_t [usertype] format sound/core/pcm_native.c:2109:54: sparse: got unsigned int [assigned] k sound/core/pcm_native.c:2127:26: sparse: sparse: restricted snd_pcm_format_t degrades to integer sound/core/pcm_native.c:2131:54: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted snd_pcm_format_t [usertype] format @@ got unsigned int [assigned] k @@ sound/core/pcm_native.c:2131:54: sparse: expected restricted snd_pcm_format_t [usertype] format sound/core/pcm_native.c:2131:54: sparse: got unsigned int [assigned] k sound/core/pcm_native.c:2311:30: sparse: sparse: restricted snd_pcm_access_t degrades to integer sound/core/pcm_native.c:2313:30: sparse: sparse: restricted snd_pcm_access_t degrades to integer sound/core/pcm_native.c:2316:38: sparse: sparse: restricted snd_pcm_access_t degrades to integer sound/core/pcm_native.c:2318:38: sparse: sparse: restricted snd_pcm_access_t degrades to integer sound/core/pcm_native.c:2320:38: sparse: sparse: restricted snd_pcm_access_t degrades to integer sound/core/pcm_native.c:2330:86: sparse: sparse: restricted snd_pcm_subformat_t degrades to integer sound/core/pcm_native.c: note: in included file: >> sound/core/pcm_compat.c:226:13: sparse: sparse: incorrect type in initializer (different base types) @@ expected signed int __pu_val @@ got restricted snd_pcm_state_t [addressable] [assigned] [usertype] state @@ sound/core/pcm_compat.c:226:13: sparse: expected signed int __pu_val sound/core/pcm_compat.c:226:13: sparse: got restricted snd_pcm_state_t [addressable] [assigned] [usertype] state >> sound/core/pcm_compat.c:235:13: sparse: sparse: incorrect type in initializer (different base types) @@ expected signed int __pu_val @@ got restricted snd_pcm_state_t [addressable] [assigned] [usertype] suspended_state @@ sound/core/pcm_compat.c:235:13: sparse: expected signed int __pu_val sound/core/pcm_compat.c:235:13: sparse: got restricted snd_pcm_state_t [addressable] [assigned] [usertype] suspended_state >> sound/core/pcm_compat.c:525:13: sparse: sparse: incorrect type in initializer (different base types) @@ expected signed int __pu_val @@ got restricted snd_pcm_state_t [assigned] [usertype] state @@ sound/core/pcm_compat.c:525:13: sparse: expected signed int __pu_val sound/core/pcm_compat.c:525:13: sparse: got restricted snd_pcm_state_t [assigned] [usertype] state sound/core/pcm_compat.c:528:13: sparse: sparse: incorrect type in initializer (different base types) @@ expected signed int __pu_val @@ got restricted snd_pcm_state_t [addressable] [assigned] [usertype] suspended_state @@ sound/core/pcm_compat.c:528:13: sparse: expected signed int __pu_val sound/core/pcm_compat.c:528:13: sparse: got restricted snd_pcm_state_t [addressable] [assigned] [usertype] suspended_state sound/core/pcm_native.c:128:9: sparse: sparse: context imbalance in '__snd_pcm_stream_lock_mode' - different lock contexts for basic block sound/core/pcm_native.c:138:28: sparse: sparse: context imbalance in '__snd_pcm_stream_unlock_mode' - unexpected unlock sound/core/pcm_native.c:1098:52: sparse: sparse: context imbalance in 'snd_pcm_action_group' - unexpected unlock sound/core/pcm_native.c: In function 'constrain_mask_params': sound/core/pcm_native.c:285:25: warning: variable 'old_mask' set but not used [-Wunused-but-set-variable] 285 | struct snd_mask old_mask; | ^~~~~~~~ sound/core/pcm_native.c: In function 'constrain_interval_params': sound/core/pcm_native.c:321:29: warning: variable 'old_interval' set but not used [-Wunused-but-set-variable] 321 | struct snd_interval old_interval; | ^~~~~~~~~~~~ sound/core/pcm_native.c: In function 'constrain_params_by_rules': sound/core/pcm_native.c:362:29: warning: variable 'old_interval' set but not used [-Wunused-but-set-variable] 362 | struct snd_interval old_interval; | ^~~~~~~~~~~~ sound/core/pcm_native.c:361:25: warning: variable 'old_mask' set but not used [-Wunused-but-set-variable] 361 | struct snd_mask old_mask; | ^~~~~~~~ sound/core/pcm_native.c: In function 'snd_pcm_hw_params_choose': sound/core/pcm_native.c:633:29: warning: variable 'old_interval' set but not used [-Wunused-but-set-variable] 633 | struct snd_interval old_interval; | ^~~~~~~~~~~~ sound/core/pcm_native.c:632:25: warning: variable 'old_mask' set but not used [-Wunused-but-set-variable] 632 | struct snd_mask old_mask; | ^~~~~~~~ In file included from include/linux/uaccess.h:11, from include/linux/poll.h:12, from include/sound/info.h:25, from sound/core/pcm_native.c:33: sound/core/pcm_compat.c: In function 'snd_pcm_status_user_compat': sound/core/pcm_compat.c:218:33: warning: taking address of packed member of 'struct snd_pcm_status32' may result in an unaligned pointer value [-Waddress-of-packed-member] 218 | (u32 __user *)(&src->audio_tstamp_data))) arch/arm64/include/asm/uaccess.h:311:43: note: in definition of macro '__get_user_check' 311 | __typeof__(*(ptr)) __user *__p = (ptr); 105- | ^~~ arch/arm64/include/asm/uaccess.h:334:25: note: in expansion of macro '__get_user' 334 | #define get_user __get_user | ^~~~~~~~~~ sound/core/pcm_compat.c:217:20: note: in expansion of macro 'get_user' 217 | if (ext && get_user(status.audio_tstamp_data, | ^~~~~~~~ sound/core/pcm_compat.c:226:36: warning: taking address of packed member of 'struct snd_pcm_status32' may result in an unaligned pointer value [-Waddress-of-packed-member] 226 | if (put_user(status.state, &src->state) || arch/arm64/include/asm/uaccess.h:380:43: note: in definition of macro '__put_user_check' 380 | __typeof__(*(ptr)) __user *__p = (ptr); 116- | ^~~ arch/arm64/include/asm/uaccess.h:403:25: note: in expansion of macro '__put_user' 403 | #define put_user __put_user | ^~~~~~~~~~ sound/core/pcm_compat.c:226:13: note: in expansion of macro 'put_user' 226 | if (put_user(status.state, &src->state) || | ^~~~~~~~ sound/core/pcm_compat.c:229:39: warning: taking address of packed member of 'struct snd_pcm_status32' may result in an unaligned pointer value [-Waddress-of-packed-member] 229 | put_user(status.appl_ptr, &src->appl_ptr) || arch/arm64/include/asm/uaccess.h:380:43: note: in definition of macro '__put_user_check' 380 | __typeof__(*(ptr)) __user *__p = (ptr); 127- | ^~~ arch/arm64/include/asm/uaccess.h:403:25: note: in expansion of macro '__put_user' 403 | #define put_user __put_user | ^~~~~~~~~~ sound/core/pcm_compat.c:229:13: note: in expansion of macro 'put_user' 229 | put_user(status.appl_ptr, &src->appl_ptr) || | ^~~~~~~~ sound/core/pcm_compat.c:230:37: warning: taking address of packed member of 'struct snd_pcm_status32' may result in an unaligned pointer value [-Waddress-of-packed-member] 230 | put_user(status.hw_ptr, &src->hw_ptr) || arch/arm64/include/asm/uaccess.h:380:43: note: in definition of macro '__put_user_check' 380 | __typeof__(*(ptr)) __user *__p = (ptr); 138- | ^~~ arch/arm64/include/asm/uaccess.h:403:25: note: in expansion of macro '__put_user' 403 | #define put_user __put_user | ^~~~~~~~~~ sound/core/pcm_compat.c:230:13: note: in expansion of macro 'put_user' 230 | put_user(status.hw_ptr, &src->hw_ptr) || | ^~~~~~~~ sound/core/pcm_compat.c:231:36: warning: taking address of packed member of 'struct snd_pcm_status32' may result in an unaligned pointer value [-Waddress-of-packed-member] 231 | put_user(status.delay, &src->delay) || arch/arm64/include/asm/uaccess.h:380:43: note: in definition of macro '__put_user_check' 380 | __typeof__(*(ptr)) __user *__p = (ptr); 149- | ^~~ arch/arm64/include/asm/uaccess.h:403:25: note: in expansion of macro '__put_user' 403 | #define put_user __put_user | ^~~~~~~~~~ sound/core/pcm_compat.c:231:13: note: in expansion of macro 'put_user' 231 | put_user(status.delay, &src->delay) || | ^~~~~~~~ sound/core/pcm_compat.c:232:36: warning: taking address of packed member of 'struct snd_pcm_status32' may result in an unaligned pointer value [-Waddress-of-packed-member] 232 | put_user(status.avail, &src->avail) || arch/arm64/include/asm/uaccess.h:380:43: note: in definition of macro '__put_user_check' 380 | __typeof__(*(ptr)) __user *__p = (ptr); 160- | ^~~ arch/arm64/include/asm/uaccess.h:403:25: note: in expansion of macro '__put_user' 403 | #define put_user __put_user | ^~~~~~~~~~ sound/core/pcm_compat.c:232:13: note: in expansion of macro 'put_user' 232 | put_user(status.avail, &src->avail) || -- >> sound/soc/codecs/rt5645.c:680:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short reg @@ got restricted __be16 [usertype] @@ sound/soc/codecs/rt5645.c:680:33: sparse: expected unsigned short reg sound/soc/codecs/rt5645.c:680:33: sparse: got restricted __be16 [usertype] >> sound/soc/codecs/rt5645.c:681:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short val @@ got restricted __be16 [usertype] @@ sound/soc/codecs/rt5645.c:681:33: sparse: expected unsigned short val sound/soc/codecs/rt5645.c:681:33: sparse: got restricted __be16 [usertype] >> sound/soc/codecs/rt5645.c:706:35: sparse: sparse: cast to restricted __be16 sound/soc/codecs/rt5645.c:707:35: sparse: sparse: cast to restricted __be16 sound/soc/codecs/rt5645.c:1623:38: warning: 'rt5645_if3_adc_in_mux' defined but not used [-Wunused-const-variable=] 1623 | static const struct snd_kcontrol_new rt5645_if3_adc_in_mux = | ^~~~~~~~~~~~~~~~~~~~~ sound/soc/codecs/rt5645.c:1312:38: warning: 'rt5645_inr_mux' defined but not used [-Wunused-const-variable=] 1312 | static const struct snd_kcontrol_new rt5645_inr_mux = | ^~~~~~~~~~~~~~ sound/soc/codecs/rt5645.c:1301:38: warning: 'rt5645_inl_mux' defined but not used [-Wunused-const-variable=] 1301 | static const struct snd_kcontrol_new rt5645_inl_mux = | ^~~~~~~~~~~~~~ vim +1379 arch/arm64/kernel/ptrace.c 478fcb2cdb2351 Will Deacon 2012-03-05 1362 478fcb2cdb2351 Will Deacon 2012-03-05 1363 static int compat_ptrace_write_user(struct task_struct *tsk, compat_ulong_t off, 478fcb2cdb2351 Will Deacon 2012-03-05 1364 compat_ulong_t val) 478fcb2cdb2351 Will Deacon 2012-03-05 1365 { 478fcb2cdb2351 Will Deacon 2012-03-05 1366 int ret; c168870704bcde Will Deacon 2014-06-02 1367 mm_segment_t old_fs = get_fs(); 478fcb2cdb2351 Will Deacon 2012-03-05 1368 478fcb2cdb2351 Will Deacon 2012-03-05 1369 if (off & 3 || off >= COMPAT_USER_SZ) 478fcb2cdb2351 Will Deacon 2012-03-05 1370 return -EIO; 478fcb2cdb2351 Will Deacon 2012-03-05 1371 478fcb2cdb2351 Will Deacon 2012-03-05 1372 if (off >= sizeof(compat_elf_gregset_t)) 478fcb2cdb2351 Will Deacon 2012-03-05 1373 return 0; 478fcb2cdb2351 Will Deacon 2012-03-05 1374 c168870704bcde Will Deacon 2014-06-02 1375 set_fs(KERNEL_DS); 478fcb2cdb2351 Will Deacon 2012-03-05 1376 ret = copy_regset_from_user(tsk, &user_aarch32_view, 478fcb2cdb2351 Will Deacon 2012-03-05 1377 REGSET_COMPAT_GPR, off, 478fcb2cdb2351 Will Deacon 2012-03-05 1378 sizeof(compat_ulong_t), 478fcb2cdb2351 Will Deacon 2012-03-05 @1379 &val); c168870704bcde Will Deacon 2014-06-02 1380 set_fs(old_fs); c168870704bcde Will Deacon 2014-06-02 1381 478fcb2cdb2351 Will Deacon 2012-03-05 1382 return ret; 478fcb2cdb2351 Will Deacon 2012-03-05 1383 } 478fcb2cdb2351 Will Deacon 2012-03-05 1384 :::::: The code at line 1379 was first introduced by commit :::::: 478fcb2cdb2351dcfc3fb23f42d76f4436ee4149 arm64: Debugging support :::::: TO: Will Deacon <will.deacon(a)arm.com> :::::: CC: Catalin Marinas <catalin.marinas(a)arm.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS 10e0ea7796b38b1d35a6969966016d7a42d77b7f
by kernel test robot 07 Sep '24

07 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 10e0ea7796b38b1d35a6969966016d7a42d77b7f !11443 v2 drm/amd/display: Fix null pointer deref in dcn20_resource.c Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-allnoconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-allmodconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-allnoconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-allyesconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-003-20240907 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-006-20240907 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-defconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-004-20240907 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-012-20240907 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-016-20240907 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-071-20240907 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs `-- x86_64-rhel-8.3-rust `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs elapsed time: 1225m configs tested: 30 configs skipped: 97 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 x86_64 alldefconfig gcc-12 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240907 gcc-12 x86_64 buildonly-randconfig-002-20240907 gcc-12 x86_64 buildonly-randconfig-003-20240907 gcc-11 x86_64 buildonly-randconfig-004-20240907 clang-18 x86_64 buildonly-randconfig-005-20240907 gcc-12 x86_64 buildonly-randconfig-006-20240907 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240907 clang-18 x86_64 randconfig-002-20240907 gcc-12 x86_64 randconfig-003-20240907 gcc-12 x86_64 randconfig-004-20240907 clang-18 x86_64 randconfig-005-20240907 gcc-12 x86_64 randconfig-006-20240907 gcc-11 x86_64 randconfig-011-20240907 gcc-12 x86_64 randconfig-012-20240907 gcc-12 x86_64 randconfig-013-20240907 gcc-12 x86_64 randconfig-014-20240907 gcc-12 x86_64 randconfig-015-20240907 clang-18 x86_64 randconfig-016-20240907 gcc-12 x86_64 randconfig-071-20240907 clang-18 x86_64 randconfig-072-20240907 gcc-12 x86_64 randconfig-073-20240907 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] CVE-2024-44972
by Yifan Qiao 07 Sep '24

07 Sep '24

Naohiro Aota (1): btrfs: fix invalid mapping of extent xarray state Qu Wenruo (1): btrfs: do not clear page dirty inside extent_write_locked_range() fs/btrfs/extent_io.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) -- 2.39.2

2 3

[openeuler:openEuler-1.0-LTS 2828/23701] drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c:297:17: sparse: sparse: dubious: x & !y
by kernel test robot 07 Sep '24

07 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 13b424f97ef548612c760cfd0892f96de96707e0 commit: 9baadf685a5618364776aed92067526bb40c137d [2828/23701] build_bug.h: remove most of dummy BUILD_BUG_ON stubs for Sparse config: x86_64-randconfig-121-20240906 (https://download.01.org/0day-ci/archive/20240907/202409070807.ESq0nR8U-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240907/202409070807.ESq0nR8U-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409070807.ESq0nR8U-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c:297:17: sparse: sparse: dubious: x & !y drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c:481:16: sparse: sparse: dubious: x & !y -- drivers/net/wireless/mediatek/mt76/mt76x0/mac.c:166:16: sparse: sparse: incorrect type in return expression (different base types) @@ expected unsigned short @@ got restricted __le16 [usertype] @@ drivers/net/wireless/mediatek/mt76/mt76x0/mac.c:166:16: sparse: expected unsigned short drivers/net/wireless/mediatek/mt76/mt76x0/mac.c:166:16: sparse: got restricted __le16 [usertype] drivers/net/wireless/mediatek/mt76/mt76x0/mac.c:175:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] tx_rate @@ got unsigned short @@ drivers/net/wireless/mediatek/mt76/mt76x0/mac.c:175:23: sparse: expected restricted __le16 [usertype] tx_rate drivers/net/wireless/mediatek/mt76/mt76x0/mac.c:175:23: sparse: got unsigned short >> drivers/net/wireless/mediatek/mt76/mt76x0/mac.c:409:16: sparse: sparse: dubious: x & !y vim +297 drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 280 b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 281 int mt76x2_mac_wcid_set_key(struct mt76x2_dev *dev, u8 idx, b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 282 struct ieee80211_key_conf *key) b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 283 { b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 284 enum mt76x2_cipher_type cipher; b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 285 u8 key_data[32]; b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 286 u8 iv_data[8]; b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 287 b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 288 cipher = mt76x2_mac_get_key_info(key, key_data); b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 289 if (cipher == MT_CIPHER_NONE && key) b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 290 return -EOPNOTSUPP; b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 291 b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 292 mt76_rmw_field(dev, MT_WCID_ATTR(idx), MT_WCID_ATTR_PKEY_MODE, cipher); b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 293 mt76_wr_copy(dev, MT_WCID_KEY(idx), key_data, sizeof(key_data)); b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 294 b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 295 memset(iv_data, 0, sizeof(iv_data)); b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 296 if (key) { b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 @297 mt76_rmw_field(dev, MT_WCID_ATTR(idx), MT_WCID_ATTR_PAIRWISE, b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 298 !!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)); b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 299 iv_data[3] = key->keyidx << 6; b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 300 if (cipher >= MT_CIPHER_TKIP) b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 301 iv_data[3] |= 0x20; b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 302 } b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 303 b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 304 mt76_wr_copy(dev, MT_WCID_IV(idx), iv_data, sizeof(iv_data)); b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 305 b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 306 return 0; b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 307 } b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 308 EXPORT_SYMBOL_GPL(mt76x2_mac_wcid_set_key); b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 309 :::::: The code at line 297 was first introduced by commit :::::: b9c45e1c42b7d709ade99b6ae243065a832e87aa mt76: add mt76x2_mac_common to mt76x2-common module :::::: TO: Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com> :::::: CC: Kalle Valo <kvalo(a)codeaurora.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 23675/23701] block/blk-io-hierarchy/iodump.c:571:7: warning: no previous prototype for '__bio_stage_hierarchy_start'
by kernel test robot 06 Sep '24

06 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 13b424f97ef548612c760cfd0892f96de96707e0 commit: ac91631e9ef7b530c02e40d10085072c08fb4a0a [23675/23701] blk-io-hierarchy: support new stage for bio lifetime config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240906/202409062219.DDwu0HG6-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240906/202409062219.DDwu0HG6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409062219.DDwu0HG6-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/blk-io-hierarchy/iodump.c:571:7: warning: no previous prototype for '__bio_stage_hierarchy_start' [-Wmissing-prototypes] 571 | void *__bio_stage_hierarchy_start(struct bio_stage_dump_data *bstage_ddata, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/asm-generic/preempt.h:5, from ./arch/arm64/include/generated/asm/preempt.h:1, from include/linux/preempt.h:81, from include/linux/spinlock.h:51, from include/linux/wait.h:9, from include/linux/wait_bit.h:8, from include/linux/fs.h:7, from include/linux/seq_file.h:11, from block/blk-io-hierarchy/iodump.c:14: In function 'check_object_size', inlined from 'check_copy_size' at include/linux/thread_info.h:90:2, inlined from 'copy_from_user' at include/linux/uaccess.h:143:6, inlined from 'threshold_store' at block/blk-io-hierarchy/iodump.c:273:6: include/linux/thread_info.h:59:17: warning: 'b' may be used uninitialized [-Wmaybe-uninitialized] 59 | __check_object_size(ptr, n, to_user); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/thread_info.h: In function 'threshold_store': include/linux/thread_info.h:52:13: note: by argument 1 of type 'const void *' to '__check_object_size' declared here 52 | extern void __check_object_size(const void *ptr, unsigned long n, | ^~~~~~~~~~~~~~~~~~~ block/blk-io-hierarchy/iodump.c:267:14: note: 'b' declared here 267 | char b[MAX_BUF_LEN + 1]; | ^ vim +/__bio_stage_hierarchy_start +571 block/blk-io-hierarchy/iodump.c 570 > 571 void *__bio_stage_hierarchy_start(struct bio_stage_dump_data *bstage_ddata, 572 loff_t *pos) 573 { 574 struct pos_data *pdata = &bstage_ddata->pdata; 575 struct rq_dump_data *rq_ddata = &bstage_ddata->rq_ddata; 576 577 retry: 578 if (stage_is_bio(pdata->stage)) { 579 struct list_head *list; 580 struct bio_dump_data *bio_ddata = 581 get_bio_stage_ddata(rq_ddata->q, pdata->stage); 582 583 if (!bio_ddata) { 584 bio_stage_start_next_stage(bstage_ddata, pos); 585 goto retry; 586 } 587 588 spin_lock_irq(&bio_ddata->lock); 589 list = seq_list_start(&bio_ddata->head, pdata->count); 590 if (list) 591 return list; 592 593 spin_unlock_irq(&bio_ddata->lock); 594 bio_stage_start_next_stage(bstage_ddata, pos); 595 goto retry; 596 } 597 598 if (pdata->stage == STAGE_BIO && 599 __rq_hierarchy_start(rq_ddata, pdata->count)) 600 return bstage_ddata; 601 602 return NULL; 603 } 604 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 13838/30000] drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `fmgr_usr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here
by kernel test robot 06 Sep '24

06 Sep '24

Hi DuanqiangWen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c431540f5e2720652e293713c7358952cd0148de commit: 3ddd74dceeba1f4ea8b20db59276ea3c6eded3d5 [13838/30000] openeuler: net: txgbe: Fix some known bugs, merge net-swift txgbe-1.2.3 out-of-tree config: x86_64-randconfig-003-20240906 (https://download.01.org/0day-ci/archive/20240906/202409062029.0Fv1YZCJ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240906/202409062029.0Fv1YZCJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409062029.0Fv1YZCJ-lkp@intel.com/ All errors (new ones prefixed by >>): ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `fmgr_cmd_op': drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2344: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2858: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `wr32': >> drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `fmgr_usr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_erase_chip': drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2371: multiple definition of `flash_erase_chip'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2885: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_erase_sector': drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2377: multiple definition of `flash_erase_sector'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2891: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_write_dword': drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2393: multiple definition of `flash_write_dword'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2908: first defined here vim +2877 drivers/net/ethernet/netswift/ngbe/ngbe_type.h a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2873 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2874 static inline void a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2875 wr32(struct ngbe_hw *hw, u32 reg, u32 val) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2876 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2877 u8 __iomem *base = READ_ONCE(hw->hw_addr); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2878 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2879 if (unlikely(!base)) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2880 return; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2881 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2882 ngbe_wr32(base + reg, val); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2883 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2884 :::::: The code at line 2877 was first introduced by commit :::::: a5961b4bc6ce09a70902686ecc848a47493a9251 openeuler: net: ngbe: add ngbe module support :::::: TO: Duanqiang Wen <duanqiangwen(a)net-swift.com> :::::: CC: Duanqiang Wen <duanqiangwen(a)net-swift.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] ACPI/HMAT: Fix compile error when CONFIG_ACPI_HMAT is not enabled
by Zhang Zekun 06 Sep '24

06 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAPHFQ ------------------------------------------------ Fix compile error when CONFIG_ACPI_HMAT is not enabled: j ../drivers/acpi/acpi_memhotplug.c: In function ‘acpi_memory_enable_device’: ../drivers/acpi/acpi_memhotplug.c:236:5: error: implicit declaration of function ‘hmat_restore_target’; did you mean ‘mte_restore_tags’? [-Werror=implicit-function-declaration] hmat_restore_target(node); ^~~~~~~~~~~~~~~~~~~ mte_restore_tags Fixes: 2e1b00fcf1e3 ("ACPI/HMAT: Add missing locality information for hot-added device") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/acpi/internal.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h index 82444a4cbf15..3a7cc297c63d 100644 --- a/drivers/acpi/internal.h +++ b/drivers/acpi/internal.h @@ -265,6 +265,10 @@ void acpi_init_lpit(void); #else static inline void acpi_init_lpit(void) { } #endif +#ifdef CONFIG_ACPI_HMAT void hmat_restore_target(int nid); +#else +static inline void hmat_restore_target(int nid) {} +#endif #endif /* _ACPI_INTERNAL_H_ */ -- 2.17.1

2 1

[openeuler:openEuler-1.0-LTS 23662/23701] include/linux/thread_info.h:59:17: warning: 'b' may be used uninitialized
by kernel test robot 06 Sep '24

06 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 13b424f97ef548612c760cfd0892f96de96707e0 commit: b9f356e64a7eda411ba8b63df9d4c5e204f16025 [23662/23701] block-io-hierarchy: core hierarchy iodump implementation config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240906/202409061840.VkS4KqE5-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240906/202409061840.VkS4KqE5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409061840.VkS4KqE5-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from include/asm-generic/preempt.h:5, from ./arch/arm64/include/generated/asm/preempt.h:1, from include/linux/preempt.h:81, from include/linux/spinlock.h:51, from include/linux/wait.h:9, from include/linux/wait_bit.h:8, from include/linux/fs.h:7, from include/linux/seq_file.h:11, from block/blk-io-hierarchy/iodump.c:14: In function 'check_object_size', inlined from 'check_copy_size' at include/linux/thread_info.h:90:2, inlined from 'copy_from_user' at include/linux/uaccess.h:143:6, inlined from 'threshold_store' at block/blk-io-hierarchy/iodump.c:240:6: >> include/linux/thread_info.h:59:17: warning: 'b' may be used uninitialized [-Wmaybe-uninitialized] 59 | __check_object_size(ptr, n, to_user); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/thread_info.h: In function 'threshold_store': include/linux/thread_info.h:52:13: note: by argument 1 of type 'const void *' to '__check_object_size' declared here 52 | extern void __check_object_size(const void *ptr, unsigned long n, | ^~~~~~~~~~~~~~~~~~~ block/blk-io-hierarchy/iodump.c:234:14: note: 'b' declared here 234 | char b[MAX_BUF_LEN + 1]; | ^ vim +/b +59 include/linux/thread_info.h 0f60a8efe4005ab Kees Cook 2016-07-12 50 f5509cc18daa7f8 Kees Cook 2016-06-07 51 #ifdef CONFIG_HARDENED_USERCOPY f5509cc18daa7f8 Kees Cook 2016-06-07 52 extern void __check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f8 Kees Cook 2016-06-07 53 bool to_user); f5509cc18daa7f8 Kees Cook 2016-06-07 54 a85d6b8242dc78e Kees Cook 2016-09-07 55 static __always_inline void check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f8 Kees Cook 2016-06-07 56 bool to_user) f5509cc18daa7f8 Kees Cook 2016-06-07 57 { 81409e9e2805881 Kees Cook 2016-08-31 58 if (!__builtin_constant_p(n)) f5509cc18daa7f8 Kees Cook 2016-06-07 @59 __check_object_size(ptr, n, to_user); f5509cc18daa7f8 Kees Cook 2016-06-07 60 } f5509cc18daa7f8 Kees Cook 2016-06-07 61 #else f5509cc18daa7f8 Kees Cook 2016-06-07 62 static inline void check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f8 Kees Cook 2016-06-07 63 bool to_user) f5509cc18daa7f8 Kees Cook 2016-06-07 64 { } f5509cc18daa7f8 Kees Cook 2016-06-07 65 #endif /* CONFIG_HARDENED_USERCOPY */ f5509cc18daa7f8 Kees Cook 2016-06-07 66 :::::: The code at line 59 was first introduced by commit :::::: f5509cc18daa7f82bcc553be70df2117c8eedc16 mm: Hardened usercopy :::::: TO: Kees Cook <keescook(a)chromium.org> :::::: CC: Kees Cook <keescook(a)chromium.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/3] block, bfq: fix possible UAF for bfqq->bic with merge chain
by Yu Kuai 06 Sep '24

06 Sep '24

Yu Kuai (3): block, bfq: fix possible UAF for bfqq->bic with merge chain block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() block, bfq: don't break merge chain in bfq_split_bfqq() block/bfq-iosched.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) -- 2.39.2

2 4

[PATCH OLK-6.6 0/3] Some patches of Net are incorporated into olk-6.6 as follows:
by Jijie Shao 06 Sep '24

06 Sep '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some patches of Net are incorporated into olk-6.6 as follows: Jian Shen (2): net: hns3: don't auto enable misc vector net: hns3: initialize reset_timer before hclgevf_misc_irq_init() Jie Wang (1): net: hns3: fix kernel crash when 1588 is sent on HIP08 devices .../net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 11 +++++++---- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 3 +++ .../net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 2 +- 3 files changed, 11 insertions(+), 5 deletions(-) -- 2.33.0

2 4

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 13b424f97ef548612c760cfd0892f96de96707e0
by kernel test robot 06 Sep '24

06 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 13b424f97ef548612c760cfd0892f96de96707e0 !11418 md/raid5: avoid BUG_ON() while continue reshape after reassembling Warning ids grouped by kconfigs: recent_errors |-- x86_64-allyesconfig | `-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start `-- x86_64-buildonly-randconfig-001-20240906 |-- block-.tmp_blk-mq.o:warning:objtool:blk_mq_unfreeze_queue:unreachable-instruction |-- drivers-dax-.tmp_bus.o:warning:objtool:__dax_driver_register:unreachable-instruction |-- drivers-gpu-drm-.tmp_drm_atomic_helper.o:warning:objtool:drm_atomic_helper_check_modeset:unreachable-instruction |-- drivers-nvdimm-.tmp_namespace_devs.o:warning:objtool:nd_region_register_namespaces:unreachable-instruction |-- net-bpf-.tmp_test_run.o:warning:objtool:bpf_prog_test_run_skb:unreachable-instruction |-- net-can-j1939-.tmp_socket.o:warning:objtool:j1939_sk_queue_activate_next:unreachable-instruction `-- net-can-j1939-.tmp_transport.o:warning:objtool:j1939_xtp_abort_to_errno:unreachable-instruction elapsed time: 1242m configs tested: 35 configs skipped: 138 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240906 gcc-14.1.0 arm64 randconfig-002-20240906 gcc-14.1.0 arm64 randconfig-003-20240906 gcc-14.1.0 arm64 randconfig-004-20240906 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240906 clang-18 x86_64 buildonly-randconfig-002-20240906 clang-18 x86_64 buildonly-randconfig-003-20240906 clang-18 x86_64 buildonly-randconfig-004-20240906 clang-18 x86_64 buildonly-randconfig-005-20240906 clang-18 x86_64 buildonly-randconfig-006-20240906 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240906 clang-18 x86_64 randconfig-002-20240906 gcc-12 x86_64 randconfig-003-20240906 gcc-12 x86_64 randconfig-004-20240906 gcc-12 x86_64 randconfig-005-20240906 gcc-12 x86_64 randconfig-006-20240906 gcc-12 x86_64 randconfig-011-20240906 clang-18 x86_64 randconfig-012-20240906 gcc-12 x86_64 randconfig-013-20240906 clang-18 x86_64 randconfig-014-20240906 clang-18 x86_64 randconfig-015-20240906 clang-18 x86_64 randconfig-016-20240906 clang-18 x86_64 randconfig-071-20240906 gcc-12 x86_64 randconfig-072-20240906 gcc-12 x86_64 randconfig-073-20240906 clang-18 x86_64 randconfig-074-20240906 gcc-12 x86_64 randconfig-075-20240906 clang-18 x86_64 randconfig-076-20240906 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] ACPI/HMAT: Fix compile error when CONFIG_ACPI_HMAT is not enabled
by Zhang Zekun 06 Sep '24

06 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAPHFQ ------------------------------------------------ Fix compile error when CONFIG_ACPI_HMAT is not enabled: j ../drivers/acpi/acpi_memhotplug.c: In function ‘acpi_memory_enable_device’: ../drivers/acpi/acpi_memhotplug.c:236:5: error: implicit declaration of function ‘hmat_restore_target’; did you mean ‘mte_restore_tags’? [-Werror=implicit-function-declaration] hmat_restore_target(node); ^~~~~~~~~~~~~~~~~~~ mte_restore_tags Fixes: 2e1b00fcf1e3 ("ACPI/HMAT: Add missing locality information for hot-added device") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/acpi/internal.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h index 82444a4cbf15..3a7cc297c63d 100644 --- a/drivers/acpi/internal.h +++ b/drivers/acpi/internal.h @@ -265,6 +265,10 @@ void acpi_init_lpit(void); #else static inline void acpi_init_lpit(void) { } #endif +#ifdef CONFIG_ACPI_HMAT void hmat_restore_target(int nid); +#else +static inline void hmat_restore_target(int nid) {} +#endif #endif /* _ACPI_INTERNAL_H_ */ -- 2.17.1

1 0

[PATCH OLK-5.10 0/1] zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
by Chen Ridong 06 Sep '24

06 Sep '24

zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING Oleg Nesterov (1): zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING kernel/pid_namespace.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
by Chen Ridong 06 Sep '24

06 Sep '24

zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING Oleg Nesterov (1): zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING kernel/pid_namespace.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-5.10 v2 00/23] mm/block: add bdi sysfs knobs
by Yifan Qiao 06 Sep '24

06 Sep '24

At meta network block devices (nbd) are used to implement remote block storage. In testing and during production it has been observed that these network block devices can consume a huge portion of the dirty writeback cache and writeback can take a considerable time. To be able to give stricter limits, I'm proposing the following changes: introduce strictlimit knob Currently the max_ratio knob exists to limit the dirty_memory. However this knob only applies once (dirty_ratio + dirty_background_ratio) / 2 has been reached. With the BDI_CAP_STRICTLIMIT flag, the max_ratio can be applied without reaching that limit. This change exposes that knob. This knob can also be useful for NFS, fuse filesystems and USB devices. Use part of 1000000 internal calculation The max_ratio is based on percentage. With the current machine sizes percentage values can be very high (1% of a 256GB main memory is already 2.5GB). This change uses part of 1000000 instead of percentages for the internal calculations. Introduce two new sysfs knobs: min_bytes and max_bytes. Currently all calculations are based on ratio, but for a user it often more convenient to specify a limit in bytes. The new knobs will not store bytes values, instead they will translate the byte value to a corresponding ratio. As the internal values are now part of 1000, the ratio is closer to the specified value. However the value should be more seen as an approximation as it can fluctuate over time. Introduce two new sysfs knobs: min_ratio_fine and max_ratio_fine. The granularity for the existing sysfs bdi knobs min_ratio and max_ratio is based on percentage values. The new sysfs bdi knobs min_ratio_fine and max_ratio_fine allow to specify the ratio as part of 1 million. Chen Wandun (1): mm: rework calculation of bdi_min_ratio in bdi_set_min_ratio Jingbo Xu (2): mm: fix arithmetic for max_prop_frac when setting max_ratio mm: fix arithmetic for bdi min_ratio Stefan Roesch (20): mm: add bdi_set_strict_limit() function mm: add knob /sys/class/bdi/<bdi>/strict_limit mm: document /sys/class/bdi/<bdi>/strict_limit knob mm: use part per 1000000 for bdi ratios mm: add bdi_get_max_bytes() function mm: split off __bdi_set_max_ratio() function mm: add bdi_set_max_bytes() function mm: add knob /sys/class/bdi/<bdi>/max_bytes mm: document /sys/class/bdi/<bdi>/max_bytes knob mm: add bdi_get_min_bytes() function mm: split off __bdi_set_min_ratio() function mm: add bdi_set_min_bytes() function mm: add /sys/class/bdi/<bdi>/min_bytes knob mm: document /sys/class/bdi/<bdi>/min_bytes knob mm: add bdi_set_max_ratio_no_scale() function mm: add /sys/class/bdi/<bdi>/max_ratio_fine knob mm: document /sys/class/bdi/<bdi>/max_ratio_fine knob mm: add bdi_set_min_ratio_no_scale() function mm: add /sys/class/bdi/<bdi>/min_ratio_fine knob mm: document /sys/class/bdi/<bdi>/min_ratio_fine knob Documentation/ABI/testing/sysfs-class-bdi | 48 +++++++ include/linux/backing-dev.h | 10 ++ mm/backing-dev.c | 133 +++++++++++++++++++- mm/page-writeback.c | 147 +++++++++++++++++++--- 4 files changed, 321 insertions(+), 17 deletions(-) -- 2.39.2

3 25

[openeuler:OLK-6.6 13863/13878] drivers/base/platform-msi.c:237: warning: Function parameter or member 'write_msi_msg' not described in 'platform_msi_domain_alloc_range_irqs'
by kernel test robot 06 Sep '24

06 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ad51fadf8895f81201ef22e91984b57ed9b2f9af commit: ed007ade0cef81fb47328683b8a7eec5edfa8494 [13863/13878] virtcca feature: secure smmu init config: x86_64-defconfig (https://download.01.org/0day-ci/archive/20240906/202409061150.PH2ggN81-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240906/202409061150.PH2ggN81-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409061150.PH2ggN81-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/base/platform-msi.c:237: warning: Function parameter or member 'write_msi_msg' not described in 'platform_msi_domain_alloc_range_irqs' vim +237 drivers/base/platform-msi.c 223 224 #ifdef CONFIG_HISI_VIRTCCA_HOST 225 /** 226 * platform_msi_domain_alloc_range_irqs - Allocate specific scope MSI interrupts for @dev 227 * @dev: The device for which to allocate interrupts 228 * @start: The start index of msi 229 * @end: The end index of msi 230 * 231 * %0 if alloc irqs success 232 * %error_code if alloc irqs failed 233 * %-EINVAL if platform_data is null 234 */ 235 int platform_msi_domain_alloc_range_irqs(struct device *dev, unsigned int start, 236 unsigned int end, irq_write_msi_msg_t write_msi_msg) > 237 { 238 int err; 239 240 if (!dev->msi.data->platform_data) 241 return -EINVAL; 242 243 dev->msi.data->platform_data->write_msg = write_msi_msg; 244 err = msi_domain_alloc_irqs_range(dev, MSI_DEFAULT_DOMAIN, start, end); 245 if (err) 246 platform_msi_free_priv_data(dev); 247 248 return err; 249 } 250 EXPORT_SYMBOL_GPL(platform_msi_domain_alloc_range_irqs); 251 #endif 252 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] arm64: Add ARM64_HAS_LSE2 CPU capability
by Tian Tao 06 Sep '24

06 Sep '24

When FEAT_LSE2 is implemented and Bit 6 of sctlr_elx is nAA, the full name of the Not-aligned access. nAA bit has two values: 0b0 Unaligned accesses by the specified instructions generate an Alignment fault. 0b1 Unaligned accesses by the specified instructions do not generate an Alignment fault. this patch sets the nAA bit to 1,The following instructions will not generate an Alignment fault if all bytes being accessed are not within a single 16-byte quantity: • LDAPR, LDAPRH, LDAPUR, LDAPURH, LDAPURSH, LDAPURSW, LDAR, LDARH,LDLAR, LDLARH. • STLLR, STLLRH, STLR, STLRH, STLUR, and STLURH Signed-off-by: Tian Tao <tiantao6(a)hisilicon.com> --- arch/arm64/Kconfig | 10 ++++++++++ arch/arm64/include/asm/sysreg.h | 1 + arch/arm64/kernel/cpufeature.c | 18 ++++++++++++++++++ arch/arm64/tools/cpucaps | 1 + 4 files changed, 30 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 77d7ef0b16c2..bdeb2d897069 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -2023,6 +2023,16 @@ config ARM64_TLB_RANGE The feature introduces new assembly instructions, and they were support when binutils >= 2.30. +config ARM64_LSE2 + bool "Enable support for not-aligned access" + depends on AS_HAS_ARMV8_4 + help + LSE2 is an extension to the original LSE (Large System Extensions) feature, + introduced in ARMv8.4. + + Enable this feature will not generate an Alignment fault if all bytes being + accessed are not within a single 16-byte quantity. + endmenu # "ARMv8.4 architectural features" menu "ARMv8.5 architectural features" diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h index 8cced8aa75a9..42e3a1959aa8 100644 --- a/arch/arm64/include/asm/sysreg.h +++ b/arch/arm64/include/asm/sysreg.h @@ -854,6 +854,7 @@ #define SCTLR_ELx_ENDB (BIT(13)) #define SCTLR_ELx_I (BIT(12)) #define SCTLR_ELx_EOS (BIT(11)) +#define SCTLR_ELx_nAA (BIT(6)) #define SCTLR_ELx_SA (BIT(3)) #define SCTLR_ELx_C (BIT(2)) #define SCTLR_ELx_A (BIT(1)) diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 646ecd3069fd..cc85c6cd9908 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -2299,6 +2299,14 @@ static void cpu_enable_mte(struct arm64_cpu_capabilities const *cap) } #endif /* CONFIG_ARM64_MTE */ +#ifdef CONFIG_ARM64_LSE2 +static void cpu_enable_lse2(const struct arm64_cpu_capabilities *__unused) +{ + sysreg_clear_set(sctlr_el2, SCTLR_ELx_nAA, SCTLR_ELx_nAA); + isb(); +} +#endif + static void user_feature_fixup(void) { if (cpus_have_cap(ARM64_WORKAROUND_2658417)) { @@ -2427,6 +2435,16 @@ static const struct arm64_cpu_capabilities arm64_features[] = { ARM64_CPUID_FIELDS(ID_AA64ISAR0_EL1, ATOMIC, IMP) }, #endif /* CONFIG_ARM64_LSE_ATOMICS */ +#ifdef CONFIG_ARM64_LSE2 + { + .desc = "FEAT_LSE2", + .capability = ARM64_HAS_LSE2, + .type = ARM64_CPUCAP_SYSTEM_FEATURE, + .matches = has_cpuid_feature, + .cpu_enable = cpu_enable_lse2, + ARM64_CPUID_FIELDS(ID_AA64MMFR2_EL1, AT, IMP) + }, +#endif { .desc = "Virtualization Host Extensions", .capability = ARM64_HAS_VIRT_HOST_EXTN, diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps index ac3429d892b9..0c7c0a293574 100644 --- a/arch/arm64/tools/cpucaps +++ b/arch/arm64/tools/cpucaps @@ -41,6 +41,7 @@ HAS_HCX HAS_LDAPR HAS_LPA2 HAS_LSE_ATOMICS +HAS_LSE2 HAS_MOPS HAS_NESTED_VIRT HAS_PAN -- 2.33.0

1 0

[PATCH 0/3] Some patches of Net are incorporated into olk-6.6 as follows:
by Jijie Shao 06 Sep '24

06 Sep '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some patches of Net are incorporated into olk-6.6 as follows: Jian Shen (2): net: hns3: remove unnecessary synchronize_irq net: hns3: initialize reset_timer before hclgevf_misc_irq_init() Jie Wang (1): net: hns3: fix kernel crash when 1588 is sent on HIP08 devices drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 8 ++++---- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 3 +++ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 2 +- 3 files changed, 8 insertions(+), 5 deletions(-) -- 2.33.0

1 3

[PATCH OLK-6.6 v2] drm/amd/display: Fix null pointer deref in dcn20_resource.c
by Xiaomeng Zhang 06 Sep '24

06 Sep '24

From: Aurabindo Pillai <aurabindo.pillai(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit ecbf60782662f0a388493685b85a645a0ba1613c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMUG CVE: CVE-2024-43899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes a hang thats triggered when MPV is run on a DCN401 dGPU: mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all and then enabling fullscreen playback (double click on the video) The following calltrace will be seen: [ 181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 181.843997] #PF: supervisor instruction fetch in kernel mode [ 181.844003] #PF: error_code(0x0010) - not-present page [ 181.844009] PGD 0 P4D 0 [ 181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI [ 181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018 [ 181.844044] RIP: 0010:0x0 [ 181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246 [ 181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 [ 181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400 [ 181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c [ 181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8 [ 181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005 [ 181.844121] FS: 00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000 [ 181.844128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0 [ 181.844141] Call Trace: [ 181.844146] <TASK> [ 181.844153] ? show_regs+0x6d/0x80 [ 181.844167] ? __die+0x24/0x80 [ 181.844179] ? page_fault_oops+0x99/0x1b0 [ 181.844192] ? do_user_addr_fault+0x31d/0x6b0 [ 181.844204] ? exc_page_fault+0x83/0x1b0 [ 181.844216] ? asm_exc_page_fault+0x27/0x30 [ 181.844237] dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu] [ 181.845115] amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu] [ 181.845985] amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu] [ 181.846848] fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu] [ 181.847734] fill_dc_plane_attributes+0x162/0x350 [amdgpu] [ 181.848748] dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.849791] ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.850840] amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu] Signed-off-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c [The conflicts were due to file path changed] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c index d587f807dfd7..94bf438c7310 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c @@ -2178,10 +2178,11 @@ bool dcn20_get_dcc_compression_cap(const struct dc *dc, const struct dc_dcc_surface_param *input, struct dc_surface_dcc_cap *output) { - return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( - dc->res_pool->hubbub, - input, - output); + if (dc->res_pool->hubbub->funcs->get_dcc_compression_cap) + return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( + dc->res_pool->hubbub, input, output); + + return false; } static void dcn20_destroy_resource_pool(struct resource_pool **pool) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v2] drm/amd/display: Fix null pointer deref in dcn20_resource.c
by Xiaomeng Zhang 06 Sep '24

06 Sep '24

From: Aurabindo Pillai <aurabindo.pillai(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit ecbf60782662f0a388493685b85a645a0ba1613c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMUG CVE: CVE-2024-43899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes a hang thats triggered when MPV is run on a DCN401 dGPU: mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all and then enabling fullscreen playback (double click on the video) The following calltrace will be seen: [ 181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 181.843997] #PF: supervisor instruction fetch in kernel mode [ 181.844003] #PF: error_code(0x0010) - not-present page [ 181.844009] PGD 0 P4D 0 [ 181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI [ 181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018 [ 181.844044] RIP: 0010:0x0 [ 181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246 [ 181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 [ 181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400 [ 181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c [ 181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8 [ 181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005 [ 181.844121] FS: 00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000 [ 181.844128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0 [ 181.844141] Call Trace: [ 181.844146] <TASK> [ 181.844153] ? show_regs+0x6d/0x80 [ 181.844167] ? __die+0x24/0x80 [ 181.844179] ? page_fault_oops+0x99/0x1b0 [ 181.844192] ? do_user_addr_fault+0x31d/0x6b0 [ 181.844204] ? exc_page_fault+0x83/0x1b0 [ 181.844216] ? asm_exc_page_fault+0x27/0x30 [ 181.844237] dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu] [ 181.845115] amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu] [ 181.845985] amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu] [ 181.846848] fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu] [ 181.847734] fill_dc_plane_attributes+0x162/0x350 [amdgpu] [ 181.848748] dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.849791] ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.850840] amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu] Signed-off-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c [The conflicts were due to file path changed] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c index 53ac82693532..2990793e86a2 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c @@ -3290,10 +3290,11 @@ bool dcn20_get_dcc_compression_cap(const struct dc *dc, const struct dc_dcc_surface_param *input, struct dc_surface_dcc_cap *output) { - return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( - dc->res_pool->hubbub, - input, - output); + if (dc->res_pool->hubbub->funcs->get_dcc_compression_cap) + return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( + dc->res_pool->hubbub, input, output); + + return false; } static void dcn20_destroy_resource_pool(struct resource_pool **pool) -- 2.34.1

2 1

[PATCH OLK-5.10 v2] drm/amd/display: Fix null pointer deref in dcn20_resource.c
by Xiaomeng Zhang 06 Sep '24

06 Sep '24

From: Aurabindo Pillai <aurabindo.pillai(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit ecbf60782662f0a388493685b85a645a0ba1613c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMUG CVE: CVE-2024-43899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes a hang thats triggered when MPV is run on a DCN401 dGPU: mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all and then enabling fullscreen playback (double click on the video) The following calltrace will be seen: [ 181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 181.843997] #PF: supervisor instruction fetch in kernel mode [ 181.844003] #PF: error_code(0x0010) - not-present page [ 181.844009] PGD 0 P4D 0 [ 181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI [ 181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018 [ 181.844044] RIP: 0010:0x0 [ 181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246 [ 181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 [ 181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400 [ 181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c [ 181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8 [ 181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005 [ 181.844121] FS: 00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000 [ 181.844128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0 [ 181.844141] Call Trace: [ 181.844146] <TASK> [ 181.844153] ? show_regs+0x6d/0x80 [ 181.844167] ? __die+0x24/0x80 [ 181.844179] ? page_fault_oops+0x99/0x1b0 [ 181.844192] ? do_user_addr_fault+0x31d/0x6b0 [ 181.844204] ? exc_page_fault+0x83/0x1b0 [ 181.844216] ? asm_exc_page_fault+0x27/0x30 [ 181.844237] dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu] [ 181.845115] amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu] [ 181.845985] amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu] [ 181.846848] fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu] [ 181.847734] fill_dc_plane_attributes+0x162/0x350 [amdgpu] [ 181.848748] dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.849791] ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.850840] amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu] Signed-off-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c [The conflicts were due to file path changed] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c index 53ac82693532..2990793e86a2 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c @@ -3290,10 +3290,11 @@ bool dcn20_get_dcc_compression_cap(const struct dc *dc, const struct dc_dcc_surface_param *input, struct dc_surface_dcc_cap *output) { - return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( - dc->res_pool->hubbub, - input, - output); + if (dc->res_pool->hubbub->funcs->get_dcc_compression_cap) + return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( + dc->res_pool->hubbub, input, output); + + return false; } static void dcn20_destroy_resource_pool(struct resource_pool **pool) -- 2.34.1

2 1

[PATCH OLK-6.6] tools: Add dynamic process-level cgroup memory monitoring tool
by Taoxy2004 06 Sep '24

