- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Qasim Ijaz <qasdev00(a)gmail.com> stable inclusion from stable-v6.6.76 commit 38ac76fc06bc6826a3e4b12a98efbe98432380a9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBI4 CVE: CVE-2025-21724 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e24c1551059268b37f6f40639883eafb281b8b9c ] Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index() where shifting the constant "1" (of type int) by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior. The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63) the shift operation overflows, as the result cannot be represented in a 32-bit type. To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type to match the operand's type. Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support") Link: https://patch.msgid.link/r/20250113223820.10713-1-qasdev00@gmail.com Reported-by: syzbot <syzbot+85992ace37d5b7b51635(a)syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635 Signed-off-by: Qasim Ijaz <qasdev00(a)gmail.com> Reviewed-by: Joao Martins <joao.m.martins(a)oracle.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/iommu/iommufd/iova_bitmap.c drivers/vfio/iova_bitmap.c [Context conflicts] Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/iommu/iommufd/iova_bitmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/iommufd/iova_bitmap.c b/drivers/iommu/iommufd/iova_bitmap.c index ca5a1757adcd..9527db8d7ba1 100644 --- a/drivers/iommu/iommufd/iova_bitmap.c +++ b/drivers/iommu/iommufd/iova_bitmap.c @@ -130,7 +130,7 @@ struct iova_bitmap { static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap, unsigned long iova) { - unsigned long pgsize = 1 << bitmap->mapped.pgshift; + unsigned long pgsize = 1UL << bitmap->mapped.pgshift; return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize); } -- 2.20.1

2 1

[PATCH OLK-6.6] PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Niklas Cassel <cassel(a)kernel.org> mainline inclusion from mainline-v6.14-rc1 commit 3708acbd5f169ebafe1faa519cb28adc56295546 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC3J CVE: CVE-2024-58006 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In commit 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address") set_bar() was modified to support dynamically changing the backing physical address of a BAR that was already configured. This means that set_bar() can be called twice, without ever calling clear_bar() (as calling clear_bar() would clear the BAR's PCI address assigned by the host). This can only be done if the new BAR size/flags does not differ from the existing BAR configuration. Add these missing checks. If we allow set_bar() to set e.g. a new BAR size that differs from the existing BAR size, the new address translation range will be smaller than the BAR size already determined by the host, which would mean that a read past the new BAR size would pass the iATU untranslated, which could allow the host to read memory not belonging to the new struct pci_epf_bar. While at it, add comments which clarifies the support for dynamically changing the physical address of a BAR. (Which was also missing.) Fixes: 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address") Link: https://lore.kernel.org/r/20241213143301.4158431-10-cassel@kernel.org Signed-off-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Cc: stable(a)vger.kernel.org Conflicts: drivers/pci/controller/dwc/pcie-designware-ep.c [wxf: fix conflicts because of the following commit is not merged. commit 33a6938e0c337 "PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar()"] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- .../pci/controller/dwc/pcie-designware-ep.c | 22 ++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c index f2e5feba5526..7fd64ac2cea1 100644 --- a/drivers/pci/controller/dwc/pcie-designware-ep.c +++ b/drivers/pci/controller/dwc/pcie-designware-ep.c @@ -256,8 +256,28 @@ static int dw_pcie_ep_set_bar(struct pci_epc *epc, u8 func_no, u8 vfunc_no, if (ret) return ret; - if (ep->epf_bar[bar]) + /* + * Certain EPF drivers dynamically change the physical address of a BAR + * (i.e. they call set_bar() twice, without ever calling clear_bar(), as + * calling clear_bar() would clear the BAR's PCI address assigned by the + * host). + */ + if (ep->epf_bar[bar]) { + /* + * We can only dynamically change a BAR if the new BAR size and + * BAR flags do not differ from the existing configuration. + */ + if (ep->epf_bar[bar]->barno != bar || + ep->epf_bar[bar]->size != size || + ep->epf_bar[bar]->flags != flags) + return -EINVAL; + + /* + * When dynamically changing a BAR, skip writing the BAR reg, as + * that would clear the BAR's PCI address assigned by the host. + */ return 0; + } dw_pcie_dbi_ro_wr_en(pci); -- 2.20.1

2 1

[PATCH OLK-6.6] afs: Fix the maximum cell name length
by Qi Xi 13 Mar '25

13 Mar '25

From: David Howells <dhowells(a)redhat.com> mainline inclusion from mainline-v6.13-rc7 commit 8fd56ad6e7c90ac2bddb0741c6b248c8c5d56ac8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQQL CVE: CVE-2025-21646 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kafs filesystem limits the maximum length of a cell to 256 bytes, but a problem occurs if someone actually does that: kafs tries to create a directory under /proc/net/afs/ with the name of the cell, but that fails with a warning: WARNING: CPU: 0 PID: 9 at fs/proc/generic.c:405 because procfs limits the maximum filename length to 255. However, the DNS limits the maximum lookup length and, by extension, the maximum cell name, to 255 less two (length count and trailing NUL). Fix this by limiting the maximum acceptable cellname length to 253. This also allows us to be sure we can create the "/afs/.<cell>/" mountpoint too. Further, split the YFS VL record cell name maximum to be the 256 allowed by the protocol and ignore the record retrieved by YFSVL.GetCellName if it exceeds 253. Fixes: c3e9f888263b ("afs: Implement client support for the YFSVL.GetCellName RPC op") Reported-by: syzbot+7848fee1f1e5c53f912b(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/6776d25d.050a0220.3a8527.0048.GAE@google.com/ Signed-off-by: David Howells <dhowells(a)redhat.com> Link: https://lore.kernel.org/r/376236.1736180460@warthog.procyon.org.uk Tested-by: syzbot+7848fee1f1e5c53f912b(a)syzkaller.appspotmail.com cc: Marc Dionne <marc.dionne(a)auristor.com> cc: linux-afs(a)lists.infradead.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- fs/afs/afs.h | 2 +- fs/afs/afs_vl.h | 1 + fs/afs/vl_alias.c | 8 ++++++-- fs/afs/vlclient.c | 2 +- 4 files changed, 9 insertions(+), 4 deletions(-) diff --git a/fs/afs/afs.h b/fs/afs/afs.h index 81815724db6c..25c17100798b 100644 --- a/fs/afs/afs.h +++ b/fs/afs/afs.h @@ -10,7 +10,7 @@ #include <linux/in.h> -#define AFS_MAXCELLNAME 256 /* Maximum length of a cell name */ +#define AFS_MAXCELLNAME 253 /* Maximum length of a cell name (DNS limited) */ #define AFS_MAXVOLNAME 64 /* Maximum length of a volume name */ #define AFS_MAXNSERVERS 8 /* Maximum servers in a basic volume record */ #define AFS_NMAXNSERVERS 13 /* Maximum servers in a N/U-class volume record */ diff --git a/fs/afs/afs_vl.h b/fs/afs/afs_vl.h index 9c65ffb8a523..8da0899fbc08 100644 --- a/fs/afs/afs_vl.h +++ b/fs/afs/afs_vl.h @@ -13,6 +13,7 @@ #define AFS_VL_PORT 7003 /* volume location service port */ #define VL_SERVICE 52 /* RxRPC service ID for the Volume Location service */ #define YFS_VL_SERVICE 2503 /* Service ID for AuriStor upgraded VL service */ +#define YFS_VL_MAXCELLNAME 256 /* Maximum length of a cell name in YFS protocol */ enum AFSVL_Operations { VLGETENTRYBYID = 503, /* AFS Get VLDB entry by ID */ diff --git a/fs/afs/vl_alias.c b/fs/afs/vl_alias.c index f04a80e4f5c3..83cf1bfbe343 100644 --- a/fs/afs/vl_alias.c +++ b/fs/afs/vl_alias.c @@ -302,6 +302,7 @@ static char *afs_vl_get_cell_name(struct afs_cell *cell, struct key *key) static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key) { struct afs_cell *master; + size_t name_len; char *cell_name; cell_name = afs_vl_get_cell_name(cell, key); @@ -313,8 +314,11 @@ static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key) return 0; } - master = afs_lookup_cell(cell->net, cell_name, strlen(cell_name), - NULL, false); + name_len = strlen(cell_name); + if (!name_len || name_len > AFS_MAXCELLNAME) + master = ERR_PTR(-EOPNOTSUPP); + else + master = afs_lookup_cell(cell->net, cell_name, name_len, NULL, false); kfree(cell_name); if (IS_ERR(master)) return PTR_ERR(master); diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c index 00fca3c66ba6..16653f2ffe4f 100644 --- a/fs/afs/vlclient.c +++ b/fs/afs/vlclient.c @@ -671,7 +671,7 @@ static int afs_deliver_yfsvl_get_cell_name(struct afs_call *call) return ret; namesz = ntohl(call->tmp); - if (namesz > AFS_MAXCELLNAME) + if (namesz > YFS_VL_MAXCELLNAME) return afs_protocol_error(call, afs_eproto_cellname_len); paddedsz = (namesz + 3) & ~3; call->count = namesz; -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS] powerpc/pseries: Fix use after free in remove_phb_dynamic()
by Qi Xi 13 Mar '25

13 Mar '25

From: Michael Ellerman <mpe(a)ellerman.id.au> mainline inclusion from mainline-v5.18-rc1 commit fe2640bd7a62f1f7c3f55fbda31084085075bc30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1SK CVE: CVE-2022-49196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In remove_phb_dynamic() we use &phb->io_resource, after we've called device_unregister(&host_bridge->dev). But the unregister may have freed phb, because pcibios_free_controller_deferred() is the release function for the host_bridge. If there are no outstanding references when we call device_unregister() then phb will be freed out from under us. This has gone mainly unnoticed, but with slub_debug and page_poison enabled it can lead to a crash: PID: 7574 TASK: c0000000d492cb80 CPU: 13 COMMAND: "drmgr" #0 [c0000000e4f075a0] crash_kexec at c00000000027d7dc #1 [c0000000e4f075d0] oops_end at c000000000029608 #2 [c0000000e4f07650] __bad_page_fault at c0000000000904b4 #3 [c0000000e4f076c0] do_bad_slb_fault at c00000000009a5a8 #4 [c0000000e4f076f0] data_access_slb_common_virt at c000000000008b30 Data SLB Access [380] exception frame: R0: c000000000167250 R1: c0000000e4f07a00 R2: c000000002a46100 R3: c000000002b39ce8 R4: 00000000000000c0 R5: 00000000000000a9 R6: 3894674d000000c0 R7: 0000000000000000 R8: 00000000000000ff R9: 0000000000000100 R10: 6b6b6b6b6b6b6b6b R11: 0000000000008000 R12: c00000000023da80 R13: c0000009ffd38b00 R14: 0000000000000000 R15: 000000011c87f0f0 R16: 0000000000000006 R17: 0000000000000003 R18: 0000000000000002 R19: 0000000000000004 R20: 0000000000000005 R21: 000000011c87ede8 R22: 000000011c87c5a8 R23: 000000011c87d3a0 R24: 0000000000000000 R25: 0000000000000001 R26: c0000000e4f07cc8 R27: c00000004d1cc400 R28: c0080000031d00e8 R29: c00000004d23d800 R30: c00000004d1d2400 R31: c00000004d1d2540 NIP: c000000000167258 MSR: 8000000000009033 OR3: c000000000e9f474 CTR: 0000000000000000 LR: c000000000167250 XER: 0000000020040003 CCR: 0000000024088420 MQ: 0000000000000000 DAR: 6b6b6b6b6b6b6ba3 DSISR: c0000000e4f07920 Syscall Result: fffffffffffffff2 [NIP : release_resource+56] [LR : release_resource+48] #5 [c0000000e4f07a00] release_resource at c000000000167258 (unreliable) #6 [c0000000e4f07a30] remove_phb_dynamic at c000000000105648 #7 [c0000000e4f07ab0] dlpar_remove_slot at c0080000031a09e8 [rpadlpar_io] #8 [c0000000e4f07b50] remove_slot_store at c0080000031a0b9c [rpadlpar_io] #9 [c0000000e4f07be0] kobj_attr_store at c000000000817d8c #10 [c0000000e4f07c00] sysfs_kf_write at c00000000063e504 #11 [c0000000e4f07c20] kernfs_fop_write_iter at c00000000063d868 #12 [c0000000e4f07c70] new_sync_write at c00000000054339c #13 [c0000000e4f07d10] vfs_write at c000000000546624 #14 [c0000000e4f07d60] ksys_write at c0000000005469f4 #15 [c0000000e4f07db0] system_call_exception at c000000000030840 #16 [c0000000e4f07e10] system_call_vectored_common at c00000000000c168 To avoid it, we can take a reference to the host_bridge->dev until we're done using phb. Then when we drop the reference the phb will be freed. Fixes: 2dd9c11b9d4d ("powerpc/pseries: use pci_host_bridge.release_fn() to kfree(phb)") Reported-by: David Dai <zdai(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Tested-by: Sachin Sant <sachinp(a)linux.ibm.com> Link: https://lore.kernel.org/r/20220318034219.1188008-1-mpe@ellerman.id.au Conflicts: arch/powerpc/platforms/pseries/pci_dlpar.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/powerpc/platforms/pseries/pci_dlpar.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c index 561917fa54a8..bf4ca557c32d 100644 --- a/arch/powerpc/platforms/pseries/pci_dlpar.c +++ b/arch/powerpc/platforms/pseries/pci_dlpar.c @@ -89,6 +89,9 @@ int remove_phb_dynamic(struct pci_controller *phb) } } + /* Keep a reference so phb isn't freed yet */ + get_device(&host_bridge->dev); + /* Remove the PCI bus and unregister the bridge device from sysfs */ phb->bus = NULL; pci_remove_bus(b); @@ -111,6 +114,7 @@ int remove_phb_dynamic(struct pci_controller *phb) * the pcibios_free_controller_deferred() callback; * see pseries_root_bridge_prepare(). */ + put_device(&host_bridge->dev); return 0; } -- 2.33.0

2 1

[PATCH OLK-6.6 v2 1/2] fuse: cleanup request queuing towards virtiofs
by Yang Erkun 13 Mar '25

13 Mar '25

From: Miklos Szeredi <mszeredi(a)redhat.com> mainline inclusion from mainline-v6.12-rc1 commit 5de8acb41c86f1d335d165e0a350441ea3a1f480 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBT4CQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Virtiofs has its own queuing mechanism, but still requests are first queued on fiq->pending to be immediately dequeued and queued onto the virtio queue. The queuing on fiq->pending is unnecessary and might even have some performance impact due to being a contention point. Forget requests are handled similarly. Move the queuing of requests and forgets into the fiq->ops->*. fuse_iqueue_ops are renamed to reflect the new semantics. Reviewed-by: Stefan Hajnoczi <stefanha(a)redhat.com> Fixed-by: Jingbo Xu <jefflexu(a)linux.alibaba.com> Reviewed-by: Jingbo Xu <jefflexu(a)linux.alibaba.com> Tested-by: Peter-Jan Gootzen <pgootzen(a)nvidia.com> Reviewed-by: Peter-Jan Gootzen <pgootzen(a)nvidia.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Conflicts: fs/fuse/dev.c fs/fuse/fuse_i.h fs/fuse/virtio_fs.c [Context conflicts] Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/fuse/dev.c | 157 ++++++++++++++++++++++++-------------------- fs/fuse/fuse_i.h | 19 ++---- fs/fuse/virtio_fs.c | 41 ++++-------- 3 files changed, 105 insertions(+), 112 deletions(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 8573d79ef29c..51330a688b17 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -192,11 +192,22 @@ unsigned int fuse_len_args(unsigned int numargs, struct fuse_arg *args) } EXPORT_SYMBOL_GPL(fuse_len_args); -u64 fuse_get_unique(struct fuse_iqueue *fiq) +static u64 fuse_get_unique_locked(struct fuse_iqueue *fiq) { fiq->reqctr += FUSE_REQ_ID_STEP; return fiq->reqctr; } + +u64 fuse_get_unique(struct fuse_iqueue *fiq) +{ + u64 ret; + + spin_lock(&fiq->lock); + ret = fuse_get_unique_locked(fiq); + spin_unlock(&fiq->lock); + + return ret; +} EXPORT_SYMBOL_GPL(fuse_get_unique); static unsigned int fuse_req_hash(u64 unique) @@ -215,22 +226,68 @@ __releases(fiq->lock) spin_unlock(&fiq->lock); } +static void fuse_dev_queue_forget(struct fuse_iqueue *fiq, struct fuse_forget_link *forget) +{ + spin_lock(&fiq->lock); + if (fiq->connected) { + fiq->forget_list_tail->next = forget; + fiq->forget_list_tail = forget; + fuse_dev_wake_and_unlock(fiq); + } else { + kfree(forget); + spin_unlock(&fiq->lock); + } +} + +static void fuse_dev_queue_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req) +{ + spin_lock(&fiq->lock); + if (list_empty(&req->intr_entry)) { + list_add_tail(&req->intr_entry, &fiq->interrupts); + /* + * Pairs with smp_mb() implied by test_and_set_bit() + * from fuse_request_end(). + */ + smp_mb(); + if (test_bit(FR_FINISHED, &req->flags)) { + list_del_init(&req->intr_entry); + spin_unlock(&fiq->lock); + } else { + fuse_dev_wake_and_unlock(fiq); + } + } else { + spin_unlock(&fiq->lock); + } +} + +static void fuse_dev_queue_req(struct fuse_iqueue *fiq, struct fuse_req *req) +{ + spin_lock(&fiq->lock); + if (fiq->connected) { + if (req->in.h.opcode != FUSE_NOTIFY_REPLY) + req->in.h.unique = fuse_get_unique_locked(fiq); + list_add_tail(&req->list, &fiq->pending); + fuse_dev_wake_and_unlock(fiq); + } else { + spin_unlock(&fiq->lock); + req->out.h.error = -ENOTCONN; + fuse_request_end(req); + } +} + const struct fuse_iqueue_ops fuse_dev_fiq_ops = { - .wake_forget_and_unlock = fuse_dev_wake_and_unlock, - .wake_interrupt_and_unlock = fuse_dev_wake_and_unlock, - .wake_pending_and_unlock = fuse_dev_wake_and_unlock, + .send_forget = fuse_dev_queue_forget, + .send_interrupt = fuse_dev_queue_interrupt, + .send_req = fuse_dev_queue_req, }; EXPORT_SYMBOL_GPL(fuse_dev_fiq_ops); -static void queue_request_and_unlock(struct fuse_iqueue *fiq, - struct fuse_req *req) -__releases(fiq->lock) +static void fuse_send_one(struct fuse_iqueue *fiq, struct fuse_req *req) { req->in.h.len = sizeof(struct fuse_in_header) + fuse_len_args(req->args->in_numargs, (struct fuse_arg *) req->args->in_args); - list_add_tail(&req->list, &fiq->pending); - fiq->ops->wake_pending_and_unlock(fiq); + fiq->ops->send_req(fiq, req); } void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget, @@ -241,15 +298,7 @@ void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget, forget->forget_one.nodeid = nodeid; forget->forget_one.nlookup = nlookup; - spin_lock(&fiq->lock); - if (fiq->connected) { - fiq->forget_list_tail->next = forget; - fiq->forget_list_tail = forget; - fiq->ops->wake_forget_and_unlock(fiq); - } else { - kfree(forget); - spin_unlock(&fiq->lock); - } + fiq->ops->send_forget(fiq, forget); } static void flush_bg_queue(struct fuse_conn *fc) @@ -263,9 +312,7 @@ static void flush_bg_queue(struct fuse_conn *fc) req = list_first_entry(&fc->bg_queue, struct fuse_req, list); list_del(&req->list); fc->active_background++; - spin_lock(&fiq->lock); - req->in.h.unique = fuse_get_unique(fiq); - queue_request_and_unlock(fiq, req); + fuse_send_one(fiq, req); } } @@ -335,29 +382,12 @@ static int queue_interrupt(struct fuse_req *req) { struct fuse_iqueue *fiq = &req->fm->fc->iq; - spin_lock(&fiq->lock); /* Check for we've sent request to interrupt this req */ - if (unlikely(!test_bit(FR_INTERRUPTED, &req->flags))) { - spin_unlock(&fiq->lock); + if (unlikely(!test_bit(FR_INTERRUPTED, &req->flags))) return -EINVAL; - } - if (list_empty(&req->intr_entry)) { - list_add_tail(&req->intr_entry, &fiq->interrupts); - /* - * Pairs with smp_mb() implied by test_and_set_bit() - * from fuse_request_end(). - */ - smp_mb(); - if (test_bit(FR_FINISHED, &req->flags)) { - list_del_init(&req->intr_entry); - spin_unlock(&fiq->lock); - return 0; - } - fiq->ops->wake_interrupt_and_unlock(fiq); - } else { - spin_unlock(&fiq->lock); - } + fiq->ops->send_interrupt(fiq, req); + return 0; } @@ -412,21 +442,15 @@ static void __fuse_request_send(struct fuse_req *req) struct fuse_iqueue *fiq = &req->fm->fc->iq; BUG_ON(test_bit(FR_BACKGROUND, &req->flags)); - spin_lock(&fiq->lock); - if (!fiq->connected) { - spin_unlock(&fiq->lock); - req->out.h.error = -ENOTCONN; - } else { - req->in.h.unique = fuse_get_unique(fiq); - /* acquire extra reference, since request is still needed - after fuse_request_end() */ - __fuse_get_request(req); - queue_request_and_unlock(fiq, req); - request_wait_answer(req); - /* Pairs with smp_wmb() in fuse_request_end() */ - smp_rmb(); - } + /* acquire extra reference, since request is still needed after + fuse_request_end() */ + __fuse_get_request(req); + fuse_send_one(fiq, req); + + request_wait_answer(req); + /* Pairs with smp_wmb() in fuse_request_end() */ + smp_rmb(); } static void fuse_adjust_compat(struct fuse_conn *fc, struct fuse_args *args) @@ -581,7 +605,6 @@ static int fuse_simple_notify_reply(struct fuse_mount *fm, { struct fuse_req *req; struct fuse_iqueue *fiq = &fm->fc->iq; - int err = 0; req = fuse_get_req(fm, false); if (IS_ERR(req)) @@ -592,16 +615,9 @@ static int fuse_simple_notify_reply(struct fuse_mount *fm, fuse_args_to_req(req, args); - spin_lock(&fiq->lock); - if (fiq->connected) { - queue_request_and_unlock(fiq, req); - } else { - err = -ENODEV; - spin_unlock(&fiq->lock); - fuse_put_request(req); - } + fuse_send_one(fiq, req); - return err; + return 0; } /* @@ -1076,9 +1092,9 @@ __releases(fiq->lock) return err ? err : reqsize; } -struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, - unsigned int max, - unsigned int *countp) +static struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, + unsigned int max, + unsigned int *countp) { struct fuse_forget_link *head = fiq->forget_list_head.next; struct fuse_forget_link **newhead = &head; @@ -1097,7 +1113,6 @@ struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, return head; } -EXPORT_SYMBOL(fuse_dequeue_forget); static int fuse_read_single_forget(struct fuse_iqueue *fiq, struct fuse_copy_state *cs, @@ -1112,7 +1127,7 @@ __releases(fiq->lock) struct fuse_in_header ih = { .opcode = FUSE_FORGET, .nodeid = forget->forget_one.nodeid, - .unique = fuse_get_unique(fiq), + .unique = fuse_get_unique_locked(fiq), .len = sizeof(ih) + sizeof(arg), }; @@ -1143,7 +1158,7 @@ __releases(fiq->lock) struct fuse_batch_forget_in arg = { .count = 0 }; struct fuse_in_header ih = { .opcode = FUSE_BATCH_FORGET, - .unique = fuse_get_unique(fiq), + .unique = fuse_get_unique_locked(fiq), .len = sizeof(ih) + sizeof(arg), }; diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index 1bb136bcbe9e..8d702f96b9e5 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -416,22 +416,19 @@ struct fuse_iqueue; */ struct fuse_iqueue_ops { /** - * Signal that a forget has been queued + * Send one forget */ - void (*wake_forget_and_unlock)(struct fuse_iqueue *fiq) - __releases(fiq->lock); + void (*send_forget)(struct fuse_iqueue *fiq, struct fuse_forget_link *link); /** - * Signal that an INTERRUPT request has been queued + * Send interrupt for request */ - void (*wake_interrupt_and_unlock)(struct fuse_iqueue *fiq) - __releases(fiq->lock); + void (*send_interrupt)(struct fuse_iqueue *fiq, struct fuse_req *req); /** - * Signal that a request has been queued + * Send one request */ - void (*wake_pending_and_unlock)(struct fuse_iqueue *fiq) - __releases(fiq->lock); + void (*send_req)(struct fuse_iqueue *fiq, struct fuse_req *req); /** * Clean up when fuse_iqueue is destroyed @@ -1019,10 +1016,6 @@ void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget, struct fuse_forget_link *fuse_alloc_forget(void); -struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, - unsigned int max, - unsigned int *countp); - /* * Initialize READ or READDIR request */ diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c index ba816b50c1d4..a6e31e68906a 100644 --- a/fs/fuse/virtio_fs.c +++ b/fs/fuse/virtio_fs.c @@ -1083,22 +1083,13 @@ static struct virtio_driver virtio_fs_driver = { #endif }; -static void virtio_fs_wake_forget_and_unlock(struct fuse_iqueue *fiq) -__releases(fiq->lock) +static void virtio_fs_send_forget(struct fuse_iqueue *fiq, struct fuse_forget_link *link) { - struct fuse_forget_link *link; struct virtio_fs_forget *forget; struct virtio_fs_forget_req *req; - struct virtio_fs *fs; - struct virtio_fs_vq *fsvq; - u64 unique; - - link = fuse_dequeue_forget(fiq, 1, NULL); - unique = fuse_get_unique(fiq); - - fs = fiq->priv; - fsvq = &fs->vqs[VQ_HIPRIO]; - spin_unlock(&fiq->lock); + struct virtio_fs *fs = fiq->priv; + struct virtio_fs_vq *fsvq = &fs->vqs[VQ_HIPRIO]; + u64 unique = fuse_get_unique(fiq); /* Allocate a buffer for the request */ forget = kmalloc(sizeof(*forget), GFP_NOFS | __GFP_NOFAIL); @@ -1118,8 +1109,7 @@ __releases(fiq->lock) kfree(link); } -static void virtio_fs_wake_interrupt_and_unlock(struct fuse_iqueue *fiq) -__releases(fiq->lock) +static void virtio_fs_send_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req) { /* * TODO interrupts. @@ -1128,7 +1118,6 @@ __releases(fiq->lock) * Exceptions are blocking lock operations; for example fcntl(F_SETLKW) * with shared lock between host and guest. */ - spin_unlock(&fiq->lock); } /* Count number of scatter-gather elements required */ @@ -1333,21 +1322,17 @@ static int virtio_fs_enqueue_req(struct virtio_fs_vq *fsvq, return ret; } -static void virtio_fs_wake_pending_and_unlock(struct fuse_iqueue *fiq) -__releases(fiq->lock) +static void virtio_fs_send_req(struct fuse_iqueue *fiq, struct fuse_req *req) { unsigned int queue_id; struct virtio_fs *fs; - struct fuse_req *req; struct virtio_fs_vq *fsvq; int ret; - WARN_ON(list_empty(&fiq->pending)); - req = list_last_entry(&fiq->pending, struct fuse_req, list); + if (req->in.h.opcode != FUSE_NOTIFY_REPLY) + req->in.h.unique = fuse_get_unique(fiq); + clear_bit(FR_PENDING, &req->flags); - list_del_init(&req->list); - WARN_ON(!list_empty(&fiq->pending)); - spin_unlock(&fiq->lock); fs = fiq->priv; queue_id = VQ_REQUEST + fs->mq_map[raw_smp_processor_id()]; @@ -1387,10 +1372,10 @@ __releases(fiq->lock) } static const struct fuse_iqueue_ops virtio_fs_fiq_ops = { - .wake_forget_and_unlock = virtio_fs_wake_forget_and_unlock, - .wake_interrupt_and_unlock = virtio_fs_wake_interrupt_and_unlock, - .wake_pending_and_unlock = virtio_fs_wake_pending_and_unlock, - .release = virtio_fs_fiq_release, + .send_forget = virtio_fs_send_forget, + .send_interrupt = virtio_fs_send_interrupt, + .send_req = virtio_fs_send_req, + .release = virtio_fs_fiq_release, }; static inline void virtio_fs_ctx_set_defaults(struct fuse_fs_context *ctx) -- 2.39.2

1 1

[PATCH OLK-6.6 0/3] some readahead improvement
by Tong Tiangen 13 Mar '25

13 Mar '25

Jan Kara (3): readahead: make sure sync readahead reads needed page readahead: don't shorten readahead window in read_pages() readahead: properly shorten readahead when falling back to do_page_cache_ra() mm/readahead.c | 29 +++++++++++++---------------- 1 file changed, 13 insertions(+), 16 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
by Guo Mengqi 13 Mar '25

13 Mar '25

From: James Smart <jsmart2021(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit 577a942df3de2666f6947bdd3a5c9e8d30073424 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6SH CVE: CVE-2022-49535 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 577a942df3de2666f6947bdd3a5c9e8d30073424 ] If lpfc_issue_els_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference. Similarly, when processing non-zero ELS PLOGI completion status in lpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference. Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling. Link: https://lore.kernel.org/r/20220412222008.126521-9-jsmart2021@gmail.com Co-developed-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: James Smart <jsmart2021(a)gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/lpfc/lpfc_els.c [Some contexts are not in this version] Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/scsi/lpfc/lpfc_els.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c index deb9202307a9..f659a4014da3 100644 --- a/drivers/scsi/lpfc/lpfc_els.c +++ b/drivers/scsi/lpfc/lpfc_els.c @@ -1484,10 +1484,12 @@ lpfc_initial_flogi(struct lpfc_vport *vport) } if (lpfc_issue_els_flogi(vport, ndlp, 0)) { - /* This decrement of reference count to node shall kick off - * the release of the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; @@ -1531,10 +1533,12 @@ lpfc_initial_fdisc(struct lpfc_vport *vport) } if (lpfc_issue_els_fdisc(vport, ndlp, 0)) { - /* decrement node reference count to trigger the release of - * the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; -- 2.22.0

2 1

[PATCH OLK-6-6 0/3] some readahead improvement
by Tong Tiangen 13 Mar '25

13 Mar '25

Jan Kara (3): readahead: make sure sync readahead reads needed page readahead: don't shorten readahead window in read_pages() readahead: properly shorten readahead when falling back to do_page_cache_ra() mm/readahead.c | 29 +++++++++++++---------------- 1 file changed, 13 insertions(+), 16 deletions(-) -- 2.25.1

1 3

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 724815180d512a9df6b3edce9151a312b76d891d
by kernel test robot 13 Mar '25

13 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 724815180d512a9df6b3edce9151a312b76d891d !15461 be2net: Fix buffer overflow in be_get_module_eeprom Error/Warning (recently discovered and may have been fixed): drivers/regulator/max8973-regulator.o: warning: objtool: max8973_probe()+0x111a: can't find switch jump table samples/vfio-mdev/mdpy-fb.o: warning: objtool: missing symbol for section .text Unverified Error/Warning (likely false positive, kindly check if interested): drivers/gpu/drm/ast/ast_fb.c:114:17: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c:323:26: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c:353:33: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/emxx_udc/emxx_udc.c:3235:24: sparse: sparse: cast removes address space '__iomem' of expression drivers/staging/emxx_udc/emxx_udc.c:73:28: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/emxx_udc/emxx_udc.c:80:29: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1280:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1341:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1343:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1360:29: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1408:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1411:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1427:27: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1476:19: sparse: sparse: incorrect type in assignment (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1479:29: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1484:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1487:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1521:16: sparse: sparse: incorrect type in assignment (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1523:26: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1528:27: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1560:45: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1564:59: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1566:45: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1568:45: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1577:23: sparse: sparse: incorrect type in assignment (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1580:26: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1611:29: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1616:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1641:14: sparse: sparse: incorrect type in assignment (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1646:29: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1651:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:463:66: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:766:58: sparse: sparse: incorrect type in argument 2 (different address spaces) sound/soc/sunxi/sun8i-codec-analog.c:915:18: sparse: sparse: incorrect type in argument 3 (different address spaces) Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250312 | |-- include-linux-uaccess.h:warning:ces32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:input-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:karg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rdwr_arg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rs485-may-be-used-uninitialized | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250312 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250312 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250312 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-r132-20250309 | |-- drivers-gpu-drm-ast-ast_fb.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-got-void | |-- drivers-net-ethernet-oki-semi-pch_gbe-pch_gbe_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-void-reg | |-- drivers-net-ethernet-oki-semi-pch_gbe-pch_gbe_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-reg-got-unsigned-int-noderef-__iomem | |-- drivers-staging-emxx_udc-emxx_udc.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression | |-- drivers-staging-emxx_udc-emxx_udc.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-void-address | |-- drivers-staging-emxx_udc-emxx_udc.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-addr-got-void-address | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-struct-VCHIQ_COMPLETION_DA | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-struct-vchiq_completion_da | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-struct-vchiq_dequeue_messa | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-struct-vchiq_element-const | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-struct-vchiq_get_config32 | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void-const | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-unsigned-int-enum-VCHIQ_BULK_MODE_ | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-unsigned-int-msgbufcount32 | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-void | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-void-msgbufptr | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-uptr-got-struct-vchiq_header_struct-usert | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-uptr-got-void-addressable-usertype-bulk_u | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-uptr-got-void-addressable-usertype-servic | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-VCHIQ_GET_CONFIG_T-usertype-args-got-void-noderef-__ | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-int-msgbufcount32-got-unsigned-int-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-msgbuf-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-msgbufptr-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-int-noderef-__user-got-int | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-VCHIQ_COMPLETION_DATA_T-usertype-got-void-noderef-_ | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-VCHIQ_COMPLETION_DATA_T-usertype-noderef-__user-got | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-vchiq_config_struct-usertype-got-void-noderef-__use | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-vchiq_config_struct-usertype-noderef-__user-got-str | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-vchiq_element-const-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-vchiq_element-const-noderef-__user-got-struct-vchiq | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-unsigned-int-enum-VCHIQ_BULK_MODE_T-noderef-__user-got-uns | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-unsigned-int-noderef-__user-got-unsigned-int | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-__pu_val-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-__user-got-void-const | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-noderef-__user-got-void | `-- sound-soc-sunxi-sun8i-codec-analog.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-bus_context-got-void-noderef-__iomem-assigned-base |-- x86_64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-shmem.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-swap.c:linux-memremap.h-is-included-more-than-once. | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250312 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250312 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20250312 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250312 | |-- drivers-regulator-max8973-regulator.o:warning:objtool:max8973_probe:can-t-find-switch-jump-table | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration | `-- samples-vfio-mdev-mdpy-fb.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-005-20250312 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250312 | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-defconfig |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 727m configs tested: 15 configs skipped: 100 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250312 gcc-14.2.0 arm64 randconfig-002-20250312 gcc-14.2.0 arm64 randconfig-003-20250312 gcc-14.2.0 arm64 randconfig-004-20250312 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250312 clang-19 x86_64 buildonly-randconfig-002-20250312 clang-19 x86_64 buildonly-randconfig-003-20250312 gcc-12 x86_64 buildonly-randconfig-004-20250312 clang-19 x86_64 buildonly-randconfig-005-20250312 clang-19 x86_64 buildonly-randconfig-006-20250312 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 203e3cc21c92f7c3289882030d699e95765e3e6b
by kernel test robot 13 Mar '25

13 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 203e3cc21c92f7c3289882030d699e95765e3e6b !15376 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.62-6.6.63 LTS Conflicts Patches Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allmodconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250312 | `-- include-linux-mmzone.h:error:error-Allocator-MAX_ORDER-exceeds-SECTION_SIZE |-- loongarch-randconfig-002-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allnoconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250312 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250312 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-defconfig |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 728m configs tested: 17 configs skipped: 104 tested configs: arm64 allmodconfig clang-18 arm64 randconfig-001-20250312 clang-21 arm64 randconfig-002-20250312 gcc-14.2.0 arm64 randconfig-003-20250312 gcc-14.2.0 arm64 randconfig-004-20250312 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch randconfig-001-20250312 gcc-14.2.0 loongarch randconfig-002-20250312 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250312 clang-19 x86_64 buildonly-randconfig-002-20250312 clang-19 x86_64 buildonly-randconfig-003-20250312 gcc-12 x86_64 buildonly-randconfig-004-20250312 clang-19 x86_64 buildonly-randconfig-005-20250312 clang-19 x86_64 buildonly-randconfig-006-20250312 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 4fd58a13ae6e747556d318770dc39c1a58e821d9
by kernel test robot 13 Mar '25

13 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 4fd58a13ae6e747556d318770dc39c1a58e821d9 !15460 v2 soc: hisilicon: Add checks against NULL pointer reference Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-003-20250312 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-004-20250312 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250312 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250312 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250312 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250312 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250312 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250312 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch `-- x86_64-defconfig |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch elapsed time: 765m configs tested: 14 configs skipped: 104 tested configs: arm64 allmodconfig clang-18 arm64 randconfig-001-20250312 clang-21 arm64 randconfig-002-20250312 gcc-14.2.0 arm64 randconfig-003-20250312 gcc-14.2.0 arm64 randconfig-004-20250312 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250312 clang-19 x86_64 buildonly-randconfig-002-20250312 clang-19 x86_64 buildonly-randconfig-003-20250312 gcc-12 x86_64 buildonly-randconfig-004-20250312 clang-19 x86_64 buildonly-randconfig-005-20250312 clang-19 x86_64 buildonly-randconfig-006-20250312 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] fs/lockd: convert comma to semicolon
by longguang.yue 12 Mar '25

12 Mar '25

From: Zheng Yongjun <zhengyongjun3(a)huawei.com> stable inclusion from linux-5.11.y commit 3316fb80a0b4c1fef03a3eb1a7f0651e2133c429 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBQKK6 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ----------------- Replace a comma between expression statements by a semicolon. Signed-off-by: Zheng Yongjun <zhengyongjun3(a)huawei.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: longguang.yue <yuelg(a)chinaunicom.cn> --- fs/lockd/host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/lockd/host.c b/fs/lockd/host.c index 771c289f6df7..f802223e71ab 100644 --- a/fs/lockd/host.c +++ b/fs/lockd/host.c @@ -163,7 +163,7 @@ static struct nlm_host *nlm_alloc_host(struct nlm_lookup_host_info *ni, host->h_nsmhandle = nsm; host->h_addrbuf = nsm->sm_addrbuf; host->net = ni->net; - host->h_cred = get_cred(ni->cred), + host->h_cred = get_cred(ni->cred); strlcpy(host->nodename, utsname()->nodename, sizeof(host->nodename)); out: -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
by Zeng Heng 12 Mar '25