06 Sep '24

community inclusion category: feature bugzilla: https://gitee.com/openeuler/open-source-summer/issues/I9JQ4D ---------------------------------------------------------------------- This patch introduces a new tool called "probeCgroup" that enables dynamic monitoring of memory usage at the process level within cgroups. By using kprobes at relevant cgroup functions, this tool can track memory allocations and deallocations for individual processes within a cgroup, providing detailed statistics on memory usage. The key features of the tool include: 1. Dynamic insertion of kprobes at critical points in the cgroup subsystem. 2. Tracking memory allocation and deallocation events for each process by recording page addresses in a hash table. 3. Providing real-time statistics on memory usage at the process level. 4. Providing statistics on memory usage for processes that are OOM. Signed-off-by: Taoxy2004 <221870066(a)smail.nju.edu.cn> --- tools/probeCgroup/Makefile | 7 + tools/probeCgroup/README.md | 29 + tools/probeCgroup/probeCgroup.c | 612 ++++++++++++++++++ tools/probeCgroup/probeCgroup.h | 415 ++++++++++++ tools/probeCgroup/run.sh | 8 + tools/probeCgroup/scripts/script1.sh | 10 + tools/probeCgroup/scripts/script2.sh | 14 + tools/probeCgroup/scripts/script3.sh | 11 + .../testcases/1_load_unload_test.py | 24 + .../testcases/2_multiple_process_test.py | 48 ++ .../testcases/3_multiple_cgroup_test.py | 55 ++ tools/probeCgroup/testcases/4_oom_test.py | 52 ++ .../testcases/5_multiple_threads_test.py | 45 ++ tools/probeCgroup/testcases/cgroup_utils.py | 114 ++++ tools/probeCgroup/testcases/mem-allocate.c | 35 + .../testcases/multiple-thread-mem-allocate.c | 60 ++ tools/probeCgroup/testcases/run.py | 32 + .../testcases/simple-mem-allocate.c | 27 + 18 files changed, 1598 insertions(+) create mode 100644 tools/probeCgroup/Makefile create mode 100644 tools/probeCgroup/README.md create mode 100644 tools/probeCgroup/probeCgroup.c create mode 100644 tools/probeCgroup/probeCgroup.h create mode 100755 tools/probeCgroup/run.sh create mode 100755 tools/probeCgroup/scripts/script1.sh create mode 100755 tools/probeCgroup/scripts/script2.sh create mode 100755 tools/probeCgroup/scripts/script3.sh create mode 100755 tools/probeCgroup/testcases/1_load_unload_test.py create mode 100755 tools/probeCgroup/testcases/2_multiple_process_test.py create mode 100755 tools/probeCgroup/testcases/3_multiple_cgroup_test.py create mode 100755 tools/probeCgroup/testcases/4_oom_test.py create mode 100755 tools/probeCgroup/testcases/5_multiple_threads_test.py create mode 100644 tools/probeCgroup/testcases/cgroup_utils.py create mode 100644 tools/probeCgroup/testcases/mem-allocate.c create mode 100644 tools/probeCgroup/testcases/multiple-thread-mem-allocate.c create mode 100755 tools/probeCgroup/testcases/run.py create mode 100644 tools/probeCgroup/testcases/simple-mem-allocate.c diff --git a/tools/probeCgroup/Makefile b/tools/probeCgroup/Makefile new file mode 100644 index 000000000000..606c951e5487 --- /dev/null +++ b/tools/probeCgroup/Makefile @@ -0,0 +1,7 @@ +obj-m := probeCgroup.o +CROSS_COMPILE = '' +KDIR := /lib/modules/$(shell uname -r)/build +all: + make -C $(KDIR) M=$(PWD) modules +clean: + rm -f *.ko *.o *.mod *.mod.o *.mod.c .*.cmd *.symvers module* diff --git a/tools/probeCgroup/README.md b/tools/probeCgroup/README.md new file mode 100644 index 000000000000..ff0b6fc21228 --- /dev/null +++ b/tools/probeCgroup/README.md @@ -0,0 +1,29 @@ +# probeCgroup + +#### Description +probeCgroup is a process-level cgroup memory monitoring tool based on dynamic tracing (kprobe/kretprobe) technology. By inserting kprobes and kretprobes at the entry and exit points of relevant cgroup functions, this tool can track the memory usage of individual processes within each cgroup in real time. + +#### Software Architecture +1. Dynamic Tracing : Insert kprobes and kretprobes at critical points in cgroup functions to capture memory allocation and release events. +2. Hash Table Recording : Record the addresses of pages currently used by each process in a hash table, so that when a page is released, the process it belongs to can be identified. +3. Real-Time Statistics : Provide real-time statistics showing the memory usage of individual processes within each cgroup. + +#### Instruction +1. Compile and Load the Module + a. In the 'probeCgroup' directory, run the 'make' command to compile the module. + b. Load the module: 'insmod probeCgroup.ko'. + c. View memory statistics: 'cat /proc/cgroup_memory_usage_per_process'. + If an OOM (Out of Memory) event occurs in a cgroup, you can see "oom:" followed by the process that experienced the OOM and its memory usage at the time. + +2. Automate OOM Scenario + In the 'probeCgroup' directory, run './run.sh'. This script will automatically set up an OOM scenario and output the content of '/proc/cgroup_memory_usage_per_process' after execution. + +3. Perform More Tests + a. After compiling the module, in the 'testcases' directory, run './run.py'. + b. This script will perform various tests, including: + - Loading and unloading the module + - Each cgroup containing multiple processes + - Creating multiple cgroups + - OOM scenarios + - Multithreading + c. The tests will take approximately one minute to complete. diff --git a/tools/probeCgroup/probeCgroup.c b/tools/probeCgroup/probeCgroup.c new file mode 100644 index 000000000000..9883cb1e082d --- /dev/null +++ b/tools/probeCgroup/probeCgroup.c @@ -0,0 +1,612 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * probeCgroup.c - A tool used to get memory usage for each process in a cgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include "probeCgroup.h" + +// kretprobe at mem_cgroup_charge +struct charge_data { + struct cgroup *cgrp; + struct mem_cgroup *memcg; + struct task_struct *task; + unsigned long addr; +}; + +static int mem_cgroup_charge_entry_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct charge_data *data; + struct folio *page; + struct mm_struct *mm; + struct mem_cgroup *memcg; + struct cgroup_subsys_state css; + struct cgroup *cgrp; + + if (!current->mm) + return 1; + page = (struct folio *)regs->di; + mm = (struct mm_struct *)regs->si; + if (mm == NULL || page == NULL) + return -1; + memcg = get_mem_cgroup_from_mm(mm); + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + + data = (struct charge_data *)ri->data; + data->memcg = memcg; + data->addr = (unsigned long)page; + data->task = current; + data->cgrp = cgrp; + } + return 0; +} + +NOKPROBE_SYMBOL(mem_cgroup_charge_entry_handler); + +static int mem_cgroup_charge_ret_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + unsigned long retval = regs_return_value(regs); + struct charge_data *data = (struct charge_data *)ri->data; + int id; + struct cgroup_info *cgrp_info; + struct task_info *tsk_info; + + if (data->memcg != NULL && retval == 0) { + id = ((data->memcg)->css).id; + + spin_lock(&lock); + cgrp_info = find_cgroup_info(id); + if (cgrp_info == NULL) { + cgrp_info = create_cgroup_info(data->cgrp, data->memcg); + if (cgrp_info == NULL) { + spin_unlock(&lock); + return -1; + } + add_cgroup_info(cgrp_info); + } + spin_unlock(&lock); + + read_lock(&cgrp_info->cgrp_lock); + tsk_info = find_task_info(cgrp_info, data->task->tgid); + read_unlock(&cgrp_info->cgrp_lock); + + // for some cases, task->comm changes over time + if (tsk_info != NULL + && strcmp(data->task->comm, tsk_info->comm) != 0) { + strscpy(tsk_info->comm, data->task->comm, + sizeof(tsk_info->comm)); + } + + if (tsk_info == NULL) { + tsk_info = create_task_info(data->task); + if (tsk_info == NULL) + return -1; + add_task_to_cgroup_info(cgrp_info, tsk_info); + } + + if (HashMap_insert(tsk_info->pages, data->addr)) { + //update counter + spin_lock(&(tsk_info->cnt_lock)); + tsk_info->count += + folio_nr_pages((struct folio *)data->addr); + spin_unlock(&(tsk_info->cnt_lock)); + } + } + + return 0; + +} + +NOKPROBE_SYMBOL(mem_cgroup_charge_ret_handler); + +static struct kretprobe mem_cgroup_charge_kretprobe = { + .handler = mem_cgroup_charge_ret_handler, + .entry_handler = mem_cgroup_charge_entry_handler, + .data_size = sizeof(struct charge_data), + .maxactive = 20, +}; + +static int mem_cgroup_charge_kretprobe_init(void) +{ + int ret; + + mem_cgroup_charge_kretprobe.kp.symbol_name = "__mem_cgroup_charge"; + ret = register_kretprobe(&mem_cgroup_charge_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); + return ret; + } + pr_info("Planted return probe at %s: %p\n", + mem_cgroup_charge_kretprobe.kp.symbol_name, + mem_cgroup_charge_kretprobe.kp.addr); + return 0; +} + +static void mem_cgroup_charge_kretprobe_exit(void) +{ + unregister_kretprobe(&mem_cgroup_charge_kretprobe); + pr_info("kretprobe at %p unregistered\n", + mem_cgroup_charge_kretprobe.kp.addr); + + /* nmissed > 0 suggests that maxactive was set too low. */ + pr_info("Missed probing %d instances of %s\n", + mem_cgroup_charge_kretprobe.nmissed, + mem_cgroup_charge_kretprobe.kp.symbol_name); +} + +// kretprobe at uncharge_folio + +struct uncharge_data { + struct cgroup *cgrp; + struct mem_cgroup *memcg; + unsigned long addr; + bool isKmem; + int nr_pages; +}; + +static int uncharge_folio_entry_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct uncharge_data *data; + struct folio *page; + struct mem_cgroup *memcg = NULL; + struct cgroup_subsys_state css; + struct cgroup *cgrp; + struct obj_cgroup *objcg; + int nr_pages = 0; + + data = (struct uncharge_data *)ri->data; + page = (struct folio *)regs->di; + if (page == NULL) { + data->memcg = NULL; + return -1; + } + if (page->memcg_data & MEMCG_DATA_KMEM) { // if the page belongs to kmem + if (!folio_test_large(page)) + nr_pages = 1; + else + nr_pages = page->_folio_nr_pages; + // nr_pages = thp_nr_pages(page); + objcg = __folio_objcg(page); + if (objcg != NULL) + memcg = objcg->memcg; + data->isKmem = true; + data->nr_pages = nr_pages; + } else { + memcg = __folio_memcg(page); + data->isKmem = false; + } + + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + + data->memcg = memcg; + data->addr = (unsigned long)page; + data->cgrp = cgrp; + } + return 0; +} + +NOKPROBE_SYMBOL(uncharge_folio_entry_handler); + +static int uncharge_folio_ret_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct uncharge_data *data = (struct uncharge_data *)ri->data; + int id; + struct cgroup_info *cgrp_info; + int ret = -1; + + if (data->memcg != NULL) { + id = ((data->memcg)->css).id; + cgrp_info = find_cgroup_info(id); + if (cgrp_info == NULL) + return -1; + if (data->isKmem) + ret = -1; + else + ret = remove_page_from_cgroup_info(data->addr, cgrp_info); + } + + return ret; +} + +NOKPROBE_SYMBOL(uncharge_folio_ret_handler); + +static struct kretprobe uncharge_folio_kretprobe = { + .handler = uncharge_folio_ret_handler, + .entry_handler = uncharge_folio_entry_handler, + .data_size = sizeof(struct uncharge_data), + .maxactive = 20, +}; + +static int uncharge_folio_kretprobe_init(void) +{ + int ret; + + uncharge_folio_kretprobe.kp.symbol_name = "uncharge_folio"; + ret = register_kretprobe(&uncharge_folio_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); + return ret; + } + pr_info("Planted return probe at %s: %p\n", + uncharge_folio_kretprobe.kp.symbol_name, + uncharge_folio_kretprobe.kp.addr); + return 0; +} + +static void uncharge_folio_kretprobe_exit(void) +{ + unregister_kretprobe(&uncharge_folio_kretprobe); + pr_info("kretprobe at %p unregistered\n", + uncharge_folio_kretprobe.kp.addr); + + /* nmissed > 0 suggests that maxactive was set too low. */ + pr_info("Missed probing %d instances of %s\n", + uncharge_folio_kretprobe.nmissed, + uncharge_folio_kretprobe.kp.symbol_name); +} + +//kprobe at do_exit +static struct kprobe do_exit_kprobe; +static int do_exit_kprobe_pre_handler(struct kprobe *p, struct pt_regs *regs) +{ + struct task_struct *cur = current; + int tgid = cur->tgid; + struct mm_struct *mm = cur->mm; + struct mem_cgroup *memcg = get_mem_cgroup_from_mm(mm); + struct cgroup_subsys_state css; + struct cgroup *cgrp; + struct cgroup_info *cgrp_info; + struct task_info *tsk_info; + int id; + + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + id = (memcg->css).id; + cgrp_info = find_cgroup_info(id); + if (cgrp_info != NULL) { + write_lock(&cgrp_info->cgrp_lock); + tsk_info = find_task_info(cgrp_info, tgid); + if (tsk_info != NULL) { + list_del(&tsk_info->list); + write_unlock(&cgrp_info->cgrp_lock); + remove_task_from_cgroup_info(cgrp_info, + tsk_info); + } else { + write_unlock(&cgrp_info->cgrp_lock); + } + return 0; + } + } + return 0; +} + +static void do_exit_kprobe_post_handler(struct kprobe *p, + struct pt_regs *regs, + unsigned long flags) +{ + +} + +static int do_exit_kprobe_init(void) +{ + do_exit_kprobe.pre_handler = do_exit_kprobe_pre_handler; + do_exit_kprobe.post_handler = do_exit_kprobe_post_handler; + do_exit_kprobe.symbol_name = "do_exit"; + if (register_kprobe(&do_exit_kprobe)) { + pr_alert("register_kprobe on do_exit failed!\n"); + return -EINVAL; + } + return 0; +} + +static void do_exit_kprobe_exit(void) +{ + unregister_kprobe(&do_exit_kprobe); +} + +//kprobe at mark_oom_victim +static struct kprobe mark_oom_victim_kprobe; + +static int mark_oom_victim_kprobe_pre_handler(struct kprobe *p, + struct pt_regs *regs) +{ + struct task_struct *victim; + int tgid; + struct mm_struct *mm; + struct mem_cgroup *memcg; + struct cgroup_subsys_state css; + struct cgroup *cgrp; + struct cgroup_info *cgrp_info; + struct task_info *tsk_info; + int id; + struct task_info *oom_info; + + victim = (struct task_struct *)regs->di; + tgid = victim->tgid; + mm = victim->mm; + memcg = get_mem_cgroup_from_mm(mm); + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + id = (memcg->css).id; + cgrp_info = find_cgroup_info(id); + if (cgrp_info != NULL) { + read_lock(&cgrp_info->cgrp_lock); + tsk_info = find_task_info(cgrp_info, tgid); + read_unlock(&cgrp_info->cgrp_lock); + if (tsk_info != NULL) { + oom_info = create_oom_task_info(tsk_info); + if (oom_info != NULL) { + add_oom_task_to_cgroup_info(cgrp_info, + oom_info); + } + return 0; + } + } + } + return 0; +} + +static void mark_oom_victim_kprobe_post_handler(struct kprobe *p, + struct pt_regs *regs, + unsigned long flags) +{ + +} + +static int mark_oom_victim_kprobe_init(void) +{ + mark_oom_victim_kprobe.pre_handler = mark_oom_victim_kprobe_pre_handler; + mark_oom_victim_kprobe.post_handler = + mark_oom_victim_kprobe_post_handler; + mark_oom_victim_kprobe.symbol_name = "mark_oom_victim"; + if (register_kprobe(&mark_oom_victim_kprobe)) { + pr_alert("register_kprobe on mark_oom_victim failed!\n"); + return -EINVAL; + } + return 0; +} + +static void mark_oom_victim_kprobe_exit(void) +{ + unregister_kprobe(&mark_oom_victim_kprobe); +} + +//kretporbe at cgroup_destroy_locked +struct destroy_data { + struct cgroup *cgrp; +}; + +static int cgroup_destroy_locked_entry_handler(struct kretprobe_instance + *ri, struct pt_regs *regs) +{ + struct destroy_data *data; + + data = (struct destroy_data *)ri->data; + data->cgrp = (struct cgroup *)regs->di; + return 0; +} + +NOKPROBE_SYMBOL(cgroup_destroy_locked_entry_handler); + +static int cgroup_destroy_locked_ret_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct destroy_data *data = (struct destroy_data *)ri->data; + struct cgroup *cgrp = data->cgrp; + struct cgroup_info *cgrp_info = NULL; + unsigned long retval = regs_return_value(regs); + + if (!cgrp) + return -1; + if (retval != 0) + return -1; + list_for_each_entry(cgrp_info, &all_cgroup_info, list) { + if (cgrp_info->cgrp == cgrp) { + spin_lock(&lock); + list_del(&cgrp_info->list); + spin_unlock(&lock); + destroy_cgroup_info(cgrp_info); + return 0; + } + } + return -1; +} + +NOKPROBE_SYMBOL(cgroup_destroy_locked_ret_handler); + +static struct kretprobe cgroup_destroy_locked_kretprobe = { + .handler = cgroup_destroy_locked_ret_handler, + .entry_handler = cgroup_destroy_locked_entry_handler, + .data_size = sizeof(struct destroy_data), + .maxactive = 20, +}; + +static int cgroup_destroy_locked_kretprobe_init(void) +{ + int ret; + + cgroup_destroy_locked_kretprobe.kp.symbol_name = + "cgroup_destroy_locked"; + ret = register_kretprobe(&cgroup_destroy_locked_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); + return ret; + } + pr_info("Planted return probe at %s: %p\n", + cgroup_destroy_locked_kretprobe.kp.symbol_name, + cgroup_destroy_locked_kretprobe.kp.addr); + return 0; +} + +static void cgroup_destroy_locked_kretprobe_exit(void) +{ + unregister_kretprobe(&cgroup_destroy_locked_kretprobe); + pr_info("kretprobe at %p unregistered\n", + cgroup_destroy_locked_kretprobe.kp.addr); + + /* nmissed > 0 suggests that maxactive was set too low. */ + pr_info("Missed probing %d instances of %s\n", + cgroup_destroy_locked_kretprobe.nmissed, + cgroup_destroy_locked_kretprobe.kp.symbol_name); +} + +// print the tasks in order of their memory usage +static void print_sorted_tasks_list(struct cgroup_info *cgrp_info, + int type, struct seq_file *m) +{ + struct list_head *cur, *insert_pos; + struct task_info *task, *insert_task; + struct list_head new_list = LIST_HEAD_INIT(new_list); + struct list_head *old_list; + struct task_info *new_task, *next_task; + + if (type == 0) { + if (cgrp_info == NULL) + return; + read_lock(&cgrp_info->cgrp_lock); + old_list = &cgrp_info->tasks_list; + } else { + if (cgrp_info == NULL) + return; + old_list = &cgrp_info->oom_list; + } + + list_for_each_entry_safe(task, insert_task, old_list, list) { + new_task = kmalloc(sizeof(struct task_info), GFP_ATOMIC); + if (!new_task) + return; + new_task->tgid = task->tgid; + strscpy(new_task->comm, task->comm, sizeof(new_task->comm)); + new_task->count = task->count; + new_task->pages = NULL; + INIT_LIST_HEAD(&new_task->list); + + //insertion sort + cur = &new_list; + insert_pos = cur->next; + while (insert_pos != &new_list) { + next_task = + list_entry(insert_pos, struct task_info, list); + if (new_task->count >= next_task->count) + break; + cur = insert_pos; + insert_pos = insert_pos->next; + } + + (&new_task->list)->prev = insert_pos->prev; + (insert_pos->prev)->next = (&new_task->list); + (&new_task->list)->next = insert_pos; + insert_pos->prev = (&new_task->list); + } + if (type == 0) + read_unlock(&cgrp_info->cgrp_lock); + + //print + if (type == 1 && (&new_list) != new_list.next) { + seq_puts(m, "oom:\n"); + seq_printf(m, "%10s %20s %20s\n", "pid", "command", + "memory usage (KB)"); + } + if (type == 0) + seq_printf(m, "%10s %20s %20s\n", "pid", "command", + "memory usage (KB)"); + list_for_each_entry_safe(task, insert_task, &new_list, list) { + seq_printf(m, "%10d %20s %20d\n", task->tgid, task->comm, + (task->count) * 4); + } + + list_for_each_entry_safe(task, insert_task, &new_list, list) { + list_del(&task->list); + kfree(task); + } +} + +static struct proc_dir_entry *cgroup_info_read; +#define procfs_file_read "cgroup_memory_usage_per_process" + +void seq_print_tasks(struct cgroup_info *cgroup_info, struct seq_file *m) +{ + if (!cgroup_info) + return; + + print_sorted_tasks_list(cgroup_info, 0, m); +} + +void seq_print_oom_tasks(struct cgroup_info *cgroup_info, struct seq_file *m) +{ + if (!cgroup_info) + return; + + print_sorted_tasks_list(cgroup_info, 1, m); +} + +void seq_print_cgroups(struct seq_file *m) +{ + struct cgroup_info *cgrp, *pos; + + spin_lock(&lock); + list_for_each_entry_safe(cgrp, pos, &all_cgroup_info, list) { + seq_printf(m, "cgroup name : %s\n", cgrp->name); + seq_print_tasks(cgrp, m); + seq_print_oom_tasks(cgrp, m); + seq_puts(m, "\n"); + } + spin_unlock(&lock); +} + +static int memory_usage_show(struct seq_file *m, void *v) +{ + seq_print_cgroups(m); + return 0; +} + +static int __init global_init(void) +{ + int ret = 0; + + cgroup_info_read = + proc_create_single(procfs_file_read, 0, NULL, memory_usage_show); + if (!cgroup_info_read) + return -ENOMEM; + ret = mem_cgroup_charge_kretprobe_init(); + uncharge_folio_kretprobe_init(); + do_exit_kprobe_init(); + mark_oom_victim_kprobe_init(); + cgroup_destroy_locked_kretprobe_init(); + + return ret; +} + +static void __exit global_exit(void) +{ + struct cgroup_info *cgrp_info, *pos; + + mem_cgroup_charge_kretprobe_exit(); + uncharge_folio_kretprobe_exit(); + do_exit_kprobe_exit(); + mark_oom_victim_kprobe_exit(); + cgroup_destroy_locked_kretprobe_exit(); + + remove_proc_entry(procfs_file_read, NULL); + + //release all memory use + list_for_each_entry_safe(cgrp_info, pos, &all_cgroup_info, list) { + list_del(&cgrp_info->list); + destroy_cgroup_info(cgrp_info); + } +} + +module_init(global_init) +module_exit(global_exit) +MODULE_LICENSE("GPL"); diff --git a/tools/probeCgroup/probeCgroup.h b/tools/probeCgroup/probeCgroup.h new file mode 100644 index 000000000000..953a6e0aca31 --- /dev/null +++ b/tools/probeCgroup/probeCgroup.h @@ -0,0 +1,415 @@ +/* SPDX-License-Identifier: GPL-2.0*/ +/* + * probeCgroup.h + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/kprobes.h> +#include <linux/ktime.h> +#include <linux/limits.h> +#include <linux/sched.h> +#include <linux/mm_types.h> +#include <linux/memcontrol.h> +#include <linux/cgroup-defs.h> +#include <linux/kernfs.h> +#include <linux/string.h> +#include <linux/list.h> +#include <linux/oom.h> +#include <linux/fs.h> +#include <linux/proc_fs.h> +#include <linux/huge_mm.h> +#include <linux/page-flags.h> +#include <linux/spinlock.h> +#include <linux/rwlock.h> + +static spinlock_t lock; // global lock for the list of cgroup_info + +struct HashNode { + unsigned long addr; + struct HashNode *next; +}; + +struct HashNode *HashNode_create(unsigned long addr) +{ + struct HashNode *node = NULL; + + node = kzalloc(sizeof(struct HashNode), GFP_ATOMIC); + if (node == NULL) + return NULL; + node->addr = addr; + node->next = NULL; + return node; +} + +struct HashBucket { + struct HashNode *head; + spinlock_t bkt_lock; +}; + +void HashBucket_init(struct HashBucket *bkt) +{ + bkt->head = NULL; + spin_lock_init(&bkt->bkt_lock); +} + +bool HashBucket_insert(struct HashBucket *bkt, unsigned long addr) +{ + struct HashNode *new_node; + struct HashNode *node; + struct HashNode *prev; + bool ret = true; + + if (bkt == NULL) + return false; + + prev = NULL; + new_node = NULL; + new_node = HashNode_create(addr); + + spin_lock(&bkt->bkt_lock); + node = bkt->head; + while (node != NULL && node->addr != addr) { + prev = node; + node = node->next; + } + if (node == NULL) { + if (new_node == NULL) { + pr_info("not enough memory for HashNode\n"); + spin_unlock(&bkt->bkt_lock); + return false; + } + if (bkt->head == NULL) + bkt->head = new_node; + else + prev->next = new_node; + spin_unlock(&bkt->bkt_lock); + ret = true; + } else { + spin_unlock(&bkt->bkt_lock); + kfree(new_node); + ret = false; + } + + return ret; +} + +bool HashBucket_erase(struct HashBucket *bkt, unsigned long addr) +{ + struct HashNode *node; + struct HashNode *prev; + bool ret = true; + + if (bkt == NULL) + return false; + + spin_lock(&bkt->bkt_lock); + node = bkt->head; + prev = NULL; + while (node != NULL && node->addr != addr) { + prev = node; + node = node->next; + } + if (node == NULL) { + spin_unlock(&bkt->bkt_lock); + ret = false; + } else { + if (bkt->head == node) + bkt->head = node->next; + else + prev->next = node->next; + kfree(node); + spin_unlock(&bkt->bkt_lock); + ret = true; + } + + return ret; +} + +void HashBucket_clear(struct HashBucket *bkt) +{ + struct HashNode *node; + struct HashNode *prev; + + if (bkt == NULL) + return; + + spin_lock(&bkt->bkt_lock); + node = bkt->head; + prev = NULL; + bkt->head = NULL; + while (node != NULL) { + prev = node; + node = node->next; + kfree(prev); + } + spin_unlock(&bkt->bkt_lock); +} + +struct HashMap { + unsigned long size; + struct HashBucket *HashTable; +}; + +unsigned long hash_func(unsigned long addr, unsigned long size) +{ + return addr % size; +} + +struct HashMap *HashMap_create(unsigned long size) +{ + struct HashMap *hm = NULL; + struct HashBucket *ht = NULL; + int i = 0; + + hm = kmalloc(sizeof(struct HashMap), GFP_ATOMIC); + if (hm == NULL) + return NULL; + ht = kmalloc((size * sizeof(struct HashBucket)), GFP_ATOMIC); + if (ht == NULL) { + kfree(hm); + return NULL; + } + for (i = 0; i < size; i++) + HashBucket_init(&(ht[i])); + + hm->size = size; + hm->HashTable = ht; + return hm; +} + +bool HashMap_insert(struct HashMap *hm, unsigned long addr) +{ + unsigned long index; + + if (hm == NULL) + return false; + index = hash_func(addr, hm->size); + if (hm->HashTable == NULL) + return false; + return HashBucket_insert(&(hm->HashTable[index]), addr); +} + +bool HashMap_erase(struct HashMap *hm, unsigned long addr) +{ + unsigned long index; + + if (hm == NULL) + return false; + index = hash_func(addr, hm->size); + if (hm->HashTable == NULL) + return false; + return HashBucket_erase(&(hm->HashTable[index]), addr); +} + +void HashMap_clear(struct HashMap *hm) +{ + unsigned long size; + struct HashBucket *ht; + int i; + + if (hm == NULL) + return; + size = hm->size; + ht = hm->HashTable; + if (ht == NULL) + return; + hm->HashTable = NULL; + for (i = 0; i < size; i++) + HashBucket_clear(&(ht[i])); + + kfree(ht); + kfree(hm); +} + +//struct that save the information for each task +struct task_info { + int tgid; + char comm[TASK_COMM_LEN]; + int count; // number of pages + struct HashMap *pages; + struct list_head list; + spinlock_t cnt_lock; +}; + +// struct that save the information for each cgroup +struct cgroup_info { + struct cgroup *cgrp; + struct mem_cgroup *memcg; + int id; + char name[64]; + struct list_head list; + struct list_head tasks_list; + struct list_head oom_list; + rwlock_t cgrp_lock; + unsigned int cached_bytes; +}; + +static LIST_HEAD(all_cgroup_info); // a list that linked all the cgroup_info struct + +static struct task_info *create_task_info(struct task_struct *cur_task) +{ + struct task_info *tsk_info = + kmalloc(sizeof(struct task_info), GFP_ATOMIC); + if (!tsk_info) + return NULL; + + // initialization + tsk_info->tgid = cur_task->tgid; + strscpy(tsk_info->comm, cur_task->comm, sizeof(tsk_info->comm)); + tsk_info->count = 0; + tsk_info->pages = NULL; + tsk_info->pages = HashMap_create(1023); + INIT_LIST_HEAD(&tsk_info->list); + spin_lock_init(&(tsk_info->cnt_lock)); + + return tsk_info; +} + +static int +add_task_to_cgroup_info(struct cgroup_info *cgrp, struct task_info *task) +{ + if (!cgrp || !task) + return -EINVAL; + + write_lock(&cgrp->cgrp_lock); + list_add_tail(&task->list, &cgrp->tasks_list); + write_unlock(&cgrp->cgrp_lock); + return 0; +} + +static int +remove_task_from_cgroup_info(struct cgroup_info *cgrp, struct task_info *task) +{ + if (cgrp == NULL || task == NULL) + return -EINVAL; + + HashMap_clear(task->pages); + // kfree(task->pages); + kfree(task); + return 0; +} + +static struct task_info *find_task_info(struct cgroup_info *cgrp, int tgid) +{ + struct task_info *tsk_info, *pos; + + list_for_each_entry_safe(tsk_info, pos, &cgrp->tasks_list, list) { + if (tsk_info->tgid == tgid) + return tsk_info; + } + return NULL; +} + +static int +remove_page_from_cgroup_info(unsigned long addr, struct cgroup_info *cgrp) +{ + struct task_info *tsk_info, *pos; + + read_lock(&cgrp->cgrp_lock); + list_for_each_entry_safe(tsk_info, pos, &cgrp->tasks_list, list) { + if (HashMap_erase(tsk_info->pages, addr)) { + spin_lock(&(tsk_info->cnt_lock)); + tsk_info->count -= folio_nr_pages((struct folio *)addr); + spin_unlock(&(tsk_info->cnt_lock)); + read_unlock(&cgrp->cgrp_lock); + return 0; + } + } + read_unlock(&cgrp->cgrp_lock); + return -1; +} + +static struct cgroup_info *create_cgroup_info(struct cgroup *cgrp, + struct mem_cgroup *memcg) +{ + struct cgroup_info *cgrp_info = + kmalloc(sizeof(struct cgroup_info), GFP_ATOMIC); + struct kernfs_node *kn; + + if (!cgrp_info) + return NULL; + + cgrp_info->cgrp = cgrp; + cgrp_info->memcg = memcg; + cgrp_info->id = (memcg->css).id; + kn = cgrp->kn; + strscpy(cgrp_info->name, kn->name, sizeof(cgrp_info->name)); + INIT_LIST_HEAD(&cgrp_info->list); + INIT_LIST_HEAD(&cgrp_info->tasks_list); + INIT_LIST_HEAD(&cgrp_info->oom_list); + rwlock_init(&(cgrp_info->cgrp_lock)); + cgrp_info->cached_bytes = 0; + + return cgrp_info; +} + +static void destroy_cgroup_info(struct cgroup_info *cgrp_info) +{ + struct task_info *task, *tmp; + + if (!cgrp_info) + return; + + write_lock(&cgrp_info->cgrp_lock); + list_for_each_entry_safe(task, tmp, &cgrp_info->tasks_list, list) { + list_del(&task->list); + remove_task_from_cgroup_info(cgrp_info, task); + } + write_unlock(&cgrp_info->cgrp_lock); + list_for_each_entry_safe(task, tmp, &cgrp_info->oom_list, list) { + list_del(&task->list); + remove_task_from_cgroup_info(cgrp_info, task); + } + + kfree(cgrp_info); +} + +static int add_cgroup_info(struct cgroup_info *cgrp_info) +{ + if (!cgrp_info) + return -EINVAL; + + list_add_tail(&cgrp_info->list, &all_cgroup_info); + return 0; +} + +static struct cgroup_info *find_cgroup_info(int id) +{ + struct cgroup_info *cgrp_info = NULL; + + list_for_each_entry(cgrp_info, &all_cgroup_info, list) { + if (cgrp_info->id == id) + return cgrp_info; + } + + return NULL; +} + +static struct task_info *create_oom_task_info(struct task_info *tsk_info) +{ + struct task_info *oom_tsk_info = + kmalloc(sizeof(struct task_info), GFP_ATOMIC); + if (!oom_tsk_info) + return NULL; + + oom_tsk_info->tgid = tsk_info->tgid; + strscpy(oom_tsk_info->comm, tsk_info->comm, sizeof(oom_tsk_info->comm)); + oom_tsk_info->count = tsk_info->count; + oom_tsk_info->pages = NULL; + INIT_LIST_HEAD(&oom_tsk_info->list); + + return oom_tsk_info; +} + +static int +add_oom_task_to_cgroup_info(struct cgroup_info *cgrp, + struct task_info *oom_task) +{ + if (!cgrp || !oom_task) + return -EINVAL; + list_add_tail(&oom_task->list, &cgrp->oom_list); + return 0; +} diff --git a/tools/probeCgroup/run.sh b/tools/probeCgroup/run.sh new file mode 100755 index 000000000000..7e1ffefe66d1 --- /dev/null +++ b/tools/probeCgroup/run.sh @@ -0,0 +1,8 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +cd scripts +./script1.sh +./script2.sh +./script3.sh diff --git a/tools/probeCgroup/scripts/script1.sh b/tools/probeCgroup/scripts/script1.sh new file mode 100755 index 000000000000..539e8258afb9 --- /dev/null +++ b/tools/probeCgroup/scripts/script1.sh @@ -0,0 +1,10 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +cd .. +make +insmod probeCgroup.ko + +cd testcases +gcc simple-mem-allocate.c -o simple-mem-allocate diff --git a/tools/probeCgroup/scripts/script2.sh b/tools/probeCgroup/scripts/script2.sh new file mode 100755 index 000000000000..2ad515cfb912 --- /dev/null +++ b/tools/probeCgroup/scripts/script2.sh @@ -0,0 +1,14 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +current_dir=$(pwd) +cd /sys/fs/cgroup/memory +mkdir test +cd test +sh -c "echo $$ >> cgroup.procs" +sh -c "echo 5M > memory.limit_in_bytes" +sh -c "echo 0 > memory.swappiness" +cd "$current_dir" +cd ../testcases +./simple-mem-allocate diff --git a/tools/probeCgroup/scripts/script3.sh b/tools/probeCgroup/scripts/script3.sh new file mode 100755 index 000000000000..127eb45de5c9 --- /dev/null +++ b/tools/probeCgroup/scripts/script3.sh @@ -0,0 +1,11 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +cd /proc +cat cgroup_memory_usage_per_process + +cat /sys/fs/cgroup/memory/test/cgroup.procs > /sys/fs/cgroup/memory/cgroup.procs +rmdir /sys/fs/cgroup/memory/test +# cat cgroup_memory_usage_per_process +rmmod probeCgroup diff --git a/tools/probeCgroup/testcases/1_load_unload_test.py b/tools/probeCgroup/testcases/1_load_unload_test.py new file mode 100755 index 000000000000..5389a14a1dac --- /dev/null +++ b/tools/probeCgroup/testcases/1_load_unload_test.py @@ -0,0 +1,24 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +import os +import subprocess +import time + +def test_module_load_unload(): + try: + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + print('loading module successfully!') + subprocess.check_call(['rmmod', 'probeCgroup']) + output = subprocess.check_output(['lsmod']) + assert b'probeCgroup' not in output + print('unloading module successfully!') + except subprocess.CalledProcessError as e: + print('Load unload test failed. Insmod failed.') + except AssertionError as e: + print('Load unload test failed. Cannot remove module.') + +if __name__ == '__main__': + test_module_load_unload() \ No newline at end of file diff --git a/tools/probeCgroup/testcases/2_multiple_process_test.py b/tools/probeCgroup/testcases/2_multiple_process_test.py new file mode 100755 index 000000000000..d88c7f7f2952 --- /dev/null +++ b/tools/probeCgroup/testcases/2_multiple_process_test.py @@ -0,0 +1,48 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup, check_kmem_usage +import os +import subprocess +import time + +def test_multiple_process(num_procs): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroup_name = 'test' + cgroup_path = create_cgroup(cgroup_name) + + processes = [] + pids = [] + + for i in range(num_procs): + process = subprocess.Popen(['./mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + processes.append(process) + pids.append(pid) + + time.sleep(0.1) + try: + count = 0 + for i in range (2000): + count += check_memory_usage(cgroup_name, pids, False) + time.sleep(0.01) + assert count <= 50, f"Memory read by probeCgroup is not accurate" + + remove_cgroup(cgroup_path, pids) + check_memory_usage(cgroup_name, pids, True) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass multiple process test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + remove_cgroup(cgroup_path, pids) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_multiple_process(3) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/3_multiple_cgroup_test.py b/tools/probeCgroup/testcases/3_multiple_cgroup_test.py new file mode 100755 index 000000000000..592a716df877 --- /dev/null +++ b/tools/probeCgroup/testcases/3_multiple_cgroup_test.py @@ -0,0 +1,55 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup +import os +import subprocess +import time + +def test_multiple_cgroup(num_procs, num_cgroups): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroups = [] + processes = {} + pids = {} + for i in range(num_cgroups): + cgroup_name = f'test_{i}' + cgroup_path = create_cgroup(cgroup_name) + cgroups.append((cgroup_name, cgroup_path)) + + for j in range(num_procs): + process = subprocess.Popen(['./mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + if cgroup_path not in processes: + processes[cgroup_path] = [] + processes[cgroup_path].append(process) + if cgroup_path not in pids: + pids[cgroup_path] = [] + pids[cgroup_path].append(pid) + + time.sleep(0.1) + try: + for i in range (100): + for cgroup_name, cgroup_path in cgroups: + check_memory_usage(cgroup_name, pids[cgroup_path], False) + time.sleep(0.01) + + for cgroup_name, cgroup_path in cgroups: + remove_cgroup(cgroup_path, pids[cgroup_path]) + check_memory_usage(cgroup_name, pids[cgroup_path], True) + cleanup(processes[cgroup_path]) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass multiple cgroup test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + for cgroup_name, cgroup_path in cgroups: + remove_cgroup(cgroup_path, pids[cgroup_path]) + cleanup(processes[cgroup_path]) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_multiple_cgroup(2,2) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/4_oom_test.py b/tools/probeCgroup/testcases/4_oom_test.py new file mode 100755 index 000000000000..128a258c56f5 --- /dev/null +++ b/tools/probeCgroup/testcases/4_oom_test.py @@ -0,0 +1,52 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup, get_oom_process_memory_usage +import os +import subprocess +import time + +def test_oom(num_procs): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroup_name = 'test' + cgroup_path = create_cgroup(cgroup_name) + + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.limit_in_bytes", 'w') as limit_file: + limit_file.write("5M") + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.swappiness", 'w') as swap_file: + swap_file.write("0") + + processes = [] + pids = [] + for i in range(num_procs): + process = subprocess.Popen(['./simple-mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + processes.append(process) + pids.append(pid) + + time.sleep(6) + + try: + for pid in pids: + memory_usage = get_oom_process_memory_usage(pid, cgroup_name) + assert memory_usage is not None, f"Memory usage(oom) not found for PID {pid}" + assert memory_usage > 0, f"Memory usage should be greater than zero for PID {pid}" + + remove_cgroup(cgroup_path, pids) + check_memory_usage(cgroup_name, pids, True) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass oom test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + remove_cgroup(cgroup_path, pids) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_oom(1) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/5_multiple_threads_test.py b/tools/probeCgroup/testcases/5_multiple_threads_test.py new file mode 100755 index 000000000000..7e1b86dabe48 --- /dev/null +++ b/tools/probeCgroup/testcases/5_multiple_threads_test.py @@ -0,0 +1,45 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup, check_kmem_usage +import os +import subprocess +import time + +def test_multiple_thread(num_procs): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroup_name = 'test' + cgroup_path = create_cgroup(cgroup_name) + + processes = [] + pids = [] + for i in range(num_procs): + process = subprocess.Popen(['./multiple-thread-mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + processes.append(process) + pids.append(pid) + + time.sleep(1) + try: + for i in range (200): + check_memory_usage(cgroup_name, pids, False) + time.sleep(0.01) + + remove_cgroup(cgroup_path, pids) + check_memory_usage(cgroup_name, pids, True) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass multiple threads test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + remove_cgroup(cgroup_path, pids) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_multiple_thread(5) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/cgroup_utils.py b/tools/probeCgroup/testcases/cgroup_utils.py new file mode 100644 index 000000000000..e00c580e724e --- /dev/null +++ b/tools/probeCgroup/testcases/cgroup_utils.py @@ -0,0 +1,114 @@ +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +import os +import subprocess +import time + +def create_cgroup(cgroup_name): + cgroup_path = f'/sys/fs/cgroup/memory/{cgroup_name}' + + try: + os.makedirs(cgroup_path) + except FileExistsError: + pass + + return cgroup_path + +def add_process_to_cgroup(cgroup_path, pid): + with open(os.path.join(cgroup_path, 'cgroup.procs'), 'w') as procs_file: + procs_file.write(str(pid)) + +def get_process_memory_usage(pid, cgroup_name): + cur_name = '' + with open('/proc/cgroup_memory_usage_per_process', 'r') as file: + for line in file: + parts = line.strip().split() + if len(parts) >= 4 and parts[0] == 'cgroup': + cur_name = parts[3] + if len(parts) >= 3 and parts[0] != 'cgroup' and cur_name == cgroup_name and parts[0] != 'pid' and int(parts[0]) == pid: + return int(parts[2]) + return None + +def get_process_kmem_usage(pid, cgroup_name): + cur_name = '' + with open('/proc/cgroup_memory_usage_per_process', 'r') as file: + for line in file: + parts = line.strip().split() + if len(parts) >= 4 and parts[0] == 'cgroup': + cur_name = parts[3] + if len(parts) >= 4 and parts[0] != 'cgroup' and cur_name == cgroup_name and parts[0] != 'pid' and int(parts[0]) == pid: + return int(parts[3]) + return None + +def remove_cgroup(cgroup_path, pids): + for pid in pids: + with open('/sys/fs/cgroup/memory/cgroup.procs', 'w') as backup_file: + backup_file.write(str(pid)) + os.rmdir(cgroup_path) + return + +def check_memory_usage(cgroup_name, pids, delete): + memory_sum = 0 + for pid in pids: + memory_usage = get_process_memory_usage(pid, cgroup_name) + if delete == False: + assert memory_usage is not None, f"Memory usage not found for PID {pid}" + assert memory_usage >= 0, f"Memory usage should be greater than zero for PID {pid}" + memory_sum += memory_usage + else: + assert memory_usage is None, f"Error: Memory usage should not be available for PID {pid} after deleting the cgroup." + if delete == False: + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.usage_in_bytes", 'r') as file: + content = file.readline().strip() + memory_read = int(content) + memory_sum *= 1024 + delta = abs(memory_read - memory_sum) + # print(f"read: {memory_read}") + # print(f"sum : {memory_sum}") + if (delta > max(memory_read, memory_sum) * 0.1): + return 1 + else: + return 0 + else: + return 0 + +def check_kmem_usage(cgroup_name, pids, delete): + kmem_sum = 0 + for pid in pids: + kmem_usage = get_process_kmem_usage(pid, cgroup_name) + if delete == False: + assert kmem_usage is not None, f"Kmem usage not found for PID {pid}" + assert kmem_usage >= 0, f"Kmem usage should be greater than zero for PID {pid}" + kmem_sum += kmem_usage + else: + assert kmem_usage is None, f"Error: Kmem usage should not be available for PID {pid} after deleting the cgroup." + if delete == False: + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.kmem.usage_in_bytes", 'r') as file: + content = file.readline().strip() + kmem_read = int(content) + kmem_sum *= 1024 + delta = abs(kmem_read - kmem_sum) + # print(f"kmem read: {kmem_read}") + # print(f"kmem sum : {kmem_sum}") + # assert delta <= max(kmem_read, kmem_sum) * 0.2, f"Kmem read by probeCgroup is not accurate, {kmem_read}, {kmem_sum}" + +def cleanup(processes): + for process in processes: + process.terminate() + process.wait() + +def get_oom_process_memory_usage(pid, cgroup_name): + cur_name = '' + oom = False + with open('/proc/cgroup_memory_usage_per_process', 'r') as file: + for line in file: + parts = line.strip().split() + if len(parts) >= 4 and parts[0] == 'cgroup': + cur_name = parts[3] + oom = False + if len(parts) >= 1 and parts[0] == 'oom:': + oom = True + if len(parts) >= 3 and parts[0] != 'cgroup' and cur_name == cgroup_name and parts[0] != 'pid' and int(parts[0]) == pid and oom == True: + return int(parts[2]) + return None \ No newline at end of file diff --git a/tools/probeCgroup/testcases/mem-allocate.c b/tools/probeCgroup/testcases/mem-allocate.c new file mode 100644 index 000000000000..e78e37cae61b --- /dev/null +++ b/tools/probeCgroup/testcases/mem-allocate.c @@ -0,0 +1,35 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * mem-allocate.c - The program to test probeCgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> + +#define MB (1024 * 1024) + +char *arr[40]; + +int main(int argc, char *argv[]) +{ + char *p; + int i = 0; + + while (1) { + for (i = 0; i < 40; i++) { + p = (char *)malloc(MB); + memset(p, 0, MB); + arr[i] = p; + usleep(100000); + } + for (int i = 0; i < 40; i++) { + free(arr[i]); + usleep(100000); + } + } + return 0; +} diff --git a/tools/probeCgroup/testcases/multiple-thread-mem-allocate.c b/tools/probeCgroup/testcases/multiple-thread-mem-allocate.c new file mode 100644 index 000000000000..55f4c068f55e --- /dev/null +++ b/tools/probeCgroup/testcases/multiple-thread-mem-allocate.c @@ -0,0 +1,60 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * multiple-thread-mem-allocate.c - The program to test probeCgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> +#include <pthread.h> + +#define MB (1024 * 1024) + +void *memory_test(void *) +{ + char *arr[25]; + char *p; + int i = 0; + int cnt = 0; + + while (1) { + for (i = 0; i < 20; i++) { + p = (char *)malloc(MB); + memset(p, 0, MB); + arr[i] = p; + usleep(10000); + } + for (int i = 0; i < 20; i++) { + free(arr[i]); + usleep(10000); + } + } +} + +int main(int argc, char *argv[]) +{ + pthread_t threads[4]; + int rc; + + // create threads + for (int i = 0; i < 4; i++) { + rc = pthread_create(&threads[i], NULL, memory_test, NULL); + if (rc != 0) { + fprintf(stderr, "Error creating thread: %d\n", rc); + return 1; + } + } + + for (int i = 0; i < 4; i++) { + rc = pthread_join(threads[i], NULL); + if (rc != 0) { + fprintf(stderr, "Error joining thread: %d\n", rc); + return 1; + } + } + + return 0; +} diff --git a/tools/probeCgroup/testcases/run.py b/tools/probeCgroup/testcases/run.py new file mode 100755 index 000000000000..8ffd0ca720d8 --- /dev/null +++ b/tools/probeCgroup/testcases/run.py @@ -0,0 +1,32 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +import os +import subprocess +import sys + +def run_tests(directory): + """Run all Python scripts in the given directory.""" + python_files = [f for f in os.listdir(directory) if f.endswith('test.py')] + python_files.sort() + + for filename in python_files: + try: + filepath = os.path.join(directory, filename) + + subprocess.check_call([sys.executable, filepath]) + except subprocess.CalledProcessError as e: + print(f"Error executing {filename}:") + return + except Exception as e: + print(f"Error executing {filename}:") + print(e) + return + +if __name__ == '__main__': + tests_directory = '.' + subprocess.check_call(['gcc', 'mem-allocate.c', '-o', 'mem-allocate']) + subprocess.check_call(['gcc', 'simple-mem-allocate.c', '-o', 'simple-mem-allocate']) + subprocess.check_call(['gcc', 'multiple-thread-mem-allocate.c', '-o', 'multiple-thread-mem-allocate']) + run_tests(tests_directory) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/simple-mem-allocate.c b/tools/probeCgroup/testcases/simple-mem-allocate.c new file mode 100644 index 000000000000..16328b10ba48 --- /dev/null +++ b/tools/probeCgroup/testcases/simple-mem-allocate.c @@ -0,0 +1,27 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * mem-allocate.c - The program to test probeCgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> + +#define MB (1024 * 1024) + +int main(int argc, char *argv[]) +{ + char *p; + int i = 0; + + while (1) { + p = (char *)malloc(MB); + memset(p, 0, MB); + sleep(1); + } + + return 0; +} -- 2.43.0

2 1

[PATCH OLK-5.10 v2] drm/amd/display: Fix null pointer deref in dcn20_resource.c
by Xiaomeng Zhang 06 Sep '24

06 Sep '24

From: Aurabindo Pillai <aurabindo.pillai(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit ecbf60782662f0a388493685b85a645a0ba1613c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMUG CVE: CVE-2024-43899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes a hang thats triggered when MPV is run on a DCN401 dGPU: mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all and then enabling fullscreen playback (double click on the video) The following calltrace will be seen: [ 181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 181.843997] #PF: supervisor instruction fetch in kernel mode [ 181.844003] #PF: error_code(0x0010) - not-present page [ 181.844009] PGD 0 P4D 0 [ 181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI [ 181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018 [ 181.844044] RIP: 0010:0x0 [ 181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246 [ 181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 [ 181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400 [ 181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c [ 181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8 [ 181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005 [ 181.844121] FS: 00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000 [ 181.844128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0 [ 181.844141] Call Trace: [ 181.844146] <TASK> [ 181.844153] ? show_regs+0x6d/0x80 [ 181.844167] ? __die+0x24/0x80 [ 181.844179] ? page_fault_oops+0x99/0x1b0 [ 181.844192] ? do_user_addr_fault+0x31d/0x6b0 [ 181.844204] ? exc_page_fault+0x83/0x1b0 [ 181.844216] ? asm_exc_page_fault+0x27/0x30 [ 181.844237] dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu] [ 181.845115] amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu] [ 181.845985] amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu] [ 181.846848] fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu] [ 181.847734] fill_dc_plane_attributes+0x162/0x350 [amdgpu] [ 181.848748] dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.849791] ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.850840] amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu] Signed-off-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c [The conflicts were due to file path changed] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c index d587f807dfd7..94bf438c7310 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c @@ -2178,10 +2178,11 @@ bool dcn20_get_dcc_compression_cap(const struct dc *dc, const struct dc_dcc_surface_param *input, struct dc_surface_dcc_cap *output) { - return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( - dc->res_pool->hubbub, - input, - output); + if (dc->res_pool->hubbub->funcs->get_dcc_compression_cap) + return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( + dc->res_pool->hubbub, input, output); + + return false; } static void dcn20_destroy_resource_pool(struct resource_pool **pool) -- 2.34.1

2 1

[PATCH OLK-5.10 v2] drm/amd/display: Fix null pointer deref in dcn20_resource.c
by Xiaomeng Zhang 06 Sep '24

06 Sep '24

From: Aurabindo Pillai <aurabindo.pillai(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit ecbf60782662f0a388493685b85a645a0ba1613c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMUG CVE: CVE-2024-43899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes a hang thats triggered when MPV is run on a DCN401 dGPU: mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all and then enabling fullscreen playback (double click on the video) The following calltrace will be seen: [ 181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 181.843997] #PF: supervisor instruction fetch in kernel mode [ 181.844003] #PF: error_code(0x0010) - not-present page [ 181.844009] PGD 0 P4D 0 [ 181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI [ 181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018 [ 181.844044] RIP: 0010:0x0 [ 181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246 [ 181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 [ 181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400 [ 181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c [ 181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8 [ 181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005 [ 181.844121] FS: 00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000 [ 181.844128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0 [ 181.844141] Call Trace: [ 181.844146] <TASK> [ 181.844153] ? show_regs+0x6d/0x80 [ 181.844167] ? __die+0x24/0x80 [ 181.844179] ? page_fault_oops+0x99/0x1b0 [ 181.844192] ? do_user_addr_fault+0x31d/0x6b0 [ 181.844204] ? exc_page_fault+0x83/0x1b0 [ 181.844216] ? asm_exc_page_fault+0x27/0x30 [ 181.844237] dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu] [ 181.845115] amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu] [ 181.845985] amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu] [ 181.846848] fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu] [ 181.847734] fill_dc_plane_attributes+0x162/0x350 [amdgpu] [ 181.848748] dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.849791] ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.850840] amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu] Signed-off-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c [The conflicts were due to file path changed] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c index 53ac82693532..2990793e86a2 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c @@ -3290,10 +3290,11 @@ bool dcn20_get_dcc_compression_cap(const struct dc *dc, const struct dc_dcc_surface_param *input, struct dc_surface_dcc_cap *output) { - return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( - dc->res_pool->hubbub, - input, - output); + if (dc->res_pool->hubbub->funcs->get_dcc_compression_cap) + return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( + dc->res_pool->hubbub, input, output); + + return false; } static void dcn20_destroy_resource_pool(struct resource_pool **pool) -- 2.34.1

2 1

[PATCH OLK-5.10] cifs: Fix pages leak when cifs_writedata allocate fails in cifs_writedata_direct_alloc()
by Zizhi Wo 05 Sep '24

05 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAOH1I -------------------------------- The function cifs_writedata_alloc() first allocates pages and then executes cifs_writedata_direct_alloc(). If the subsequent allocation of wdata fails, the previously allocated pages are not released, leading to a memory leak: [root@fedora debug]# cat kmemleak unreferenced object 0xff110001287aa000 (size 8192): comm "kworker/u220:9", pid 1604, jiffies 4294753971 (age 19.114s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000c80fa56d>] kmemleak_alloc+0x65/0xd0 [<0000000032ff36c6>] __kmalloc+0x641/0xa50 [<00000000da9a4c31>] cifs_writedata_alloc+0x1d/0x30 [<00000000337073aa>] cifs_writepages+0x3e0/0x1990 [<0000000095bfb1fd>] do_writepages+0x31/0xb0 [<00000000321368a2>] __writeback_single_inode+0x4f/0x550 [<00000000f200b315>] writeback_sb_inodes+0x24a/0x7a0 [<00000000badd6d82>] __writeback_inodes_wb+0x88/0x120 [<000000000632fc4a>] wb_writeback+0x3aa/0x4c0 [<00000000c184a6e4>] wb_workfn+0x507/0x770 [<000000005d8f6f94>] process_one_work+0x226/0x540 [<000000000c3dd58a>] worker_thread+0x1b3/0x680 [<00000000457537ac>] kthread+0x159/0x1c0 [<000000000ef58c85>] ret_from_fork+0x1f/0x30 This issue can be avoided by promptly using kvfree. Fixes: 8e7360f67e75 ("CIFS: Add support for direct pages in wdata") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/cifssmb.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c index 95992c93bbe3..1a6c9ac25615 100644 --- a/fs/cifs/cifssmb.c +++ b/fs/cifs/cifssmb.c @@ -2119,12 +2119,17 @@ cifs_writev_complete(struct work_struct *work) struct cifs_writedata * cifs_writedata_alloc(unsigned int nr_pages, work_func_t complete) { + struct cifs_writedata *wdata = NULL; + struct page **pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS); - if (pages) - return cifs_writedata_direct_alloc(pages, complete); + if (pages) { + wdata = cifs_writedata_direct_alloc(pages, complete); + if (!wdata) + kvfree(pages); + } - return NULL; + return wdata; } struct cifs_writedata * -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS V3] cifs: Fix pages leak when cifs_writedata allocate fails in cifs_writedata_direct_alloc()
by Zizhi Wo 05 Sep '24