12 Mar '25

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from stable-v4.19.247 commit 4bdcf32c965c27f55ccc4ee71c1927131115b0bb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP32T CVE: CVE-2022-49503 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2dc509305cf956381532792cb8dceef2b1504765 ] The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to ensure that it is within the bitmap. drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept() error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()' Fixes: 4ed1a8d4a257 ("ath9k_htc: use ath9k_cmn_rx_accept") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Acked-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/20220409061225.GA5447@kili Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/wireless/ath/ath9k/htc_drv_txrx.c [Fix context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c index 2bca38e39721..df16b3e1f793 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c @@ -1007,6 +1007,14 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, goto rx_next; } + if (rxstatus->rs_keyix >= ATH_KEYMAX && + rxstatus->rs_keyix != ATH9K_RXKEYIX_INVALID) { + ath_dbg(common, ANY, + "Invalid keyix, dropping (keyix: %d)\n", + rxstatus->rs_keyix); + goto rx_next; + } + /* Get the RX status information */ memset(rx_status, 0, sizeof(struct ieee80211_rx_status)); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net: mdio: unexport __init-annotated mdio_bus_init()
by Wenyu Huang 12 Mar '25

12 Mar '25

From: Masahiro Yamada <masahiroy(a)kernel.org> stable inclusion from stable-v4.19.247 commit 5534bcd7c40299862237c4a8fd9c5031b3db1538 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPK8Q CVE: CVE-2022-49350 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 35b42dce619701f1300fb8498dae82c9bb1f0263 ] EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. modpost used to detect it, but it has been broken for a decade. Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds. There are two ways to fix it: - Remove __init - Remove EXPORT_SYMBOL I chose the latter for this case because the only in-tree call-site, drivers/net/phy/phy_device.c is never compiled as modular. (CONFIG_PHYLIB is boolean) Fixes: 90eff9096c01 ("net: phy: Allow splitting MDIO bus/device support from PHYs") Reported-by: Stephen Rothwell <sfr(a)canb.auug.org.au> Signed-off-by: Masahiro Yamada <masahiroy(a)kernel.org> Reviewed-by: Florian Fainelli <f.fainelli(a)gmail.com> Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/net/phy/mdio_bus.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 82cc1983c09a..35937175c4e8 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -745,7 +745,6 @@ int __init mdio_bus_init(void) return ret; } -EXPORT_SYMBOL_GPL(mdio_bus_init); #if IS_ENABLED(CONFIG_PHYLIB) void mdio_bus_exit(void) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
by Zeng Heng 12 Mar '25

12 Mar '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.247 commit 9345122f5fb9f97a206f440f38bb656e53f46912 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3KL CVE: CVE-2022-49517 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 05654431a18fe24e5e46a375d98904134628a102 ] This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak. Fixes: 8625c1dbd876 ("ASoC: mediatek: Add mt2701-wm8960 machine driver") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Link: https://lore.kernel.org/r/20220404093526.30004-1-linmq006@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- sound/soc/mediatek/mt2701/mt2701-wm8960.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/sound/soc/mediatek/mt2701/mt2701-wm8960.c b/sound/soc/mediatek/mt2701/mt2701-wm8960.c index 89f34efd9747..a5ede216b795 100644 --- a/sound/soc/mediatek/mt2701/mt2701-wm8960.c +++ b/sound/soc/mediatek/mt2701/mt2701-wm8960.c @@ -118,7 +118,8 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) if (!codec_node) { dev_err(&pdev->dev, "Property 'audio-codec' missing or invalid\n"); - return -EINVAL; + ret = -EINVAL; + goto put_platform_node; } for (i = 0; i < card->num_links; i++) { if (mt2701_wm8960_dai_links[i].codec_name) @@ -129,7 +130,7 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) ret = snd_soc_of_parse_audio_routing(card, "audio-routing"); if (ret) { dev_err(&pdev->dev, "failed to parse audio-routing: %d\n", ret); - return ret; + goto put_codec_node; } ret = devm_snd_soc_register_card(&pdev->dev, card); @@ -137,6 +138,10 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", __func__, ret); +put_codec_node: + of_node_put(codec_node); +put_platform_node: + of_node_put(platform_node); return ret; } -- 2.25.1

2 1

[PATCH OLK-6-6 0/3] some readahead improvement
by Tong Tiangen 12 Mar '25

12 Mar '25

Jan Kara (3): readahead: make sure sync readahead reads needed page readahead: don't shorten readahead window in read_pages() readahead: properly shorten readahead when falling back to do_page_cache_ra() mm/readahead.c | 29 +++++++++++++---------------- 1 file changed, 13 insertions(+), 16 deletions(-) -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49490
by Zeng Heng 12 Mar '25

12 Mar '25

Jessica Zhang (1): drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected Rob Clark (1): drm/msm/mdp5: Fix global state lock backoff drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 18 +++++++++++++----- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- 3 files changed, 30 insertions(+), 10 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49490
by Zeng Heng 12 Mar '25

12 Mar '25

Jessica Zhang (1): drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected Rob Clark (1): drm/msm/mdp5: Fix global state lock backoff drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 18 +++++++++++++----- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- 3 files changed, 30 insertions(+), 10 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected
by Zeng Heng 12 Mar '25

12 Mar '25

From: Jessica Zhang <quic_jesszhan(a)quicinc.com> stable inclusion from stable-v4.19.247 commit 776f5c58bfe16cf322d71eeed3c5dda1eeac7e6b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1O4 CVE: CVE-2022-49490 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d59be579fa932c46b908f37509f319cbd4ca9a68 ] mdp5_get_global_state runs the risk of hitting a -EDEADLK when acquiring the modeset lock, but currently mdp5_pipe_release doesn't check for if an error is returned. Because of this, there is a possibility of mdp5_pipe_release hitting a NULL dereference error. To avoid this, let's have mdp5_pipe_release check if mdp5_get_global_state returns an error and propogate that error. Changes since v1: - Separated declaration and initialization of *new_state to avoid compiler warning - Fixed some spelling mistakes in commit message Changes since v2: - Return 0 in case where hwpipe is NULL as this is considered normal behavior - Added 2nd patch in series to fix a similar NULL dereference issue in mdp5_mixer_release Reported-by: Tomeu Vizoso <tomeu.vizoso(a)collabora.com> Signed-off-by: Jessica Zhang <quic_jesszhan(a)quicinc.com> Fixes: 7907a0d77cb4 ("drm/msm/mdp5: Use the new private_obj state") Reviewed-by: Rob Clark <robdclark(a)gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/485179/ Link: https://lore.kernel.org/r/20220505214051.155-1-quic_jesszhan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +++++++++++---- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- 3 files changed, 28 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c index 1ef26bc63163..88de12225582 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c @@ -130,18 +130,23 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, return 0; } -void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) +int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) { struct msm_drm_private *priv = s->dev->dev_private; struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms)); struct mdp5_global_state *state = mdp5_get_global_state(s); - struct mdp5_hw_pipe_state *new_state = &state->hwpipe; + struct mdp5_hw_pipe_state *new_state; if (!hwpipe) - return; + return 0; + + if (IS_ERR(state)) + return PTR_ERR(state); + + new_state = &state->hwpipe; if (WARN_ON(!new_state->hwpipe_to_plane[hwpipe->idx])) - return; + return -EINVAL; DBG("%s: release from plane %s", hwpipe->name, new_state->hwpipe_to_plane[hwpipe->idx]->name); @@ -152,6 +157,8 @@ void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) } new_state->hwpipe_to_plane[hwpipe->idx] = NULL; + + return 0; } void mdp5_pipe_destroy(struct mdp5_hw_pipe *hwpipe) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h index bb2b0ac7aa2b..072db6a99b85 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h @@ -48,7 +48,7 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, uint32_t caps, uint32_t blkcfg, struct mdp5_hw_pipe **hwpipe, struct mdp5_hw_pipe **r_hwpipe); -void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe); +int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe); struct mdp5_hw_pipe *mdp5_pipe_init(enum mdp5_pipe pipe, uint32_t reg_offset, uint32_t caps); diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c index 1ddf07514de6..85bbae26b17e 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c @@ -399,12 +399,24 @@ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state, mdp5_state->r_hwpipe = NULL; - mdp5_pipe_release(state->state, old_hwpipe); - mdp5_pipe_release(state->state, old_right_hwpipe); + ret = mdp5_pipe_release(state->state, old_hwpipe); + if (ret) + return ret; + + ret = mdp5_pipe_release(state->state, old_right_hwpipe); + if (ret) + return ret; + } } else { - mdp5_pipe_release(state->state, mdp5_state->hwpipe); - mdp5_pipe_release(state->state, mdp5_state->r_hwpipe); + ret = mdp5_pipe_release(state->state, mdp5_state->hwpipe); + if (ret) + return ret; + + ret = mdp5_pipe_release(state->state, mdp5_state->r_hwpipe); + if (ret) + return ret; + mdp5_state->hwpipe = mdp5_state->r_hwpipe = NULL; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] be2net: Fix buffer overflow in be_get_module_eeprom
by Zeng Heng 12 Mar '25

12 Mar '25

From: Hristo Venev <hristo(a)venev.name> stable inclusion from stable-v4.19.254 commit 8ff4f9df73e5c551a72ee6034886c17e8de6596d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6VF CVE: CVE-2022-49581 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d7241f679a59cfe27f92cb5c6272cb429fb1f7ec ] be_cmd_read_port_transceiver_data assumes that it is given a buffer that is at least PAGE_DATA_LEN long, or twice that if the module supports SFF 8472. However, this is not always the case. Fix this by passing the desired offset and length to be_cmd_read_port_transceiver_data so that we only copy the bytes once. Fixes: e36edd9d26cf ("be2net: add ethtool "-m" option support") Signed-off-by: Hristo Venev <hristo(a)venev.name> Link: https://lore.kernel.org/r/20220716085134.6095-1-hristo@venev.name Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/net/ethernet/emulex/benet/be_cmds.c | 10 +++--- drivers/net/ethernet/emulex/benet/be_cmds.h | 2 +- .../net/ethernet/emulex/benet/be_ethtool.c | 31 ++++++++++++------- 3 files changed, 25 insertions(+), 18 deletions(-) diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c index 1e9d882c04ef..a4a448d97451 100644 --- a/drivers/net/ethernet/emulex/benet/be_cmds.c +++ b/drivers/net/ethernet/emulex/benet/be_cmds.c @@ -2291,7 +2291,7 @@ int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, u32 *state) /* Uses sync mcc */ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, - u8 page_num, u8 *data) + u8 page_num, u32 off, u32 len, u8 *data) { struct be_dma_mem cmd; struct be_mcc_wrb *wrb; @@ -2325,10 +2325,10 @@ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, req->port = cpu_to_le32(adapter->hba_port_num); req->page_num = cpu_to_le32(page_num); status = be_mcc_notify_wait(adapter); - if (!status) { + if (!status && len > 0) { struct be_cmd_resp_port_type *resp = cmd.va; - memcpy(data, resp->page_data, PAGE_DATA_LEN); + memcpy(data, resp->page_data + off, len); } err: mutex_unlock(&adapter->mcc_lock); @@ -2419,7 +2419,7 @@ int be_cmd_query_cable_type(struct be_adapter *adapter) int status; status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - page_data); + 0, PAGE_DATA_LEN, page_data); if (!status) { switch (adapter->phy.interface_type) { case PHY_TYPE_QSFP: @@ -2444,7 +2444,7 @@ int be_cmd_query_sfp_info(struct be_adapter *adapter) int status; status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - page_data); + 0, PAGE_DATA_LEN, page_data); if (!status) { strlcpy(adapter->phy.vendor_name, page_data + SFP_VENDOR_NAME_OFFSET, SFP_VENDOR_NAME_LEN - 1); diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h index e8b43cf44b6f..f6f9c51a7d47 100644 --- a/drivers/net/ethernet/emulex/benet/be_cmds.h +++ b/drivers/net/ethernet/emulex/benet/be_cmds.h @@ -2431,7 +2431,7 @@ int be_cmd_set_beacon_state(struct be_adapter *adapter, u8 port_num, u8 beacon, int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, u32 *state); int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, - u8 page_num, u8 *data); + u8 page_num, u32 off, u32 len, u8 *data); int be_cmd_query_cable_type(struct be_adapter *adapter); int be_cmd_query_sfp_info(struct be_adapter *adapter); int lancer_cmd_read_object(struct be_adapter *adapter, struct be_dma_mem *cmd, diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c index d1905d50c26c..1c1ac3488da2 100644 --- a/drivers/net/ethernet/emulex/benet/be_ethtool.c +++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c @@ -1342,7 +1342,7 @@ static int be_get_module_info(struct net_device *netdev, return -EOPNOTSUPP; status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - page_data); + 0, PAGE_DATA_LEN, page_data); if (!status) { if (!page_data[SFP_PLUS_SFF_8472_COMP]) { modinfo->type = ETH_MODULE_SFF_8079; @@ -1360,25 +1360,32 @@ static int be_get_module_eeprom(struct net_device *netdev, { struct be_adapter *adapter = netdev_priv(netdev); int status; + u32 begin, end; if (!check_privilege(adapter, MAX_PRIVILEGES)) return -EOPNOTSUPP; - status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - data); - if (status) - goto err; + begin = eeprom->offset; + end = eeprom->offset + eeprom->len; + + if (begin < PAGE_DATA_LEN) { + status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, begin, + min_t(u32, end, PAGE_DATA_LEN) - begin, + data); + if (status) + goto err; + + data += PAGE_DATA_LEN - begin; + begin = PAGE_DATA_LEN; + } - if (eeprom->offset + eeprom->len > PAGE_DATA_LEN) { - status = be_cmd_read_port_transceiver_data(adapter, - TR_PAGE_A2, - data + - PAGE_DATA_LEN); + if (end > PAGE_DATA_LEN) { + status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A2, + begin - PAGE_DATA_LEN, + end - begin, data); if (status) goto err; } - if (eeprom->offset) - memcpy(data, data + eeprom->offset, eeprom->len); err: return be_cmd_status(status); } -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1473/1473] drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:72:28: sparse: sparse: symbol 'nic_cmd_support_vf' was not declared. Should it be static?
by kernel test robot 12 Mar '25

12 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 09e192513a17ce8324302ae595ebf001e08e13b0 commit: 746ea35981b1f77e988d48642409d73f0470b3eb [1473/1473] net: hinic: Add Hardware Abstract Layer config: arm64-randconfig-r132-20250309 (https://download.01.org/0day-ci/archive/20250312/202503121425.Yho9rU1a-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250312/202503121425.Yho9rU1a-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503121425.Yho9rU1a-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:72:28: sparse: sparse: symbol 'nic_cmd_support_vf' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:398:5: sparse: sparse: symbol 'hinic_hiovs_set_cpath_vlan' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:424:5: sparse: sparse: symbol 'hinic_hiovs_del_cpath_vlan' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1541:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] group_index @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1541:30: sparse: expected unsigned int [usertype] group_index drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1541:30: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1544:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] size @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1544:23: sparse: expected unsigned int [usertype] size drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1544:23: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1546:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] ctx @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1546:22: sparse: expected unsigned int [usertype] ctx drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1546:22: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1728:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] group_index @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1728:32: sparse: expected unsigned int [usertype] group_index drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1728:32: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1735:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1735:31: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1735:31: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1742:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] size @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1742:25: sparse: expected unsigned int [usertype] size drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1742:25: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1754:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] offset @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1754:27: sparse: expected unsigned int [usertype] offset drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1754:27: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1755:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] size @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1755:25: sparse: expected unsigned int [usertype] size drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1755:25: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:2349:5: sparse: sparse: symbol 'nic_pf_mbox_handler' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:3237:5: sparse: sparse: symbol 'hw_speed_convert' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:398:5: warning: no previous prototype for 'hinic_hiovs_set_cpath_vlan' [-Wmissing-prototypes] 398 | int hinic_hiovs_set_cpath_vlan(void *hwdev, u16 vlan_id, u16 pf_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:424:5: warning: no previous prototype for 'hinic_hiovs_del_cpath_vlan' [-Wmissing-prototypes] 424 | int hinic_hiovs_del_cpath_vlan(void *hwdev, u16 vlan_id, u16 pf_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:2349:5: warning: no previous prototype for 'nic_pf_mbox_handler' [-Wmissing-prototypes] 2349 | int nic_pf_mbox_handler(void *hwdev, u16 vf_id, u8 cmd, void *buf_in, | ^~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:346:6: sparse: sparse: symbol 'hinic_qp_prepare_cmdq_header' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:379:24: sparse: sparse: cast to restricted __be64 >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:365:6: sparse: sparse: symbol 'hinic_sq_prepare_ctxt' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:441:24: sparse: sparse: cast to restricted __be64 >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:427:6: sparse: sparse: symbol 'hinic_rq_prepare_ctxt' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:843:16: sparse: sparse: cast to restricted __be16 >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:913:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [addressable] [usertype] db_info @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:913:23: sparse: expected unsigned int [addressable] [usertype] db_info drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:913:23: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:917:9: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:917:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:917:9: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:917:9: sparse: got unsigned long long [usertype] * >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:974:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:974:27: sparse: expected unsigned short [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:974:27: sparse: got restricted __be16 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:346:6: warning: no previous prototype for 'hinic_qp_prepare_cmdq_header' [-Wmissing-prototypes] 346 | void hinic_qp_prepare_cmdq_header(struct hinic_qp_ctxt_header *qp_ctxt_hdr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:365:6: warning: no previous prototype for 'hinic_sq_prepare_ctxt' [-Wmissing-prototypes] 365 | void hinic_sq_prepare_ctxt(struct hinic_sq *sq, u16 global_qpn, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:427:6: warning: no previous prototype for 'hinic_rq_prepare_ctxt' [-Wmissing-prototypes] 427 | void hinic_rq_prepare_ctxt(struct hinic_rq *rq, struct hinic_rq_ctxt *rq_ctxt) | ^~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c:100:24: sparse: sparse: incorrect type in return expression (different base types) @@ expected unsigned short @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c:100:24: sparse: expected unsigned short drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c:100:24: sparse: got restricted __be16 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c:159:22: sparse: sparse: cast removes address space '__iomem' of expression -- >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:37:16: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: expected unsigned int [usertype] val drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:552:29: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base @@ got void *cfg_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:552:29: sparse: expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:552:29: sparse: got void *cfg_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:553:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *intr_regs_base @@ got void *intr_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:553:30: sparse: expected unsigned char [noderef] [usertype] __iomem *intr_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:553:30: sparse: got void *intr_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:557:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *db_base @@ got void *db_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:557:23: sparse: expected unsigned char [noderef] [usertype] __iomem *db_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:557:23: sparse: got void *db_base >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:558:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __iomem *dwqe_mapping @@ got void *dwqe_mapping @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:558:28: sparse: expected void [noderef] __iomem *dwqe_mapping drivers/net/ethernet/huawei/hinic/hinic_hwif.c:558:28: sparse: got void *dwqe_mapping drivers/net/ethernet/huawei/hinic/hinic_hwif.c:620:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:620:65: sparse: expected restricted gfp_t [usertype] flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:620:65: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:635:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:635:65: sparse: expected restricted gfp_t [usertype] flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:635:65: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:52: warning: Function parameter or member 'hwdev' not described in 'hwif_ready' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:52: warning: Excess function parameter 'hwif' description in 'hwif_ready' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'hwdev' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'cfg_reg_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'intr_reg_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'db_base_phy' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'db_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'dwqe_mapping' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Excess function parameter 'hwif' description in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Excess function parameter 'pdev' description in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:607: warning: Function parameter or member 'hwdev' not described in 'hinic_free_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:607: warning: Excess function parameter 'hwif' description in 'hinic_free_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:607: warning: Excess function parameter 'pdev' description in 'hinic_free_hwif' -- >> drivers/net/ethernet/huawei/hinic/hinic_eqs.c:418:29: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_eqs.c:426:39: sparse: sparse: mixing different enum types: drivers/net/ethernet/huawei/hinic/hinic_eqs.c:426:39: sparse: unsigned int enum hinic_aeq_type drivers/net/ethernet/huawei/hinic/hinic_eqs.c:426:39: sparse: unsigned int enum hinic_ucode_event_type >> drivers/net/ethernet/huawei/hinic/hinic_eqs.c:431:37: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/huawei/hinic/hinic_eqs.c:479:24: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_eqs.c:765:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_eqs.c:765:25: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_eqs.c:765:25: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_eqs.c:783:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] desc @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_eqs.c:783:28: sparse: expected unsigned int [usertype] desc drivers/net/ethernet/huawei/hinic/hinic_eqs.c:783:28: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_eqs.c: In function 'aeq_irq_handler': drivers/net/ethernet/huawei/hinic/hinic_eqs.c:426:37: warning: implicit conversion from 'enum hinic_aeq_type' to 'enum hinic_ucode_event_type' [-Wenum-conversion] 426 | ucode_event = event; | ^ drivers/net/ethernet/huawei/hinic/hinic_eqs.c:238: warning: Function parameter or member 'hwdev' not described in 'hinic_aeq_register_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:238: warning: Function parameter or member 'hwe_cb' not described in 'hinic_aeq_register_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:238: warning: Excess function parameter 'eqs' description in 'hinic_aeq_register_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:238: warning: Excess function parameter 'handle' description in 'hinic_aeq_register_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:238: warning: Excess function parameter 'hw_cb' description in 'hinic_aeq_register_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:258: warning: Function parameter or member 'hwdev' not described in 'hinic_aeq_unregister_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:258: warning: Excess function parameter 'eqs' description in 'hinic_aeq_unregister_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:280: warning: Function parameter or member 'hwdev' not described in 'hinic_aeq_register_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:280: warning: Function parameter or member 'aeq_swe_cb' not described in 'hinic_aeq_register_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:280: warning: Excess function parameter 'eqs' description in 'hinic_aeq_register_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:280: warning: Excess function parameter 'handle' description in 'hinic_aeq_register_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:280: warning: Excess function parameter 'sw_cb' description in 'hinic_aeq_register_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:300: warning: Function parameter or member 'hwdev' not described in 'hinic_aeq_unregister_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:300: warning: Excess function parameter 'eqs' description in 'hinic_aeq_unregister_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:322: warning: Function parameter or member 'hwdev' not described in 'hinic_ceq_register_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:322: warning: Function parameter or member 'callback' not described in 'hinic_ceq_register_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:322: warning: Excess function parameter 'ceqs' description in 'hinic_ceq_register_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:322: warning: Excess function parameter 'handle' description in 'hinic_ceq_register_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:322: warning: Excess function parameter 'ceq_cb' description in 'hinic_ceq_register_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:342: warning: Function parameter or member 'hwdev' not described in 'hinic_ceq_unregister_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:342: warning: Excess function parameter 'ceqs' description in 'hinic_ceq_unregister_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:361: warning: Function parameter or member 'arm_state' not described in 'set_eq_cons_idx' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:382: warning: Function parameter or member 'ceqs' not described in 'ceq_event_handler' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:382: warning: Excess function parameter 'eqs' description in 'ceq_event_handler' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:954: warning: Function parameter or member 'hwdev' not described in 'init_eq' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:954: warning: Excess function parameter 'hwif' description in 'init_eq' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:954: warning: Excess function parameter 'page_size' description in 'init_eq' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Function parameter or member 'hwdev' not described in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Function parameter or member 'num_aeqs' not described in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Excess function parameter 'aeqs' description in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Excess function parameter 'hwif' description in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Excess function parameter 'num_ceqs' description in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Excess function parameter 'q_len' description in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Excess function parameter 'page_size' description in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1139: warning: Function parameter or member 'hwdev' not described in 'hinic_aeqs_free' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1139: warning: Excess function parameter 'aeqs' description in 'hinic_aeqs_free' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1171: warning: Function parameter or member 'hwdev' not described in 'hinic_ceqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1171: warning: Excess function parameter 'ceqs' description in 'hinic_ceqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1171: warning: Excess function parameter 'hwif' description in 'hinic_ceqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1171: warning: Excess function parameter 'q_len' description in 'hinic_ceqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1171: warning: Excess function parameter 'page_size' description in 'hinic_ceqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1222: warning: Function parameter or member 'hwdev' not described in 'hinic_ceqs_free' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1222: warning: Excess function parameter 'ceqs' description in 'hinic_ceqs_free' -- >> drivers/net/ethernet/huawei/hinic/hinic_mbox.c:735:5: sparse: sparse: symbol 'set_vf_mbox_random_id' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_mbox.c:813:21: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_mbox.c:787:6: sparse: sparse: symbol 'check_vf_mbox_random_id' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_mbox.c:893:54: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:893:54: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/hinic/hinic_mbox.c:893:54: sparse: got unsigned char [usertype] * drivers/net/ethernet/huawei/hinic/hinic_mbox.c:909:58: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:909:58: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/hinic/hinic_mbox.c:909:58: sparse: got unsigned char [usertype] * >> drivers/net/ethernet/huawei/hinic/hinic_mbox.c:947:6: sparse: sparse: symbol 'dump_mox_reg' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_mbox.c:962:22: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/huawei/hinic/hinic_mbox.c:1450:25: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [usertype] *data @@ got unsigned char [noderef] [usertype] __iomem * @@ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:1450:25: sparse: expected unsigned char [usertype] *data drivers/net/ethernet/huawei/hinic/hinic_mbox.c:1450:25: sparse: got unsigned char [noderef] [usertype] __iomem * drivers/net/ethernet/huawei/hinic/hinic_mbox.c:735:5: warning: no previous prototype for 'set_vf_mbox_random_id' [-Wmissing-prototypes] 735 | int set_vf_mbox_random_id(struct hinic_hwdev *hwdev, u16 func_id) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:787:6: warning: no previous prototype for 'check_vf_mbox_random_id' [-Wmissing-prototypes] 787 | bool check_vf_mbox_random_id(struct hinic_mbox_func_to_func *func_to_func, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:947:6: warning: no previous prototype for 'dump_mox_reg' [-Wmissing-prototypes] 947 | void dump_mox_reg(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:265: warning: Function parameter or member 'hwdev' not described in 'hinic_register_ppf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:265: warning: Excess function parameter 'func_to_func' description in 'hinic_register_ppf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:287: warning: Function parameter or member 'hwdev' not described in 'hinic_register_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:287: warning: Excess function parameter 'func_to_func' description in 'hinic_register_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:309: warning: Function parameter or member 'hwdev' not described in 'hinic_register_vf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:309: warning: Excess function parameter 'func_to_func' description in 'hinic_register_vf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:331: warning: Function parameter or member 'hwdev' not described in 'hinic_register_ppf_to_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:331: warning: Excess function parameter 'func_to_func' description in 'hinic_register_ppf_to_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:350: warning: Function parameter or member 'hwdev' not described in 'hinic_unregister_ppf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:350: warning: Excess function parameter 'func_to_func' description in 'hinic_unregister_ppf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:364: warning: Function parameter or member 'hwdev' not described in 'hinic_unregister_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:364: warning: Excess function parameter 'func_to_func' description in 'hinic_unregister_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:378: warning: Function parameter or member 'hwdev' not described in 'hinic_unregister_vf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:378: warning: Excess function parameter 'func_to_func' description in 'hinic_unregister_vf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:392: warning: Function parameter or member 'hwdev' not described in 'hinic_unregister_ppf_to_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:392: warning: Excess function parameter 'func_to_func' description in 'hinic_unregister_ppf_to_pf_mbox_cb' -- >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:160:31: sparse: sparse: cast to restricted __be64 >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:241:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:241:20: sparse: expected unsigned long long [usertype] drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:241:20: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:302:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] desc @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:302:20: sparse: expected unsigned long long [usertype] desc drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:302:20: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:353:20: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:357:25: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:417:31: sparse: sparse: cast to restricted __be64 >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:776:41: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] hw_cmd_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:776:41: sparse: expected unsigned long long [usertype] hw_cmd_paddr drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:776:41: sparse: got restricted __be64 [usertype] drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:782:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] hw_cmd_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:782:42: sparse: expected unsigned long long [usertype] hw_cmd_paddr drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:782:42: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:809:37: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] hw_wb_resp_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:809:37: sparse: expected unsigned long long [usertype] hw_wb_resp_paddr drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:809:37: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:887:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] next_cell_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:887:43: sparse: expected unsigned long long [usertype] next_cell_paddr drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:887:43: sparse: got restricted __be64 [usertype] drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:930:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] next_cell_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:930:31: sparse: expected unsigned long long [usertype] next_cell_paddr drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:930:31: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:999:47: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected unsigned int flag @@ got restricted gfp_t @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:999:47: sparse: expected unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:999:47: sparse: got restricted gfp_t drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:515:17: sparse: sparse: context imbalance in 'api_cmd' - different lock contexts for basic block drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c: In function 'api_chain_init': drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1033:41: warning: suggest braces around empty body in an 'else' statement [-Wempty-body] 1033 | sema_deinit(&chain->sem); | ^ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c: In function 'api_chain_free': drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1056:41: warning: suggest braces around empty body in an 'else' statement [-Wempty-body] 1056 | sema_deinit(&chain->sem); | ^ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:197: warning: Function parameter or member 'cmd_size' not described in 'get_cell_data_size' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:411: warning: Function parameter or member 'ctxt' not described in 'wait_for_resp_polling' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:411: warning: Excess function parameter 'chain' description in 'wait_for_resp_polling' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:443: warning: Function parameter or member 'ctxt' not described in 'wait_for_api_cmd_completion' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:443: warning: Function parameter or member 'ack' not described in 'wait_for_api_cmd_completion' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:443: warning: Function parameter or member 'ack_size' not described in 'wait_for_api_cmd_completion' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:502: warning: Function parameter or member 'cmd_size' not described in 'api_cmd' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:502: warning: Function parameter or member 'ack' not described in 'api_cmd' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:502: warning: Function parameter or member 'ack_size' not described in 'api_cmd' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:502: warning: Excess function parameter 'size' description in 'api_cmd' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:565: warning: Function parameter or member 'cmd_chain' not described in 'api_cmd_hw_restart' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:565: warning: Excess function parameter 'chain' description in 'api_cmd_hw_restart' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1068: warning: Function parameter or member 'cmd_chain' not described in 'api_cmd_create_chain' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1068: warning: Excess function parameter 'chain' description in 'api_cmd_create_chain' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1132: warning: Function parameter or member 'hwdev' not described in 'hinic_api_cmd_init' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1132: warning: Excess function parameter 'hwif' description in 'hinic_api_cmd_init' -- >> drivers/net/ethernet/huawei/hinic/hinic_wq.c:208:55: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected unsigned int flag @@ got restricted gfp_t @@ drivers/net/ethernet/huawei/hinic/hinic_wq.c:208:55: sparse: expected unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_wq.c:208:55: sparse: got restricted gfp_t >> drivers/net/ethernet/huawei/hinic/hinic_wq.c:214:24: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_wq.c:214:24: sparse: expected unsigned long long [usertype] drivers/net/ethernet/huawei/hinic/hinic_wq.c:214:24: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_wq.c:587:16: sparse: sparse: cast to restricted __be64 -- >> drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:366:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [addressable] [usertype] db_info @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:366:20: sparse: expected unsigned int [addressable] [usertype] db_info drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:366:20: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:369:9: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:369:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:369:9: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:369:9: sparse: got unsigned char [usertype] * >> drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:511:31: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:517:40: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:517:40: sparse: expected unsigned long long [usertype] drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:517:40: sparse: got restricted __be64 [usertype] drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:531:21: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1080:27: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1151:25: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1217:37: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1245:31: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1315:26: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1315:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *db_base @@ got unsigned char [usertype] * @@ drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1315:23: sparse: expected unsigned char [noderef] [usertype] __iomem *db_base drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1315:23: sparse: got unsigned char [usertype] * >> drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1334:5: sparse: sparse: symbol 'hinic_set_cmdq_ctxts' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1334:5: warning: no previous prototype for 'hinic_set_cmdq_ctxts' [-Wmissing-prototypes] 1334 | int hinic_set_cmdq_ctxts(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:223:5: sparse: sparse: symbol 'hinic_hw_rx_buf_size' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:629:28: sparse: sparse: symbol 'hw_cmd_support_vf' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:659:30: sparse: sparse: symbol 'mgmt_status_log' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:722:6: sparse: sparse: symbol 'hinic_print_status_info' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1039:5: sparse: sparse: symbol 'hinic_msg_to_mgmt_no_ack' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1106:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1106:22: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1106:22: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1128:24: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1826:5: sparse: sparse: symbol 'hinic_sync_heartbeat_status' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1928:5: sparse: sparse: symbol 'comm_pf_mbox_handler' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2617:5: sparse: sparse: symbol 'ppf_ht_gpa_set' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2663:5: sparse: sparse: symbol 'hinic_ppf_ht_gpa_init' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2709:6: sparse: sparse: symbol 'hinic_ppf_ht_gpa_deinit' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4205:6: sparse: sparse: symbol 'pf_fault_event_handler' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4213:6: sparse: sparse: symbol 'mgmt_watchdog_event_handler' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4220:6: sparse: sparse: symbol 'mgmt_fmw_act_event_handler' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4227:6: sparse: sparse: symbol 'mgmt_pcie_dfx_event_handler' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4234:6: sparse: sparse: symbol 'mgmt_get_mctp_event_handler' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4517:5: sparse: sparse: symbol '_set_led_status' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4603:5: sparse: sparse: symbol 'hinic_get_phy_init_status' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4807:5: sparse: sparse: symbol 'hinic_read_reg' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4985:23: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4991:21: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [addressable] [assigned] [usertype] val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4991:21: sparse: expected unsigned int [addressable] [assigned] [usertype] val drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4991:21: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:722:6: warning: no previous prototype for 'hinic_print_status_info' [-Wmissing-prototypes] 722 | void hinic_print_status_info(void *hwdev, enum hinic_mod_type mod, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1039:5: warning: no previous prototype for 'hinic_msg_to_mgmt_no_ack' [-Wmissing-prototypes] 1039 | int hinic_msg_to_mgmt_no_ack(void *hwdev, enum hinic_mod_type mod, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1826:5: warning: no previous prototype for 'hinic_sync_heartbeat_status' [-Wmissing-prototypes] 1826 | int hinic_sync_heartbeat_status(struct hinic_hwdev *hwdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1928:5: warning: no previous prototype for 'comm_pf_mbox_handler' [-Wmissing-prototypes] 1928 | int comm_pf_mbox_handler(void *handle, u16 vf_id, u8 cmd, void *buf_in, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2617:5: warning: no previous prototype for 'ppf_ht_gpa_set' [-Wmissing-prototypes] 2617 | int ppf_ht_gpa_set(struct hinic_hwdev *hwdev, struct hinic_page_addr *pg0, | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2663:5: warning: no previous prototype for 'hinic_ppf_ht_gpa_init' [-Wmissing-prototypes] 2663 | int hinic_ppf_ht_gpa_init(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2709:6: warning: no previous prototype for 'hinic_ppf_ht_gpa_deinit' [-Wmissing-prototypes] 2709 | void hinic_ppf_ht_gpa_deinit(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2786:5: warning: no previous prototype for 'mqm_eqm_try_alloc_mem' [-Wmissing-prototypes] 2786 | int mqm_eqm_try_alloc_mem(struct hinic_hwdev *hwdev, u32 page_size, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2823:5: warning: no previous prototype for 'mqm_eqm_alloc_page_mem' [-Wmissing-prototypes] 2823 | int mqm_eqm_alloc_page_mem(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2848:6: warning: no previous prototype for 'mqm_eqm_free_page_mem' [-Wmissing-prototypes] 2848 | void mqm_eqm_free_page_mem(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2864:5: warning: no previous prototype for 'mqm_eqm_set_cfg_2_hw' [-Wmissing-prototypes] 2864 | int mqm_eqm_set_cfg_2_hw(struct hinic_hwdev *hwdev, u32 valid) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2889:5: warning: no previous prototype for 'mqm_eqm_set_page_2_hw' [-Wmissing-prototypes] 2889 | int mqm_eqm_set_page_2_hw(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2967:5: warning: no previous prototype for 'mqm_eqm_init' [-Wmissing-prototypes] 2967 | int mqm_eqm_init(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3030:6: warning: no previous prototype for 'mqm_eqm_deinit' [-Wmissing-prototypes] 3030 | void mqm_eqm_deinit(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3932:6: warning: no previous prototype for 'print_hilink_info' [-Wmissing-prototypes] 3932 | void print_hilink_info(struct hinic_hwdev *hwdev, | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4205:6: warning: no previous prototype for 'pf_fault_event_handler' [-Wmissing-prototypes] 4205 | void pf_fault_event_handler(void *hwdev, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4213:6: warning: no previous prototype for 'mgmt_watchdog_event_handler' [-Wmissing-prototypes] 4213 | void mgmt_watchdog_event_handler(void *hwdev, void *buf_in, u16 in_size, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4220:6: warning: no previous prototype for 'mgmt_fmw_act_event_handler' [-Wmissing-prototypes] 4220 | void mgmt_fmw_act_event_handler(void *hwdev, void *buf_in, u16 in_size, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4227:6: warning: no previous prototype for 'mgmt_pcie_dfx_event_handler' [-Wmissing-prototypes] 4227 | void mgmt_pcie_dfx_event_handler(void *hwdev, void *buf_in, u16 in_size, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4234:6: warning: no previous prototype for 'mgmt_get_mctp_event_handler' [-Wmissing-prototypes] 4234 | void mgmt_get_mctp_event_handler(void *hwdev, void *buf_in, u16 in_size, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4517:5: warning: no previous prototype for '_set_led_status' [-Wmissing-prototypes] 4517 | int _set_led_status(struct hinic_hwdev *hwdev, u8 port, | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4603:5: warning: no previous prototype for 'hinic_get_phy_init_status' [-Wmissing-prototypes] 4603 | int hinic_get_phy_init_status(void *hwdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4807:5: warning: no previous prototype for 'hinic_read_reg' [-Wmissing-prototypes] 4807 | int hinic_read_reg(void *hwdev, u32 reg_addr, u32 *val) | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4894:5: warning: no previous prototype for 'hinic_register_fault_recover' [-Wmissing-prototypes] 4894 | int hinic_register_fault_recover(void *hwdev, void *pri_handle, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4916:5: warning: no previous prototype for 'hinic_unregister_fault_recover' [-Wmissing-prototypes] 4916 | int hinic_unregister_fault_recover(void *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c: In function '__print_cable_info.isra': drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3849:29: warning: ', Temperature: ' directive output may be truncated writing 15 bytes into a region of size between 0 and 511 [-Wformat-truncation=] 3849 | "%s, Temperature: %u", tmp_str, | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3849:26: note: directive argument in the range [0, 255] 3849 | "%s, Temperature: %u", tmp_str, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3848:17: note: 'snprintf' output between 17 and 530 bytes into a destination of size 511 3848 | snprintf(tmp_str, sizeof(tmp_str) - 1, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3849 | "%s, Temperature: %u", tmp_str, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3850 | info->cable_temp); | ~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3848:17: warning: 'snprintf' argument 4 overlaps destination object 'tmp_str' [-Wrestrict] drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3812:14: note: destination object referenced by 'restrict'-qualified argument 1 was declared here 3812 | char tmp_str[512] = {0}; | ^~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1721: warning: Function parameter or member 'hwdev' not described in 'set_pf_dma_attr_entry' drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1721: warning: Excess function parameter 'hwif' description in 'set_pf_dma_attr_entry' drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1780: warning: Function parameter or member 'hwdev' not described in 'dma_attr_table_init' drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1780: warning: Excess function parameter 'hwif' description in 'dma_attr_table_init' -- >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:41:6: sparse: sparse: symbol 'g_test_qpc_num' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:42:6: sparse: sparse: symbol 'g_test_qpc_resvd_num' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:43:6: sparse: sparse: symbol 'g_test_pagesize_reorder' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:44:6: sparse: sparse: symbol 'g_test_xid_alloc_mode' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:45:6: sparse: sparse: symbol 'g_test_gpa_check_enable' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:46:6: sparse: sparse: symbol 'g_test_qpc_alloc_mode' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:47:6: sparse: sparse: symbol 'g_test_scqc_alloc_mode' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:48:6: sparse: sparse: symbol 'g_test_max_conn' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:49:6: sparse: sparse: symbol 'g_test_max_cache_conn' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:50:6: sparse: sparse: symbol 'g_test_scqc_num' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:51:6: sparse: sparse: symbol 'g_test_mpt_num' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:52:6: sparse: sparse: symbol 'g_test_mpt_resvd' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:53:6: sparse: sparse: symbol 'g_test_scq_resvd' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:54:6: sparse: sparse: symbol 'g_test_hash_num' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:55:6: sparse: sparse: symbol 'g_test_reorder_num' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1411:5: sparse: sparse: symbol 'init_cfg_mgmt' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1458:6: sparse: sparse: symbol 'free_cfg_mgmt' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1493:5: sparse: sparse: symbol 'init_capability' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1522:6: sparse: sparse: symbol 'free_capability' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1732:5: sparse: sparse: symbol 'cfg_set_func_sf_en' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1770:5: sparse: sparse: symbol 'cfg_get_func_sf_en' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1096:5: warning: no previous prototype for 'hinic_vector_to_irq' [-Wmissing-prototypes] 1096 | int hinic_vector_to_irq(void *hwdev, enum hinic_service_type type, int vector) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1411:5: warning: no previous prototype for 'init_cfg_mgmt' [-Wmissing-prototypes] 1411 | int init_cfg_mgmt(struct hinic_hwdev *dev) | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1458:6: warning: no previous prototype for 'free_cfg_mgmt' [-Wmissing-prototypes] 1458 | void free_cfg_mgmt(struct hinic_hwdev *dev) | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1493:5: warning: no previous prototype for 'init_capability' [-Wmissing-prototypes] 1493 | int init_capability(struct hinic_hwdev *dev) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1522:6: warning: no previous prototype for 'free_capability' [-Wmissing-prototypes] 1522 | void free_capability(struct hinic_hwdev *dev) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1732:5: warning: no previous prototype for 'cfg_set_func_sf_en' [-Wmissing-prototypes] 1732 | int cfg_set_func_sf_en(void *hwdev, u32 enbits, u32 enmask) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1770:5: warning: no previous prototype for 'cfg_get_func_sf_en' [-Wmissing-prototypes] 1770 | int cfg_get_func_sf_en(void *hwdev, u32 *enbits) | ^~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:66:6: sparse: sparse: symbol 'get_slave_host_enable' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:589:6: sparse: sparse: symbol 'comm_ppf_to_pf_handler' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:607:5: sparse: sparse: symbol 'hinic_nic_ppf_mbox_handler' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:616:6: sparse: sparse: symbol 'hinic_nic_ppf_to_pf_handler' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:625:5: sparse: sparse: symbol 'hinic_register_slave_ppf' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:66:6: warning: no previous prototype for 'get_slave_host_enable' [-Wmissing-prototypes] 66 | bool get_slave_host_enable(struct hinic_hwdev *hwdev, u8 host_id) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:209:5: warning: no previous prototype for '__mbox_to_host' [-Wmissing-prototypes] 209 | int __mbox_to_host(struct hinic_hwdev *hwdev, enum hinic_mod_type mod, | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:483:5: warning: no previous prototype for 'sw_func_ppf_mbox_handler' [-Wmissing-prototypes] 483 | int sw_func_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:506:5: warning: no previous prototype for '__ppf_process_mbox_msg' [-Wmissing-prototypes] 506 | int __ppf_process_mbox_msg(struct hinic_hwdev *hwdev, u16 pf_idx, u16 vf_id, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:580:5: warning: no previous prototype for 'comm_ppf_mbox_handler' [-Wmissing-prototypes] 580 | int comm_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:589:6: warning: no previous prototype for 'comm_ppf_to_pf_handler' [-Wmissing-prototypes] 589 | void comm_ppf_to_pf_handler(void *handle, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:598:5: warning: no previous prototype for 'hilink_ppf_mbox_handler' [-Wmissing-prototypes] 598 | int hilink_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:607:5: warning: no previous prototype for 'hinic_nic_ppf_mbox_handler' [-Wmissing-prototypes] 607 | int hinic_nic_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:616:6: warning: no previous prototype for 'hinic_nic_ppf_to_pf_handler' [-Wmissing-prototypes] 616 | void hinic_nic_ppf_to_pf_handler(void *handle, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:625:5: warning: no previous prototype for 'hinic_register_slave_ppf' [-Wmissing-prototypes] 625 | int hinic_register_slave_ppf(struct hinic_hwdev *hwdev, bool registered) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:686:5: warning: no previous prototype for 'set_slave_func_nic_state' [-Wmissing-prototypes] 686 | int set_slave_func_nic_state(struct hinic_hwdev *hwdev, u16 func_idx, u8 en) | ^~~~~~~~~~~~~~~~~~~~~~~~ vim +/nic_cmd_support_vf +72 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c 71 > 72 struct vf_cmd_check_handle nic_cmd_support_vf[] = { 73 {HINIC_PORT_CMD_VF_REGISTER, NULL}, 74 {HINIC_PORT_CMD_VF_UNREGISTER, NULL}, 75 76 {HINIC_PORT_CMD_CHANGE_MTU, hinic_mbox_check_func_id_8B}, 77 78 {HINIC_PORT_CMD_ADD_VLAN, hinic_mbox_check_func_id_8B}, 79 {HINIC_PORT_CMD_DEL_VLAN, hinic_mbox_check_func_id_8B}, 80 81 {HINIC_PORT_CMD_SET_MAC, hinic_mbox_check_func_id_8B}, 82 {HINIC_PORT_CMD_GET_MAC, hinic_mbox_check_func_id_8B}, 83 {HINIC_PORT_CMD_DEL_MAC, hinic_mbox_check_func_id_8B}, 84 85 {HINIC_PORT_CMD_SET_RX_MODE, hinic_mbox_check_func_id_8B}, 86 87 {HINIC_PORT_CMD_GET_PAUSE_INFO, hinic_mbox_check_func_id_8B}, 88 89 {HINIC_PORT_CMD_GET_LINK_STATE, hinic_mbox_check_func_id_8B}, 90 {HINIC_PORT_CMD_SET_LRO, hinic_mbox_check_func_id_8B}, 91 {HINIC_PORT_CMD_SET_RX_CSUM, hinic_mbox_check_func_id_8B}, 92 {HINIC_PORT_CMD_SET_RX_VLAN_OFFLOAD, hinic_mbox_check_func_id_8B}, 93 94 {HINIC_PORT_CMD_GET_VPORT_STAT, hinic_mbox_check_func_id_8B}, 95 {HINIC_PORT_CMD_CLEAN_VPORT_STAT, hinic_mbox_check_func_id_8B}, 96 97 {HINIC_PORT_CMD_GET_RSS_TEMPLATE_INDIR_TBL, 98 hinic_mbox_check_func_id_8B}, 99 {HINIC_PORT_CMD_SET_RSS_TEMPLATE_INDIR_TBL, 100 hinic_mbox_check_func_id_8B}, 101 {HINIC_PORT_CMD_SET_RSS_TEMPLATE_TBL, hinic_mbox_check_func_id_8B}, 102 {HINIC_PORT_CMD_GET_RSS_TEMPLATE_TBL, hinic_mbox_check_func_id_8B}, 103 {HINIC_PORT_CMD_SET_RSS_HASH_ENGINE, hinic_mbox_check_func_id_8B}, 104 {HINIC_PORT_CMD_GET_RSS_HASH_ENGINE, hinic_mbox_check_func_id_8B}, 105 {HINIC_PORT_CMD_GET_RSS_CTX_TBL, hinic_mbox_check_func_id_8B}, 106 {HINIC_PORT_CMD_SET_RSS_CTX_TBL, hinic_mbox_check_func_id_8B}, 107 {HINIC_PORT_CMD_RSS_TEMP_MGR, hinic_mbox_check_func_id_8B}, 108 {HINIC_PORT_CMD_RSS_CFG, hinic_mbox_check_func_id_8B}, 109 110 {HINIC_PORT_CMD_INIT_FUNC, check_func_table}, 111 {HINIC_PORT_CMD_SET_LLI_PRI, hinic_mbox_check_func_id_8B}, 112 113 {HINIC_PORT_CMD_GET_MGMT_VERSION, NULL}, 114 {HINIC_PORT_CMD_GET_BOOT_VERSION, NULL}, 115 {HINIC_PORT_CMD_GET_MICROCODE_VERSION, NULL}, 116 117 {HINIC_PORT_CMD_GET_VPORT_ENABLE, hinic_mbox_check_func_id_8B}, 118 {HINIC_PORT_CMD_SET_VPORT_ENABLE, hinic_mbox_check_func_id_8B}, 119 120 {HINIC_PORT_CMD_GET_LRO, hinic_mbox_check_func_id_8B}, 121 {HINIC_PORT_CMD_GET_GLOBAL_QPN, hinic_mbox_check_func_id_8B}, 122 123 {HINIC_PORT_CMD_SET_TSO, hinic_mbox_check_func_id_8B}, 124 {HINIC_PORT_CMD_SET_RQ_IQ_MAP, hinic_mbox_check_func_id_8B}, 125 {HINIC_PORT_CMD_LINK_STATUS_REPORT, hinic_mbox_check_func_id_8B}, 126 {HINIC_PORT_CMD_UPDATE_MAC, hinic_mbox_check_func_id_8B}, 127 128 {HINIC_PORT_CMD_GET_PORT_INFO, hinic_mbox_check_func_id_8B}, 129 130 {HINIC_PORT_CMD_SET_IPSU_MAC, hinic_mbox_check_func_id_10B}, 131 {HINIC_PORT_CMD_GET_IPSU_MAC, hinic_mbox_check_func_id_10B}, 132 133 {HINIC_PORT_CMD_GET_LINK_MODE, hinic_mbox_check_func_id_8B}, 134 135 {HINIC_PORT_CMD_CLEAR_SQ_RES, hinic_mbox_check_func_id_8B}, 136 {HINIC_PORT_CMD_SET_SUPER_CQE, hinic_mbox_check_func_id_8B}, 137 138 {HINIC_PORT_CMD_GET_VF_COS, NULL}, 139 {HINIC_PORT_CMD_SET_VHD_CFG, hinic_mbox_check_func_id_8B}, 140 141 {HINIC_PORT_CMD_SET_VLAN_FILTER, hinic_mbox_check_func_id_8B}, 142 }; 143 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/4] some readahead improvement
by Tong Tiangen 12 Mar '25

12 Mar '25

Jan Kara (3): readahead: make sure sync readahead reads needed page readahead: don't shorten readahead window in read_pages() readahead: properly shorten readahead when falling back to do_page_cache_ra() Yafang Shao (1): mm/readahead: fix large folio support in async readahead mm/readahead.c | 35 ++++++++++++++++++----------------- 1 file changed, 18 insertions(+), 17 deletions(-) -- 2.25.1

2 5

[PATCH V2 OLK-5.10] soc: hisilicon: Add checks against NULL pointer reference
by Junhao He 12 Mar '25

12 Mar '25

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBS9WQ CVE: NA ---------------------------------------------------------------------- The function of ACPI_COMPANION returns a NULL pointer when the device without an fwnode, so add checks for this to fix NULL pointer reference at ACPI_COMPANION. Fixes: efb5bc7b199e ("soc: hisilicon: Support memory repair driver on Kunpeng SoC") Signed-off-by: Junhao He <hejunhao3(a)huawei.com> Signed-off-by: Qizhi Zhang <zhangqizhi3(a)h-partners.com> --- drivers/soc/hisilicon/hisi_mem_ras.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/soc/hisilicon/hisi_mem_ras.c b/drivers/soc/hisilicon/hisi_mem_ras.c index 991b76e3075d..556a6be8afda 100644 --- a/drivers/soc/hisilicon/hisi_mem_ras.c +++ b/drivers/soc/hisilicon/hisi_mem_ras.c @@ -43,16 +43,20 @@ static int hisi_mem_get_pcc_chan_id(struct hisi_mem_dev *hdev) struct platform_device *pdev = hdev->pdev; struct acpi_device *adev = ACPI_COMPANION(&pdev->dev); struct hisi_mem_register_ctx ctx = {0}; - acpi_handle handle = adev->handle; acpi_status status; - if (!acpi_has_method(handle, METHOD_NAME__CRS)) { + if (!adev) { + dev_err(&pdev->dev, "ACPI companion missing\n"); + return -ENODEV; + } + + if (!acpi_has_method(adev->handle, METHOD_NAME__CRS)) { dev_err(&pdev->dev, "No _CRS method.\n"); return -ENODEV; } ctx.dev = &pdev->dev; - status = acpi_walk_resources(handle, METHOD_NAME__CRS, + status = acpi_walk_resources(adev->handle, METHOD_NAME__CRS, hisi_mem_get_chan_id_cb, &ctx); if (ACPI_FAILURE(status)) return ctx.err; -- 2.33.0

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 5d94761f19ef0d640491ea29b1e87db3c5093756
by kernel test robot 12 Mar '25

12 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 5d94761f19ef0d640491ea29b1e87db3c5093756 !15447 Some bug fix patches for RDMA/hns to olk-5.10 Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-alldefconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-001-20250311 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-002-20250311 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-003-20250311 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-004-20250311 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- Warning:arch-x86-kernel-cpu-resctrl-monitor.c-references-a-file-that-doesn-t-exist:Documentation-x86-resctrl.rst | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250311 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250311 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250311 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250311 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250311 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250311 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch `-- x86_64-defconfig |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch elapsed time: 762m configs tested: 16 configs skipped: 109 tested configs: arm64 alldefconfig gcc-14.2.0 arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250311 gcc-14.2.0 arm64 randconfig-002-20250311 gcc-14.2.0 arm64 randconfig-003-20250311 gcc-14.2.0 arm64 randconfig-004-20250311 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250311 gcc-12 x86_64 buildonly-randconfig-002-20250311 gcc-12 x86_64 buildonly-randconfig-003-20250311 clang-19 x86_64 buildonly-randconfig-004-20250311 clang-19 x86_64 buildonly-randconfig-005-20250311 gcc-12 x86_64 buildonly-randconfig-006-20250311 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] perf: Configure BRBE correctly on VHE host
by Yushan Wang 12 Mar '25

12 Mar '25

From: Yicong Yang <yangyicong(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBSI0M CVE: NA ---------------------------------------------------------------------- The BRBE support backported of v18 didn't configure the BRBCR_EL1 correctly which will miss some key functions like FZP during sampling. In VHE mode with MDCR_EL2.HPMN set to PMCR_EL0.N, the counters are controlled by BRBCR_EL1 rather than BRBCR_EL2 (which writes to BRBCR_EL1 are redirected to). Use the same value for both register except keep EL1 and EL0 recording disabled in guests. The fix is backported from the v19 version [1]. [1] https://lore.kernel.org/linux-arm-kernel/ 20250202-arm-brbe-v19-v19-0-1c1300802385(a)kernel.org/ T/#m887b1dcf7f6784b7293626952052f27b68784beb Fixes: 6c6848e7e00c ("drivers: perf: arm_pmuv3: Enable branch stack sampling via FEAT_BRBE") Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Qizhi Zhang <zhangqizhi3(a)h-partners.com> --- drivers/perf/arm_brbe.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/perf/arm_brbe.c b/drivers/perf/arm_brbe.c index d795e8fd646f..22e4828feec8 100644 --- a/drivers/perf/arm_brbe.c +++ b/drivers/perf/arm_brbe.c @@ -874,6 +874,16 @@ void armv8pmu_branch_enable(struct arm_pmu *arm_pmu) brbcr &= ~BRBCR_ELx_CONFIG_MASK; brbcr |= branch_type_to_brbcr(cpuc->branch_sample_type); write_sysreg_s(brbcr, SYS_BRBCR_EL1); + + /* + * In VHE mode with MDCR_EL2.HPMN set to PMCR_EL0.N, the counters are + * controlled by BRBCR_EL1 rather than BRBCR_EL2 (which writes to + * BRBCR_EL1 are redirected to). Use the same value for both register + * except keep EL1 and EL0 recording disabled in guests. + */ + if (is_kernel_in_hyp_mode()) + write_sysreg_s(brbcr & ~(BRBCR_ELx_ExBRE | BRBCR_ELx_E0BRE), SYS_BRBCR_EL12); + isb(); } @@ -886,6 +896,11 @@ void armv8pmu_branch_disable(void) brbcr &= ~(BRBCR_ELx_E0BRE | BRBCR_ELx_ExBRE); brbfcr |= BRBFCR_EL1_PAUSED; write_sysreg_s(brbcr, SYS_BRBCR_EL1); + + /* See the comment in armv8pmu_branch_enable() */ + if (is_kernel_in_hyp_mode()) + write_sysreg_s(brbcr, SYS_BRBCR_EL12); + write_sysreg_s(brbfcr, SYS_BRBFCR_EL1); isb(); } -- 2.33.0

2 1

openEuler Kernel SIG双周例会
by openEuler conference 12 Mar '25

12 Mar '25

您好！ Kernel 邀请您参加 2025-03-14 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复此邮件申报，也可直接填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/965671868 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2025-03-14 14:00, The subject of the conference is openEuler Kernel SIG双周例会 Summary: 1. 进展update 2. 议题征集中（新增议题可回复此邮件申报，也可直接填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/965671868 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] sfc: fix kernel panic when creating VF
by Zeng Heng 12 Mar '25

12 Mar '25

From: Íñigo Huguet <ihuguet(a)redhat.com> stable inclusion from stable-v4.19.253 commit 82bcb730f856086f033e6c04082eb4503d4c2fa4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP5WM CVE: CVE-2022-49625 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ada74c5539eba06cf8b47d068f92e0b3963a9a6e ] When creating VFs a kernel panic can happen when calling to efx_ef10_try_update_nic_stats_vf. When releasing a DMA coherent buffer, sometimes, I don't know in what specific circumstances, it has to unmap memory with vunmap. It is disallowed to do that in IRQ context or with BH disabled. Otherwise, we hit this line in vunmap, causing the crash: BUG_ON(in_interrupt()); This patch reenables BH to release the buffer. Log messages when the bug is hit: kernel BUG at mm/vmalloc.c:2727! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 6 PID: 1462 Comm: NetworkManager Kdump: loaded Tainted: G I --------- --- 5.14.0-119.el9.x86_64 #1 Hardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020 RIP: 0010:vunmap+0x2e/0x30 ...skip... Call Trace: __iommu_dma_free+0x96/0x100 efx_nic_free_buffer+0x2b/0x40 [sfc] efx_ef10_try_update_nic_stats_vf+0x14a/0x1c0 [sfc] efx_ef10_update_stats_vf+0x18/0x40 [sfc] efx_start_all+0x15e/0x1d0 [sfc] efx_net_open+0x5a/0xe0 [sfc] __dev_open+0xe7/0x1a0 __dev_change_flags+0x1d7/0x240 dev_change_flags+0x21/0x60 ...skip... Fixes: d778819609a2 ("sfc: DMA the VF stats only when requested") Reported-by: Ma Yuying <yuma(a)redhat.com> Signed-off-by: Íñigo Huguet <ihuguet(a)redhat.com> Acked-by: Edward Cree <ecree.xilinx(a)gmail.com> Link: https://lore.kernel.org/r/20220713092116.21238-1-ihuguet@redhat.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/net/ethernet/sfc/ef10.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c index 1f971d31ec30..51e22b13146c 100644 --- a/drivers/net/ethernet/sfc/ef10.c +++ b/drivers/net/ethernet/sfc/ef10.c @@ -2059,7 +2059,10 @@ static int efx_ef10_try_update_nic_stats_vf(struct efx_nic *efx) efx_update_sw_stats(efx, stats); out: + /* releasing a DMA coherent buffer with BH disabled can panic */ + spin_unlock_bh(&efx->stats_lock); efx_nic_free_buffer(efx, &stats_buf); + spin_lock_bh(&efx->stats_lock); return rc; } -- 2.25.1

2 1

[PATCH OLK-6.6 v2 00/55] fuse: support large folios
by Baokun Li 12 Mar '25

12 Mar '25

Changes since v1: * Add patch 55 to fix read-write inconsistency issue. Port the fuse large folios support patches to OLK6.6. This code hasn't been system tested and is just for exploration and verification, not for merging into the release. Amir Goldstein (1): fuse: allocate ff->release_args only if release is needed Baokun Li (1): fuse: avoid writing more pages than max_pages Bernd Schubert (1): fuse: Set *nbytesp=0 in fuse_get_user_pages on allocation failure David Howells (1): iov_iter: Provide copy_folio_from_iter() Joanne Koong (32): fuse: convert fuse_writepages_fill() to use a folio for its tmp page fuse: drop unused fuse_mount arg in fuse_writepage_finish() fuse: refactor finished writeback stats updates into helper function fuse: support folios in struct fuse_args_pages and fuse_copy_pages() fuse: add support in virtio for requests using folios fuse: convert cuse to use folios fuse: convert readlink to use folios fuse: convert readdir to use folios fuse: convert reads to use folios fuse: convert writes (non-writeback) to use folios fuse: convert ioctls to use folios fuse: convert retrieves to use folios fuse: revert back to __readahead_folio() for readahead mm/writeback: add folio_mark_dirty_lock() fuse: move initialization of fuse_file to fuse_writepages() instead of in callback fuse: move fuse file initialization to wpa allocation time fuse: refactor out shared logic in fuse_writepages_fill() and fuse_writepage_locked() fuse: convert writebacks to use folios fuse: convert direct io to use folios fuse: remove pages for requests and exclusively use folios fuse: fix direct io folio offset and length calculation fuse: support copying large folios fuse: support large folios for retrieves fuse: refactor fuse_fill_write_pages() fuse: support large folios for writethrough writes fuse: support large folios for folio reads fuse: support large folios for symlinks fuse: support large folios for stores fuse: support large folios for queued writes fuse: support large folios for readahead fuse: optimize direct io large folios processing fuse: enable dynamic configuration of fuse max pages limit (FUSE_MAX_MAX_PAGES) Josef Bacik (10): fuse: use fuse_range_is_writeback() instead of iterating pages fuse: convert readahead to use folios fuse: convert fuse_send_write_pages to use folios fuse: convert fuse_fill_write_pages to use folios fuse: convert fuse_page_mkwrite to use folios fuse: convert fuse_do_readpage to use folios fuse: convert fuse_writepage_need_send to take a folio fuse: convert fuse_retrieve to use folios fuse: convert fuse_notify_store to use folios fuse: use the folio based vmstat helpers Lei Huang (1): fuse: Fix missing FOLL_PIN for direct-io Matthew Wilcox (Oracle) (6): fuse: Remove fuse_writepage fuse: Convert fuse_writepage_locked to take a folio mm: add folio_end_read() fuse: Convert fuse_readpages_end() to use folio_end_read() fuse: Convert fuse_write_end() to use a folio fuse: Convert fuse_write_begin() to use a folio Miklos Szeredi (1): fuse: clear PG_uptodate when using a stolen page Vivek Kasireddy (1): mm/gup: introduce unpin_folio/unpin_folios helpers Documentation/admin-guide/sysctl/fs.rst | 10 + fs/fuse/Makefile | 1 + fs/fuse/cuse.c | 29 +- fs/fuse/dev.c | 163 ++--- fs/fuse/dir.c | 28 +- fs/fuse/file.c | 774 +++++++++++++----------- fs/fuse/fuse_i.h | 51 +- fs/fuse/inode.c | 11 +- fs/fuse/ioctl.c | 33 +- fs/fuse/readdir.c | 18 +- fs/fuse/sysctl.c | 40 ++ fs/fuse/virtio_fs.c | 52 +- include/linux/mm.h | 3 + include/linux/pagemap.h | 1 + include/linux/uio.h | 6 + mm/filemap.c | 22 + mm/folio-compat.c | 6 + mm/gup.c | 47 ++ mm/page-writeback.c | 22 +- mm/util.c | 1 + 20 files changed, 789 insertions(+), 529 deletions(-) create mode 100644 fs/fuse/sysctl.c -- 2.46.1

2 56

[PATCH OLK-5.10] soc: hisilicon: Fix one printing issue and simplify some printing
by Junhao He 12 Mar '25

12 Mar '25

From: Xiaofei Tan <tanxiaofei(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBS9WQ CVE: NA ---------------------------------------------------------------------- It's the opposite of what acls_repair_store printing really means. Fix it and add some printing simplification. Fixes: efb5bc7b199e ("soc: hisilicon: Support memory repair driver on Kunpeng SoC") Signed-off-by: Xiaofei Tan <tanxiaofei(a)huawei.com> Signed-off-by: Qizhi Zhang <zhangqizhi3(a)h-partners.com> --- drivers/soc/hisilicon/hisi_mem_ras.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/soc/hisilicon/hisi_mem_ras.c b/drivers/soc/hisilicon/hisi_mem_ras.c index 765132cf1c04..991b76e3075d 100644 --- a/drivers/soc/hisilicon/hisi_mem_ras.c +++ b/drivers/soc/hisilicon/hisi_mem_ras.c @@ -229,7 +229,7 @@ static struct page *trans_and_check_paddr(struct device *dev, const char *buf, u page = pfn_to_online_page(__phys_to_pfn(paddr_tmp)); if (!page) { - dev_info(dev, "The page of paddr 0x%llx is not online page.\n", paddr_tmp); + dev_info(dev, "The page of paddr 0x%llx not online.\n", paddr_tmp); return NULL; } @@ -283,7 +283,7 @@ static ssize_t acls_repair_store(struct device *dev, struct device_attribute *at return -EINVAL; if (hdev->mem_type == MEMORY_TYPE_HBM && !PageHWPoison(page)) { - dev_info(dev, "The page of paddr 0x%llx is not unpoisoned.\n", paddr); + dev_info(dev, "The page of paddr 0x%llx not poisoned.\n", paddr); return -EIO; } @@ -350,7 +350,7 @@ static ssize_t sppr_repair_store(struct device *dev, struct device_attribute *at return -EINVAL; if (hdev->mem_type == MEMORY_TYPE_HBM && !PageHWPoison(page)) { - dev_info(dev, "The page of paddr 0x%llx is not poisoned.\n", paddr); + dev_info(dev, "The page of paddr 0x%llx not poisoned.\n", paddr); return -EIO; } -- 2.33.0

2 3

[PATCH OLK-5.10] RDMA/hns: Fix mbox timing out by adding retry mechanism
by Junxian Huang 12 Mar '25

12 Mar '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBSLDS CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?h=wip… ---------------------------------------------------------------------- If a QP is modified to error state and a flush CQE process is triggered, the subsequent QP destruction mbox can still be successfully posted but will be blocked in HW until the flush CQE process finishes. This causes further mbox posting timeouts in driver. The blocking time is related to QP depth. Considering an extreme case where SQ depth and RQ depth are both 32K, the blocking time can reach about 135ms. This patch adds a retry mechanism for mbox posting. For each try, FW waits 15ms for HW to complete the previous mbox, otherwise return a timeout error code to driver. Counting other time consumption in FW, set 8 tries for mbox posting and a 5ms time gap before each retry to increase to a sufficient timeout limit. Fixes: 0425e3e6e0c7 ("RDMA/hns: Support flush cqe for hip08 in kernel space") Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Link: https://patch.msgid.link/20250208105930.522796-1-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 64 ++++++++++++++++------ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 2 + 2 files changed, 50 insertions(+), 16 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index 88a10930447b..3813b318f1c3 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -1395,10 +1395,8 @@ static u32 hns_roce_cmdq_tx_timeout(u16 opcode, u32 tx_timeout) return tx_timeout; } -static void hns_roce_wait_csq_done(struct hns_roce_dev *hr_dev, u16 opcode) +static void hns_roce_wait_csq_done(struct hns_roce_dev *hr_dev, u32 tx_timeout) { - struct hns_roce_v2_priv *priv = hr_dev->priv; - u32 tx_timeout = hns_roce_cmdq_tx_timeout(opcode, priv->cmq.tx_timeout); u32 timeout = 0; do { @@ -1408,8 +1406,9 @@ static void hns_roce_wait_csq_done(struct hns_roce_dev *hr_dev, u16 opcode) } while (++timeout < tx_timeout); } -static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, - struct hns_roce_cmq_desc *desc, int num) +static int __hns_roce_cmq_send_one(struct hns_roce_dev *hr_dev, + struct hns_roce_cmq_desc *desc, + int num, u32 tx_timeout) { struct hns_roce_v2_priv *priv = hr_dev->priv; struct hns_roce_v2_cmq_ring *csq = &priv->cmq.csq; @@ -1418,8 +1417,6 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, int ret; int i; - spin_lock_bh(&csq->lock); - tail = csq->head; for (i = 0; i < num; i++) { @@ -1433,22 +1430,17 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, atomic64_inc(&hr_dev->dfx_cnt[HNS_ROCE_DFX_CMDS_CNT]); - hns_roce_wait_csq_done(hr_dev, le16_to_cpu(desc->opcode)); + hns_roce_wait_csq_done(hr_dev, tx_timeout); if (hns_roce_cmq_csq_done(hr_dev)) { ret = 0; for (i = 0; i < num; i++) { /* check the result of hardware write back */ - desc[i] = csq->desc[tail++]; + desc_ret = le16_to_cpu(csq->desc[tail++].retval); if (tail == csq->desc_num) tail = 0; - - desc_ret = le16_to_cpu(desc[i].retval); if (likely(desc_ret == CMD_EXEC_SUCCESS)) continue; - dev_err_ratelimited(hr_dev->dev, - "Cmdq IO error, opcode = 0x%x, return = 0x%x.\n", - desc->opcode, desc_ret); ret = hns_roce_cmd_err_convert_errno(desc_ret); } } else { @@ -1463,14 +1455,54 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, ret = -EAGAIN; } - spin_unlock_bh(&csq->lock); - if (ret) atomic64_inc(&hr_dev->dfx_cnt[HNS_ROCE_DFX_CMDS_ERR_CNT]); return ret; } +static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, + struct hns_roce_cmq_desc *desc, int num) +{ + struct hns_roce_v2_priv *priv = hr_dev->priv; + struct hns_roce_v2_cmq_ring *csq = &priv->cmq.csq; + u16 opcode = le16_to_cpu(desc->opcode); + u32 tx_timeout = hns_roce_cmdq_tx_timeout(opcode, priv->cmq.tx_timeout); + u8 try_cnt = HNS_ROCE_OPC_POST_MB_TRY_CNT; + u32 rsv_tail; + int ret; + int i; + + while (try_cnt) { + try_cnt--; + + spin_lock_bh(&csq->lock); + rsv_tail = csq->head; + ret = __hns_roce_cmq_send_one(hr_dev, desc, num, tx_timeout); + if (opcode == HNS_ROCE_OPC_POST_MB && ret == -ETIME && + try_cnt) { + spin_unlock_bh(&csq->lock); + mdelay(HNS_ROCE_OPC_POST_MB_RETRY_GAP_MSEC); + continue; + } + + for (i = 0; i < num; i++) { + desc[i] = csq->desc[rsv_tail++]; + if (rsv_tail == csq->desc_num) + rsv_tail = 0; + } + spin_unlock_bh(&csq->lock); + break; + } + + if (ret) + dev_err_ratelimited(hr_dev->dev, + "Cmdq IO error, opcode = 0x%x, return = %d.\n", + opcode, ret); + + return ret; +} + static int hns_roce_cmq_send(struct hns_roce_dev *hr_dev, struct hns_roce_cmq_desc *desc, int num) { diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h index c59e40649454..dbc405885ea7 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -243,6 +243,8 @@ enum hns_roce_opcode_type { }; #define HNS_ROCE_OPC_POST_MB_TIMEOUT 35000 +#define HNS_ROCE_OPC_POST_MB_TRY_CNT 8 +#define HNS_ROCE_OPC_POST_MB_RETRY_GAP_MSEC 5 struct hns_roce_cmdq_tx_timeout_map { u16 opcode; u32 tx_timeout; -- 2.33.0

2 1

[PATCH OLK-6.6] perf: Configure BRBE correctly on VHE host
by Yushan Wang 12 Mar '25

12 Mar '25

From: Yicong Yang <yangyicong(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBSI0M CVE: NA ---------------------------------------------------------------------- The BRBE support backported of v18 didn't configure the BRBCR_EL1 correctly which will miss some key functions like FZP during sampling. In VHE mode with MDCR_EL2.HPMN set to PMCR_EL0.N, the counters are controlled by BRBCR_EL1 rather than BRBCR_EL2 (which writes to BRBCR_EL1 are redirected to). Use the same value for both register except keep EL1 and EL0 recording disabled in guests. The fix is backported from the v19 version [1]. [1] https://lore.kernel.org/linux-arm-kernel/ 20250202-arm-brbe-v19-v19-0-1c1300802385(a)kernel.org/ T/#m887b1dcf7f6784b7293626952052f27b68784beb fixes: 6c6848e7e00c ("drivers: perf: arm_pmuv3: Enable branch stack sampling via FEAT_BRBE") Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Qizhi Zhang <zhangqizhi3(a)h-partners.com> --- drivers/perf/arm_brbe.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/perf/arm_brbe.c b/drivers/perf/arm_brbe.c index d795e8fd646f..22e4828feec8 100644 --- a/drivers/perf/arm_brbe.c +++ b/drivers/perf/arm_brbe.c @@ -874,6 +874,16 @@ void armv8pmu_branch_enable(struct arm_pmu *arm_pmu) brbcr &= ~BRBCR_ELx_CONFIG_MASK; brbcr |= branch_type_to_brbcr(cpuc->branch_sample_type); write_sysreg_s(brbcr, SYS_BRBCR_EL1); + + /* + * In VHE mode with MDCR_EL2.HPMN set to PMCR_EL0.N, the counters are + * controlled by BRBCR_EL1 rather than BRBCR_EL2 (which writes to + * BRBCR_EL1 are redirected to). Use the same value for both register + * except keep EL1 and EL0 recording disabled in guests. + */ + if (is_kernel_in_hyp_mode()) + write_sysreg_s(brbcr & ~(BRBCR_ELx_ExBRE | BRBCR_ELx_E0BRE), SYS_BRBCR_EL12); + isb(); } @@ -886,6 +896,11 @@ void armv8pmu_branch_disable(void) brbcr &= ~(BRBCR_ELx_E0BRE | BRBCR_ELx_ExBRE); brbfcr |= BRBFCR_EL1_PAUSED; write_sysreg_s(brbcr, SYS_BRBCR_EL1); + + /* See the comment in armv8pmu_branch_enable() */ + if (is_kernel_in_hyp_mode()) + write_sysreg_s(brbcr, SYS_BRBCR_EL12); + write_sysreg_s(brbfcr, SYS_BRBFCR_EL1); isb(); } -- 2.33.0

2 1

[openeuler:OLK-6.6] BUILD REGRESSION 2f1a9354fdf9708fa38bd6916f84034bc1510c16
by kernel test robot 12 Mar '25

12 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 2f1a9354fdf9708fa38bd6916f84034bc1510c16 !15423 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.69-6.6.70 LTS Additional Patches Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-alldefconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allmodconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allnoconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-051-20250312 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-052-20250312 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-053-20250312 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-054-20250312 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-055-20250312 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- loongarch-allmodconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allnoconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allyesconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-002-20250311 | `-- include-linux-mmzone.h:error:error-Allocator-MAX_ORDER-exceeds-SECTION_SIZE |-- x86_64-allnoconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250311 | |-- drivers-cpufreq-acpi-cpufreq.c:warning:sched_set_itmt-defined-but-not-used | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250311 | |-- ld.lld:error:undefined-symbol:arch_kexec_protect_crashkres | |-- ld.lld:error:undefined-symbol:machine_crash_shutdown | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250311 | |-- drivers-cpufreq-acpi-cpufreq.c:warning:sched_set_itmt-defined-but-not-used | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-randconfig-161-20250312 |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() |-- mm-compaction.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:vm_compaction-proc_handler |-- mm-compaction.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:vm_compaction-procname |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 823m configs tested: 20 configs skipped: 123 tested configs: arm64 alldefconfig gcc-14.2.0 arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250311 gcc-14.2.0 arm64 randconfig-002-20250311 gcc-14.2.0 arm64 randconfig-003-20250311 gcc-14.2.0 arm64 randconfig-004-20250311 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250311 gcc-14.2.0 loongarch randconfig-002-20250311 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250311 gcc-12 x86_64 buildonly-randconfig-002-20250311 gcc-12 x86_64 buildonly-randconfig-003-20250311 clang-19 x86_64 buildonly-randconfig-004-20250311 clang-19 x86_64 buildonly-randconfig-005-20250311 gcc-12 x86_64 buildonly-randconfig-006-20250311 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/4] some readahead improvement
by Tong Tiangen 11 Mar '25

11 Mar '25

Jan Kara (3): readahead: make sure sync readahead reads needed page readahead: don't shorten readahead window in read_pages() readahead: properly shorten readahead when falling back to do_page_cache_ra() Yafang Shao (1): mm/readahead: fix large folio support in async readahead mm/readahead.c | 35 ++++++++++++++++++----------------- 1 file changed, 18 insertions(+), 17 deletions(-) -- 2.25.1

2 5

[PATCH openEuler-1.0-LTS] hrtimers: Handle CPU state correctly on hotplug
by Zeng Heng 11 Mar '25