05 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAOH1I -------------------------------- The function cifs_writedata_alloc() first allocates pages and then executes cifs_writedata_direct_alloc(). If the subsequent allocation of wdata fails, the previously allocated pages are not released, leading to a memory leak: [root@fedora debug]# cat kmemleak unreferenced object 0xff110001287aa000 (size 8192): comm "kworker/u220:9", pid 1604, jiffies 4294753971 (age 19.114s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000c80fa56d>] kmemleak_alloc+0x65/0xd0 [<0000000032ff36c6>] __kmalloc+0x641/0xa50 [<00000000da9a4c31>] cifs_writedata_alloc+0x1d/0x30 [<00000000337073aa>] cifs_writepages+0x3e0/0x1990 [<0000000095bfb1fd>] do_writepages+0x31/0xb0 [<00000000321368a2>] __writeback_single_inode+0x4f/0x550 [<00000000f200b315>] writeback_sb_inodes+0x24a/0x7a0 [<00000000badd6d82>] __writeback_inodes_wb+0x88/0x120 [<000000000632fc4a>] wb_writeback+0x3aa/0x4c0 [<00000000c184a6e4>] wb_workfn+0x507/0x770 [<000000005d8f6f94>] process_one_work+0x226/0x540 [<000000000c3dd58a>] worker_thread+0x1b3/0x680 [<00000000457537ac>] kthread+0x159/0x1c0 [<000000000ef58c85>] ret_from_fork+0x1f/0x30 This issue can be avoided by promptly using kvfree. Fixes: 8e7360f67e75 ("CIFS: Add support for direct pages in wdata") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/cifssmb.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c index cb70f0c6aa1b..15b039820a26 100644 --- a/fs/cifs/cifssmb.c +++ b/fs/cifs/cifssmb.c @@ -2109,12 +2109,17 @@ cifs_writev_complete(struct work_struct *work) struct cifs_writedata * cifs_writedata_alloc(unsigned int nr_pages, work_func_t complete) { + struct cifs_writedata *wdata = NULL; + struct page **pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS); - if (pages) - return cifs_writedata_direct_alloc(pages, complete); + if (pages) { + wdata = cifs_writedata_direct_alloc(pages, complete); + if (!wdata) + kvfree(pages); + } - return NULL; + return wdata; } struct cifs_writedata * -- 2.39.2

2 1

[PATCH OLK-6.6] ext4: Track data blocks freeing operation in journal
by Zhihao Cheng 05 Sep '24

05 Sep '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9DN5Z -------------------------------- Since commit 7f6416dcd4a3f ("ext4: implement writeback iomap path"), the order mode is removed in iomap framework, which lets ext4_mb_clear_bb() free data blocks immediately. It may cause stale data read from truncated file in power-cut case. Following is details: P1 P2 vfs_truncate(file A) ext4_setattr EXT4_I(inode)->i_disksize = attr->ia_size // record in journal ext4_truncate ext4_mb_clear_bb mb_free_blocks // free block i vfs_write(file B) // get block i and writeback >> powercut << In the next mount, inode size and extent tree is stale(before truncated), the content in block i is file B. Fix the problem by tracking free data blocks in journal for iomap/non-writeback case. Fixes: 7f6416dcd4a3 ("ext4: implement writeback iomap path") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/ext4/ext4_jbd2.c | 9 ++------- fs/ext4/ext4_jbd2.h | 7 +++++++ 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c index 94c8073b49e7..cac0eb5068d3 100644 --- a/fs/ext4/ext4_jbd2.c +++ b/fs/ext4/ext4_jbd2.c @@ -11,18 +11,13 @@ int ext4_inode_journal_mode(struct inode *inode) { if (EXT4_JOURNAL(inode) == NULL) return EXT4_INODE_WRITEBACK_DATA_MODE; /* writeback */ - /* - * Ordered mode is no longer needed for the inode that use the - * iomap path, always use writeback mode. - */ - if (ext4_test_inode_state(inode, EXT4_STATE_BUFFERED_IOMAP)) - return EXT4_INODE_WRITEBACK_DATA_MODE; /* writeback */ /* We do not support data journalling with delayed allocation */ if (!S_ISREG(inode->i_mode) || ext4_test_inode_flag(inode, EXT4_INODE_EA_INODE) || test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA || (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA) && - !test_opt(inode->i_sb, DELALLOC))) { + !test_opt(inode->i_sb, DELALLOC) && + !ext4_test_inode_state(inode, EXT4_STATE_BUFFERED_IOMAP))) { /* We do not support data journalling for encrypted data */ if (S_ISREG(inode->i_mode) && IS_ENCRYPTED(inode)) return EXT4_INODE_ORDERED_DATA_MODE; /* ordered */ diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h index 0c77697d5e90..c52d1caf6622 100644 --- a/fs/ext4/ext4_jbd2.h +++ b/fs/ext4/ext4_jbd2.h @@ -467,6 +467,13 @@ static inline int ext4_should_journal_data(struct inode *inode) static inline int ext4_should_order_data(struct inode *inode) { + /* + * Ordered mode is no longer needed for the inode that use the + * iomap path, always use writeback mode. + */ + if (ext4_test_inode_state(inode, EXT4_STATE_BUFFERED_IOMAP)) + return 0; /* writeback */ + return ext4_inode_journal_mode(inode) & EXT4_INODE_ORDERED_DATA_MODE; } -- 2.31.1

2 1

[openeuler:OLK-6.6 13795/13866] mm/shmem.c:1641:57: error: call to '__compiletime_assert_745' declared with 'error' attribute: BUILD_BUG failed
by kernel test robot 05 Sep '24

05 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 552667f6edabe9e4bc2c86f990f53749bebfcbed commit: c7fcbe1041758d0dedc32502609a73a22884d7b8 [13795/13866] mm: shmem: Merge shmem_alloc_hugefolio() with shmem_alloc_folio() config: x86_64-randconfig-014-20240905 (https://download.01.org/0day-ci/archive/20240905/202409051939.TTEs2Xg7-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240905/202409051939.TTEs2Xg7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409051939.TTEs2Xg7-lkp@intel.com/ All errors (new ones prefixed by >>): mm/shmem.c:1660:6: warning: variable 'folio' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] 1660 | if (!shmem_prepare_alloc(&gfp)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ mm/shmem.c:1688:7: note: uninitialized use occurs here 1688 | if (!folio) | ^~~~~ mm/shmem.c:1660:2: note: remove the 'if' if its condition is always false 1660 | if (!shmem_prepare_alloc(&gfp)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1661 | goto no_mem; | ~~~~~~~~~~~ mm/shmem.c:1653:21: note: initialize the variable 'folio' to silence this warning 1653 | struct folio *folio; | ^ | = NULL >> mm/shmem.c:1641:57: error: call to '__compiletime_assert_745' declared with 'error' attribute: BUILD_BUG failed 1641 | folio = vma_alloc_folio(gfp, order, &pvma, 0, order == HPAGE_PMD_ORDER); | ^ include/linux/huge_mm.h:110:26: note: expanded from macro 'HPAGE_PMD_ORDER' 110 | #define HPAGE_PMD_ORDER (HPAGE_PMD_SHIFT-PAGE_SHIFT) | ^ include/linux/huge_mm.h:106:28: note: expanded from macro 'HPAGE_PMD_SHIFT' 106 | #define HPAGE_PMD_SHIFT ({ BUILD_BUG(); 0; }) | ^ include/linux/build_bug.h:59:21: note: expanded from macro 'BUILD_BUG' 59 | #define BUILD_BUG() BUILD_BUG_ON_MSG(1, "BUILD_BUG failed") | ^ note: (skipping 2 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/compiler_types.h:439:2: note: expanded from macro '_compiletime_assert' 439 | __compiletime_assert(condition, msg, prefix, suffix) | ^ include/linux/compiler_types.h:432:4: note: expanded from macro '__compiletime_assert' 432 | prefix ## suffix(); \ | ^ <scratch space>:61:1: note: expanded from here 61 | __compiletime_assert_745 | ^ >> mm/shmem.c:1641:57: error: call to '__compiletime_assert_745' declared with 'error' attribute: BUILD_BUG failed include/linux/huge_mm.h:110:26: note: expanded from macro 'HPAGE_PMD_ORDER' 110 | #define HPAGE_PMD_ORDER (HPAGE_PMD_SHIFT-PAGE_SHIFT) | ^ include/linux/huge_mm.h:106:28: note: expanded from macro 'HPAGE_PMD_SHIFT' 106 | #define HPAGE_PMD_SHIFT ({ BUILD_BUG(); 0; }) | ^ include/linux/build_bug.h:59:21: note: expanded from macro 'BUILD_BUG' 59 | #define BUILD_BUG() BUILD_BUG_ON_MSG(1, "BUILD_BUG failed") | ^ note: (skipping 2 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/compiler_types.h:439:2: note: expanded from macro '_compiletime_assert' 439 | __compiletime_assert(condition, msg, prefix, suffix) | ^ include/linux/compiler_types.h:432:4: note: expanded from macro '__compiletime_assert' 432 | prefix ## suffix(); \ | ^ <scratch space>:61:1: note: expanded from here 61 | __compiletime_assert_745 | ^ 1 warning and 2 errors generated. vim +1641 mm/shmem.c 1633 1634 static struct folio *shmem_alloc_folio(gfp_t gfp, int order, 1635 struct shmem_inode_info *info, pgoff_t index) 1636 { 1637 struct vm_area_struct pvma; 1638 struct folio *folio; 1639 1640 shmem_pseudo_vma_init(&pvma, info, index); > 1641 folio = vma_alloc_folio(gfp, order, &pvma, 0, order == HPAGE_PMD_ORDER); 1642 shmem_pseudo_vma_destroy(&pvma); 1643 1644 return folio; 1645 } 1646 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-23.09] tools: Add dynamic process-level cgroup memory monitoring tool
by Taoxy2004 05 Sep '24

05 Sep '24

community inclusion category: feature bugzilla: https://gitee.com/openeuler/open-source-summer/issues/I9JQ4D ---------------------------------------------------------------------- This patch introduces a new tool called "probeCgroup" that enables dynamic monitoring of memory usage at the process level within cgroups. By using kprobes at relevant cgroup functions, this tool can track memory allocations and deallocations for individual processes within a cgroup, providing detailed statistics on memory usage. The key features of the tool include: 1. Dynamic insertion of kprobes at critical points in the cgroup subsystem. 2. Tracking memory allocation and deallocation events for each process by recording page addresses in a hash table. 3. Providing real-time statistics on memory usage at the process level. 4. Providing statistics on memory usage for processes that are OOM. Signed-off-by: Taoxy2004 <221870066(a)smail.nju.edu.cn> --- tools/probeCgroup/Makefile | 7 + tools/probeCgroup/README.md | 29 + tools/probeCgroup/probeCgroup.c | 612 ++++++++++++++++++ tools/probeCgroup/probeCgroup.h | 415 ++++++++++++ tools/probeCgroup/run.sh | 8 + tools/probeCgroup/scripts/script1.sh | 10 + tools/probeCgroup/scripts/script2.sh | 14 + tools/probeCgroup/scripts/script3.sh | 11 + .../testcases/1_load_unload_test.py | 24 + .../testcases/2_multiple_process_test.py | 48 ++ .../testcases/3_multiple_cgroup_test.py | 55 ++ tools/probeCgroup/testcases/4_oom_test.py | 52 ++ .../testcases/5_multiple_threads_test.py | 45 ++ tools/probeCgroup/testcases/cgroup_utils.py | 114 ++++ tools/probeCgroup/testcases/mem-allocate.c | 35 + .../testcases/multiple-thread-mem-allocate.c | 60 ++ tools/probeCgroup/testcases/run.py | 32 + .../testcases/simple-mem-allocate.c | 27 + 18 files changed, 1598 insertions(+) create mode 100644 tools/probeCgroup/Makefile create mode 100644 tools/probeCgroup/README.md create mode 100644 tools/probeCgroup/probeCgroup.c create mode 100644 tools/probeCgroup/probeCgroup.h create mode 100755 tools/probeCgroup/run.sh create mode 100755 tools/probeCgroup/scripts/script1.sh create mode 100755 tools/probeCgroup/scripts/script2.sh create mode 100755 tools/probeCgroup/scripts/script3.sh create mode 100755 tools/probeCgroup/testcases/1_load_unload_test.py create mode 100755 tools/probeCgroup/testcases/2_multiple_process_test.py create mode 100755 tools/probeCgroup/testcases/3_multiple_cgroup_test.py create mode 100755 tools/probeCgroup/testcases/4_oom_test.py create mode 100755 tools/probeCgroup/testcases/5_multiple_threads_test.py create mode 100644 tools/probeCgroup/testcases/cgroup_utils.py create mode 100644 tools/probeCgroup/testcases/mem-allocate.c create mode 100644 tools/probeCgroup/testcases/multiple-thread-mem-allocate.c create mode 100755 tools/probeCgroup/testcases/run.py create mode 100644 tools/probeCgroup/testcases/simple-mem-allocate.c diff --git a/tools/probeCgroup/Makefile b/tools/probeCgroup/Makefile new file mode 100644 index 000000000000..606c951e5487 --- /dev/null +++ b/tools/probeCgroup/Makefile @@ -0,0 +1,7 @@ +obj-m := probeCgroup.o +CROSS_COMPILE = '' +KDIR := /lib/modules/$(shell uname -r)/build +all: + make -C $(KDIR) M=$(PWD) modules +clean: + rm -f *.ko *.o *.mod *.mod.o *.mod.c .*.cmd *.symvers module* diff --git a/tools/probeCgroup/README.md b/tools/probeCgroup/README.md new file mode 100644 index 000000000000..ff0b6fc21228 --- /dev/null +++ b/tools/probeCgroup/README.md @@ -0,0 +1,29 @@ +# probeCgroup + +#### Description +probeCgroup is a process-level cgroup memory monitoring tool based on dynamic tracing (kprobe/kretprobe) technology. By inserting kprobes and kretprobes at the entry and exit points of relevant cgroup functions, this tool can track the memory usage of individual processes within each cgroup in real time. + +#### Software Architecture +1. Dynamic Tracing : Insert kprobes and kretprobes at critical points in cgroup functions to capture memory allocation and release events. +2. Hash Table Recording : Record the addresses of pages currently used by each process in a hash table, so that when a page is released, the process it belongs to can be identified. +3. Real-Time Statistics : Provide real-time statistics showing the memory usage of individual processes within each cgroup. + +#### Instruction +1. Compile and Load the Module + a. In the 'probeCgroup' directory, run the 'make' command to compile the module. + b. Load the module: 'insmod probeCgroup.ko'. + c. View memory statistics: 'cat /proc/cgroup_memory_usage_per_process'. + If an OOM (Out of Memory) event occurs in a cgroup, you can see "oom:" followed by the process that experienced the OOM and its memory usage at the time. + +2. Automate OOM Scenario + In the 'probeCgroup' directory, run './run.sh'. This script will automatically set up an OOM scenario and output the content of '/proc/cgroup_memory_usage_per_process' after execution. + +3. Perform More Tests + a. After compiling the module, in the 'testcases' directory, run './run.py'. + b. This script will perform various tests, including: + - Loading and unloading the module + - Each cgroup containing multiple processes + - Creating multiple cgroups + - OOM scenarios + - Multithreading + c. The tests will take approximately one minute to complete. diff --git a/tools/probeCgroup/probeCgroup.c b/tools/probeCgroup/probeCgroup.c new file mode 100644 index 000000000000..9883cb1e082d --- /dev/null +++ b/tools/probeCgroup/probeCgroup.c @@ -0,0 +1,612 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * probeCgroup.c - A tool used to get memory usage for each process in a cgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include "probeCgroup.h" + +// kretprobe at mem_cgroup_charge +struct charge_data { + struct cgroup *cgrp; + struct mem_cgroup *memcg; + struct task_struct *task; + unsigned long addr; +}; + +static int mem_cgroup_charge_entry_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct charge_data *data; + struct folio *page; + struct mm_struct *mm; + struct mem_cgroup *memcg; + struct cgroup_subsys_state css; + struct cgroup *cgrp; + + if (!current->mm) + return 1; + page = (struct folio *)regs->di; + mm = (struct mm_struct *)regs->si; + if (mm == NULL || page == NULL) + return -1; + memcg = get_mem_cgroup_from_mm(mm); + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + + data = (struct charge_data *)ri->data; + data->memcg = memcg; + data->addr = (unsigned long)page; + data->task = current; + data->cgrp = cgrp; + } + return 0; +} + +NOKPROBE_SYMBOL(mem_cgroup_charge_entry_handler); + +static int mem_cgroup_charge_ret_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + unsigned long retval = regs_return_value(regs); + struct charge_data *data = (struct charge_data *)ri->data; + int id; + struct cgroup_info *cgrp_info; + struct task_info *tsk_info; + + if (data->memcg != NULL && retval == 0) { + id = ((data->memcg)->css).id; + + spin_lock(&lock); + cgrp_info = find_cgroup_info(id); + if (cgrp_info == NULL) { + cgrp_info = create_cgroup_info(data->cgrp, data->memcg); + if (cgrp_info == NULL) { + spin_unlock(&lock); + return -1; + } + add_cgroup_info(cgrp_info); + } + spin_unlock(&lock); + + read_lock(&cgrp_info->cgrp_lock); + tsk_info = find_task_info(cgrp_info, data->task->tgid); + read_unlock(&cgrp_info->cgrp_lock); + + // for some cases, task->comm changes over time + if (tsk_info != NULL + && strcmp(data->task->comm, tsk_info->comm) != 0) { + strscpy(tsk_info->comm, data->task->comm, + sizeof(tsk_info->comm)); + } + + if (tsk_info == NULL) { + tsk_info = create_task_info(data->task); + if (tsk_info == NULL) + return -1; + add_task_to_cgroup_info(cgrp_info, tsk_info); + } + + if (HashMap_insert(tsk_info->pages, data->addr)) { + //update counter + spin_lock(&(tsk_info->cnt_lock)); + tsk_info->count += + folio_nr_pages((struct folio *)data->addr); + spin_unlock(&(tsk_info->cnt_lock)); + } + } + + return 0; + +} + +NOKPROBE_SYMBOL(mem_cgroup_charge_ret_handler); + +static struct kretprobe mem_cgroup_charge_kretprobe = { + .handler = mem_cgroup_charge_ret_handler, + .entry_handler = mem_cgroup_charge_entry_handler, + .data_size = sizeof(struct charge_data), + .maxactive = 20, +}; + +static int mem_cgroup_charge_kretprobe_init(void) +{ + int ret; + + mem_cgroup_charge_kretprobe.kp.symbol_name = "__mem_cgroup_charge"; + ret = register_kretprobe(&mem_cgroup_charge_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); + return ret; + } + pr_info("Planted return probe at %s: %p\n", + mem_cgroup_charge_kretprobe.kp.symbol_name, + mem_cgroup_charge_kretprobe.kp.addr); + return 0; +} + +static void mem_cgroup_charge_kretprobe_exit(void) +{ + unregister_kretprobe(&mem_cgroup_charge_kretprobe); + pr_info("kretprobe at %p unregistered\n", + mem_cgroup_charge_kretprobe.kp.addr); + + /* nmissed > 0 suggests that maxactive was set too low. */ + pr_info("Missed probing %d instances of %s\n", + mem_cgroup_charge_kretprobe.nmissed, + mem_cgroup_charge_kretprobe.kp.symbol_name); +} + +// kretprobe at uncharge_folio + +struct uncharge_data { + struct cgroup *cgrp; + struct mem_cgroup *memcg; + unsigned long addr; + bool isKmem; + int nr_pages; +}; + +static int uncharge_folio_entry_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct uncharge_data *data; + struct folio *page; + struct mem_cgroup *memcg = NULL; + struct cgroup_subsys_state css; + struct cgroup *cgrp; + struct obj_cgroup *objcg; + int nr_pages = 0; + + data = (struct uncharge_data *)ri->data; + page = (struct folio *)regs->di; + if (page == NULL) { + data->memcg = NULL; + return -1; + } + if (page->memcg_data & MEMCG_DATA_KMEM) { // if the page belongs to kmem + if (!folio_test_large(page)) + nr_pages = 1; + else + nr_pages = page->_folio_nr_pages; + // nr_pages = thp_nr_pages(page); + objcg = __folio_objcg(page); + if (objcg != NULL) + memcg = objcg->memcg; + data->isKmem = true; + data->nr_pages = nr_pages; + } else { + memcg = __folio_memcg(page); + data->isKmem = false; + } + + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + + data->memcg = memcg; + data->addr = (unsigned long)page; + data->cgrp = cgrp; + } + return 0; +} + +NOKPROBE_SYMBOL(uncharge_folio_entry_handler); + +static int uncharge_folio_ret_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct uncharge_data *data = (struct uncharge_data *)ri->data; + int id; + struct cgroup_info *cgrp_info; + int ret = -1; + + if (data->memcg != NULL) { + id = ((data->memcg)->css).id; + cgrp_info = find_cgroup_info(id); + if (cgrp_info == NULL) + return -1; + if (data->isKmem) + ret = -1; + else + ret = remove_page_from_cgroup_info(data->addr, cgrp_info); + } + + return ret; +} + +NOKPROBE_SYMBOL(uncharge_folio_ret_handler); + +static struct kretprobe uncharge_folio_kretprobe = { + .handler = uncharge_folio_ret_handler, + .entry_handler = uncharge_folio_entry_handler, + .data_size = sizeof(struct uncharge_data), + .maxactive = 20, +}; + +static int uncharge_folio_kretprobe_init(void) +{ + int ret; + + uncharge_folio_kretprobe.kp.symbol_name = "uncharge_folio"; + ret = register_kretprobe(&uncharge_folio_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); + return ret; + } + pr_info("Planted return probe at %s: %p\n", + uncharge_folio_kretprobe.kp.symbol_name, + uncharge_folio_kretprobe.kp.addr); + return 0; +} + +static void uncharge_folio_kretprobe_exit(void) +{ + unregister_kretprobe(&uncharge_folio_kretprobe); + pr_info("kretprobe at %p unregistered\n", + uncharge_folio_kretprobe.kp.addr); + + /* nmissed > 0 suggests that maxactive was set too low. */ + pr_info("Missed probing %d instances of %s\n", + uncharge_folio_kretprobe.nmissed, + uncharge_folio_kretprobe.kp.symbol_name); +} + +//kprobe at do_exit +static struct kprobe do_exit_kprobe; +static int do_exit_kprobe_pre_handler(struct kprobe *p, struct pt_regs *regs) +{ + struct task_struct *cur = current; + int tgid = cur->tgid; + struct mm_struct *mm = cur->mm; + struct mem_cgroup *memcg = get_mem_cgroup_from_mm(mm); + struct cgroup_subsys_state css; + struct cgroup *cgrp; + struct cgroup_info *cgrp_info; + struct task_info *tsk_info; + int id; + + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + id = (memcg->css).id; + cgrp_info = find_cgroup_info(id); + if (cgrp_info != NULL) { + write_lock(&cgrp_info->cgrp_lock); + tsk_info = find_task_info(cgrp_info, tgid); + if (tsk_info != NULL) { + list_del(&tsk_info->list); + write_unlock(&cgrp_info->cgrp_lock); + remove_task_from_cgroup_info(cgrp_info, + tsk_info); + } else { + write_unlock(&cgrp_info->cgrp_lock); + } + return 0; + } + } + return 0; +} + +static void do_exit_kprobe_post_handler(struct kprobe *p, + struct pt_regs *regs, + unsigned long flags) +{ + +} + +static int do_exit_kprobe_init(void) +{ + do_exit_kprobe.pre_handler = do_exit_kprobe_pre_handler; + do_exit_kprobe.post_handler = do_exit_kprobe_post_handler; + do_exit_kprobe.symbol_name = "do_exit"; + if (register_kprobe(&do_exit_kprobe)) { + pr_alert("register_kprobe on do_exit failed!\n"); + return -EINVAL; + } + return 0; +} + +static void do_exit_kprobe_exit(void) +{ + unregister_kprobe(&do_exit_kprobe); +} + +//kprobe at mark_oom_victim +static struct kprobe mark_oom_victim_kprobe; + +static int mark_oom_victim_kprobe_pre_handler(struct kprobe *p, + struct pt_regs *regs) +{ + struct task_struct *victim; + int tgid; + struct mm_struct *mm; + struct mem_cgroup *memcg; + struct cgroup_subsys_state css; + struct cgroup *cgrp; + struct cgroup_info *cgrp_info; + struct task_info *tsk_info; + int id; + struct task_info *oom_info; + + victim = (struct task_struct *)regs->di; + tgid = victim->tgid; + mm = victim->mm; + memcg = get_mem_cgroup_from_mm(mm); + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + id = (memcg->css).id; + cgrp_info = find_cgroup_info(id); + if (cgrp_info != NULL) { + read_lock(&cgrp_info->cgrp_lock); + tsk_info = find_task_info(cgrp_info, tgid); + read_unlock(&cgrp_info->cgrp_lock); + if (tsk_info != NULL) { + oom_info = create_oom_task_info(tsk_info); + if (oom_info != NULL) { + add_oom_task_to_cgroup_info(cgrp_info, + oom_info); + } + return 0; + } + } + } + return 0; +} + +static void mark_oom_victim_kprobe_post_handler(struct kprobe *p, + struct pt_regs *regs, + unsigned long flags) +{ + +} + +static int mark_oom_victim_kprobe_init(void) +{ + mark_oom_victim_kprobe.pre_handler = mark_oom_victim_kprobe_pre_handler; + mark_oom_victim_kprobe.post_handler = + mark_oom_victim_kprobe_post_handler; + mark_oom_victim_kprobe.symbol_name = "mark_oom_victim"; + if (register_kprobe(&mark_oom_victim_kprobe)) { + pr_alert("register_kprobe on mark_oom_victim failed!\n"); + return -EINVAL; + } + return 0; +} + +static void mark_oom_victim_kprobe_exit(void) +{ + unregister_kprobe(&mark_oom_victim_kprobe); +} + +//kretporbe at cgroup_destroy_locked +struct destroy_data { + struct cgroup *cgrp; +}; + +static int cgroup_destroy_locked_entry_handler(struct kretprobe_instance + *ri, struct pt_regs *regs) +{ + struct destroy_data *data; + + data = (struct destroy_data *)ri->data; + data->cgrp = (struct cgroup *)regs->di; + return 0; +} + +NOKPROBE_SYMBOL(cgroup_destroy_locked_entry_handler); + +static int cgroup_destroy_locked_ret_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct destroy_data *data = (struct destroy_data *)ri->data; + struct cgroup *cgrp = data->cgrp; + struct cgroup_info *cgrp_info = NULL; + unsigned long retval = regs_return_value(regs); + + if (!cgrp) + return -1; + if (retval != 0) + return -1; + list_for_each_entry(cgrp_info, &all_cgroup_info, list) { + if (cgrp_info->cgrp == cgrp) { + spin_lock(&lock); + list_del(&cgrp_info->list); + spin_unlock(&lock); + destroy_cgroup_info(cgrp_info); + return 0; + } + } + return -1; +} + +NOKPROBE_SYMBOL(cgroup_destroy_locked_ret_handler); + +static struct kretprobe cgroup_destroy_locked_kretprobe = { + .handler = cgroup_destroy_locked_ret_handler, + .entry_handler = cgroup_destroy_locked_entry_handler, + .data_size = sizeof(struct destroy_data), + .maxactive = 20, +}; + +static int cgroup_destroy_locked_kretprobe_init(void) +{ + int ret; + + cgroup_destroy_locked_kretprobe.kp.symbol_name = + "cgroup_destroy_locked"; + ret = register_kretprobe(&cgroup_destroy_locked_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); + return ret; + } + pr_info("Planted return probe at %s: %p\n", + cgroup_destroy_locked_kretprobe.kp.symbol_name, + cgroup_destroy_locked_kretprobe.kp.addr); + return 0; +} + +static void cgroup_destroy_locked_kretprobe_exit(void) +{ + unregister_kretprobe(&cgroup_destroy_locked_kretprobe); + pr_info("kretprobe at %p unregistered\n", + cgroup_destroy_locked_kretprobe.kp.addr); + + /* nmissed > 0 suggests that maxactive was set too low. */ + pr_info("Missed probing %d instances of %s\n", + cgroup_destroy_locked_kretprobe.nmissed, + cgroup_destroy_locked_kretprobe.kp.symbol_name); +} + +// print the tasks in order of their memory usage +static void print_sorted_tasks_list(struct cgroup_info *cgrp_info, + int type, struct seq_file *m) +{ + struct list_head *cur, *insert_pos; + struct task_info *task, *insert_task; + struct list_head new_list = LIST_HEAD_INIT(new_list); + struct list_head *old_list; + struct task_info *new_task, *next_task; + + if (type == 0) { + if (cgrp_info == NULL) + return; + read_lock(&cgrp_info->cgrp_lock); + old_list = &cgrp_info->tasks_list; + } else { + if (cgrp_info == NULL) + return; + old_list = &cgrp_info->oom_list; + } + + list_for_each_entry_safe(task, insert_task, old_list, list) { + new_task = kmalloc(sizeof(struct task_info), GFP_ATOMIC); + if (!new_task) + return; + new_task->tgid = task->tgid; + strscpy(new_task->comm, task->comm, sizeof(new_task->comm)); + new_task->count = task->count; + new_task->pages = NULL; + INIT_LIST_HEAD(&new_task->list); + + //insertion sort + cur = &new_list; + insert_pos = cur->next; + while (insert_pos != &new_list) { + next_task = + list_entry(insert_pos, struct task_info, list); + if (new_task->count >= next_task->count) + break; + cur = insert_pos; + insert_pos = insert_pos->next; + } + + (&new_task->list)->prev = insert_pos->prev; + (insert_pos->prev)->next = (&new_task->list); + (&new_task->list)->next = insert_pos; + insert_pos->prev = (&new_task->list); + } + if (type == 0) + read_unlock(&cgrp_info->cgrp_lock); + + //print + if (type == 1 && (&new_list) != new_list.next) { + seq_puts(m, "oom:\n"); + seq_printf(m, "%10s %20s %20s\n", "pid", "command", + "memory usage (KB)"); + } + if (type == 0) + seq_printf(m, "%10s %20s %20s\n", "pid", "command", + "memory usage (KB)"); + list_for_each_entry_safe(task, insert_task, &new_list, list) { + seq_printf(m, "%10d %20s %20d\n", task->tgid, task->comm, + (task->count) * 4); + } + + list_for_each_entry_safe(task, insert_task, &new_list, list) { + list_del(&task->list); + kfree(task); + } +} + +static struct proc_dir_entry *cgroup_info_read; +#define procfs_file_read "cgroup_memory_usage_per_process" + +void seq_print_tasks(struct cgroup_info *cgroup_info, struct seq_file *m) +{ + if (!cgroup_info) + return; + + print_sorted_tasks_list(cgroup_info, 0, m); +} + +void seq_print_oom_tasks(struct cgroup_info *cgroup_info, struct seq_file *m) +{ + if (!cgroup_info) + return; + + print_sorted_tasks_list(cgroup_info, 1, m); +} + +void seq_print_cgroups(struct seq_file *m) +{ + struct cgroup_info *cgrp, *pos; + + spin_lock(&lock); + list_for_each_entry_safe(cgrp, pos, &all_cgroup_info, list) { + seq_printf(m, "cgroup name : %s\n", cgrp->name); + seq_print_tasks(cgrp, m); + seq_print_oom_tasks(cgrp, m); + seq_puts(m, "\n"); + } + spin_unlock(&lock); +} + +static int memory_usage_show(struct seq_file *m, void *v) +{ + seq_print_cgroups(m); + return 0; +} + +static int __init global_init(void) +{ + int ret = 0; + + cgroup_info_read = + proc_create_single(procfs_file_read, 0, NULL, memory_usage_show); + if (!cgroup_info_read) + return -ENOMEM; + ret = mem_cgroup_charge_kretprobe_init(); + uncharge_folio_kretprobe_init(); + do_exit_kprobe_init(); + mark_oom_victim_kprobe_init(); + cgroup_destroy_locked_kretprobe_init(); + + return ret; +} + +static void __exit global_exit(void) +{ + struct cgroup_info *cgrp_info, *pos; + + mem_cgroup_charge_kretprobe_exit(); + uncharge_folio_kretprobe_exit(); + do_exit_kprobe_exit(); + mark_oom_victim_kprobe_exit(); + cgroup_destroy_locked_kretprobe_exit(); + + remove_proc_entry(procfs_file_read, NULL); + + //release all memory use + list_for_each_entry_safe(cgrp_info, pos, &all_cgroup_info, list) { + list_del(&cgrp_info->list); + destroy_cgroup_info(cgrp_info); + } +} + +module_init(global_init) +module_exit(global_exit) +MODULE_LICENSE("GPL"); diff --git a/tools/probeCgroup/probeCgroup.h b/tools/probeCgroup/probeCgroup.h new file mode 100644 index 000000000000..953a6e0aca31 --- /dev/null +++ b/tools/probeCgroup/probeCgroup.h @@ -0,0 +1,415 @@ +/* SPDX-License-Identifier: GPL-2.0*/ +/* + * probeCgroup.h + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/kprobes.h> +#include <linux/ktime.h> +#include <linux/limits.h> +#include <linux/sched.h> +#include <linux/mm_types.h> +#include <linux/memcontrol.h> +#include <linux/cgroup-defs.h> +#include <linux/kernfs.h> +#include <linux/string.h> +#include <linux/list.h> +#include <linux/oom.h> +#include <linux/fs.h> +#include <linux/proc_fs.h> +#include <linux/huge_mm.h> +#include <linux/page-flags.h> +#include <linux/spinlock.h> +#include <linux/rwlock.h> + +static spinlock_t lock; // global lock for the list of cgroup_info + +struct HashNode { + unsigned long addr; + struct HashNode *next; +}; + +struct HashNode *HashNode_create(unsigned long addr) +{ + struct HashNode *node = NULL; + + node = kzalloc(sizeof(struct HashNode), GFP_ATOMIC); + if (node == NULL) + return NULL; + node->addr = addr; + node->next = NULL; + return node; +} + +struct HashBucket { + struct HashNode *head; + spinlock_t bkt_lock; +}; + +void HashBucket_init(struct HashBucket *bkt) +{ + bkt->head = NULL; + spin_lock_init(&bkt->bkt_lock); +} + +bool HashBucket_insert(struct HashBucket *bkt, unsigned long addr) +{ + struct HashNode *new_node; + struct HashNode *node; + struct HashNode *prev; + bool ret = true; + + if (bkt == NULL) + return false; + + prev = NULL; + new_node = NULL; + new_node = HashNode_create(addr); + + spin_lock(&bkt->bkt_lock); + node = bkt->head; + while (node != NULL && node->addr != addr) { + prev = node; + node = node->next; + } + if (node == NULL) { + if (new_node == NULL) { + pr_info("not enough memory for HashNode\n"); + spin_unlock(&bkt->bkt_lock); + return false; + } + if (bkt->head == NULL) + bkt->head = new_node; + else + prev->next = new_node; + spin_unlock(&bkt->bkt_lock); + ret = true; + } else { + spin_unlock(&bkt->bkt_lock); + kfree(new_node); + ret = false; + } + + return ret; +} + +bool HashBucket_erase(struct HashBucket *bkt, unsigned long addr) +{ + struct HashNode *node; + struct HashNode *prev; + bool ret = true; + + if (bkt == NULL) + return false; + + spin_lock(&bkt->bkt_lock); + node = bkt->head; + prev = NULL; + while (node != NULL && node->addr != addr) { + prev = node; + node = node->next; + } + if (node == NULL) { + spin_unlock(&bkt->bkt_lock); + ret = false; + } else { + if (bkt->head == node) + bkt->head = node->next; + else + prev->next = node->next; + kfree(node); + spin_unlock(&bkt->bkt_lock); + ret = true; + } + + return ret; +} + +void HashBucket_clear(struct HashBucket *bkt) +{ + struct HashNode *node; + struct HashNode *prev; + + if (bkt == NULL) + return; + + spin_lock(&bkt->bkt_lock); + node = bkt->head; + prev = NULL; + bkt->head = NULL; + while (node != NULL) { + prev = node; + node = node->next; + kfree(prev); + } + spin_unlock(&bkt->bkt_lock); +} + +struct HashMap { + unsigned long size; + struct HashBucket *HashTable; +}; + +unsigned long hash_func(unsigned long addr, unsigned long size) +{ + return addr % size; +} + +struct HashMap *HashMap_create(unsigned long size) +{ + struct HashMap *hm = NULL; + struct HashBucket *ht = NULL; + int i = 0; + + hm = kmalloc(sizeof(struct HashMap), GFP_ATOMIC); + if (hm == NULL) + return NULL; + ht = kmalloc((size * sizeof(struct HashBucket)), GFP_ATOMIC); + if (ht == NULL) { + kfree(hm); + return NULL; + } + for (i = 0; i < size; i++) + HashBucket_init(&(ht[i])); + + hm->size = size; + hm->HashTable = ht; + return hm; +} + +bool HashMap_insert(struct HashMap *hm, unsigned long addr) +{ + unsigned long index; + + if (hm == NULL) + return false; + index = hash_func(addr, hm->size); + if (hm->HashTable == NULL) + return false; + return HashBucket_insert(&(hm->HashTable[index]), addr); +} + +bool HashMap_erase(struct HashMap *hm, unsigned long addr) +{ + unsigned long index; + + if (hm == NULL) + return false; + index = hash_func(addr, hm->size); + if (hm->HashTable == NULL) + return false; + return HashBucket_erase(&(hm->HashTable[index]), addr); +} + +void HashMap_clear(struct HashMap *hm) +{ + unsigned long size; + struct HashBucket *ht; + int i; + + if (hm == NULL) + return; + size = hm->size; + ht = hm->HashTable; + if (ht == NULL) + return; + hm->HashTable = NULL; + for (i = 0; i < size; i++) + HashBucket_clear(&(ht[i])); + + kfree(ht); + kfree(hm); +} + +//struct that save the information for each task +struct task_info { + int tgid; + char comm[TASK_COMM_LEN]; + int count; // number of pages + struct HashMap *pages; + struct list_head list; + spinlock_t cnt_lock; +}; + +// struct that save the information for each cgroup +struct cgroup_info { + struct cgroup *cgrp; + struct mem_cgroup *memcg; + int id; + char name[64]; + struct list_head list; + struct list_head tasks_list; + struct list_head oom_list; + rwlock_t cgrp_lock; + unsigned int cached_bytes; +}; + +static LIST_HEAD(all_cgroup_info); // a list that linked all the cgroup_info struct + +static struct task_info *create_task_info(struct task_struct *cur_task) +{ + struct task_info *tsk_info = + kmalloc(sizeof(struct task_info), GFP_ATOMIC); + if (!tsk_info) + return NULL; + + // initialization + tsk_info->tgid = cur_task->tgid; + strscpy(tsk_info->comm, cur_task->comm, sizeof(tsk_info->comm)); + tsk_info->count = 0; + tsk_info->pages = NULL; + tsk_info->pages = HashMap_create(1023); + INIT_LIST_HEAD(&tsk_info->list); + spin_lock_init(&(tsk_info->cnt_lock)); + + return tsk_info; +} + +static int +add_task_to_cgroup_info(struct cgroup_info *cgrp, struct task_info *task) +{ + if (!cgrp || !task) + return -EINVAL; + + write_lock(&cgrp->cgrp_lock); + list_add_tail(&task->list, &cgrp->tasks_list); + write_unlock(&cgrp->cgrp_lock); + return 0; +} + +static int +remove_task_from_cgroup_info(struct cgroup_info *cgrp, struct task_info *task) +{ + if (cgrp == NULL || task == NULL) + return -EINVAL; + + HashMap_clear(task->pages); + // kfree(task->pages); + kfree(task); + return 0; +} + +static struct task_info *find_task_info(struct cgroup_info *cgrp, int tgid) +{ + struct task_info *tsk_info, *pos; + + list_for_each_entry_safe(tsk_info, pos, &cgrp->tasks_list, list) { + if (tsk_info->tgid == tgid) + return tsk_info; + } + return NULL; +} + +static int +remove_page_from_cgroup_info(unsigned long addr, struct cgroup_info *cgrp) +{ + struct task_info *tsk_info, *pos; + + read_lock(&cgrp->cgrp_lock); + list_for_each_entry_safe(tsk_info, pos, &cgrp->tasks_list, list) { + if (HashMap_erase(tsk_info->pages, addr)) { + spin_lock(&(tsk_info->cnt_lock)); + tsk_info->count -= folio_nr_pages((struct folio *)addr); + spin_unlock(&(tsk_info->cnt_lock)); + read_unlock(&cgrp->cgrp_lock); + return 0; + } + } + read_unlock(&cgrp->cgrp_lock); + return -1; +} + +static struct cgroup_info *create_cgroup_info(struct cgroup *cgrp, + struct mem_cgroup *memcg) +{ + struct cgroup_info *cgrp_info = + kmalloc(sizeof(struct cgroup_info), GFP_ATOMIC); + struct kernfs_node *kn; + + if (!cgrp_info) + return NULL; + + cgrp_info->cgrp = cgrp; + cgrp_info->memcg = memcg; + cgrp_info->id = (memcg->css).id; + kn = cgrp->kn; + strscpy(cgrp_info->name, kn->name, sizeof(cgrp_info->name)); + INIT_LIST_HEAD(&cgrp_info->list); + INIT_LIST_HEAD(&cgrp_info->tasks_list); + INIT_LIST_HEAD(&cgrp_info->oom_list); + rwlock_init(&(cgrp_info->cgrp_lock)); + cgrp_info->cached_bytes = 0; + + return cgrp_info; +} + +static void destroy_cgroup_info(struct cgroup_info *cgrp_info) +{ + struct task_info *task, *tmp; + + if (!cgrp_info) + return; + + write_lock(&cgrp_info->cgrp_lock); + list_for_each_entry_safe(task, tmp, &cgrp_info->tasks_list, list) { + list_del(&task->list); + remove_task_from_cgroup_info(cgrp_info, task); + } + write_unlock(&cgrp_info->cgrp_lock); + list_for_each_entry_safe(task, tmp, &cgrp_info->oom_list, list) { + list_del(&task->list); + remove_task_from_cgroup_info(cgrp_info, task); + } + + kfree(cgrp_info); +} + +static int add_cgroup_info(struct cgroup_info *cgrp_info) +{ + if (!cgrp_info) + return -EINVAL; + + list_add_tail(&cgrp_info->list, &all_cgroup_info); + return 0; +} + +static struct cgroup_info *find_cgroup_info(int id) +{ + struct cgroup_info *cgrp_info = NULL; + + list_for_each_entry(cgrp_info, &all_cgroup_info, list) { + if (cgrp_info->id == id) + return cgrp_info; + } + + return NULL; +} + +static struct task_info *create_oom_task_info(struct task_info *tsk_info) +{ + struct task_info *oom_tsk_info = + kmalloc(sizeof(struct task_info), GFP_ATOMIC); + if (!oom_tsk_info) + return NULL; + + oom_tsk_info->tgid = tsk_info->tgid; + strscpy(oom_tsk_info->comm, tsk_info->comm, sizeof(oom_tsk_info->comm)); + oom_tsk_info->count = tsk_info->count; + oom_tsk_info->pages = NULL; + INIT_LIST_HEAD(&oom_tsk_info->list); + + return oom_tsk_info; +} + +static int +add_oom_task_to_cgroup_info(struct cgroup_info *cgrp, + struct task_info *oom_task) +{ + if (!cgrp || !oom_task) + return -EINVAL; + list_add_tail(&oom_task->list, &cgrp->oom_list); + return 0; +} diff --git a/tools/probeCgroup/run.sh b/tools/probeCgroup/run.sh new file mode 100755 index 000000000000..7e1ffefe66d1 --- /dev/null +++ b/tools/probeCgroup/run.sh @@ -0,0 +1,8 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +cd scripts +./script1.sh +./script2.sh +./script3.sh diff --git a/tools/probeCgroup/scripts/script1.sh b/tools/probeCgroup/scripts/script1.sh new file mode 100755 index 000000000000..539e8258afb9 --- /dev/null +++ b/tools/probeCgroup/scripts/script1.sh @@ -0,0 +1,10 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +cd .. +make +insmod probeCgroup.ko + +cd testcases +gcc simple-mem-allocate.c -o simple-mem-allocate diff --git a/tools/probeCgroup/scripts/script2.sh b/tools/probeCgroup/scripts/script2.sh new file mode 100755 index 000000000000..2ad515cfb912 --- /dev/null +++ b/tools/probeCgroup/scripts/script2.sh @@ -0,0 +1,14 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +current_dir=$(pwd) +cd /sys/fs/cgroup/memory +mkdir test +cd test +sh -c "echo $$ >> cgroup.procs" +sh -c "echo 5M > memory.limit_in_bytes" +sh -c "echo 0 > memory.swappiness" +cd "$current_dir" +cd ../testcases +./simple-mem-allocate diff --git a/tools/probeCgroup/scripts/script3.sh b/tools/probeCgroup/scripts/script3.sh new file mode 100755 index 000000000000..127eb45de5c9 --- /dev/null +++ b/tools/probeCgroup/scripts/script3.sh @@ -0,0 +1,11 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +cd /proc +cat cgroup_memory_usage_per_process + +cat /sys/fs/cgroup/memory/test/cgroup.procs > /sys/fs/cgroup/memory/cgroup.procs +rmdir /sys/fs/cgroup/memory/test +# cat cgroup_memory_usage_per_process +rmmod probeCgroup diff --git a/tools/probeCgroup/testcases/1_load_unload_test.py b/tools/probeCgroup/testcases/1_load_unload_test.py new file mode 100755 index 000000000000..5389a14a1dac --- /dev/null +++ b/tools/probeCgroup/testcases/1_load_unload_test.py @@ -0,0 +1,24 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +import os +import subprocess +import time + +def test_module_load_unload(): + try: + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + print('loading module successfully!') + subprocess.check_call(['rmmod', 'probeCgroup']) + output = subprocess.check_output(['lsmod']) + assert b'probeCgroup' not in output + print('unloading module successfully!') + except subprocess.CalledProcessError as e: + print('Load unload test failed. Insmod failed.') + except AssertionError as e: + print('Load unload test failed. Cannot remove module.') + +if __name__ == '__main__': + test_module_load_unload() \ No newline at end of file diff --git a/tools/probeCgroup/testcases/2_multiple_process_test.py b/tools/probeCgroup/testcases/2_multiple_process_test.py new file mode 100755 index 000000000000..d88c7f7f2952 --- /dev/null +++ b/tools/probeCgroup/testcases/2_multiple_process_test.py @@ -0,0 +1,48 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup, check_kmem_usage +import os +import subprocess +import time + +def test_multiple_process(num_procs): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroup_name = 'test' + cgroup_path = create_cgroup(cgroup_name) + + processes = [] + pids = [] + + for i in range(num_procs): + process = subprocess.Popen(['./mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + processes.append(process) + pids.append(pid) + + time.sleep(0.1) + try: + count = 0 + for i in range (2000): + count += check_memory_usage(cgroup_name, pids, False) + time.sleep(0.01) + assert count <= 50, f"Memory read by probeCgroup is not accurate" + + remove_cgroup(cgroup_path, pids) + check_memory_usage(cgroup_name, pids, True) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass multiple process test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + remove_cgroup(cgroup_path, pids) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_multiple_process(3) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/3_multiple_cgroup_test.py b/tools/probeCgroup/testcases/3_multiple_cgroup_test.py new file mode 100755 index 000000000000..592a716df877 --- /dev/null +++ b/tools/probeCgroup/testcases/3_multiple_cgroup_test.py @@ -0,0 +1,55 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup +import os +import subprocess +import time + +def test_multiple_cgroup(num_procs, num_cgroups): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroups = [] + processes = {} + pids = {} + for i in range(num_cgroups): + cgroup_name = f'test_{i}' + cgroup_path = create_cgroup(cgroup_name) + cgroups.append((cgroup_name, cgroup_path)) + + for j in range(num_procs): + process = subprocess.Popen(['./mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + if cgroup_path not in processes: + processes[cgroup_path] = [] + processes[cgroup_path].append(process) + if cgroup_path not in pids: + pids[cgroup_path] = [] + pids[cgroup_path].append(pid) + + time.sleep(0.1) + try: + for i in range (100): + for cgroup_name, cgroup_path in cgroups: + check_memory_usage(cgroup_name, pids[cgroup_path], False) + time.sleep(0.01) + + for cgroup_name, cgroup_path in cgroups: + remove_cgroup(cgroup_path, pids[cgroup_path]) + check_memory_usage(cgroup_name, pids[cgroup_path], True) + cleanup(processes[cgroup_path]) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass multiple cgroup test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + for cgroup_name, cgroup_path in cgroups: + remove_cgroup(cgroup_path, pids[cgroup_path]) + cleanup(processes[cgroup_path]) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_multiple_cgroup(2,2) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/4_oom_test.py b/tools/probeCgroup/testcases/4_oom_test.py new file mode 100755 index 000000000000..128a258c56f5 --- /dev/null +++ b/tools/probeCgroup/testcases/4_oom_test.py @@ -0,0 +1,52 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup, get_oom_process_memory_usage +import os +import subprocess +import time + +def test_oom(num_procs): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroup_name = 'test' + cgroup_path = create_cgroup(cgroup_name) + + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.limit_in_bytes", 'w') as limit_file: + limit_file.write("5M") + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.swappiness", 'w') as swap_file: + swap_file.write("0") + + processes = [] + pids = [] + for i in range(num_procs): + process = subprocess.Popen(['./simple-mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + processes.append(process) + pids.append(pid) + + time.sleep(6) + + try: + for pid in pids: + memory_usage = get_oom_process_memory_usage(pid, cgroup_name) + assert memory_usage is not None, f"Memory usage(oom) not found for PID {pid}" + assert memory_usage > 0, f"Memory usage should be greater than zero for PID {pid}" + + remove_cgroup(cgroup_path, pids) + check_memory_usage(cgroup_name, pids, True) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass oom test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + remove_cgroup(cgroup_path, pids) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_oom(1) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/5_multiple_threads_test.py b/tools/probeCgroup/testcases/5_multiple_threads_test.py new file mode 100755 index 000000000000..7e1b86dabe48 --- /dev/null +++ b/tools/probeCgroup/testcases/5_multiple_threads_test.py @@ -0,0 +1,45 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup, check_kmem_usage +import os +import subprocess +import time + +def test_multiple_thread(num_procs): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroup_name = 'test' + cgroup_path = create_cgroup(cgroup_name) + + processes = [] + pids = [] + for i in range(num_procs): + process = subprocess.Popen(['./multiple-thread-mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + processes.append(process) + pids.append(pid) + + time.sleep(1) + try: + for i in range (200): + check_memory_usage(cgroup_name, pids, False) + time.sleep(0.01) + + remove_cgroup(cgroup_path, pids) + check_memory_usage(cgroup_name, pids, True) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass multiple threads test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + remove_cgroup(cgroup_path, pids) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_multiple_thread(5) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/cgroup_utils.py b/tools/probeCgroup/testcases/cgroup_utils.py new file mode 100644 index 000000000000..e00c580e724e --- /dev/null +++ b/tools/probeCgroup/testcases/cgroup_utils.py @@ -0,0 +1,114 @@ +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +import os +import subprocess +import time + +def create_cgroup(cgroup_name): + cgroup_path = f'/sys/fs/cgroup/memory/{cgroup_name}' + + try: + os.makedirs(cgroup_path) + except FileExistsError: + pass + + return cgroup_path + +def add_process_to_cgroup(cgroup_path, pid): + with open(os.path.join(cgroup_path, 'cgroup.procs'), 'w') as procs_file: + procs_file.write(str(pid)) + +def get_process_memory_usage(pid, cgroup_name): + cur_name = '' + with open('/proc/cgroup_memory_usage_per_process', 'r') as file: + for line in file: + parts = line.strip().split() + if len(parts) >= 4 and parts[0] == 'cgroup': + cur_name = parts[3] + if len(parts) >= 3 and parts[0] != 'cgroup' and cur_name == cgroup_name and parts[0] != 'pid' and int(parts[0]) == pid: + return int(parts[2]) + return None + +def get_process_kmem_usage(pid, cgroup_name): + cur_name = '' + with open('/proc/cgroup_memory_usage_per_process', 'r') as file: + for line in file: + parts = line.strip().split() + if len(parts) >= 4 and parts[0] == 'cgroup': + cur_name = parts[3] + if len(parts) >= 4 and parts[0] != 'cgroup' and cur_name == cgroup_name and parts[0] != 'pid' and int(parts[0]) == pid: + return int(parts[3]) + return None + +def remove_cgroup(cgroup_path, pids): + for pid in pids: + with open('/sys/fs/cgroup/memory/cgroup.procs', 'w') as backup_file: + backup_file.write(str(pid)) + os.rmdir(cgroup_path) + return + +def check_memory_usage(cgroup_name, pids, delete): + memory_sum = 0 + for pid in pids: + memory_usage = get_process_memory_usage(pid, cgroup_name) + if delete == False: + assert memory_usage is not None, f"Memory usage not found for PID {pid}" + assert memory_usage >= 0, f"Memory usage should be greater than zero for PID {pid}" + memory_sum += memory_usage + else: + assert memory_usage is None, f"Error: Memory usage should not be available for PID {pid} after deleting the cgroup." + if delete == False: + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.usage_in_bytes", 'r') as file: + content = file.readline().strip() + memory_read = int(content) + memory_sum *= 1024 + delta = abs(memory_read - memory_sum) + # print(f"read: {memory_read}") + # print(f"sum : {memory_sum}") + if (delta > max(memory_read, memory_sum) * 0.1): + return 1 + else: + return 0 + else: + return 0 + +def check_kmem_usage(cgroup_name, pids, delete): + kmem_sum = 0 + for pid in pids: + kmem_usage = get_process_kmem_usage(pid, cgroup_name) + if delete == False: + assert kmem_usage is not None, f"Kmem usage not found for PID {pid}" + assert kmem_usage >= 0, f"Kmem usage should be greater than zero for PID {pid}" + kmem_sum += kmem_usage + else: + assert kmem_usage is None, f"Error: Kmem usage should not be available for PID {pid} after deleting the cgroup." + if delete == False: + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.kmem.usage_in_bytes", 'r') as file: + content = file.readline().strip() + kmem_read = int(content) + kmem_sum *= 1024 + delta = abs(kmem_read - kmem_sum) + # print(f"kmem read: {kmem_read}") + # print(f"kmem sum : {kmem_sum}") + # assert delta <= max(kmem_read, kmem_sum) * 0.2, f"Kmem read by probeCgroup is not accurate, {kmem_read}, {kmem_sum}" + +def cleanup(processes): + for process in processes: + process.terminate() + process.wait() + +def get_oom_process_memory_usage(pid, cgroup_name): + cur_name = '' + oom = False + with open('/proc/cgroup_memory_usage_per_process', 'r') as file: + for line in file: + parts = line.strip().split() + if len(parts) >= 4 and parts[0] == 'cgroup': + cur_name = parts[3] + oom = False + if len(parts) >= 1 and parts[0] == 'oom:': + oom = True + if len(parts) >= 3 and parts[0] != 'cgroup' and cur_name == cgroup_name and parts[0] != 'pid' and int(parts[0]) == pid and oom == True: + return int(parts[2]) + return None \ No newline at end of file diff --git a/tools/probeCgroup/testcases/mem-allocate.c b/tools/probeCgroup/testcases/mem-allocate.c new file mode 100644 index 000000000000..e78e37cae61b --- /dev/null +++ b/tools/probeCgroup/testcases/mem-allocate.c @@ -0,0 +1,35 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * mem-allocate.c - The program to test probeCgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> + +#define MB (1024 * 1024) + +char *arr[40]; + +int main(int argc, char *argv[]) +{ + char *p; + int i = 0; + + while (1) { + for (i = 0; i < 40; i++) { + p = (char *)malloc(MB); + memset(p, 0, MB); + arr[i] = p; + usleep(100000); + } + for (int i = 0; i < 40; i++) { + free(arr[i]); + usleep(100000); + } + } + return 0; +} diff --git a/tools/probeCgroup/testcases/multiple-thread-mem-allocate.c b/tools/probeCgroup/testcases/multiple-thread-mem-allocate.c new file mode 100644 index 000000000000..55f4c068f55e --- /dev/null +++ b/tools/probeCgroup/testcases/multiple-thread-mem-allocate.c @@ -0,0 +1,60 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * multiple-thread-mem-allocate.c - The program to test probeCgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> +#include <pthread.h> + +#define MB (1024 * 1024) + +void *memory_test(void *) +{ + char *arr[25]; + char *p; + int i = 0; + int cnt = 0; + + while (1) { + for (i = 0; i < 20; i++) { + p = (char *)malloc(MB); + memset(p, 0, MB); + arr[i] = p; + usleep(10000); + } + for (int i = 0; i < 20; i++) { + free(arr[i]); + usleep(10000); + } + } +} + +int main(int argc, char *argv[]) +{ + pthread_t threads[4]; + int rc; + + // create threads + for (int i = 0; i < 4; i++) { + rc = pthread_create(&threads[i], NULL, memory_test, NULL); + if (rc != 0) { + fprintf(stderr, "Error creating thread: %d\n", rc); + return 1; + } + } + + for (int i = 0; i < 4; i++) { + rc = pthread_join(threads[i], NULL); + if (rc != 0) { + fprintf(stderr, "Error joining thread: %d\n", rc); + return 1; + } + } + + return 0; +} diff --git a/tools/probeCgroup/testcases/run.py b/tools/probeCgroup/testcases/run.py new file mode 100755 index 000000000000..8ffd0ca720d8 --- /dev/null +++ b/tools/probeCgroup/testcases/run.py @@ -0,0 +1,32 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +import os +import subprocess +import sys + +def run_tests(directory): + """Run all Python scripts in the given directory.""" + python_files = [f for f in os.listdir(directory) if f.endswith('test.py')] + python_files.sort() + + for filename in python_files: + try: + filepath = os.path.join(directory, filename) + + subprocess.check_call([sys.executable, filepath]) + except subprocess.CalledProcessError as e: + print(f"Error executing {filename}:") + return + except Exception as e: + print(f"Error executing {filename}:") + print(e) + return + +if __name__ == '__main__': + tests_directory = '.' + subprocess.check_call(['gcc', 'mem-allocate.c', '-o', 'mem-allocate']) + subprocess.check_call(['gcc', 'simple-mem-allocate.c', '-o', 'simple-mem-allocate']) + subprocess.check_call(['gcc', 'multiple-thread-mem-allocate.c', '-o', 'multiple-thread-mem-allocate']) + run_tests(tests_directory) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/simple-mem-allocate.c b/tools/probeCgroup/testcases/simple-mem-allocate.c new file mode 100644 index 000000000000..16328b10ba48 --- /dev/null +++ b/tools/probeCgroup/testcases/simple-mem-allocate.c @@ -0,0 +1,27 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * mem-allocate.c - The program to test probeCgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> + +#define MB (1024 * 1024) + +int main(int argc, char *argv[]) +{ + char *p; + int i = 0; + + while (1) { + p = (char *)malloc(MB); + memset(p, 0, MB); + sleep(1); + } + + return 0; +} -- 2.43.0