11 Mar '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v6.6.74 commit a5cbbea145b400e40540c34816d16d36e0374fbc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBLWTN CVE: CVE-2024-57951 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2f8dea1692eef2b7ba6a256246ed82c365fdc686 upstream. Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to CPUHP_ONLINE: Since hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set to 1 throughout. However, during a CPU unplug operation, the tick and the clockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online state, for instance CFS incorrectly assumes that the hrtick is already active, and the chance of the clockevent device to transition to oneshot mode is also lost forever for the CPU, unless it goes back to a lower state than CPUHP_HRTIMERS_PREPARE once. This round-trip reveals another issue; cpu_base.online is not set to 1 after the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer(). Aside of that, the bulk of the per CPU state is not reset either, which means there are dangling pointers in the worst case. Address this by adding a corresponding startup() callback, which resets the stale per CPU state and sets the online flag. [ tglx: Make the new callback unconditionally available, remove the online modification in the prepare() callback and clear the remaining state in the starting callback instead of the prepare callback ] Fixes: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier") Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20241220134421.3809834-1-koichiro.den@canonical… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: include/linux/hrtimer.h kernel/cpu.c kernel/time/hrtimer.c [Fix context conflict.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 9 +++++++++ 2 files changed, 10 insertions(+) diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h index 542b4fa2cda9..27f504fc36d2 100644 --- a/include/linux/hrtimer.h +++ b/include/linux/hrtimer.h @@ -507,6 +507,7 @@ extern void __init hrtimers_init(void); extern void sysrq_timer_list_show(void); int hrtimers_prepare_cpu(unsigned int cpu); +int hrtimers_cpu_starting(unsigned int cpu); #ifdef CONFIG_HOTPLUG_CPU int hrtimers_dead_cpu(unsigned int cpu); #else diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c index ce8fe5adafb0..c7817f3e814e 100644 --- a/kernel/time/hrtimer.c +++ b/kernel/time/hrtimer.c @@ -1882,6 +1882,14 @@ int hrtimers_prepare_cpu(unsigned int cpu) } cpu_base->cpu = cpu; + return 0; +} + +int hrtimers_cpu_starting(unsigned int cpu) +{ + struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases); + + /* Clear out any left over state from a CPU down operation */ cpu_base->active_bases = 0; cpu_base->hres_active = 0; cpu_base->hang_detected = 0; @@ -1974,6 +1982,7 @@ int hrtimers_dead_cpu(unsigned int scpu) void __init hrtimers_init(void) { hrtimers_prepare_cpu(smp_processor_id()); + hrtimers_cpu_starting(smp_processor_id()); open_softirq(HRTIMER_SOFTIRQ, hrtimer_run_softirq); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] hrtimers: Handle CPU state correctly on hotplug
by Zeng Heng 11 Mar '25

11 Mar '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v6.6.74 commit a5cbbea145b400e40540c34816d16d36e0374fbc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBLWTN CVE: CVE-2024-57951 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2f8dea1692eef2b7ba6a256246ed82c365fdc686 upstream. Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to CPUHP_ONLINE: Since hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set to 1 throughout. However, during a CPU unplug operation, the tick and the clockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online state, for instance CFS incorrectly assumes that the hrtick is already active, and the chance of the clockevent device to transition to oneshot mode is also lost forever for the CPU, unless it goes back to a lower state than CPUHP_HRTIMERS_PREPARE once. This round-trip reveals another issue; cpu_base.online is not set to 1 after the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer(). Aside of that, the bulk of the per CPU state is not reset either, which means there are dangling pointers in the worst case. Address this by adding a corresponding startup() callback, which resets the stale per CPU state and sets the online flag. [ tglx: Make the new callback unconditionally available, remove the online modification in the prepare() callback and clear the remaining state in the starting callback instead of the prepare callback ] Fixes: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier") Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20241220134421.3809834-1-koichiro.den@canonical… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: include/linux/hrtimer.h kernel/cpu.c kernel/time/hrtimer.c [Fix context conflict.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 10 ++++++++++ 2 files changed, 11 insertions(+) diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h index 542b4fa2cda9..27f504fc36d2 100644 --- a/include/linux/hrtimer.h +++ b/include/linux/hrtimer.h @@ -507,6 +507,7 @@ extern void __init hrtimers_init(void); extern void sysrq_timer_list_show(void); int hrtimers_prepare_cpu(unsigned int cpu); +int hrtimers_cpu_starting(unsigned int cpu); #ifdef CONFIG_HOTPLUG_CPU int hrtimers_dead_cpu(unsigned int cpu); #else diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c index ce8fe5adafb0..300eb4039f26 100644 --- a/kernel/time/hrtimer.c +++ b/kernel/time/hrtimer.c @@ -1882,6 +1882,15 @@ int hrtimers_prepare_cpu(unsigned int cpu) } cpu_base->cpu = cpu; + hrtimer_cpu_base_init_expiry_lock(cpu_base); + return 0; +} + +int hrtimers_cpu_starting(unsigned int cpu) +{ + struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases); + + /* Clear out any left over state from a CPU down operation */ cpu_base->active_bases = 0; cpu_base->hres_active = 0; cpu_base->hang_detected = 0; @@ -1974,6 +1983,7 @@ int hrtimers_dead_cpu(unsigned int scpu) void __init hrtimers_init(void) { hrtimers_prepare_cpu(smp_processor_id()); + hrtimers_cpu_starting(smp_processor_id()); open_softirq(HRTIMER_SOFTIRQ, hrtimer_run_softirq); } -- 2.25.1

2 1

[PATCH] RDMA/hns: Fix mbox timing out by adding retry mechanism
by Junxian Huang 11 Mar '25

11 Mar '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBSLDS CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?h=wip… ---------------------------------------------------------------------- If a QP is modified to error state and a flush CQE process is triggered, the subsequent QP destruction mbox can still be successfully posted but will be blocked in HW until the flush CQE process finishes. This causes further mbox posting timeouts in driver. The blocking time is related to QP depth. Considering an extreme case where SQ depth and RQ depth are both 32K, the blocking time can reach about 135ms. This patch adds a retry mechanism for mbox posting. For each try, FW waits 15ms for HW to complete the previous mbox, otherwise return a timeout error code to driver. Counting other time consumption in FW, set 8 tries for mbox posting and a 5ms time gap before each retry to increase to a sufficient timeout limit. Fixes: 0425e3e6e0c7 ("RDMA/hns: Support flush cqe for hip08 in kernel space") Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Link: https://patch.msgid.link/20250208105930.522796-1-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 64 ++++++++++++++++------ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 2 + 2 files changed, 50 insertions(+), 16 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index 88a10930447b..3813b318f1c3 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -1395,10 +1395,8 @@ static u32 hns_roce_cmdq_tx_timeout(u16 opcode, u32 tx_timeout) return tx_timeout; } -static void hns_roce_wait_csq_done(struct hns_roce_dev *hr_dev, u16 opcode) +static void hns_roce_wait_csq_done(struct hns_roce_dev *hr_dev, u32 tx_timeout) { - struct hns_roce_v2_priv *priv = hr_dev->priv; - u32 tx_timeout = hns_roce_cmdq_tx_timeout(opcode, priv->cmq.tx_timeout); u32 timeout = 0; do { @@ -1408,8 +1406,9 @@ static void hns_roce_wait_csq_done(struct hns_roce_dev *hr_dev, u16 opcode) } while (++timeout < tx_timeout); } -static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, - struct hns_roce_cmq_desc *desc, int num) +static int __hns_roce_cmq_send_one(struct hns_roce_dev *hr_dev, + struct hns_roce_cmq_desc *desc, + int num, u32 tx_timeout) { struct hns_roce_v2_priv *priv = hr_dev->priv; struct hns_roce_v2_cmq_ring *csq = &priv->cmq.csq; @@ -1418,8 +1417,6 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, int ret; int i; - spin_lock_bh(&csq->lock); - tail = csq->head; for (i = 0; i < num; i++) { @@ -1433,22 +1430,17 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, atomic64_inc(&hr_dev->dfx_cnt[HNS_ROCE_DFX_CMDS_CNT]); - hns_roce_wait_csq_done(hr_dev, le16_to_cpu(desc->opcode)); + hns_roce_wait_csq_done(hr_dev, tx_timeout); if (hns_roce_cmq_csq_done(hr_dev)) { ret = 0; for (i = 0; i < num; i++) { /* check the result of hardware write back */ - desc[i] = csq->desc[tail++]; + desc_ret = le16_to_cpu(csq->desc[tail++].retval); if (tail == csq->desc_num) tail = 0; - - desc_ret = le16_to_cpu(desc[i].retval); if (likely(desc_ret == CMD_EXEC_SUCCESS)) continue; - dev_err_ratelimited(hr_dev->dev, - "Cmdq IO error, opcode = 0x%x, return = 0x%x.\n", - desc->opcode, desc_ret); ret = hns_roce_cmd_err_convert_errno(desc_ret); } } else { @@ -1463,14 +1455,54 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, ret = -EAGAIN; } - spin_unlock_bh(&csq->lock); - if (ret) atomic64_inc(&hr_dev->dfx_cnt[HNS_ROCE_DFX_CMDS_ERR_CNT]); return ret; } +static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, + struct hns_roce_cmq_desc *desc, int num) +{ + struct hns_roce_v2_priv *priv = hr_dev->priv; + struct hns_roce_v2_cmq_ring *csq = &priv->cmq.csq; + u16 opcode = le16_to_cpu(desc->opcode); + u32 tx_timeout = hns_roce_cmdq_tx_timeout(opcode, priv->cmq.tx_timeout); + u8 try_cnt = HNS_ROCE_OPC_POST_MB_TRY_CNT; + u32 rsv_tail; + int ret; + int i; + + while (try_cnt) { + try_cnt--; + + spin_lock_bh(&csq->lock); + rsv_tail = csq->head; + ret = __hns_roce_cmq_send_one(hr_dev, desc, num, tx_timeout); + if (opcode == HNS_ROCE_OPC_POST_MB && ret == -ETIME && + try_cnt) { + spin_unlock_bh(&csq->lock); + mdelay(HNS_ROCE_OPC_POST_MB_RETRY_GAP_MSEC); + continue; + } + + for (i = 0; i < num; i++) { + desc[i] = csq->desc[rsv_tail++]; + if (rsv_tail == csq->desc_num) + rsv_tail = 0; + } + spin_unlock_bh(&csq->lock); + break; + } + + if (ret) + dev_err_ratelimited(hr_dev->dev, + "Cmdq IO error, opcode = 0x%x, return = %d.\n", + opcode, ret); + + return ret; +} + static int hns_roce_cmq_send(struct hns_roce_dev *hr_dev, struct hns_roce_cmq_desc *desc, int num) { diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h index c59e40649454..dbc405885ea7 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -243,6 +243,8 @@ enum hns_roce_opcode_type { }; #define HNS_ROCE_OPC_POST_MB_TIMEOUT 35000 +#define HNS_ROCE_OPC_POST_MB_TRY_CNT 8 +#define HNS_ROCE_OPC_POST_MB_RETRY_GAP_MSEC 5 struct hns_roce_cmdq_tx_timeout_map { u16 opcode; u32 tx_timeout; -- 2.33.0

1 0

[PATCH OLK-6.6] vrf: use RCU protection in l3mdev_l3_out()
by Liu Jian 11 Mar '25

11 Mar '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.79 commit c40cb5c03e37552d6eff963187109e2c3f78ef6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPCA6 CVE: CVE-2025-21791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 6d0ce46a93135d96b7fa075a94a88fe0da8e8773 ] l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip_out() Add rcu_read_lock() / rcu_read_unlock() pair to avoid a potential UAF. Fixes: a8e3e1a9f020 ("net: l3mdev: Add hook to output path") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-7-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/l3mdev.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/net/l3mdev.h b/include/net/l3mdev.h index ba8dc2523c59..eb5ef1b2e059 100644 --- a/include/net/l3mdev.h +++ b/include/net/l3mdev.h @@ -204,10 +204,12 @@ struct sk_buff *l3mdev_l3_out(struct sock *sk, struct sk_buff *skb, u16 proto) if (netif_is_l3_slave(dev)) { struct net_device *master; + rcu_read_lock(); master = netdev_master_upper_dev_get_rcu(dev); if (master && master->l3mdev_ops->l3mdev_l3_out) skb = master->l3mdev_ops->l3mdev_l3_out(master, sk, skb, proto); + rcu_read_unlock(); } return skb; -- 2.34.1

2 1

[PATCH OLK-5.10] vrf: use RCU protection in l3mdev_l3_out()
by Liu Jian 11 Mar '25

11 Mar '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 6d0ce46a93135d96b7fa075a94a88fe0da8e8773 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPCA6 CVE: CVE-2025-21791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip_out() Add rcu_read_lock() / rcu_read_unlock() pair to avoid a potential UAF. Fixes: a8e3e1a9f020 ("net: l3mdev: Add hook to output path") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-7-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/l3mdev.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/net/l3mdev.h b/include/net/l3mdev.h index ba8dc2523c59..eb5ef1b2e059 100644 --- a/include/net/l3mdev.h +++ b/include/net/l3mdev.h @@ -204,10 +204,12 @@ struct sk_buff *l3mdev_l3_out(struct sock *sk, struct sk_buff *skb, u16 proto) if (netif_is_l3_slave(dev)) { struct net_device *master; + rcu_read_lock(); master = netdev_master_upper_dev_get_rcu(dev); if (master && master->l3mdev_ops->l3mdev_l3_out) skb = master->l3mdev_ops->l3mdev_l3_out(master, sk, skb, proto); + rcu_read_unlock(); } return skb; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] vrf: use RCU protection in l3mdev_l3_out()
by Liu Jian 11 Mar '25

11 Mar '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 6d0ce46a93135d96b7fa075a94a88fe0da8e8773 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPCA6 CVE: CVE-2025-21791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip_out() Add rcu_read_lock() / rcu_read_unlock() pair to avoid a potential UAF. Fixes: a8e3e1a9f020 ("net: l3mdev: Add hook to output path") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-7-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/l3mdev.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/net/l3mdev.h b/include/net/l3mdev.h index a421e2fa06e3..3300f1440158 100644 --- a/include/net/l3mdev.h +++ b/include/net/l3mdev.h @@ -181,10 +181,12 @@ struct sk_buff *l3mdev_l3_out(struct sock *sk, struct sk_buff *skb, u16 proto) if (netif_is_l3_slave(dev)) { struct net_device *master; + rcu_read_lock(); master = netdev_master_upper_dev_get_rcu(dev); if (master && master->l3mdev_ops->l3mdev_l3_out) skb = master->l3mdev_ops->l3mdev_l3_out(master, sk, skb, proto); + rcu_read_unlock(); } return skb; -- 2.34.1

2 1

[PATCH OLK-5.10 0/8] Some bug fix patches for RDMA/hns to olk-5.10
by Junxian Huang 11 Mar '25

11 Mar '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some bug fix patches for RDMA/hns to olk-5.10: Junxian Huang (7): RDMA/hns: Fix DCA error path in alloc_wqe_buf() RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() RDMA/hns: Fix invalid sq params not being blocked RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() RDMA/hns: Fix missing xa_destroy() RDMA/hns: Fix wrong value of max_sge_rd RDMA/hns: Fix udca not unregistered when reset entry allocation failed Xinghai Cen (1): RDMA/hns: Fix default congestion control algorithm not set for kernel QP drivers/infiniband/hw/hns/hns_roce_alloc.c | 4 +++- drivers/infiniband/hw/hns/hns_roce_cq.c | 1 + drivers/infiniband/hw/hns/hns_roce_main.c | 12 +++++------ drivers/infiniband/hw/hns/hns_roce_qp.c | 23 +++++++++++++--------- 4 files changed, 24 insertions(+), 16 deletions(-) -- 2.33.0

2 9

[PATCH openEuler-1.0-LTS] i40e: Fix call trace in setup_tx_descriptors
by Chen Ridong 11 Mar '25

11 Mar '25

From: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> stable inclusion from stable-v4.19.24 commit 15950157e2c24865b696db1c9ccc72743ae0e967 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP4HT CVE: CVE-2022-49725 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit fd5855e6b1358e816710afee68a1d2bc685176ca ] After PF reset and ethtool -t there was call trace in dmesg sometimes leading to panic. When there was some time, around 5 seconds, between reset and test there were no errors. Problem was that pf reset calls i40e_vsi_close in prep_for_reset and ethtool -t calls i40e_vsi_close in diag_test. If there was not enough time between those commands the second i40e_vsi_close starts before previous i40e_vsi_close was done which leads to crash. Add check to diag_test if pf is in reset and don't start offline tests if it is true. Add netif_info("testing failed") into unhappy path of i40e_diag_test() Fixes: e17bc411aea8 ("i40e: Disable offline diagnostics if VFs are enabled") Fixes: 510efb2682b3 ("i40e: Fix ethtool offline diagnostic with netqueues") Signed-off-by: Michal Jaron <michalx.jaron(a)intel.com> Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Tested-by: Gurucharan <gurucharanx.g(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> --- .../net/ethernet/intel/i40e/i40e_ethtool.c | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c index a6b0f605a7d8..50f56a51bbc7 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c @@ -2195,15 +2195,16 @@ static void i40e_diag_test(struct net_device *netdev, set_bit(__I40E_TESTING, pf->state); + if (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state) || + test_bit(__I40E_RESET_INTR_RECEIVED, pf->state)) { + dev_warn(&pf->pdev->dev, + "Cannot start offline testing when PF is in reset state.\n"); + goto skip_ol_tests; + } + if (i40e_active_vfs(pf) || i40e_active_vmdqs(pf)) { dev_warn(&pf->pdev->dev, "Please take active VFs and Netqueues offline and restart the adapter before running NIC diagnostics\n"); - data[I40E_ETH_TEST_REG] = 1; - data[I40E_ETH_TEST_EEPROM] = 1; - data[I40E_ETH_TEST_INTR] = 1; - data[I40E_ETH_TEST_LINK] = 1; - eth_test->flags |= ETH_TEST_FL_FAILED; - clear_bit(__I40E_TESTING, pf->state); goto skip_ol_tests; } @@ -2250,9 +2251,17 @@ static void i40e_diag_test(struct net_device *netdev, data[I40E_ETH_TEST_INTR] = 0; } -skip_ol_tests: - netif_info(pf, drv, netdev, "testing finished\n"); + return; + +skip_ol_tests: + data[I40E_ETH_TEST_REG] = 1; + data[I40E_ETH_TEST_EEPROM] = 1; + data[I40E_ETH_TEST_INTR] = 1; + data[I40E_ETH_TEST_LINK] = 1; + eth_test->flags |= ETH_TEST_FL_FAILED; + clear_bit(__I40E_TESTING, pf->state); + netif_info(pf, drv, netdev, "testing failed\n"); } static void i40e_get_wol(struct net_device *netdev, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred
by Chen Ridong 11 Mar '25

11 Mar '25

From: Xiaohui Zhang <xiaohuizhang(a)ruc.edu.cn> stable inclusion from stable-v4.19.249 commit 3e7c7df6991ac349f2fa8540047757df666e610f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6U3 CVE: CVE-2022-49729 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8a4d480702b71184fabcf379b80bf7539716752e ] Similar to the handling of play_deferred in commit 19cfe912c37b ("Bluetooth: btusb: Fix memory leak in play_deferred"), we thought a patch might be needed here as well. Currently usb_submit_urb is called directly to submit deferred tx urbs after unanchor them. So the usb_giveback_urb_bh would failed to unref it in usb_unanchor_urb and cause memory leak. Put those urbs in tx_anchor to avoid the leak, and also fix the error handling. Signed-off-by: Xiaohui Zhang <xiaohuizhang(a)ruc.edu.cn> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://lore.kernel.org/r/20220607083230.6182-1-xiaohuizhang@ruc.edu.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- drivers/nfc/nfcmrvl/usb.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/nfc/nfcmrvl/usb.c b/drivers/nfc/nfcmrvl/usb.c index 888e298f610b..f26986eb53f1 100644 --- a/drivers/nfc/nfcmrvl/usb.c +++ b/drivers/nfc/nfcmrvl/usb.c @@ -401,13 +401,25 @@ static void nfcmrvl_play_deferred(struct nfcmrvl_usb_drv_data *drv_data) int err; while ((urb = usb_get_from_anchor(&drv_data->deferred))) { + usb_anchor_urb(urb, &drv_data->tx_anchor); + err = usb_submit_urb(urb, GFP_ATOMIC); - if (err) + if (err) { + kfree(urb->setup_packet); + usb_unanchor_urb(urb); + usb_free_urb(urb); break; + } drv_data->tx_in_flight++; + usb_free_urb(urb); + } + + /* Cleanup the rest deferred urbs. */ + while ((urb = usb_get_from_anchor(&drv_data->deferred))) { + kfree(urb->setup_packet); + usb_free_urb(urb); } - usb_scuttle_anchored_urbs(&drv_data->deferred); } static int nfcmrvl_resume(struct usb_interface *intf) -- 2.34.1

2 1

[PATCH OLK-6.6 00/54] fuse: support large folios
by Baokun Li 11 Mar '25

11 Mar '25

Port the fuse large folios support patches to OLK6.6. This code hasn't been system tested and is just for exploration and verification, not for merging into the release. Amir Goldstein (1): fuse: allocate ff->release_args only if release is needed Bernd Schubert (1): fuse: Set *nbytesp=0 in fuse_get_user_pages on allocation failure David Howells (1): iov_iter: Provide copy_folio_from_iter() Joanne Koong (32): fuse: convert fuse_writepages_fill() to use a folio for its tmp page fuse: drop unused fuse_mount arg in fuse_writepage_finish() fuse: refactor finished writeback stats updates into helper function fuse: support folios in struct fuse_args_pages and fuse_copy_pages() fuse: add support in virtio for requests using folios fuse: convert cuse to use folios fuse: convert readlink to use folios fuse: convert readdir to use folios fuse: convert reads to use folios fuse: convert writes (non-writeback) to use folios fuse: convert ioctls to use folios fuse: convert retrieves to use folios fuse: revert back to __readahead_folio() for readahead mm/writeback: add folio_mark_dirty_lock() fuse: move initialization of fuse_file to fuse_writepages() instead of in callback fuse: move fuse file initialization to wpa allocation time fuse: refactor out shared logic in fuse_writepages_fill() and fuse_writepage_locked() fuse: convert writebacks to use folios fuse: convert direct io to use folios fuse: remove pages for requests and exclusively use folios fuse: fix direct io folio offset and length calculation fuse: support copying large folios fuse: support large folios for retrieves fuse: refactor fuse_fill_write_pages() fuse: support large folios for writethrough writes fuse: support large folios for folio reads fuse: support large folios for symlinks fuse: support large folios for stores fuse: support large folios for queued writes fuse: support large folios for readahead fuse: optimize direct io large folios processing fuse: enable dynamic configuration of fuse max pages limit (FUSE_MAX_MAX_PAGES) Josef Bacik (10): fuse: use fuse_range_is_writeback() instead of iterating pages fuse: convert readahead to use folios fuse: convert fuse_send_write_pages to use folios fuse: convert fuse_fill_write_pages to use folios fuse: convert fuse_page_mkwrite to use folios fuse: convert fuse_do_readpage to use folios fuse: convert fuse_writepage_need_send to take a folio fuse: convert fuse_retrieve to use folios fuse: convert fuse_notify_store to use folios fuse: use the folio based vmstat helpers Lei Huang (1): fuse: Fix missing FOLL_PIN for direct-io Matthew Wilcox (Oracle) (6): fuse: Remove fuse_writepage fuse: Convert fuse_writepage_locked to take a folio mm: add folio_end_read() fuse: Convert fuse_readpages_end() to use folio_end_read() fuse: Convert fuse_write_end() to use a folio fuse: Convert fuse_write_begin() to use a folio Miklos Szeredi (1): fuse: clear PG_uptodate when using a stolen page Vivek Kasireddy (1): mm/gup: introduce unpin_folio/unpin_folios helpers Documentation/admin-guide/sysctl/fs.rst | 10 + fs/fuse/Makefile | 1 + fs/fuse/cuse.c | 29 +- fs/fuse/dev.c | 163 ++--- fs/fuse/dir.c | 28 +- fs/fuse/file.c | 770 +++++++++++++----------- fs/fuse/fuse_i.h | 51 +- fs/fuse/inode.c | 11 +- fs/fuse/ioctl.c | 33 +- fs/fuse/readdir.c | 18 +- fs/fuse/sysctl.c | 40 ++ fs/fuse/virtio_fs.c | 52 +- include/linux/mm.h | 3 + include/linux/pagemap.h | 1 + include/linux/uio.h | 6 + mm/filemap.c | 22 + mm/folio-compat.c | 6 + mm/gup.c | 47 ++ mm/page-writeback.c | 22 +- mm/util.c | 1 + 20 files changed, 785 insertions(+), 529 deletions(-) create mode 100644 fs/fuse/sysctl.c -- 2.46.1

2 55

[PATCH openEuler-1.0-LTS] scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
by Cai Xinchen 11 Mar '25

11 Mar '25

From: Saurav Kashyap <skashyap(a)marvell.com> stable inclusion from stable-v4.19.238 commit f68776f28d9134fa65056e7e63bfc734049730b7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3I7 CVE: CVE-2022-49155 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a60447e7d451df42c7bde43af53b34f10f34f469 upstream. [ 12.323788] BUG: using smp_processor_id() in preemptible [00000000] code: systemd-udevd/1020 [ 12.332297] caller is qla2xxx_create_qpair+0x32a/0x5d0 [qla2xxx] [ 12.338417] CPU: 7 PID: 1020 Comm: systemd-udevd Tainted: G I --------- --- 5.14.0-29.el9.x86_64 #1 [ 12.348827] Hardware name: Dell Inc. PowerEdge R610/0F0XJ6, BIOS 6.6.0 05/22/2018 [ 12.356356] Call Trace: [ 12.358821] dump_stack_lvl+0x34/0x44 [ 12.362514] check_preemption_disabled+0xd9/0xe0 [ 12.367164] qla2xxx_create_qpair+0x32a/0x5d0 [qla2xxx] [ 12.372481] qla2x00_probe_one+0xa3a/0x1b80 [qla2xxx] [ 12.377617] ? _raw_spin_lock_irqsave+0x19/0x40 [ 12.384284] local_pci_probe+0x42/0x80 [ 12.390162] ? pci_match_device+0xd7/0x110 [ 12.396366] pci_device_probe+0xfd/0x1b0 [ 12.402372] really_probe+0x1e7/0x3e0 [ 12.408114] __driver_probe_device+0xfe/0x180 [ 12.414544] driver_probe_device+0x1e/0x90 [ 12.420685] __driver_attach+0xc0/0x1c0 [ 12.426536] ? __device_attach_driver+0xe0/0xe0 [ 12.433061] ? __device_attach_driver+0xe0/0xe0 [ 12.439538] bus_for_each_dev+0x78/0xc0 [ 12.445294] bus_add_driver+0x12b/0x1e0 [ 12.451021] driver_register+0x8f/0xe0 [ 12.456631] ? 0xffffffffc07bc000 [ 12.461773] qla2x00_module_init+0x1be/0x229 [qla2xxx] [ 12.468776] do_one_initcall+0x44/0x200 [ 12.474401] ? load_module+0xad3/0xba0 [ 12.479908] ? kmem_cache_alloc_trace+0x45/0x410 [ 12.486268] do_init_module+0x5c/0x280 [ 12.491730] __do_sys_init_module+0x12e/0x1b0 [ 12.497785] do_syscall_64+0x3b/0x90 [ 12.503029] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 12.509764] RIP: 0033:0x7f554f73ab2e Link: https://lore.kernel.org/r/20220110050218.3958-15-njavali@marvell.com Cc: stable(a)vger.kernel.org Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Saurav Kashyap <skashyap(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/scsi/qla2xxx/qla_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c index 753338d5343b..0d564f6da230 100644 --- a/drivers/scsi/qla2xxx/qla_init.c +++ b/drivers/scsi/qla2xxx/qla_init.c @@ -8661,7 +8661,7 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos, qpair->rsp->req = qpair->req; qpair->rsp->qpair = qpair; /* init qpair to this cpu. Will adjust at run time. */ - qla_cpu_update(qpair, smp_processor_id()); + qla_cpu_update(qpair, raw_smp_processor_id()); if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif) { if (ha->fw_attributes & BIT_4) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49087
by Cai Xinchen 11 Mar '25

11 Mar '25

David Howells (1): rxrpc: Restore removed timer deletion Eric Dumazet (1): rxrpc: fix a race in rxrpc_exit_net() net/rxrpc/net_ns.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6 0/5] cpufreq: Fix some boost errors related to CPU online and offline
by Lifeng Zheng 11 Mar '25

11 Mar '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> cpufreq: Fix some boost errors related to CPU online and offline: Aboorva Devarajan (1): cpufreq: prevent NULL dereference in cpufreq_online() Lifeng Zheng (4): cpufreq: Fix re-boost issue after hotplugging a CPU cpufreq: Introduce a more generic way to set default per-policy boost flag cpufreq: CPPC: Fix wrong max_freq in policy initialization cpufreq: ACPI: Remove set_boost in acpi_cpufreq_cpu_init() drivers/cpufreq/acpi-cpufreq.c | 5 ----- drivers/cpufreq/cppc_cpufreq.c | 5 +++-- drivers/cpufreq/cpufreq.c | 21 +++++++++++++++++---- 3 files changed, 20 insertions(+), 11 deletions(-) -- 2.33.0

2 6

[openeuler:openEuler-1.0-LTS 1473/1473] drivers/net/ethernet/huawei/hinic/hinic_lld.c:142:1: sparse: sparse: symbol 'g_hinic_chip_list' was not declared. Should it be static?
by kernel test robot 11 Mar '25

11 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 09e192513a17ce8324302ae595ebf001e08e13b0 commit: 6cb2e756917d122560e0c52f350682760d004eec [1473/1473] net: hinic: Add NIC Layer config: arm64-randconfig-r132-20250309 (https://download.01.org/0day-ci/archive/20250311/202503111134.UWDl3InI-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250311/202503111134.UWDl3InI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503111134.UWDl3InI-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:142:1: sparse: sparse: symbol 'g_hinic_chip_list' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_lld.c:158:23: sparse: sparse: symbol 'g_lld_lock' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:484:31: sparse: sparse: symbol 'ver_incompat_table' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:529:5: sparse: sparse: symbol 'hinic_version_cmp' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:754:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] manufacture_id @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:754:29: sparse: expected unsigned int [usertype] manufacture_id drivers/net/ethernet/huawei/hinic/hinic_lld.c:754:29: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:755:24: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] resp_code @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:755:24: sparse: expected unsigned short [usertype] resp_code drivers/net/ethernet/huawei/hinic/hinic_lld.c:755:24: sparse: got restricted __be16 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:756:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] reason_code @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:756:26: sparse: expected unsigned short [usertype] reason_code drivers/net/ethernet/huawei/hinic/hinic_lld.c:756:26: sparse: got restricted __be16 [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:801:16: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:801:16: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:801:16: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:802:16: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:802:16: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:802:16: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:803:16: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:803:16: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:803:16: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:804:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:804:14: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:804:14: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:842:52: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] ifa_address @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:842:52: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:842:52: sparse: got restricted __be32 [usertype] ifa_address drivers/net/ethernet/huawei/hinic/hinic_lld.c:881:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] ip_cnt @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:881:25: sparse: expected unsigned short [usertype] ip_cnt drivers/net/ethernet/huawei/hinic/hinic_lld.c:881:25: sparse: got restricted __be16 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:1268:6: sparse: sparse: symbol 'hinic_get_ppf_hwdev_by_pdev' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:1539:19: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:1781:57: sparse: sparse: Using plain integer as NULL pointer >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:1824:6: sparse: sparse: symbol 'hinic_event_process' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_lld.c:2203:32: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *[assigned] cfg_reg_base @@ got void [noderef] __iomem *cfg_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:2203:32: sparse: expected void *[assigned] cfg_reg_base drivers/net/ethernet/huawei/hinic/hinic_lld.c:2203:32: sparse: got void [noderef] __iomem *cfg_reg_base drivers/net/ethernet/huawei/hinic/hinic_lld.c:2204:33: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *[assigned] intr_reg_base @@ got void [noderef] __iomem *intr_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:2204:33: sparse: expected void *[assigned] intr_reg_base drivers/net/ethernet/huawei/hinic/hinic_lld.c:2204:33: sparse: got void [noderef] __iomem *intr_reg_base drivers/net/ethernet/huawei/hinic/hinic_lld.c:2205:27: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *[assigned] db_base @@ got void [noderef] __iomem *db_base @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:2205:27: sparse: expected void *[assigned] db_base drivers/net/ethernet/huawei/hinic/hinic_lld.c:2205:27: sparse: got void [noderef] __iomem *db_base >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:2207:32: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *[assigned] dwqe_mapping @@ got void [noderef] __iomem *dwqe_mapping @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:2207:32: sparse: expected void *[assigned] dwqe_mapping drivers/net/ethernet/huawei/hinic/hinic_lld.c:2207:32: sparse: got void [noderef] __iomem *dwqe_mapping drivers/net/ethernet/huawei/hinic/hinic_lld.c:529:5: warning: no previous prototype for 'hinic_version_cmp' [-Wmissing-prototypes] 529 | int hinic_version_cmp(char *ver1, char *ver2) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_lld.c:1268:7: warning: no previous prototype for 'hinic_get_ppf_hwdev_by_pdev' [-Wmissing-prototypes] 1268 | void *hinic_get_ppf_hwdev_by_pdev(struct pci_dev *pdev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_lld.c:1390:5: warning: no previous prototype for 'hinic_get_card_func_info_by_card_name' [-Wmissing-prototypes] 1390 | int hinic_get_card_func_info_by_card_name(char *chip_name, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_lld.c:1824:6: warning: no previous prototype for 'hinic_event_process' [-Wmissing-prototypes] 1824 | void hinic_event_process(void *adapter, struct hinic_event_info *event) | ^~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_qp.c:49:26: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_qp.c:62:28: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_qp.c:70:18: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_qp.c:85:21: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] status @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_qp.c:85:21: sparse: expected unsigned int [usertype] status drivers/net/ethernet/huawei/hinic/hinic_qp.c:85:21: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_qp.c:96:20: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_qp.c:107:24: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_qp.c:114:23: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_qp.c:122:23: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_qp.c:191:33: sparse: sparse: cast to restricted __be32 -- >> drivers/net/ethernet/huawei/hinic/hinic_rx.c:152:44: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] addr_high @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_rx.c:152:44: sparse: expected unsigned int [usertype] addr_high drivers/net/ethernet/huawei/hinic/hinic_rx.c:152:44: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_rx.c:154:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] addr_low @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_rx.c:154:43: sparse: expected unsigned int [usertype] addr_low drivers/net/ethernet/huawei/hinic/hinic_rx.c:154:43: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_rx.c:174:6: sparse: sparse: symbol 'hinic_rx_free_buffers' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_rx.c:568:24: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_rx.c:606:6: sparse: sparse: symbol 'rx_pass_super_cqe' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_rx.c:680:26: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_rx.c:688:28: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_rx.c:689:28: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_rx.c:709:45: sparse: sparse: cast to restricted __be32 In file included from include/linux/sctp.h:57, from drivers/net/ethernet/huawei/hinic/hinic_rx.c:30: include/uapi/linux/sctp.h:390:1: warning: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Wpacked-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:719:1: warning: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Wpacked-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:718:33: warning: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Wpacked-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ include/uapi/linux/sctp.h:732:1: warning: alignment 4 of 'struct sctp_prim' is less than 8 [-Wpacked-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:731:33: warning: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Wpacked-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ include/uapi/linux/sctp.h:783:1: warning: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Wpacked-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:775:33: warning: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Wpacked-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ include/uapi/linux/sctp.h:896:1: warning: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Wpacked-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:890:33: warning: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Wpacked-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_rx.c:174:6: warning: no previous prototype for 'hinic_rx_free_buffers' [-Wmissing-prototypes] 174 | void hinic_rx_free_buffers(struct hinic_rxq *rxq) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_rx.c:548:5: warning: no previous prototype for 'recv_one_pkt' [-Wmissing-prototypes] 548 | int recv_one_pkt(struct hinic_rxq *rxq, struct hinic_rq_cqe *rx_cqe, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_rx.c:606:6: warning: no previous prototype for 'rx_pass_super_cqe' [-Wmissing-prototypes] 606 | void rx_pass_super_cqe(struct hinic_rxq *rxq, u32 index, u32 pkt_num, | ^~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:593:35: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_tx.c:594:35: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_tx.c:595:35: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:1051:5: sparse: sparse: symbol 'hinic_setup_tx_wqe' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:1230:5: sparse: sparse: symbol 'hinic_stop_sq' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] hi_addr @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: expected unsigned int [usertype] hi_addr drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] lo_addr @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: expected unsigned int [usertype] lo_addr drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] len @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: expected unsigned int [usertype] len drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] hi_addr @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: expected unsigned int [usertype] hi_addr drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] lo_addr @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: expected unsigned int [usertype] lo_addr drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] len @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: expected unsigned int [usertype] len drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] hi_addr @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: expected unsigned int [usertype] hi_addr drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] lo_addr @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: expected unsigned int [usertype] lo_addr drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] len @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: expected unsigned int [usertype] len drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: got restricted __be32 [usertype] In file included from include/linux/sctp.h:57, from drivers/net/ethernet/huawei/hinic/hinic_tx.c:26: include/uapi/linux/sctp.h:390:1: warning: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Wpacked-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:719:1: warning: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Wpacked-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:718:33: warning: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Wpacked-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ include/uapi/linux/sctp.h:732:1: warning: alignment 4 of 'struct sctp_prim' is less than 8 [-Wpacked-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:731:33: warning: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Wpacked-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ include/uapi/linux/sctp.h:783:1: warning: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Wpacked-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:775:33: warning: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Wpacked-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ include/uapi/linux/sctp.h:896:1: warning: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Wpacked-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:890:33: warning: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Wpacked-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_tx.c:1051:5: warning: no previous prototype for 'hinic_setup_tx_wqe' [-Wmissing-prototypes] 1051 | int hinic_setup_tx_wqe(struct hinic_txq *txq) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_tx.c:1230:5: warning: no previous prototype for 'hinic_stop_sq' [-Wmissing-prototypes] 1230 | int hinic_stop_sq(struct hinic_txq *txq) | ^~~~~~~~~~~~~ -- drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:65:7: sparse: sparse: symbol 'dbgtool_dev_id' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:66:13: sparse: sparse: symbol 'dbgtool_chr_dev' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:69:14: sparse: sparse: symbol 'dbgtool_d_class' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:72:5: sparse: sparse: symbol 'g_dbgtool_init_flag' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:73:5: sparse: sparse: symbol 'g_dbgtool_ref_cnt' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:176:51: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got unsigned char [usertype] *cmd @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:176:51: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:176:51: sparse: got unsigned char [usertype] *cmd drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:190:44: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *ack @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:190:44: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:190:44: sparse: got void *ack drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:135:6: sparse: sparse: symbol 'dbgtool_knl_api_cmd_read' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:238:51: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got unsigned char [usertype] *cmd @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:238:51: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:238:51: sparse: got unsigned char [usertype] *cmd drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:207:6: sparse: sparse: symbol 'dbgtool_knl_api_cmd_write' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:339:37: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got struct pf_dev_info *dev_info @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:339:37: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:339:37: sparse: got struct pf_dev_info *dev_info drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:299:6: sparse: sparse: symbol 'dbgtool_knl_pf_dev_info_get' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:357:37: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got struct ffm_record_info *ffm_rd @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:357:37: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:357:37: sparse: got struct ffm_record_info *ffm_rd drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:353:6: sparse: sparse: symbol 'dbgtool_knl_ffm_info_rd' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:371:6: sparse: sparse: symbol 'dbgtool_knl_ffm_info_clr' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:423:54: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got void *buf_in @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:423:54: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:423:54: sparse: got void *buf_in >> drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:446:44: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got unsigned short [usertype] *out_size @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:446:44: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:446:44: sparse: got unsigned short [usertype] *out_size drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:453:44: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *buf_out @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:453:44: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:453:44: sparse: got void *buf_out drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:386:6: sparse: sparse: symbol 'dbgtool_knl_msg_to_up' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:508:37: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got void * @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:508:37: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:508:37: sparse: got void * drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:495:6: sparse: sparse: symbol 'dbgtool_knl_unlocked_ioctl' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:573:6: sparse: sparse: symbol 'ffm_intr_msg_record' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:135:6: warning: no previous prototype for 'dbgtool_knl_api_cmd_read' [-Wmissing-prototypes] 135 | long dbgtool_knl_api_cmd_read(struct dbgtool_param *para, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:207:6: warning: no previous prototype for 'dbgtool_knl_api_cmd_write' [-Wmissing-prototypes] 207 | long dbgtool_knl_api_cmd_write(struct dbgtool_param *para, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:299:6: warning: no previous prototype for 'dbgtool_knl_pf_dev_info_get' [-Wmissing-prototypes] 299 | long dbgtool_knl_pf_dev_info_get(struct dbgtool_param *para, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:353:6: warning: no previous prototype for 'dbgtool_knl_ffm_info_rd' [-Wmissing-prototypes] 353 | long dbgtool_knl_ffm_info_rd(struct dbgtool_param *para, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:371:6: warning: no previous prototype for 'dbgtool_knl_ffm_info_clr' [-Wmissing-prototypes] 371 | long dbgtool_knl_ffm_info_clr(struct dbgtool_param *para, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:386:6: warning: no previous prototype for 'dbgtool_knl_msg_to_up' [-Wmissing-prototypes] 386 | long dbgtool_knl_msg_to_up(struct dbgtool_param *para, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:495:6: warning: no previous prototype for 'dbgtool_knl_unlocked_ioctl' [-Wmissing-prototypes] 495 | long dbgtool_knl_unlocked_ioctl(struct file *pfile, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:573:6: warning: no previous prototype for 'ffm_intr_msg_record' [-Wmissing-prototypes] 573 | void ffm_intr_msg_record(void *handle, void *buf_in, u16 in_size, | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:498: warning: Function parameter or member 'arg' not described in 'dbgtool_knl_unlocked_ioctl' drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:575: warning: Function parameter or member 'in_size' not described in 'ffm_intr_msg_record' drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:575: warning: Function parameter or member 'out_size' not described in 'ffm_intr_msg_record' drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:664: warning: Function parameter or member 'vhwdev' not described in 'dbgtool_knl_init' drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:664: warning: Excess function parameter 'hwdev' description in 'dbgtool_knl_init' drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:792: warning: Function parameter or member 'vhwdev' not described in 'dbgtool_knl_deinit' drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:792: warning: Excess function parameter 'hwdev' description in 'dbgtool_knl_deinit' -- drivers/net/ethernet/huawei/hinic/hinic_nictool.c:104:43: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got void *in_buff @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:104:43: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/hinic/hinic_nictool.c:104:43: sparse: got void *in_buff >> drivers/net/ethernet/huawei/hinic/hinic_nictool.c:162:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *out_buf @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:162:32: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_nictool.c:162:32: sparse: got void *out_buf drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1070:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *out_buf @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1070:32: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1070:32: sparse: got void *out_buf drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1153:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *out_buf @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1153:32: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1153:32: sparse: got void *out_buf drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1363:35: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got void * @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1363:35: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1363:35: sparse: got void * drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1492:25: sparse: sparse: symbol 'sm_module_cmd_handle' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1663:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *out_buf @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1663:32: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1663:32: sparse: got void *out_buf drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1750:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *out_buf @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1750:32: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1750:32: sparse: got void *out_buf drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1756:5: sparse: sparse: symbol 'send_to_service_driver' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1871:38: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got void * @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1871:38: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1871:38: sparse: got void * drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1964:5: sparse: sparse: symbol 'if_nictool_exist' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1756:5: warning: no previous prototype for 'send_to_service_driver' [-Wmissing-prototypes] 1756 | int send_to_service_driver(struct msg_module *nt_msg, void *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1964:5: warning: no previous prototype for 'if_nictool_exist' [-Wmissing-prototypes] 1964 | int if_nictool_exist(void) | ^~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:62:6: sparse: sparse: symbol 'hinic_dcb_config_init' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:226:6: sparse: sparse: symbol 'hinic_set_prio_tc_map' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:825:4: sparse: sparse: symbol 'hinic_dcbnl_set_all' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1059:5: sparse: sparse: symbol '__set_cos_up_map' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dcb.c:62:6: warning: no previous prototype for 'hinic_dcb_config_init' [-Wmissing-prototypes] 62 | void hinic_dcb_config_init(struct hinic_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:226:6: warning: no previous prototype for 'hinic_set_prio_tc_map' [-Wmissing-prototypes] 226 | void hinic_set_prio_tc_map(struct hinic_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:825:4: warning: no previous prototype for 'hinic_dcbnl_set_all' [-Wmissing-prototypes] 825 | u8 hinic_dcbnl_set_all(struct net_device *netdev) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1059:5: warning: no previous prototype for '__set_cos_up_map' [-Wmissing-prototypes] 1059 | int __set_cos_up_map(struct hinic_nic_dev *nic_dev, u8 *cos_up) | ^~~~~~~~~~~~~~~~ vim +/g_hinic_chip_list +142 drivers/net/ethernet/huawei/hinic/hinic_lld.c 746ea35981b1f77 Xue 2019-01-30 139 746ea35981b1f77 Xue 2019-01-30 140 #define MAX_CARD_ID 64 746ea35981b1f77 Xue 2019-01-30 141 static u64 card_bit_map; 746ea35981b1f77 Xue 2019-01-30 @142 LIST_HEAD(g_hinic_chip_list); 746ea35981b1f77 Xue 2019-01-30 143 struct hinic_uld_info g_uld_info[SERVICE_T_MAX] = { {0} }; 746ea35981b1f77 Xue 2019-01-30 144 static const char *s_uld_name[SERVICE_T_MAX] = { 746ea35981b1f77 Xue 2019-01-30 145 "nic", "ovs", "roce", "toe", "iwarp", "fc", "fcoe", }; 746ea35981b1f77 Xue 2019-01-30 146 :::::: The code at line 142 was first introduced by commit :::::: 746ea35981b1f77e988d48642409d73f0470b3eb net: hinic: Add Hardware Abstract Layer :::::: TO: Xue <xuechaojing(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 20ecc2fe65037adab573d12c528d9883e738fa8a
by kernel test robot 11 Mar '25

11 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 20ecc2fe65037adab573d12c528d9883e738fa8a !15428 ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- Warning:arch-x86-kernel-cpu-resctrl-monitor.c-references-a-file-that-doesn-t-exist:Documentation-x86-resctrl.rst | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250310 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250310 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250310 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250310 | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250310 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250310 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch `-- x86_64-randconfig-161-20250311 |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch elapsed time: 728m configs tested: 15 configs skipped: 110 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250310 clang-19 arm64 randconfig-002-20250310 clang-17 arm64 randconfig-003-20250310 clang-15 arm64 randconfig-004-20250310 clang-17 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250310 gcc-12 x86_64 buildonly-randconfig-002-20250310 clang-19 x86_64 buildonly-randconfig-003-20250310 clang-19 x86_64 buildonly-randconfig-004-20250310 clang-19 x86_64 buildonly-randconfig-005-20250310 clang-19 x86_64 buildonly-randconfig-006-20250310 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 5dc4d5d2c6e574ad35fa81c3b1768238a0b9b3eb
by kernel test robot 11 Mar '25

11 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 5dc4d5d2c6e574ad35fa81c3b1768238a0b9b3eb !15299 ptp: Ensure info->enable callback is always set Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allnoconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250310 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250310 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250310 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250310 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-051-20250311 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-052-20250311 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-053-20250311 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-054-20250311 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-055-20250311 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- loongarch-allmodconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allnoconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allyesconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250310 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-002-20250310 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-r121-20250311 | `-- include-linux-mmzone.h:error:error-Allocator-MAX_ORDER-exceeds-SECTION_SIZE |-- loongarch-randconfig-r122-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250310 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250310 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250310 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250310 | |-- ld.lld:error:undefined-symbol:arch_kexec_protect_crashkres | |-- ld.lld:error:undefined-symbol:machine_crash_shutdown | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250310 | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250310 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-randconfig-161-20250311 | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-compaction.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:vm_compaction-proc_handler | |-- mm-compaction.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:vm_compaction-procname | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-randconfig-r112-20250311 |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 723m configs tested: 19 configs skipped: 113 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250310 clang-19 arm64 randconfig-002-20250310 clang-17 arm64 randconfig-003-20250310 clang-15 arm64 randconfig-004-20250310 clang-17 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250310 gcc-14.2.0 loongarch randconfig-002-20250310 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250310 gcc-12 x86_64 buildonly-randconfig-002-20250310 clang-19 x86_64 buildonly-randconfig-003-20250310 clang-19 x86_64 buildonly-randconfig-004-20250310 clang-19 x86_64 buildonly-randconfig-005-20250310 clang-19 x86_64 buildonly-randconfig-006-20250310 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1480/1480] mm/debug.c:174:3: warning: format specifies type 'void *' but the argument has type 'int'
by kernel test robot 11 Mar '25

11 Mar '25

Hi Ding, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 09e192513a17ce8324302ae595ebf001e08e13b0 commit: 2d2fe6b40444bd8f84f674930ac5f98a6314702e [1480/1480] ascend: mm: add an owner for mm_struct config: x86_64-randconfig-r112-20250311 (https://download.01.org/0day-ci/archive/20250311/202503110222.0FkInwB9-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250311/202503110222.0FkInwB9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503110222.0FkInwB9-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/debug.c: note: in included file (through include/linux/kernel.h): /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:44: sparse: sparse: Expected ) in function call /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:44: sparse: sparse: got < /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:43: sparse: sparse: not a function <noident> /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:22: sparse: sparse: bad constant expression type mm/debug.c: note: in included file (through include/linux/printk.h, include/linux/kernel.h): /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:44: sparse: sparse: Expected ) in function call /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:44: sparse: sparse: got < /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:43: sparse: sparse: not a function <noident> /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:22: sparse: sparse: bad constant expression type mm/debug.c: note: in included file (through include/linux/string.h, include/linux/bitmap.h, include/linux/cpumask.h, ...): /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:44: sparse: sparse: Expected ) in function call /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:44: sparse: sparse: got < /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:43: sparse: sparse: not a function <noident> /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:22: sparse: sparse: bad constant expression type In file included from mm/debug.c:14: In file included from include/linux/migrate.h:6: In file included from include/linux/mempolicy.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> mm/debug.c:174:3: warning: format specifies type 'void *' but the argument has type 'int' [-Wformat] 135 | atomic_read(&mm->tlb_flush_pending), | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/printk.h:342:35: note: expanded from macro 'pr_emerg' 342 | printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__) | ~~~ ^~~~~~~~~~~ >> mm/debug.c:175:3: warning: format specifies type 'int' but the argument has type 'unsigned long' [-Wformat] 142 | mm->def_flags, &mm->def_flags | ^~~~~~~~~~~~~ include/linux/printk.h:342:35: note: expanded from macro 'pr_emerg' 342 | printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__) | ~~~ ^~~~~~~~~~~ >> mm/debug.c:175:18: warning: format specifies type 'unsigned long' but the argument has type 'const unsigned long *' [-Wformat] 143 | mm->def_flags, &mm->def_flags | ^~~~~~~~~~~~~~ include/linux/printk.h:342:35: note: expanded from macro 'pr_emerg' 342 | printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__) | ~~~ ^~~~~~~~~~~ >> mm/debug.c:143:21: warning: more '%' conversions than data arguments [-Wformat-insufficient-args] 143 | "def_flags: %#lx(%pGv)\n", | ~^ include/linux/printk.h:342:27: note: expanded from macro 'pr_emerg' 342 | printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__) | ^~~ include/linux/printk.h:332:21: note: expanded from macro 'pr_fmt' 332 | #define pr_fmt(fmt) fmt | ^~~ 5 warnings generated. vim +174 mm/debug.c 82742a3a5152195 Sasha Levin 2014-10-09 114 31c9afa6db122a5 Sasha Levin 2014-10-09 115 void dump_mm(const struct mm_struct *mm) 31c9afa6db122a5 Sasha Levin 2014-10-09 116 { 7a9cdebdcc17e42 Linus Torvalds 2018-09-12 117 pr_emerg("mm %px mmap %px seqnum %llu task_size %lu\n" 31c9afa6db122a5 Sasha Levin 2014-10-09 118 #ifdef CONFIG_MMU 152a2d199e1385c Matthew Wilcox 2018-01-04 119 "get_unmapped_area %px\n" 31c9afa6db122a5 Sasha Levin 2014-10-09 120 #endif 31c9afa6db122a5 Sasha Levin 2014-10-09 121 "mmap_base %lu mmap_legacy_base %lu highest_vm_end %lu\n" 152a2d199e1385c Matthew Wilcox 2018-01-04 122 "pgd %px mm_users %d mm_count %d pgtables_bytes %lu map_count %d\n" 31c9afa6db122a5 Sasha Levin 2014-10-09 123 "hiwater_rss %lx hiwater_vm %lx total_vm %lx locked_vm %lx\n" 84638335900f199 Konstantin Khlebnikov 2016-01-14 124 "pinned_vm %lx data_vm %lx exec_vm %lx stack_vm %lx\n" 31c9afa6db122a5 Sasha Levin 2014-10-09 125 "start_code %lx end_code %lx start_data %lx end_data %lx\n" 31c9afa6db122a5 Sasha Levin 2014-10-09 126 "start_brk %lx brk %lx start_stack %lx\n" 31c9afa6db122a5 Sasha Levin 2014-10-09 127 "arg_start %lx arg_end %lx env_start %lx env_end %lx\n" 152a2d199e1385c Matthew Wilcox 2018-01-04 128 "binfmt %px flags %lx core_state %px\n" 31c9afa6db122a5 Sasha Levin 2014-10-09 129 #ifdef CONFIG_AIO 152a2d199e1385c Matthew Wilcox 2018-01-04 130 "ioctx_table %px\n" 31c9afa6db122a5 Sasha Levin 2014-10-09 131 #endif 2d2fe6b40444bd8 Ding Tianhong 2021-10-30 132 #ifdef CONFIG_MM_OWNER 152a2d199e1385c Matthew Wilcox 2018-01-04 133 "owner %px " 31c9afa6db122a5 Sasha Levin 2014-10-09 134 #endif 152a2d199e1385c Matthew Wilcox 2018-01-04 135 "exe_file %px\n" 31c9afa6db122a5 Sasha Levin 2014-10-09 136 #ifdef CONFIG_MMU_NOTIFIER 152a2d199e1385c Matthew Wilcox 2018-01-04 137 "mmu_notifier_mm %px\n" 31c9afa6db122a5 Sasha Levin 2014-10-09 138 #endif 31c9afa6db122a5 Sasha Levin 2014-10-09 139 #ifdef CONFIG_NUMA_BALANCING 31c9afa6db122a5 Sasha Levin 2014-10-09 140 "numa_next_scan %lu numa_scan_offset %lu numa_scan_seq %d\n" 31c9afa6db122a5 Sasha Levin 2014-10-09 141 #endif 31c9afa6db122a5 Sasha Levin 2014-10-09 142 "tlb_flush_pending %d\n" b8eceeb99014cf5 Vlastimil Babka 2016-03-15 @143 "def_flags: %#lx(%pGv)\n", 31c9afa6db122a5 Sasha Levin 2014-10-09 144 7a9cdebdcc17e42 Linus Torvalds 2018-09-12 145 mm, mm->mmap, (long long) mm->vmacache_seqnum, mm->task_size, 31c9afa6db122a5 Sasha Levin 2014-10-09 146 #ifdef CONFIG_MMU 31c9afa6db122a5 Sasha Levin 2014-10-09 147 mm->get_unmapped_area, 31c9afa6db122a5 Sasha Levin 2014-10-09 148 #endif 31c9afa6db122a5 Sasha Levin 2014-10-09 149 mm->mmap_base, mm->mmap_legacy_base, mm->highest_vm_end, 31c9afa6db122a5 Sasha Levin 2014-10-09 150 mm->pgd, atomic_read(&mm->mm_users), 31c9afa6db122a5 Sasha Levin 2014-10-09 151 atomic_read(&mm->mm_count), af5b0f6a09e42c9 Kirill A. Shutemov 2017-11-15 152 mm_pgtables_bytes(mm), 31c9afa6db122a5 Sasha Levin 2014-10-09 153 mm->map_count, 53f4e528406789b Daniel Jordan 2019-08-14 154 mm->hiwater_rss, mm->hiwater_vm, mm->total_vm, 53f4e528406789b Daniel Jordan 2019-08-14 155 atomic_long_read(&mm->locked_vm), 84638335900f199 Konstantin Khlebnikov 2016-01-14 156 mm->pinned_vm, mm->data_vm, mm->exec_vm, mm->stack_vm, 31c9afa6db122a5 Sasha Levin 2014-10-09 157 mm->start_code, mm->end_code, mm->start_data, mm->end_data, 31c9afa6db122a5 Sasha Levin 2014-10-09 158 mm->start_brk, mm->brk, mm->start_stack, 31c9afa6db122a5 Sasha Levin 2014-10-09 159 mm->arg_start, mm->arg_end, mm->env_start, mm->env_end, 31c9afa6db122a5 Sasha Levin 2014-10-09 160 mm->binfmt, mm->flags, mm->core_state, 31c9afa6db122a5 Sasha Levin 2014-10-09 161 #ifdef CONFIG_AIO 31c9afa6db122a5 Sasha Levin 2014-10-09 162 mm->ioctx_table, 31c9afa6db122a5 Sasha Levin 2014-10-09 163 #endif 31c9afa6db122a5 Sasha Levin 2014-10-09 164 #ifdef CONFIG_MEMCG 31c9afa6db122a5 Sasha Levin 2014-10-09 165 mm->owner, 31c9afa6db122a5 Sasha Levin 2014-10-09 166 #endif 31c9afa6db122a5 Sasha Levin 2014-10-09 167 mm->exe_file, 31c9afa6db122a5 Sasha Levin 2014-10-09 168 #ifdef CONFIG_MMU_NOTIFIER 31c9afa6db122a5 Sasha Levin 2014-10-09 169 mm->mmu_notifier_mm, 31c9afa6db122a5 Sasha Levin 2014-10-09 170 #endif 31c9afa6db122a5 Sasha Levin 2014-10-09 171 #ifdef CONFIG_NUMA_BALANCING 31c9afa6db122a5 Sasha Levin 2014-10-09 172 mm->numa_next_scan, mm->numa_scan_offset, mm->numa_scan_seq, 31c9afa6db122a5 Sasha Levin 2014-10-09 173 #endif 16af97dc5a89753 Nadav Amit 2017-08-10 @174 atomic_read(&mm->tlb_flush_pending), b8eceeb99014cf5 Vlastimil Babka 2016-03-15 @175 mm->def_flags, &mm->def_flags 31c9afa6db122a5 Sasha Levin 2014-10-09 176 ); 31c9afa6db122a5 Sasha Levin 2014-10-09 177 } 31c9afa6db122a5 Sasha Levin 2014-10-09 178 :::::: The code at line 174 was first introduced by commit :::::: 16af97dc5a8975371a83d9e30a64038b48f40a2d mm: migrate: prevent racy access to tlb_flush_pending :::::: TO: Nadav Amit <nadav.amit(a)gmail.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 09e192513a17ce8324302ae595ebf001e08e13b0
by kernel test robot 11 Mar '25

11 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 09e192513a17ce8324302ae595ebf001e08e13b0 !15415 tracing/histograms: Fix memory leak problem Error/Warning (recently discovered and may have been fixed): drivers/block/zram/.tmp_zcomp.o: warning: objtool: missing symbol for section .text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250310 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250310 | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250310 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250310 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-allnoconfig | |-- mm-hugetlb.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-shmem.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-swap.c:linux-memremap.h-is-included-more-than-once. | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250310 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250310 | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-.tmp_vmacache.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250310 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250310 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250310 | |-- crypto-.tmp_sm4_generic.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-block-zram-.tmp_zcomp.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-.tmp_nouveau_abi16.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- fs-crypto-.tmp_hooks.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-.tmp_vmacache.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- net-can-j1939-.tmp_address-claim.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-006-20250310 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-defconfig | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-102-20250310 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used `-- x86_64-randconfig-161-20250310 |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page |-- mm-vmalloc.c:warning:variable-start-set-but-not-used `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration elapsed time: 729m configs tested: 15 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250310 gcc-14.2.0 arm64 randconfig-002-20250310 gcc-14.2.0 arm64 randconfig-003-20250310 gcc-14.2.0 arm64 randconfig-004-20250310 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250310 gcc-12 x86_64 buildonly-randconfig-002-20250310 clang-19 x86_64 buildonly-randconfig-003-20250310 clang-19 x86_64 buildonly-randconfig-004-20250310 clang-19 x86_64 buildonly-randconfig-005-20250310 clang-19 x86_64 buildonly-randconfig-006-20250310 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty
by Wang Zhaolong 10 Mar '25

10 Mar '25

From: Zhihao Cheng <chengzhihao1(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit c4595fe394a289927077e3da561db27811919ee0 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBS8G5 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since commit 14072ee33d5a ("ubi: fastmap: Check wl_pool for free peb before wear leveling"), wear_leveling_worker() won't schedule fm_work if wear-leveling pool is empty, which could temporarily disable the wear-leveling until the fastmap is updated(eg. pool becomes empty). Fix it by scheduling fm_work if wl_pool is empty during wear-leveing. Fixes: 14072ee33d5a ("ubi: fastmap: Check wl_pool for free peb before wear leveling") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- drivers/mtd/ubi/fastmap-wl.c | 19 ++++++++++++++++--- drivers/mtd/ubi/wl.c | 2 +- drivers/mtd/ubi/wl.h | 3 ++- 3 files changed, 19 insertions(+), 5 deletions(-) diff --git a/drivers/mtd/ubi/fastmap-wl.c b/drivers/mtd/ubi/fastmap-wl.c index 2a9cc9413c42..9bdb6525f128 100644 --- a/drivers/mtd/ubi/fastmap-wl.c +++ b/drivers/mtd/ubi/fastmap-wl.c @@ -344,18 +344,31 @@ int ubi_wl_get_peb(struct ubi_device *ubi) /** * next_peb_for_wl - returns next PEB to be used internally by the * WL sub-system. * * @ubi: UBI device description object + * @need_fill: whether to fill wear-leveling pool when no PEBs are found */ -static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi) +static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi, + bool need_fill) { struct ubi_fm_pool *pool = &ubi->fm_wl_pool; int pnum; - if (pool->used == pool->size) + if (pool->used == pool->size) { + if (need_fill && !ubi->fm_work_scheduled) { + /* + * We cannot update the fastmap here because this + * function is called in atomic context. + * Let's fail here and refill/update it as soon as + * possible. + */ + ubi->fm_work_scheduled = 1; + schedule_work(&ubi->fm_work); + } return NULL; + } pnum = pool->pebs[pool->used]; return ubi->lookuptbl[pnum]; } @@ -373,11 +386,11 @@ static bool need_wear_leveling(struct ubi_device *ubi) struct ubi_wl_entry *e; if (!ubi->used.rb_node) return false; - e = next_peb_for_wl(ubi); + e = next_peb_for_wl(ubi, false); if (!e) { if (!ubi->free.rb_node) return false; e = find_wl_entry(ubi, &ubi->free, WL_FREE_MAX_DIFF, 0); ec = e->ec; diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c index b60eea10f68f..97b86fab1466 100644 --- a/drivers/mtd/ubi/wl.c +++ b/drivers/mtd/ubi/wl.c @@ -681,11 +681,11 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, spin_lock(&ubi->wl_lock); ubi_assert(!ubi->move_from && !ubi->move_to); ubi_assert(!ubi->move_to_put); #ifdef CONFIG_MTD_UBI_FASTMAP - if (!next_peb_for_wl(ubi) || + if (!next_peb_for_wl(ubi, true) || #else if (!ubi->free.rb_node || #endif (!ubi->used.rb_node && !ubi->scrub.rb_node)) { /* diff --git a/drivers/mtd/ubi/wl.h b/drivers/mtd/ubi/wl.h index 7b6715ef6d4a..a69169c35e31 100644 --- a/drivers/mtd/ubi/wl.h +++ b/drivers/mtd/ubi/wl.h @@ -3,11 +3,12 @@ #define UBI_WL_H #ifdef CONFIG_MTD_UBI_FASTMAP static void update_fastmap_work_fn(struct work_struct *wrk); static struct ubi_wl_entry *find_anchor_wl_entry(struct rb_root *root); static struct ubi_wl_entry *get_peb_for_wl(struct ubi_device *ubi); -static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi); +static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi, + bool need_fill); static bool need_wear_leveling(struct ubi_device *ubi); static void ubi_fastmap_close(struct ubi_device *ubi); static inline void ubi_fastmap_init(struct ubi_device *ubi, int *count) { if (ubi->fm_disabled) -- 2.34.3

2 1

[PATCH OLK-5.10 0/2] CVE-2022-49513
by Zhang Kunbo 10 Mar '25

10 Mar '25

*** BLURB HERE *** Kevin Hao (2): cpufreq: Move to_gov_attr_set() to cpufreq.h cpufreq: governor: Use kobject release() method to free dbs_data drivers/cpufreq/cpufreq_governor.c | 20 +++++++++++++------- drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cpufreq/cpufreq_governor_attr_set.c | 5 ----- include/linux/cpufreq.h | 5 +++++ 4 files changed, 19 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49513
by Zhang Kunbo 10 Mar '25

10 Mar '25

*** BLURB HERE *** Kevin Hao (2): cpufreq: Move to_gov_attr_set() to cpufreq.h cpufreq: governor: Use kobject release() method to free dbs_data drivers/cpufreq/cpufreq_governor.c | 20 +++++++++++++------- drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cpufreq/cpufreq_governor_attr_set.c | 5 ----- include/linux/cpufreq.h | 5 +++++ 4 files changed, 19 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT
by Tengda Wu 10 Mar '25

10 Mar '25

From: Martin KaFai Lau <martin.lau(a)kernel.org> stable inclusion from stable-v6.6.76 commit 3392fa605d7c5708c5fbe02e4fbdac547c3b7352 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBREBI CVE: CVE-2024-58070 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8eef6ac4d70eb1f0099fff93321d90ce8fa49ee1 ] In PREEMPT_RT, kmalloc(GFP_ATOMIC) is still not safe in non preemptible context. bpf_mem_alloc must be used in PREEMPT_RT. This patch is to enforce bpf_mem_alloc in the bpf_local_storage when CONFIG_PREEMPT_RT is enabled. [ 35.118559] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 35.118566] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1832, name: test_progs [ 35.118569] preempt_count: 1, expected: 0 [ 35.118571] RCU nest depth: 1, expected: 1 [ 35.118577] INFO: lockdep is turned off. ... [ 35.118647] __might_resched+0x433/0x5b0 [ 35.118677] rt_spin_lock+0xc3/0x290 [ 35.118700] ___slab_alloc+0x72/0xc40 [ 35.118723] __kmalloc_noprof+0x13f/0x4e0 [ 35.118732] bpf_map_kzalloc+0xe5/0x220 [ 35.118740] bpf_selem_alloc+0x1d2/0x7b0 [ 35.118755] bpf_local_storage_update+0x2fa/0x8b0 [ 35.118784] bpf_sk_storage_get_tracing+0x15a/0x1d0 [ 35.118791] bpf_prog_9a118d86fca78ebb_trace_inet_sock_set_state+0x44/0x66 [ 35.118795] bpf_trace_run3+0x222/0x400 [ 35.118820] __bpf_trace_inet_sock_set_state+0x11/0x20 [ 35.118824] trace_inet_sock_set_state+0x112/0x130 [ 35.118830] inet_sk_state_store+0x41/0x90 [ 35.118836] tcp_set_state+0x3b3/0x640 There is no need to adjust the gfp_flags passing to the bpf_mem_cache_alloc_flags() which only honors the GFP_KERNEL. The verifier has ensured GFP_KERNEL is passed only in sleepable context. It has been an old issue since the first introduction of the bpf_local_storage ~5 years ago, so this patch targets the bpf-next. bpf_mem_alloc is needed to solve it, so the Fixes tag is set to the commit when bpf_mem_alloc was first used in the bpf_local_storage. Fixes: 08a7ce384e33 ("bpf: Use bpf_mem_cache_alloc/free in bpf_local_storage_elem") Reported-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://lore.kernel.org/r/20241218193000.2084281-1-martin.lau@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/bpf/bpf_local_storage.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/bpf_local_storage.c b/kernel/bpf/bpf_local_storage.c index e8d02212da70..b4c6b9b3cb42 100644 --- a/kernel/bpf/bpf_local_storage.c +++ b/kernel/bpf/bpf_local_storage.c @@ -823,8 +823,12 @@ bpf_local_storage_map_alloc(union bpf_attr *attr, smap->elem_size = offsetof(struct bpf_local_storage_elem, sdata.data[attr->value_size]); - smap->bpf_ma = bpf_ma; - if (bpf_ma) { + /* In PREEMPT_RT, kmalloc(GFP_ATOMIC) is still not safe in non + * preemptible context. Thus, enforce all storages to use + * bpf_mem_alloc when CONFIG_PREEMPT_RT is enabled. + */ + smap->bpf_ma = IS_ENABLED(CONFIG_PREEMPT_RT) ? true : bpf_ma; + if (smap->bpf_ma) { err = bpf_mem_alloc_init(&smap->selem_ma, smap->elem_size, false); if (err) goto free_smap; -- 2.34.1

2 1

[openeuler:OLK-5.10 2799/2799] block/bio.c:412: warning: Function parameter or member 'nr_iovecs_int' not described in 'bio_alloc_bioset'
by kernel test robot 10 Mar '25

10 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 2c111a42444b16dfa7f0081facc22e382988eacc commit: 6381672514c4d94637cd4db830b8644440abe99a [2799/2799] block: fix kabi broken config: x86_64-defconfig (https://download.01.org/0day-ci/archive/20250310/202503101424.uyjkGNSl-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250310/202503101424.uyjkGNSl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503101424.uyjkGNSl-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/bio.c:412: warning: Function parameter or member 'nr_iovecs_int' not described in 'bio_alloc_bioset' >> block/bio.c:412: warning: Excess function parameter 'nr_iovecs' description in 'bio_alloc_bioset' vim +412 block/bio.c df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 374 ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 375 /** ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 376 * bio_alloc_bioset - allocate a bio for I/O 519c8e9ffd86143 block/bio.c Randy Dunlap 2017-10-16 377 * @gfp_mask: the GFP_* mask given to the slab allocator ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 378 * @nr_iovecs: number of iovecs to pre-allocate db18efac0bd644e fs/bio.c Jaak Ristioja 2010-01-15 379 * @bs: the bio_set to allocate from. ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 380 * ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 381 * Description: 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 382 * If @bs is NULL, uses kmalloc() to allocate the bio; else the allocation is 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 383 * backed by the @bs's mempool. 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 384 * d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 385 * When @bs is not NULL, if %__GFP_DIRECT_RECLAIM is set then bio_alloc will d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 386 * always be able to allocate a bio. This is due to the mempool guarantees. d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 387 * To make this work, callers must never allocate more than 1 bio at a time d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 388 * from this pool. Callers that need to allocate more than 1 bio must always d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 389 * submit the previously allocated bio for IO before attempting to allocate d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 390 * a new one. Failure to do so can cause deadlocks under memory pressure. 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 391 * ed00aabd5eb9fb4 block/bio.c Christoph Hellwig 2020-07-01 392 * Note that when running under submit_bio_noacct() (i.e. any block df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 393 * driver), bios are not submitted until after you return - see the code in ed00aabd5eb9fb4 block/bio.c Christoph Hellwig 2020-07-01 394 * submit_bio_noacct() that converts recursion into iteration, to prevent df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 395 * stack overflows. df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 396 * df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 397 * This would normally mean allocating multiple bios under ed00aabd5eb9fb4 block/bio.c Christoph Hellwig 2020-07-01 398 * submit_bio_noacct() would be susceptible to deadlocks, but we have df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 399 * deadlock avoidance code that resubmits any blocked bios from a rescuer df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 400 * thread. df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 401 * df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 402 * However, we do not guarantee forward progress for allocations from other df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 403 * mempools. Doing multiple allocations from the same mempool under ed00aabd5eb9fb4 block/bio.c Christoph Hellwig 2020-07-01 404 * submit_bio_noacct() should be avoided - instead, use bio_set's front_pad df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 405 * for per bio allocations. df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 406 * 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 407 * RETURNS: 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 408 * Pointer to new bio on success, NULL on failure. 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 409 */ 6381672514c4d94 block/bio.c Li Lingfeng 2025-02-10 410 struct bio *bio_alloc_bioset(gfp_t gfp_mask, unsigned int nr_iovecs_int, 7a88fa191944589 block/bio.c Dan Carpenter 2017-03-23 411 struct bio_set *bs) ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 @412 { df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 413 gfp_t saved_gfp = gfp_mask; 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 414 unsigned front_pad; 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 415 unsigned inline_vecs; 34053979fb1d923 fs/bio.c Ingo Molnar 2009-02-21 416 struct bio_vec *bvl = NULL; 451a9ebf653d283 fs/bio.c Tejun Heo 2009-04-15 417 struct bio *bio; 451a9ebf653d283 fs/bio.c Tejun Heo 2009-04-15 418 void *p; 6381672514c4d94 block/bio.c Li Lingfeng 2025-02-10 419 unsigned short nr_iovecs = (unsigned short)nr_iovecs_int; 0a0d96b03a1f3bf fs/bio.c Jens Axboe 2008-09-11 420 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 421 if (!bs) { 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 422 if (nr_iovecs > UIO_MAXIOV) 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 423 return NULL; 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 424 1f4fe21cf45c799 block/bio.c Gustavo A. R. Silva 2020-06-19 425 p = kmalloc(struct_size(bio, bi_inline_vecs, nr_iovecs), gfp_mask); 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 426 front_pad = 0; 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 427 inline_vecs = nr_iovecs; 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 428 } else { d8f429e1669b970 block/bio.c Junichi Nomura 2014-10-03 429 /* should not use nobvec bioset for nr_iovecs > 0 */ 8aa6ba2f6e3deaf block/bio.c Kent Overstreet 2018-05-08 430 if (WARN_ON_ONCE(!mempool_initialized(&bs->bvec_pool) && 8aa6ba2f6e3deaf block/bio.c Kent Overstreet 2018-05-08 431 nr_iovecs > 0)) d8f429e1669b970 block/bio.c Junichi Nomura 2014-10-03 432 return NULL; df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 433 /* ed00aabd5eb9fb4 block/bio.c Christoph Hellwig 2020-07-01 434 * submit_bio_noacct() converts recursion to iteration; this df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 435 * means if we're running beneath it, any bios we allocate and df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 436 * submit will not be submitted (and thus freed) until after we df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 437 * return. df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 438 * df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 439 * This exposes us to a potential deadlock if we allocate df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 440 * multiple bios from the same bio_set() while running ed00aabd5eb9fb4 block/bio.c Christoph Hellwig 2020-07-01 441 * underneath submit_bio_noacct(). If we were to allocate df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 442 * multiple bios (say a stacking block driver that was splitting df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 443 * bios), we would deadlock if we exhausted the mempool's df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 444 * reserve. df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 445 * df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 446 * We solve this, and guarantee forward progress, with a rescuer df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 447 * workqueue per bio_set. If we go to allocate and there are df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 448 * bios on current->bio_list, we first try the allocation d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 449 * without __GFP_DIRECT_RECLAIM; if that fails, we punt those d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 450 * bios we would be blocking to the rescuer workqueue before d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 451 * we retry with the original gfp_flags. df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 452 */ df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 453 f5fe1b51905df7c block/bio.c NeilBrown 2017-03-10 454 if (current->bio_list && f5fe1b51905df7c block/bio.c NeilBrown 2017-03-10 455 (!bio_list_empty(&current->bio_list[0]) || 47e0fb461fca1a6 block/bio.c NeilBrown 2017-06-18 456 !bio_list_empty(&current->bio_list[1])) && 47e0fb461fca1a6 block/bio.c NeilBrown 2017-06-18 457 bs->rescue_workqueue) d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 458 gfp_mask &= ~__GFP_DIRECT_RECLAIM; df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 459 8aa6ba2f6e3deaf block/bio.c Kent Overstreet 2018-05-08 460 p = mempool_alloc(&bs->bio_pool, gfp_mask); df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 461 if (!p && gfp_mask != saved_gfp) { df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 462 punt_bios_to_rescuer(bs); df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 463 gfp_mask = saved_gfp; 8aa6ba2f6e3deaf block/bio.c Kent Overstreet 2018-05-08 464 p = mempool_alloc(&bs->bio_pool, gfp_mask); df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 465 } df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 466 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 467 front_pad = bs->front_pad; 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 468 inline_vecs = BIO_INLINE_VECS; 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 469 } 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 470 451a9ebf653d283 fs/bio.c Tejun Heo 2009-04-15 471 if (unlikely(!p)) 451a9ebf653d283 fs/bio.c Tejun Heo 2009-04-15 472 return NULL; ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 473 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 474 bio = p + front_pad; 3a83f4677539bce block/bio.c Ming Lei 2016-11-22 475 bio_init(bio, NULL, 0); 34053979fb1d923 fs/bio.c Ingo Molnar 2009-02-21 476 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 477 if (nr_iovecs > inline_vecs) { ed996a52c868b62 block/bio.c Christoph Hellwig 2016-07-19 478 958384da6a734eb block/bio.c Christoph Hellwig 2025-02-10 479 bvl = bvec_alloc(&bs->bvec_pool, &nr_iovecs, gfp_mask); df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 480 if (!bvl && gfp_mask != saved_gfp) { df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 481 punt_bios_to_rescuer(bs); df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 482 gfp_mask = saved_gfp; 958384da6a734eb block/bio.c Christoph Hellwig 2025-02-10 483 bvl = bvec_alloc(&bs->bvec_pool, &nr_iovecs, gfp_mask); df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 484 } df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 485 34053979fb1d923 fs/bio.c Ingo Molnar 2009-02-21 486 if (unlikely(!bvl)) 34053979fb1d923 fs/bio.c Ingo Molnar 2009-02-21 487 goto err_free; a38352e0ac02dbb fs/bio.c Kent Overstreet 2012-05-25 488 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 489 } else if (nr_iovecs) { 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 490 bvl = bio->bi_inline_vecs; 392ddc32982a5c6 fs/bio.c Jens Axboe 2008-12-23 491 } 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 492 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 493 bio->bi_pool = bs; 392ddc32982a5c6 fs/bio.c Jens Axboe 2008-12-23 494 bio->bi_max_vecs = nr_iovecs; ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 495 bio->bi_io_vec = bvl; ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 496 return bio; 34053979fb1d923 fs/bio.c Ingo Molnar 2009-02-21 497 34053979fb1d923 fs/bio.c Ingo Molnar 2009-02-21 498 err_free: 8aa6ba2f6e3deaf block/bio.c Kent Overstreet 2018-05-08 499 mempool_free(p, &bs->bio_pool); 34053979fb1d923 fs/bio.c Ingo Molnar 2009-02-21 500 return NULL; ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 501 } a112a71d45b5e40 fs/bio.c H Hartley Sweeten 2009-09-26 502 EXPORT_SYMBOL(bio_alloc_bioset); ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 503 :::::: The code at line 412 was first introduced by commit :::::: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Linux-2.6.12-rc2 :::::: TO: Linus Torvalds <torvalds(a)ppc970.osdl.org> :::::: CC: Linus Torvalds <torvalds(a)ppc970.osdl.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] ocfs2: handle a symlink read error correctly
by Luo Gengkun 10 Mar '25