2 1

openEuler Kernel SIG双周例会
by openEuler conference 05 Sep '24

05 Sep '24

您好！ Kernel 邀请您参加 2024-09-06 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复本邮件申请，也可直接填写至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/989033877 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-09-06 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复本邮件申请，也可直接填写至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/989033877. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-5.10] Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
by Kaixiong Yu 05 Sep '24

05 Sep '24

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.222 commit 145faa3d03688cbb7bbaaecbd84c01539852942c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAD6H2 CVE: CVE-2024-42102 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 30139c702048f1097342a31302cbd3d478f50c63 upstream. Patch series "mm: Avoid possible overflows in dirty throttling". Dirty throttling logic assumes dirty limits in page units fit into 32-bits. This patch series makes sure this is true (see patch 2/2 for more details). This patch (of 2): This reverts commit 9319b647902cbd5cc884ac08a8a6d54ce111fc78. The commit is broken in several ways. Firstly, the removed (u64) cast from the multiplication will introduce a multiplication overflow on 32-bit archs if wb_thresh * bg_thresh >= 1<<32 (which is actually common - the default settings with 4GB of RAM will trigger this). Secondly, the div64_u64() is unnecessarily expensive on 32-bit archs. We have div64_ul() in case we want to be safe & cheap. Thirdly, if dirty thresholds are larger than 1<<32 pages, then dirty balancing is going to blow up in many other spectacular ways anyway so trying to fix one possible overflow is just moot. Link: https://lkml.kernel.org/r/20240621144017.30993-1-jack@suse.cz Link: https://lkml.kernel.org/r/20240621144246.11148-1-jack@suse.cz Fixes: 9319b647902c ("mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again") Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-By: Zach O'Keefe <zokeefe(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/page-writeback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/page-writeback.c b/mm/page-writeback.c index 0d7cc65c6367..31bc5904bbf8 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -1541,7 +1541,7 @@ static inline void wb_dirty_limits(struct dirty_throttle_control *dtc) */ dtc->wb_thresh = __wb_calc_thresh(dtc); dtc->wb_bg_thresh = dtc->thresh ? - div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; + div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; /* * In order to avoid the stacked BDI deadlock we need -- 2.25.1

2 1

[openeuler:OLK-6.6 2700/13861] drivers/platform/mpam/mpam_devices.c:247:32: error: implicit declaration of function '__acpi_get_mem_attribute'
by kernel test robot 05 Sep '24

05 Sep '24

Hi James, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 392f26f46bac569be21dbe2b3ca67641e02cb148 commit: 3e9e723f3bf92a19e5e15dda89bbb136ce463294 [2700/13861] arm_mpam: Add probe/remove for mpam msc driver and kbuild boiler plate config: arm64-randconfig-004-20240905 (https://download.01.org/0day-ci/archive/20240905/202409051300.VBHKGPkR-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240905/202409051300.VBHKGPkR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409051300.VBHKGPkR-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from include/linux/mmzone.h:8, from include/linux/gfp.h:7, from include/linux/slab.h:16, from include/linux/resource_ext.h:11, from include/linux/acpi.h:13, from drivers/platform/mpam/mpam_devices.c:6: drivers/platform/mpam/mpam_devices.c: In function 'mpam_msc_drv_probe': drivers/platform/mpam/mpam_devices.c:212:38: error: 'struct mpam_msc' has no member named 'mon_sel_lock'; did you mean 'part_sel_lock'? 212 | spin_lock_init(&msc->mon_sel_lock); | ^~~~~~~~~~~~ include/linux/spinlock.h:335:45: note: in definition of macro 'spin_lock_init' 335 | __raw_spin_lock_init(spinlock_check(lock), \ | ^~~~ >> drivers/platform/mpam/mpam_devices.c:247:32: error: implicit declaration of function '__acpi_get_mem_attribute' [-Wimplicit-function-declaration] 247 | prot = __acpi_get_mem_attribute(msc->pcc_chan->shmem_base_addr); | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/platform/mpam/mpam_devices.c:247:32: error: incompatible types when assigning to type 'pgprot_t' from type 'int' vim +/__acpi_get_mem_attribute +247 drivers/platform/mpam/mpam_devices.c 170 171 static int mpam_msc_drv_probe(struct platform_device *pdev) 172 { 173 int err; 174 pgprot_t prot; 175 void * __iomem io; 176 struct mpam_msc *msc; 177 struct resource *msc_res; 178 void *plat_data = pdev->dev.platform_data; 179 180 mutex_lock(&mpam_list_lock); 181 do { 182 msc = devm_kzalloc(&pdev->dev, sizeof(*msc), GFP_KERNEL); 183 if (!msc) { 184 err = -ENOMEM; 185 break; 186 } 187 188 INIT_LIST_HEAD_RCU(&msc->glbl_list); 189 msc->pdev = pdev; 190 191 err = device_property_read_u32(&pdev->dev, "arm,not-ready-us", 192 &msc->nrdy_usec); 193 if (err) { 194 /* This will prevent CSU monitors being usable */ 195 msc->nrdy_usec = 0; 196 } 197 198 err = get_msc_affinity(msc); 199 if (err) 200 break; 201 if (cpumask_empty(&msc->accessibility)) { 202 pr_err_once("msc:%u is not accessible from any CPU!", 203 msc->id); 204 err = -EINVAL; 205 break; 206 } 207 208 mutex_init(&msc->lock); 209 msc->id = mpam_num_msc++; 210 INIT_LIST_HEAD_RCU(&msc->ris); 211 spin_lock_init(&msc->part_sel_lock); > 212 spin_lock_init(&msc->mon_sel_lock); 213 214 if (device_property_read_u32(&pdev->dev, "pcc-channel", 215 &msc->pcc_subspace_id)) 216 msc->iface = MPAM_IFACE_MMIO; 217 else 218 msc->iface = MPAM_IFACE_PCC; 219 220 if (msc->iface == MPAM_IFACE_MMIO) { 221 io = devm_platform_get_and_ioremap_resource(pdev, 0, 222 &msc_res); 223 if (IS_ERR(io)) { 224 pr_err("Failed to map MSC base address\n"); 225 devm_kfree(&pdev->dev, msc); 226 err = PTR_ERR(io); 227 break; 228 } 229 msc->mapped_hwpage_sz = msc_res->end - msc_res->start; 230 msc->mapped_hwpage = io; 231 } else if (msc->iface == MPAM_IFACE_PCC) { 232 msc->pcc_cl.dev = &pdev->dev; 233 msc->pcc_cl.rx_callback = mpam_pcc_rx_callback; 234 msc->pcc_cl.tx_block = false; 235 msc->pcc_cl.tx_tout = 1000; /* 1s */ 236 msc->pcc_cl.knows_txdone = false; 237 238 msc->pcc_chan = pcc_mbox_request_channel(&msc->pcc_cl, 239 msc->pcc_subspace_id); 240 if (IS_ERR(msc->pcc_chan)) { 241 pr_err("Failed to request MSC PCC channel\n"); 242 devm_kfree(&pdev->dev, msc); 243 err = PTR_ERR(msc->pcc_chan); 244 break; 245 } 246 > 247 prot = __acpi_get_mem_attribute(msc->pcc_chan->shmem_base_addr); 248 io = ioremap_prot(msc->pcc_chan->shmem_base_addr, 249 msc->pcc_chan->shmem_size, pgprot_val(prot)); 250 if (IS_ERR(io)) { 251 pr_err("Failed to map MSC base address\n"); 252 pcc_mbox_free_channel(msc->pcc_chan); 253 devm_kfree(&pdev->dev, msc); 254 err = PTR_ERR(io); 255 break; 256 } 257 258 /* TODO: issue a read to update the registers */ 259 260 msc->mapped_hwpage_sz = msc->pcc_chan->shmem_size; 261 msc->mapped_hwpage = io + sizeof(struct acpi_pcct_shared_memory); 262 } 263 264 list_add_rcu(&msc->glbl_list, &mpam_all_msc); 265 platform_set_drvdata(pdev, msc); 266 } while (0); 267 mutex_unlock(&mpam_list_lock); 268 269 if (!err) { 270 /* Create RIS entries described by firmware */ 271 if (!acpi_disabled) 272 err = acpi_mpam_parse_resources(msc, plat_data); 273 else 274 err = mpam_dt_parse_resources(msc, plat_data); 275 } 276 277 if (!err && fw_num_msc == mpam_num_msc) 278 mpam_discovery_complete(); 279 280 return err; 281 } 282 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/2] nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
by Kaixiong Yu 05 Sep '24

05 Sep '24

fix CVE-2023-52907 Fedor Pchelkin (1): nfc: pn533: initialize struct pn533_out_arg properly Minsuk Kang (1): nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() drivers/nfc/pn533/usb.c | 45 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 42 insertions(+), 3 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/1] zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
by Chen Ridong 05 Sep '24

05 Sep '24

zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING Oleg Nesterov (1): zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING kernel/pid_namespace.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
by Chen Ridong 05 Sep '24

05 Sep '24

zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING Oleg Nesterov (1): zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING kernel/pid_namespace.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/2] nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
by Kaixiong Yu 05 Sep '24

05 Sep '24

fix CVE-2023-52907 Fedor Pchelkin (1): nfc: pn533: initialize struct pn533_out_arg properly Minsuk Kang (1): nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() drivers/nfc/pn533/usb.c | 45 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 42 insertions(+), 3 deletions(-) -- 2.25.1

2 3

[openeuler:openEuler-1.0-LTS 23675/23694] block/blk-io-hierarchy/iodump.c:571:7: warning: no previous prototype for function '__bio_stage_hierarchy_start'
by kernel test robot 05 Sep '24

05 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bd317843995067c2f78bd884340fcd0a27acab8d commit: ac91631e9ef7b530c02e40d10085072c08fb4a0a [23675/23694] blk-io-hierarchy: support new stage for bio lifetime config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240905/202409051155.tjBfzaXC-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240905/202409051155.tjBfzaXC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409051155.tjBfzaXC-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from block/blk-io-hierarchy/iodump.c:15: In file included from include/linux/blktrace_api.h:5: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> block/blk-io-hierarchy/iodump.c:571:7: warning: no previous prototype for function '__bio_stage_hierarchy_start' [-Wmissing-prototypes] 571 | void *__bio_stage_hierarchy_start(struct bio_stage_dump_data *bstage_ddata, | ^ block/blk-io-hierarchy/iodump.c:571:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 571 | void *__bio_stage_hierarchy_start(struct bio_stage_dump_data *bstage_ddata, | ^ | static 2 warnings generated. vim +/__bio_stage_hierarchy_start +571 block/blk-io-hierarchy/iodump.c 570 > 571 void *__bio_stage_hierarchy_start(struct bio_stage_dump_data *bstage_ddata, 572 loff_t *pos) 573 { 574 struct pos_data *pdata = &bstage_ddata->pdata; 575 struct rq_dump_data *rq_ddata = &bstage_ddata->rq_ddata; 576 577 retry: 578 if (stage_is_bio(pdata->stage)) { 579 struct list_head *list; 580 struct bio_dump_data *bio_ddata = 581 get_bio_stage_ddata(rq_ddata->q, pdata->stage); 582 583 if (!bio_ddata) { 584 bio_stage_start_next_stage(bstage_ddata, pos); 585 goto retry; 586 } 587 588 spin_lock_irq(&bio_ddata->lock); 589 list = seq_list_start(&bio_ddata->head, pdata->count); 590 if (list) 591 return list; 592 593 spin_unlock_irq(&bio_ddata->lock); 594 bio_stage_start_next_stage(bstage_ddata, pos); 595 goto retry; 596 } 597 598 if (pdata->stage == STAGE_BIO && 599 __rq_hierarchy_start(rq_ddata, pdata->count)) 600 return bstage_ddata; 601 602 return NULL; 603 } 604 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
by Kaixiong Yu 05 Sep '24

05 Sep '24

fix CVE-2023-52907 Fedor Pchelkin (1): nfc: pn533: initialize struct pn533_out_arg properly Minsuk Kang (1): nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() drivers/nfc/pn533/usb.c | 45 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 42 insertions(+), 3 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10] Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
by Kaixiong Yu 05 Sep '24

05 Sep '24

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.222 commit 145faa3d03688cbb7bbaaecbd84c01539852942c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAD6H2 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 30139c702048f1097342a31302cbd3d478f50c63 upstream. Patch series "mm: Avoid possible overflows in dirty throttling". Dirty throttling logic assumes dirty limits in page units fit into 32-bits. This patch series makes sure this is true (see patch 2/2 for more details). This patch (of 2): This reverts commit 9319b647902cbd5cc884ac08a8a6d54ce111fc78. The commit is broken in several ways. Firstly, the removed (u64) cast from the multiplication will introduce a multiplication overflow on 32-bit archs if wb_thresh * bg_thresh >= 1<<32 (which is actually common - the default settings with 4GB of RAM will trigger this). Secondly, the div64_u64() is unnecessarily expensive on 32-bit archs. We have div64_ul() in case we want to be safe & cheap. Thirdly, if dirty thresholds are larger than 1<<32 pages, then dirty balancing is going to blow up in many other spectacular ways anyway so trying to fix one possible overflow is just moot. Link: https://lkml.kernel.org/r/20240621144017.30993-1-jack@suse.cz Link: https://lkml.kernel.org/r/20240621144246.11148-1-jack@suse.cz Fixes: 9319b647902c ("mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again") Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-By: Zach O'Keefe <zokeefe(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/page-writeback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/page-writeback.c b/mm/page-writeback.c index 0d7cc65c6367..31bc5904bbf8 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -1541,7 +1541,7 @@ static inline void wb_dirty_limits(struct dirty_throttle_control *dtc) */ dtc->wb_thresh = __wb_calc_thresh(dtc); dtc->wb_bg_thresh = dtc->thresh ? - div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; + div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; /* * In order to avoid the stacked BDI deadlock we need -- 2.25.1

2 1

[PATCH openEuler-23.09] Add dynamic kprobe-based process-level cgroup memory monitoring tool
by Taoxy2004 05 Sep '24

05 Sep '24

--- tools/probeCgroup: This patch introduces a new tool called "probeCgroup" that enables dynamic monitoring of memory usage at the process level within cgroups. By using kprobes at relevant cgroup functions, this tool can track memory allocations and deallocations for individual processes within a cgroup, providing detailed statistics on memory usage. The key features of the tool include: 1. Dynamic insertion of kprobes at critical points in the cgroup subsystem. 2. Tracking memory allocation and deallocation events for each process by recording page addresses in a hash table. 3. Providing real-time statistics on memory usage at the process level. 4. Providing statistics on memory usage for processes that are OOM. Signed-off-by: Taoxy2004 <221870066(a)smail.nju.edu.cn> --- tools/probeCgroup/Makefile | 7 + tools/probeCgroup/README.md | 29 + tools/probeCgroup/probeCgroup.c | 612 ++++++++++++++++++ tools/probeCgroup/probeCgroup.h | 415 ++++++++++++ tools/probeCgroup/run.sh | 8 + tools/probeCgroup/scripts/script1.sh | 10 + tools/probeCgroup/scripts/script2.sh | 14 + tools/probeCgroup/scripts/script3.sh | 11 + .../testcases/1_load_unload_test.py | 24 + .../testcases/2_multiple_process_test.py | 48 ++ .../testcases/3_multiple_cgroup_test.py | 55 ++ tools/probeCgroup/testcases/4_oom_test.py | 52 ++ .../testcases/5_multiple_threads_test.py | 45 ++ tools/probeCgroup/testcases/cgroup_utils.py | 115 ++++ tools/probeCgroup/testcases/mem-allocate.c | 35 + .../testcases/multiple-thread-mem-allocate.c | 60 ++ tools/probeCgroup/testcases/run.py | 32 + .../testcases/simple-mem-allocate.c | 27 + 18 files changed, 1599 insertions(+) create mode 100644 tools/probeCgroup/Makefile create mode 100644 tools/probeCgroup/README.md create mode 100644 tools/probeCgroup/probeCgroup.c create mode 100644 tools/probeCgroup/probeCgroup.h create mode 100755 tools/probeCgroup/run.sh create mode 100755 tools/probeCgroup/scripts/script1.sh create mode 100755 tools/probeCgroup/scripts/script2.sh create mode 100755 tools/probeCgroup/scripts/script3.sh create mode 100755 tools/probeCgroup/testcases/1_load_unload_test.py create mode 100755 tools/probeCgroup/testcases/2_multiple_process_test.py create mode 100755 tools/probeCgroup/testcases/3_multiple_cgroup_test.py create mode 100755 tools/probeCgroup/testcases/4_oom_test.py create mode 100755 tools/probeCgroup/testcases/5_multiple_threads_test.py create mode 100644 tools/probeCgroup/testcases/cgroup_utils.py create mode 100644 tools/probeCgroup/testcases/mem-allocate.c create mode 100644 tools/probeCgroup/testcases/multiple-thread-mem-allocate.c create mode 100755 tools/probeCgroup/testcases/run.py create mode 100644 tools/probeCgroup/testcases/simple-mem-allocate.c diff --git a/tools/probeCgroup/Makefile b/tools/probeCgroup/Makefile new file mode 100644 index 000000000000..606c951e5487 --- /dev/null +++ b/tools/probeCgroup/Makefile @@ -0,0 +1,7 @@ +obj-m := probeCgroup.o +CROSS_COMPILE = '' +KDIR := /lib/modules/$(shell uname -r)/build +all: + make -C $(KDIR) M=$(PWD) modules +clean: + rm -f *.ko *.o *.mod *.mod.o *.mod.c .*.cmd *.symvers module* diff --git a/tools/probeCgroup/README.md b/tools/probeCgroup/README.md new file mode 100644 index 000000000000..ff0b6fc21228 --- /dev/null +++ b/tools/probeCgroup/README.md @@ -0,0 +1,29 @@ +# probeCgroup + +#### Description +probeCgroup is a process-level cgroup memory monitoring tool based on dynamic tracing (kprobe/kretprobe) technology. By inserting kprobes and kretprobes at the entry and exit points of relevant cgroup functions, this tool can track the memory usage of individual processes within each cgroup in real time. + +#### Software Architecture +1. Dynamic Tracing : Insert kprobes and kretprobes at critical points in cgroup functions to capture memory allocation and release events. +2. Hash Table Recording : Record the addresses of pages currently used by each process in a hash table, so that when a page is released, the process it belongs to can be identified. +3. Real-Time Statistics : Provide real-time statistics showing the memory usage of individual processes within each cgroup. + +#### Instruction +1. Compile and Load the Module + a. In the 'probeCgroup' directory, run the 'make' command to compile the module. + b. Load the module: 'insmod probeCgroup.ko'. + c. View memory statistics: 'cat /proc/cgroup_memory_usage_per_process'. + If an OOM (Out of Memory) event occurs in a cgroup, you can see "oom:" followed by the process that experienced the OOM and its memory usage at the time. + +2. Automate OOM Scenario + In the 'probeCgroup' directory, run './run.sh'. This script will automatically set up an OOM scenario and output the content of '/proc/cgroup_memory_usage_per_process' after execution. + +3. Perform More Tests + a. After compiling the module, in the 'testcases' directory, run './run.py'. + b. This script will perform various tests, including: + - Loading and unloading the module + - Each cgroup containing multiple processes + - Creating multiple cgroups + - OOM scenarios + - Multithreading + c. The tests will take approximately one minute to complete. diff --git a/tools/probeCgroup/probeCgroup.c b/tools/probeCgroup/probeCgroup.c new file mode 100644 index 000000000000..9883cb1e082d --- /dev/null +++ b/tools/probeCgroup/probeCgroup.c @@ -0,0 +1,612 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * probeCgroup.c - A tool used to get memory usage for each process in a cgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include "probeCgroup.h" + +// kretprobe at mem_cgroup_charge +struct charge_data { + struct cgroup *cgrp; + struct mem_cgroup *memcg; + struct task_struct *task; + unsigned long addr; +}; + +static int mem_cgroup_charge_entry_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct charge_data *data; + struct folio *page; + struct mm_struct *mm; + struct mem_cgroup *memcg; + struct cgroup_subsys_state css; + struct cgroup *cgrp; + + if (!current->mm) + return 1; + page = (struct folio *)regs->di; + mm = (struct mm_struct *)regs->si; + if (mm == NULL || page == NULL) + return -1; + memcg = get_mem_cgroup_from_mm(mm); + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + + data = (struct charge_data *)ri->data; + data->memcg = memcg; + data->addr = (unsigned long)page; + data->task = current; + data->cgrp = cgrp; + } + return 0; +} + +NOKPROBE_SYMBOL(mem_cgroup_charge_entry_handler); + +static int mem_cgroup_charge_ret_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + unsigned long retval = regs_return_value(regs); + struct charge_data *data = (struct charge_data *)ri->data; + int id; + struct cgroup_info *cgrp_info; + struct task_info *tsk_info; + + if (data->memcg != NULL && retval == 0) { + id = ((data->memcg)->css).id; + + spin_lock(&lock); + cgrp_info = find_cgroup_info(id); + if (cgrp_info == NULL) { + cgrp_info = create_cgroup_info(data->cgrp, data->memcg); + if (cgrp_info == NULL) { + spin_unlock(&lock); + return -1; + } + add_cgroup_info(cgrp_info); + } + spin_unlock(&lock); + + read_lock(&cgrp_info->cgrp_lock); + tsk_info = find_task_info(cgrp_info, data->task->tgid); + read_unlock(&cgrp_info->cgrp_lock); + + // for some cases, task->comm changes over time + if (tsk_info != NULL + && strcmp(data->task->comm, tsk_info->comm) != 0) { + strscpy(tsk_info->comm, data->task->comm, + sizeof(tsk_info->comm)); + } + + if (tsk_info == NULL) { + tsk_info = create_task_info(data->task); + if (tsk_info == NULL) + return -1; + add_task_to_cgroup_info(cgrp_info, tsk_info); + } + + if (HashMap_insert(tsk_info->pages, data->addr)) { + //update counter + spin_lock(&(tsk_info->cnt_lock)); + tsk_info->count += + folio_nr_pages((struct folio *)data->addr); + spin_unlock(&(tsk_info->cnt_lock)); + } + } + + return 0; + +} + +NOKPROBE_SYMBOL(mem_cgroup_charge_ret_handler); + +static struct kretprobe mem_cgroup_charge_kretprobe = { + .handler = mem_cgroup_charge_ret_handler, + .entry_handler = mem_cgroup_charge_entry_handler, + .data_size = sizeof(struct charge_data), + .maxactive = 20, +}; + +static int mem_cgroup_charge_kretprobe_init(void) +{ + int ret; + + mem_cgroup_charge_kretprobe.kp.symbol_name = "__mem_cgroup_charge"; + ret = register_kretprobe(&mem_cgroup_charge_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); + return ret; + } + pr_info("Planted return probe at %s: %p\n", + mem_cgroup_charge_kretprobe.kp.symbol_name, + mem_cgroup_charge_kretprobe.kp.addr); + return 0; +} + +static void mem_cgroup_charge_kretprobe_exit(void) +{ + unregister_kretprobe(&mem_cgroup_charge_kretprobe); + pr_info("kretprobe at %p unregistered\n", + mem_cgroup_charge_kretprobe.kp.addr); + + /* nmissed > 0 suggests that maxactive was set too low. */ + pr_info("Missed probing %d instances of %s\n", + mem_cgroup_charge_kretprobe.nmissed, + mem_cgroup_charge_kretprobe.kp.symbol_name); +} + +// kretprobe at uncharge_folio + +struct uncharge_data { + struct cgroup *cgrp; + struct mem_cgroup *memcg; + unsigned long addr; + bool isKmem; + int nr_pages; +}; + +static int uncharge_folio_entry_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct uncharge_data *data; + struct folio *page; + struct mem_cgroup *memcg = NULL; + struct cgroup_subsys_state css; + struct cgroup *cgrp; + struct obj_cgroup *objcg; + int nr_pages = 0; + + data = (struct uncharge_data *)ri->data; + page = (struct folio *)regs->di; + if (page == NULL) { + data->memcg = NULL; + return -1; + } + if (page->memcg_data & MEMCG_DATA_KMEM) { // if the page belongs to kmem + if (!folio_test_large(page)) + nr_pages = 1; + else + nr_pages = page->_folio_nr_pages; + // nr_pages = thp_nr_pages(page); + objcg = __folio_objcg(page); + if (objcg != NULL) + memcg = objcg->memcg; + data->isKmem = true; + data->nr_pages = nr_pages; + } else { + memcg = __folio_memcg(page); + data->isKmem = false; + } + + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + + data->memcg = memcg; + data->addr = (unsigned long)page; + data->cgrp = cgrp; + } + return 0; +} + +NOKPROBE_SYMBOL(uncharge_folio_entry_handler); + +static int uncharge_folio_ret_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct uncharge_data *data = (struct uncharge_data *)ri->data; + int id; + struct cgroup_info *cgrp_info; + int ret = -1; + + if (data->memcg != NULL) { + id = ((data->memcg)->css).id; + cgrp_info = find_cgroup_info(id); + if (cgrp_info == NULL) + return -1; + if (data->isKmem) + ret = -1; + else + ret = remove_page_from_cgroup_info(data->addr, cgrp_info); + } + + return ret; +} + +NOKPROBE_SYMBOL(uncharge_folio_ret_handler); + +static struct kretprobe uncharge_folio_kretprobe = { + .handler = uncharge_folio_ret_handler, + .entry_handler = uncharge_folio_entry_handler, + .data_size = sizeof(struct uncharge_data), + .maxactive = 20, +}; + +static int uncharge_folio_kretprobe_init(void) +{ + int ret; + + uncharge_folio_kretprobe.kp.symbol_name = "uncharge_folio"; + ret = register_kretprobe(&uncharge_folio_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); + return ret; + } + pr_info("Planted return probe at %s: %p\n", + uncharge_folio_kretprobe.kp.symbol_name, + uncharge_folio_kretprobe.kp.addr); + return 0; +} + +static void uncharge_folio_kretprobe_exit(void) +{ + unregister_kretprobe(&uncharge_folio_kretprobe); + pr_info("kretprobe at %p unregistered\n", + uncharge_folio_kretprobe.kp.addr); + + /* nmissed > 0 suggests that maxactive was set too low. */ + pr_info("Missed probing %d instances of %s\n", + uncharge_folio_kretprobe.nmissed, + uncharge_folio_kretprobe.kp.symbol_name); +} + +//kprobe at do_exit +static struct kprobe do_exit_kprobe; +static int do_exit_kprobe_pre_handler(struct kprobe *p, struct pt_regs *regs) +{ + struct task_struct *cur = current; + int tgid = cur->tgid; + struct mm_struct *mm = cur->mm; + struct mem_cgroup *memcg = get_mem_cgroup_from_mm(mm); + struct cgroup_subsys_state css; + struct cgroup *cgrp; + struct cgroup_info *cgrp_info; + struct task_info *tsk_info; + int id; + + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + id = (memcg->css).id; + cgrp_info = find_cgroup_info(id); + if (cgrp_info != NULL) { + write_lock(&cgrp_info->cgrp_lock); + tsk_info = find_task_info(cgrp_info, tgid); + if (tsk_info != NULL) { + list_del(&tsk_info->list); + write_unlock(&cgrp_info->cgrp_lock); + remove_task_from_cgroup_info(cgrp_info, + tsk_info); + } else { + write_unlock(&cgrp_info->cgrp_lock); + } + return 0; + } + } + return 0; +} + +static void do_exit_kprobe_post_handler(struct kprobe *p, + struct pt_regs *regs, + unsigned long flags) +{ + +} + +static int do_exit_kprobe_init(void) +{ + do_exit_kprobe.pre_handler = do_exit_kprobe_pre_handler; + do_exit_kprobe.post_handler = do_exit_kprobe_post_handler; + do_exit_kprobe.symbol_name = "do_exit"; + if (register_kprobe(&do_exit_kprobe)) { + pr_alert("register_kprobe on do_exit failed!\n"); + return -EINVAL; + } + return 0; +} + +static void do_exit_kprobe_exit(void) +{ + unregister_kprobe(&do_exit_kprobe); +} + +//kprobe at mark_oom_victim +static struct kprobe mark_oom_victim_kprobe; + +static int mark_oom_victim_kprobe_pre_handler(struct kprobe *p, + struct pt_regs *regs) +{ + struct task_struct *victim; + int tgid; + struct mm_struct *mm; + struct mem_cgroup *memcg; + struct cgroup_subsys_state css; + struct cgroup *cgrp; + struct cgroup_info *cgrp_info; + struct task_info *tsk_info; + int id; + struct task_info *oom_info; + + victim = (struct task_struct *)regs->di; + tgid = victim->tgid; + mm = victim->mm; + memcg = get_mem_cgroup_from_mm(mm); + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + id = (memcg->css).id; + cgrp_info = find_cgroup_info(id); + if (cgrp_info != NULL) { + read_lock(&cgrp_info->cgrp_lock); + tsk_info = find_task_info(cgrp_info, tgid); + read_unlock(&cgrp_info->cgrp_lock); + if (tsk_info != NULL) { + oom_info = create_oom_task_info(tsk_info); + if (oom_info != NULL) { + add_oom_task_to_cgroup_info(cgrp_info, + oom_info); + } + return 0; + } + } + } + return 0; +} + +static void mark_oom_victim_kprobe_post_handler(struct kprobe *p, + struct pt_regs *regs, + unsigned long flags) +{ + +} + +static int mark_oom_victim_kprobe_init(void) +{ + mark_oom_victim_kprobe.pre_handler = mark_oom_victim_kprobe_pre_handler; + mark_oom_victim_kprobe.post_handler = + mark_oom_victim_kprobe_post_handler; + mark_oom_victim_kprobe.symbol_name = "mark_oom_victim"; + if (register_kprobe(&mark_oom_victim_kprobe)) { + pr_alert("register_kprobe on mark_oom_victim failed!\n"); + return -EINVAL; + } + return 0; +} + +static void mark_oom_victim_kprobe_exit(void) +{ + unregister_kprobe(&mark_oom_victim_kprobe); +} + +//kretporbe at cgroup_destroy_locked +struct destroy_data { + struct cgroup *cgrp; +}; + +static int cgroup_destroy_locked_entry_handler(struct kretprobe_instance + *ri, struct pt_regs *regs) +{ + struct destroy_data *data; + + data = (struct destroy_data *)ri->data; + data->cgrp = (struct cgroup *)regs->di; + return 0; +} + +NOKPROBE_SYMBOL(cgroup_destroy_locked_entry_handler); + +static int cgroup_destroy_locked_ret_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct destroy_data *data = (struct destroy_data *)ri->data; + struct cgroup *cgrp = data->cgrp; + struct cgroup_info *cgrp_info = NULL; + unsigned long retval = regs_return_value(regs); + + if (!cgrp) + return -1; + if (retval != 0) + return -1; + list_for_each_entry(cgrp_info, &all_cgroup_info, list) { + if (cgrp_info->cgrp == cgrp) { + spin_lock(&lock); + list_del(&cgrp_info->list); + spin_unlock(&lock); + destroy_cgroup_info(cgrp_info); + return 0; + } + } + return -1; +} + +NOKPROBE_SYMBOL(cgroup_destroy_locked_ret_handler); + +static struct kretprobe cgroup_destroy_locked_kretprobe = { + .handler = cgroup_destroy_locked_ret_handler, + .entry_handler = cgroup_destroy_locked_entry_handler, + .data_size = sizeof(struct destroy_data), + .maxactive = 20, +}; + +static int cgroup_destroy_locked_kretprobe_init(void) +{ + int ret; + + cgroup_destroy_locked_kretprobe.kp.symbol_name = + "cgroup_destroy_locked"; + ret = register_kretprobe(&cgroup_destroy_locked_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); + return ret; + } + pr_info("Planted return probe at %s: %p\n", + cgroup_destroy_locked_kretprobe.kp.symbol_name, + cgroup_destroy_locked_kretprobe.kp.addr); + return 0; +} + +static void cgroup_destroy_locked_kretprobe_exit(void) +{ + unregister_kretprobe(&cgroup_destroy_locked_kretprobe); + pr_info("kretprobe at %p unregistered\n", + cgroup_destroy_locked_kretprobe.kp.addr); + + /* nmissed > 0 suggests that maxactive was set too low. */ + pr_info("Missed probing %d instances of %s\n", + cgroup_destroy_locked_kretprobe.nmissed, + cgroup_destroy_locked_kretprobe.kp.symbol_name); +} + +// print the tasks in order of their memory usage +static void print_sorted_tasks_list(struct cgroup_info *cgrp_info, + int type, struct seq_file *m) +{ + struct list_head *cur, *insert_pos; + struct task_info *task, *insert_task; + struct list_head new_list = LIST_HEAD_INIT(new_list); + struct list_head *old_list; + struct task_info *new_task, *next_task; + + if (type == 0) { + if (cgrp_info == NULL) + return; + read_lock(&cgrp_info->cgrp_lock); + old_list = &cgrp_info->tasks_list; + } else { + if (cgrp_info == NULL) + return; + old_list = &cgrp_info->oom_list; + } + + list_for_each_entry_safe(task, insert_task, old_list, list) { + new_task = kmalloc(sizeof(struct task_info), GFP_ATOMIC); + if (!new_task) + return; + new_task->tgid = task->tgid; + strscpy(new_task->comm, task->comm, sizeof(new_task->comm)); + new_task->count = task->count; + new_task->pages = NULL; + INIT_LIST_HEAD(&new_task->list); + + //insertion sort + cur = &new_list; + insert_pos = cur->next; + while (insert_pos != &new_list) { + next_task = + list_entry(insert_pos, struct task_info, list); + if (new_task->count >= next_task->count) + break; + cur = insert_pos; + insert_pos = insert_pos->next; + } + + (&new_task->list)->prev = insert_pos->prev; + (insert_pos->prev)->next = (&new_task->list); + (&new_task->list)->next = insert_pos; + insert_pos->prev = (&new_task->list); + } + if (type == 0) + read_unlock(&cgrp_info->cgrp_lock); + + //print + if (type == 1 && (&new_list) != new_list.next) { + seq_puts(m, "oom:\n"); + seq_printf(m, "%10s %20s %20s\n", "pid", "command", + "memory usage (KB)"); + } + if (type == 0) + seq_printf(m, "%10s %20s %20s\n", "pid", "command", + "memory usage (KB)"); + list_for_each_entry_safe(task, insert_task, &new_list, list) { + seq_printf(m, "%10d %20s %20d\n", task->tgid, task->comm, + (task->count) * 4); + } + + list_for_each_entry_safe(task, insert_task, &new_list, list) { + list_del(&task->list); + kfree(task); + } +} + +static struct proc_dir_entry *cgroup_info_read; +#define procfs_file_read "cgroup_memory_usage_per_process" + +void seq_print_tasks(struct cgroup_info *cgroup_info, struct seq_file *m) +{ + if (!cgroup_info) + return; + + print_sorted_tasks_list(cgroup_info, 0, m); +} + +void seq_print_oom_tasks(struct cgroup_info *cgroup_info, struct seq_file *m) +{ + if (!cgroup_info) + return; + + print_sorted_tasks_list(cgroup_info, 1, m); +} + +void seq_print_cgroups(struct seq_file *m) +{ + struct cgroup_info *cgrp, *pos; + + spin_lock(&lock); + list_for_each_entry_safe(cgrp, pos, &all_cgroup_info, list) { + seq_printf(m, "cgroup name : %s\n", cgrp->name); + seq_print_tasks(cgrp, m); + seq_print_oom_tasks(cgrp, m); + seq_puts(m, "\n"); + } + spin_unlock(&lock); +} + +static int memory_usage_show(struct seq_file *m, void *v) +{ + seq_print_cgroups(m); + return 0; +} + +static int __init global_init(void) +{ + int ret = 0; + + cgroup_info_read = + proc_create_single(procfs_file_read, 0, NULL, memory_usage_show); + if (!cgroup_info_read) + return -ENOMEM; + ret = mem_cgroup_charge_kretprobe_init(); + uncharge_folio_kretprobe_init(); + do_exit_kprobe_init(); + mark_oom_victim_kprobe_init(); + cgroup_destroy_locked_kretprobe_init(); + + return ret; +} + +static void __exit global_exit(void) +{ + struct cgroup_info *cgrp_info, *pos; + + mem_cgroup_charge_kretprobe_exit(); + uncharge_folio_kretprobe_exit(); + do_exit_kprobe_exit(); + mark_oom_victim_kprobe_exit(); + cgroup_destroy_locked_kretprobe_exit(); + + remove_proc_entry(procfs_file_read, NULL); + + //release all memory use + list_for_each_entry_safe(cgrp_info, pos, &all_cgroup_info, list) { + list_del(&cgrp_info->list); + destroy_cgroup_info(cgrp_info); + } +} + +module_init(global_init) +module_exit(global_exit) +MODULE_LICENSE("GPL"); diff --git a/tools/probeCgroup/probeCgroup.h b/tools/probeCgroup/probeCgroup.h new file mode 100644 index 000000000000..953a6e0aca31 --- /dev/null +++ b/tools/probeCgroup/probeCgroup.h @@ -0,0 +1,415 @@ +/* SPDX-License-Identifier: GPL-2.0*/ +/* + * probeCgroup.h + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/kprobes.h> +#include <linux/ktime.h> +#include <linux/limits.h> +#include <linux/sched.h> +#include <linux/mm_types.h> +#include <linux/memcontrol.h> +#include <linux/cgroup-defs.h> +#include <linux/kernfs.h> +#include <linux/string.h> +#include <linux/list.h> +#include <linux/oom.h> +#include <linux/fs.h> +#include <linux/proc_fs.h> +#include <linux/huge_mm.h> +#include <linux/page-flags.h> +#include <linux/spinlock.h> +#include <linux/rwlock.h> + +static spinlock_t lock; // global lock for the list of cgroup_info + +struct HashNode { + unsigned long addr; + struct HashNode *next; +}; + +struct HashNode *HashNode_create(unsigned long addr) +{ + struct HashNode *node = NULL; + + node = kzalloc(sizeof(struct HashNode), GFP_ATOMIC); + if (node == NULL) + return NULL; + node->addr = addr; + node->next = NULL; + return node; +} + +struct HashBucket { + struct HashNode *head; + spinlock_t bkt_lock; +}; + +void HashBucket_init(struct HashBucket *bkt) +{ + bkt->head = NULL; + spin_lock_init(&bkt->bkt_lock); +} + +bool HashBucket_insert(struct HashBucket *bkt, unsigned long addr) +{ + struct HashNode *new_node; + struct HashNode *node; + struct HashNode *prev; + bool ret = true; + + if (bkt == NULL) + return false; + + prev = NULL; + new_node = NULL; + new_node = HashNode_create(addr); + + spin_lock(&bkt->bkt_lock); + node = bkt->head; + while (node != NULL && node->addr != addr) { + prev = node; + node = node->next; + } + if (node == NULL) { + if (new_node == NULL) { + pr_info("not enough memory for HashNode\n"); + spin_unlock(&bkt->bkt_lock); + return false; + } + if (bkt->head == NULL) + bkt->head = new_node; + else + prev->next = new_node; + spin_unlock(&bkt->bkt_lock); + ret = true; + } else { + spin_unlock(&bkt->bkt_lock); + kfree(new_node); + ret = false; + } + + return ret; +} + +bool HashBucket_erase(struct HashBucket *bkt, unsigned long addr) +{ + struct HashNode *node; + struct HashNode *prev; + bool ret = true; + + if (bkt == NULL) + return false; + + spin_lock(&bkt->bkt_lock); + node = bkt->head; + prev = NULL; + while (node != NULL && node->addr != addr) { + prev = node; + node = node->next; + } + if (node == NULL) { + spin_unlock(&bkt->bkt_lock); + ret = false; + } else { + if (bkt->head == node) + bkt->head = node->next; + else + prev->next = node->next; + kfree(node); + spin_unlock(&bkt->bkt_lock); + ret = true; + } + + return ret; +} + +void HashBucket_clear(struct HashBucket *bkt) +{ + struct HashNode *node; + struct HashNode *prev; + + if (bkt == NULL) + return; + + spin_lock(&bkt->bkt_lock); + node = bkt->head; + prev = NULL; + bkt->head = NULL; + while (node != NULL) { + prev = node; + node = node->next; + kfree(prev); + } + spin_unlock(&bkt->bkt_lock); +} + +struct HashMap { + unsigned long size; + struct HashBucket *HashTable; +}; + +unsigned long hash_func(unsigned long addr, unsigned long size) +{ + return addr % size; +} + +struct HashMap *HashMap_create(unsigned long size) +{ + struct HashMap *hm = NULL; + struct HashBucket *ht = NULL; + int i = 0; + + hm = kmalloc(sizeof(struct HashMap), GFP_ATOMIC); + if (hm == NULL) + return NULL; + ht = kmalloc((size * sizeof(struct HashBucket)), GFP_ATOMIC); + if (ht == NULL) { + kfree(hm); + return NULL; + } + for (i = 0; i < size; i++) + HashBucket_init(&(ht[i])); + + hm->size = size; + hm->HashTable = ht; + return hm; +} + +bool HashMap_insert(struct HashMap *hm, unsigned long addr) +{ + unsigned long index; + + if (hm == NULL) + return false; + index = hash_func(addr, hm->size); + if (hm->HashTable == NULL) + return false; + return HashBucket_insert(&(hm->HashTable[index]), addr); +} + +bool HashMap_erase(struct HashMap *hm, unsigned long addr) +{ + unsigned long index; + + if (hm == NULL) + return false; + index = hash_func(addr, hm->size); + if (hm->HashTable == NULL) + return false; + return HashBucket_erase(&(hm->HashTable[index]), addr); +} + +void HashMap_clear(struct HashMap *hm) +{ + unsigned long size; + struct HashBucket *ht; + int i; + + if (hm == NULL) + return; + size = hm->size; + ht = hm->HashTable; + if (ht == NULL) + return; + hm->HashTable = NULL; + for (i = 0; i < size; i++) + HashBucket_clear(&(ht[i])); + + kfree(ht); + kfree(hm); +} + +//struct that save the information for each task +struct task_info { + int tgid; + char comm[TASK_COMM_LEN]; + int count; // number of pages + struct HashMap *pages; + struct list_head list; + spinlock_t cnt_lock; +}; + +// struct that save the information for each cgroup +struct cgroup_info { + struct cgroup *cgrp; + struct mem_cgroup *memcg; + int id; + char name[64]; + struct list_head list; + struct list_head tasks_list; + struct list_head oom_list; + rwlock_t cgrp_lock; + unsigned int cached_bytes; +}; + +static LIST_HEAD(all_cgroup_info); // a list that linked all the cgroup_info struct + +static struct task_info *create_task_info(struct task_struct *cur_task) +{ + struct task_info *tsk_info = + kmalloc(sizeof(struct task_info), GFP_ATOMIC); + if (!tsk_info) + return NULL; + + // initialization + tsk_info->tgid = cur_task->tgid; + strscpy(tsk_info->comm, cur_task->comm, sizeof(tsk_info->comm)); + tsk_info->count = 0; + tsk_info->pages = NULL; + tsk_info->pages = HashMap_create(1023); + INIT_LIST_HEAD(&tsk_info->list); + spin_lock_init(&(tsk_info->cnt_lock)); + + return tsk_info; +} + +static int +add_task_to_cgroup_info(struct cgroup_info *cgrp, struct task_info *task) +{ + if (!cgrp || !task) + return -EINVAL; + + write_lock(&cgrp->cgrp_lock); + list_add_tail(&task->list, &cgrp->tasks_list); + write_unlock(&cgrp->cgrp_lock); + return 0; +} + +static int +remove_task_from_cgroup_info(struct cgroup_info *cgrp, struct task_info *task) +{ + if (cgrp == NULL || task == NULL) + return -EINVAL; + + HashMap_clear(task->pages); + // kfree(task->pages); + kfree(task); + return 0; +} + +static struct task_info *find_task_info(struct cgroup_info *cgrp, int tgid) +{ + struct task_info *tsk_info, *pos; + + list_for_each_entry_safe(tsk_info, pos, &cgrp->tasks_list, list) { + if (tsk_info->tgid == tgid) + return tsk_info; + } + return NULL; +} + +static int +remove_page_from_cgroup_info(unsigned long addr, struct cgroup_info *cgrp) +{ + struct task_info *tsk_info, *pos; + + read_lock(&cgrp->cgrp_lock); + list_for_each_entry_safe(tsk_info, pos, &cgrp->tasks_list, list) { + if (HashMap_erase(tsk_info->pages, addr)) { + spin_lock(&(tsk_info->cnt_lock)); + tsk_info->count -= folio_nr_pages((struct folio *)addr); + spin_unlock(&(tsk_info->cnt_lock)); + read_unlock(&cgrp->cgrp_lock); + return 0; + } + } + read_unlock(&cgrp->cgrp_lock); + return -1; +} + +static struct cgroup_info *create_cgroup_info(struct cgroup *cgrp, + struct mem_cgroup *memcg) +{ + struct cgroup_info *cgrp_info = + kmalloc(sizeof(struct cgroup_info), GFP_ATOMIC); + struct kernfs_node *kn; + + if (!cgrp_info) + return NULL; + + cgrp_info->cgrp = cgrp; + cgrp_info->memcg = memcg; + cgrp_info->id = (memcg->css).id; + kn = cgrp->kn; + strscpy(cgrp_info->name, kn->name, sizeof(cgrp_info->name)); + INIT_LIST_HEAD(&cgrp_info->list); + INIT_LIST_HEAD(&cgrp_info->tasks_list); + INIT_LIST_HEAD(&cgrp_info->oom_list); + rwlock_init(&(cgrp_info->cgrp_lock)); + cgrp_info->cached_bytes = 0; + + return cgrp_info; +} + +static void destroy_cgroup_info(struct cgroup_info *cgrp_info) +{ + struct task_info *task, *tmp; + + if (!cgrp_info) + return; + + write_lock(&cgrp_info->cgrp_lock); + list_for_each_entry_safe(task, tmp, &cgrp_info->tasks_list, list) { + list_del(&task->list); + remove_task_from_cgroup_info(cgrp_info, task); + } + write_unlock(&cgrp_info->cgrp_lock); + list_for_each_entry_safe(task, tmp, &cgrp_info->oom_list, list) { + list_del(&task->list); + remove_task_from_cgroup_info(cgrp_info, task); + } + + kfree(cgrp_info); +} + +static int add_cgroup_info(struct cgroup_info *cgrp_info) +{ + if (!cgrp_info) + return -EINVAL; + + list_add_tail(&cgrp_info->list, &all_cgroup_info); + return 0; +} + +static struct cgroup_info *find_cgroup_info(int id) +{ + struct cgroup_info *cgrp_info = NULL; + + list_for_each_entry(cgrp_info, &all_cgroup_info, list) { + if (cgrp_info->id == id) + return cgrp_info; + } + + return NULL; +} + +static struct task_info *create_oom_task_info(struct task_info *tsk_info) +{ + struct task_info *oom_tsk_info = + kmalloc(sizeof(struct task_info), GFP_ATOMIC); + if (!oom_tsk_info) + return NULL; + + oom_tsk_info->tgid = tsk_info->tgid; + strscpy(oom_tsk_info->comm, tsk_info->comm, sizeof(oom_tsk_info->comm)); + oom_tsk_info->count = tsk_info->count; + oom_tsk_info->pages = NULL; + INIT_LIST_HEAD(&oom_tsk_info->list); + + return oom_tsk_info; +} + +static int +add_oom_task_to_cgroup_info(struct cgroup_info *cgrp, + struct task_info *oom_task) +{ + if (!cgrp || !oom_task) + return -EINVAL; + list_add_tail(&oom_task->list, &cgrp->oom_list); + return 0; +} diff --git a/tools/probeCgroup/run.sh b/tools/probeCgroup/run.sh new file mode 100755 index 000000000000..7e1ffefe66d1 --- /dev/null +++ b/tools/probeCgroup/run.sh @@ -0,0 +1,8 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +cd scripts +./script1.sh +./script2.sh +./script3.sh diff --git a/tools/probeCgroup/scripts/script1.sh b/tools/probeCgroup/scripts/script1.sh new file mode 100755 index 000000000000..539e8258afb9 --- /dev/null +++ b/tools/probeCgroup/scripts/script1.sh @@ -0,0 +1,10 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +cd .. +make +insmod probeCgroup.ko + +cd testcases +gcc simple-mem-allocate.c -o simple-mem-allocate diff --git a/tools/probeCgroup/scripts/script2.sh b/tools/probeCgroup/scripts/script2.sh new file mode 100755 index 000000000000..2ad515cfb912 --- /dev/null +++ b/tools/probeCgroup/scripts/script2.sh @@ -0,0 +1,14 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +current_dir=$(pwd) +cd /sys/fs/cgroup/memory +mkdir test +cd test +sh -c "echo $$ >> cgroup.procs" +sh -c "echo 5M > memory.limit_in_bytes" +sh -c "echo 0 > memory.swappiness" +cd "$current_dir" +cd ../testcases +./simple-mem-allocate diff --git a/tools/probeCgroup/scripts/script3.sh b/tools/probeCgroup/scripts/script3.sh new file mode 100755 index 000000000000..127eb45de5c9 --- /dev/null +++ b/tools/probeCgroup/scripts/script3.sh @@ -0,0 +1,11 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +cd /proc +cat cgroup_memory_usage_per_process + +cat /sys/fs/cgroup/memory/test/cgroup.procs > /sys/fs/cgroup/memory/cgroup.procs +rmdir /sys/fs/cgroup/memory/test +# cat cgroup_memory_usage_per_process +rmmod probeCgroup diff --git a/tools/probeCgroup/testcases/1_load_unload_test.py b/tools/probeCgroup/testcases/1_load_unload_test.py new file mode 100755 index 000000000000..5389a14a1dac --- /dev/null +++ b/tools/probeCgroup/testcases/1_load_unload_test.py @@ -0,0 +1,24 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +import os +import subprocess +import time + +def test_module_load_unload(): + try: + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + print('loading module successfully!') + subprocess.check_call(['rmmod', 'probeCgroup']) + output = subprocess.check_output(['lsmod']) + assert b'probeCgroup' not in output + print('unloading module successfully!') + except subprocess.CalledProcessError as e: + print('Load unload test failed. Insmod failed.') + except AssertionError as e: + print('Load unload test failed. Cannot remove module.') + +if __name__ == '__main__': + test_module_load_unload() \ No newline at end of file diff --git a/tools/probeCgroup/testcases/2_multiple_process_test.py b/tools/probeCgroup/testcases/2_multiple_process_test.py new file mode 100755 index 000000000000..d88c7f7f2952 --- /dev/null +++ b/tools/probeCgroup/testcases/2_multiple_process_test.py @@ -0,0 +1,48 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup, check_kmem_usage +import os +import subprocess +import time + +def test_multiple_process(num_procs): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroup_name = 'test' + cgroup_path = create_cgroup(cgroup_name) + + processes = [] + pids = [] + + for i in range(num_procs): + process = subprocess.Popen(['./mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + processes.append(process) + pids.append(pid) + + time.sleep(0.1) + try: + count = 0 + for i in range (2000): + count += check_memory_usage(cgroup_name, pids, False) + time.sleep(0.01) + assert count <= 50, f"Memory read by probeCgroup is not accurate" + + remove_cgroup(cgroup_path, pids) + check_memory_usage(cgroup_name, pids, True) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass multiple process test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + remove_cgroup(cgroup_path, pids) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_multiple_process(3) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/3_multiple_cgroup_test.py b/tools/probeCgroup/testcases/3_multiple_cgroup_test.py new file mode 100755 index 000000000000..592a716df877 --- /dev/null +++ b/tools/probeCgroup/testcases/3_multiple_cgroup_test.py @@ -0,0 +1,55 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup +import os +import subprocess +import time + +def test_multiple_cgroup(num_procs, num_cgroups): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroups = [] + processes = {} + pids = {} + for i in range(num_cgroups): + cgroup_name = f'test_{i}' + cgroup_path = create_cgroup(cgroup_name) + cgroups.append((cgroup_name, cgroup_path)) + + for j in range(num_procs): + process = subprocess.Popen(['./mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + if cgroup_path not in processes: + processes[cgroup_path] = [] + processes[cgroup_path].append(process) + if cgroup_path not in pids: + pids[cgroup_path] = [] + pids[cgroup_path].append(pid) + + time.sleep(0.1) + try: + for i in range (100): + for cgroup_name, cgroup_path in cgroups: + check_memory_usage(cgroup_name, pids[cgroup_path], False) + time.sleep(0.01) + + for cgroup_name, cgroup_path in cgroups: + remove_cgroup(cgroup_path, pids[cgroup_path]) + check_memory_usage(cgroup_name, pids[cgroup_path], True) + cleanup(processes[cgroup_path]) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass multiple cgroup test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + for cgroup_name, cgroup_path in cgroups: + remove_cgroup(cgroup_path, pids[cgroup_path]) + cleanup(processes[cgroup_path]) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_multiple_cgroup(2,2) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/4_oom_test.py b/tools/probeCgroup/testcases/4_oom_test.py new file mode 100755 index 000000000000..128a258c56f5 --- /dev/null +++ b/tools/probeCgroup/testcases/4_oom_test.py @@ -0,0 +1,52 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup, get_oom_process_memory_usage +import os +import subprocess +import time + +def test_oom(num_procs): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroup_name = 'test' + cgroup_path = create_cgroup(cgroup_name) + + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.limit_in_bytes", 'w') as limit_file: + limit_file.write("5M") + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.swappiness", 'w') as swap_file: + swap_file.write("0") + + processes = [] + pids = [] + for i in range(num_procs): + process = subprocess.Popen(['./simple-mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + processes.append(process) + pids.append(pid) + + time.sleep(6) + + try: + for pid in pids: + memory_usage = get_oom_process_memory_usage(pid, cgroup_name) + assert memory_usage is not None, f"Memory usage(oom) not found for PID {pid}" + assert memory_usage > 0, f"Memory usage should be greater than zero for PID {pid}" + + remove_cgroup(cgroup_path, pids) + check_memory_usage(cgroup_name, pids, True) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass oom test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + remove_cgroup(cgroup_path, pids) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_oom(1) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/5_multiple_threads_test.py b/tools/probeCgroup/testcases/5_multiple_threads_test.py new file mode 100755 index 000000000000..7e1b86dabe48 --- /dev/null +++ b/tools/probeCgroup/testcases/5_multiple_threads_test.py @@ -0,0 +1,45 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup, check_kmem_usage +import os +import subprocess +import time + +def test_multiple_thread(num_procs): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroup_name = 'test' + cgroup_path = create_cgroup(cgroup_name) + + processes = [] + pids = [] + for i in range(num_procs): + process = subprocess.Popen(['./multiple-thread-mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + processes.append(process) + pids.append(pid) + + time.sleep(1) + try: + for i in range (200): + check_memory_usage(cgroup_name, pids, False) + time.sleep(0.01) + + remove_cgroup(cgroup_path, pids) + check_memory_usage(cgroup_name, pids, True) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass multiple threads test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + remove_cgroup(cgroup_path, pids) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_multiple_thread(5) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/cgroup_utils.py b/tools/probeCgroup/testcases/cgroup_utils.py new file mode 100644 index 000000000000..f70c68c1f188 --- /dev/null +++ b/tools/probeCgroup/testcases/cgroup_utils.py @@ -0,0 +1,115 @@ +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +import os +import subprocess +import time + +def create_cgroup(cgroup_name): + cgroup_path = f'/sys/fs/cgroup/memory/{cgroup_name}' + + try: + os.makedirs(cgroup_path) + except FileExistsError: + pass + + return cgroup_path + +def add_process_to_cgroup(cgroup_path, pid): + with open(os.path.join(cgroup_path, 'cgroup.procs'), 'w') as procs_file: + procs_file.write(str(pid)) + +def get_process_memory_usage(pid, cgroup_name): + cur_name = '' + with open('/proc/cgroup_memory_usage_per_process', 'r') as file: + for line in file: + parts = line.strip().split() + if len(parts) >= 4 and parts[0] == 'cgroup': + cur_name = parts[3] + if len(parts) >= 3 and parts[0] != 'cgroup' and cur_name == cgroup_name and parts[0] != 'pid' and int(parts[0]) == pid: + return int(parts[2]) + return None + +def get_process_kmem_usage(pid, cgroup_name): + cur_name = '' + with open('/proc/cgroup_memory_usage_per_process', 'r') as file: + for line in file: + parts = line.strip().split() + if len(parts) >= 4 and parts[0] == 'cgroup': + cur_name = parts[3] + if len(parts) >= 4 and parts[0] != 'cgroup' and cur_name == cgroup_name and parts[0] != 'pid' and int(parts[0]) == pid: + return int(parts[3]) + return None + +def remove_cgroup(cgroup_path, pids): + for pid in pids: + with open('/sys/fs/cgroup/memory/cgroup.procs', 'w') as backup_file: + backup_file.write(str(pid)) + os.rmdir(cgroup_path) + return + +def check_memory_usage(cgroup_name, pids, delete): + memory_sum = 0 + for pid in pids: + memory_usage = get_process_memory_usage(pid, cgroup_name) + if delete == False: + assert memory_usage is not None, f"Memory usage not found for PID {pid}" + assert memory_usage >= 0, f"Memory usage should be greater than zero for PID {pid}" + memory_sum += memory_usage + else: + assert memory_usage is None, f"Error: Memory usage should not be available for PID {pid} after deleting the cgroup." + if delete == False: + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.usage_in_bytes", 'r') as file: + content = file.readline().strip() + memory_read = int(content) + memory_sum *= 1024 + delta = abs(memory_read - memory_sum) + # print(f"read: {memory_read}") + # print(f"sum : {memory_sum}") + if (delta > max(memory_read, memory_sum) * 0.1): + return 1 + else: + return 0 + else: + return 0 + +def check_kmem_usage(cgroup_name, pids, delete): + kmem_sum = 0 + for pid in pids: + kmem_usage = get_process_kmem_usage(pid, cgroup_name) + if delete == False: + assert kmem_usage is not None, f"Kmem usage not found for PID {pid}" + assert kmem_usage >= 0, f"Kmem usage should be greater than zero for PID {pid}" + kmem_sum += kmem_usage + else: + assert kmem_usage is None, f"Error: Kmem usage should not be available for PID {pid} after deleting the cgroup." + if delete == False: + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.kmem.usage_in_bytes", 'r') as file: + content = file.readline().strip() + kmem_read = int(content) + kmem_sum *= 1024 + delta = abs(kmem_read - kmem_sum) + # print(f"kmem read: {kmem_read}") + # print(f"kmem sum : {kmem_sum}") + # assert delta <= max(kmem_read, kmem_sum) * 0.2, f"Kmem read by probeCgroup is not accurate, {kmem_read}, {kmem_sum}" + +def cleanup(processes): + for process in processes: + process.terminate() + process.wait() + +def get_oom_process_memory_usage(pid, cgroup_name): + # �� + cur_name = '' + oom = False + with open('/proc/cgroup_memory_usage_per_process', 'r') as file: + for line in file: + parts = line.strip().split() + if len(parts) >= 4 and parts[0] == 'cgroup': + cur_name = parts[3] + oom = False + if len(parts) >= 1 and parts[0] == 'oom:': + oom = True + if len(parts) >= 3 and parts[0] != 'cgroup' and cur_name == cgroup_name and parts[0] != 'pid' and int(parts[0]) == pid and oom == True: + return int(parts[2]) + return None \ No newline at end of file diff --git a/tools/probeCgroup/testcases/mem-allocate.c b/tools/probeCgroup/testcases/mem-allocate.c new file mode 100644 index 000000000000..e78e37cae61b --- /dev/null +++ b/tools/probeCgroup/testcases/mem-allocate.c @@ -0,0 +1,35 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * mem-allocate.c - The program to test probeCgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> + +#define MB (1024 * 1024) + +char *arr[40]; + +int main(int argc, char *argv[]) +{ + char *p; + int i = 0; + + while (1) { + for (i = 0; i < 40; i++) { + p = (char *)malloc(MB); + memset(p, 0, MB); + arr[i] = p; + usleep(100000); + } + for (int i = 0; i < 40; i++) { + free(arr[i]); + usleep(100000); + } + } + return 0; +} diff --git a/tools/probeCgroup/testcases/multiple-thread-mem-allocate.c b/tools/probeCgroup/testcases/multiple-thread-mem-allocate.c new file mode 100644 index 000000000000..55f4c068f55e --- /dev/null +++ b/tools/probeCgroup/testcases/multiple-thread-mem-allocate.c @@ -0,0 +1,60 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * multiple-thread-mem-allocate.c - The program to test probeCgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> +#include <pthread.h> + +#define MB (1024 * 1024) + +void *memory_test(void *) +{ + char *arr[25]; + char *p; + int i = 0; + int cnt = 0; + + while (1) { + for (i = 0; i < 20; i++) { + p = (char *)malloc(MB); + memset(p, 0, MB); + arr[i] = p; + usleep(10000); + } + for (int i = 0; i < 20; i++) { + free(arr[i]); + usleep(10000); + } + } +} + +int main(int argc, char *argv[]) +{ + pthread_t threads[4]; + int rc; + + // create threads + for (int i = 0; i < 4; i++) { + rc = pthread_create(&threads[i], NULL, memory_test, NULL); + if (rc != 0) { + fprintf(stderr, "Error creating thread: %d\n", rc); + return 1; + } + } + + for (int i = 0; i < 4; i++) { + rc = pthread_join(threads[i], NULL); + if (rc != 0) { + fprintf(stderr, "Error joining thread: %d\n", rc); + return 1; + } + } + + return 0; +} diff --git a/tools/probeCgroup/testcases/run.py b/tools/probeCgroup/testcases/run.py new file mode 100755 index 000000000000..8ffd0ca720d8 --- /dev/null +++ b/tools/probeCgroup/testcases/run.py @@ -0,0 +1,32 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +import os +import subprocess +import sys + +def run_tests(directory): + """Run all Python scripts in the given directory.""" + python_files = [f for f in os.listdir(directory) if f.endswith('test.py')] + python_files.sort() + + for filename in python_files: + try: + filepath = os.path.join(directory, filename) + + subprocess.check_call([sys.executable, filepath]) + except subprocess.CalledProcessError as e: + print(f"Error executing {filename}:") + return + except Exception as e: + print(f"Error executing {filename}:") + print(e) + return + +if __name__ == '__main__': + tests_directory = '.' + subprocess.check_call(['gcc', 'mem-allocate.c', '-o', 'mem-allocate']) + subprocess.check_call(['gcc', 'simple-mem-allocate.c', '-o', 'simple-mem-allocate']) + subprocess.check_call(['gcc', 'multiple-thread-mem-allocate.c', '-o', 'multiple-thread-mem-allocate']) + run_tests(tests_directory) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/simple-mem-allocate.c b/tools/probeCgroup/testcases/simple-mem-allocate.c new file mode 100644 index 000000000000..16328b10ba48 --- /dev/null +++ b/tools/probeCgroup/testcases/simple-mem-allocate.c @@ -0,0 +1,27 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * mem-allocate.c - The program to test probeCgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> + +#define MB (1024 * 1024) + +int main(int argc, char *argv[]) +{ + char *p; + int i = 0; + + while (1) { + p = (char *)malloc(MB); + memset(p, 0, MB); + sleep(1); + } + + return 0; +} -- 2.43.0