10 Mar '25

From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> mainline inclusion from mainline-v6.14-rc1 commit 2b4c2094da6d84e69b843dd3317902e977bf64bd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8H CVE: CVE-2024-58001 Reference: https://git.kernel.org/stable/c/2b4c2094da6d84e69b843dd3317902e977bf64bd -------------------------------- Patch series "Convert ocfs2 to use folios". Mark did a conversion of ocfs2 to use folios and sent it to me as a giant patch for review ;-) So I've redone it as individual patches, and credited Mark for the patches where his code is substantially the same. It's not a bad way to do it; his patch had some bugs and my patches had some bugs. Hopefully all our bugs were different from each other. And hopefully Mark likes all the changes I made to his code! This patch (of 23): If we can't read the buffer, be sure to unlock the page before returning. Link: https://lkml.kernel.org/r/20241205171653.3179945-1-willy@infradead.org Link: https://lkml.kernel.org/r/20241205171653.3179945-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Mark Tinguely <mark.tinguely(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- fs/ocfs2/symlink.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c index 94cfacc9bad7..f3e80c00ca69 100644 --- a/fs/ocfs2/symlink.c +++ b/fs/ocfs2/symlink.c @@ -66,7 +66,7 @@ static int ocfs2_fast_symlink_readpage(struct file *unused, struct page *page) if (status < 0) { mlog_errno(status); - return status; + goto out; } fe = (struct ocfs2_dinode *) bh->b_data; @@ -77,9 +77,10 @@ static int ocfs2_fast_symlink_readpage(struct file *unused, struct page *page) memcpy(kaddr, link, len + 1); kunmap_atomic(kaddr); SetPageUptodate(page); +out: unlock_page(page); brelse(bh); - return 0; + return status; } const struct address_space_operations ocfs2_fast_symlink_aops = { -- 2.34.1

2 1

[PATCH OLK-5.10 0/7] Some bug fix patches for OLK-5.10 hns RoCE
by Junxian Huang 10 Mar '25

10 Mar '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some bug fix patches for OLK-5.10 hns RoCE: Junxian Huang (5): RDMA/hns: Change mtr member to pointer in hns QP/CQ/MR/SRQ/EQ struct RDMA/hns: Move mtr_node into the mtr struct RDMA/hns: Fix delayed destruction of db not taking effect RDMA/hns: Fix delay-destruction mechanism not processing kernel db RDMA/hns: Fix soft lockup by adding cond_resched() to bt pages loop Xinghai Cen (1): RDMA/hns: Fix unmatched kmalloc and kvfree Yuyu Li (1): RDMA/hns: Fix ifnullfree static warning drivers/infiniband/hw/hns/hns_roce_cq.c | 35 ++--- drivers/infiniband/hw/hns/hns_roce_db.c | 86 +++++++---- drivers/infiniband/hw/hns/hns_roce_dca.c | 6 +- drivers/infiniband/hw/hns/hns_roce_device.h | 69 ++++----- drivers/infiniband/hw/hns/hns_roce_ext.c | 3 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 17 ++- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 82 +++++----- drivers/infiniband/hw/hns/hns_roce_main.c | 14 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 144 ++++++++---------- drivers/infiniband/hw/hns/hns_roce_qp.c | 35 ++--- drivers/infiniband/hw/hns/hns_roce_restrack.c | 4 +- drivers/infiniband/hw/hns/hns_roce_srq.c | 63 +++----- 12 files changed, 271 insertions(+), 287 deletions(-) -- 2.33.0

2 8

[PATCH OLK-5.10] NFC: nci: Add bounds checking in nci_hci_create_pipe()
by Yang Yingliang 10 Mar '25

10 Mar '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.14-rc1 commit 110b43ef05342d5a11284cc8b21582b698b4ef1c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8J CVE: CVE-2025-21735 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The "pipe" variable is a u8 which comes from the network. If it's more than 127, then it results in memory corruption in the caller, nci_hci_connect_gate(). Cc: stable(a)vger.kernel.org Fixes: a1b0b9415817 ("NFC: nci: Create pipe on specific gate in nci_hci_connect_gate") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://patch.msgid.link/bcf5453b-7204-4297-9c20-4d8c7dacf586@stanley.mount… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/nfc/nci/hci.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c index 4fe336ff2bfa..f8140488b08a 100644 --- a/net/nfc/nci/hci.c +++ b/net/nfc/nci/hci.c @@ -548,6 +548,8 @@ static u8 nci_hci_create_pipe(struct nci_dev *ndev, u8 dest_host, pr_debug("pipe created=%d\n", pipe); + if (pipe >= NCI_HCI_MAX_PIPES) + pipe = NCI_HCI_INVALID_PIPE; return pipe; } -- 2.25.1

2 1

[PATCH OLK-6.6] ocfs2: handle a symlink read error correctly
by Luo Gengkun 10 Mar '25

10 Mar '25

From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> stable inclusion from stable-v6.6.78 commit b6833b38984d1e9f20dd80f9ec9050c10d687f30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8H CVE: CVE-2024-58001 Reference: https://git.kernel.org/stable/c/b6833b38984d1e9f20dd80f9ec9050c10d687f30 -------------------------------- commit 2b4c2094da6d84e69b843dd3317902e977bf64bd upstream. Patch series "Convert ocfs2 to use folios". Mark did a conversion of ocfs2 to use folios and sent it to me as a giant patch for review ;-) So I've redone it as individual patches, and credited Mark for the patches where his code is substantially the same. It's not a bad way to do it; his patch had some bugs and my patches had some bugs. Hopefully all our bugs were different from each other. And hopefully Mark likes all the changes I made to his code! This patch (of 23): If we can't read the buffer, be sure to unlock the page before returning. Link: https://lkml.kernel.org/r/20241205171653.3179945-1-willy@infradead.org Link: https://lkml.kernel.org/r/20241205171653.3179945-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Mark Tinguely <mark.tinguely(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- fs/ocfs2/symlink.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c index d4c5fdcfa1e4..f5cf2255dc09 100644 --- a/fs/ocfs2/symlink.c +++ b/fs/ocfs2/symlink.c @@ -65,7 +65,7 @@ static int ocfs2_fast_symlink_read_folio(struct file *f, struct folio *folio) if (status < 0) { mlog_errno(status); - return status; + goto out; } fe = (struct ocfs2_dinode *) bh->b_data; @@ -76,9 +76,10 @@ static int ocfs2_fast_symlink_read_folio(struct file *f, struct folio *folio) memcpy(kaddr, link, len + 1); kunmap_atomic(kaddr); SetPageUptodate(page); +out: unlock_page(page); brelse(bh); - return 0; + return status; } const struct address_space_operations ocfs2_fast_symlink_aops = { -- 2.34.1

2 1

[PATCH OLK-5.10] ocfs2: handle a symlink read error correctly
by Luo Gengkun 10 Mar '25

10 Mar '25

From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> mainline inclusion from mainline-v6.14-rc1 commit b6833b38984d1e9f20dd80f9ec9050c10d687f30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8H CVE: CVE-2024-58001 Reference: https://git.kernel.org/stable/c/b6833b38984d1e9f20dd80f9ec9050c10d687f30 -------------------------------- commit 2b4c2094da6d84e69b843dd3317902e977bf64bd upstream. Patch series "Convert ocfs2 to use folios". Mark did a conversion of ocfs2 to use folios and sent it to me as a giant patch for review ;-) So I've redone it as individual patches, and credited Mark for the patches where his code is substantially the same. It's not a bad way to do it; his patch had some bugs and my patches had some bugs. Hopefully all our bugs were different from each other. And hopefully Mark likes all the changes I made to his code! This patch (of 23): If we can't read the buffer, be sure to unlock the page before returning. Link: https://lkml.kernel.org/r/20241205171653.3179945-1-willy@infradead.org Link: https://lkml.kernel.org/r/20241205171653.3179945-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Mark Tinguely <mark.tinguely(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- fs/ocfs2/symlink.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c index 94cfacc9bad7..f3e80c00ca69 100644 --- a/fs/ocfs2/symlink.c +++ b/fs/ocfs2/symlink.c @@ -66,7 +66,7 @@ static int ocfs2_fast_symlink_readpage(struct file *unused, struct page *page) if (status < 0) { mlog_errno(status); - return status; + goto out; } fe = (struct ocfs2_dinode *) bh->b_data; @@ -77,9 +77,10 @@ static int ocfs2_fast_symlink_readpage(struct file *unused, struct page *page) memcpy(kaddr, link, len + 1); kunmap_atomic(kaddr); SetPageUptodate(page); +out: unlock_page(page); brelse(bh); - return 0; + return status; } const struct address_space_operations ocfs2_fast_symlink_aops = { -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1473/1473] drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:72:28: sparse: sparse: symbol 'nic_cmd_support_vf' was not declared. Should it be static?
by kernel test robot 10 Mar '25

10 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 1584a68cf2ef23ac87ba506e8ab8ca7e261813c1 commit: 746ea35981b1f77e988d48642409d73f0470b3eb [1473/1473] net: hinic: Add Hardware Abstract Layer config: arm64-randconfig-r132-20250309 (https://download.01.org/0day-ci/archive/20250310/202503101044.1ARqFaAp-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250310/202503101044.1ARqFaAp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503101044.1ARqFaAp-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:72:28: sparse: sparse: symbol 'nic_cmd_support_vf' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:398:5: sparse: sparse: symbol 'hinic_hiovs_set_cpath_vlan' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:424:5: sparse: sparse: symbol 'hinic_hiovs_del_cpath_vlan' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1541:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] group_index @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1541:30: sparse: expected unsigned int [usertype] group_index drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1541:30: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1544:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] size @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1544:23: sparse: expected unsigned int [usertype] size drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1544:23: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1546:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] ctx @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1546:22: sparse: expected unsigned int [usertype] ctx drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1546:22: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1728:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] group_index @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1728:32: sparse: expected unsigned int [usertype] group_index drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1728:32: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1735:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1735:31: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1735:31: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1742:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] size @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1742:25: sparse: expected unsigned int [usertype] size drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1742:25: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1754:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] offset @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1754:27: sparse: expected unsigned int [usertype] offset drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1754:27: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1755:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] size @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1755:25: sparse: expected unsigned int [usertype] size drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1755:25: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:2349:5: sparse: sparse: symbol 'nic_pf_mbox_handler' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:3237:5: sparse: sparse: symbol 'hw_speed_convert' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:398:5: warning: no previous prototype for 'hinic_hiovs_set_cpath_vlan' [-Wmissing-prototypes] 398 | int hinic_hiovs_set_cpath_vlan(void *hwdev, u16 vlan_id, u16 pf_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:424:5: warning: no previous prototype for 'hinic_hiovs_del_cpath_vlan' [-Wmissing-prototypes] 424 | int hinic_hiovs_del_cpath_vlan(void *hwdev, u16 vlan_id, u16 pf_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:2349:5: warning: no previous prototype for 'nic_pf_mbox_handler' [-Wmissing-prototypes] 2349 | int nic_pf_mbox_handler(void *hwdev, u16 vf_id, u8 cmd, void *buf_in, | ^~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:346:6: sparse: sparse: symbol 'hinic_qp_prepare_cmdq_header' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:379:24: sparse: sparse: cast to restricted __be64 >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:365:6: sparse: sparse: symbol 'hinic_sq_prepare_ctxt' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:441:24: sparse: sparse: cast to restricted __be64 >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:427:6: sparse: sparse: symbol 'hinic_rq_prepare_ctxt' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:843:16: sparse: sparse: cast to restricted __be16 >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:913:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [addressable] [usertype] db_info @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:913:23: sparse: expected unsigned int [addressable] [usertype] db_info drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:913:23: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:917:9: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:917:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:917:9: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:917:9: sparse: got unsigned long long [usertype] * >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:974:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:974:27: sparse: expected unsigned short [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:974:27: sparse: got restricted __be16 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:346:6: warning: no previous prototype for 'hinic_qp_prepare_cmdq_header' [-Wmissing-prototypes] 346 | void hinic_qp_prepare_cmdq_header(struct hinic_qp_ctxt_header *qp_ctxt_hdr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:365:6: warning: no previous prototype for 'hinic_sq_prepare_ctxt' [-Wmissing-prototypes] 365 | void hinic_sq_prepare_ctxt(struct hinic_sq *sq, u16 global_qpn, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:427:6: warning: no previous prototype for 'hinic_rq_prepare_ctxt' [-Wmissing-prototypes] 427 | void hinic_rq_prepare_ctxt(struct hinic_rq *rq, struct hinic_rq_ctxt *rq_ctxt) | ^~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c:100:24: sparse: sparse: incorrect type in return expression (different base types) @@ expected unsigned short @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c:100:24: sparse: expected unsigned short drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c:100:24: sparse: got restricted __be16 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c:159:22: sparse: sparse: cast removes address space '__iomem' of expression -- >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:37:16: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: expected unsigned int [usertype] val drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:552:29: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base @@ got void *cfg_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:552:29: sparse: expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:552:29: sparse: got void *cfg_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:553:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *intr_regs_base @@ got void *intr_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:553:30: sparse: expected unsigned char [noderef] [usertype] __iomem *intr_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:553:30: sparse: got void *intr_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:557:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *db_base @@ got void *db_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:557:23: sparse: expected unsigned char [noderef] [usertype] __iomem *db_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:557:23: sparse: got void *db_base >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:558:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __iomem *dwqe_mapping @@ got void *dwqe_mapping @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:558:28: sparse: expected void [noderef] __iomem *dwqe_mapping drivers/net/ethernet/huawei/hinic/hinic_hwif.c:558:28: sparse: got void *dwqe_mapping drivers/net/ethernet/huawei/hinic/hinic_hwif.c:620:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:620:65: sparse: expected restricted gfp_t [usertype] flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:620:65: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:635:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:635:65: sparse: expected restricted gfp_t [usertype] flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:635:65: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:52: warning: Function parameter or member 'hwdev' not described in 'hwif_ready' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:52: warning: Excess function parameter 'hwif' description in 'hwif_ready' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'hwdev' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'cfg_reg_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'intr_reg_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'db_base_phy' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'db_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'dwqe_mapping' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Excess function parameter 'hwif' description in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Excess function parameter 'pdev' description in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:607: warning: Function parameter or member 'hwdev' not described in 'hinic_free_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:607: warning: Excess function parameter 'hwif' description in 'hinic_free_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:607: warning: Excess function parameter 'pdev' description in 'hinic_free_hwif' -- >> drivers/net/ethernet/huawei/hinic/hinic_eqs.c:418:29: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_eqs.c:426:39: sparse: sparse: mixing different enum types: drivers/net/ethernet/huawei/hinic/hinic_eqs.c:426:39: sparse: unsigned int enum hinic_aeq_type drivers/net/ethernet/huawei/hinic/hinic_eqs.c:426:39: sparse: unsigned int enum hinic_ucode_event_type >> drivers/net/ethernet/huawei/hinic/hinic_eqs.c:431:37: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/huawei/hinic/hinic_eqs.c:479:24: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_eqs.c:765:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_eqs.c:765:25: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_eqs.c:765:25: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_eqs.c:783:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] desc @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_eqs.c:783:28: sparse: expected unsigned int [usertype] desc drivers/net/ethernet/huawei/hinic/hinic_eqs.c:783:28: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_eqs.c: In function 'aeq_irq_handler': drivers/net/ethernet/huawei/hinic/hinic_eqs.c:426:37: warning: implicit conversion from 'enum hinic_aeq_type' to 'enum hinic_ucode_event_type' [-Wenum-conversion] 426 | ucode_event = event; | ^ drivers/net/ethernet/huawei/hinic/hinic_eqs.c:238: warning: Function parameter or member 'hwdev' not described in 'hinic_aeq_register_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:238: warning: Function parameter or member 'hwe_cb' not described in 'hinic_aeq_register_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:238: warning: Excess function parameter 'eqs' description in 'hinic_aeq_register_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:238: warning: Excess function parameter 'handle' description in 'hinic_aeq_register_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:238: warning: Excess function parameter 'hw_cb' description in 'hinic_aeq_register_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:258: warning: Function parameter or member 'hwdev' not described in 'hinic_aeq_unregister_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:258: warning: Excess function parameter 'eqs' description in 'hinic_aeq_unregister_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:280: warning: Function parameter or member 'hwdev' not described in 'hinic_aeq_register_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:280: warning: Function parameter or member 'aeq_swe_cb' not described in 'hinic_aeq_register_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:280: warning: Excess function parameter 'eqs' description in 'hinic_aeq_register_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:280: warning: Excess function parameter 'handle' description in 'hinic_aeq_register_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:280: warning: Excess function parameter 'sw_cb' description in 'hinic_aeq_register_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:300: warning: Function parameter or member 'hwdev' not described in 'hinic_aeq_unregister_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:300: warning: Excess function parameter 'eqs' description in 'hinic_aeq_unregister_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:322: warning: Function parameter or member 'hwdev' not described in 'hinic_ceq_register_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:322: warning: Function parameter or member 'callback' not described in 'hinic_ceq_register_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:322: warning: Excess function parameter 'ceqs' description in 'hinic_ceq_register_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:322: warning: Excess function parameter 'handle' description in 'hinic_ceq_register_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:322: warning: Excess function parameter 'ceq_cb' description in 'hinic_ceq_register_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:342: warning: Function parameter or member 'hwdev' not described in 'hinic_ceq_unregister_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:342: warning: Excess function parameter 'ceqs' description in 'hinic_ceq_unregister_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:361: warning: Function parameter or member 'arm_state' not described in 'set_eq_cons_idx' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:382: warning: Function parameter or member 'ceqs' not described in 'ceq_event_handler' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:382: warning: Excess function parameter 'eqs' description in 'ceq_event_handler' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:954: warning: Function parameter or member 'hwdev' not described in 'init_eq' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:954: warning: Excess function parameter 'hwif' description in 'init_eq' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:954: warning: Excess function parameter 'page_size' description in 'init_eq' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Function parameter or member 'hwdev' not described in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Function parameter or member 'num_aeqs' not described in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Excess function parameter 'aeqs' description in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Excess function parameter 'hwif' description in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Excess function parameter 'num_ceqs' description in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Excess function parameter 'q_len' description in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Excess function parameter 'page_size' description in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1139: warning: Function parameter or member 'hwdev' not described in 'hinic_aeqs_free' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1139: warning: Excess function parameter 'aeqs' description in 'hinic_aeqs_free' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1171: warning: Function parameter or member 'hwdev' not described in 'hinic_ceqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1171: warning: Excess function parameter 'ceqs' description in 'hinic_ceqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1171: warning: Excess function parameter 'hwif' description in 'hinic_ceqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1171: warning: Excess function parameter 'q_len' description in 'hinic_ceqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1171: warning: Excess function parameter 'page_size' description in 'hinic_ceqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1222: warning: Function parameter or member 'hwdev' not described in 'hinic_ceqs_free' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1222: warning: Excess function parameter 'ceqs' description in 'hinic_ceqs_free' -- >> drivers/net/ethernet/huawei/hinic/hinic_mbox.c:735:5: sparse: sparse: symbol 'set_vf_mbox_random_id' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_mbox.c:813:21: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_mbox.c:787:6: sparse: sparse: symbol 'check_vf_mbox_random_id' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_mbox.c:893:54: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:893:54: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/hinic/hinic_mbox.c:893:54: sparse: got unsigned char [usertype] * drivers/net/ethernet/huawei/hinic/hinic_mbox.c:909:58: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:909:58: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/hinic/hinic_mbox.c:909:58: sparse: got unsigned char [usertype] * >> drivers/net/ethernet/huawei/hinic/hinic_mbox.c:947:6: sparse: sparse: symbol 'dump_mox_reg' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_mbox.c:962:22: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/huawei/hinic/hinic_mbox.c:1450:25: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [usertype] *data @@ got unsigned char [noderef] [usertype] __iomem * @@ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:1450:25: sparse: expected unsigned char [usertype] *data drivers/net/ethernet/huawei/hinic/hinic_mbox.c:1450:25: sparse: got unsigned char [noderef] [usertype] __iomem * drivers/net/ethernet/huawei/hinic/hinic_mbox.c:735:5: warning: no previous prototype for 'set_vf_mbox_random_id' [-Wmissing-prototypes] 735 | int set_vf_mbox_random_id(struct hinic_hwdev *hwdev, u16 func_id) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:787:6: warning: no previous prototype for 'check_vf_mbox_random_id' [-Wmissing-prototypes] 787 | bool check_vf_mbox_random_id(struct hinic_mbox_func_to_func *func_to_func, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:947:6: warning: no previous prototype for 'dump_mox_reg' [-Wmissing-prototypes] 947 | void dump_mox_reg(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:265: warning: Function parameter or member 'hwdev' not described in 'hinic_register_ppf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:265: warning: Excess function parameter 'func_to_func' description in 'hinic_register_ppf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:287: warning: Function parameter or member 'hwdev' not described in 'hinic_register_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:287: warning: Excess function parameter 'func_to_func' description in 'hinic_register_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:309: warning: Function parameter or member 'hwdev' not described in 'hinic_register_vf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:309: warning: Excess function parameter 'func_to_func' description in 'hinic_register_vf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:331: warning: Function parameter or member 'hwdev' not described in 'hinic_register_ppf_to_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:331: warning: Excess function parameter 'func_to_func' description in 'hinic_register_ppf_to_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:350: warning: Function parameter or member 'hwdev' not described in 'hinic_unregister_ppf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:350: warning: Excess function parameter 'func_to_func' description in 'hinic_unregister_ppf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:364: warning: Function parameter or member 'hwdev' not described in 'hinic_unregister_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:364: warning: Excess function parameter 'func_to_func' description in 'hinic_unregister_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:378: warning: Function parameter or member 'hwdev' not described in 'hinic_unregister_vf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:378: warning: Excess function parameter 'func_to_func' description in 'hinic_unregister_vf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:392: warning: Function parameter or member 'hwdev' not described in 'hinic_unregister_ppf_to_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:392: warning: Excess function parameter 'func_to_func' description in 'hinic_unregister_ppf_to_pf_mbox_cb' -- >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:160:31: sparse: sparse: cast to restricted __be64 >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:241:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:241:20: sparse: expected unsigned long long [usertype] drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:241:20: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:302:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] desc @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:302:20: sparse: expected unsigned long long [usertype] desc drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:302:20: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:353:20: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:357:25: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:417:31: sparse: sparse: cast to restricted __be64 >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:776:41: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] hw_cmd_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:776:41: sparse: expected unsigned long long [usertype] hw_cmd_paddr drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:776:41: sparse: got restricted __be64 [usertype] drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:782:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] hw_cmd_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:782:42: sparse: expected unsigned long long [usertype] hw_cmd_paddr drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:782:42: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:809:37: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] hw_wb_resp_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:809:37: sparse: expected unsigned long long [usertype] hw_wb_resp_paddr drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:809:37: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:887:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] next_cell_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:887:43: sparse: expected unsigned long long [usertype] next_cell_paddr drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:887:43: sparse: got restricted __be64 [usertype] drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:930:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] next_cell_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:930:31: sparse: expected unsigned long long [usertype] next_cell_paddr drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:930:31: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:999:47: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected unsigned int flag @@ got restricted gfp_t @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:999:47: sparse: expected unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:999:47: sparse: got restricted gfp_t drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:515:17: sparse: sparse: context imbalance in 'api_cmd' - different lock contexts for basic block drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c: In function 'api_chain_init': drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1033:41: warning: suggest braces around empty body in an 'else' statement [-Wempty-body] 1033 | sema_deinit(&chain->sem); | ^ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c: In function 'api_chain_free': drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1056:41: warning: suggest braces around empty body in an 'else' statement [-Wempty-body] 1056 | sema_deinit(&chain->sem); | ^ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:197: warning: Function parameter or member 'cmd_size' not described in 'get_cell_data_size' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:411: warning: Function parameter or member 'ctxt' not described in 'wait_for_resp_polling' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:411: warning: Excess function parameter 'chain' description in 'wait_for_resp_polling' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:443: warning: Function parameter or member 'ctxt' not described in 'wait_for_api_cmd_completion' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:443: warning: Function parameter or member 'ack' not described in 'wait_for_api_cmd_completion' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:443: warning: Function parameter or member 'ack_size' not described in 'wait_for_api_cmd_completion' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:502: warning: Function parameter or member 'cmd_size' not described in 'api_cmd' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:502: warning: Function parameter or member 'ack' not described in 'api_cmd' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:502: warning: Function parameter or member 'ack_size' not described in 'api_cmd' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:502: warning: Excess function parameter 'size' description in 'api_cmd' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:565: warning: Function parameter or member 'cmd_chain' not described in 'api_cmd_hw_restart' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:565: warning: Excess function parameter 'chain' description in 'api_cmd_hw_restart' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1068: warning: Function parameter or member 'cmd_chain' not described in 'api_cmd_create_chain' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1068: warning: Excess function parameter 'chain' description in 'api_cmd_create_chain' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1132: warning: Function parameter or member 'hwdev' not described in 'hinic_api_cmd_init' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1132: warning: Excess function parameter 'hwif' description in 'hinic_api_cmd_init' -- >> drivers/net/ethernet/huawei/hinic/hinic_wq.c:208:55: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected unsigned int flag @@ got restricted gfp_t @@ drivers/net/ethernet/huawei/hinic/hinic_wq.c:208:55: sparse: expected unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_wq.c:208:55: sparse: got restricted gfp_t >> drivers/net/ethernet/huawei/hinic/hinic_wq.c:214:24: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_wq.c:214:24: sparse: expected unsigned long long [usertype] drivers/net/ethernet/huawei/hinic/hinic_wq.c:214:24: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_wq.c:587:16: sparse: sparse: cast to restricted __be64 -- >> drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:366:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [addressable] [usertype] db_info @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:366:20: sparse: expected unsigned int [addressable] [usertype] db_info drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:366:20: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:369:9: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:369:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:369:9: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:369:9: sparse: got unsigned char [usertype] * >> drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:511:31: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:517:40: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:517:40: sparse: expected unsigned long long [usertype] drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:517:40: sparse: got restricted __be64 [usertype] drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:531:21: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1080:27: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1151:25: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1217:37: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1245:31: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1315:26: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1315:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *db_base @@ got unsigned char [usertype] * @@ drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1315:23: sparse: expected unsigned char [noderef] [usertype] __iomem *db_base drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1315:23: sparse: got unsigned char [usertype] * >> drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1334:5: sparse: sparse: symbol 'hinic_set_cmdq_ctxts' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1334:5: warning: no previous prototype for 'hinic_set_cmdq_ctxts' [-Wmissing-prototypes] 1334 | int hinic_set_cmdq_ctxts(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:223:5: sparse: sparse: symbol 'hinic_hw_rx_buf_size' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:629:28: sparse: sparse: symbol 'hw_cmd_support_vf' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:659:30: sparse: sparse: symbol 'mgmt_status_log' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:722:6: sparse: sparse: symbol 'hinic_print_status_info' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1039:5: sparse: sparse: symbol 'hinic_msg_to_mgmt_no_ack' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1106:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1106:22: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1106:22: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1128:24: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1826:5: sparse: sparse: symbol 'hinic_sync_heartbeat_status' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1928:5: sparse: sparse: symbol 'comm_pf_mbox_handler' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2617:5: sparse: sparse: symbol 'ppf_ht_gpa_set' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2663:5: sparse: sparse: symbol 'hinic_ppf_ht_gpa_init' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2709:6: sparse: sparse: symbol 'hinic_ppf_ht_gpa_deinit' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4205:6: sparse: sparse: symbol 'pf_fault_event_handler' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4213:6: sparse: sparse: symbol 'mgmt_watchdog_event_handler' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4220:6: sparse: sparse: symbol 'mgmt_fmw_act_event_handler' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4227:6: sparse: sparse: symbol 'mgmt_pcie_dfx_event_handler' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4234:6: sparse: sparse: symbol 'mgmt_get_mctp_event_handler' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4517:5: sparse: sparse: symbol '_set_led_status' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4603:5: sparse: sparse: symbol 'hinic_get_phy_init_status' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4807:5: sparse: sparse: symbol 'hinic_read_reg' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4985:23: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4991:21: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [addressable] [assigned] [usertype] val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4991:21: sparse: expected unsigned int [addressable] [assigned] [usertype] val drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4991:21: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:722:6: warning: no previous prototype for 'hinic_print_status_info' [-Wmissing-prototypes] 722 | void hinic_print_status_info(void *hwdev, enum hinic_mod_type mod, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1039:5: warning: no previous prototype for 'hinic_msg_to_mgmt_no_ack' [-Wmissing-prototypes] 1039 | int hinic_msg_to_mgmt_no_ack(void *hwdev, enum hinic_mod_type mod, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1826:5: warning: no previous prototype for 'hinic_sync_heartbeat_status' [-Wmissing-prototypes] 1826 | int hinic_sync_heartbeat_status(struct hinic_hwdev *hwdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1928:5: warning: no previous prototype for 'comm_pf_mbox_handler' [-Wmissing-prototypes] 1928 | int comm_pf_mbox_handler(void *handle, u16 vf_id, u8 cmd, void *buf_in, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2617:5: warning: no previous prototype for 'ppf_ht_gpa_set' [-Wmissing-prototypes] 2617 | int ppf_ht_gpa_set(struct hinic_hwdev *hwdev, struct hinic_page_addr *pg0, | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2663:5: warning: no previous prototype for 'hinic_ppf_ht_gpa_init' [-Wmissing-prototypes] 2663 | int hinic_ppf_ht_gpa_init(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2709:6: warning: no previous prototype for 'hinic_ppf_ht_gpa_deinit' [-Wmissing-prototypes] 2709 | void hinic_ppf_ht_gpa_deinit(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2786:5: warning: no previous prototype for 'mqm_eqm_try_alloc_mem' [-Wmissing-prototypes] 2786 | int mqm_eqm_try_alloc_mem(struct hinic_hwdev *hwdev, u32 page_size, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2823:5: warning: no previous prototype for 'mqm_eqm_alloc_page_mem' [-Wmissing-prototypes] 2823 | int mqm_eqm_alloc_page_mem(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2848:6: warning: no previous prototype for 'mqm_eqm_free_page_mem' [-Wmissing-prototypes] 2848 | void mqm_eqm_free_page_mem(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2864:5: warning: no previous prototype for 'mqm_eqm_set_cfg_2_hw' [-Wmissing-prototypes] 2864 | int mqm_eqm_set_cfg_2_hw(struct hinic_hwdev *hwdev, u32 valid) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2889:5: warning: no previous prototype for 'mqm_eqm_set_page_2_hw' [-Wmissing-prototypes] 2889 | int mqm_eqm_set_page_2_hw(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2967:5: warning: no previous prototype for 'mqm_eqm_init' [-Wmissing-prototypes] 2967 | int mqm_eqm_init(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3030:6: warning: no previous prototype for 'mqm_eqm_deinit' [-Wmissing-prototypes] 3030 | void mqm_eqm_deinit(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3932:6: warning: no previous prototype for 'print_hilink_info' [-Wmissing-prototypes] 3932 | void print_hilink_info(struct hinic_hwdev *hwdev, | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4205:6: warning: no previous prototype for 'pf_fault_event_handler' [-Wmissing-prototypes] 4205 | void pf_fault_event_handler(void *hwdev, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4213:6: warning: no previous prototype for 'mgmt_watchdog_event_handler' [-Wmissing-prototypes] 4213 | void mgmt_watchdog_event_handler(void *hwdev, void *buf_in, u16 in_size, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4220:6: warning: no previous prototype for 'mgmt_fmw_act_event_handler' [-Wmissing-prototypes] 4220 | void mgmt_fmw_act_event_handler(void *hwdev, void *buf_in, u16 in_size, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4227:6: warning: no previous prototype for 'mgmt_pcie_dfx_event_handler' [-Wmissing-prototypes] 4227 | void mgmt_pcie_dfx_event_handler(void *hwdev, void *buf_in, u16 in_size, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4234:6: warning: no previous prototype for 'mgmt_get_mctp_event_handler' [-Wmissing-prototypes] 4234 | void mgmt_get_mctp_event_handler(void *hwdev, void *buf_in, u16 in_size, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4517:5: warning: no previous prototype for '_set_led_status' [-Wmissing-prototypes] 4517 | int _set_led_status(struct hinic_hwdev *hwdev, u8 port, | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4603:5: warning: no previous prototype for 'hinic_get_phy_init_status' [-Wmissing-prototypes] 4603 | int hinic_get_phy_init_status(void *hwdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4807:5: warning: no previous prototype for 'hinic_read_reg' [-Wmissing-prototypes] 4807 | int hinic_read_reg(void *hwdev, u32 reg_addr, u32 *val) | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4894:5: warning: no previous prototype for 'hinic_register_fault_recover' [-Wmissing-prototypes] 4894 | int hinic_register_fault_recover(void *hwdev, void *pri_handle, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4916:5: warning: no previous prototype for 'hinic_unregister_fault_recover' [-Wmissing-prototypes] 4916 | int hinic_unregister_fault_recover(void *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c: In function '__print_cable_info.isra': drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3849:29: warning: ', Temperature: ' directive output may be truncated writing 15 bytes into a region of size between 0 and 511 [-Wformat-truncation=] 3849 | "%s, Temperature: %u", tmp_str, | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3849:26: note: directive argument in the range [0, 255] 3849 | "%s, Temperature: %u", tmp_str, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3848:17: note: 'snprintf' output between 17 and 530 bytes into a destination of size 511 3848 | snprintf(tmp_str, sizeof(tmp_str) - 1, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3849 | "%s, Temperature: %u", tmp_str, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3850 | info->cable_temp); | ~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3848:17: warning: 'snprintf' argument 4 overlaps destination object 'tmp_str' [-Wrestrict] drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3812:14: note: destination object referenced by 'restrict'-qualified argument 1 was declared here 3812 | char tmp_str[512] = {0}; | ^~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1721: warning: Function parameter or member 'hwdev' not described in 'set_pf_dma_attr_entry' drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1721: warning: Excess function parameter 'hwif' description in 'set_pf_dma_attr_entry' drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1780: warning: Function parameter or member 'hwdev' not described in 'dma_attr_table_init' drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1780: warning: Excess function parameter 'hwif' description in 'dma_attr_table_init' -- >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:41:6: sparse: sparse: symbol 'g_test_qpc_num' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:42:6: sparse: sparse: symbol 'g_test_qpc_resvd_num' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:43:6: sparse: sparse: symbol 'g_test_pagesize_reorder' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:44:6: sparse: sparse: symbol 'g_test_xid_alloc_mode' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:45:6: sparse: sparse: symbol 'g_test_gpa_check_enable' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:46:6: sparse: sparse: symbol 'g_test_qpc_alloc_mode' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:47:6: sparse: sparse: symbol 'g_test_scqc_alloc_mode' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:48:6: sparse: sparse: symbol 'g_test_max_conn' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:49:6: sparse: sparse: symbol 'g_test_max_cache_conn' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:50:6: sparse: sparse: symbol 'g_test_scqc_num' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:51:6: sparse: sparse: symbol 'g_test_mpt_num' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:52:6: sparse: sparse: symbol 'g_test_mpt_resvd' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:53:6: sparse: sparse: symbol 'g_test_scq_resvd' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:54:6: sparse: sparse: symbol 'g_test_hash_num' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:55:6: sparse: sparse: symbol 'g_test_reorder_num' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1411:5: sparse: sparse: symbol 'init_cfg_mgmt' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1458:6: sparse: sparse: symbol 'free_cfg_mgmt' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1493:5: sparse: sparse: symbol 'init_capability' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1522:6: sparse: sparse: symbol 'free_capability' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1732:5: sparse: sparse: symbol 'cfg_set_func_sf_en' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1770:5: sparse: sparse: symbol 'cfg_get_func_sf_en' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1096:5: warning: no previous prototype for 'hinic_vector_to_irq' [-Wmissing-prototypes] 1096 | int hinic_vector_to_irq(void *hwdev, enum hinic_service_type type, int vector) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1411:5: warning: no previous prototype for 'init_cfg_mgmt' [-Wmissing-prototypes] 1411 | int init_cfg_mgmt(struct hinic_hwdev *dev) | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1458:6: warning: no previous prototype for 'free_cfg_mgmt' [-Wmissing-prototypes] 1458 | void free_cfg_mgmt(struct hinic_hwdev *dev) | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1493:5: warning: no previous prototype for 'init_capability' [-Wmissing-prototypes] 1493 | int init_capability(struct hinic_hwdev *dev) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1522:6: warning: no previous prototype for 'free_capability' [-Wmissing-prototypes] 1522 | void free_capability(struct hinic_hwdev *dev) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1732:5: warning: no previous prototype for 'cfg_set_func_sf_en' [-Wmissing-prototypes] 1732 | int cfg_set_func_sf_en(void *hwdev, u32 enbits, u32 enmask) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1770:5: warning: no previous prototype for 'cfg_get_func_sf_en' [-Wmissing-prototypes] 1770 | int cfg_get_func_sf_en(void *hwdev, u32 *enbits) | ^~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:66:6: sparse: sparse: symbol 'get_slave_host_enable' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:589:6: sparse: sparse: symbol 'comm_ppf_to_pf_handler' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:607:5: sparse: sparse: symbol 'hinic_nic_ppf_mbox_handler' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:616:6: sparse: sparse: symbol 'hinic_nic_ppf_to_pf_handler' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:625:5: sparse: sparse: symbol 'hinic_register_slave_ppf' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:66:6: warning: no previous prototype for 'get_slave_host_enable' [-Wmissing-prototypes] 66 | bool get_slave_host_enable(struct hinic_hwdev *hwdev, u8 host_id) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:209:5: warning: no previous prototype for '__mbox_to_host' [-Wmissing-prototypes] 209 | int __mbox_to_host(struct hinic_hwdev *hwdev, enum hinic_mod_type mod, | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:483:5: warning: no previous prototype for 'sw_func_ppf_mbox_handler' [-Wmissing-prototypes] 483 | int sw_func_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:506:5: warning: no previous prototype for '__ppf_process_mbox_msg' [-Wmissing-prototypes] 506 | int __ppf_process_mbox_msg(struct hinic_hwdev *hwdev, u16 pf_idx, u16 vf_id, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:580:5: warning: no previous prototype for 'comm_ppf_mbox_handler' [-Wmissing-prototypes] 580 | int comm_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:589:6: warning: no previous prototype for 'comm_ppf_to_pf_handler' [-Wmissing-prototypes] 589 | void comm_ppf_to_pf_handler(void *handle, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:598:5: warning: no previous prototype for 'hilink_ppf_mbox_handler' [-Wmissing-prototypes] 598 | int hilink_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:607:5: warning: no previous prototype for 'hinic_nic_ppf_mbox_handler' [-Wmissing-prototypes] 607 | int hinic_nic_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:616:6: warning: no previous prototype for 'hinic_nic_ppf_to_pf_handler' [-Wmissing-prototypes] 616 | void hinic_nic_ppf_to_pf_handler(void *handle, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:625:5: warning: no previous prototype for 'hinic_register_slave_ppf' [-Wmissing-prototypes] 625 | int hinic_register_slave_ppf(struct hinic_hwdev *hwdev, bool registered) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:686:5: warning: no previous prototype for 'set_slave_func_nic_state' [-Wmissing-prototypes] 686 | int set_slave_func_nic_state(struct hinic_hwdev *hwdev, u16 func_idx, u8 en) | ^~~~~~~~~~~~~~~~~~~~~~~~ vim +/nic_cmd_support_vf +72 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c 71 > 72 struct vf_cmd_check_handle nic_cmd_support_vf[] = { 73 {HINIC_PORT_CMD_VF_REGISTER, NULL}, 74 {HINIC_PORT_CMD_VF_UNREGISTER, NULL}, 75 76 {HINIC_PORT_CMD_CHANGE_MTU, hinic_mbox_check_func_id_8B}, 77 78 {HINIC_PORT_CMD_ADD_VLAN, hinic_mbox_check_func_id_8B}, 79 {HINIC_PORT_CMD_DEL_VLAN, hinic_mbox_check_func_id_8B}, 80 81 {HINIC_PORT_CMD_SET_MAC, hinic_mbox_check_func_id_8B}, 82 {HINIC_PORT_CMD_GET_MAC, hinic_mbox_check_func_id_8B}, 83 {HINIC_PORT_CMD_DEL_MAC, hinic_mbox_check_func_id_8B}, 84 85 {HINIC_PORT_CMD_SET_RX_MODE, hinic_mbox_check_func_id_8B}, 86 87 {HINIC_PORT_CMD_GET_PAUSE_INFO, hinic_mbox_check_func_id_8B}, 88 89 {HINIC_PORT_CMD_GET_LINK_STATE, hinic_mbox_check_func_id_8B}, 90 {HINIC_PORT_CMD_SET_LRO, hinic_mbox_check_func_id_8B}, 91 {HINIC_PORT_CMD_SET_RX_CSUM, hinic_mbox_check_func_id_8B}, 92 {HINIC_PORT_CMD_SET_RX_VLAN_OFFLOAD, hinic_mbox_check_func_id_8B}, 93 94 {HINIC_PORT_CMD_GET_VPORT_STAT, hinic_mbox_check_func_id_8B}, 95 {HINIC_PORT_CMD_CLEAN_VPORT_STAT, hinic_mbox_check_func_id_8B}, 96 97 {HINIC_PORT_CMD_GET_RSS_TEMPLATE_INDIR_TBL, 98 hinic_mbox_check_func_id_8B}, 99 {HINIC_PORT_CMD_SET_RSS_TEMPLATE_INDIR_TBL, 100 hinic_mbox_check_func_id_8B}, 101 {HINIC_PORT_CMD_SET_RSS_TEMPLATE_TBL, hinic_mbox_check_func_id_8B}, 102 {HINIC_PORT_CMD_GET_RSS_TEMPLATE_TBL, hinic_mbox_check_func_id_8B}, 103 {HINIC_PORT_CMD_SET_RSS_HASH_ENGINE, hinic_mbox_check_func_id_8B}, 104 {HINIC_PORT_CMD_GET_RSS_HASH_ENGINE, hinic_mbox_check_func_id_8B}, 105 {HINIC_PORT_CMD_GET_RSS_CTX_TBL, hinic_mbox_check_func_id_8B}, 106 {HINIC_PORT_CMD_SET_RSS_CTX_TBL, hinic_mbox_check_func_id_8B}, 107 {HINIC_PORT_CMD_RSS_TEMP_MGR, hinic_mbox_check_func_id_8B}, 108 {HINIC_PORT_CMD_RSS_CFG, hinic_mbox_check_func_id_8B}, 109 110 {HINIC_PORT_CMD_INIT_FUNC, check_func_table}, 111 {HINIC_PORT_CMD_SET_LLI_PRI, hinic_mbox_check_func_id_8B}, 112 113 {HINIC_PORT_CMD_GET_MGMT_VERSION, NULL}, 114 {HINIC_PORT_CMD_GET_BOOT_VERSION, NULL}, 115 {HINIC_PORT_CMD_GET_MICROCODE_VERSION, NULL}, 116 117 {HINIC_PORT_CMD_GET_VPORT_ENABLE, hinic_mbox_check_func_id_8B}, 118 {HINIC_PORT_CMD_SET_VPORT_ENABLE, hinic_mbox_check_func_id_8B}, 119 120 {HINIC_PORT_CMD_GET_LRO, hinic_mbox_check_func_id_8B}, 121 {HINIC_PORT_CMD_GET_GLOBAL_QPN, hinic_mbox_check_func_id_8B}, 122 123 {HINIC_PORT_CMD_SET_TSO, hinic_mbox_check_func_id_8B}, 124 {HINIC_PORT_CMD_SET_RQ_IQ_MAP, hinic_mbox_check_func_id_8B}, 125 {HINIC_PORT_CMD_LINK_STATUS_REPORT, hinic_mbox_check_func_id_8B}, 126 {HINIC_PORT_CMD_UPDATE_MAC, hinic_mbox_check_func_id_8B}, 127 128 {HINIC_PORT_CMD_GET_PORT_INFO, hinic_mbox_check_func_id_8B}, 129 130 {HINIC_PORT_CMD_SET_IPSU_MAC, hinic_mbox_check_func_id_10B}, 131 {HINIC_PORT_CMD_GET_IPSU_MAC, hinic_mbox_check_func_id_10B}, 132 133 {HINIC_PORT_CMD_GET_LINK_MODE, hinic_mbox_check_func_id_8B}, 134 135 {HINIC_PORT_CMD_CLEAR_SQ_RES, hinic_mbox_check_func_id_8B}, 136 {HINIC_PORT_CMD_SET_SUPER_CQE, hinic_mbox_check_func_id_8B}, 137 138 {HINIC_PORT_CMD_GET_VF_COS, NULL}, 139 {HINIC_PORT_CMD_SET_VHD_CFG, hinic_mbox_check_func_id_8B}, 140 141 {HINIC_PORT_CMD_SET_VLAN_FILTER, hinic_mbox_check_func_id_8B}, 142 }; 143 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] tracing/histograms: Fix memory leak problem
by Li Huafei 10 Mar '25

10 Mar '25

From: Zheng Yejian <zhengyejian1(a)huawei.com> stable inclusion from stable-v4.19.253 commit eb622d5580b9e2ff694f62da6410618bd73853cb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6IV CVE: CVE-2022-49648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7edc3945bdce9c39198a10d6129377a5c53559c2 upstream. This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac. As commit 46bbe5c671e0 ("tracing: fix double free") said, the "double free" problem reported by clang static analyzer is: > In parse_var_defs() if there is a problem allocating > var_defs.expr, the earlier var_defs.name is freed. > This free is duplicated by free_var_defs() which frees > the rest of the list. However, if there is a problem allocating N-th var_defs.expr: + in parse_var_defs(), the freed 'earlier var_defs.name' is actually the N-th var_defs.name; + then in free_var_defs(), the names from 0th to (N-1)-th are freed; IF ALLOCATING PROBLEM HAPPENED HERE!!! -+ \ | 0th 1th (N-1)-th N-th V +-------------+-------------+-----+-------------+----------- var_defs: | name | expr | name | expr | ... | name | expr | name | /// +-------------+-------------+-----+-------------+----------- These two frees don't act on same name, so there was no "double free" problem before. Conversely, after that commit, we get a "memory leak" problem because the above "N-th var_defs.name" is not freed. If enable CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th var_defs.expr allocated, then execute on shell like: $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \ /sys/kernel/debug/tracing/events/kmem/kmalloc/trigger Then kmemleak reports: unreferenced object 0xffff8fb100ef3518 (size 8): comm "bash", pid 196, jiffies 4295681690 (age 28.538s) hex dump (first 8 bytes): 76 31 00 00 b1 8f ff ff v1...... backtrace: [<0000000038fe4895>] kstrdup+0x2d/0x60 [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0 [<00000000ae70d2cc>] trigger_process_regex+0xc0/0x110 [<0000000066737a4c>] event_trigger_write+0x75/0xd0 [<000000007341e40c>] vfs_write+0xbb/0x2a0 [<0000000087fde4c2>] ksys_write+0x59/0xd0 [<00000000581e9cdf>] do_syscall_64+0x3a/0x80 [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Link: https://lkml.kernel.org/r/20220711014731.69520-1-zhengyejian1@huawei.com Cc: stable(a)vger.kernel.org Fixes: 46bbe5c671e0 ("tracing: fix double free") Reported-by: Hulk Robot <hulkci(a)huawei.com> Suggested-by: Steven Rostedt <rostedt(a)goodmis.org> Reviewed-by: Tom Zanussi <tom.zanussi(a)linux.intel.com> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- kernel/trace/trace_events_hist.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 638566ea7839..2f57eb241ac9 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -4155,6 +4155,8 @@ static int parse_var_defs(struct hist_trigger_data *hist_data) s = kstrdup(field_str, GFP_KERNEL); if (!s) { + kfree(hist_data->attrs->var_defs.name[n_vars]); + hist_data->attrs->var_defs.name[n_vars] = NULL; ret = -ENOMEM; goto free; } -- 2.25.1

2 1

[openeuler:OLK-6.6 2007/2007] kernel/kexec_core.c:1066: undefined reference to `machine_crash_shutdown'
by kernel test robot 09 Mar '25

09 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 944ce05f6b83ba40c4382c6b90b7b94f529118d3 commit: 47ff774cbb440dfc3cf5d5bc7cf82b41d4d99966 [2007/2007] x86, crash: wrap crash dumping code into crash related ifdefs config: x86_64-randconfig-r121-20250309 (https://download.01.org/0day-ci/archive/20250309/202503091909.W4esTcVo-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250309/202503091909.W4esTcVo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503091909.W4esTcVo-lkp@intel.com/ All errors (new ones prefixed by >>): ld: kernel/kexec_core.o: in function `__crash_kexec': >> kernel/kexec_core.c:1066: undefined reference to `machine_crash_shutdown' ld: kernel/kexec.o: in function `do_kexec_load': >> kernel/kexec.c:105: undefined reference to `arch_kexec_unprotect_crashkres' >> ld: kernel/kexec.c:166: undefined reference to `arch_kexec_protect_crashkres' ld: kernel/kexec_file.o: in function `__do_sys_kexec_file_load': >> kernel/kexec_file.c:350: undefined reference to `arch_kexec_unprotect_crashkres' >> ld: kernel/kexec_file.c:415: undefined reference to `arch_kexec_protect_crashkres' vim +1066 kernel/kexec_core.c 7e99f8b69c11c1 Ricardo Ribalda 2023-01-04 1044 7bbee5ca3896f6 Hidehiro Kawai 2015-12-14 1045 /* 7bbee5ca3896f6 Hidehiro Kawai 2015-12-14 1046 * No panic_cpu check version of crash_kexec(). This function is called 7bbee5ca3896f6 Hidehiro Kawai 2015-12-14 1047 * only when panic_cpu holds the current CPU number; this is the only CPU 7bbee5ca3896f6 Hidehiro Kawai 2015-12-14 1048 * which processes crash_kexec routines. 7bbee5ca3896f6 Hidehiro Kawai 2015-12-14 1049 */ c207aee48037ab Josh Poimboeuf 2017-06-28 1050 void __noclone __crash_kexec(struct pt_regs *regs) 2965faa5e03d1e Dave Young 2015-09-09 1051 { 05c6257433b721 Valentin Schneider 2022-06-30 1052 /* Take the kexec_lock here to prevent sys_kexec_load 2965faa5e03d1e Dave Young 2015-09-09 1053 * running on one cpu from replacing the crash kernel 2965faa5e03d1e Dave Young 2015-09-09 1054 * we are using after a panic on a different cpu. 2965faa5e03d1e Dave Young 2015-09-09 1055 * 2965faa5e03d1e Dave Young 2015-09-09 1056 * If the crash kernel was not located in a fixed area 2965faa5e03d1e Dave Young 2015-09-09 1057 * of memory the xchg(&kexec_crash_image) would be 2965faa5e03d1e Dave Young 2015-09-09 1058 * sufficient. But since I reuse the memory... 2965faa5e03d1e Dave Young 2015-09-09 1059 */ 05c6257433b721 Valentin Schneider 2022-06-30 1060 if (kexec_trylock()) { 2965faa5e03d1e Dave Young 2015-09-09 1061 if (kexec_crash_image) { 2965faa5e03d1e Dave Young 2015-09-09 1062 struct pt_regs fixed_regs; 2965faa5e03d1e Dave Young 2015-09-09 1063 2965faa5e03d1e Dave Young 2015-09-09 1064 crash_setup_regs(&fixed_regs, regs); 2965faa5e03d1e Dave Young 2015-09-09 1065 crash_save_vmcoreinfo(); 2965faa5e03d1e Dave Young 2015-09-09 @1066 machine_crash_shutdown(&fixed_regs); 2965faa5e03d1e Dave Young 2015-09-09 1067 machine_kexec(kexec_crash_image); 2965faa5e03d1e Dave Young 2015-09-09 1068 } 05c6257433b721 Valentin Schneider 2022-06-30 1069 kexec_unlock(); 2965faa5e03d1e Dave Young 2015-09-09 1070 } 2965faa5e03d1e Dave Young 2015-09-09 1071 } c207aee48037ab Josh Poimboeuf 2017-06-28 1072 STACK_FRAME_NON_STANDARD(__crash_kexec); 2965faa5e03d1e Dave Young 2015-09-09 1073 :::::: The code at line 1066 was first introduced by commit :::::: 2965faa5e03d1e71e9ff9aa143fff39e0a77543a kexec: split kexec_load syscall from kexec core code :::::: TO: Dave Young <dyoung(a)redhat.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2007/2007] ld: kernel/kexec.c:105: undefined reference to `arch_kexec_unprotect_crashkres'
by kernel test robot 09 Mar '25

09 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 944ce05f6b83ba40c4382c6b90b7b94f529118d3 commit: 47ff774cbb440dfc3cf5d5bc7cf82b41d4d99966 [2007/2007] x86, crash: wrap crash dumping code into crash related ifdefs config: x86_64-randconfig-123-20250309 (https://download.01.org/0day-ci/archive/20250309/202503091725.g6h6oRC3-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250309/202503091725.g6h6oRC3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503091725.g6h6oRC3-lkp@intel.com/ All errors (new ones prefixed by >>): ld: vmlinux.o: in function `__crash_kexec': kernel/kexec_core.c:1066: undefined reference to `machine_crash_shutdown' ld: vmlinux.o: in function `do_kexec_load': >> kernel/kexec.c:166: undefined reference to `arch_kexec_protect_crashkres' >> ld: kernel/kexec.c:105: undefined reference to `arch_kexec_unprotect_crashkres' ld: vmlinux.o: in function `__do_sys_kexec_file_load': kernel/kexec_file.c:350: undefined reference to `arch_kexec_unprotect_crashkres' ld: kernel/kexec_file.c:415: undefined reference to `arch_kexec_protect_crashkres' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1473/1473] mm/khugepaged.c:974:21: sparse: sparse: invalid assignment: |=
by kernel test robot 09 Mar '25

09 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 1584a68cf2ef23ac87ba506e8ab8ca7e261813c1 commit: ff0fb9e816fac221fa24a1810dd895745406070b [1473/1473] mm: thp: Add memory reliable support for hugepaged collapse config: arm64-randconfig-r113-20250309 (https://download.01.org/0day-ci/archive/20250309/202503091715.gswAJqxr-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250309/202503091715.gswAJqxr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503091715.gswAJqxr-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/khugepaged.c:974:21: sparse: sparse: invalid assignment: |= mm/khugepaged.c:974:21: sparse: left side has type restricted gfp_t mm/khugepaged.c:974:21: sparse: right side has type unsigned int mm/khugepaged.c:1352:21: sparse: sparse: invalid assignment: |= mm/khugepaged.c:1352:21: sparse: left side has type restricted gfp_t mm/khugepaged.c:1352:21: sparse: right side has type unsigned int mm/khugepaged.c:1378:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ mm/khugepaged.c:1378:9: sparse: expected void **slot mm/khugepaged.c:1378:9: sparse: got void [noderef] __rcu ** mm/khugepaged.c:1378:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ mm/khugepaged.c:1378:9: sparse: expected void **slot mm/khugepaged.c:1378:9: sparse: got void [noderef] __rcu ** mm/khugepaged.c:1409:56: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __rcu **slot @@ got void **slot @@ mm/khugepaged.c:1409:56: sparse: expected void [noderef] __rcu **slot mm/khugepaged.c:1409:56: sparse: got void **slot mm/khugepaged.c:1458:22: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ mm/khugepaged.c:1458:22: sparse: expected void **slot mm/khugepaged.c:1458:22: sparse: got void [noderef] __rcu ** mm/khugepaged.c:1459:17: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __rcu **slot @@ got void **slot @@ mm/khugepaged.c:1459:17: sparse: expected void [noderef] __rcu **slot mm/khugepaged.c:1459:17: sparse: got void **slot mm/khugepaged.c:1483:60: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] __rcu **slot @@ got void **slot @@ mm/khugepaged.c:1483:60: sparse: expected void [noderef] __rcu **slot mm/khugepaged.c:1483:60: sparse: got void **slot mm/khugepaged.c:1486:47: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __rcu **slot @@ got void **slot @@ mm/khugepaged.c:1486:47: sparse: expected void [noderef] __rcu **slot mm/khugepaged.c:1486:47: sparse: got void **slot mm/khugepaged.c:1486:22: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ mm/khugepaged.c:1486:22: sparse: expected void **slot mm/khugepaged.c:1486:22: sparse: got void [noderef] __rcu ** mm/khugepaged.c:1378:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __rcu **slot @@ got void **slot @@ mm/khugepaged.c:1378:9: sparse: expected void [noderef] __rcu **slot mm/khugepaged.c:1378:9: sparse: got void **slot mm/khugepaged.c:1378:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ mm/khugepaged.c:1378:9: sparse: expected void **slot mm/khugepaged.c:1378:9: sparse: got void [noderef] __rcu ** mm/khugepaged.c:1578:17: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ mm/khugepaged.c:1578:17: sparse: expected void **slot mm/khugepaged.c:1578:17: sparse: got void [noderef] __rcu ** mm/khugepaged.c:1578:17: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ mm/khugepaged.c:1578:17: sparse: expected void **slot mm/khugepaged.c:1578:17: sparse: got void [noderef] __rcu ** mm/khugepaged.c:1597:68: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] __rcu **slot @@ got void **slot @@ mm/khugepaged.c:1597:68: sparse: expected void [noderef] __rcu **slot mm/khugepaged.c:1597:68: sparse: got void **slot mm/khugepaged.c:1598:55: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __rcu **slot @@ got void **slot @@ mm/khugepaged.c:1598:55: sparse: expected void [noderef] __rcu **slot mm/khugepaged.c:1598:55: sparse: got void **slot mm/khugepaged.c:1598:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ mm/khugepaged.c:1598:30: sparse: expected void **slot mm/khugepaged.c:1598:30: sparse: got void [noderef] __rcu ** mm/khugepaged.c:1578:17: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __rcu **slot @@ got void **slot @@ mm/khugepaged.c:1578:17: sparse: expected void [noderef] __rcu **slot mm/khugepaged.c:1578:17: sparse: got void **slot mm/khugepaged.c:1578:17: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ mm/khugepaged.c:1578:17: sparse: expected void **slot mm/khugepaged.c:1578:17: sparse: got void [noderef] __rcu ** mm/khugepaged.c:1633:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ mm/khugepaged.c:1633:9: sparse: expected void **slot mm/khugepaged.c:1633:9: sparse: got void [noderef] __rcu ** mm/khugepaged.c:1633:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ mm/khugepaged.c:1633:9: sparse: expected void **slot mm/khugepaged.c:1633:9: sparse: got void [noderef] __rcu ** mm/khugepaged.c:1637:46: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __rcu **slot @@ got void **slot @@ mm/khugepaged.c:1637:46: sparse: expected void [noderef] __rcu **slot mm/khugepaged.c:1637:46: sparse: got void **slot mm/khugepaged.c:1639:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ mm/khugepaged.c:1639:30: sparse: expected void **slot mm/khugepaged.c:1639:30: sparse: got void [noderef] __rcu ** mm/khugepaged.c:1682:55: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __rcu **slot @@ got void **slot @@ mm/khugepaged.c:1682:55: sparse: expected void [noderef] __rcu **slot mm/khugepaged.c:1682:55: sparse: got void **slot mm/khugepaged.c:1682:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ mm/khugepaged.c:1682:30: sparse: expected void **slot mm/khugepaged.c:1682:30: sparse: got void [noderef] __rcu ** mm/khugepaged.c:1633:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __rcu **slot @@ got void **slot @@ mm/khugepaged.c:1633:9: sparse: expected void [noderef] __rcu **slot mm/khugepaged.c:1633:9: sparse: got void **slot mm/khugepaged.c:1633:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void **slot @@ got void [noderef] __rcu ** @@ mm/khugepaged.c:1633:9: sparse: expected void **slot mm/khugepaged.c:1633:9: sparse: got void [noderef] __rcu ** mm/khugepaged.c: note: in included file (through include/linux/mm.h): include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer In file included from arch/arm64/include/asm/atomic.h:36, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from include/asm-generic/bug.h:18, from arch/arm64/include/asm/bug.h:37, from include/linux/bug.h:5, from include/linux/mmdebug.h:5, from include/linux/mm.h:10, from mm/khugepaged.c:4: In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, vim +974 mm/khugepaged.c 949 950 static void collapse_huge_page(struct mm_struct *mm, 951 unsigned long address, 952 struct page **hpage, 953 int node, int referenced, int unmapped, 954 bool reliable) 955 { 956 pmd_t *pmd, _pmd; 957 pte_t *pte; 958 pgtable_t pgtable; 959 struct page *new_page; 960 spinlock_t *pmd_ptl, *pte_ptl; 961 int isolated = 0, result = 0; 962 struct mem_cgroup *memcg; 963 struct vm_area_struct *vma; 964 unsigned long mmun_start; /* For mmu_notifiers */ 965 unsigned long mmun_end; /* For mmu_notifiers */ 966 gfp_t gfp; 967 968 VM_BUG_ON(address & ~HPAGE_PMD_MASK); 969 970 /* Only allocate from the target node */ 971 gfp = alloc_hugepage_khugepaged_gfpmask() | __GFP_THISNODE; 972 973 if (reliable) > 974 gfp |= ___GFP_RELIABILITY; 975 976 /* 977 * Before allocating the hugepage, release the mmap_sem read lock. 978 * The allocation can take potentially a long time if it involves 979 * sync compaction, and we do not need to hold the mmap_sem during 980 * that. We will recheck the vma after taking it again in write mode. 981 */ 982 up_read(&mm->mmap_sem); 983 new_page = khugepaged_alloc_page(hpage, gfp, node); 984 if (!new_page) { 985 result = SCAN_ALLOC_HUGE_PAGE_FAIL; 986 goto out_nolock; 987 } 988 989 if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp, &memcg, true))) { 990 result = SCAN_CGROUP_CHARGE_FAIL; 991 goto out_nolock; 992 } 993 994 down_read(&mm->mmap_sem); 995 result = hugepage_vma_revalidate(mm, address, &vma); 996 if (result) { 997 mem_cgroup_cancel_charge(new_page, memcg, true); 998 up_read(&mm->mmap_sem); 999 goto out_nolock; 1000 } 1001 1002 pmd = mm_find_pmd(mm, address); 1003 if (!pmd) { 1004 result = SCAN_PMD_NULL; 1005 mem_cgroup_cancel_charge(new_page, memcg, true); 1006 up_read(&mm->mmap_sem); 1007 goto out_nolock; 1008 } 1009 1010 /* 1011 * __collapse_huge_page_swapin always returns with mmap_sem locked. 1012 * If it fails, we release mmap_sem and jump out_nolock. 1013 * Continuing to collapse causes inconsistency. 1014 */ 1015 if (unmapped && !__collapse_huge_page_swapin(mm, vma, address, 1016 pmd, referenced)) { 1017 mem_cgroup_cancel_charge(new_page, memcg, true); 1018 up_read(&mm->mmap_sem); 1019 goto out_nolock; 1020 } 1021 1022 up_read(&mm->mmap_sem); 1023 /* 1024 * Prevent all access to pagetables with the exception of 1025 * gup_fast later handled by the ptep_clear_flush and the VM 1026 * handled by the anon_vma lock + PG_lock. 1027 */ 1028 down_write(&mm->mmap_sem); 1029 result = hugepage_vma_revalidate(mm, address, &vma); 1030 if (result) 1031 goto out; 1032 /* check if the pmd is still valid */ 1033 if (mm_find_pmd(mm, address) != pmd) 1034 goto out; 1035 1036 anon_vma_lock_write(vma->anon_vma); 1037 1038 pte = pte_offset_map(pmd, address); 1039 pte_ptl = pte_lockptr(mm, pmd); 1040 1041 mmun_start = address; 1042 mmun_end = address + HPAGE_PMD_SIZE; 1043 mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end); 1044 pmd_ptl = pmd_lock(mm, pmd); /* probably unnecessary */ 1045 /* 1046 * After this gup_fast can't run anymore. This also removes 1047 * any huge TLB entry from the CPU so we won't allow 1048 * huge and small TLB entries for the same virtual address 1049 * to avoid the risk of CPU bugs in that area. 1050 */ 1051 _pmd = pmdp_collapse_flush(vma, address, pmd); 1052 spin_unlock(pmd_ptl); 1053 mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end); 1054 1055 spin_lock(pte_ptl); 1056 isolated = __collapse_huge_page_isolate(vma, address, pte); 1057 spin_unlock(pte_ptl); 1058 1059 if (unlikely(!isolated)) { 1060 pte_unmap(pte); 1061 spin_lock(pmd_ptl); 1062 BUG_ON(!pmd_none(*pmd)); 1063 /* 1064 * We can only use set_pmd_at when establishing 1065 * hugepmds and never for establishing regular pmds that 1066 * points to regular pagetables. Use pmd_populate for that 1067 */ 1068 pmd_populate(mm, pmd, pmd_pgtable(_pmd)); 1069 spin_unlock(pmd_ptl); 1070 anon_vma_unlock_write(vma->anon_vma); 1071 result = SCAN_FAIL; 1072 goto out; 1073 } 1074 1075 /* 1076 * All pages are isolated and locked so anon_vma rmap 1077 * can't run anymore. 1078 */ 1079 anon_vma_unlock_write(vma->anon_vma); 1080 1081 __collapse_huge_page_copy(pte, new_page, vma, address, pte_ptl); 1082 pte_unmap(pte); 1083 __SetPageUptodate(new_page); 1084 pgtable = pmd_pgtable(_pmd); 1085 1086 _pmd = mk_huge_pmd(new_page, vma->vm_page_prot); 1087 _pmd = maybe_pmd_mkwrite(pmd_mkdirty(_pmd), vma); 1088 1089 /* 1090 * spin_lock() below is not the equivalent of smp_wmb(), so 1091 * this is needed to avoid the copy_huge_page writes to become 1092 * visible after the set_pmd_at() write. 1093 */ 1094 smp_wmb(); 1095 1096 spin_lock(pmd_ptl); 1097 BUG_ON(!pmd_none(*pmd)); 1098 page_add_new_anon_rmap(new_page, vma, address, true); 1099 mem_cgroup_commit_charge(new_page, memcg, false, true); 1100 count_memcg_events(memcg, THP_COLLAPSE_ALLOC, 1); 1101 lru_cache_add_active_or_unevictable(new_page, vma); 1102 pgtable_trans_huge_deposit(mm, pmd, pgtable); 1103 set_pmd_at(mm, address, pmd, _pmd); 1104 update_mmu_cache_pmd(vma, address, pmd); 1105 spin_unlock(pmd_ptl); 1106 1107 *hpage = NULL; 1108 1109 khugepaged_pages_collapsed++; 1110 result = SCAN_SUCCEED; 1111 out_up_write: 1112 up_write(&mm->mmap_sem); 1113 out_nolock: 1114 trace_mm_collapse_huge_page(mm, isolated, result); 1115 return; 1116 out: 1117 mem_cgroup_cancel_charge(new_page, memcg, true); 1118 goto out_up_write; 1119 } 1120 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 1584a68cf2ef23ac87ba506e8ab8ca7e261813c1
by kernel test robot 09 Mar '25

09 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 1584a68cf2ef23ac87ba506e8ab8ca7e261813c1 !15411 v2 Ignore SB_RDONLY when mounting and remounting nfs Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503090527.cCPBJlcO-lkp@intel.com drivers/gpu/drm/nouveau/.tmp_nouveau_abi16.o: warning: objtool: missing symbol for section .text drivers/infiniband/core/.tmp_uverbs_uapi.o: warning: objtool: missing symbol for section .text drivers/infiniband/hw/hfi1/.tmp_exp_rcv.o: warning: objtool: missing symbol for section .text drivers/infiniband/hw/mlx5/.tmp_mad.o: warning: objtool: missing symbol for section .text drivers/net/bonding/.tmp_bond_main.o: warning: objtool: missing symbol for section .exit.text drivers/net/ethernet/broadcom/bnx2x/.tmp_bnx2x_vfpf.o: warning: objtool: missing symbol for section .text drivers/net/ethernet/cavium/liquidio/.tmp_octeon_mailbox.o: warning: objtool: missing symbol for section .text drivers/pinctrl/mediatek/mtk-eint.h:102:5: warning: no previous prototype for 'mtk_eint_find_irq' [-Wmissing-prototypes] drivers/pinctrl/mediatek/mtk-eint.h:96:5: warning: no previous prototype for 'mtk_eint_set_debounce' [-Wmissing-prototypes] fs/crypto/.tmp_hooks.o: warning: objtool: missing symbol for section .text fs/debugfs/file.o: warning: objtool: full_proxy_open()+0x55a: unreachable instruction fs/ext4/mballoc.o: warning: objtool: ext4_mb_complex_scan_group()+0x11a4: unreachable instruction kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace' mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] net/nfc/.tmp_llcp_commands.o: warning: objtool: missing symbol for section .text net/openvswitch/.tmp_vport.o: warning: objtool: missing symbol for section .text net/rose/.tmp_rose_subr.o: warning: objtool: missing symbol for section .text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250308 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250308 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250308 | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250308 | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-r113-20250309 | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(152fecd8f70e5939-becomes-f70e5939) | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(1f83d9abfb41bd6b-becomes-fb41bd6b) | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(3c6ef372fe94f82b-becomes-fe94f82b) | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(47b5481dbefa4fa4-becomes-befa4fa4) | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(510e527fade682d1-becomes-ade682d1) | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(5be0cd19137e2179-becomes-137e2179) | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(629a292a367cd507-becomes-367cd507) | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(67332667ffc00b31-becomes-ffc00b31) | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(6a09e667f3bcc908-becomes-f3bcc908) | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(8eb44a8768581511-becomes-) | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(9159015a3070dd17-becomes-3070dd17) | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(9b05688c2b3e6c1f-becomes-2b3e6c1f) | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(a54ff53a5f1d36f1-becomes-5f1d36f1) | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(bb67ae8584caa73b-becomes-84caa73b) | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(cbbb9d5dc1059ed8-becomes-c1059ed8) | |-- drivers-crypto-inside-secure-safexcel_hash.c:sparse:sparse:cast-truncates-bits-from-constant-value-(db0c2e0d64f98fa7-becomes-64f98fa7) | |-- drivers-pinctrl-mediatek-mtk-eint.h:warning:no-previous-prototype-for-mtk_eint_find_irq | |-- drivers-pinctrl-mediatek-mtk-eint.h:warning:no-previous-prototype-for-mtk_eint_set_debounce | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- include-linux-mem_reliable.h:sparse:sparse:restricted-gfp_t-degrades-to-integer | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-mem_reliable.c:sparse:sparse:invalid-assignment: | |-- mm-mem_reliable.c:sparse:sparse:symbol-reliable_debug_handler-was-not-declared.-Should-it-be-static | |-- mm-mem_reliable.c:sparse:sparse:symbol-reliable_limit_handler-was-not-declared.-Should-it-be-static | |-- mm-mem_reliable.c:sparse:sparse:symbol-reliable_pagecache_max_bytes_write-was-not-declared.-Should-it-be-static | |-- mm-mem_reliable.c:sparse:sparse:symbol-reliable_shmem_bytes_limit_handler-was-not-declared.-Should-it-be-static | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-gfp_t-usertype-flags-got-unsigned-int | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-shmem.c:sparse:sparse:invalid-assignment: | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-r132-20250309 | |-- drivers-gpu-drm-exynos-exynos_drm_fbdev.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-addr-got-void-noderef-__iomem-kvaddr | |-- drivers-mtd-spi-nor-fsl-quadspi.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-got-void-noderef-__iomem | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-allnoconfig | |-- mm-hugetlb.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-shmem.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-swap.c:linux-memremap.h-is-included-more-than-once. | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250308 | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-hns3_cae_init.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250308 | |-- crypto-.tmp_aegis128.o:warning:objtool:missing-symbol-for-section-.init.text | |-- crypto-.tmp_sm4_generic.o:warning:objtool:missing-symbol-for-section-.text | |-- crypto-.tmp_zstd.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-nouveau-.tmp_nouveau_abi16.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-infiniband-core-.tmp_uverbs_uapi.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-infiniband-hw-hfi1-.tmp_exp_rcv.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-infiniband-hw-mlx5-.tmp_mad.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-bonding-.tmp_bond_main.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-net-ethernet-broadcom-bnx2x-.tmp_bnx2x_vfpf.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-cavium-liquidio-.tmp_octeon_mailbox.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-crypto-.tmp_hooks.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-.tmp_vmacache.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration | |-- net-can-j1939-.tmp_address-claim.o:warning:objtool:missing-symbol-for-section-.text | |-- net-nfc-.tmp_llcp_commands.o:warning:objtool:missing-symbol-for-section-.text | |-- net-openvswitch-.tmp_vport.o:warning:objtool:missing-symbol-for-section-.text | `-- net-rose-.tmp_rose_subr.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-003-20250308 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250308 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20241216 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250308 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250308 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-defconfig | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-101-20241223 | `-- fs-ext4-mballoc.o:warning:objtool:ext4_mb_complex_scan_group:unreachable-instruction |-- x86_64-randconfig-101-20250309 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-102-20250309 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-103-20241218 | `-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace |-- x86_64-randconfig-103-20250309 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-104-20250309 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-121-20250309 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-122-20241226 | `-- fs-debugfs-file.o:warning:objtool:full_proxy_open:unreachable-instruction |-- x86_64-randconfig-122-20250309 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-123-20250309 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-161-20250309 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-r131-20250309 |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 1346m configs tested: 15 configs skipped: 130 tested configs: arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250308 gcc-14.2.0 arm64 randconfig-002-20250308 gcc-14.2.0 arm64 randconfig-003-20250308 gcc-14.2.0 arm64 randconfig-004-20250308 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250308 gcc-12 x86_64 buildonly-randconfig-002-20250308 clang-19 x86_64 buildonly-randconfig-003-20250308 gcc-12 x86_64 buildonly-randconfig-004-20250308 clang-19 x86_64 buildonly-randconfig-005-20250308 clang-19 x86_64 buildonly-randconfig-006-20250308 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2007/2007] kernel/sched/fair.c:174:14: sparse: sparse: symbol 'sysctl_qos_level_weights' was not declared. Should it be static?
by kernel test robot 09 Mar '25