2 1

[PATCH OLK-6.6 0/4] Some fixes About cpuset partition
by Chen Ridong 05 Sep '24

05 Sep '24

Chen Ridong (1): cgroup/cpuset: fix panic caused by partcmd_update Waiman Long (3): cgroup/cpuset: Optimize isolated partition only generate_sched_domains() calls cgroup/cpuset: Fix remote root partition creation problem cgroup/cpuset: Clear effective_xcpus on cpus_allowed clearing only if cpus.exclusive not set kernel/cgroup/cpuset.c | 68 +++++++++++++++++++++++++++++++++--------- 1 file changed, 54 insertions(+), 14 deletions(-) -- 2.34.1

2 5

[PATCH penEuler-23.09] Add dynamic kprobe-based process-level cgroup memory monitoring tool
by Taoxy2004 05 Sep '24

05 Sep '24

--- tools/probeCgroup: This patch introduces a new tool called "probeCgroup" that enables dynamic monitoring of memory usage at the process level within cgroups. By using kprobes at relevant cgroup functions, this tool can track memory allocations and deallocations for individual processes within a cgroup, providing detailed statistics on memory usage. The key features of the tool include: 1. Dynamic insertion of kprobes at critical points in the cgroup subsystem. 2. Tracking memory allocation and deallocation events for each process by recording page addresses in a hash table. 3. Providing real-time statistics on memory usage at the process level. 4. Providing statistics on memory usage for processes that are OOM. Signed-off-by: Taoxy2004 <221870066(a)smail.nju.edu.cn> --- tools/probeCgroup/Makefile | 7 + tools/probeCgroup/README.md | 29 + tools/probeCgroup/probeCgroup.c | 612 ++++++++++++++++++ tools/probeCgroup/probeCgroup.h | 415 ++++++++++++ tools/probeCgroup/run.sh | 8 + tools/probeCgroup/scripts/script1.sh | 10 + tools/probeCgroup/scripts/script2.sh | 14 + tools/probeCgroup/scripts/script3.sh | 11 + .../testcases/1_load_unload_test.py | 24 + .../testcases/2_multiple_process_test.py | 48 ++ .../testcases/3_multiple_cgroup_test.py | 55 ++ tools/probeCgroup/testcases/4_oom_test.py | 52 ++ .../testcases/5_multiple_threads_test.py | 45 ++ tools/probeCgroup/testcases/cgroup_utils.py | 115 ++++ tools/probeCgroup/testcases/mem-allocate.c | 35 + .../testcases/multiple-thread-mem-allocate.c | 60 ++ tools/probeCgroup/testcases/run.py | 32 + .../testcases/simple-mem-allocate.c | 27 + 18 files changed, 1599 insertions(+) create mode 100644 tools/probeCgroup/Makefile create mode 100644 tools/probeCgroup/README.md create mode 100644 tools/probeCgroup/probeCgroup.c create mode 100644 tools/probeCgroup/probeCgroup.h create mode 100755 tools/probeCgroup/run.sh create mode 100755 tools/probeCgroup/scripts/script1.sh create mode 100755 tools/probeCgroup/scripts/script2.sh create mode 100755 tools/probeCgroup/scripts/script3.sh create mode 100755 tools/probeCgroup/testcases/1_load_unload_test.py create mode 100755 tools/probeCgroup/testcases/2_multiple_process_test.py create mode 100755 tools/probeCgroup/testcases/3_multiple_cgroup_test.py create mode 100755 tools/probeCgroup/testcases/4_oom_test.py create mode 100755 tools/probeCgroup/testcases/5_multiple_threads_test.py create mode 100644 tools/probeCgroup/testcases/cgroup_utils.py create mode 100644 tools/probeCgroup/testcases/mem-allocate.c create mode 100644 tools/probeCgroup/testcases/multiple-thread-mem-allocate.c create mode 100755 tools/probeCgroup/testcases/run.py create mode 100644 tools/probeCgroup/testcases/simple-mem-allocate.c diff --git a/tools/probeCgroup/Makefile b/tools/probeCgroup/Makefile new file mode 100644 index 000000000000..606c951e5487 --- /dev/null +++ b/tools/probeCgroup/Makefile @@ -0,0 +1,7 @@ +obj-m := probeCgroup.o +CROSS_COMPILE = '' +KDIR := /lib/modules/$(shell uname -r)/build +all: + make -C $(KDIR) M=$(PWD) modules +clean: + rm -f *.ko *.o *.mod *.mod.o *.mod.c .*.cmd *.symvers module* diff --git a/tools/probeCgroup/README.md b/tools/probeCgroup/README.md new file mode 100644 index 000000000000..ff0b6fc21228 --- /dev/null +++ b/tools/probeCgroup/README.md @@ -0,0 +1,29 @@ +# probeCgroup + +#### Description +probeCgroup is a process-level cgroup memory monitoring tool based on dynamic tracing (kprobe/kretprobe) technology. By inserting kprobes and kretprobes at the entry and exit points of relevant cgroup functions, this tool can track the memory usage of individual processes within each cgroup in real time. + +#### Software Architecture +1. Dynamic Tracing : Insert kprobes and kretprobes at critical points in cgroup functions to capture memory allocation and release events. +2. Hash Table Recording : Record the addresses of pages currently used by each process in a hash table, so that when a page is released, the process it belongs to can be identified. +3. Real-Time Statistics : Provide real-time statistics showing the memory usage of individual processes within each cgroup. + +#### Instruction +1. Compile and Load the Module + a. In the 'probeCgroup' directory, run the 'make' command to compile the module. + b. Load the module: 'insmod probeCgroup.ko'. + c. View memory statistics: 'cat /proc/cgroup_memory_usage_per_process'. + If an OOM (Out of Memory) event occurs in a cgroup, you can see "oom:" followed by the process that experienced the OOM and its memory usage at the time. + +2. Automate OOM Scenario + In the 'probeCgroup' directory, run './run.sh'. This script will automatically set up an OOM scenario and output the content of '/proc/cgroup_memory_usage_per_process' after execution. + +3. Perform More Tests + a. After compiling the module, in the 'testcases' directory, run './run.py'. + b. This script will perform various tests, including: + - Loading and unloading the module + - Each cgroup containing multiple processes + - Creating multiple cgroups + - OOM scenarios + - Multithreading + c. The tests will take approximately one minute to complete. diff --git a/tools/probeCgroup/probeCgroup.c b/tools/probeCgroup/probeCgroup.c new file mode 100644 index 000000000000..9883cb1e082d --- /dev/null +++ b/tools/probeCgroup/probeCgroup.c @@ -0,0 +1,612 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * probeCgroup.c - A tool used to get memory usage for each process in a cgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include "probeCgroup.h" + +// kretprobe at mem_cgroup_charge +struct charge_data { + struct cgroup *cgrp; + struct mem_cgroup *memcg; + struct task_struct *task; + unsigned long addr; +}; + +static int mem_cgroup_charge_entry_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct charge_data *data; + struct folio *page; + struct mm_struct *mm; + struct mem_cgroup *memcg; + struct cgroup_subsys_state css; + struct cgroup *cgrp; + + if (!current->mm) + return 1; + page = (struct folio *)regs->di; + mm = (struct mm_struct *)regs->si; + if (mm == NULL || page == NULL) + return -1; + memcg = get_mem_cgroup_from_mm(mm); + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + + data = (struct charge_data *)ri->data; + data->memcg = memcg; + data->addr = (unsigned long)page; + data->task = current; + data->cgrp = cgrp; + } + return 0; +} + +NOKPROBE_SYMBOL(mem_cgroup_charge_entry_handler); + +static int mem_cgroup_charge_ret_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + unsigned long retval = regs_return_value(regs); + struct charge_data *data = (struct charge_data *)ri->data; + int id; + struct cgroup_info *cgrp_info; + struct task_info *tsk_info; + + if (data->memcg != NULL && retval == 0) { + id = ((data->memcg)->css).id; + + spin_lock(&lock); + cgrp_info = find_cgroup_info(id); + if (cgrp_info == NULL) { + cgrp_info = create_cgroup_info(data->cgrp, data->memcg); + if (cgrp_info == NULL) { + spin_unlock(&lock); + return -1; + } + add_cgroup_info(cgrp_info); + } + spin_unlock(&lock); + + read_lock(&cgrp_info->cgrp_lock); + tsk_info = find_task_info(cgrp_info, data->task->tgid); + read_unlock(&cgrp_info->cgrp_lock); + + // for some cases, task->comm changes over time + if (tsk_info != NULL + && strcmp(data->task->comm, tsk_info->comm) != 0) { + strscpy(tsk_info->comm, data->task->comm, + sizeof(tsk_info->comm)); + } + + if (tsk_info == NULL) { + tsk_info = create_task_info(data->task); + if (tsk_info == NULL) + return -1; + add_task_to_cgroup_info(cgrp_info, tsk_info); + } + + if (HashMap_insert(tsk_info->pages, data->addr)) { + //update counter + spin_lock(&(tsk_info->cnt_lock)); + tsk_info->count += + folio_nr_pages((struct folio *)data->addr); + spin_unlock(&(tsk_info->cnt_lock)); + } + } + + return 0; + +} + +NOKPROBE_SYMBOL(mem_cgroup_charge_ret_handler); + +static struct kretprobe mem_cgroup_charge_kretprobe = { + .handler = mem_cgroup_charge_ret_handler, + .entry_handler = mem_cgroup_charge_entry_handler, + .data_size = sizeof(struct charge_data), + .maxactive = 20, +}; + +static int mem_cgroup_charge_kretprobe_init(void) +{ + int ret; + + mem_cgroup_charge_kretprobe.kp.symbol_name = "__mem_cgroup_charge"; + ret = register_kretprobe(&mem_cgroup_charge_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); + return ret; + } + pr_info("Planted return probe at %s: %p\n", + mem_cgroup_charge_kretprobe.kp.symbol_name, + mem_cgroup_charge_kretprobe.kp.addr); + return 0; +} + +static void mem_cgroup_charge_kretprobe_exit(void) +{ + unregister_kretprobe(&mem_cgroup_charge_kretprobe); + pr_info("kretprobe at %p unregistered\n", + mem_cgroup_charge_kretprobe.kp.addr); + + /* nmissed > 0 suggests that maxactive was set too low. */ + pr_info("Missed probing %d instances of %s\n", + mem_cgroup_charge_kretprobe.nmissed, + mem_cgroup_charge_kretprobe.kp.symbol_name); +} + +// kretprobe at uncharge_folio + +struct uncharge_data { + struct cgroup *cgrp; + struct mem_cgroup *memcg; + unsigned long addr; + bool isKmem; + int nr_pages; +}; + +static int uncharge_folio_entry_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct uncharge_data *data; + struct folio *page; + struct mem_cgroup *memcg = NULL; + struct cgroup_subsys_state css; + struct cgroup *cgrp; + struct obj_cgroup *objcg; + int nr_pages = 0; + + data = (struct uncharge_data *)ri->data; + page = (struct folio *)regs->di; + if (page == NULL) { + data->memcg = NULL; + return -1; + } + if (page->memcg_data & MEMCG_DATA_KMEM) { // if the page belongs to kmem + if (!folio_test_large(page)) + nr_pages = 1; + else + nr_pages = page->_folio_nr_pages; + // nr_pages = thp_nr_pages(page); + objcg = __folio_objcg(page); + if (objcg != NULL) + memcg = objcg->memcg; + data->isKmem = true; + data->nr_pages = nr_pages; + } else { + memcg = __folio_memcg(page); + data->isKmem = false; + } + + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + + data->memcg = memcg; + data->addr = (unsigned long)page; + data->cgrp = cgrp; + } + return 0; +} + +NOKPROBE_SYMBOL(uncharge_folio_entry_handler); + +static int uncharge_folio_ret_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct uncharge_data *data = (struct uncharge_data *)ri->data; + int id; + struct cgroup_info *cgrp_info; + int ret = -1; + + if (data->memcg != NULL) { + id = ((data->memcg)->css).id; + cgrp_info = find_cgroup_info(id); + if (cgrp_info == NULL) + return -1; + if (data->isKmem) + ret = -1; + else + ret = remove_page_from_cgroup_info(data->addr, cgrp_info); + } + + return ret; +} + +NOKPROBE_SYMBOL(uncharge_folio_ret_handler); + +static struct kretprobe uncharge_folio_kretprobe = { + .handler = uncharge_folio_ret_handler, + .entry_handler = uncharge_folio_entry_handler, + .data_size = sizeof(struct uncharge_data), + .maxactive = 20, +}; + +static int uncharge_folio_kretprobe_init(void) +{ + int ret; + + uncharge_folio_kretprobe.kp.symbol_name = "uncharge_folio"; + ret = register_kretprobe(&uncharge_folio_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); + return ret; + } + pr_info("Planted return probe at %s: %p\n", + uncharge_folio_kretprobe.kp.symbol_name, + uncharge_folio_kretprobe.kp.addr); + return 0; +} + +static void uncharge_folio_kretprobe_exit(void) +{ + unregister_kretprobe(&uncharge_folio_kretprobe); + pr_info("kretprobe at %p unregistered\n", + uncharge_folio_kretprobe.kp.addr); + + /* nmissed > 0 suggests that maxactive was set too low. */ + pr_info("Missed probing %d instances of %s\n", + uncharge_folio_kretprobe.nmissed, + uncharge_folio_kretprobe.kp.symbol_name); +} + +//kprobe at do_exit +static struct kprobe do_exit_kprobe; +static int do_exit_kprobe_pre_handler(struct kprobe *p, struct pt_regs *regs) +{ + struct task_struct *cur = current; + int tgid = cur->tgid; + struct mm_struct *mm = cur->mm; + struct mem_cgroup *memcg = get_mem_cgroup_from_mm(mm); + struct cgroup_subsys_state css; + struct cgroup *cgrp; + struct cgroup_info *cgrp_info; + struct task_info *tsk_info; + int id; + + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + id = (memcg->css).id; + cgrp_info = find_cgroup_info(id); + if (cgrp_info != NULL) { + write_lock(&cgrp_info->cgrp_lock); + tsk_info = find_task_info(cgrp_info, tgid); + if (tsk_info != NULL) { + list_del(&tsk_info->list); + write_unlock(&cgrp_info->cgrp_lock); + remove_task_from_cgroup_info(cgrp_info, + tsk_info); + } else { + write_unlock(&cgrp_info->cgrp_lock); + } + return 0; + } + } + return 0; +} + +static void do_exit_kprobe_post_handler(struct kprobe *p, + struct pt_regs *regs, + unsigned long flags) +{ + +} + +static int do_exit_kprobe_init(void) +{ + do_exit_kprobe.pre_handler = do_exit_kprobe_pre_handler; + do_exit_kprobe.post_handler = do_exit_kprobe_post_handler; + do_exit_kprobe.symbol_name = "do_exit"; + if (register_kprobe(&do_exit_kprobe)) { + pr_alert("register_kprobe on do_exit failed!\n"); + return -EINVAL; + } + return 0; +} + +static void do_exit_kprobe_exit(void) +{ + unregister_kprobe(&do_exit_kprobe); +} + +//kprobe at mark_oom_victim +static struct kprobe mark_oom_victim_kprobe; + +static int mark_oom_victim_kprobe_pre_handler(struct kprobe *p, + struct pt_regs *regs) +{ + struct task_struct *victim; + int tgid; + struct mm_struct *mm; + struct mem_cgroup *memcg; + struct cgroup_subsys_state css; + struct cgroup *cgrp; + struct cgroup_info *cgrp_info; + struct task_info *tsk_info; + int id; + struct task_info *oom_info; + + victim = (struct task_struct *)regs->di; + tgid = victim->tgid; + mm = victim->mm; + memcg = get_mem_cgroup_from_mm(mm); + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + id = (memcg->css).id; + cgrp_info = find_cgroup_info(id); + if (cgrp_info != NULL) { + read_lock(&cgrp_info->cgrp_lock); + tsk_info = find_task_info(cgrp_info, tgid); + read_unlock(&cgrp_info->cgrp_lock); + if (tsk_info != NULL) { + oom_info = create_oom_task_info(tsk_info); + if (oom_info != NULL) { + add_oom_task_to_cgroup_info(cgrp_info, + oom_info); + } + return 0; + } + } + } + return 0; +} + +static void mark_oom_victim_kprobe_post_handler(struct kprobe *p, + struct pt_regs *regs, + unsigned long flags) +{ + +} + +static int mark_oom_victim_kprobe_init(void) +{ + mark_oom_victim_kprobe.pre_handler = mark_oom_victim_kprobe_pre_handler; + mark_oom_victim_kprobe.post_handler = + mark_oom_victim_kprobe_post_handler; + mark_oom_victim_kprobe.symbol_name = "mark_oom_victim"; + if (register_kprobe(&mark_oom_victim_kprobe)) { + pr_alert("register_kprobe on mark_oom_victim failed!\n"); + return -EINVAL; + } + return 0; +} + +static void mark_oom_victim_kprobe_exit(void) +{ + unregister_kprobe(&mark_oom_victim_kprobe); +} + +//kretporbe at cgroup_destroy_locked +struct destroy_data { + struct cgroup *cgrp; +}; + +static int cgroup_destroy_locked_entry_handler(struct kretprobe_instance + *ri, struct pt_regs *regs) +{ + struct destroy_data *data; + + data = (struct destroy_data *)ri->data; + data->cgrp = (struct cgroup *)regs->di; + return 0; +} + +NOKPROBE_SYMBOL(cgroup_destroy_locked_entry_handler); + +static int cgroup_destroy_locked_ret_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct destroy_data *data = (struct destroy_data *)ri->data; + struct cgroup *cgrp = data->cgrp; + struct cgroup_info *cgrp_info = NULL; + unsigned long retval = regs_return_value(regs); + + if (!cgrp) + return -1; + if (retval != 0) + return -1; + list_for_each_entry(cgrp_info, &all_cgroup_info, list) { + if (cgrp_info->cgrp == cgrp) { + spin_lock(&lock); + list_del(&cgrp_info->list); + spin_unlock(&lock); + destroy_cgroup_info(cgrp_info); + return 0; + } + } + return -1; +} + +NOKPROBE_SYMBOL(cgroup_destroy_locked_ret_handler); + +static struct kretprobe cgroup_destroy_locked_kretprobe = { + .handler = cgroup_destroy_locked_ret_handler, + .entry_handler = cgroup_destroy_locked_entry_handler, + .data_size = sizeof(struct destroy_data), + .maxactive = 20, +}; + +static int cgroup_destroy_locked_kretprobe_init(void) +{ + int ret; + + cgroup_destroy_locked_kretprobe.kp.symbol_name = + "cgroup_destroy_locked"; + ret = register_kretprobe(&cgroup_destroy_locked_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); + return ret; + } + pr_info("Planted return probe at %s: %p\n", + cgroup_destroy_locked_kretprobe.kp.symbol_name, + cgroup_destroy_locked_kretprobe.kp.addr); + return 0; +} + +static void cgroup_destroy_locked_kretprobe_exit(void) +{ + unregister_kretprobe(&cgroup_destroy_locked_kretprobe); + pr_info("kretprobe at %p unregistered\n", + cgroup_destroy_locked_kretprobe.kp.addr); + + /* nmissed > 0 suggests that maxactive was set too low. */ + pr_info("Missed probing %d instances of %s\n", + cgroup_destroy_locked_kretprobe.nmissed, + cgroup_destroy_locked_kretprobe.kp.symbol_name); +} + +// print the tasks in order of their memory usage +static void print_sorted_tasks_list(struct cgroup_info *cgrp_info, + int type, struct seq_file *m) +{ + struct list_head *cur, *insert_pos; + struct task_info *task, *insert_task; + struct list_head new_list = LIST_HEAD_INIT(new_list); + struct list_head *old_list; + struct task_info *new_task, *next_task; + + if (type == 0) { + if (cgrp_info == NULL) + return; + read_lock(&cgrp_info->cgrp_lock); + old_list = &cgrp_info->tasks_list; + } else { + if (cgrp_info == NULL) + return; + old_list = &cgrp_info->oom_list; + } + + list_for_each_entry_safe(task, insert_task, old_list, list) { + new_task = kmalloc(sizeof(struct task_info), GFP_ATOMIC); + if (!new_task) + return; + new_task->tgid = task->tgid; + strscpy(new_task->comm, task->comm, sizeof(new_task->comm)); + new_task->count = task->count; + new_task->pages = NULL; + INIT_LIST_HEAD(&new_task->list); + + //insertion sort + cur = &new_list; + insert_pos = cur->next; + while (insert_pos != &new_list) { + next_task = + list_entry(insert_pos, struct task_info, list); + if (new_task->count >= next_task->count) + break; + cur = insert_pos; + insert_pos = insert_pos->next; + } + + (&new_task->list)->prev = insert_pos->prev; + (insert_pos->prev)->next = (&new_task->list); + (&new_task->list)->next = insert_pos; + insert_pos->prev = (&new_task->list); + } + if (type == 0) + read_unlock(&cgrp_info->cgrp_lock); + + //print + if (type == 1 && (&new_list) != new_list.next) { + seq_puts(m, "oom:\n"); + seq_printf(m, "%10s %20s %20s\n", "pid", "command", + "memory usage (KB)"); + } + if (type == 0) + seq_printf(m, "%10s %20s %20s\n", "pid", "command", + "memory usage (KB)"); + list_for_each_entry_safe(task, insert_task, &new_list, list) { + seq_printf(m, "%10d %20s %20d\n", task->tgid, task->comm, + (task->count) * 4); + } + + list_for_each_entry_safe(task, insert_task, &new_list, list) { + list_del(&task->list); + kfree(task); + } +} + +static struct proc_dir_entry *cgroup_info_read; +#define procfs_file_read "cgroup_memory_usage_per_process" + +void seq_print_tasks(struct cgroup_info *cgroup_info, struct seq_file *m) +{ + if (!cgroup_info) + return; + + print_sorted_tasks_list(cgroup_info, 0, m); +} + +void seq_print_oom_tasks(struct cgroup_info *cgroup_info, struct seq_file *m) +{ + if (!cgroup_info) + return; + + print_sorted_tasks_list(cgroup_info, 1, m); +} + +void seq_print_cgroups(struct seq_file *m) +{ + struct cgroup_info *cgrp, *pos; + + spin_lock(&lock); + list_for_each_entry_safe(cgrp, pos, &all_cgroup_info, list) { + seq_printf(m, "cgroup name : %s\n", cgrp->name); + seq_print_tasks(cgrp, m); + seq_print_oom_tasks(cgrp, m); + seq_puts(m, "\n"); + } + spin_unlock(&lock); +} + +static int memory_usage_show(struct seq_file *m, void *v) +{ + seq_print_cgroups(m); + return 0; +} + +static int __init global_init(void) +{ + int ret = 0; + + cgroup_info_read = + proc_create_single(procfs_file_read, 0, NULL, memory_usage_show); + if (!cgroup_info_read) + return -ENOMEM; + ret = mem_cgroup_charge_kretprobe_init(); + uncharge_folio_kretprobe_init(); + do_exit_kprobe_init(); + mark_oom_victim_kprobe_init(); + cgroup_destroy_locked_kretprobe_init(); + + return ret; +} + +static void __exit global_exit(void) +{ + struct cgroup_info *cgrp_info, *pos; + + mem_cgroup_charge_kretprobe_exit(); + uncharge_folio_kretprobe_exit(); + do_exit_kprobe_exit(); + mark_oom_victim_kprobe_exit(); + cgroup_destroy_locked_kretprobe_exit(); + + remove_proc_entry(procfs_file_read, NULL); + + //release all memory use + list_for_each_entry_safe(cgrp_info, pos, &all_cgroup_info, list) { + list_del(&cgrp_info->list); + destroy_cgroup_info(cgrp_info); + } +} + +module_init(global_init) +module_exit(global_exit) +MODULE_LICENSE("GPL"); diff --git a/tools/probeCgroup/probeCgroup.h b/tools/probeCgroup/probeCgroup.h new file mode 100644 index 000000000000..953a6e0aca31 --- /dev/null +++ b/tools/probeCgroup/probeCgroup.h @@ -0,0 +1,415 @@ +/* SPDX-License-Identifier: GPL-2.0*/ +/* + * probeCgroup.h + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/kprobes.h> +#include <linux/ktime.h> +#include <linux/limits.h> +#include <linux/sched.h> +#include <linux/mm_types.h> +#include <linux/memcontrol.h> +#include <linux/cgroup-defs.h> +#include <linux/kernfs.h> +#include <linux/string.h> +#include <linux/list.h> +#include <linux/oom.h> +#include <linux/fs.h> +#include <linux/proc_fs.h> +#include <linux/huge_mm.h> +#include <linux/page-flags.h> +#include <linux/spinlock.h> +#include <linux/rwlock.h> + +static spinlock_t lock; // global lock for the list of cgroup_info + +struct HashNode { + unsigned long addr; + struct HashNode *next; +}; + +struct HashNode *HashNode_create(unsigned long addr) +{ + struct HashNode *node = NULL; + + node = kzalloc(sizeof(struct HashNode), GFP_ATOMIC); + if (node == NULL) + return NULL; + node->addr = addr; + node->next = NULL; + return node; +} + +struct HashBucket { + struct HashNode *head; + spinlock_t bkt_lock; +}; + +void HashBucket_init(struct HashBucket *bkt) +{ + bkt->head = NULL; + spin_lock_init(&bkt->bkt_lock); +} + +bool HashBucket_insert(struct HashBucket *bkt, unsigned long addr) +{ + struct HashNode *new_node; + struct HashNode *node; + struct HashNode *prev; + bool ret = true; + + if (bkt == NULL) + return false; + + prev = NULL; + new_node = NULL; + new_node = HashNode_create(addr); + + spin_lock(&bkt->bkt_lock); + node = bkt->head; + while (node != NULL && node->addr != addr) { + prev = node; + node = node->next; + } + if (node == NULL) { + if (new_node == NULL) { + pr_info("not enough memory for HashNode\n"); + spin_unlock(&bkt->bkt_lock); + return false; + } + if (bkt->head == NULL) + bkt->head = new_node; + else + prev->next = new_node; + spin_unlock(&bkt->bkt_lock); + ret = true; + } else { + spin_unlock(&bkt->bkt_lock); + kfree(new_node); + ret = false; + } + + return ret; +} + +bool HashBucket_erase(struct HashBucket *bkt, unsigned long addr) +{ + struct HashNode *node; + struct HashNode *prev; + bool ret = true; + + if (bkt == NULL) + return false; + + spin_lock(&bkt->bkt_lock); + node = bkt->head; + prev = NULL; + while (node != NULL && node->addr != addr) { + prev = node; + node = node->next; + } + if (node == NULL) { + spin_unlock(&bkt->bkt_lock); + ret = false; + } else { + if (bkt->head == node) + bkt->head = node->next; + else + prev->next = node->next; + kfree(node); + spin_unlock(&bkt->bkt_lock); + ret = true; + } + + return ret; +} + +void HashBucket_clear(struct HashBucket *bkt) +{ + struct HashNode *node; + struct HashNode *prev; + + if (bkt == NULL) + return; + + spin_lock(&bkt->bkt_lock); + node = bkt->head; + prev = NULL; + bkt->head = NULL; + while (node != NULL) { + prev = node; + node = node->next; + kfree(prev); + } + spin_unlock(&bkt->bkt_lock); +} + +struct HashMap { + unsigned long size; + struct HashBucket *HashTable; +}; + +unsigned long hash_func(unsigned long addr, unsigned long size) +{ + return addr % size; +} + +struct HashMap *HashMap_create(unsigned long size) +{ + struct HashMap *hm = NULL; + struct HashBucket *ht = NULL; + int i = 0; + + hm = kmalloc(sizeof(struct HashMap), GFP_ATOMIC); + if (hm == NULL) + return NULL; + ht = kmalloc((size * sizeof(struct HashBucket)), GFP_ATOMIC); + if (ht == NULL) { + kfree(hm); + return NULL; + } + for (i = 0; i < size; i++) + HashBucket_init(&(ht[i])); + + hm->size = size; + hm->HashTable = ht; + return hm; +} + +bool HashMap_insert(struct HashMap *hm, unsigned long addr) +{ + unsigned long index; + + if (hm == NULL) + return false; + index = hash_func(addr, hm->size); + if (hm->HashTable == NULL) + return false; + return HashBucket_insert(&(hm->HashTable[index]), addr); +} + +bool HashMap_erase(struct HashMap *hm, unsigned long addr) +{ + unsigned long index; + + if (hm == NULL) + return false; + index = hash_func(addr, hm->size); + if (hm->HashTable == NULL) + return false; + return HashBucket_erase(&(hm->HashTable[index]), addr); +} + +void HashMap_clear(struct HashMap *hm) +{ + unsigned long size; + struct HashBucket *ht; + int i; + + if (hm == NULL) + return; + size = hm->size; + ht = hm->HashTable; + if (ht == NULL) + return; + hm->HashTable = NULL; + for (i = 0; i < size; i++) + HashBucket_clear(&(ht[i])); + + kfree(ht); + kfree(hm); +} + +//struct that save the information for each task +struct task_info { + int tgid; + char comm[TASK_COMM_LEN]; + int count; // number of pages + struct HashMap *pages; + struct list_head list; + spinlock_t cnt_lock; +}; + +// struct that save the information for each cgroup +struct cgroup_info { + struct cgroup *cgrp; + struct mem_cgroup *memcg; + int id; + char name[64]; + struct list_head list; + struct list_head tasks_list; + struct list_head oom_list; + rwlock_t cgrp_lock; + unsigned int cached_bytes; +}; + +static LIST_HEAD(all_cgroup_info); // a list that linked all the cgroup_info struct + +static struct task_info *create_task_info(struct task_struct *cur_task) +{ + struct task_info *tsk_info = + kmalloc(sizeof(struct task_info), GFP_ATOMIC); + if (!tsk_info) + return NULL; + + // initialization + tsk_info->tgid = cur_task->tgid; + strscpy(tsk_info->comm, cur_task->comm, sizeof(tsk_info->comm)); + tsk_info->count = 0; + tsk_info->pages = NULL; + tsk_info->pages = HashMap_create(1023); + INIT_LIST_HEAD(&tsk_info->list); + spin_lock_init(&(tsk_info->cnt_lock)); + + return tsk_info; +} + +static int +add_task_to_cgroup_info(struct cgroup_info *cgrp, struct task_info *task) +{ + if (!cgrp || !task) + return -EINVAL; + + write_lock(&cgrp->cgrp_lock); + list_add_tail(&task->list, &cgrp->tasks_list); + write_unlock(&cgrp->cgrp_lock); + return 0; +} + +static int +remove_task_from_cgroup_info(struct cgroup_info *cgrp, struct task_info *task) +{ + if (cgrp == NULL || task == NULL) + return -EINVAL; + + HashMap_clear(task->pages); + // kfree(task->pages); + kfree(task); + return 0; +} + +static struct task_info *find_task_info(struct cgroup_info *cgrp, int tgid) +{ + struct task_info *tsk_info, *pos; + + list_for_each_entry_safe(tsk_info, pos, &cgrp->tasks_list, list) { + if (tsk_info->tgid == tgid) + return tsk_info; + } + return NULL; +} + +static int +remove_page_from_cgroup_info(unsigned long addr, struct cgroup_info *cgrp) +{ + struct task_info *tsk_info, *pos; + + read_lock(&cgrp->cgrp_lock); + list_for_each_entry_safe(tsk_info, pos, &cgrp->tasks_list, list) { + if (HashMap_erase(tsk_info->pages, addr)) { + spin_lock(&(tsk_info->cnt_lock)); + tsk_info->count -= folio_nr_pages((struct folio *)addr); + spin_unlock(&(tsk_info->cnt_lock)); + read_unlock(&cgrp->cgrp_lock); + return 0; + } + } + read_unlock(&cgrp->cgrp_lock); + return -1; +} + +static struct cgroup_info *create_cgroup_info(struct cgroup *cgrp, + struct mem_cgroup *memcg) +{ + struct cgroup_info *cgrp_info = + kmalloc(sizeof(struct cgroup_info), GFP_ATOMIC); + struct kernfs_node *kn; + + if (!cgrp_info) + return NULL; + + cgrp_info->cgrp = cgrp; + cgrp_info->memcg = memcg; + cgrp_info->id = (memcg->css).id; + kn = cgrp->kn; + strscpy(cgrp_info->name, kn->name, sizeof(cgrp_info->name)); + INIT_LIST_HEAD(&cgrp_info->list); + INIT_LIST_HEAD(&cgrp_info->tasks_list); + INIT_LIST_HEAD(&cgrp_info->oom_list); + rwlock_init(&(cgrp_info->cgrp_lock)); + cgrp_info->cached_bytes = 0; + + return cgrp_info; +} + +static void destroy_cgroup_info(struct cgroup_info *cgrp_info) +{ + struct task_info *task, *tmp; + + if (!cgrp_info) + return; + + write_lock(&cgrp_info->cgrp_lock); + list_for_each_entry_safe(task, tmp, &cgrp_info->tasks_list, list) { + list_del(&task->list); + remove_task_from_cgroup_info(cgrp_info, task); + } + write_unlock(&cgrp_info->cgrp_lock); + list_for_each_entry_safe(task, tmp, &cgrp_info->oom_list, list) { + list_del(&task->list); + remove_task_from_cgroup_info(cgrp_info, task); + } + + kfree(cgrp_info); +} + +static int add_cgroup_info(struct cgroup_info *cgrp_info) +{ + if (!cgrp_info) + return -EINVAL; + + list_add_tail(&cgrp_info->list, &all_cgroup_info); + return 0; +} + +static struct cgroup_info *find_cgroup_info(int id) +{ + struct cgroup_info *cgrp_info = NULL; + + list_for_each_entry(cgrp_info, &all_cgroup_info, list) { + if (cgrp_info->id == id) + return cgrp_info; + } + + return NULL; +} + +static struct task_info *create_oom_task_info(struct task_info *tsk_info) +{ + struct task_info *oom_tsk_info = + kmalloc(sizeof(struct task_info), GFP_ATOMIC); + if (!oom_tsk_info) + return NULL; + + oom_tsk_info->tgid = tsk_info->tgid; + strscpy(oom_tsk_info->comm, tsk_info->comm, sizeof(oom_tsk_info->comm)); + oom_tsk_info->count = tsk_info->count; + oom_tsk_info->pages = NULL; + INIT_LIST_HEAD(&oom_tsk_info->list); + + return oom_tsk_info; +} + +static int +add_oom_task_to_cgroup_info(struct cgroup_info *cgrp, + struct task_info *oom_task) +{ + if (!cgrp || !oom_task) + return -EINVAL; + list_add_tail(&oom_task->list, &cgrp->oom_list); + return 0; +} diff --git a/tools/probeCgroup/run.sh b/tools/probeCgroup/run.sh new file mode 100755 index 000000000000..7e1ffefe66d1 --- /dev/null +++ b/tools/probeCgroup/run.sh @@ -0,0 +1,8 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +cd scripts +./script1.sh +./script2.sh +./script3.sh diff --git a/tools/probeCgroup/scripts/script1.sh b/tools/probeCgroup/scripts/script1.sh new file mode 100755 index 000000000000..539e8258afb9 --- /dev/null +++ b/tools/probeCgroup/scripts/script1.sh @@ -0,0 +1,10 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +cd .. +make +insmod probeCgroup.ko + +cd testcases +gcc simple-mem-allocate.c -o simple-mem-allocate diff --git a/tools/probeCgroup/scripts/script2.sh b/tools/probeCgroup/scripts/script2.sh new file mode 100755 index 000000000000..2ad515cfb912 --- /dev/null +++ b/tools/probeCgroup/scripts/script2.sh @@ -0,0 +1,14 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +current_dir=$(pwd) +cd /sys/fs/cgroup/memory +mkdir test +cd test +sh -c "echo $$ >> cgroup.procs" +sh -c "echo 5M > memory.limit_in_bytes" +sh -c "echo 0 > memory.swappiness" +cd "$current_dir" +cd ../testcases +./simple-mem-allocate diff --git a/tools/probeCgroup/scripts/script3.sh b/tools/probeCgroup/scripts/script3.sh new file mode 100755 index 000000000000..127eb45de5c9 --- /dev/null +++ b/tools/probeCgroup/scripts/script3.sh @@ -0,0 +1,11 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +cd /proc +cat cgroup_memory_usage_per_process + +cat /sys/fs/cgroup/memory/test/cgroup.procs > /sys/fs/cgroup/memory/cgroup.procs +rmdir /sys/fs/cgroup/memory/test +# cat cgroup_memory_usage_per_process +rmmod probeCgroup diff --git a/tools/probeCgroup/testcases/1_load_unload_test.py b/tools/probeCgroup/testcases/1_load_unload_test.py new file mode 100755 index 000000000000..5389a14a1dac --- /dev/null +++ b/tools/probeCgroup/testcases/1_load_unload_test.py @@ -0,0 +1,24 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +import os +import subprocess +import time + +def test_module_load_unload(): + try: + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + print('loading module successfully!') + subprocess.check_call(['rmmod', 'probeCgroup']) + output = subprocess.check_output(['lsmod']) + assert b'probeCgroup' not in output + print('unloading module successfully!') + except subprocess.CalledProcessError as e: + print('Load unload test failed. Insmod failed.') + except AssertionError as e: + print('Load unload test failed. Cannot remove module.') + +if __name__ == '__main__': + test_module_load_unload() \ No newline at end of file diff --git a/tools/probeCgroup/testcases/2_multiple_process_test.py b/tools/probeCgroup/testcases/2_multiple_process_test.py new file mode 100755 index 000000000000..d88c7f7f2952 --- /dev/null +++ b/tools/probeCgroup/testcases/2_multiple_process_test.py @@ -0,0 +1,48 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup, check_kmem_usage +import os +import subprocess +import time + +def test_multiple_process(num_procs): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroup_name = 'test' + cgroup_path = create_cgroup(cgroup_name) + + processes = [] + pids = [] + + for i in range(num_procs): + process = subprocess.Popen(['./mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + processes.append(process) + pids.append(pid) + + time.sleep(0.1) + try: + count = 0 + for i in range (2000): + count += check_memory_usage(cgroup_name, pids, False) + time.sleep(0.01) + assert count <= 50, f"Memory read by probeCgroup is not accurate" + + remove_cgroup(cgroup_path, pids) + check_memory_usage(cgroup_name, pids, True) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass multiple process test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + remove_cgroup(cgroup_path, pids) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_multiple_process(3) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/3_multiple_cgroup_test.py b/tools/probeCgroup/testcases/3_multiple_cgroup_test.py new file mode 100755 index 000000000000..592a716df877 --- /dev/null +++ b/tools/probeCgroup/testcases/3_multiple_cgroup_test.py @@ -0,0 +1,55 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup +import os +import subprocess +import time + +def test_multiple_cgroup(num_procs, num_cgroups): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroups = [] + processes = {} + pids = {} + for i in range(num_cgroups): + cgroup_name = f'test_{i}' + cgroup_path = create_cgroup(cgroup_name) + cgroups.append((cgroup_name, cgroup_path)) + + for j in range(num_procs): + process = subprocess.Popen(['./mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + if cgroup_path not in processes: + processes[cgroup_path] = [] + processes[cgroup_path].append(process) + if cgroup_path not in pids: + pids[cgroup_path] = [] + pids[cgroup_path].append(pid) + + time.sleep(0.1) + try: + for i in range (100): + for cgroup_name, cgroup_path in cgroups: + check_memory_usage(cgroup_name, pids[cgroup_path], False) + time.sleep(0.01) + + for cgroup_name, cgroup_path in cgroups: + remove_cgroup(cgroup_path, pids[cgroup_path]) + check_memory_usage(cgroup_name, pids[cgroup_path], True) + cleanup(processes[cgroup_path]) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass multiple cgroup test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + for cgroup_name, cgroup_path in cgroups: + remove_cgroup(cgroup_path, pids[cgroup_path]) + cleanup(processes[cgroup_path]) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_multiple_cgroup(2,2) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/4_oom_test.py b/tools/probeCgroup/testcases/4_oom_test.py new file mode 100755 index 000000000000..128a258c56f5 --- /dev/null +++ b/tools/probeCgroup/testcases/4_oom_test.py @@ -0,0 +1,52 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup, get_oom_process_memory_usage +import os +import subprocess +import time + +def test_oom(num_procs): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroup_name = 'test' + cgroup_path = create_cgroup(cgroup_name) + + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.limit_in_bytes", 'w') as limit_file: + limit_file.write("5M") + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.swappiness", 'w') as swap_file: + swap_file.write("0") + + processes = [] + pids = [] + for i in range(num_procs): + process = subprocess.Popen(['./simple-mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + processes.append(process) + pids.append(pid) + + time.sleep(6) + + try: + for pid in pids: + memory_usage = get_oom_process_memory_usage(pid, cgroup_name) + assert memory_usage is not None, f"Memory usage(oom) not found for PID {pid}" + assert memory_usage > 0, f"Memory usage should be greater than zero for PID {pid}" + + remove_cgroup(cgroup_path, pids) + check_memory_usage(cgroup_name, pids, True) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass oom test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + remove_cgroup(cgroup_path, pids) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_oom(1) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/5_multiple_threads_test.py b/tools/probeCgroup/testcases/5_multiple_threads_test.py new file mode 100755 index 000000000000..7e1b86dabe48 --- /dev/null +++ b/tools/probeCgroup/testcases/5_multiple_threads_test.py @@ -0,0 +1,45 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup, check_kmem_usage +import os +import subprocess +import time + +def test_multiple_thread(num_procs): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroup_name = 'test' + cgroup_path = create_cgroup(cgroup_name) + + processes = [] + pids = [] + for i in range(num_procs): + process = subprocess.Popen(['./multiple-thread-mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + processes.append(process) + pids.append(pid) + + time.sleep(1) + try: + for i in range (200): + check_memory_usage(cgroup_name, pids, False) + time.sleep(0.01) + + remove_cgroup(cgroup_path, pids) + check_memory_usage(cgroup_name, pids, True) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass multiple threads test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + remove_cgroup(cgroup_path, pids) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_multiple_thread(5) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/cgroup_utils.py b/tools/probeCgroup/testcases/cgroup_utils.py new file mode 100644 index 000000000000..f70c68c1f188 --- /dev/null +++ b/tools/probeCgroup/testcases/cgroup_utils.py @@ -0,0 +1,115 @@ +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +import os +import subprocess +import time + +def create_cgroup(cgroup_name): + cgroup_path = f'/sys/fs/cgroup/memory/{cgroup_name}' + + try: + os.makedirs(cgroup_path) + except FileExistsError: + pass + + return cgroup_path + +def add_process_to_cgroup(cgroup_path, pid): + with open(os.path.join(cgroup_path, 'cgroup.procs'), 'w') as procs_file: + procs_file.write(str(pid)) + +def get_process_memory_usage(pid, cgroup_name): + cur_name = '' + with open('/proc/cgroup_memory_usage_per_process', 'r') as file: + for line in file: + parts = line.strip().split() + if len(parts) >= 4 and parts[0] == 'cgroup': + cur_name = parts[3] + if len(parts) >= 3 and parts[0] != 'cgroup' and cur_name == cgroup_name and parts[0] != 'pid' and int(parts[0]) == pid: + return int(parts[2]) + return None + +def get_process_kmem_usage(pid, cgroup_name): + cur_name = '' + with open('/proc/cgroup_memory_usage_per_process', 'r') as file: + for line in file: + parts = line.strip().split() + if len(parts) >= 4 and parts[0] == 'cgroup': + cur_name = parts[3] + if len(parts) >= 4 and parts[0] != 'cgroup' and cur_name == cgroup_name and parts[0] != 'pid' and int(parts[0]) == pid: + return int(parts[3]) + return None + +def remove_cgroup(cgroup_path, pids): + for pid in pids: + with open('/sys/fs/cgroup/memory/cgroup.procs', 'w') as backup_file: + backup_file.write(str(pid)) + os.rmdir(cgroup_path) + return + +def check_memory_usage(cgroup_name, pids, delete): + memory_sum = 0 + for pid in pids: + memory_usage = get_process_memory_usage(pid, cgroup_name) + if delete == False: + assert memory_usage is not None, f"Memory usage not found for PID {pid}" + assert memory_usage >= 0, f"Memory usage should be greater than zero for PID {pid}" + memory_sum += memory_usage + else: + assert memory_usage is None, f"Error: Memory usage should not be available for PID {pid} after deleting the cgroup." + if delete == False: + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.usage_in_bytes", 'r') as file: + content = file.readline().strip() + memory_read = int(content) + memory_sum *= 1024 + delta = abs(memory_read - memory_sum) + # print(f"read: {memory_read}") + # print(f"sum : {memory_sum}") + if (delta > max(memory_read, memory_sum) * 0.1): + return 1 + else: + return 0 + else: + return 0 + +def check_kmem_usage(cgroup_name, pids, delete): + kmem_sum = 0 + for pid in pids: + kmem_usage = get_process_kmem_usage(pid, cgroup_name) + if delete == False: + assert kmem_usage is not None, f"Kmem usage not found for PID {pid}" + assert kmem_usage >= 0, f"Kmem usage should be greater than zero for PID {pid}" + kmem_sum += kmem_usage + else: + assert kmem_usage is None, f"Error: Kmem usage should not be available for PID {pid} after deleting the cgroup." + if delete == False: + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.kmem.usage_in_bytes", 'r') as file: + content = file.readline().strip() + kmem_read = int(content) + kmem_sum *= 1024 + delta = abs(kmem_read - kmem_sum) + # print(f"kmem read: {kmem_read}") + # print(f"kmem sum : {kmem_sum}") + # assert delta <= max(kmem_read, kmem_sum) * 0.2, f"Kmem read by probeCgroup is not accurate, {kmem_read}, {kmem_sum}" + +def cleanup(processes): + for process in processes: + process.terminate() + process.wait() + +def get_oom_process_memory_usage(pid, cgroup_name): + # �� + cur_name = '' + oom = False + with open('/proc/cgroup_memory_usage_per_process', 'r') as file: + for line in file: + parts = line.strip().split() + if len(parts) >= 4 and parts[0] == 'cgroup': + cur_name = parts[3] + oom = False + if len(parts) >= 1 and parts[0] == 'oom:': + oom = True + if len(parts) >= 3 and parts[0] != 'cgroup' and cur_name == cgroup_name and parts[0] != 'pid' and int(parts[0]) == pid and oom == True: + return int(parts[2]) + return None \ No newline at end of file diff --git a/tools/probeCgroup/testcases/mem-allocate.c b/tools/probeCgroup/testcases/mem-allocate.c new file mode 100644 index 000000000000..e78e37cae61b --- /dev/null +++ b/tools/probeCgroup/testcases/mem-allocate.c @@ -0,0 +1,35 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * mem-allocate.c - The program to test probeCgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> + +#define MB (1024 * 1024) + +char *arr[40]; + +int main(int argc, char *argv[]) +{ + char *p; + int i = 0; + + while (1) { + for (i = 0; i < 40; i++) { + p = (char *)malloc(MB); + memset(p, 0, MB); + arr[i] = p; + usleep(100000); + } + for (int i = 0; i < 40; i++) { + free(arr[i]); + usleep(100000); + } + } + return 0; +} diff --git a/tools/probeCgroup/testcases/multiple-thread-mem-allocate.c b/tools/probeCgroup/testcases/multiple-thread-mem-allocate.c new file mode 100644 index 000000000000..55f4c068f55e --- /dev/null +++ b/tools/probeCgroup/testcases/multiple-thread-mem-allocate.c @@ -0,0 +1,60 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * multiple-thread-mem-allocate.c - The program to test probeCgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> +#include <pthread.h> + +#define MB (1024 * 1024) + +void *memory_test(void *) +{ + char *arr[25]; + char *p; + int i = 0; + int cnt = 0; + + while (1) { + for (i = 0; i < 20; i++) { + p = (char *)malloc(MB); + memset(p, 0, MB); + arr[i] = p; + usleep(10000); + } + for (int i = 0; i < 20; i++) { + free(arr[i]); + usleep(10000); + } + } +} + +int main(int argc, char *argv[]) +{ + pthread_t threads[4]; + int rc; + + // create threads + for (int i = 0; i < 4; i++) { + rc = pthread_create(&threads[i], NULL, memory_test, NULL); + if (rc != 0) { + fprintf(stderr, "Error creating thread: %d\n", rc); + return 1; + } + } + + for (int i = 0; i < 4; i++) { + rc = pthread_join(threads[i], NULL); + if (rc != 0) { + fprintf(stderr, "Error joining thread: %d\n", rc); + return 1; + } + } + + return 0; +} diff --git a/tools/probeCgroup/testcases/run.py b/tools/probeCgroup/testcases/run.py new file mode 100755 index 000000000000..8ffd0ca720d8 --- /dev/null +++ b/tools/probeCgroup/testcases/run.py @@ -0,0 +1,32 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +import os +import subprocess +import sys + +def run_tests(directory): + """Run all Python scripts in the given directory.""" + python_files = [f for f in os.listdir(directory) if f.endswith('test.py')] + python_files.sort() + + for filename in python_files: + try: + filepath = os.path.join(directory, filename) + + subprocess.check_call([sys.executable, filepath]) + except subprocess.CalledProcessError as e: + print(f"Error executing {filename}:") + return + except Exception as e: + print(f"Error executing {filename}:") + print(e) + return + +if __name__ == '__main__': + tests_directory = '.' + subprocess.check_call(['gcc', 'mem-allocate.c', '-o', 'mem-allocate']) + subprocess.check_call(['gcc', 'simple-mem-allocate.c', '-o', 'simple-mem-allocate']) + subprocess.check_call(['gcc', 'multiple-thread-mem-allocate.c', '-o', 'multiple-thread-mem-allocate']) + run_tests(tests_directory) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/simple-mem-allocate.c b/tools/probeCgroup/testcases/simple-mem-allocate.c new file mode 100644 index 000000000000..16328b10ba48 --- /dev/null +++ b/tools/probeCgroup/testcases/simple-mem-allocate.c @@ -0,0 +1,27 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * mem-allocate.c - The program to test probeCgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> + +#define MB (1024 * 1024) + +int main(int argc, char *argv[]) +{ + char *p; + int i = 0; + + while (1) { + p = (char *)malloc(MB); + memset(p, 0, MB); + sleep(1); + } + + return 0; +} -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 0/2] nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
by Kaixiong Yu 04 Sep '24

04 Sep '24

fix CVE-2023-52907 Fedor Pchelkin (1): nfc: pn533: initialize struct pn533_out_arg properly Minsuk Kang (1): nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() drivers/nfc/pn533/usb.c | 45 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 42 insertions(+), 3 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
by Kaixiong Yu 04 Sep '24

04 Sep '24

fix CVE-2023-52907 Fedor Pchelkin (1): nfc: pn533: initialize struct pn533_out_arg properly Minsuk Kang (1): nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() drivers/nfc/pn533/usb.c | 45 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 42 insertions(+), 3 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] md/raid5: avoid BUG_ON() while continue reshape after reassembling
by Li Nan 04 Sep '24

04 Sep '24

From: Yu Kuai <yukuai3(a)huawei.com> stable inclusion from stable-v4.19.320 commit 2c92f8c1c456d556f15cbf51667b385026b2e6a0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMNBN CVE: CVE-2024-43914 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 305a5170dc5cf3d395bb4c4e9239bca6d0b54b49 ] Currently, mdadm support --revert-reshape to abort the reshape while reassembling, as the test 07revert-grow. However, following BUG_ON() can be triggerred by the test: kernel BUG at drivers/md/raid5.c:6278! invalid opcode: 0000 [#1] PREEMPT SMP PTI irq event stamp: 158985 CPU: 6 PID: 891 Comm: md0_reshape Not tainted 6.9.0-03335-g7592a0b0049a #94 RIP: 0010:reshape_request+0x3f1/0xe60 Call Trace: <TASK> raid5_sync_request+0x43d/0x550 md_do_sync+0xb7a/0x2110 md_thread+0x294/0x2b0 kthread+0x147/0x1c0 ret_from_fork+0x59/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> Root cause is that --revert-reshape update the raid_disks from 5 to 4, while reshape position is still set, and after reassembling the array, reshape position will be read from super block, then during reshape the checking of 'writepos' that is caculated by old reshape position will fail. Fix this panic the easy way first, by converting the BUG_ON() to WARN_ON(), and stop the reshape if checkings fail. Noted that mdadm must fix --revert-shape as well, and probably md/raid should enhance metadata validation as well, however this means reassemble will fail and there must be user tools to fix the wrong metadata. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Song Liu <song(a)kernel.org> Link: https://lore.kernel.org/r/20240611132251.1967786-13-yukuai1@huaweicloud.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/md/raid5.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index 1c2e2ff162dc..b2b35cdabac5 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -5817,7 +5817,9 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, int *sk safepos = conf->reshape_safe; sector_div(safepos, data_disks); if (mddev->reshape_backwards) { - BUG_ON(writepos < reshape_sectors); + if (WARN_ON(writepos < reshape_sectors)) + return MaxSector; + writepos -= reshape_sectors; readpos += reshape_sectors; safepos += reshape_sectors; @@ -5835,14 +5837,18 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, int *sk * to set 'stripe_addr' which is where we will write to. */ if (mddev->reshape_backwards) { - BUG_ON(conf->reshape_progress == 0); + if (WARN_ON(conf->reshape_progress == 0)) + return MaxSector; + stripe_addr = writepos; - BUG_ON((mddev->dev_sectors & - ~((sector_t)reshape_sectors - 1)) - - reshape_sectors - stripe_addr - != sector_nr); + if (WARN_ON((mddev->dev_sectors & + ~((sector_t)reshape_sectors - 1)) - + reshape_sectors - stripe_addr != sector_nr)) + return MaxSector; } else { - BUG_ON(writepos != sector_nr + reshape_sectors); + if (WARN_ON(writepos != sector_nr + reshape_sectors)) + return MaxSector; + stripe_addr = sector_nr; } -- 2.39.2

2 1

[PATCH OLK-5.10] md/raid5: avoid BUG_ON() while continue reshape after reassembling
by Li Nan 04 Sep '24

04 Sep '24

From: Yu Kuai <yukuai3(a)huawei.com> stable inclusion from stable-v5.10.224 commit c384dd4f1fb3b14a2fd199360701cc163ea88705 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMNBN CVE: CVE-2024-43914 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 305a5170dc5cf3d395bb4c4e9239bca6d0b54b49 ] Currently, mdadm support --revert-reshape to abort the reshape while reassembling, as the test 07revert-grow. However, following BUG_ON() can be triggerred by the test: kernel BUG at drivers/md/raid5.c:6278! invalid opcode: 0000 [#1] PREEMPT SMP PTI irq event stamp: 158985 CPU: 6 PID: 891 Comm: md0_reshape Not tainted 6.9.0-03335-g7592a0b0049a #94 RIP: 0010:reshape_request+0x3f1/0xe60 Call Trace: <TASK> raid5_sync_request+0x43d/0x550 md_do_sync+0xb7a/0x2110 md_thread+0x294/0x2b0 kthread+0x147/0x1c0 ret_from_fork+0x59/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> Root cause is that --revert-reshape update the raid_disks from 5 to 4, while reshape position is still set, and after reassembling the array, reshape position will be read from super block, then during reshape the checking of 'writepos' that is caculated by old reshape position will fail. Fix this panic the easy way first, by converting the BUG_ON() to WARN_ON(), and stop the reshape if checkings fail. Noted that mdadm must fix --revert-shape as well, and probably md/raid should enhance metadata validation as well, however this means reassemble will fail and there must be user tools to fix the wrong metadata. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Song Liu <song(a)kernel.org> Link: https://lore.kernel.org/r/20240611132251.1967786-13-yukuai1@huaweicloud.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/md/raid5.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index 3cb90d7e88d9..126b9ecfe750 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -5997,7 +5997,9 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, int *sk safepos = conf->reshape_safe; sector_div(safepos, data_disks); if (mddev->reshape_backwards) { - BUG_ON(writepos < reshape_sectors); + if (WARN_ON(writepos < reshape_sectors)) + return MaxSector; + writepos -= reshape_sectors; readpos += reshape_sectors; safepos += reshape_sectors; @@ -6015,14 +6017,18 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, int *sk * to set 'stripe_addr' which is where we will write to. */ if (mddev->reshape_backwards) { - BUG_ON(conf->reshape_progress == 0); + if (WARN_ON(conf->reshape_progress == 0)) + return MaxSector; + stripe_addr = writepos; - BUG_ON((mddev->dev_sectors & - ~((sector_t)reshape_sectors - 1)) - - reshape_sectors - stripe_addr - != sector_nr); + if (WARN_ON((mddev->dev_sectors & + ~((sector_t)reshape_sectors - 1)) - + reshape_sectors - stripe_addr != sector_nr)) + return MaxSector; } else { - BUG_ON(writepos != sector_nr + reshape_sectors); + if (WARN_ON(writepos != sector_nr + reshape_sectors)) + return MaxSector; + stripe_addr = sector_nr; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] md/raid5: avoid BUG_ON() while continue reshape after reassembling
by Li Nan 04 Sep '24

04 Sep '24

From: Yu Kuai <yukuai3(a)huawei.com> stable inclusion from stable-v5.10.224 commit c384dd4f1fb3b14a2fd199360701cc163ea88705 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMNBN CVE: CVE-2024-43914 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 305a5170dc5cf3d395bb4c4e9239bca6d0b54b49 ] Currently, mdadm support --revert-reshape to abort the reshape while reassembling, as the test 07revert-grow. However, following BUG_ON() can be triggerred by the test: kernel BUG at drivers/md/raid5.c:6278! invalid opcode: 0000 [#1] PREEMPT SMP PTI irq event stamp: 158985 CPU: 6 PID: 891 Comm: md0_reshape Not tainted 6.9.0-03335-g7592a0b0049a #94 RIP: 0010:reshape_request+0x3f1/0xe60 Call Trace: <TASK> raid5_sync_request+0x43d/0x550 md_do_sync+0xb7a/0x2110 md_thread+0x294/0x2b0 kthread+0x147/0x1c0 ret_from_fork+0x59/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> Root cause is that --revert-reshape update the raid_disks from 5 to 4, while reshape position is still set, and after reassembling the array, reshape position will be read from super block, then during reshape the checking of 'writepos' that is caculated by old reshape position will fail. Fix this panic the easy way first, by converting the BUG_ON() to WARN_ON(), and stop the reshape if checkings fail. Noted that mdadm must fix --revert-shape as well, and probably md/raid should enhance metadata validation as well, however this means reassemble will fail and there must be user tools to fix the wrong metadata. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Song Liu <song(a)kernel.org> Link: https://lore.kernel.org/r/20240611132251.1967786-13-yukuai1@huaweicloud.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/md/raid5.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index 3cb90d7e88d9..126b9ecfe750 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -5997,7 +5997,9 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, int *sk safepos = conf->reshape_safe; sector_div(safepos, data_disks); if (mddev->reshape_backwards) { - BUG_ON(writepos < reshape_sectors); + if (WARN_ON(writepos < reshape_sectors)) + return MaxSector; + writepos -= reshape_sectors; readpos += reshape_sectors; safepos += reshape_sectors; @@ -6015,14 +6017,18 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, int *sk * to set 'stripe_addr' which is where we will write to. */ if (mddev->reshape_backwards) { - BUG_ON(conf->reshape_progress == 0); + if (WARN_ON(conf->reshape_progress == 0)) + return MaxSector; + stripe_addr = writepos; - BUG_ON((mddev->dev_sectors & - ~((sector_t)reshape_sectors - 1)) - - reshape_sectors - stripe_addr - != sector_nr); + if (WARN_ON((mddev->dev_sectors & + ~((sector_t)reshape_sectors - 1)) - + reshape_sectors - stripe_addr != sector_nr)) + return MaxSector; } else { - BUG_ON(writepos != sector_nr + reshape_sectors); + if (WARN_ON(writepos != sector_nr + reshape_sectors)) + return MaxSector; + stripe_addr = sector_nr; } -- 2.39.2

2 1

[PATCH OLK-6.6] net: missing check virtio
by Zhang Changzhong 04 Sep '24

04 Sep '24

From: Denis Arefev <arefev(a)swemel.ru> stable inclusion from stable-v6.6.44 commit 90d41ebe0cd4635f6410471efc1dd71b33e894cf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ33 CVE: CVE-2024-43817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e269d79c7d35aa3808b1f3c1737d63dab504ddc8 ] Two missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again 1. After the skb_segment function the buffer may become non-linear (nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere the __skb_linearize function will not be executed, then the buffer will remain non-linear. Then the condition (offset >= skb_headlen(skb)) becomes true, which causes WARN_ON_ONCE in skb_checksum_help. 2. The struct sk_buff and struct virtio_net_hdr members must be mathematically related. (gso_size) must be greater than (needed) otherwise WARN_ON_ONCE. (remainder) must be greater than (needed) otherwise WARN_ON_ONCE. (remainder) may be 0 if division is without remainder. offset+2 (4191) > skb_headlen() (1116) WARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 Modules linked in: CPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 Code: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 <0f> 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef RSP: 0018:ffffc90003a9f338 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209 RDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001 RBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c R13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d FS: 0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777 ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584 ip_finish_output_gso net/ipv4/ip_output.c:286 [inline] __ip_finish_output net/ipv4/ip_output.c:308 [inline] __ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433 dst_output include/net/dst.h:451 [inline] ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129 iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82 ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline] sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3545 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561 __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346 dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Found by Linux Verification Center (linuxtesting.org) with Syzkaller Fixes: 0f6925b3e8da ("virtio_net: Do not pull payload in skb->head") Signed-off-by: Denis Arefev <arefev(a)swemel.ru> Message-Id: <20240613095448.27118-1-arefev(a)swemel.ru> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- include/linux/virtio_net.h | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h index 6c395a2..c824c52 100644 --- a/include/linux/virtio_net.h +++ b/include/linux/virtio_net.h @@ -56,6 +56,7 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, unsigned int thlen = 0; unsigned int p_off = 0; unsigned int ip_proto; + u64 ret, remainder, gso_size; if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) { @@ -98,6 +99,16 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, u32 off = __virtio16_to_cpu(little_endian, hdr->csum_offset); u32 needed = start + max_t(u32, thlen, off + sizeof(__sum16)); + if (hdr->gso_size) { + gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); + ret = div64_u64_rem(skb->len, gso_size, &remainder); + if (!(ret && (hdr->gso_size > needed) && + ((remainder > needed) || (remainder == 0)))) { + return -EINVAL; + } + skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG; + } + if (!pskb_may_pull(skb, needed)) return -EINVAL; -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] net: missing check virtio
by Zhang Changzhong 04 Sep '24

04 Sep '24

From: Denis Arefev <arefev(a)swemel.ru> mainline inclusion from mainline-v6.11-rc1 commit e269d79c7d35aa3808b1f3c1737d63dab504ddc8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ33 CVE: CVE-2024-43817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Two missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again 1. After the skb_segment function the buffer may become non-linear (nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere the __skb_linearize function will not be executed, then the buffer will remain non-linear. Then the condition (offset >= skb_headlen(skb)) becomes true, which causes WARN_ON_ONCE in skb_checksum_help. 2. The struct sk_buff and struct virtio_net_hdr members must be mathematically related. (gso_size) must be greater than (needed) otherwise WARN_ON_ONCE. (remainder) must be greater than (needed) otherwise WARN_ON_ONCE. (remainder) may be 0 if division is without remainder. offset+2 (4191) > skb_headlen() (1116) WARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 Modules linked in: CPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 Code: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 <0f> 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef RSP: 0018:ffffc90003a9f338 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209 RDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001 RBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c R13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d FS: 0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777 ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584 ip_finish_output_gso net/ipv4/ip_output.c:286 [inline] __ip_finish_output net/ipv4/ip_output.c:308 [inline] __ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433 dst_output include/net/dst.h:451 [inline] ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129 iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82 ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline] sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3545 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561 __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346 dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Found by Linux Verification Center (linuxtesting.org) with Syzkaller Fixes: 0f6925b3e8da ("virtio_net: Do not pull payload in skb->head") Signed-off-by: Denis Arefev <arefev(a)swemel.ru> Message-Id: <20240613095448.27118-1-arefev(a)swemel.ru> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- include/linux/virtio_net.h | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h index a960de6..b6a9d07 100644 --- a/include/linux/virtio_net.h +++ b/include/linux/virtio_net.h @@ -51,6 +51,7 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, unsigned int thlen = 0; unsigned int p_off = 0; unsigned int ip_proto; + u64 ret, remainder, gso_size; if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) { @@ -87,6 +88,16 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, u32 off = __virtio16_to_cpu(little_endian, hdr->csum_offset); u32 needed = start + max_t(u32, thlen, off + sizeof(__sum16)); + if (hdr->gso_size) { + gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); + ret = div64_u64_rem(skb->len, gso_size, &remainder); + if (!(ret && (hdr->gso_size > needed) && + ((remainder > needed) || (remainder == 0)))) { + return -EINVAL; + } + skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG; + } + if (!pskb_may_pull(skb, needed)) return -EINVAL; -- 2.9.5

2 1

[PATCH OLK-5.10] net: missing check virtio
by Zhang Changzhong 04 Sep '24

04 Sep '24

From: Denis Arefev <arefev(a)swemel.ru> mainline inclusion from mainline-v6.11-rc1 commit e269d79c7d35aa3808b1f3c1737d63dab504ddc8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ33 CVE: CVE-2024-43817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Two missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again 1. After the skb_segment function the buffer may become non-linear (nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere the __skb_linearize function will not be executed, then the buffer will remain non-linear. Then the condition (offset >= skb_headlen(skb)) becomes true, which causes WARN_ON_ONCE in skb_checksum_help. 2. The struct sk_buff and struct virtio_net_hdr members must be mathematically related. (gso_size) must be greater than (needed) otherwise WARN_ON_ONCE. (remainder) must be greater than (needed) otherwise WARN_ON_ONCE. (remainder) may be 0 if division is without remainder. offset+2 (4191) > skb_headlen() (1116) WARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 Modules linked in: CPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 Code: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 <0f> 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef RSP: 0018:ffffc90003a9f338 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209 RDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001 RBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c R13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d FS: 0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777 ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584 ip_finish_output_gso net/ipv4/ip_output.c:286 [inline] __ip_finish_output net/ipv4/ip_output.c:308 [inline] __ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433 dst_output include/net/dst.h:451 [inline] ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129 iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82 ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline] sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3545 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561 __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346 dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Found by Linux Verification Center (linuxtesting.org) with Syzkaller Fixes: 0f6925b3e8da ("virtio_net: Do not pull payload in skb->head") Signed-off-by: Denis Arefev <arefev(a)swemel.ru> Message-Id: <20240613095448.27118-1-arefev(a)swemel.ru> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- include/linux/virtio_net.h | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h index 6047058..29b19d0 100644 --- a/include/linux/virtio_net.h +++ b/include/linux/virtio_net.h @@ -51,6 +51,7 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, unsigned int thlen = 0; unsigned int p_off = 0; unsigned int ip_proto; + u64 ret, remainder, gso_size; if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) { @@ -87,6 +88,16 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, u32 off = __virtio16_to_cpu(little_endian, hdr->csum_offset); u32 needed = start + max_t(u32, thlen, off + sizeof(__sum16)); + if (hdr->gso_size) { + gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); + ret = div64_u64_rem(skb->len, gso_size, &remainder); + if (!(ret && (hdr->gso_size > needed) && + ((remainder > needed) || (remainder == 0)))) { + return -EINVAL; + } + skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG; + } + if (!pskb_may_pull(skb, needed)) return -EINVAL; -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: cfg80211: Avoid Wdiscarded-qualifiers warning
by Yue Haibing 04 Sep '24

04 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAGX1C -------------------------------- Commit 591481cccbad trigger a warning: In file included from ./include/net/genetlink.h:6, from net/wireless/nl80211.c:25: net/wireless/nl80211.c:692:69: warning: initialization discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] 692 | [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range), | ^ ./include/net/netlink.h:407:18: note: in definition of macro 'NLA_POLICY_FULL_RANGE' 407 | .range = _range, \ | ^~~~~~ Remove const qualifier to fix this. Fixes: 591481cccbad ("wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values") Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 89b94d482fcf..674a0d54aff8 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -403,7 +403,7 @@ nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + .len = IEEE80211_MAX_DATA_LEN } }; -static const struct netlink_range_validation q_range = { +static struct netlink_range_validation q_range = { .max = INT_MAX, }; -- 2.34.1

2 1

[PATCH OLK-6.6] f2fs: fix null reference error when checking end of zone
by Kaixiong Yu 04 Sep '24

04 Sep '24

From: Daejun Park <daejun7.park(a)samsung.com> stable inclusion from stable-v6.10.3 commit 381cbe85592c78fbaeb3e770e3e9f3bfa3e67efb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/381cbe85592c78fbaeb3e770e3e9f… CVE: CVE-2024-43857 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c82bc1ab2a8a5e73d9728e80c4c2ed87e8921a38 ] This patch fixes a potentially null pointer being accessed by is_end_zone_blkaddr() that checks the last block of a zone when f2fs is mounted as a single device. Fixes: e067dc3c6b9c ("f2fs: maintain six open zones for zoned devices") Signed-off-by: Daejun Park <daejun7.park(a)samsung.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Daeho Jeong <daehojeong(a)google.com> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/f2fs/data.c [Since hulk-6.6 does not merge stable inclusion commit 7437bb73f087 ("block: remove support for the host aware zone model")] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- fs/f2fs/data.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c index 84fc87018180..0acafb505efc 100644 --- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -924,6 +924,7 @@ int f2fs_merge_page_bio(struct f2fs_io_info *fio) #ifdef CONFIG_BLK_DEV_ZONED static bool is_end_zone_blkaddr(struct f2fs_sb_info *sbi, block_t blkaddr) { + struct block_device *bdev = sbi->sb->s_bdev; int devi = 0; if (f2fs_is_multi_device(sbi)) { @@ -934,8 +935,9 @@ static bool is_end_zone_blkaddr(struct f2fs_sb_info *sbi, block_t blkaddr) return false; } blkaddr -= FDEV(devi).start_blk; + bdev = FDEV(devi).bdev; } - return bdev_zoned_model(FDEV(devi).bdev) == BLK_ZONED_HM && + return bdev_zoned_model(bdev) == BLK_ZONED_HM && f2fs_blkz_is_seq(sbi, devi, blkaddr) && (blkaddr % sbi->blocks_per_blkz == sbi->blocks_per_blkz - 1); } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] btrfs: do not start relocation until in progress drops are done
by Long Li 04 Sep '24

04 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v5.15.26 commit 6599d5e8bd758d897fd2ef4dc388ae50278b1f7e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALPSL CVE: CVE-2022-48901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit b4be6aefa73c9a6899ef3ba9c5faaa8a66e333ef upstream. We hit a bug with a recovering relocation on mount for one of our file systems in production. I reproduced this locally by injecting errors into snapshot delete with balance running at the same time. This presented as an error while looking up an extent item WARNING: CPU: 5 PID: 1501 at fs/btrfs/extent-tree.c:866 lookup_inline_extent_backref+0x647/0x680 CPU: 5 PID: 1501 Comm: btrfs-balance Not tainted 5.16.0-rc8+ #8 RIP: 0010:lookup_inline_extent_backref+0x647/0x680 RSP: 0018:ffffae0a023ab960 EFLAGS: 00010202 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 000000000000000c RDI: 0000000000000000 RBP: ffff943fd2a39b60 R08: 0000000000000000 R09: 0000000000000001 R10: 0001434088152de0 R11: 0000000000000000 R12: 0000000001d05000 R13: ffff943fd2a39b60 R14: ffff943fdb96f2a0 R15: ffff9442fc923000 FS: 0000000000000000(0000) GS:ffff944e9eb40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1157b1fca8 CR3: 000000010f092000 CR4: 0000000000350ee0 Call Trace: <TASK> insert_inline_extent_backref+0x46/0xd0 __btrfs_inc_extent_ref.isra.0+0x5f/0x200 ? btrfs_merge_delayed_refs+0x164/0x190 __btrfs_run_delayed_refs+0x561/0xfa0 ? btrfs_search_slot+0x7b4/0xb30 ? btrfs_update_root+0x1a9/0x2c0 btrfs_run_delayed_refs+0x73/0x1f0 ? btrfs_update_root+0x1a9/0x2c0 btrfs_commit_transaction+0x50/0xa50 ? btrfs_update_reloc_root+0x122/0x220 prepare_to_merge+0x29f/0x320 relocate_block_group+0x2b8/0x550 btrfs_relocate_block_group+0x1a6/0x350 btrfs_relocate_chunk+0x27/0xe0 btrfs_balance+0x777/0xe60 balance_kthread+0x35/0x50 ? btrfs_balance+0xe60/0xe60 kthread+0x16b/0x190 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 </TASK> Normally snapshot deletion and relocation are excluded from running at the same time by the fs_info->cleaner_mutex. However if we had a pending balance waiting to get the ->cleaner_mutex, and a snapshot deletion was running, and then the box crashed, we would come up in a state where we have a half deleted snapshot. Again, in the normal case the snapshot deletion needs to complete before relocation can start, but in this case relocation could very well start before the snapshot deletion completes, as we simply add the root to the dead roots list and wait for the next time the cleaner runs to clean up the snapshot. Fix this by setting a bit on the fs_info if we have any DEAD_ROOT's that had a pending drop_progress key. If they do then we know we were in the middle of the drop operation and set a flag on the fs_info. Then balance can wait until this flag is cleared to start up again. If there are DEAD_ROOT's that don't have a drop_progress set then we're safe to start balance right away as we'll be properly protected by the cleaner_mutex. CC: stable(a)vger.kernel.org # 5.10+ Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/btrfs/disk-io.c fs/btrfs/ctree.h fs/btrfs/transaction.h [conflicts due to 8cd2908846d1 ("btrfs: clear oneshot options on mount and remount") not mergered] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/ctree.h | 10 ++++++++++ fs/btrfs/disk-io.c | 10 ++++++++++ fs/btrfs/extent-tree.c | 10 ++++++++++ fs/btrfs/relocation.c | 13 +++++++++++++ fs/btrfs/root-tree.c | 15 +++++++++++++++ fs/btrfs/transaction.c | 33 ++++++++++++++++++++++++++++++++- fs/btrfs/transaction.h | 1 + 7 files changed, 91 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h index 84ac3642023f..90b46ac13003 100644 --- a/fs/btrfs/ctree.h +++ b/fs/btrfs/ctree.h @@ -567,6 +567,9 @@ enum { /* Indicate that we can't trust the free space tree for caching yet */ BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, + + /* Indicate we have half completed snapshot deletions pending. */ + BTRFS_FS_UNFINISHED_DROPS, }; /* @@ -1033,8 +1036,15 @@ enum { BTRFS_ROOT_HAS_LOG_TREE, /* Qgroup flushing is in progress */ BTRFS_ROOT_QGROUP_FLUSHING, + /* This root has a drop operation that was started previously. */ + BTRFS_ROOT_UNFINISHED_DROP, }; +static inline void btrfs_wake_unfinished_drop(struct btrfs_fs_info *fs_info) +{ + clear_and_wake_up_bit(BTRFS_FS_UNFINISHED_DROPS, &fs_info->flags); +} + /* * Record swapped tree blocks of a subvolume tree for delayed subtree trace * code. For detail check comment in fs/btrfs/qgroup.c. diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c index b9a3bdacdede..05bc52003e19 100644 --- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -3427,6 +3427,10 @@ int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_device } set_bit(BTRFS_FS_OPEN, &fs_info->flags); + /* Kick the cleaner thread so it'll start deleting snapshots. */ + if (test_bit(BTRFS_FS_UNFINISHED_DROPS, &fs_info->flags)) + wake_up_process(fs_info->cleaner_kthread); + /* * backuproot only affect mount behavior, and if open_ctree succeeded, * no need to keep the flag @@ -4092,6 +4096,12 @@ void __cold close_ctree(struct btrfs_fs_info *fs_info) */ kthread_park(fs_info->cleaner_kthread); + /* + * If we had UNFINISHED_DROPS we could still be processing them, so + * clear that bit and wake up relocation so it can stop. + */ + btrfs_wake_unfinished_drop(fs_info); + /* wait for the qgroup rescan worker to stop */ btrfs_qgroup_wait_for_completion(fs_info, false); diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 284294620e9f..578b217bc4ea 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5353,6 +5353,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root, int update_ref, int for_reloc) int ret; int level; bool root_dropped = false; + bool unfinished_drop = false; btrfs_debug(fs_info, "Drop subvolume %llu", root->root_key.objectid); @@ -5395,6 +5396,8 @@ int btrfs_drop_snapshot(struct btrfs_root *root, int update_ref, int for_reloc) * already dropped. */ set_bit(BTRFS_ROOT_DELETING, &root->state); + unfinished_drop = test_bit(BTRFS_ROOT_UNFINISHED_DROP, &root->state); + if (btrfs_disk_key_objectid(&root_item->drop_progress) == 0) { level = btrfs_header_level(root->node); path->nodes[level] = btrfs_lock_root_node(root); @@ -5571,6 +5574,13 @@ int btrfs_drop_snapshot(struct btrfs_root *root, int update_ref, int for_reloc) kfree(wc); btrfs_free_path(path); out: + /* + * We were an unfinished drop root, check to see if there are any + * pending, and if not clear and wake up any waiters. + */ + if (!err && unfinished_drop) + btrfs_maybe_wake_unfinished_drop(fs_info); + /* * So if we need to stop dropping the snapshot for whatever reason we * need to make sure to add it back to the dead root list so that we diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index c21545c5b34b..cf7a8fcea4d6 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -3595,6 +3595,19 @@ int btrfs_relocate_block_group(struct btrfs_fs_info *fs_info, u64 group_start) int rw = 0; int err = 0; + /* + * This only gets set if we had a half-deleted snapshot on mount. We + * cannot allow relocation to start while we're still trying to clean up + * these pending deletions. + */ + ret = wait_on_bit(&fs_info->flags, BTRFS_FS_UNFINISHED_DROPS, TASK_INTERRUPTIBLE); + if (ret) + return ret; + + /* We may have been woken up by close_ctree, so bail if we're closing. */ + if (btrfs_fs_closing(fs_info)) + return -EINTR; + bg = btrfs_lookup_block_group(fs_info, group_start); if (!bg) return -ENOENT; diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c index cd40e7a92552..7bdaccb58ec0 100644 --- a/fs/btrfs/root-tree.c +++ b/fs/btrfs/root-tree.c @@ -280,6 +280,21 @@ int btrfs_find_orphan_roots(struct btrfs_fs_info *fs_info) WARN_ON(!test_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED, &root->state)); if (btrfs_root_refs(&root->root_item) == 0) { + struct btrfs_key drop_key; + + btrfs_disk_key_to_cpu(&drop_key, &root->root_item.drop_progress); + /* + * If we have a non-zero drop_progress then we know we + * made it partly through deleting this snapshot, and + * thus we need to make sure we block any balance from + * happening until this snapshot is completely dropped. + */ + if (drop_key.objectid != 0 || drop_key.type != 0 || + drop_key.offset != 0) { + set_bit(BTRFS_FS_UNFINISHED_DROPS, &fs_info->flags); + set_bit(BTRFS_ROOT_UNFINISHED_DROP, &root->state); + } + set_bit(BTRFS_ROOT_DEAD_TREE, &root->state); btrfs_add_dead_root(root); } diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c index a6ddf91d5c40..cf7e8a20bb02 100644 --- a/fs/btrfs/transaction.c +++ b/fs/btrfs/transaction.c @@ -1294,6 +1294,32 @@ static noinline int commit_cowonly_roots(struct btrfs_trans_handle *trans) return 0; } +/* + * If we had a pending drop we need to see if there are any others left in our + * dead roots list, and if not clear our bit and wake any waiters. + */ +void btrfs_maybe_wake_unfinished_drop(struct btrfs_fs_info *fs_info) +{ + /* + * We put the drop in progress roots at the front of the list, so if the + * first entry doesn't have UNFINISHED_DROP set we can wake everybody + * up. + */ + spin_lock(&fs_info->trans_lock); + if (!list_empty(&fs_info->dead_roots)) { + struct btrfs_root *root = list_first_entry(&fs_info->dead_roots, + struct btrfs_root, + root_list); + if (test_bit(BTRFS_ROOT_UNFINISHED_DROP, &root->state)) { + spin_unlock(&fs_info->trans_lock); + return; + } + } + spin_unlock(&fs_info->trans_lock); + + btrfs_wake_unfinished_drop(fs_info); +} + /* * dead roots are old snapshots that need to be deleted. This allocates * a dirty root struct and adds it into the list of dead roots that need to @@ -1306,7 +1332,12 @@ void btrfs_add_dead_root(struct btrfs_root *root) spin_lock(&fs_info->trans_lock); if (list_empty(&root->root_list)) { btrfs_grab_root(root); - list_add_tail(&root->root_list, &fs_info->dead_roots); + + /* We want to process the partially complete drops first. */ + if (test_bit(BTRFS_ROOT_UNFINISHED_DROP, &root->state)) + list_add(&root->root_list, &fs_info->dead_roots); + else + list_add_tail(&root->root_list, &fs_info->dead_roots); } spin_unlock(&fs_info->trans_lock); } diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h index eb26eb068fe8..0599e3994633 100644 --- a/fs/btrfs/transaction.h +++ b/fs/btrfs/transaction.h @@ -216,6 +216,7 @@ int btrfs_wait_for_commit(struct btrfs_fs_info *fs_info, u64 transid); void btrfs_add_dead_root(struct btrfs_root *root); int btrfs_defrag_root(struct btrfs_root *root); +void btrfs_maybe_wake_unfinished_drop(struct btrfs_fs_info *fs_info); int btrfs_clean_one_deleted_snapshot(struct btrfs_root *root); int btrfs_commit_transaction(struct btrfs_trans_handle *trans); int btrfs_commit_transaction_async(struct btrfs_trans_handle *trans, -- 2.39.2

2 1

[PATCH OLK-5.10] btrfs: do not start relocation until in progress drops are done
by Long Li 04 Sep '24

04 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v5.15.26 commit 6599d5e8bd758d897fd2ef4dc388ae50278b1f7e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALPSL CVE: CVE-2022-48901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit b4be6aefa73c9a6899ef3ba9c5faaa8a66e333ef upstream. We hit a bug with a recovering relocation on mount for one of our file systems in production. I reproduced this locally by injecting errors into snapshot delete with balance running at the same time. This presented as an error while looking up an extent item WARNING: CPU: 5 PID: 1501 at fs/btrfs/extent-tree.c:866 lookup_inline_extent_backref+0x647/0x680 CPU: 5 PID: 1501 Comm: btrfs-balance Not tainted 5.16.0-rc8+ #8 RIP: 0010:lookup_inline_extent_backref+0x647/0x680 RSP: 0018:ffffae0a023ab960 EFLAGS: 00010202 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 000000000000000c RDI: 0000000000000000 RBP: ffff943fd2a39b60 R08: 0000000000000000 R09: 0000000000000001 R10: 0001434088152de0 R11: 0000000000000000 R12: 0000000001d05000 R13: ffff943fd2a39b60 R14: ffff943fdb96f2a0 R15: ffff9442fc923000 FS: 0000000000000000(0000) GS:ffff944e9eb40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1157b1fca8 CR3: 000000010f092000 CR4: 0000000000350ee0 Call Trace: <TASK> insert_inline_extent_backref+0x46/0xd0 __btrfs_inc_extent_ref.isra.0+0x5f/0x200 ? btrfs_merge_delayed_refs+0x164/0x190 __btrfs_run_delayed_refs+0x561/0xfa0 ? btrfs_search_slot+0x7b4/0xb30 ? btrfs_update_root+0x1a9/0x2c0 btrfs_run_delayed_refs+0x73/0x1f0 ? btrfs_update_root+0x1a9/0x2c0 btrfs_commit_transaction+0x50/0xa50 ? btrfs_update_reloc_root+0x122/0x220 prepare_to_merge+0x29f/0x320 relocate_block_group+0x2b8/0x550 btrfs_relocate_block_group+0x1a6/0x350 btrfs_relocate_chunk+0x27/0xe0 btrfs_balance+0x777/0xe60 balance_kthread+0x35/0x50 ? btrfs_balance+0xe60/0xe60 kthread+0x16b/0x190 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 </TASK> Normally snapshot deletion and relocation are excluded from running at the same time by the fs_info->cleaner_mutex. However if we had a pending balance waiting to get the ->cleaner_mutex, and a snapshot deletion was running, and then the box crashed, we would come up in a state where we have a half deleted snapshot. Again, in the normal case the snapshot deletion needs to complete before relocation can start, but in this case relocation could very well start before the snapshot deletion completes, as we simply add the root to the dead roots list and wait for the next time the cleaner runs to clean up the snapshot. Fix this by setting a bit on the fs_info if we have any DEAD_ROOT's that had a pending drop_progress key. If they do then we know we were in the middle of the drop operation and set a flag on the fs_info. Then balance can wait until this flag is cleared to start up again. If there are DEAD_ROOT's that don't have a drop_progress set then we're safe to start balance right away as we'll be properly protected by the cleaner_mutex. CC: stable(a)vger.kernel.org # 5.10+ Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/btrfs/disk-io.c fs/btrfs/ctree.h fs/btrfs/transaction.h [conflicts due to 8cd2908846d1 ("btrfs: clear oneshot options on mount and remount") not mergered] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/ctree.h | 10 ++++++++++ fs/btrfs/disk-io.c | 10 ++++++++++ fs/btrfs/extent-tree.c | 10 ++++++++++ fs/btrfs/relocation.c | 13 +++++++++++++ fs/btrfs/root-tree.c | 15 +++++++++++++++ fs/btrfs/transaction.c | 33 ++++++++++++++++++++++++++++++++- fs/btrfs/transaction.h | 1 + 7 files changed, 91 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h index 482842ac397b..abc1e72a4464 100644 --- a/fs/btrfs/ctree.h +++ b/fs/btrfs/ctree.h @@ -565,6 +565,9 @@ enum { /* Indicate that we can't trust the free space tree for caching yet */ BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, + + /* Indicate we have half completed snapshot deletions pending. */ + BTRFS_FS_UNFINISHED_DROPS, }; /* @@ -1031,8 +1034,15 @@ enum { BTRFS_ROOT_HAS_LOG_TREE, /* Qgroup flushing is in progress */ BTRFS_ROOT_QGROUP_FLUSHING, + /* This root has a drop operation that was started previously. */ + BTRFS_ROOT_UNFINISHED_DROP, }; +static inline void btrfs_wake_unfinished_drop(struct btrfs_fs_info *fs_info) +{ + clear_and_wake_up_bit(BTRFS_FS_UNFINISHED_DROPS, &fs_info->flags); +} + /* * Record swapped tree blocks of a subvolume tree for delayed subtree trace * code. For detail check comment in fs/btrfs/qgroup.c. diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c index 707344288b1c..b923011dec85 100644 --- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -3444,6 +3444,10 @@ int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_device } set_bit(BTRFS_FS_OPEN, &fs_info->flags); + /* Kick the cleaner thread so it'll start deleting snapshots. */ + if (test_bit(BTRFS_FS_UNFINISHED_DROPS, &fs_info->flags)) + wake_up_process(fs_info->cleaner_kthread); + /* * backuproot only affect mount behavior, and if open_ctree succeeded, * no need to keep the flag @@ -4109,6 +4113,12 @@ void __cold close_ctree(struct btrfs_fs_info *fs_info) */ kthread_park(fs_info->cleaner_kthread); + /* + * If we had UNFINISHED_DROPS we could still be processing them, so + * clear that bit and wake up relocation so it can stop. + */ + btrfs_wake_unfinished_drop(fs_info); + /* wait for the qgroup rescan worker to stop */ btrfs_qgroup_wait_for_completion(fs_info, false); diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 3ba43a40032c..1cf787209798 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5365,6 +5365,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root, int update_ref, int for_reloc) int ret; int level; bool root_dropped = false; + bool unfinished_drop = false; btrfs_debug(fs_info, "Drop subvolume %llu", root->root_key.objectid); @@ -5407,6 +5408,8 @@ int btrfs_drop_snapshot(struct btrfs_root *root, int update_ref, int for_reloc) * already dropped. */ set_bit(BTRFS_ROOT_DELETING, &root->state); + unfinished_drop = test_bit(BTRFS_ROOT_UNFINISHED_DROP, &root->state); + if (btrfs_disk_key_objectid(&root_item->drop_progress) == 0) { level = btrfs_header_level(root->node); path->nodes[level] = btrfs_lock_root_node(root); @@ -5583,6 +5586,13 @@ int btrfs_drop_snapshot(struct btrfs_root *root, int update_ref, int for_reloc) kfree(wc); btrfs_free_path(path); out: + /* + * We were an unfinished drop root, check to see if there are any + * pending, and if not clear and wake up any waiters. + */ + if (!err && unfinished_drop) + btrfs_maybe_wake_unfinished_drop(fs_info); + /* * So if we need to stop dropping the snapshot for whatever reason we * need to make sure to add it back to the dead root list so that we diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index 93db4486a943..bdfa4a93d373 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -3601,6 +3601,19 @@ int btrfs_relocate_block_group(struct btrfs_fs_info *fs_info, u64 group_start) int rw = 0; int err = 0; + /* + * This only gets set if we had a half-deleted snapshot on mount. We + * cannot allow relocation to start while we're still trying to clean up + * these pending deletions. + */ + ret = wait_on_bit(&fs_info->flags, BTRFS_FS_UNFINISHED_DROPS, TASK_INTERRUPTIBLE); + if (ret) + return ret; + + /* We may have been woken up by close_ctree, so bail if we're closing. */ + if (btrfs_fs_closing(fs_info)) + return -EINTR; + bg = btrfs_lookup_block_group(fs_info, group_start); if (!bg) return -ENOENT; diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c index cd40e7a92552..7bdaccb58ec0 100644 --- a/fs/btrfs/root-tree.c +++ b/fs/btrfs/root-tree.c @@ -280,6 +280,21 @@ int btrfs_find_orphan_roots(struct btrfs_fs_info *fs_info) WARN_ON(!test_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED, &root->state)); if (btrfs_root_refs(&root->root_item) == 0) { + struct btrfs_key drop_key; + + btrfs_disk_key_to_cpu(&drop_key, &root->root_item.drop_progress); + /* + * If we have a non-zero drop_progress then we know we + * made it partly through deleting this snapshot, and + * thus we need to make sure we block any balance from + * happening until this snapshot is completely dropped. + */ + if (drop_key.objectid != 0 || drop_key.type != 0 || + drop_key.offset != 0) { + set_bit(BTRFS_FS_UNFINISHED_DROPS, &fs_info->flags); + set_bit(BTRFS_ROOT_UNFINISHED_DROP, &root->state); + } + set_bit(BTRFS_ROOT_DEAD_TREE, &root->state); btrfs_add_dead_root(root); } diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c index 89117cc2cf05..7d0ea8aeadb0 100644 --- a/fs/btrfs/transaction.c +++ b/fs/btrfs/transaction.c @@ -1301,6 +1301,32 @@ static noinline int commit_cowonly_roots(struct btrfs_trans_handle *trans) return 0; } +/* + * If we had a pending drop we need to see if there are any others left in our + * dead roots list, and if not clear our bit and wake any waiters. + */ +void btrfs_maybe_wake_unfinished_drop(struct btrfs_fs_info *fs_info) +{ + /* + * We put the drop in progress roots at the front of the list, so if the + * first entry doesn't have UNFINISHED_DROP set we can wake everybody + * up. + */ + spin_lock(&fs_info->trans_lock); + if (!list_empty(&fs_info->dead_roots)) { + struct btrfs_root *root = list_first_entry(&fs_info->dead_roots, + struct btrfs_root, + root_list); + if (test_bit(BTRFS_ROOT_UNFINISHED_DROP, &root->state)) { + spin_unlock(&fs_info->trans_lock); + return; + } + } + spin_unlock(&fs_info->trans_lock); + + btrfs_wake_unfinished_drop(fs_info); +} + /* * dead roots are old snapshots that need to be deleted. This allocates * a dirty root struct and adds it into the list of dead roots that need to @@ -1313,7 +1339,12 @@ void btrfs_add_dead_root(struct btrfs_root *root) spin_lock(&fs_info->trans_lock); if (list_empty(&root->root_list)) { btrfs_grab_root(root); - list_add_tail(&root->root_list, &fs_info->dead_roots); + + /* We want to process the partially complete drops first. */ + if (test_bit(BTRFS_ROOT_UNFINISHED_DROP, &root->state)) + list_add(&root->root_list, &fs_info->dead_roots); + else + list_add_tail(&root->root_list, &fs_info->dead_roots); } spin_unlock(&fs_info->trans_lock); } diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h index eb26eb068fe8..0599e3994633 100644 --- a/fs/btrfs/transaction.h +++ b/fs/btrfs/transaction.h @@ -216,6 +216,7 @@ int btrfs_wait_for_commit(struct btrfs_fs_info *fs_info, u64 transid); void btrfs_add_dead_root(struct btrfs_root *root); int btrfs_defrag_root(struct btrfs_root *root); +void btrfs_maybe_wake_unfinished_drop(struct btrfs_fs_info *fs_info); int btrfs_clean_one_deleted_snapshot(struct btrfs_root *root); int btrfs_commit_transaction(struct btrfs_trans_handle *trans); int btrfs_commit_transaction_async(struct btrfs_trans_handle *trans, -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
by Kaixiong Yu 04 Sep '24

04 Sep '24

From: Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> stable inclusion from stable-v4.19.270 commit 321db5131c92983dac4f3338e8fbb6df214238c0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIN1 CVE: CVE-2023-52907 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9dab880d675b9d0dd56c6428e4e8352a3339371d ] Fix a use-after-free that occurs in hcd when in_urb sent from pn533_usb_send_frame() is completed earlier than out_urb. Its callback frees the skb data in pn533_send_async_complete() that is used as a transfer buffer of out_urb. Wait before sending in_urb until the callback of out_urb is called. To modify the callback of out_urb alone, separate the complete function of out_urb and ack_urb. Found by a modified version of syzkaller. BUG: KASAN: use-after-free in dummy_timer Call Trace: memcpy (mm/kasan/shadow.c:65) dummy_perform_transfer (drivers/usb/gadget/udc/dummy_hcd.c:1352) transfer (drivers/usb/gadget/udc/dummy_hcd.c:1453) dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:1972) arch_static_branch (arch/x86/include/asm/jump_label.h:27) static_key_false (include/linux/jump_label.h:207) timer_expire_exit (include/trace/events/timer.h:127) call_timer_fn (kernel/time/timer.c:1475) expire_timers (kernel/time/timer.c:1519) __run_timers (kernel/time/timer.c:1790) run_timer_softirq (kernel/time/timer.c:1803) Fixes: c46ee38620a2 ("NFC: pn533: add NXP pn533 nfc device driver") Signed-off-by: Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/nfc/pn533/usb.c | 44 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 41 insertions(+), 3 deletions(-) diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c index 84f2983bf384..57b07446bb76 100644 --- a/drivers/nfc/pn533/usb.c +++ b/drivers/nfc/pn533/usb.c @@ -153,10 +153,17 @@ static int pn533_usb_send_ack(struct pn533 *dev, gfp_t flags) return usb_submit_urb(phy->ack_urb, flags); } +struct pn533_out_arg { + struct pn533_usb_phy *phy; + struct completion done; +}; + static int pn533_usb_send_frame(struct pn533 *dev, struct sk_buff *out) { struct pn533_usb_phy *phy = dev->phy; + struct pn533_out_arg arg; + void *cntx; int rc; if (phy->priv == NULL) @@ -168,10 +175,17 @@ static int pn533_usb_send_frame(struct pn533 *dev, print_hex_dump_debug("PN533 TX: ", DUMP_PREFIX_NONE, 16, 1, out->data, out->len, false); + init_completion(&arg.done); + cntx = phy->out_urb->context; + phy->out_urb->context = &arg; + rc = usb_submit_urb(phy->out_urb, GFP_KERNEL); if (rc) return rc; + wait_for_completion(&arg.done); + phy->out_urb->context = cntx; + if (dev->protocol_type == PN533_PROTO_REQ_RESP) { /* request for response for sent packet directly */ rc = pn533_submit_urb_for_response(phy, GFP_KERNEL); @@ -412,7 +426,31 @@ static int pn533_acr122_poweron_rdr(struct pn533_usb_phy *phy) return arg.rc; } -static void pn533_send_complete(struct urb *urb) +static void pn533_out_complete(struct urb *urb) +{ + struct pn533_out_arg *arg = urb->context; + struct pn533_usb_phy *phy = arg->phy; + + switch (urb->status) { + case 0: + break; /* success */ + case -ECONNRESET: + case -ENOENT: + dev_dbg(&phy->udev->dev, + "The urb has been stopped (status %d)\n", + urb->status); + break; + case -ESHUTDOWN: + default: + nfc_err(&phy->udev->dev, + "Urb failure (status %d)\n", + urb->status); + } + + complete(&arg->done); +} + +static void pn533_ack_complete(struct urb *urb) { struct pn533_usb_phy *phy = urb->context; @@ -500,10 +538,10 @@ static int pn533_usb_probe(struct usb_interface *interface, usb_fill_bulk_urb(phy->out_urb, phy->udev, usb_sndbulkpipe(phy->udev, out_endpoint), - NULL, 0, pn533_send_complete, phy); + NULL, 0, pn533_out_complete, phy); usb_fill_bulk_urb(phy->ack_urb, phy->udev, usb_sndbulkpipe(phy->udev, out_endpoint), - NULL, 0, pn533_send_complete, phy); + NULL, 0, pn533_ack_complete, phy); switch (id->driver_info) { case PN533_DEVICE_STD: -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net: hns3: do not allow call hns3_nic_net_open repeatedly
by Xiang Yang 04 Sep '24

04 Sep '24

From: Jian Shen <shenjian15(a)huawei.com> mainline inclusion from mainline-v5.15-rc4 commit 5b09e88e1bf7fe86540fab4b5f3eece8abead39e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4O1 CVE: CVE-2021-47400 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- hns3_nic_net_open() is not allowed to called repeatly, but there is no checking for this. When doing device reset and setup tc concurrently, there is a small oppotunity to call hns3_nic_net_open repeatedly, and cause kernel bug by calling napi_enable twice. The calltrace information is like below: [ 3078.222780] ------------[ cut here ]------------ [ 3078.230255] kernel BUG at net/core/dev.c:6991! [ 3078.236224] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 3078.243431] Modules linked in: hns3 hclgevf hclge hnae3 vfio_iommu_type1 vfio_pci vfio_virqfd vfio pv680_mii(O) [ 3078.258880] CPU: 0 PID: 295 Comm: kworker/u8:5 Tainted: G O 5.14.0-rc4+ #1 [ 3078.269102] Hardware name: , BIOS KpxxxFPGA 1P B600 V181 08/12/2021 [ 3078.276801] Workqueue: hclge hclge_service_task [hclge] [ 3078.288774] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--) [ 3078.296168] pc : napi_enable+0x80/0x84 tc qdisc sho[w 3d0e7v8 .e3t0h218 79] lr : hns3_nic_net_open+0x138/0x510 [hns3] [ 3078.314771] sp : ffff8000108abb20 [ 3078.319099] x29: ffff8000108abb20 x28: 0000000000000000 x27: ffff0820a8490300 [ 3078.329121] x26: 0000000000000001 x25: ffff08209cfc6200 x24: 0000000000000000 [ 3078.339044] x23: ffff0820a8490300 x22: ffff08209cd76000 x21: ffff0820abfe3880 [ 3078.349018] x20: 0000000000000000 x19: ffff08209cd76900 x18: 0000000000000000 [ 3078.358620] x17: 0000000000000000 x16: ffffc816e1727a50 x15: 0000ffff8f4ff930 [ 3078.368895] x14: 0000000000000000 x13: 0000000000000000 x12: 0000259e9dbeb6b4 [ 3078.377987] x11: 0096a8f7e764eb40 x10: 634615ad28d3eab5 x9 : ffffc816ad8885b8 [ 3078.387091] x8 : ffff08209cfc6fb8 x7 : ffff0820ac0da058 x6 : ffff0820a8490344 [ 3078.396356] x5 : 0000000000000140 x4 : 0000000000000003 x3 : ffff08209cd76938 [ 3078.405365] x2 : 0000000000000000 x1 : 0000000000000010 x0 : ffff0820abfe38a0 [ 3078.414657] Call trace: [ 3078.418517] napi_enable+0x80/0x84 [ 3078.424626] hns3_reset_notify_up_enet+0x78/0xd0 [hns3] [ 3078.433469] hns3_reset_notify+0x64/0x80 [hns3] [ 3078.441430] hclge_notify_client+0x68/0xb0 [hclge] [ 3078.450511] hclge_reset_rebuild+0x524/0x884 [hclge] [ 3078.458879] hclge_reset_service_task+0x3c4/0x680 [hclge] [ 3078.467470] hclge_service_task+0xb0/0xb54 [hclge] [ 3078.475675] process_one_work+0x1dc/0x48c [ 3078.481888] worker_thread+0x15c/0x464 [ 3078.487104] kthread+0x160/0x170 [ 3078.492479] ret_from_fork+0x10/0x18 [ 3078.498785] Code: c8027c81 35ffffa2 d50323bf d65f03c0 (d4210000) [ 3078.506889] ---[ end trace 8ebe0340a1b0fb44 ]--- Once hns3_nic_net_open() is excute success, the flag HNS3_NIC_STATE_DOWN will be cleared. So add checking for this flag, directly return when HNS3_NIC_STATE_DOWN is no set. Fixes: e888402789b9 ("net: hns3: call hns3_nic_net_open() while doing HNAE3_UP_CLIENT") Signed-off-by: Jian Shen <shenjian15(a)huawei.com> Signed-off-by: Guangbin Huang <huangguangbin2(a)huawei.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c index 20703ce86281..89f1d0597844 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c @@ -438,6 +438,11 @@ static int hns3_nic_net_open(struct net_device *netdev) if (hns3_nic_resetting(netdev)) return -EBUSY; + if (!test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) { + netdev_warn(netdev, "net open repeatedly!\n"); + return 0; + } + netif_carrier_off(netdev); ret = hns3_nic_set_real_num_queue(netdev); -- 2.34.1

2 1

[PATCH OLK-5.10] dma: fix call order in dmam_free_coherent
by Kaixiong Yu 04 Sep '24

04 Sep '24

From: Lance Richardson <rlance(a)google.com> stable inclusion from stable-v6.6.44 commit 1fe97f68fce1ba24bf823bfb0eb0956003473130 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ2W CVE: CVE-2024-43856 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 28e8b7406d3a1f5329a03aa25a43aa28e087cb20 ] dmam_free_coherent() frees a DMA allocation, which makes the freed vaddr available for reuse, then calls devres_destroy() to remove and free the data structure used to track the DMA allocation. Between the two calls, it is possible for a concurrent task to make an allocation with the same vaddr and add it to the devres list. If this happens, there will be two entries in the devres list with the same vaddr and devres_destroy() can free the wrong entry, triggering the WARN_ON() in dmam_match. Fix by destroying the devres entry before freeing the DMA allocation. Tested: kokonut //net/encryption http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03 Fixes: 9ac7849e35f7 ("devres: device resource management") Signed-off-by: Lance Richardson <rlance(a)google.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- kernel/dma/mapping.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/dma/mapping.c b/kernel/dma/mapping.c index 51bb8fa8eb89..453c0fbe87ff 100644 --- a/kernel/dma/mapping.c +++ b/kernel/dma/mapping.c @@ -60,8 +60,8 @@ void dmam_free_coherent(struct device *dev, size_t size, void *vaddr, { struct dma_devres match_data = { size, vaddr, dma_handle }; - dma_free_coherent(dev, size, vaddr, dma_handle); WARN_ON(devres_destroy(dev, dmam_release, dmam_match, &match_data)); + dma_free_coherent(dev, size, vaddr, dma_handle); } EXPORT_SYMBOL(dmam_free_coherent); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
by Wang Hai 04 Sep '24

04 Sep '24

From: Maciej Żenczykowski <maze(a)google.com> stable inclusion from stable-v4.19.271 commit 63d161f29cd39c050e8873aa36e0c9fc013bb763 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIDP CVE: CVE-2023-52894 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c6ec929595c7443250b2a4faea988c62019d5cd2 upstream. In Google internal bug 265639009 we've received an (as yet) unreproducible crash report from an aarch64 GKI 5.10.149-android13 running device. AFAICT the source code is at: https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_1… The call stack is: ncm_close() -> ncm_notify() -> ncm_do_notify() with the crash at: ncm_do_notify+0x98/0x270 Code: 79000d0b b9000a6c f940012a f9400269 (b9405d4b) Which I believe disassembles to (I don't know ARM assembly, but it looks sane enough to me...): // halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification) 0B 0D 00 79 strh w11, [x8, #6] // word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request) 6C 0A 00 B9 str w12, [x19, #8] // x10 (NULL) was read here from offset 0 of valid pointer x9 // IMHO we're reading 'cdev->gadget' and getting NULL // gadget is indeed at offset 0 of struct usb_composite_dev 2A 01 40 F9 ldr x10, [x9] // loading req->buf pointer, which is at offset 0 of struct usb_request 69 02 40 F9 ldr x9, [x19] // x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed 4B 5D 40 B9 ldr w11, [x10, #0x5c] which seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment: event->wLength = cpu_to_le16(8); req->length = NCM_STATUS_BYTECOUNT; /* SPEED_CHANGE data is up/down speeds in bits/sec */ data = req->buf + sizeof *event; data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); My analysis of registers and NULL ptr deref crash offset (Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c) heavily suggests that the crash is due to 'cdev->gadget' being NULL when executing: data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); which calls: ncm_bitrate(NULL) which then calls: gadget_is_superspeed(NULL) which reads ((struct usb_gadget *)NULL)->max_speed and hits a panic. AFAICT, if I'm counting right, the offset of max_speed is indeed 0x5C. (remember there's a GKI KABI reservation of 16 bytes in struct work_struct) It's not at all clear to me how this is all supposed to work... but returning 0 seems much better than panic-ing... Cc: Felipe Balbi <balbi(a)kernel.org> Cc: Lorenzo Colitti <lorenzo(a)google.com> Cc: Carlos Llamas <cmllamas(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Maciej Żenczykowski <maze(a)google.com> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20230117131839.1138208-1-maze@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/gadget/function/f_ncm.c [Context conflict] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/usb/gadget/function/f_ncm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c index 3da7e6511fc6..6031e96cf351 100644 --- a/drivers/usb/gadget/function/f_ncm.c +++ b/drivers/usb/gadget/function/f_ncm.c @@ -85,7 +85,9 @@ static inline struct f_ncm *func_to_ncm(struct usb_function *f) /* peak (theoretical) bulk transfer rate in bits-per-second */ static inline unsigned ncm_bitrate(struct usb_gadget *g) { - if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER) + if (!g) + return 0; + else if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER) return 13 * 1024 * 8 * 1000 * 8; else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH) return 13 * 512 * 8 * 1000 * 8; -- 2.17.1

2 1

[PATCH OLK-5.10] btrfs: do not WARN_ON() if we have PageError set
by Yu Kuai 04 Sep '24

04 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v5.17-rc7 commit a50e1fcbc9b85fd4e95b89a75c0884cb032a3e06 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALPSO CVE: CVE-2022-48902 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- Whenever we do any extent buffer operations we call assert_eb_page_uptodate() to complain loudly if we're operating on an non-uptodate page. Our overnight tests caught this warning earlier this week WARNING: CPU: 1 PID: 553508 at fs/btrfs/extent_io.c:6849 assert_eb_page_uptodate+0x3f/0x50 CPU: 1 PID: 553508 Comm: kworker/u4:13 Tainted: G W 5.17.0-rc3+ #564 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 Workqueue: btrfs-cache btrfs_work_helper RIP: 0010:assert_eb_page_uptodate+0x3f/0x50 RSP: 0018:ffffa961440a7c68 EFLAGS: 00010246 RAX: 0017ffffc0002112 RBX: ffffe6e74453f9c0 RCX: 0000000000001000 RDX: ffffe6e74467c887 RSI: ffffe6e74453f9c0 RDI: ffff8d4c5efc2fc0 RBP: 0000000000000d56 R08: ffff8d4d4a224000 R09: 0000000000000000 R10: 00015817fa9d1ef0 R11: 000000000000000c R12: 00000000000007b1 R13: ffff8d4c5efc2fc0 R14: 0000000001500000 R15: 0000000001cb1000 FS: 0000000000000000(0000) GS:ffff8d4dbbd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff31d3448d8 CR3: 0000000118be8004 CR4: 0000000000370ee0 Call Trace: extent_buffer_test_bit+0x3f/0x70 free_space_test_bit+0xa6/0xc0 load_free_space_tree+0x1f6/0x470 caching_thread+0x454/0x630 ? rcu_read_lock_sched_held+0x12/0x60 ? rcu_read_lock_sched_held+0x12/0x60 ? rcu_read_lock_sched_held+0x12/0x60 ? lock_release+0x1f0/0x2d0 btrfs_work_helper+0xf2/0x3e0 ? lock_release+0x1f0/0x2d0 ? finish_task_switch.isra.0+0xf9/0x3a0 process_one_work+0x26d/0x580 ? process_one_work+0x580/0x580 worker_thread+0x55/0x3b0 ? process_one_work+0x580/0x580 kthread+0xf0/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 This was partially fixed by c2e39305299f01 ("btrfs: clear extent buffer uptodate when we fail to write it"), however all that fix did was keep us from finding extent buffers after a failed writeout. It didn't keep us from continuing to use a buffer that we already had found. In this case we're searching the commit root to cache the block group, so we can start committing the transaction and switch the commit root and then start writing. After the switch we can look up an extent buffer that hasn't been written yet and start processing that block group. Then we fail to write that block out and clear Uptodate on the page, and then we start spewing these errors. Normally we're protected by the tree lock to a certain degree here. If we read a block we have that block read locked, and we block the writer from locking the block before we submit it for the write. However this isn't necessarily fool proof because the read could happen before we do the submit_bio and after we locked and unlocked the extent buffer. Also in this particular case we have path->skip_locking set, so that won't save us here. We'll simply get a block that was valid when we read it, but became invalid while we were using it. What we really want is to catch the case where we've "read" a block but it's not marked Uptodate. On read we ClearPageError(), so if we're !Uptodate and !Error we know we didn't do the right thing for reading the page. Fix this by checking !Uptodate && !Error, this way we will not complain if our buffer gets invalidated while we're using it, and we'll maintain the spirit of the check which is to make sure we have a fully in-cache block while we're messing with it. CC: stable(a)vger.kernel.org # 5.4+ Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent_io.c [1. commit a1d767c11cca ("btrfs: introduce helpers for subpage uptodate status") is not backported, subpage is not supported. 2. commit b8f957715eae ("btrfs: support page uptodate assertions in subpage mode") is not backported, the helper assert_eb_page_uptodate() is not introduced.] Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- fs/btrfs/extent_io.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c index 104e2f1fe4f7..6bcaf539f894 100644 --- a/fs/btrfs/extent_io.c +++ b/fs/btrfs/extent_io.c @@ -5734,7 +5734,7 @@ void write_extent_buffer_chunk_tree_uuid(const struct extent_buffer *eb, { char *kaddr; - WARN_ON(!PageUptodate(eb->pages[0])); + WARN_ON(!PageUptodate(eb->pages[0]) && !PageError(eb->pages[0])); kaddr = page_address(eb->pages[0]); memcpy(kaddr + offsetof(struct btrfs_header, chunk_tree_uuid), srcv, BTRFS_FSID_SIZE); @@ -5744,7 +5744,7 @@ void write_extent_buffer_fsid(const struct extent_buffer *eb, const void *srcv) { char *kaddr; - WARN_ON(!PageUptodate(eb->pages[0])); + WARN_ON(!PageUptodate(eb->pages[0]) && !PageError(eb->pages[0])); kaddr = page_address(eb->pages[0]); memcpy(kaddr + offsetof(struct btrfs_header, fsid), srcv, BTRFS_FSID_SIZE); @@ -5767,7 +5767,7 @@ void write_extent_buffer(const struct extent_buffer *eb, const void *srcv, while (len > 0) { page = eb->pages[i]; - WARN_ON(!PageUptodate(page)); + WARN_ON(!PageUptodate(page) && !PageError(page)); cur = min(len, PAGE_SIZE - offset); kaddr = page_address(page); @@ -5796,7 +5796,7 @@ void memzero_extent_buffer(const struct extent_buffer *eb, unsigned long start, while (len > 0) { page = eb->pages[i]; - WARN_ON(!PageUptodate(page)); + WARN_ON(!PageUptodate(page) && !PageError(page)); cur = min(len, PAGE_SIZE - offset); kaddr = page_address(page); @@ -5844,7 +5844,7 @@ void copy_extent_buffer(const struct extent_buffer *dst, while (len > 0) { page = dst->pages[i]; - WARN_ON(!PageUptodate(page)); + WARN_ON(!PageUptodate(page) && !PageError(page)); cur = min(len, (unsigned long)(PAGE_SIZE - offset)); @@ -5906,7 +5906,8 @@ int extent_buffer_test_bit(const struct extent_buffer *eb, unsigned long start, eb_bitmap_offset(eb, start, nr, &i, &offset); page = eb->pages[i]; - WARN_ON(!PageUptodate(page)); + WARN_ON(!PageUptodate(page) && !PageError(page)); + kaddr = page_address(page); return 1U & (kaddr[offset] >> (nr & (BITS_PER_BYTE - 1))); } @@ -5931,7 +5932,7 @@ void extent_buffer_bitmap_set(const struct extent_buffer *eb, unsigned long star eb_bitmap_offset(eb, start, pos, &i, &offset); page = eb->pages[i]; - WARN_ON(!PageUptodate(page)); + WARN_ON(!PageUptodate(page) && !PageError(page)); kaddr = page_address(page); while (len >= bits_to_set) { @@ -5942,7 +5943,7 @@ void extent_buffer_bitmap_set(const struct extent_buffer *eb, unsigned long star if (++offset >= PAGE_SIZE && len > 0) { offset = 0; page = eb->pages[++i]; - WARN_ON(!PageUptodate(page)); + WARN_ON(!PageUptodate(page) && !PageError(page)); kaddr = page_address(page); } } @@ -5974,7 +5975,7 @@ void extent_buffer_bitmap_clear(const struct extent_buffer *eb, eb_bitmap_offset(eb, start, pos, &i, &offset); page = eb->pages[i]; - WARN_ON(!PageUptodate(page)); + WARN_ON(!PageUptodate(page) && !PageError(page)); kaddr = page_address(page); while (len >= bits_to_clear) { @@ -5985,7 +5986,7 @@ void extent_buffer_bitmap_clear(const struct extent_buffer *eb, if (++offset >= PAGE_SIZE && len > 0) { offset = 0; page = eb->pages[++i]; - WARN_ON(!PageUptodate(page)); + WARN_ON(!PageUptodate(page) && !PageError(page)); kaddr = page_address(page); } } -- 2.39.2

2 1

[PATCH OLK-6.6 0/4] mainline patches
by Chen Ridong 04 Sep '24

04 Sep '24

Chen Ridong (1): cgroup/cpuset: fix panic caused by partcmd_update Waiman Long (3): cgroup/cpuset: Optimize isolated partition only generate_sched_domains() calls cgroup/cpuset: Fix remote root partition creation problem cgroup/cpuset: Clear effective_xcpus on cpus_allowed clearing only if cpus.exclusive not set kernel/cgroup/cpuset.c | 68 +++++++++++++++++++++++++++++++++--------- 1 file changed, 54 insertions(+), 14 deletions(-) -- 2.34.1

2 6

[PATCH OLK-5.10 0/3] btrfs: do not WARN_ON() if we have PageError set
by Yu Kuai 04 Sep '24

04 Sep '24

Josef Bacik (1): btrfs: do not WARN_ON() if we have PageError set Qu Wenruo (2): btrfs: handle sectorsize < PAGE_SIZE case for extent buffer accessors btrfs: support page uptodate assertions in subpage mode fs/btrfs/ctree.c | 3 +- fs/btrfs/ctree.h | 38 ++++++++++++- fs/btrfs/extent_io.c | 116 +++++++++++++++++++++++++++------------- fs/btrfs/struct-funcs.c | 18 ++++--- 4 files changed, 127 insertions(+), 48 deletions(-) -- 2.39.2

2 4

[PATCH OLK-6.6] ext4: Track data blocks freeing operation in journal
by Zhihao Cheng 04 Sep '24

04 Sep '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9DN5Z -------------------------------- Since commit 7f6416dcd4a3f ("ext4: implement writeback iomap path"), the order mode is removed in iomap framework, which lets ext4_mb_clear_bb() free data blocks immediately. It may cause stale data read from truncated file in power-cut case. Following is details: P1 P2 vfs_truncate(file A) ext4_setattr EXT4_I(inode)->i_disksize = attr->ia_size // record in journal ext4_truncate ext4_mb_clear_bb mb_free_blocks // free block i vfs_write(file B) // get block i and writeback >> powercut << In the next mount, inode size and extent tree is stale(before truncated), the content in block i is file B. Fix the problem by tracking free data blocks in journal for iomap/non-writeback case. Fixes: 7f6416dcd4a3 ("ext4: implement writeback iomap path") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/ext4_jbd2.c | 6 ------ fs/ext4/ext4_jbd2.h | 7 +++++++ 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c index 94c8073b49e7..d1a2e6624401 100644 --- a/fs/ext4/ext4_jbd2.c +++ b/fs/ext4/ext4_jbd2.c @@ -11,12 +11,6 @@ int ext4_inode_journal_mode(struct inode *inode) { if (EXT4_JOURNAL(inode) == NULL) return EXT4_INODE_WRITEBACK_DATA_MODE; /* writeback */ - /* - * Ordered mode is no longer needed for the inode that use the - * iomap path, always use writeback mode. - */ - if (ext4_test_inode_state(inode, EXT4_STATE_BUFFERED_IOMAP)) - return EXT4_INODE_WRITEBACK_DATA_MODE; /* writeback */ /* We do not support data journalling with delayed allocation */ if (!S_ISREG(inode->i_mode) || ext4_test_inode_flag(inode, EXT4_INODE_EA_INODE) || diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h index 0c77697d5e90..c52d1caf6622 100644 --- a/fs/ext4/ext4_jbd2.h +++ b/fs/ext4/ext4_jbd2.h @@ -467,6 +467,13 @@ static inline int ext4_should_journal_data(struct inode *inode) static inline int ext4_should_order_data(struct inode *inode) { + /* + * Ordered mode is no longer needed for the inode that use the + * iomap path, always use writeback mode. + */ + if (ext4_test_inode_state(inode, EXT4_STATE_BUFFERED_IOMAP)) + return 0; /* writeback */ + return ext4_inode_journal_mode(inode) & EXT4_INODE_ORDERED_DATA_MODE; } -- 2.31.1

2 1

【重要】openEuler 24.03 LTS SP1版本需求收集中，请大家提交需要合入的特性到release plan
by Sujinling 04 Sep '24

04 Sep '24

大家好， openEuler 24.03 LTS SP1是基于6.6内核的24.03-LTS版本增强扩展版本，按release-plan计划启动需求收集，欢迎各sig maintainer、伙伴和社区开发者们积极反馈和交流。请大家提交需要合入的特性清单到release plan上，感谢！ openEuler 24.03 LTS SP1版本release plan详细版本计划： https://gitee.com/openeuler/release-management/blob/master/openEuler-24.03-… 需求申请流程链接，请按照流程步骤提交，issue 类型选择需求， issue 标题以 [openEuler-24.03 LTS SP1] 开头： https://gitee.com/openeuler/release-management/blob/master/Goverance/openEu… Thanks & best regards, 苏锦铃

1 1

[PATCH openEuler-22.03-LTS-SP1] fuse: Initialize beyond-EOF page contents before setting uptodate
by Yifan Qiao 04 Sep '24

04 Sep '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v6.6.48 commit ac42e0f0eb66af966015ee33fd355bc6f5d80cd6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOAMF CVE: CVE-2024-44947 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3c0da3d163eb32f1f91891efaade027fa9b245b9 upstream. fuse_notify_store(), unlike fuse_do_readpage(), does not enable page zeroing (because it can be used to change partial page contents). So fuse_notify_store() must be more careful to fully initialize page contents (including parts of the page that are beyond end-of-file) before marking the page uptodate. The current code can leave beyond-EOF page contents uninitialized, which makes these uninitialized page contents visible to userspace via mmap(). This is an information leak, but only affects systems which do not enable init-on-alloc (via CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y or the corresponding kernel command line parameter). Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2574 Cc: stable(a)kernel.org Fixes: a1d75f258230 ("fuse: add store request") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/fuse/dev.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 8ac91ba05d6d..e6cbed7aedcb 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -1627,9 +1627,11 @@ static int fuse_notify_store(struct fuse_conn *fc, unsigned int size, this_num = min_t(unsigned, num, PAGE_SIZE - offset); err = fuse_copy_page(cs, &page, offset, this_num, 0); - if (!err && offset == 0 && - (this_num == PAGE_SIZE || file_size == end)) + if (!PageUptodate(page) && !err && offset == 0 && + (this_num == PAGE_SIZE || file_size == end)) { + zero_user_segment(page, this_num, PAGE_SIZE); SetPageUptodate(page); + } unlock_page(page); put_page(page); -- 2.39.2

2 1

[PATCH OLK-5.10] fuse: Initialize beyond-EOF page contents before setting uptodate
by Yifan Qiao 04 Sep '24

04 Sep '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v6.6.48 commit ac42e0f0eb66af966015ee33fd355bc6f5d80cd6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOAMF CVE: CVE-2024-44947 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3c0da3d163eb32f1f91891efaade027fa9b245b9 upstream. fuse_notify_store(), unlike fuse_do_readpage(), does not enable page zeroing (because it can be used to change partial page contents). So fuse_notify_store() must be more careful to fully initialize page contents (including parts of the page that are beyond end-of-file) before marking the page uptodate. The current code can leave beyond-EOF page contents uninitialized, which makes these uninitialized page contents visible to userspace via mmap(). This is an information leak, but only affects systems which do not enable init-on-alloc (via CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y or the corresponding kernel command line parameter). Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2574 Cc: stable(a)kernel.org Fixes: a1d75f258230 ("fuse: add store request") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/fuse/dev.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 8ac91ba05d6d..e6cbed7aedcb 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -1627,9 +1627,11 @@ static int fuse_notify_store(struct fuse_conn *fc, unsigned int size, this_num = min_t(unsigned, num, PAGE_SIZE - offset); err = fuse_copy_page(cs, &page, offset, this_num, 0); - if (!err && offset == 0 && - (this_num == PAGE_SIZE || file_size == end)) + if (!PageUptodate(page) && !err && offset == 0 && + (this_num == PAGE_SIZE || file_size == end)) { + zero_user_segment(page, this_num, PAGE_SIZE); SetPageUptodate(page); + } unlock_page(page); put_page(page); -- 2.39.2

2 1

[PATCH OLK-6.6] fuse: Initialize beyond-EOF page contents before setting uptodate
by Yifan Qiao 04 Sep '24

04 Sep '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v6.6.48 commit ac42e0f0eb66af966015ee33fd355bc6f5d80cd6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOAMF CVE: CVE-2024-44947 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3c0da3d163eb32f1f91891efaade027fa9b245b9 upstream. fuse_notify_store(), unlike fuse_do_readpage(), does not enable page zeroing (because it can be used to change partial page contents). So fuse_notify_store() must be more careful to fully initialize page contents (including parts of the page that are beyond end-of-file) before marking the page uptodate. The current code can leave beyond-EOF page contents uninitialized, which makes these uninitialized page contents visible to userspace via mmap(). This is an information leak, but only affects systems which do not enable init-on-alloc (via CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y or the corresponding kernel command line parameter). Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2574 Cc: stable(a)kernel.org Fixes: a1d75f258230 ("fuse: add store request") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/fuse/dev.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 1a8f82f478cb..8573d79ef29c 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -1618,9 +1618,11 @@ static int fuse_notify_store(struct fuse_conn *fc, unsigned int size, this_num = min_t(unsigned, num, PAGE_SIZE - offset); err = fuse_copy_page(cs, &page, offset, this_num, 0); - if (!err && offset == 0 && - (this_num == PAGE_SIZE || file_size == end)) + if (!PageUptodate(page) && !err && offset == 0 && + (this_num == PAGE_SIZE || file_size == end)) { + zero_user_segment(page, this_num, PAGE_SIZE); SetPageUptodate(page); + } unlock_page(page); put_page(page); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS V2] cifs: Fix pages leak when cifs_writedata allocate fails in cifs_writedata_direct_alloc()
by Zizhi Wo 04 Sep '24

04 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAOH1I -------------------------------- The function cifs_writedata_alloc() first allocates pages and then executes cifs_writedata_direct_alloc(). If the subsequent allocation of wdata fails, the previously allocated pages are not released, leading to a memory leak: hex dump (first 8 bytes): 00 00 00 00 00 00 00 00 ........ backtrace: [<00000000c2b9cca5>] cifs_write_from_iter.isra.0+0x103/0x730 [<0000000069a4b2e6>] cifs_user_writev+0x138/0x280 [<00000000bfdbeacd>] __vfs_write+0x12b/0x190 [<00000000460567cf>] vfs_write+0xac/0x1a0 [<00000000f92e5dfc>] ksys_write+0x43/0xb0 [<0000000094ddd57e>] do_syscall_64+0x63/0x220 [<0000000055ce26ff>] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [<00000000359223fa>] 0xffffffffffffffff This issue can be avoided by promptly using kvfree. Fixes: 8e7360f67e75 ("CIFS: Add support for direct pages in wdata") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/cifssmb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c index cb70f0c6aa1b..7950c906e7b3 100644 --- a/fs/cifs/cifssmb.c +++ b/fs/cifs/cifssmb.c @@ -2129,6 +2129,8 @@ cifs_writedata_direct_alloc(struct page **pages, work_func_t complete) INIT_LIST_HEAD(&wdata->list); init_completion(&wdata->done); INIT_WORK(&wdata->work, complete); + } else { + kvfree(pages); } return wdata; } -- 2.39.2

2 1

[PATCH OLK-5.10] dmaengine: idxd: Prevent use after free on completion memory
by Liu Mingrui 04 Sep '24

04 Sep '24

From: Reinette Chatre <reinette.chatre(a)intel.com> stable inclusion from stable-v6.1.8 commit b9e8e3fcfec625fc1c2f68f684448aeeb882625b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALILE CVE: CVE-2022-48867 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1beeec45f9ac31eba52478379f70a5fa9c2ad005 upstream. On driver unload any pending descriptors are flushed at the time the interrupt is freed: idxd_dmaengine_drv_remove() -> drv_disable_wq() -> idxd_wq_free_irq() -> idxd_flush_pending_descs(). If there are any descriptors present that need to be flushed this flow triggers a "not present" page fault as below: BUG: unable to handle page fault for address: ff391c97c70c9040 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page The address that triggers the fault is the address of the descriptor that was freed moments earlier via: drv_disable_wq()->idxd_wq_free_resources() Fix the use after free by freeing the descriptors after any possible usage. This is done after idxd_wq_reset() to ensure that the memory remains accessible during possible completion writes by the device. Fixes: 63c14ae6c161 ("dmaengine: idxd: refactor wq driver enable/disable operations") Suggested-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: Reinette Chatre <reinette.chatre(a)intel.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Reviewed-by: Fenghua Yu <fenghua.yu(a)intel.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/6c4657d9cff0a0a00501a7b928297ac966e9ec9d.16704524… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/dma/idxd/device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c index 06f5d3783d77..300ee3b5cf63 100644 --- a/drivers/dma/idxd/device.c +++ b/drivers/dma/idxd/device.c @@ -1408,11 +1408,11 @@ void drv_disable_wq(struct idxd_wq *wq) dev_warn(dev, "Clients has claim on wq %d: %d\n", wq->id, idxd_wq_refcount(wq)); - idxd_wq_free_resources(wq); idxd_wq_unmap_portal(wq); idxd_wq_drain(wq); idxd_wq_free_irq(wq); idxd_wq_reset(wq); + idxd_wq_free_resources(wq); percpu_ref_exit(&wq->wq_active); wq->type = IDXD_WQT_NONE; wq->client_count = 0; -- 2.25.1

2 1

[PATCH OLK-5.10] dmaengine: idxd: Prevent use after free on completion memory
by Liu Mingrui 04 Sep '24

04 Sep '24

From: Reinette Chatre <reinette.chatre(a)intel.com> stable inclusion from stable-v6.1.8~66 commit b9e8e3fcfec625fc1c2f68f684448aeeb882625b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALILE CVE: CVE-2022-48867 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1beeec45f9ac31eba52478379f70a5fa9c2ad005 upstream. On driver unload any pending descriptors are flushed at the time the interrupt is freed: idxd_dmaengine_drv_remove() -> drv_disable_wq() -> idxd_wq_free_irq() -> idxd_flush_pending_descs(). If there are any descriptors present that need to be flushed this flow triggers a "not present" page fault as below: BUG: unable to handle page fault for address: ff391c97c70c9040 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page The address that triggers the fault is the address of the descriptor that was freed moments earlier via: drv_disable_wq()->idxd_wq_free_resources() Fix the use after free by freeing the descriptors after any possible usage. This is done after idxd_wq_reset() to ensure that the memory remains accessible during possible completion writes by the device. Fixes: 63c14ae6c161 ("dmaengine: idxd: refactor wq driver enable/disable operations") Suggested-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: Reinette Chatre <reinette.chatre(a)intel.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Reviewed-by: Fenghua Yu <fenghua.yu(a)intel.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/6c4657d9cff0a0a00501a7b928297ac966e9ec9d.16704524… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/dma/idxd/device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c index 06f5d3783d77..300ee3b5cf63 100644 --- a/drivers/dma/idxd/device.c +++ b/drivers/dma/idxd/device.c @@ -1408,11 +1408,11 @@ void drv_disable_wq(struct idxd_wq *wq) dev_warn(dev, "Clients has claim on wq %d: %d\n", wq->id, idxd_wq_refcount(wq)); - idxd_wq_free_resources(wq); idxd_wq_unmap_portal(wq); idxd_wq_drain(wq); idxd_wq_free_irq(wq); idxd_wq_reset(wq); + idxd_wq_free_resources(wq); percpu_ref_exit(&wq->wq_active); wq->type = IDXD_WQT_NONE; wq->client_count = 0; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] fix CVE-2023-45896
by Lin Yujun 04 Sep '24

04 Sep '24

Konstantin Komarov (1): fs/ntfs3: Add more attributes checks in mi_enum_attr() fs/ntfs3/record.c | 63 +++++++++++++++++++++++++++++++++++++---------- 1 file changed, 50 insertions(+), 13 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] fix CVE-2023-45896
by Lin Yujun 04 Sep '24

04 Sep '24

Konstantin Komarov (1): fs/ntfs3: Add more attributes checks in mi_enum_attr() fs/ntfs3/record.c | 63 +++++++++++++++++++++++++++++++++++++---------- 1 file changed, 50 insertions(+), 13 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
by Liu Mingrui 04 Sep '24

04 Sep '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v5.10.224 commit 10f7163bfb5f8b4e0c9c05a939f20b8540e33c65 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPRV CVE: CVE-2024-42311 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 26a2ed107929a855155429b11e1293b83e6b2a8b upstream. Syzbot reports uninitialized value access issue as below: loop0: detected capacity change from 0 to 64 ===================================================== BUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 d_revalidate fs/namei.c:862 [inline] lookup_fast+0x89e/0x8e0 fs/namei.c:1649 walk_component fs/namei.c:2001 [inline] link_path_walk+0x817/0x1480 fs/namei.c:2332 path_lookupat+0xd9/0x6f0 fs/namei.c:2485 filename_lookup+0x22e/0x740 fs/namei.c:2515 user_path_at_empty+0x8b/0x390 fs/namei.c:2924 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3689 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount+0x66b/0x810 fs/namespace.c:3875 __x64_sys_mount+0xe4/0x140 fs/namespace.c:3875 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline] BUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 hfs_ext_read_extent fs/hfs/extent.c:196 [inline] hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271 hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39 filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426 do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553 do_read_cache_page mm/filemap.c:3595 [inline] read_cache_page+0xfb/0x2f0 mm/filemap.c:3604 read_mapping_page include/linux/pagemap.h:755 [inline] hfs_btree_open+0x928/0x1ae0 fs/hfs/btree.c:78 hfs_mdb_get+0x260c/0x3000 fs/hfs/mdb.c:204 hfs_fill_super+0x1fb1/0x2790 fs/hfs/super.c:406 mount_bdev+0x628/0x920 fs/super.c:1359 hfs_mount+0xcd/0xe0 fs/hfs/super.c:456 legacy_get_tree+0x167/0x2e0 fs/fs_context.c:610 vfs_get_tree+0xdc/0x5d0 fs/super.c:1489 do_new_mount+0x7a9/0x16f0 fs/namespace.c:3145 path_mount+0xf98/0x26a0 fs/namespace.c:3475 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x919/0x9e0 fs/namespace.c:3674 __ia32_sys_mount+0x15b/0x1b0 fs/namespace.c:3674 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Uninit was created at: __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2190 [inline] allocate_slab mm/slub.c:2354 [inline] new_slab+0x2d7/0x1400 mm/slub.c:2407 ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] kmem_cache_alloc_lru+0x64d/0xb30 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3018 [inline] hfs_alloc_inode+0x5a/0xc0 fs/hfs/super.c:165 alloc_inode+0x83/0x440 fs/inode.c:260 new_inode_pseudo fs/inode.c:1005 [inline] new_inode+0x38/0x4f0 fs/inode.c:1031 hfs_new_inode+0x61/0x1010 fs/hfs/inode.c:186 hfs_mkdir+0x54/0x250 fs/hfs/dir.c:228 vfs_mkdir+0x49a/0x700 fs/namei.c:4126 do_mkdirat+0x529/0x810 fs/namei.c:4149 __do_sys_mkdirat fs/namei.c:4164 [inline] __se_sys_mkdirat fs/namei.c:4162 [inline] __x64_sys_mkdirat+0xc8/0x120 fs/namei.c:4162 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b It missed to initialize .tz_secondswest, .cached_start and .cached_blocks fields in struct hfs_inode_info after hfs_alloc_inode(), fix it. Cc: stable(a)vger.kernel.org Reported-by: syzbot+3ae6be33a50b5aae4dab(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-fsdevel/0000000000005ad04005ee48897f@google.c… Signed-off-by: Chao Yu <chao(a)kernel.org> Link: https://lore.kernel.org/r/20240616013841.2217-1-chao@kernel.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- fs/hfs/inode.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c index 6fbde990e056..3d59cdb31278 100644 --- a/fs/hfs/inode.c +++ b/fs/hfs/inode.c @@ -200,6 +200,7 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t HFS_I(inode)->flags = 0; HFS_I(inode)->rsrc_inode = NULL; HFS_I(inode)->fs_blocks = 0; + HFS_I(inode)->tz_secondswest = sys_tz.tz_minuteswest * 60; if (S_ISDIR(mode)) { inode->i_size = 2; HFS_SB(sb)->folder_count++; @@ -275,6 +276,8 @@ void hfs_inode_read_fork(struct inode *inode, struct hfs_extent *ext, for (count = 0, i = 0; i < 3; i++) count += be16_to_cpu(ext[i].count); HFS_I(inode)->first_blocks = count; + HFS_I(inode)->cached_start = 0; + HFS_I(inode)->cached_blocks = 0; inode->i_size = HFS_I(inode)->phys_size = log_size; HFS_I(inode)->fs_blocks = (log_size + sb->s_blocksize - 1) >> sb->s_blocksize_bits; -- 2.25.1

2 1

[openeuler:OLK-5.10 29999/30000] drivers/acpi/acpi_memhotplug.c:236: undefined reference to `hmat_restore_target'
by kernel test robot 04 Sep '24

04 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b7bed6628b750ffd687d1da0a170dece4b0c08bd commit: 2e1b00fcf1e3152a1e73846f5f9ec37cef088a65 [29999/30000] ACPI/HMAT: Add missing locality information for hot-added device config: x86_64-randconfig-013-20240903 (https://download.01.org/0day-ci/archive/20240904/202409040825.59qJfROR-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240904/202409040825.59qJfROR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409040825.59qJfROR-lkp@intel.com/ All errors (new ones prefixed by >>): ld: drivers/acpi/acpi_memhotplug.o: in function `acpi_memory_enable_device': >> drivers/acpi/acpi_memhotplug.c:236: undefined reference to `hmat_restore_target' vim +236 drivers/acpi/acpi_memhotplug.c 171 172 static int acpi_memory_enable_device(struct acpi_memory_device *mem_device) 173 { 174 acpi_handle handle = mem_device->device->handle; 175 int result, num_enabled = 0; 176 struct acpi_memory_info *info; 177 int node; 178 179 node = acpi_get_node(handle); 180 /* 181 * Tell the VM there is more memory here... 182 * Note: Assume that this function returns zero on success 183 * We don't have memory-hot-add rollback function,now. 184 * (i.e. memory-hot-remove function) 185 */ 186 list_for_each_entry(info, &mem_device->res_list, list) { 187 if (info->enabled) { /* just sanity check...*/ 188 num_enabled++; 189 continue; 190 } 191 /* 192 * If the memory block size is zero, please ignore it. 193 * Don't try to do the following memory hotplug flowchart. 194 */ 195 if (!info->length) 196 continue; 197 if (node < 0) 198 node = memory_add_physaddr_to_nid(info->start_addr); 199 200 result = __add_memory(node, info->start_addr, info->length, 201 MHP_NONE); 202 203 /* 204 * If the memory block has been used by the kernel, add_memory() 205 * returns -EEXIST. If add_memory() returns the other error, it 206 * means that this memory block is not used by the kernel. 207 */ 208 if (result && result != -EEXIST) 209 continue; 210 211 result = acpi_bind_memory_blocks(info, mem_device->device); 212 if (result) { 213 acpi_unbind_memory_blocks(info); 214 return -ENODEV; 215 } 216 217 info->enabled = 1; 218 219 /* 220 * Add num_enable even if add_memory() returns -EEXIST, so the 221 * device is bound to this driver. 222 */ 223 224 hotplug_mdev[node] = mem_device->device; 225 num_enabled++; 226 } 227 if (acpi_has_method(handle, "_HMA")) { 228 acpi_status status; 229 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 230 231 status = acpi_evaluate_object(handle, "_HMA", NULL, &buffer); 232 if (ACPI_SUCCESS(status) && buffer.length) { 233 union acpi_object *obj = buffer.pointer; 234 235 if (!obj->buffer.length) > 236 hmat_restore_target(node); 237 } 238 } 239 240 if (!num_enabled) { 241 dev_err(&mem_device->device->dev, "add_memory failed\n"); 242 return -EINVAL; 243 } 244 /* 245 * Sometimes the memory device will contain several memory blocks. 246 * When one memory block is hot-added to the system memory, it will 247 * be regarded as a success. 248 * Otherwise if the last memory block can't be hot-added to the system 249 * memory, it will be failure and the memory device can't be bound with 250 * driver. 251 */ 252 return 0; 253 } 254 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29716/30000] drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:1195:5: warning: no previous prototype for function 'hclge_tm_vf_tc_dwrr_cfg'
by kernel test robot 04 Sep '24

04 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b7bed6628b750ffd687d1da0a170dece4b0c08bd commit: 518ea89ec98b78c749c27d6ba7792e1bdb5779ed [29716/30000] net: hns3: add support for vf multiple tcs config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240904/202409040605.jzWfVsDp-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240904/202409040605.jzWfVsDp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409040605.jzWfVsDp-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:1195:5: warning: no previous prototype for function 'hclge_tm_vf_tc_dwrr_cfg' [-Wmissing-prototypes] 1195 | int hclge_tm_vf_tc_dwrr_cfg(struct hclge_vport *vport) | ^ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:1195:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1195 | int hclge_tm_vf_tc_dwrr_cfg(struct hclge_vport *vport) | ^ | static >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:2323:5: warning: no previous prototype for function 'hclge_mbx_set_vf_multi_tc' [-Wmissing-prototypes] 2323 | int hclge_mbx_set_vf_multi_tc(struct hclge_vport *vport, | ^ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:2323:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2323 | int hclge_mbx_set_vf_multi_tc(struct hclge_vport *vport, | ^ | static 2 warnings generated. vim +/hclge_tm_vf_tc_dwrr_cfg +1195 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c 1194 > 1195 int hclge_tm_vf_tc_dwrr_cfg(struct hclge_vport *vport) 1196 { 1197 struct hnae3_knic_private_info *kinfo = &vport->nic.kinfo; 1198 struct hclge_dev *hdev = vport->back; 1199 struct hclge_pg_info *pg_info; 1200 u8 dwrr; 1201 int ret; 1202 u32 i; 1203 1204 for (i = 0; i < kinfo->tc_info.max_tc; i++) { 1205 pg_info = &hdev->tm_info.pg_info[hdev->tm_info.tc_info[i].pgid]; 1206 dwrr = i < kinfo->tc_info.num_tc ? pg_info->tc_dwrr[i] : 0; 1207 ret = hclge_tm_qs_weight_cfg(hdev, vport->qs_offset + i, dwrr); 1208 if (ret) 1209 return ret; 1210 } 1211 1212 return 0; 1213 } 1214 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 16259/30000] mm/memcontrol.c:5402:40: error: implicit declaration of function 'ksm_process_profit'
by kernel test robot 04 Sep '24

04 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b7bed6628b750ffd687d1da0a170dece4b0c08bd commit: 0f6fb3570be40b783d8c756d64297be1a8e3d2b3 [16259/30000] memcg: support ksm merge any mode per cgroup config: x86_64-buildonly-randconfig-004-20240903 (https://download.01.org/0day-ci/archive/20240904/202409040111.5iXDLbsV-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240904/202409040111.5iXDLbsV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409040111.5iXDLbsV-lkp@intel.com/ All errors (new ones prefixed by >>): mm/memcontrol.c: In function 'memory_ksm_show': >> mm/memcontrol.c:5402:40: error: implicit declaration of function 'ksm_process_profit' [-Werror=implicit-function-declaration] 5402 | ksm_process_profits += ksm_process_profit(mm); | ^~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/ksm_process_profit +5402 mm/memcontrol.c 5379 5380 static int memory_ksm_show(struct seq_file *m, void *v) 5381 { 5382 unsigned long ksm_merging_pages = 0; 5383 unsigned long ksm_rmap_items = 0; 5384 long ksm_process_profits = 0; 5385 unsigned int tasks = 0; 5386 struct task_struct *task; 5387 struct mm_struct *mm; 5388 struct css_task_iter it; 5389 struct mem_cgroup *memcg = mem_cgroup_from_seq(m); 5390 5391 css_task_iter_start(&memcg->css, CSS_TASK_ITER_PROCS, &it); 5392 while ((task = css_task_iter_next(&it))) { 5393 mm = get_task_mm(task); 5394 if (!mm) 5395 continue; 5396 5397 if (test_bit(MMF_VM_MERGE_ANY, &mm->flags)) 5398 tasks++; 5399 5400 ksm_rmap_items += mm->ksm_rmap_items; 5401 ksm_merging_pages += mm->ksm_merging_pages; > 5402 ksm_process_profits += ksm_process_profit(mm); 5403 mmput(mm); 5404 } 5405 css_task_iter_end(&it); 5406 5407 seq_printf(m, "merge any state: %d\n", READ_ONCE(memcg->ksm_merge_any)); 5408 seq_printf(m, "merge any tasks: %u\n", tasks); 5409 seq_printf(m, "ksm_rmap_items %lu\n", ksm_rmap_items); 5410 seq_printf(m, "ksm_merging_pages %lu\n", ksm_merging_pages); 5411 seq_printf(m, "ksm_process_profits %ld\n", ksm_process_profits); 5412 return 0; 5413 } 5414 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29379/30000] drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c:2327:6: warning: no previous prototype for function 'mcp251xfd_tx_obj_write_sync'
by kernel test robot 04 Sep '24

04 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b7bed6628b750ffd687d1da0a170dece4b0c08bd commit: b4eaf3e808dc2abcab55bc72df3b0d15961f33f0 [29379/30000] can: mcp251xfd: fix infinite loop when xmit fails config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240904/202409040151.sxh3qZ5K-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240904/202409040151.sxh3qZ5K-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409040151.sxh3qZ5K-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c:2327:6: warning: no previous prototype for function 'mcp251xfd_tx_obj_write_sync' [-Wmissing-prototypes] 2327 | void mcp251xfd_tx_obj_write_sync(struct work_struct *work) | ^ drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c:2327:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2327 | void mcp251xfd_tx_obj_write_sync(struct work_struct *work) | ^ | static drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c:511:1: warning: unused function 'mcp251xfd_chip_set_mode_nowait' [-Wunused-function] 511 | mcp251xfd_chip_set_mode_nowait(const struct mcp251xfd_priv *priv, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. vim +/mcp251xfd_tx_obj_write_sync +2327 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c 2326 > 2327 void mcp251xfd_tx_obj_write_sync(struct work_struct *work) 2328 { 2329 struct mcp251xfd_priv *priv = container_of(work, struct mcp251xfd_priv, 2330 tx_work); 2331 struct mcp251xfd_tx_obj *tx_obj = priv->tx_work_obj; 2332 struct mcp251xfd_tx_ring *tx_ring = priv->tx; 2333 int err; 2334 2335 err = spi_sync(priv->spi, &tx_obj->msg); 2336 if (err) 2337 mcp251xfd_tx_failure_drop(priv, tx_ring, err); 2338 } 2339 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] dev/parport: fix the array out-of-bounds risk
by dinglongwei 03 Sep '24

03 Sep '24

From: tuhaowen <tuhaowen(a)uniontech.com> stable inclusion from stable-v4.19.320 commit 166a0bddcc27de41fe13f861c8348e8e53e988c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQAA CVE: CVE-2024-42301 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ab11dac93d2d568d151b1918d7b84c2d02bacbd5 ] Fixed array out-of-bounds issues caused by sprintf by replacing it with snprintf for safer data copying, ensuring the destination buffer is not overflowed. Below is the stack trace I encountered during the actual issue: [ 66.575408s] [pid:5118,cpu4,QThread,4]Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: do_hardware_base_addr+0xcc/0xd0 [parport] [ 66.575408s] [pid:5118,cpu4,QThread,5]CPU: 4 PID: 5118 Comm: QThread Tainted: G S W O 5.10.97-arm64-desktop #7100.57021.2 [ 66.575439s] [pid:5118,cpu4,QThread,6]TGID: 5087 Comm: EFileApp [ 66.575439s] [pid:5118,cpu4,QThread,7]Hardware name: HUAWEI HUAWEI QingYun PGUX-W515x-B081/SP1PANGUXM, BIOS 1.00.07 04/29/2024 [ 66.575439s] [pid:5118,cpu4,QThread,8]Call trace: [ 66.575469s] [pid:5118,cpu4,QThread,9] dump_backtrace+0x0/0x1c0 [ 66.575469s] [pid:5118,cpu4,QThread,0] show_stack+0x14/0x20 [ 66.575469s] [pid:5118,cpu4,QThread,1] dump_stack+0xd4/0x10c [ 66.575500s] [pid:5118,cpu4,QThread,2] panic+0x1d8/0x3bc [ 66.575500s] [pid:5118,cpu4,QThread,3] __stack_chk_fail+0x2c/0x38 [ 66.575500s] [pid:5118,cpu4,QThread,4] do_hardware_base_addr+0xcc/0xd0 [parport] Signed-off-by: tuhaowen <tuhaowen(a)uniontech.com> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20240708080430.8221-1-tuhaowen@uniontech.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/parport/procfs.c [Fix context] Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/parport/procfs.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c index 48804049d697..c5f7e1ff06f1 100644 --- a/drivers/parport/procfs.c +++ b/drivers/parport/procfs.c @@ -51,12 +51,12 @@ static int do_active_device(struct ctl_table *table, int write, for (dev = port->devices; dev ; dev = dev->next) { if(dev == port->cad) { - len += sprintf(buffer, "%s\n", dev->name); + len += snprintf(buffer, sizeof(buffer), "%s\n", dev->name); } } if(!len) { - len += sprintf(buffer, "%s\n", "none"); + len += snprintf(buffer, sizeof(buffer), "%s\n", "none"); } if (len > *lenp) @@ -87,19 +87,19 @@ static int do_autoprobe(struct ctl_table *table, int write, } if ((str = info->class_name) != NULL) - len += sprintf (buffer + len, "CLASS:%s;\n", str); + len += snprintf (buffer + len, sizeof(buffer) - len, "CLASS:%s;\n", str); if ((str = info->model) != NULL) - len += sprintf (buffer + len, "MODEL:%s;\n", str); + len += snprintf (buffer + len, sizeof(buffer) - len, "MODEL:%s;\n", str); if ((str = info->mfr) != NULL) - len += sprintf (buffer + len, "MANUFACTURER:%s;\n", str); + len += snprintf (buffer + len, sizeof(buffer) - len, "MANUFACTURER:%s;\n", str); if ((str = info->description) != NULL) - len += sprintf (buffer + len, "DESCRIPTION:%s;\n", str); + len += snprintf (buffer + len, sizeof(buffer) - len, "DESCRIPTION:%s;\n", str); if ((str = info->cmdset) != NULL) - len += sprintf (buffer + len, "COMMAND SET:%s;\n", str); + len += snprintf (buffer + len, sizeof(buffer) - len, "COMMAND SET:%s;\n", str); if (len > *lenp) len = *lenp; @@ -117,7 +117,7 @@ static int do_hardware_base_addr(struct ctl_table *table, int write, size_t *lenp, loff_t *ppos) { struct parport *port = (struct parport *)table->extra1; - char buffer[20]; + char buffer[64]; int len = 0; if (*ppos) { @@ -128,7 +128,7 @@ static int do_hardware_base_addr(struct ctl_table *table, int write, if (write) /* permissions prevent this anyway */ return -EACCES; - len += sprintf (buffer, "%lu\t%lu\n", port->base, port->base_hi); + len += snprintf (buffer, sizeof(buffer), "%lu\t%lu\n", port->base, port->base_hi); if (len > *lenp) len = *lenp; @@ -156,7 +156,7 @@ static int do_hardware_irq(struct ctl_table *table, int write, if (write) /* permissions prevent this anyway */ return -EACCES; - len += sprintf (buffer, "%d\n", port->irq); + len += snprintf (buffer, sizeof(buffer), "%d\n", port->irq); if (len > *lenp) len = *lenp; @@ -184,7 +184,7 @@ static int do_hardware_dma(struct ctl_table *table, int write, if (write) /* permissions prevent this anyway */ return -EACCES; - len += sprintf (buffer, "%d\n", port->dma); + len += snprintf (buffer, sizeof(buffer), "%d\n", port->dma); if (len > *lenp) len = *lenp; @@ -213,7 +213,13 @@ static int do_hardware_modes(struct ctl_table *table, int write, return -EACCES; { -#define printmode(x) {if(port->modes&PARPORT_MODE_##x){len+=sprintf(buffer+len,"%s%s",f?",":"",#x);f++;}} +#define printmode(x) { \ + if (port->modes & PARPORT_MODE_##x) { \ + len += snprintf(buffer + len, sizeof(buffer) - len, \ + "%s%s", f ? "," : "", #x); \ + f++; \ + } \ +} int f = 0; printmode(PCSPP); printmode(TRISTATE); -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] usb: gadget: rndis: add spinlock for rndis response list
by Yuan Can 03 Sep '24

03 Sep '24

From: Daehwan Jung <dh10.jung(a)samsung.com> stable inclusion from stable-v4.19.232 commit 37da52f96aaa5013f0330801efe9211e8e5ccb68 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALPWM CVE: CVE-2022-48926 Reference: https://gitee.com/openeuler/kernel/commit/37da52f96aaa5013f0330801efe9211e8… -------------------------------- commit aaaba1c86d04dac8e49bf508b492f81506257da3 upstream. There's no lock for rndis response list. It could cause list corruption if there're two different list_add at the same time like below. It's better to add in rndis_add_response / rndis_free_response / rndis_get_next_response to prevent any race condition on response list. [ 361.894299] [1: irq/191-dwc3:16979] list_add corruption. next->prev should be prev (ffffff80651764d0), but was ffffff883dc36f80. (next=ffffff80651764d0). [ 361.904380] [1: irq/191-dwc3:16979] Call trace: [ 361.904391] [1: irq/191-dwc3:16979] __list_add_valid+0x74/0x90 [ 361.904401] [1: irq/191-dwc3:16979] rndis_msg_parser+0x168/0x8c0 [ 361.904409] [1: irq/191-dwc3:16979] rndis_command_complete+0x24/0x84 [ 361.904417] [1: irq/191-dwc3:16979] usb_gadget_giveback_request+0x20/0xe4 [ 361.904426] [1: irq/191-dwc3:16979] dwc3_gadget_giveback+0x44/0x60 [ 361.904434] [1: irq/191-dwc3:16979] dwc3_ep0_complete_data+0x1e8/0x3a0 [ 361.904442] [1: irq/191-dwc3:16979] dwc3_ep0_interrupt+0x29c/0x3dc [ 361.904450] [1: irq/191-dwc3:16979] dwc3_process_event_entry+0x78/0x6cc [ 361.904457] [1: irq/191-dwc3:16979] dwc3_process_event_buf+0xa0/0x1ec [ 361.904465] [1: irq/191-dwc3:16979] dwc3_thread_interrupt+0x34/0x5c Fixes: f6281af9d62e ("usb: gadget: rndis: use list_for_each_entry_safe") Cc: stable <stable(a)kernel.org> Signed-off-by: Daehwan Jung <dh10.jung(a)samsung.com> Link: https://lore.kernel.org/r/1645507768-77687-1-git-send-email-dh10.jung@samsu… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/usb/gadget/function/rndis.c | 8 ++++++++ drivers/usb/gadget/function/rndis.h | 1 + 2 files changed, 9 insertions(+) diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c index 6e92549f2567..eaa4cf163eaf 100644 --- a/drivers/usb/gadget/function/rndis.c +++ b/drivers/usb/gadget/function/rndis.c @@ -952,6 +952,7 @@ struct rndis_params *rndis_register(void (*resp_avail)(void *v), void *v) params->resp_avail = resp_avail; params->v = v; INIT_LIST_HEAD(&params->resp_queue); + spin_lock_init(&params->resp_lock); pr_debug("%s: configNr = %d\n", __func__, i); return params; @@ -1045,12 +1046,14 @@ void rndis_free_response(struct rndis_params *params, u8 *buf) { rndis_resp_t *r, *n; + spin_lock(&params->resp_lock); list_for_each_entry_safe(r, n, &params->resp_queue, list) { if (r->buf == buf) { list_del(&r->list); kfree(r); } } + spin_unlock(&params->resp_lock); } EXPORT_SYMBOL_GPL(rndis_free_response); @@ -1060,14 +1063,17 @@ u8 *rndis_get_next_response(struct rndis_params *params, u32 *length) if (!length) return NULL; + spin_lock(&params->resp_lock); list_for_each_entry_safe(r, n, &params->resp_queue, list) { if (!r->send) { r->send = 1; *length = r->length; + spin_unlock(&params->resp_lock); return r->buf; } } + spin_unlock(&params->resp_lock); return NULL; } EXPORT_SYMBOL_GPL(rndis_get_next_response); @@ -1084,7 +1090,9 @@ static rndis_resp_t *rndis_add_response(struct rndis_params *params, u32 length) r->length = length; r->send = 0; + spin_lock(&params->resp_lock); list_add_tail(&r->list, &params->resp_queue); + spin_unlock(&params->resp_lock); return r; } diff --git a/drivers/usb/gadget/function/rndis.h b/drivers/usb/gadget/function/rndis.h index c7e3a70ce6c1..c996ba28bcb7 100644 --- a/drivers/usb/gadget/function/rndis.h +++ b/drivers/usb/gadget/function/rndis.h @@ -174,6 +174,7 @@ typedef struct rndis_params { void (*resp_avail)(void *v); void *v; struct list_head resp_queue; + spinlock_t resp_lock; } rndis_params; /* RNDIS Message parser and other useless functions */ -- 2.17.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS WITH WARNING b7bed6628b750ffd687d1da0a170dece4b0c08bd
by kernel test robot 03 Sep '24

03 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: b7bed6628b750ffd687d1da0a170dece4b0c08bd !11337 v3 Some features and fixs for hbmdev and hbm cache Warning reports: https://lore.kernel.org/oe-kbuild-all/202409030213.Wm0NsmFj-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409031250.rcUC04W4-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409031257.Y7C0PYH5-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409031941.6m1LMpai-lkp@intel.com Warning: (recently discovered and may have been fixed) drivers/acpi/numa/hmat.c:726:6: warning: no previous prototype for function 'hmat_restore_target' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:4324:6: warning: variable 'err' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:104: warning: Excess function parameter 'direction' description in 'rnpgbevf_set_ring_vector' drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:104: warning: Excess function parameter 'msix_vector' description in 'rnpgbevf_set_ring_vector' drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:104: warning: Excess function parameter 'queue' description in 'rnpgbevf_set_ring_vector' drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:112: warning: Excess function parameter 'direction' description in 'rnpvf_set_ring_vector' drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:112: warning: Excess function parameter 'msix_vector' description in 'rnpvf_set_ring_vector' drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:112: warning: Excess function parameter 'queue' description in 'rnpvf_set_ring_vector' Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration |-- arm64-randconfig-002-20240903 | `-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-allyesconfig | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:variable-err-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-direction-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-queue-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-direction-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-queue-description-in-rnpvf_set_ring_vector | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_CTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_dispatch_event | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_net_exit | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-ctx-not-described-in-ubcore_update_uvs_eid_ret | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-dev-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-req-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-function-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-function-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TPG-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-function-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-function-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_UTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-function-ubcore_hash_table_rmv_vtpn | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_get_umap_ops | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_umap_priv_init | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_unmap_vma_pages | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-001-20240903 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-002-20240903 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-003-20240903 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-004-20240903 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-defconfig | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register `-- x86_64-rhel-8.3-rust |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register elapsed time: 1590m configs tested: 11 configs skipped: 107 tested configs: arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240903 clang-17 arm64 randconfig-002-20240903 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240903 gcc-12 x86_64 buildonly-randconfig-002-20240903 gcc-12 x86_64 buildonly-randconfig-003-20240903 gcc-12 x86_64 buildonly-randconfig-004-20240903 gcc-12 x86_64 defconfig gcc-11 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS v5 00/30] support block hierarchy stats
by Yu Kuai 03 Sep '24

03 Sep '24

Changes in v5: - add missing callers of blk_rq_hierarchy_stats_complete() in patch 16; - remove blk_mq_debugfs_unregister_hierarchy_stats in patch 16; - use NR_NEW_STAT_GROUPS in patch 18; Changes in v4: - remove changes to cfq in patch 2, also fix kabi change for blk-wbt in patch 2; - check q->mq_ops from the only caller from blk-flush.c in patch 12; Changes in v3: - fix patch 7 format; Changes in v2: - find_get_pid(current->pid); -> get_pid(task_pid(current)); - check q->mq_ops in blk_mq_get_alloc_task(); - remove blk_mq_debugfs_unregister_hierarchy_stats(); - include cgroup_path() inside CONFIG_BLK_CGROUP; Bart Van Assche (1): blk-mq: remove blk_mq_put_ctx() Jens Axboe (4): block: add blk_time_get_ns() and blk_time_get() helpers block: cache current nsec time in struct blk_plug block: update cached timestamp post schedule/preemption block: limit block time caching to in_task() context Yu Kuai (25): blk-mq: export blk-mq-debugfs apis block: fix that blk_time_get_ns() doesn't update time after schedule block: fix kabi broken in struct blk_plug block: support to recored bio allocation time block: support to recored bio allocation task block: support to recored bio allocation time in request block: fix kabi broken for struct request block: support to recored bio allocation task in request block: block: fix kabi broken for struct blk_mq_alloc_data blk-mq-debugfs: factor out a new helper to show allocated request block: support to record when request is completed block-io-hierarchy: core hierarchy stats implementation block-io-hierarchy: core hierarchy iodump implementation blk-io-hierarchy: support to recored the number of slow IO blk-io-hierarchy: support new bio based stage blk-throtl blk-io-hierarchy: support new bio based stage blk-wbt blk-io-hierarchy: support new bio based stage gettag blk-io-hierarchy: support new rq based stage plug blk-io-hierarchy: support new rq based stage mq-deadline blk-io-hierarchy: support new rq based stage bfq blk-io-hierarchy: support new rq based stage kyber blk-io-hierarchy: support new rq based stage hctx blk-io-hierarchy: support new rq based stage requeue blk-io-hierarchy: support new rq based stage rq_driver blk-io-hierarchy: support new stage for bio lifetime arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 8 + block/Makefile | 1 + block/bfq-cgroup.c | 15 +- block/bfq-iosched.c | 34 +- block/bio.c | 17 + block/blk-cgroup.c | 2 +- block/blk-core.c | 37 +- block/blk-flush.c | 22 +- block/blk-io-hierarchy/Kconfig | 145 +++++ block/blk-io-hierarchy/Makefile | 8 + block/blk-io-hierarchy/debugfs.c | 230 ++++++++ block/blk-io-hierarchy/iodump.c | 756 +++++++++++++++++++++++++ block/blk-io-hierarchy/iodump.h | 103 ++++ block/blk-io-hierarchy/stats.c | 429 ++++++++++++++ block/blk-io-hierarchy/stats.h | 366 ++++++++++++ block/blk-iolatency.c | 6 +- block/blk-merge.c | 1 + block/blk-mq-debugfs.c | 21 +- block/blk-mq-debugfs.h | 10 + block/blk-mq-sched.c | 7 +- block/blk-mq-tag.c | 13 +- block/blk-mq.c | 77 ++- block/blk-mq.h | 56 +- block/blk-sysfs.c | 16 + block/blk-throttle.c | 29 +- block/blk-wbt.c | 15 +- block/blk.h | 89 ++- block/kyber-iosched.c | 10 +- block/mq-deadline.c | 15 +- include/linux/blk_types.h | 55 +- include/linux/blkdev.h | 16 + include/linux/sched.h | 2 + kernel/sched/core.c | 6 +- 35 files changed, 2530 insertions(+), 89 deletions(-) create mode 100644 block/blk-io-hierarchy/Kconfig create mode 100644 block/blk-io-hierarchy/Makefile create mode 100644 block/blk-io-hierarchy/debugfs.c create mode 100644 block/blk-io-hierarchy/iodump.c create mode 100644 block/blk-io-hierarchy/iodump.h create mode 100644 block/blk-io-hierarchy/stats.c create mode 100644 block/blk-io-hierarchy/stats.h -- 2.39.2

2 31

[PATCH OLK-6.6] ext4: Track data blocks freeing operation in journal
by Zhihao Cheng 03 Sep '24

03 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9DN5Z CVE: NA -------------------------------- Since commit 7f6416dcd4a3f ("ext4: implement writeback iomap path"), the order mode is removed in iomap framework, which lets ext4_mb_clear_bb() free data blocks immediately. It may cause stale data read from truncated file in power-cut case. Following is details: P1 P2 vfs_truncate(file A) ext4_setattr EXT4_I(inode)->i_disksize = attr->ia_size // record in journal ext4_truncate ext4_mb_clear_bb mb_free_blocks // free block i vfs_write(file B) // get block i and writeback >> powercut << In the next mount, inode size and extent tree is stale(before truncated), the content in block i is file B. Fix the problem by adding free data blocks in journal for iomap case. Fixes: 7f6416dcd4a3 ("ext4: implement writeback iomap path") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/mballoc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index b138902fd42c..4d34e2b33fa0 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -6624,7 +6624,8 @@ static void ext4_mb_clear_bb(handle_t *handle, struct inode *inode, */ if (ext4_handle_valid(handle) && ((flags & EXT4_FREE_BLOCKS_METADATA) || - !ext4_should_writeback_data(inode))) { + !ext4_should_writeback_data(inode) || + ext4_test_inode_state(inode, EXT4_STATE_BUFFERED_IOMAP))) { struct ext4_free_data *new_entry; /* * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] fs/proc: fix softlockup in __read_vmcore
by Xiaomeng Zhang 03 Sep '24

03 Sep '24

From: Rik van Riel <riel(a)surriel.com> stable inclusion from stable-v4.19.317 commit 7bdf1d550ddfcd9ab797087421f77b7aceddc8a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAJKLA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 5cbcb62dddf5346077feb82b7b0c9254222d3445 upstream. While taking a kernel core dump with makedumpfile on a larger system, softlockup messages often appear. While softlockup warnings can be harmless, they can also interfere with things like RCU freeing memory, which can be problematic when the kdump kexec image is configured with as little memory as possible. Avoid the softlockup, and give things like work items and RCU a chance to do their thing during __read_vmcore by adding a cond_resched. Link: https://lkml.kernel.org/r/20240507091858.36ff767f@imladris.surriel.com Signed-off-by: Rik van Riel <riel(a)surriel.com> Acked-by: Baoquan He <bhe(a)redhat.com> Cc: Dave Young <dyoung(a)redhat.com> Cc: Vivek Goyal <vgoyal(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- fs/proc/vmcore.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c index f5dfedc01552..cd384a1ebef5 100644 --- a/fs/proc/vmcore.c +++ b/fs/proc/vmcore.c @@ -359,6 +359,8 @@ static ssize_t __read_vmcore(char *buffer, size_t buflen, loff_t *fpos, /* leave now if filled buffer already */ if (buflen == 0) return acc; + + cond_resched(); } list_for_each_entry(m, &vmcore_list, list) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] perf/core: Fix missing wakeup when waiting for context reference
by Xiaomeng Zhang 03 Sep '24

03 Sep '24

From: Haifeng Xu <haifeng.xu(a)shopee.com> stable inclusion from stable-v4.19.317 commit c23ead9986a17c793d39be11ce6c084904c9c44a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAJLGS Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 74751ef5c1912ebd3e65c3b65f45587e05ce5d36 ] In our production environment, we found many hung tasks which are blocked for more than 18 hours. Their call traces are like this: [346278.191038] __schedule+0x2d8/0x890 [346278.191046] schedule+0x4e/0xb0 [346278.191049] perf_event_free_task+0x220/0x270 [346278.191056] ? init_wait_var_entry+0x50/0x50 [346278.191060] copy_process+0x663/0x18d0 [346278.191068] kernel_clone+0x9d/0x3d0 [346278.191072] __do_sys_clone+0x5d/0x80 [346278.191076] __x64_sys_clone+0x25/0x30 [346278.191079] do_syscall_64+0x5c/0xc0 [346278.191083] ? syscall_exit_to_user_mode+0x27/0x50 [346278.191086] ? do_syscall_64+0x69/0xc0 [346278.191088] ? irqentry_exit_to_user_mode+0x9/0x20 [346278.191092] ? irqentry_exit+0x19/0x30 [346278.191095] ? exc_page_fault+0x89/0x160 [346278.191097] ? asm_exc_page_fault+0x8/0x30 [346278.191102] entry_SYSCALL_64_after_hwframe+0x44/0xae The task was waiting for the refcount become to 1, but from the vmcore, we found the refcount has already been 1. It seems that the task didn't get woken up by perf_event_release_kernel() and got stuck forever. The below scenario may cause the problem. Thread A Thread B ... ... perf_event_free_task perf_event_release_kernel ... acquire event->child_mutex ... get_ctx ... release event->child_mutex acquire ctx->mutex ... perf_free_event (acquire/release event->child_mutex) ... release ctx->mutex wait_var_event acquire ctx->mutex acquire event->child_mutex # move existing events to free_list release event->child_mutex release ctx->mutex put_ctx ... ... In this case, all events of the ctx have been freed, so we couldn't find the ctx in free_list and Thread A will miss the wakeup. It's thus necessary to add a wakeup after dropping the reference. Fixes: 1cf8dfe8a661 ("perf/core: Fix race between close() and fork()") Signed-off-by: Haifeng Xu <haifeng.xu(a)shopee.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Frederic Weisbecker <frederic(a)kernel.org> Acked-by: Mark Rutland <mark.rutland(a)arm.com> Cc: stable(a)vger.kernel.org Link: https://lkml.kernel.org/r/20240513103948.33570-1-haifeng.xu@shopee.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/events/core.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/kernel/events/core.c b/kernel/events/core.c index b9667223b050..b7f4aaedb5ff 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -4664,6 +4664,7 @@ int perf_event_release_kernel(struct perf_event *event) again: mutex_lock(&event->child_mutex); list_for_each_entry(child, &event->child_list, child_list) { + void *var = NULL; /* * Cannot change, child events are not migrated, see the @@ -4704,11 +4705,23 @@ int perf_event_release_kernel(struct perf_event *event) * this can't be the last reference. */ put_event(event); + } else { + var = &ctx->refcount; } mutex_unlock(&event->child_mutex); mutex_unlock(&ctx->mutex); put_ctx(ctx); + + if (var) { + /* + * If perf_event_free_task() has deleted all events from the + * ctx while the child_mutex got released above, make sure to + * notify about the preceding put_ctx(). + */ + smp_mb(); /* pairs with wait_var_event() */ + wake_up_var(var); + } goto again; } mutex_unlock(&event->child_mutex); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Fix null pointer deref in dcn20_resource.c
by Xiaomeng Zhang 03 Sep '24

03 Sep '24

From: Aurabindo Pillai <aurabindo.pillai(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit ecbf60782662f0a388493685b85a645a0ba1613c category: bugfix bugzilla: 190282 CVE: CVE-2024-43899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes a hang thats triggered when MPV is run on a DCN401 dGPU: mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all and then enabling fullscreen playback (double click on the video) The following calltrace will be seen: [ 181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 181.843997] #PF: supervisor instruction fetch in kernel mode [ 181.844003] #PF: error_code(0x0010) - not-present page [ 181.844009] PGD 0 P4D 0 [ 181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI [ 181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018 [ 181.844044] RIP: 0010:0x0 [ 181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246 [ 181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 [ 181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400 [ 181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c [ 181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8 [ 181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005 [ 181.844121] FS: 00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000 [ 181.844128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0 [ 181.844141] Call Trace: [ 181.844146] <TASK> [ 181.844153] ? show_regs+0x6d/0x80 [ 181.844167] ? __die+0x24/0x80 [ 181.844179] ? page_fault_oops+0x99/0x1b0 [ 181.844192] ? do_user_addr_fault+0x31d/0x6b0 [ 181.844204] ? exc_page_fault+0x83/0x1b0 [ 181.844216] ? asm_exc_page_fault+0x27/0x30 [ 181.844237] dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu] [ 181.845115] amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu] [ 181.845985] amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu] [ 181.846848] fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu] [ 181.847734] fill_dc_plane_attributes+0x162/0x350 [amdgpu] [ 181.848748] dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.849791] ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.850840] amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu] Signed-off-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c [The conflicts were due to changed file path drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c to drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c index 53ac82693532..2990793e86a2 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c @@ -3290,10 +3290,11 @@ bool dcn20_get_dcc_compression_cap(const struct dc *dc, const struct dc_dcc_surface_param *input, struct dc_surface_dcc_cap *output) { - return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( - dc->res_pool->hubbub, - input, - output); + if (dc->res_pool->hubbub->funcs->get_dcc_compression_cap) + return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( + dc->res_pool->hubbub, input, output); + + return false; } static void dcn20_destroy_resource_pool(struct resource_pool **pool) -- 2.34.1

2 1

[PATCH OLK-6.6] mm/dynamic_pool: use batch to add free pages to dpool
by Liu Shixin 03 Sep '24

03 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAO6DE -------------------------------- In the commit 8ee84018a958 ("mm/dynamic_pool: disable irq for dynamic_pool lock"), the spinlock has been changed to spinlock_irq to address potential deadlock scenarios during interrupts. However, during dpool_init(), the lock will be released and sleep in order to avoid lockup. This is not appropriate, as disabling the interrupt will render this scheduling ineffective. To resolve this, add pages to dpool via batch. Fixes: 8ee84018a958 ("mm/dynamic_pool: disable irq for dynamic_pool lock") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/dynamic_pool.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/mm/dynamic_pool.c b/mm/dynamic_pool.c index 7b0bbf0c348fc..063fb6092401c 100644 --- a/mm/dynamic_pool.c +++ b/mm/dynamic_pool.c @@ -1576,7 +1576,9 @@ static int dpool_fill_from_pagelist(struct dynamic_pool *dpool, void *arg) { struct dpool_info *info = (struct dpool_info *)arg; struct pages_pool *pool = &dpool->pool[PAGES_POOL_4K]; - int i, ret = -EINVAL; + unsigned long nr_pages = 0; + int i; + LIST_HEAD(page_list); dpool->range_cnt = info->range_cnt; dpool->pfn_ranges = @@ -1587,8 +1589,6 @@ static int dpool_fill_from_pagelist(struct dynamic_pool *dpool, void *arg) memcpy(dpool->pfn_ranges, info->pfn_ranges, sizeof(struct range) * dpool->range_cnt); - spin_lock_irq(&dpool->lock); - for (i = 0; i < dpool->range_cnt; i++) { struct range *range = &dpool->pfn_ranges[i]; u64 pfn; @@ -1601,22 +1601,23 @@ static int dpool_fill_from_pagelist(struct dynamic_pool *dpool, void *arg) if (!dpool_free_page_prepare(page)) { pr_err("fill pool failed, check pages failed\n"); - goto unlock; + return -EINVAL; } __SetPageDpool(page); - list_add_tail(&page->lru, &pool->freelist); - pool->free_pages++; + list_add_tail(&page->lru, &page_list); + nr_pages++; - cond_resched_lock(&dpool->lock); + cond_resched(); } } - ret = 0; -unlock: + spin_lock_irq(&dpool->lock); + list_splice(&page_list, &pool->freelist); + pool->free_pages += nr_pages; spin_unlock_irq(&dpool->lock); - return ret; + return 0; } static int dpool_drain_to_pagelist(struct dynamic_pool *dpool) -- 2.25.1

2 1

[PATCH OLK-5.10] drm/amd/display: Fix null pointer deref in dcn20_resource.c
by Xiaomeng Zhang 03 Sep '24

03 Sep '24

From: Aurabindo Pillai <aurabindo.pillai(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit ecbf60782662f0a388493685b85a645a0ba1613c category: bugfix bugzilla: 190282 CVE: CVE-2024-43899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes a hang thats triggered when MPV is run on a DCN401 dGPU: mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all and then enabling fullscreen playback (double click on the video) The following calltrace will be seen: [ 181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 181.843997] #PF: supervisor instruction fetch in kernel mode [ 181.844003] #PF: error_code(0x0010) - not-present page [ 181.844009] PGD 0 P4D 0 [ 181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI [ 181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018 [ 181.844044] RIP: 0010:0x0 [ 181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246 [ 181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 [ 181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400 [ 181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c [ 181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8 [ 181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005 [ 181.844121] FS: 00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000 [ 181.844128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0 [ 181.844141] Call Trace: [ 181.844146] <TASK> [ 181.844153] ? show_regs+0x6d/0x80 [ 181.844167] ? __die+0x24/0x80 [ 181.844179] ? page_fault_oops+0x99/0x1b0 [ 181.844192] ? do_user_addr_fault+0x31d/0x6b0 [ 181.844204] ? exc_page_fault+0x83/0x1b0 [ 181.844216] ? asm_exc_page_fault+0x27/0x30 [ 181.844237] dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu] [ 181.845115] amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu] [ 181.845985] amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu] [ 181.846848] fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu] [ 181.847734] fill_dc_plane_attributes+0x162/0x350 [amdgpu] [ 181.848748] dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.849791] ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.850840] amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu] Signed-off-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c [The conflicts were due to changed file path drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c to drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c index 53ac82693532..2990793e86a2 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c @@ -3290,10 +3290,11 @@ bool dcn20_get_dcc_compression_cap(const struct dc *dc, const struct dc_dcc_surface_param *input, struct dc_surface_dcc_cap *output) { - return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( - dc->res_pool->hubbub, - input, - output); + if (dc->res_pool->hubbub->funcs->get_dcc_compression_cap) + return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( + dc->res_pool->hubbub, input, output); + + return false; } static void dcn20_destroy_resource_pool(struct resource_pool **pool) -- 2.34.1

2 1

[openeuler:OLK-5.10 27098/30000] drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:112: warning: Excess function parameter 'direction' description in 'rnpvf_set_ring_vector'
by kernel test robot 03 Sep '24

03 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b7bed6628b750ffd687d1da0a170dece4b0c08bd commit: 6cf173c15990725cb9c0c4570fbc90e937a757b4 [27098/30000] drivers: initial support for rnpvf drivers from Mucse Technology config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240903/202409031941.6m1LMpai-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240903/202409031941.6m1LMpai-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409031941.6m1LMpai-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:112: warning: Function parameter or member 'rnpvf_queue' not described in 'rnpvf_set_ring_vector' drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:112: warning: Function parameter or member 'rnpvf_msix_vector' not described in 'rnpvf_set_ring_vector' >> drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:112: warning: Excess function parameter 'direction' description in 'rnpvf_set_ring_vector' >> drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:112: warning: Excess function parameter 'queue' description in 'rnpvf_set_ring_vector' >> drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:112: warning: Excess function parameter 'msix_vector' description in 'rnpvf_set_ring_vector' drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:807: warning: Excess function parameter 'rx_ring' description in 'rnpvf_pull_tail' drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:1030: warning: Excess function parameter 'skb' description in 'rnpvf_is_non_eop' drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:2203: warning: Function parameter or member 'type' not described in 'rnpvf_update_itr' drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:3922: warning: Function parameter or member 't' not described in 'rnpvf_watchdog' drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:3922: warning: Excess function parameter 'data' description in 'rnpvf_watchdog' vim +112 drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c 102 103 /** 104 * rnpvf_set_ivar - set IVAR registers - maps interrupt causes to vectors 105 * @adapter: pointer to adapter struct 106 * @direction: 0 for Rx, 1 for Tx, -1 for other causes 107 * @queue: queue to map the corresponding interrupt to 108 * @msix_vector: the vector to map to the corresponding queue 109 */ 110 static void rnpvf_set_ring_vector(struct rnpvf_adapter *adapter, 111 u8 rnpvf_queue, u8 rnpvf_msix_vector) > 112 { 113 struct rnpvf_hw *hw = &adapter->hw; 114 u32 data = 0; 115 116 data = hw->vfnum << 24; 117 data |= (rnpvf_msix_vector << 8); 118 data |= (rnpvf_msix_vector << 0); 119 DPRINTK(IFUP, INFO, 120 "Set Ring-Vector queue:%d (reg:0x%x) <-- Rx-MSIX:%d, Tx-MSIX:%d\n", 121 rnpvf_queue, RING_VECTOR(rnpvf_queue), rnpvf_msix_vector, 122 rnpvf_msix_vector); 123 124 rnpvf_wr_reg(hw->ring_msix_base + RING_VECTOR(rnpvf_queue), data); 125 } 126 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] drm/amd/display: Fix null pointer deref in dcn20_resource.c
by Xiaomeng Zhang 03 Sep '24

03 Sep '24

From: Aurabindo Pillai <aurabindo.pillai(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit ecbf60782662f0a388493685b85a645a0ba1613c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMUG CVE: CVE-2024-43899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes a hang thats triggered when MPV is run on a DCN401 dGPU: mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all and then enabling fullscreen playback (double click on the video) The following calltrace will be seen: [ 181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 181.843997] #PF: supervisor instruction fetch in kernel mode [ 181.844003] #PF: error_code(0x0010) - not-present page [ 181.844009] PGD 0 P4D 0 [ 181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI [ 181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018 [ 181.844044] RIP: 0010:0x0 [ 181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246 [ 181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 [ 181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400 [ 181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c [ 181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8 [ 181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005 [ 181.844121] FS: 00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000 [ 181.844128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0 [ 181.844141] Call Trace: [ 181.844146] <TASK> [ 181.844153] ? show_regs+0x6d/0x80 [ 181.844167] ? __die+0x24/0x80 [ 181.844179] ? page_fault_oops+0x99/0x1b0 [ 181.844192] ? do_user_addr_fault+0x31d/0x6b0 [ 181.844204] ? exc_page_fault+0x83/0x1b0 [ 181.844216] ? asm_exc_page_fault+0x27/0x30 [ 181.844237] dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu] [ 181.845115] amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu] [ 181.845985] amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu] [ 181.846848] fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu] [ 181.847734] fill_dc_plane_attributes+0x162/0x350 [amdgpu] [ 181.848748] dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.849791] ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.850840] amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu] Signed-off-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c [The conflicts were due to file path changed] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c index d587f807dfd7..94bf438c7310 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c @@ -2178,10 +2178,11 @@ bool dcn20_get_dcc_compression_cap(const struct dc *dc, const struct dc_dcc_surface_param *input, struct dc_surface_dcc_cap *output) { - return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( - dc->res_pool->hubbub, - input, - output); + if (dc->res_pool->hubbub->funcs->get_dcc_compression_cap) + return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( + dc->res_pool->hubbub, input, output); + + return false; } static void dcn20_destroy_resource_pool(struct resource_pool **pool) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
by Cui GaoSheng 03 Sep '24

03 Sep '24

From: Andi Shyti <andi.shyti(a)linux.intel.com> stable inclusion from stable-v4.19.320 commit 3e06073d24807f04b4694108a8474decb7b99e60 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAK3GU CVE: CVE-2024-42259 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3 upstream. Calculating the size of the mapped area as the lesser value between the requested size and the actual size does not consider the partial mapping offset. This can cause page fault access. Fix the calculation of the starting and ending addresses, the total size is now deduced from the difference between the end and start addresses. Additionally, the calculations have been rewritten in a clearer and more understandable form. Fixes: c58305af1835 ("drm/i915: Use remap_io_mapping() to prefault all PTE in a single pass") Reported-by: Jann Horn <jannh(a)google.com> Co-developed-by: Chris Wilson <chris.p.wilson(a)linux.intel.com> Signed-off-by: Chris Wilson <chris.p.wilson(a)linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti(a)linux.intel.com> Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> Cc: Matthew Auld <matthew.auld(a)intel.com> Cc: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Cc: <stable(a)vger.kernel.org> # v4.9+ Reviewed-by: Jann Horn <jannh(a)google.com> Reviewed-by: Jonathan Cavitt <Jonathan.cavitt(a)intel.com> [Joonas: Add Requires: tag] Requires: 60a2066c5005 ("drm/i915/gem: Adjust vma offset for framebuffer mmap offset") Signed-off-by: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240802083850.103694-3-andi.… (cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417) Signed-off-by: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/gpu/drm/i915/i915_gem.c | 47 +++++++++++++++++++++++++++++---- 1 file changed, 42 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index b1b207747f39..0835643e9495 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -2006,6 +2006,39 @@ compute_partial_view(struct drm_i915_gem_object *obj, return view; } +static void set_address_limits(struct vm_area_struct *area, + struct i915_vma *vma, + unsigned long *start_vaddr, + unsigned long *end_vaddr) +{ + unsigned long vm_start, vm_end, vma_size; /* user's memory parameters */ + long start, end; /* memory boundaries */ + + /* + * Let's move into the ">> PAGE_SHIFT" + * domain to be sure not to lose bits + */ + vm_start = area->vm_start >> PAGE_SHIFT; + vm_end = area->vm_end >> PAGE_SHIFT; + vma_size = vma->size >> PAGE_SHIFT; + + /* + * Calculate the memory boundaries by considering the offset + * provided by the user during memory mapping and the offset + * provided for the partial mapping. + */ + start = vm_start; + start += vma->ggtt_view.partial.offset; + end = start + vma_size; + + start = max_t(long, start, vm_start); + end = min_t(long, end, vm_end); + + /* Let's move back into the "<< PAGE_SHIFT" domain */ + *start_vaddr = (unsigned long)start << PAGE_SHIFT; + *end_vaddr = (unsigned long)end << PAGE_SHIFT; +} + /** * i915_gem_fault - fault a page into the GTT * @vmf: fault info @@ -2033,8 +2066,10 @@ vm_fault_t i915_gem_fault(struct vm_fault *vmf) struct drm_i915_private *dev_priv = to_i915(dev); struct i915_ggtt *ggtt = &dev_priv->ggtt; bool write = !!(vmf->flags & FAULT_FLAG_WRITE); + unsigned long start, end; /* memory boundaries */ struct i915_vma *vma; pgoff_t page_offset; + unsigned long pfn; int ret; /* Sanity check that we allow writing into this object */ @@ -2116,12 +2151,14 @@ vm_fault_t i915_gem_fault(struct vm_fault *vmf) if (ret) goto err_unpin; + set_address_limits(area, vma, &start, &end); + + pfn = (ggtt->gmadr.start + i915_ggtt_offset(vma)) >> PAGE_SHIFT; + pfn += (start - area->vm_start) >> PAGE_SHIFT; + pfn -= vma->ggtt_view.partial.offset; + /* Finally, remap it using the new GTT offset */ - ret = remap_io_mapping(area, - area->vm_start + (vma->ggtt_view.partial.offset << PAGE_SHIFT), - (ggtt->gmadr.start + vma->node.start) >> PAGE_SHIFT, - min_t(u64, vma->size, area->vm_end - area->vm_start), - &ggtt->iomap); + ret = remap_io_mapping(area, start, pfn, end - start, &ggtt->iomap); if (ret) goto err_fence; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
by Cui GaoSheng 03 Sep '24

03 Sep '24

From: Andi Shyti <andi.shyti(a)linux.intel.com> stable inclusion from stable-v5.10.224 commit 50111a8098fb9ade621eeff82228a997d42732ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMM9L CVE: CVE-2024-42259 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3 upstream. Calculating the size of the mapped area as the lesser value between the requested size and the actual size does not consider the partial mapping offset. This can cause page fault access. Fix the calculation of the starting and ending addresses, the total size is now deduced from the difference between the end and start addresses. Additionally, the calculations have been rewritten in a clearer and more understandable form. Fixes: c58305af1835 ("drm/i915: Use remap_io_mapping() to prefault all PTE in a single pass") Reported-by: Jann Horn <jannh(a)google.com> Co-developed-by: Chris Wilson <chris.p.wilson(a)linux.intel.com> Signed-off-by: Chris Wilson <chris.p.wilson(a)linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti(a)linux.intel.com> Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> Cc: Matthew Auld <matthew.auld(a)intel.com> Cc: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Cc: <stable(a)vger.kernel.org> # v4.9+ Reviewed-by: Jann Horn <jannh(a)google.com> Reviewed-by: Jonathan Cavitt <Jonathan.cavitt(a)intel.com> [Joonas: Add Requires: tag] Requires: 60a2066c5005 ("drm/i915/gem: Adjust vma offset for framebuffer mmap offset") Signed-off-by: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240802083850.103694-3-andi.… (cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417) Signed-off-by: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 53 +++++++++++++++++++++--- 1 file changed, 47 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/i915_gem_mman.c index 92dd65befbcb..edbd363afb00 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c @@ -272,6 +272,41 @@ static vm_fault_t vm_fault_cpu(struct vm_fault *vmf) return i915_error_to_vmf_fault(err); } +static void set_address_limits(struct vm_area_struct *area, + struct i915_vma *vma, + unsigned long obj_offset, + unsigned long *start_vaddr, + unsigned long *end_vaddr) +{ + unsigned long vm_start, vm_end, vma_size; /* user's memory parameters */ + long start, end; /* memory boundaries */ + + /* + * Let's move into the ">> PAGE_SHIFT" + * domain to be sure not to lose bits + */ + vm_start = area->vm_start >> PAGE_SHIFT; + vm_end = area->vm_end >> PAGE_SHIFT; + vma_size = vma->size >> PAGE_SHIFT; + + /* + * Calculate the memory boundaries by considering the offset + * provided by the user during memory mapping and the offset + * provided for the partial mapping. + */ + start = vm_start; + start -= obj_offset; + start += vma->ggtt_view.partial.offset; + end = start + vma_size; + + start = max_t(long, start, vm_start); + end = min_t(long, end, vm_end); + + /* Let's move back into the "<< PAGE_SHIFT" domain */ + *start_vaddr = (unsigned long)start << PAGE_SHIFT; + *end_vaddr = (unsigned long)end << PAGE_SHIFT; +} + static vm_fault_t vm_fault_gtt(struct vm_fault *vmf) { #define MIN_CHUNK_PAGES (SZ_1M >> PAGE_SHIFT) @@ -284,14 +319,18 @@ static vm_fault_t vm_fault_gtt(struct vm_fault *vmf) struct i915_ggtt *ggtt = &i915->ggtt; bool write = area->vm_flags & VM_WRITE; struct i915_gem_ww_ctx ww; + unsigned long obj_offset; + unsigned long start, end; /* memory boundaries */ intel_wakeref_t wakeref; struct i915_vma *vma; pgoff_t page_offset; + unsigned long pfn; int srcu; int ret; - /* We don't use vmf->pgoff since that has the fake offset */ + obj_offset = area->vm_pgoff - drm_vma_node_start(&mmo->vma_node); page_offset = (vmf->address - area->vm_start) >> PAGE_SHIFT; + page_offset += obj_offset; trace_i915_gem_object_fault(obj, page_offset, true, write); @@ -362,12 +401,14 @@ static vm_fault_t vm_fault_gtt(struct vm_fault *vmf) if (ret) goto err_unpin; + set_address_limits(area, vma, obj_offset, &start, &end); + + pfn = (ggtt->gmadr.start + i915_ggtt_offset(vma)) >> PAGE_SHIFT; + pfn += (start - area->vm_start) >> PAGE_SHIFT; + pfn += obj_offset - vma->ggtt_view.partial.offset; + /* Finally, remap it using the new GTT offset */ - ret = remap_io_mapping(area, - area->vm_start + (vma->ggtt_view.partial.offset << PAGE_SHIFT), - (ggtt->gmadr.start + vma->node.start) >> PAGE_SHIFT, - min_t(u64, vma->size, area->vm_end - area->vm_start), - &ggtt->iomap); + ret = remap_io_mapping(area, start, pfn, end - start, &ggtt->iomap); if (ret) goto err_fence; -- 2.34.1

2 1

[PATCH OLK-5.10] drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
by Cui GaoSheng 03 Sep '24

03 Sep '24

From: Andi Shyti <andi.shyti(a)linux.intel.com> stable inclusion from stable-v5.10.224 commit 50111a8098fb9ade621eeff82228a997d42732ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMM9L CVE: CVE-2024-42259 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3 upstream. Calculating the size of the mapped area as the lesser value between the requested size and the actual size does not consider the partial mapping offset. This can cause page fault access. Fix the calculation of the starting and ending addresses, the total size is now deduced from the difference between the end and start addresses. Additionally, the calculations have been rewritten in a clearer and more understandable form. Fixes: c58305af1835 ("drm/i915: Use remap_io_mapping() to prefault all PTE in a single pass") Reported-by: Jann Horn <jannh(a)google.com> Co-developed-by: Chris Wilson <chris.p.wilson(a)linux.intel.com> Signed-off-by: Chris Wilson <chris.p.wilson(a)linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti(a)linux.intel.com> Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> Cc: Matthew Auld <matthew.auld(a)intel.com> Cc: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Cc: <stable(a)vger.kernel.org> # v4.9+ Reviewed-by: Jann Horn <jannh(a)google.com> Reviewed-by: Jonathan Cavitt <Jonathan.cavitt(a)intel.com> [Joonas: Add Requires: tag] Requires: 60a2066c5005 ("drm/i915/gem: Adjust vma offset for framebuffer mmap offset") Signed-off-by: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240802083850.103694-3-andi.… (cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417) Signed-off-by: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 53 +++++++++++++++++++++--- 1 file changed, 47 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/i915_gem_mman.c index 01a88b03bc6d..0021b039b72b 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c @@ -273,6 +273,41 @@ static vm_fault_t vm_fault_cpu(struct vm_fault *vmf) return i915_error_to_vmf_fault(err); } +static void set_address_limits(struct vm_area_struct *area, + struct i915_vma *vma, + unsigned long obj_offset, + unsigned long *start_vaddr, + unsigned long *end_vaddr) +{ + unsigned long vm_start, vm_end, vma_size; /* user's memory parameters */ + long start, end; /* memory boundaries */ + + /* + * Let's move into the ">> PAGE_SHIFT" + * domain to be sure not to lose bits + */ + vm_start = area->vm_start >> PAGE_SHIFT; + vm_end = area->vm_end >> PAGE_SHIFT; + vma_size = vma->size >> PAGE_SHIFT; + + /* + * Calculate the memory boundaries by considering the offset + * provided by the user during memory mapping and the offset + * provided for the partial mapping. + */ + start = vm_start; + start -= obj_offset; + start += vma->ggtt_view.partial.offset; + end = start + vma_size; + + start = max_t(long, start, vm_start); + end = min_t(long, end, vm_end); + + /* Let's move back into the "<< PAGE_SHIFT" domain */ + *start_vaddr = (unsigned long)start << PAGE_SHIFT; + *end_vaddr = (unsigned long)end << PAGE_SHIFT; +} + static vm_fault_t vm_fault_gtt(struct vm_fault *vmf) { #define MIN_CHUNK_PAGES (SZ_1M >> PAGE_SHIFT) @@ -285,14 +320,18 @@ static vm_fault_t vm_fault_gtt(struct vm_fault *vmf) struct i915_ggtt *ggtt = &i915->ggtt; bool write = area->vm_flags & VM_WRITE; struct i915_gem_ww_ctx ww; + unsigned long obj_offset; + unsigned long start, end; /* memory boundaries */ intel_wakeref_t wakeref; struct i915_vma *vma; pgoff_t page_offset; + unsigned long pfn; int srcu; int ret; - /* We don't use vmf->pgoff since that has the fake offset */ + obj_offset = area->vm_pgoff - drm_vma_node_start(&mmo->vma_node); page_offset = (vmf->address - area->vm_start) >> PAGE_SHIFT; + page_offset += obj_offset; trace_i915_gem_object_fault(obj, page_offset, true, write); @@ -363,12 +402,14 @@ static vm_fault_t vm_fault_gtt(struct vm_fault *vmf) if (ret) goto err_unpin; + set_address_limits(area, vma, obj_offset, &start, &end); + + pfn = (ggtt->gmadr.start + i915_ggtt_offset(vma)) >> PAGE_SHIFT; + pfn += (start - area->vm_start) >> PAGE_SHIFT; + pfn += obj_offset - vma->ggtt_view.partial.offset; + /* Finally, remap it using the new GTT offset */ - ret = remap_io_mapping(area, - area->vm_start + (vma->ggtt_view.partial.offset << PAGE_SHIFT), - (ggtt->gmadr.start + vma->node.start) >> PAGE_SHIFT, - min_t(u64, vma->size, area->vm_end - area->vm_start), - &ggtt->iomap); + ret = remap_io_mapping(area, start, pfn, end - start, &ggtt->iomap); if (ret) goto err_fence; -- 2.34.1

2 1

[PATCH OLK-5.10] mlxsw: spectrum_acl_erp: Fix object nesting warning
by Dong Chenchen 03 Sep '24

03 Sep '24

From: Ido Schimmel <idosch(a)nvidia.com> stable inclusion from stable-v5.10.223 commit 36a9996e020dd5aa325e0ecc55eb2328288ea6bb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IALEAO CVE: CVE-2024-43880 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 97d833ceb27dc19f8777d63f90be4a27b5daeedf ] ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM (A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can contain more ACLs (i.e., tc filters), but the number of masks in each region (i.e., tc chain) is limited. In order to mitigate the effects of the above limitation, the device allows filters to share a single mask if their masks only differ in up to 8 consecutive bits. For example, dst_ip/25 can be represented using dst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the number of masks being used (and therefore does not support mask aggregation), but can contain a limited number of filters. The driver uses the "objagg" library to perform the mask aggregation by passing it objects that consist of the filter's mask and whether the filter is to be inserted into the A-TCAM or the C-TCAM since filters in different TCAMs cannot share a mask. The set of created objects is dependent on the insertion order of the filters and is not necessarily optimal. Therefore, the driver will periodically ask the library to compute a more optimal set ("hints") by looking at all the existing objects. When the library asks the driver whether two objects can be aggregated the driver only compares the provided masks and ignores the A-TCAM / C-TCAM indication. This is the right thing to do since the goal is to move as many filters as possible to the A-TCAM. The driver also forbids two identical masks from being aggregated since this can only happen if one was intentionally put in the C-TCAM to avoid a conflict in the A-TCAM. The above can result in the following set of hints: H1: {mask X, A-TCAM} -> H2: {mask Y, A-TCAM} // X is Y + delta H3: {mask Y, C-TCAM} -> H4: {mask Z, A-TCAM} // Y is Z + delta After getting the hints from the library the driver will start migrating filters from one region to another while consulting the computed hints and instructing the device to perform a lookup in both regions during the transition. Assuming a filter with mask X is being migrated into the A-TCAM in the new region, the hints lookup will return H1. Since H2 is the parent of H1, the library will try to find the object associated with it and create it if necessary in which case another hints lookup (recursive) will be performed. This hints lookup for {mask Y, A-TCAM} will either return H2 or H3 since the driver passes the library an object comparison function that ignores the A-TCAM / C-TCAM indication. This can eventually lead to nested objects which are not supported by the library [1]. Fix by removing the object comparison function from both the driver and the library as the driver was the only user. That way the lookup will only return exact matches. I do not have a reliable reproducer that can reproduce the issue in a timely manner, but before the fix the issue would reproduce in several minutes and with the fix it does not reproduce in over an hour. Note that the current usefulness of the hints is limited because they include the C-TCAM indication and represent aggregation that cannot actually happen. This will be addressed in net-next. [1] WARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0 Modules linked in: CPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42 Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:objagg_obj_parent_assign+0xb5/0xd0 [...] Call Trace: <TASK> __objagg_obj_get+0x2bb/0x580 objagg_obj_get+0xe/0x80 mlxsw_sp_acl_erp_mask_get+0xb5/0xf0 mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370 Fixes: 9069a3817d82 ("lib: objagg: implement optimization hints assembly and use hints for object creation") Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Tested-by: Alexander Zubkov <green(a)qrator.net> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- .../ethernet/mellanox/mlxsw/spectrum_acl_erp.c | 13 ------------- include/linux/objagg.h | 1 - lib/objagg.c | 15 --------------- 3 files changed, 29 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c index d231f4d2888b..9eee229303cc 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c @@ -1217,18 +1217,6 @@ static bool mlxsw_sp_acl_erp_delta_check(void *priv, const void *parent_obj, return err ? false : true; } -static int mlxsw_sp_acl_erp_hints_obj_cmp(const void *obj1, const void *obj2) -{ - const struct mlxsw_sp_acl_erp_key *key1 = obj1; - const struct mlxsw_sp_acl_erp_key *key2 = obj2; - - /* For hints purposes, two objects are considered equal - * in case the masks are the same. Does not matter what - * the "ctcam" value is. - */ - return memcmp(key1->mask, key2->mask, sizeof(key1->mask)); -} - static void *mlxsw_sp_acl_erp_delta_create(void *priv, void *parent_obj, void *obj) { @@ -1308,7 +1296,6 @@ static void mlxsw_sp_acl_erp_root_destroy(void *priv, void *root_priv) static const struct objagg_ops mlxsw_sp_acl_erp_objagg_ops = { .obj_size = sizeof(struct mlxsw_sp_acl_erp_key), .delta_check = mlxsw_sp_acl_erp_delta_check, - .hints_obj_cmp = mlxsw_sp_acl_erp_hints_obj_cmp, .delta_create = mlxsw_sp_acl_erp_delta_create, .delta_destroy = mlxsw_sp_acl_erp_delta_destroy, .root_create = mlxsw_sp_acl_erp_root_create, diff --git a/include/linux/objagg.h b/include/linux/objagg.h index 78021777df46..6df5b887dc54 100644 --- a/include/linux/objagg.h +++ b/include/linux/objagg.h @@ -8,7 +8,6 @@ struct objagg_ops { size_t obj_size; bool (*delta_check)(void *priv, const void *parent_obj, const void *obj); - int (*hints_obj_cmp)(const void *obj1, const void *obj2); void * (*delta_create)(void *priv, void *parent_obj, void *obj); void (*delta_destroy)(void *priv, void *delta_priv); void * (*root_create)(void *priv, void *obj, unsigned int root_id); diff --git a/lib/objagg.c b/lib/objagg.c index 5e1676ccdadd..6917d5974345 100644 --- a/lib/objagg.c +++ b/lib/objagg.c @@ -906,20 +906,6 @@ static const struct objagg_opt_algo *objagg_opt_algos[] = { [OBJAGG_OPT_ALGO_SIMPLE_GREEDY] = &objagg_opt_simple_greedy, }; -static int objagg_hints_obj_cmp(struct rhashtable_compare_arg *arg, - const void *obj) -{ - struct rhashtable *ht = arg->ht; - struct objagg_hints *objagg_hints = - container_of(ht, struct objagg_hints, node_ht); - const struct objagg_ops *ops = objagg_hints->ops; - const char *ptr = obj; - - ptr += ht->p.key_offset; - return ops->hints_obj_cmp ? ops->hints_obj_cmp(ptr, arg->key) : - memcmp(ptr, arg->key, ht->p.key_len); -} - /** * objagg_hints_get - obtains hints instance * @objagg: objagg instance @@ -958,7 +944,6 @@ struct objagg_hints *objagg_hints_get(struct objagg *objagg, offsetof(struct objagg_hints_node, obj); objagg_hints->ht_params.head_offset = offsetof(struct objagg_hints_node, ht_node); - objagg_hints->ht_params.obj_cmpfn = objagg_hints_obj_cmp; err = rhashtable_init(&objagg_hints->node_ht, &objagg_hints->ht_params); if (err) -- 2.25.1

2 1