09 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 944ce05f6b83ba40c4382c6b90b7b94f529118d3 commit: 0b620bf6de24090878f77ca8c639759b8f1af8e7 [2007/2007] sched/fair: Introduce multiple qos level config: x86_64-randconfig-r121-20250309 (https://download.01.org/0day-ci/archive/20250309/202503091446.DwKr9tpK-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250309/202503091446.DwKr9tpK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503091446.DwKr9tpK-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/fair.c:151:14: sparse: sparse: symbol 'sysctl_overload_detect_period' was not declared. Should it be static? kernel/sched/fair.c:152:14: sparse: sparse: symbol 'sysctl_offline_wait_interval' was not declared. Should it be static? >> kernel/sched/fair.c:174:14: sparse: sparse: symbol 'sysctl_qos_level_weights' was not declared. Should it be static? kernel/sched/fair.c:1310:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_entity const *se @@ got struct sched_entity [noderef] __rcu * @@ kernel/sched/fair.c:1310:34: sparse: expected struct sched_entity const *se kernel/sched/fair.c:1310:34: sparse: got struct sched_entity [noderef] __rcu * kernel/sched/fair.c:3093:13: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct task_struct *tsk @@ got struct task_struct [noderef] __rcu * @@ kernel/sched/fair.c:3093:13: sparse: expected struct task_struct *tsk kernel/sched/fair.c:3093:13: sparse: got struct task_struct [noderef] __rcu * kernel/sched/fair.c:13391:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:13391:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:13391:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:5195:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:5195:25: sparse: struct sparsemask [noderef] __rcu * kernel/sched/fair.c:5195:25: sparse: struct sparsemask * kernel/sched/fair.c:5212:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:5212:25: sparse: struct sparsemask [noderef] __rcu * kernel/sched/fair.c:5212:25: sparse: struct sparsemask * kernel/sched/fair.c:13747:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:13747:25: sparse: struct sparsemask [noderef] __rcu * kernel/sched/fair.c:13747:25: sparse: struct sparsemask * kernel/sched/fair.c:6071:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:6071:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:6071:22: sparse: struct task_struct * kernel/sched/fair.c:8196:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8196:20: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:8196:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8511:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8511:9: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:8511:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8623:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8623:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8623:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8969:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:8969:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:8969:22: sparse: struct task_struct * kernel/sched/fair.c:9520:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:9520:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:9520:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:10591:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *child @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:10591:40: sparse: expected struct sched_domain *child kernel/sched/fair.c:10591:40: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:11228:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:11228:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:11228:22: sparse: struct task_struct * kernel/sched/fair.c:12669:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12669:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12669:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12326:44: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *sd_parent @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12326:44: sparse: expected struct sched_domain *sd_parent kernel/sched/fair.c:12326:44: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12765:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12765:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12765:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:3039:9: sparse: sparse: context imbalance in 'task_numa_placement' - different lock contexts for basic block kernel/sched/fair.c: note: in included file (through include/linux/rculist.h, include/linux/pid.h, include/linux/sched.h, ...): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true kernel/sched/fair.c:7382:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:7382:28: sparse: expected struct sched_domain *sd kernel/sched/fair.c:7382:28: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:7388:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:7388:28: sparse: expected struct sched_domain *sd kernel/sched/fair.c:7388:28: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:7395:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:7395:28: sparse: expected struct sched_domain *sd kernel/sched/fair.c:7395:28: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:7403:17: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:7403:17: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:7403:17: sparse: got struct sched_domain [noderef] __rcu *parent include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true kernel/sched/fair.c: note: in included file: kernel/sched/sched.h:2355:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2355:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2355:9: sparse: struct task_struct * kernel/sched/sched.h:2355:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2355:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2355:9: sparse: struct task_struct * kernel/sched/sched.h:2191:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2191:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2191:25: sparse: struct task_struct * kernel/sched/sched.h:2191:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2191:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2191:25: sparse: struct task_struct * vim +/sysctl_qos_level_weights +174 kernel/sched/fair.c 173 > 174 unsigned int sysctl_qos_level_weights[5] = { 175 QOS_LEVEL_WEIGHT_OFFLINE_EX, 176 QOS_LEVEL_WEIGHT_OFFLINE, 177 QOS_LEVEL_WEIGHT_ONLINE, 178 QOS_LEVEL_WEIGHT_HIGH, 179 QOS_LEVEL_WEIGHT_HIGH_EX, 180 }; 181 static long qos_reweight(long shares, struct task_group *tg); 182 #endif 183 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2007/2007] kernel/sched/fair.c:143:14: sparse: sparse: symbol 'sysctl_overload_detect_period' was not declared. Should it be static?
by kernel test robot 09 Mar '25

09 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 944ce05f6b83ba40c4382c6b90b7b94f529118d3 commit: a3c9f2da0a35df4e41751556be4308f57bdaf3d6 [2007/2007] sched: Introduce handle priority reversion mechanism config: x86_64-randconfig-r121-20250309 (https://download.01.org/0day-ci/archive/20250309/202503091054.fOa4dBNp-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250309/202503091054.fOa4dBNp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503091054.fOa4dBNp-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/sched/fair.c:143:14: sparse: sparse: symbol 'sysctl_overload_detect_period' was not declared. Should it be static? >> kernel/sched/fair.c:144:14: sparse: sparse: symbol 'sysctl_offline_wait_interval' was not declared. Should it be static? kernel/sched/fair.c:1236:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_entity const *se @@ got struct sched_entity [noderef] __rcu * @@ kernel/sched/fair.c:1236:34: sparse: expected struct sched_entity const *se kernel/sched/fair.c:1236:34: sparse: got struct sched_entity [noderef] __rcu * kernel/sched/fair.c:3019:13: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct task_struct *tsk @@ got struct task_struct [noderef] __rcu * @@ kernel/sched/fair.c:3019:13: sparse: expected struct task_struct *tsk kernel/sched/fair.c:3019:13: sparse: got struct task_struct [noderef] __rcu * kernel/sched/fair.c:12477:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12477:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12477:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:5766:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:5766:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:5766:22: sparse: struct task_struct * kernel/sched/fair.c:7809:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:7809:20: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:7809:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8014:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8014:9: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:8014:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8113:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8113:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8113:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8333:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:8333:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:8333:22: sparse: struct task_struct * kernel/sched/fair.c:8687:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8687:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8687:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:9680:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *child @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:9680:40: sparse: expected struct sched_domain *child kernel/sched/fair.c:9680:40: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:10317:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:10317:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:10317:22: sparse: struct task_struct * kernel/sched/fair.c:11749:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:11749:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:11749:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:11406:44: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *sd_parent @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:11406:44: sparse: expected struct sched_domain *sd_parent kernel/sched/fair.c:11406:44: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:11845:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:11845:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:11845:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:2965:9: sparse: sparse: context imbalance in 'task_numa_placement' - different lock contexts for basic block kernel/sched/fair.c: note: in included file (through include/linux/rculist.h, include/linux/pid.h, include/linux/sched.h, ...): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true kernel/sched/fair.c:7047:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:7047:28: sparse: expected struct sched_domain *sd kernel/sched/fair.c:7047:28: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:7053:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:7053:28: sparse: expected struct sched_domain *sd kernel/sched/fair.c:7053:28: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:7060:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:7060:28: sparse: expected struct sched_domain *sd kernel/sched/fair.c:7060:28: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:7068:17: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:7068:17: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:7068:17: sparse: got struct sched_domain [noderef] __rcu *parent include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true kernel/sched/fair.c: note: in included file: kernel/sched/sched.h:2309:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2309:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2309:9: sparse: struct task_struct * kernel/sched/sched.h:2145:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2145:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2145:25: sparse: struct task_struct * kernel/sched/sched.h:2145:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2145:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2145:25: sparse: struct task_struct * vim +/sysctl_overload_detect_period +143 kernel/sched/fair.c 139 140 static DEFINE_PER_CPU_SHARED_ALIGNED(struct list_head, qos_throttled_cfs_rq); 141 static DEFINE_PER_CPU_SHARED_ALIGNED(struct hrtimer, qos_overload_timer); 142 static DEFINE_PER_CPU(int, qos_cpu_overload); > 143 unsigned int sysctl_overload_detect_period = 5000; /* in ms */ > 144 unsigned int sysctl_offline_wait_interval = 100; /* in ms */ 145 static int one_thousand = 1000; 146 static int hundred_thousand = 100000; 147 static int unthrottle_qos_cfs_rqs(int cpu); 148 #endif 149 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 944ce05f6b83ba40c4382c6b90b7b94f529118d3
by kernel test robot 09 Mar '25

09 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 944ce05f6b83ba40c4382c6b90b7b94f529118d3 !15302 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.57-6.6.58 LTS Conflicts Patches Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503082212.OF8nZc9a-lkp@intel.com mm/memory.c:5277:24: warning: variable 'nr_pages' set but not used [-Wunused-but-set-variable] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250308 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250308 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250308 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250308 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-051-20250309 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-052-20250309 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-053-20250309 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-054-20250309 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-055-20250309 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- loongarch-allmodconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250308 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-002-20250308 | `-- include-linux-mmzone.h:error:error-Allocator-MAX_ORDER-exceeds-SECTION_SIZE |-- x86_64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250308 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250308 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250308 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250308 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250308 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250308 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-defconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-randconfig-r121-20250309 |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 838m configs tested: 19 configs skipped: 122 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250308 gcc-14.2.0 arm64 randconfig-002-20250308 gcc-14.2.0 arm64 randconfig-003-20250308 clang-16 arm64 randconfig-004-20250308 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250308 gcc-14.2.0 loongarch randconfig-002-20250308 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250308 gcc-12 x86_64 buildonly-randconfig-002-20250308 clang-19 x86_64 buildonly-randconfig-003-20250308 gcc-12 x86_64 buildonly-randconfig-004-20250308 clang-19 x86_64 buildonly-randconfig-005-20250308 clang-19 x86_64 buildonly-randconfig-006-20250308 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 2e32af659ca005096d96fb7e433bd96744b02844
by kernel test robot 09 Mar '25

09 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2e32af659ca005096d96fb7e433bd96744b02844 !15397 Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-defconfig | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-001-20250308 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-002-20250308 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-004-20250308 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-r131-20250308 | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-allnoconfig | |-- Warning:arch-x86-kernel-cpu-resctrl-monitor.c-references-a-file-that-doesn-t-exist:Documentation-x86-resctrl.rst | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250308 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250308 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250308 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250308 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250308 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250308 | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch `-- x86_64-defconfig |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch elapsed time: 791m configs tested: 16 configs skipped: 118 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250308 gcc-14.2.0 arm64 randconfig-002-20250308 gcc-14.2.0 arm64 randconfig-003-20250308 clang-16 arm64 randconfig-004-20250308 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250308 gcc-12 x86_64 buildonly-randconfig-002-20250308 clang-19 x86_64 buildonly-randconfig-003-20250308 gcc-12 x86_64 buildonly-randconfig-004-20250308 clang-19 x86_64 buildonly-randconfig-005-20250308 clang-19 x86_64 buildonly-randconfig-006-20250308 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1461/1461] drivers/infiniband/core/.tmp_uverbs_uapi.o: warning: objtool: missing symbol for section .text
by kernel test robot 09 Mar '25

09 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 1584a68cf2ef23ac87ba506e8ab8ca7e261813c1 commit: 0a3173a5f09bc58a3638ecfd0a80bdbae55e123c [1461/1461] Merge branch 'linus/master' into rdma.git for-next config: x86_64-buildonly-randconfig-002-20250308 (https://download.01.org/0day-ci/archive/20250309/202503090527.cCPBJlcO-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250309/202503090527.cCPBJlcO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503090527.cCPBJlcO-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/infiniband/core/.tmp_uverbs_uapi.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2790/2790] mm/page_alloc.c:3036:6: sparse: sparse: symbol '__drain_all_pages' was not declared. Should it be static?
by kernel test robot 08 Mar '25

08 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 2e32af659ca005096d96fb7e433bd96744b02844 commit: e037ee4a8deaff7c579618c0aba1f066d6d14b11 [2790/2790] mm, page_alloc: disable pcplists during memory offline config: arm64-randconfig-r131-20250308 (https://download.01.org/0day-ci/archive/20250308/202503082314.gTnzWY6P-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250308/202503082314.gTnzWY6P-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503082314.gTnzWY6P-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/page_alloc.c:3036:6: sparse: sparse: symbol '__drain_all_pages' was not declared. Should it be static? >> mm/page_alloc.c:6634:6: sparse: sparse: symbol '__zone_set_pageset_high_and_batch' was not declared. Should it be static? mm/page_alloc.c: note: in included file (through include/linux/mm.h): include/linux/gfp.h:327:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:327:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:327:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:327:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:327:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:327:27: sparse: sparse: restricted gfp_t degrades to integer vim +/__drain_all_pages +3036 mm/page_alloc.c 3025 3026 /* 3027 * The implementation of drain_all_pages(), exposing an extra parameter to 3028 * drain on all cpus. 3029 * 3030 * drain_all_pages() is optimized to only execute on cpus where pcplists are 3031 * not empty. The check for non-emptiness can however race with a free to 3032 * pcplist that has not yet increased the pcp->count from 0 to 1. Callers 3033 * that need the guarantee that every CPU has drained can disable the 3034 * optimizing racy check. 3035 */ > 3036 void __drain_all_pages(struct zone *zone, bool force_all_cpus) 3037 { 3038 int cpu; 3039 3040 /* 3041 * Allocate in the BSS so we wont require allocation in 3042 * direct reclaim path for CONFIG_CPUMASK_OFFSTACK=y 3043 */ 3044 static cpumask_t cpus_with_pcps; 3045 3046 /* 3047 * Make sure nobody triggers this path before mm_percpu_wq is fully 3048 * initialized. 3049 */ 3050 if (WARN_ON_ONCE(!mm_percpu_wq)) 3051 return; 3052 3053 /* 3054 * Do not drain if one is already in progress unless it's specific to 3055 * a zone. Such callers are primarily CMA and memory hotplug and need 3056 * the drain to be complete when the call returns. 3057 */ 3058 if (unlikely(!mutex_trylock(&pcpu_drain_mutex))) { 3059 if (!zone) 3060 return; 3061 mutex_lock(&pcpu_drain_mutex); 3062 } 3063 3064 /* 3065 * We don't care about racing with CPU hotplug event 3066 * as offline notification will cause the notified 3067 * cpu to drain that CPU pcps and on_each_cpu_mask 3068 * disables preemption as part of its processing 3069 */ 3070 for_each_online_cpu(cpu) { 3071 struct per_cpu_pageset *pcp; 3072 struct zone *z; 3073 bool has_pcps = false; 3074 3075 if (force_all_cpus) { 3076 /* 3077 * The pcp.count check is racy, some callers need a 3078 * guarantee that no cpu is missed. 3079 */ 3080 has_pcps = true; 3081 } else if (zone) { 3082 pcp = per_cpu_ptr(zone->pageset, cpu); 3083 if (pcp->pcp.count) 3084 has_pcps = true; 3085 } else { 3086 for_each_populated_zone(z) { 3087 pcp = per_cpu_ptr(z->pageset, cpu); 3088 if (pcp->pcp.count) { 3089 has_pcps = true; 3090 break; 3091 } 3092 } 3093 } 3094 3095 if (has_pcps) 3096 cpumask_set_cpu(cpu, &cpus_with_pcps); 3097 else 3098 cpumask_clear_cpu(cpu, &cpus_with_pcps); 3099 } 3100 3101 for_each_cpu(cpu, &cpus_with_pcps) { 3102 struct pcpu_drain *drain = per_cpu_ptr(&pcpu_drain, cpu); 3103 3104 drain->zone = zone; 3105 INIT_WORK(&drain->work, drain_local_pages_wq); 3106 queue_work_on(cpu, mm_percpu_wq, &drain->work); 3107 } 3108 for_each_cpu(cpu, &cpus_with_pcps) 3109 flush_work(&per_cpu_ptr(&pcpu_drain, cpu)->work); 3110 3111 mutex_unlock(&pcpu_drain_mutex); 3112 } 3113 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2007/2007] mm/memory.c:5277:24: warning: variable 'nr_pages' set but not used
by kernel test robot 08 Mar '25

08 Mar '25

Hi Zi, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 944ce05f6b83ba40c4382c6b90b7b94f529118d3 commit: 3bfa35ccde9e52ca74fed047eb4d89be32dd9e5e [2007/2007] mm/numa: no task_numa_fault() call if PTE is changed config: loongarch-randconfig-001-20250308 (https://download.01.org/0day-ci/archive/20250308/202503082212.OF8nZc9a-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250308/202503082212.OF8nZc9a-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503082212.OF8nZc9a-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/memory.c: In function 'do_numa_page': >> mm/memory.c:5277:24: warning: variable 'nr_pages' set but not used [-Wunused-but-set-variable] 5277 | int flags = 0, nr_pages; | ^~~~~~~~ vim +/nr_pages +5277 mm/memory.c f569661eacc258 Baolin Wang 2024-05-11 5266 2b7403035459c7 Souptick Joarder 2018-08-23 5267 static vm_fault_t do_numa_page(struct vm_fault *vmf) d10e63f29488b0 Mel Gorman 2012-10-25 5268 { 82b0f8c39a3869 Jan Kara 2016-12-14 5269 struct vm_area_struct *vma = vmf->vma; d5e6c8d5790088 Kefeng Wang 2023-11-27 5270 struct folio *folio = NULL; d5e6c8d5790088 Kefeng Wang 2023-11-27 5271 int nid = NUMA_NO_NODE; 2cb37064a2b82c Baolin Wang 2024-06-22 5272 bool writable = false, ignore_writable = false; 2cb37064a2b82c Baolin Wang 2024-06-22 5273 bool pte_write_upgrade = vma_wants_manual_pte_write_upgrade(vma); 90572890d20252 Peter Zijlstra 2013-10-07 5274 int last_cpupid; cbee9f88ec1b8d Peter Zijlstra 2012-10-25 5275 int target_nid; 04a8645304500b Aneesh Kumar K.V 2019-03-05 5276 pte_t pte, old_pte; 2cb37064a2b82c Baolin Wang 2024-06-22 @5277 int flags = 0, nr_pages; d10e63f29488b0 Mel Gorman 2012-10-25 5278 d10e63f29488b0 Mel Gorman 2012-10-25 5279 /* e2491c31fb10ae John Hubbard 2024-05-25 5280 * The pte cannot be used safely until we verify, while holding the page e2491c31fb10ae John Hubbard 2024-05-25 5281 * table lock, that its contents have not changed during fault handling. d10e63f29488b0 Mel Gorman 2012-10-25 5282 */ 82b0f8c39a3869 Jan Kara 2016-12-14 5283 spin_lock(vmf->ptl); e2491c31fb10ae John Hubbard 2024-05-25 5284 /* Read the live PTE from the page tables: */ e2491c31fb10ae John Hubbard 2024-05-25 5285 old_pte = ptep_get(vmf->pte); e2491c31fb10ae John Hubbard 2024-05-25 5286 e2491c31fb10ae John Hubbard 2024-05-25 5287 if (unlikely(!pte_same(old_pte, vmf->orig_pte))) { 82b0f8c39a3869 Jan Kara 2016-12-14 5288 pte_unmap_unlock(vmf->pte, vmf->ptl); 3bfa35ccde9e52 Zi Yan 2024-08-09 5289 return 0; 4daae3b4b9e49b Mel Gorman 2012-11-02 5290 } 4daae3b4b9e49b Mel Gorman 2012-11-02 5291 04a8645304500b Aneesh Kumar K.V 2019-03-05 5292 pte = pte_modify(old_pte, vma->vm_page_prot); d10e63f29488b0 Mel Gorman 2012-10-25 5293 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5294 /* 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5295 * Detect now whether the PTE could be writable; this information 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5296 * is only valid while holding the PT lock. 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5297 */ 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5298 writable = pte_write(pte); 2cb37064a2b82c Baolin Wang 2024-06-22 5299 if (!writable && pte_write_upgrade && 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5300 can_change_pte_writable(vma, vmf->address, pte)) 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5301 writable = true; 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5302 d5e6c8d5790088 Kefeng Wang 2023-11-27 5303 folio = vm_normal_folio(vma, vmf->address, pte); d5e6c8d5790088 Kefeng Wang 2023-11-27 5304 if (!folio || folio_is_zone_device(folio)) b99a342d4f11a5 Huang Ying 2021-04-29 5305 goto out_map; d10e63f29488b0 Mel Gorman 2012-10-25 5306 6688cc05473b36 Peter Zijlstra 2013-10-07 5307 /* bea66fbd11af1c Mel Gorman 2015-03-25 5308 * Avoid grouping on RO pages in general. RO pages shouldn't hurt as bea66fbd11af1c Mel Gorman 2015-03-25 5309 * much anyway since they can be in shared cache state. This misses bea66fbd11af1c Mel Gorman 2015-03-25 5310 * the case where a mapping is writable but the process never writes bea66fbd11af1c Mel Gorman 2015-03-25 5311 * to it but pte_write gets cleared during protection updates and bea66fbd11af1c Mel Gorman 2015-03-25 5312 * pte_dirty has unpredictable behaviour between PTE scan updates, bea66fbd11af1c Mel Gorman 2015-03-25 5313 * background writeback, dirty balancing and application behaviour. bea66fbd11af1c Mel Gorman 2015-03-25 5314 */ 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5315 if (!writable) 6688cc05473b36 Peter Zijlstra 2013-10-07 5316 flags |= TNF_NO_GROUP; 6688cc05473b36 Peter Zijlstra 2013-10-07 5317 dabe1d992414a6 Rik van Riel 2013-10-07 5318 /* d5e6c8d5790088 Kefeng Wang 2023-11-27 5319 * Flag if the folio is shared between multiple address spaces. This dabe1d992414a6 Rik van Riel 2013-10-07 5320 * is later used when determining whether to group tasks together dabe1d992414a6 Rik van Riel 2013-10-07 5321 */ b8eba2d7e4a309 David Hildenbrand 2024-05-11 5322 if (folio_likely_mapped_shared(folio) && (vma->vm_flags & VM_SHARED)) dabe1d992414a6 Rik van Riel 2013-10-07 5323 flags |= TNF_SHARED; dabe1d992414a6 Rik van Riel 2013-10-07 5324 d5e6c8d5790088 Kefeng Wang 2023-11-27 5325 nid = folio_nid(folio); 2cb37064a2b82c Baolin Wang 2024-06-22 5326 nr_pages = folio_nr_pages(folio); 33024536bafd91 Huang Ying 2022-07-13 5327 /* 33024536bafd91 Huang Ying 2022-07-13 5328 * For memory tiering mode, cpupid of slow memory page is used 33024536bafd91 Huang Ying 2022-07-13 5329 * to record page access time. So use default value. 33024536bafd91 Huang Ying 2022-07-13 5330 */ 33024536bafd91 Huang Ying 2022-07-13 5331 if ((sysctl_numa_balancing_mode & NUMA_BALANCING_MEMORY_TIERING) && d5e6c8d5790088 Kefeng Wang 2023-11-27 5332 !node_is_toptier(nid)) 33024536bafd91 Huang Ying 2022-07-13 5333 last_cpupid = (-1 & LAST_CPUPID_MASK); 33024536bafd91 Huang Ying 2022-07-13 5334 else 28e1ec746768bb Kefeng Wang 2023-11-27 5335 last_cpupid = folio_last_cpupid(folio); bf7c2ab764599b Kefeng Wang 2023-11-27 5336 target_nid = numa_migrate_prep(folio, vma, vmf->address, nid, &flags); 98fa15f34cb379 Anshuman Khandual 2019-03-05 5337 if (target_nid == NUMA_NO_NODE) { d5e6c8d5790088 Kefeng Wang 2023-11-27 5338 folio_put(folio); b99a342d4f11a5 Huang Ying 2021-04-29 5339 goto out_map; 4daae3b4b9e49b Mel Gorman 2012-11-02 5340 } b99a342d4f11a5 Huang Ying 2021-04-29 5341 pte_unmap_unlock(vmf->pte, vmf->ptl); 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5342 writable = false; 2cb37064a2b82c Baolin Wang 2024-06-22 5343 ignore_writable = true; 4daae3b4b9e49b Mel Gorman 2012-11-02 5344 4daae3b4b9e49b Mel Gorman 2012-11-02 5345 /* Migrate to the requested node */ d5e6c8d5790088 Kefeng Wang 2023-11-27 5346 if (migrate_misplaced_folio(folio, vma, target_nid)) { d5e6c8d5790088 Kefeng Wang 2023-11-27 5347 nid = target_nid; 6688cc05473b36 Peter Zijlstra 2013-10-07 5348 flags |= TNF_MIGRATED; 3bfa35ccde9e52 Zi Yan 2024-08-09 5349 task_numa_fault(last_cpupid, nid, 1, flags); 3bfa35ccde9e52 Zi Yan 2024-08-09 5350 return 0; 3bfa35ccde9e52 Zi Yan 2024-08-09 5351 } 3bfa35ccde9e52 Zi Yan 2024-08-09 5352 074c238177a75f Mel Gorman 2015-03-25 5353 flags |= TNF_MIGRATE_FAIL; c7ad08804fae5b Hugh Dickins 2023-06-08 5354 vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, c7ad08804fae5b Hugh Dickins 2023-06-08 5355 vmf->address, &vmf->ptl); c7ad08804fae5b Hugh Dickins 2023-06-08 5356 if (unlikely(!vmf->pte)) 3bfa35ccde9e52 Zi Yan 2024-08-09 5357 return 0; c33c794828f212 Ryan Roberts 2023-06-12 5358 if (unlikely(!pte_same(ptep_get(vmf->pte), vmf->orig_pte))) { b99a342d4f11a5 Huang Ying 2021-04-29 5359 pte_unmap_unlock(vmf->pte, vmf->ptl); d10e63f29488b0 Mel Gorman 2012-10-25 5360 return 0; 3bfa35ccde9e52 Zi Yan 2024-08-09 5361 } b99a342d4f11a5 Huang Ying 2021-04-29 5362 out_map: b99a342d4f11a5 Huang Ying 2021-04-29 5363 /* b99a342d4f11a5 Huang Ying 2021-04-29 5364 * Make it present again, depending on how arch implements b99a342d4f11a5 Huang Ying 2021-04-29 5365 * non-accessible ptes, some can allow access by kernel mode. b99a342d4f11a5 Huang Ying 2021-04-29 5366 */ 2cb37064a2b82c Baolin Wang 2024-06-22 5367 if (folio && folio_test_large(folio)) 2cb37064a2b82c Baolin Wang 2024-06-22 5368 numa_rebuild_large_mapping(vmf, vma, folio, pte, ignore_writable, 2cb37064a2b82c Baolin Wang 2024-06-22 5369 pte_write_upgrade); 2cb37064a2b82c Baolin Wang 2024-06-22 5370 else 2cb37064a2b82c Baolin Wang 2024-06-22 5371 numa_rebuild_single_mapping(vmf, vma, vmf->address, vmf->pte, 2cb37064a2b82c Baolin Wang 2024-06-22 5372 writable); b99a342d4f11a5 Huang Ying 2021-04-29 5373 pte_unmap_unlock(vmf->pte, vmf->ptl); 3bfa35ccde9e52 Zi Yan 2024-08-09 5374 3bfa35ccde9e52 Zi Yan 2024-08-09 5375 if (nid != NUMA_NO_NODE) 3bfa35ccde9e52 Zi Yan 2024-08-09 5376 task_numa_fault(last_cpupid, nid, 1, flags); 3bfa35ccde9e52 Zi Yan 2024-08-09 5377 return 0; d10e63f29488b0 Mel Gorman 2012-10-25 5378 } d10e63f29488b0 Mel Gorman 2012-10-25 5379 :::::: The code at line 5277 was first introduced by commit :::::: 2cb37064a2b82cd8ebeeaaed21259b5912dff51d mm: support multi-size THP numa balancing :::::: TO: Baolin Wang <baolin.wang(a)linux.alibaba.com> :::::: CC: Liu Shixin <liushixin2(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] CVE-2025-21756
by Liu Jian 08 Mar '25

08 Mar '25

CVE-2025-21756 Michal Luczaj (2): vsock: Keep the binding until socket destruction vsock: Orphan socket after transport release net/vmw_vsock/af_vsock.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2025-21756
by Liu Jian 08 Mar '25

08 Mar '25

CVE-2025-21756 Michal Luczaj (2): vsock: Keep the binding until socket destruction vsock: Orphan socket after transport release net/vmw_vsock/af_vsock.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS v2 0/2] Ignore SB_RDONLY when mounting and remounting nfs
by Li Lingfeng 08 Mar '25

08 Mar '25

When NFS_MOUNT_UNSHARED is not set, NFS forces the sharing of a superblock among each filesystem that mounts sub-directories elonging to a single exported root path. To prevent interference between different filesystems, ignore SB_RDONLY when mounting and remounting nfs. Li Lingfeng (2): nfs: clear SB_RDONLY before getting superblock nfs: ignore SB_RDONLY when remounting nfs --- Changes in v2: - Change the bugzilla tag to the gitee link. --- fs/nfs/super.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) -- 2.31.1

2 3

[openeuler:OLK-5.10] BUILD REGRESSION e0313ab44ba7cbcdf1ecebd6c5bec2fa79a1b600
by kernel test robot 08 Mar '25

08 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: e0313ab44ba7cbcdf1ecebd6c5bec2fa79a1b600 !15382 srcu: Tighten cleanup_srcu_struct() GP checks Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BPF_NET_GLOBAL_PROG-when-selected-by-SCHED_TASK_RELATIONSHIP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PCI_IOV-when-selected-by-CRYPTO_DEV_HISI_MIGRATION | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-TASK_PLACEMENT_BY_CPU_RANGE-when-selected-by-BPF_SCHED |-- arm64-randconfig-001-20250308 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-002-20250308 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-004-20250308 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- Warning:arch-x86-kernel-cpu-resctrl-monitor.c-references-a-file-that-doesn-t-exist:Documentation-x86-resctrl.rst | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250308 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250308 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250308 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250308 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250308 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250308 | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-defconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch `-- x86_64-randconfig-161-20250308 |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch elapsed time: 748m configs tested: 14 configs skipped: 104 tested configs: arm64 allmodconfig clang-18 arm64 randconfig-001-20250308 gcc-14.2.0 arm64 randconfig-002-20250308 gcc-14.2.0 arm64 randconfig-003-20250308 clang-16 arm64 randconfig-004-20250308 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250308 gcc-12 x86_64 buildonly-randconfig-002-20250308 clang-19 x86_64 buildonly-randconfig-003-20250308 gcc-12 x86_64 buildonly-randconfig-004-20250308 clang-19 x86_64 buildonly-randconfig-005-20250308 clang-19 x86_64 buildonly-randconfig-006-20250308 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 98d5b0444e788687e54a325fc84907a8bacbe635
by kernel test robot 08 Mar '25

08 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 98d5b0444e788687e54a325fc84907a8bacbe635 !15374 can: gs_usb: gs_usb_open/close(): fix memory leak Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503080120.II99gux6-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503081134.gJtKyv85-lkp@intel.com drivers/gpu/drm/amd/amdgpu/amdgpu_ids.o: warning: objtool: amdgpu_vmid_grab()+0xd3e: unreachable instruction drivers/media/i2c/adv7511-v4l2.o: warning: objtool: adv7511_set_fmt()+0x805: unreachable instruction drivers/net/ethernet/hisilicon/hns3/hns3_enet.o: warning: objtool: missing symbol for section .exit.text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250308 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250308 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250308 | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250308 | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-allnoconfig | |-- mm-hugetlb.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-shmem.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-swap.c:linux-memremap.h-is-included-more-than-once. | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250308 | |-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250308 | |-- crypto-.tmp_sm4_generic.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-.tmp_vmacache.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration | `-- net-can-j1939-.tmp_address-claim.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-003-20250308 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250102 | `-- drivers-media-i2c-adv7511-v4l2.o:warning:objtool:adv7511_set_fmt:unreachable-instruction |-- x86_64-buildonly-randconfig-004-20250308 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250308 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250308 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-defconfig | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-102-20250103 | `-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. |-- x86_64-randconfig-103-20250305 | `-- drivers-gpu-drm-amd-amdgpu-amdgpu_ids.o:warning:objtool:amdgpu_vmid_grab:unreachable-instruction `-- x86_64-randconfig-161-20250308 |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page |-- mm-vmalloc.c:warning:variable-start-set-but-not-used `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration elapsed time: 742m configs tested: 15 configs skipped: 123 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250308 gcc-14.2.0 arm64 randconfig-002-20250308 gcc-14.2.0 arm64 randconfig-003-20250308 gcc-14.2.0 arm64 randconfig-004-20250308 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250308 gcc-12 x86_64 buildonly-randconfig-002-20250308 clang-19 x86_64 buildonly-randconfig-003-20250308 gcc-12 x86_64 buildonly-randconfig-004-20250308 clang-19 x86_64 buildonly-randconfig-005-20250308 clang-19 x86_64 buildonly-randconfig-006-20250308 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] CVE-2025-21715
by Lin Yujun 08 Mar '25

08 Mar '25

Chenyuan Yang (1): net: davicom: fix UAF in dm9000_drv_remove drivers/net/ethernet/davicom/dm9000.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2025-21715
by Lin Yujun 08 Mar '25

08 Mar '25

Chenyuan Yang (1): net: davicom: fix UAF in dm9000_drv_remove drivers/net/ethernet/davicom/dm9000.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] CVE-2025-21744
by Lin Yujun 08 Mar '25

08 Mar '25

Marcel Hamer (1): wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 5 +++++ 1 file changed, 5 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2025-21744
by Lin Yujun 08 Mar '25

08 Mar '25

Marcel Hamer (1): wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 5 +++++ 1 file changed, 5 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2022-49158
by Lin Yujun 08 Mar '25

08 Mar '25

Quinn Tran (1): scsi: qla2xxx: Fix warning message due to adisc being flushed drivers/scsi/qla2xxx/qla_init.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2022-49164
by Lin Yujun 08 Mar '25

08 Mar '25

Nicholas Piggin (1): powerpc/tm: Fix more userspace r13 corruption arch/powerpc/kernel/tm.S | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) -- 2.34.1

2 2

[openeuler:openEuler-1.0-LTS 1461/1461] drivers/net/ethernet/hisilicon/hns3/hns3_enet.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 08 Mar '25

08 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 98d5b0444e788687e54a325fc84907a8bacbe635 commit: 7d1756a0d43d1c46e8ab8cc127c3725acff703f8 [1461/1461] net: hns3: add trace events support for hns3 driver config: x86_64-buildonly-randconfig-001-20250308 (https://download.01.org/0day-ci/archive/20250308/202503081134.gJtKyv85-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250308/202503081134.gJtKyv85-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503081134.gJtKyv85-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/sctp.h:57, from drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:15: include/uapi/linux/sctp.h:390:1: warning: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Wpacked-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:719:1: warning: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Wpacked-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:718:33: warning: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Wpacked-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ include/uapi/linux/sctp.h:732:1: warning: alignment 4 of 'struct sctp_prim' is less than 8 [-Wpacked-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:731:33: warning: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Wpacked-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ include/uapi/linux/sctp.h:783:1: warning: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Wpacked-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:775:33: warning: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Wpacked-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ include/uapi/linux/sctp.h:896:1: warning: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Wpacked-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:890:33: warning: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Wpacked-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ In file included from include/linux/kallsyms.h:13, from include/linux/filter.h:21, from include/net/sock.h:65, from include/linux/tcp.h:23, from include/linux/ipv6.h:105, from drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:10: include/linux/module.h:140:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'hns3_exit_module': 'cold' [-Wmissing-attributes] 140 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:4540:1: note: in expansion of macro 'module_exit' 4540 | module_exit(hns3_exit_module); | ^~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:4534:20: note: 'cleanup_module' target declared here 4534 | static void __exit hns3_exit_module(void) | ^~~~~~~~~~~~~~~~ include/linux/module.h:134:13: warning: 'init_module' specifies less restrictive attribute than its target 'hns3_init_module': 'cold' [-Wmissing-attributes] 134 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:4527:1: note: in expansion of macro 'module_init' 4527 | module_init(hns3_init_module); | ^~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:4494:19: note: 'init_module' target declared here 4494 | static int __init hns3_init_module(void) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ipmr: do not call mr_mfc_uses_dev() for unres entries
by Wang Liang 08 Mar '25

08 Mar '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc1 commit 15a901361ec3fb1c393f91880e1cbf24ec0a88bd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBJT CVE: CVE-2025-21719 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot found that calling mr_mfc_uses_dev() for unres entries would crash [1], because c->mfc_un.res.minvif / c->mfc_un.res.maxvif alias to "struct sk_buff_head unresolved", which contain two pointers. This code never worked, lets remove it. [1] Unable to handle kernel paging request at virtual address ffff5fff2d536613 KASAN: maybe wild-memory-access in range [0xfffefff96a9b3098-0xfffefff96a9b309f] Modules linked in: CPU: 1 UID: 0 PID: 7321 Comm: syz.0.16 Not tainted 6.13.0-rc7-syzkaller-g1950a0af2d55 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] pc : mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 lr : mr_mfc_uses_dev net/ipv4/ipmr_base.c:289 [inline] lr : mr_table_dump+0x694/0x8b0 net/ipv4/ipmr_base.c:334 Call trace: mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] (P) mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 (P) mr_rtm_dumproute+0x254/0x454 net/ipv4/ipmr_base.c:382 ipmr_rtm_dumproute+0x248/0x4b4 net/ipv4/ipmr.c:2648 rtnl_dump_all+0x2e4/0x4e8 net/core/rtnetlink.c:4327 rtnl_dumpit+0x98/0x1d0 net/core/rtnetlink.c:6791 netlink_dump+0x4f0/0xbc0 net/netlink/af_netlink.c:2317 netlink_recvmsg+0x56c/0xe64 net/netlink/af_netlink.c:1973 sock_recvmsg_nosec net/socket.c:1033 [inline] sock_recvmsg net/socket.c:1055 [inline] sock_read_iter+0x2d8/0x40c net/socket.c:1125 new_sync_read fs/read_write.c:484 [inline] vfs_read+0x740/0x970 fs/read_write.c:565 ksys_read+0x15c/0x26c fs/read_write.c:708 Fixes: cb167893f41e ("net: Plumb support for filtering ipv4 and ipv6 multicast route dumps") Reported-by: syzbot+5cfae50c0e5f2c500013(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/678fe2d1.050a0220.15cac.00b3.GAE@google.com/… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20250121181241.841212-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv4/ipmr_base.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/net/ipv4/ipmr_base.c b/net/ipv4/ipmr_base.c index f0af12a2f70b..de98ce66d38f 100644 --- a/net/ipv4/ipmr_base.c +++ b/net/ipv4/ipmr_base.c @@ -330,9 +330,6 @@ int mr_table_dump(struct mr_table *mrt, struct sk_buff *skb, list_for_each_entry(mfc, &mrt->mfc_unres_queue, list) { if (e < s_e) goto next_entry2; - if (filter->dev && - !mr_mfc_uses_dev(mrt, mfc, filter->dev)) - goto next_entry2; err = fill(mrt, skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, mfc, RTM_NEWROUTE, flags); -- 2.34.1

2 1

[PATCH OLK-5.10] ipmr: do not call mr_mfc_uses_dev() for unres entries
by Wang Liang 08 Mar '25

08 Mar '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc1 commit 15a901361ec3fb1c393f91880e1cbf24ec0a88bd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBJT CVE: CVE-2025-21719 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot found that calling mr_mfc_uses_dev() for unres entries would crash [1], because c->mfc_un.res.minvif / c->mfc_un.res.maxvif alias to "struct sk_buff_head unresolved", which contain two pointers. This code never worked, lets remove it. [1] Unable to handle kernel paging request at virtual address ffff5fff2d536613 KASAN: maybe wild-memory-access in range [0xfffefff96a9b3098-0xfffefff96a9b309f] Modules linked in: CPU: 1 UID: 0 PID: 7321 Comm: syz.0.16 Not tainted 6.13.0-rc7-syzkaller-g1950a0af2d55 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] pc : mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 lr : mr_mfc_uses_dev net/ipv4/ipmr_base.c:289 [inline] lr : mr_table_dump+0x694/0x8b0 net/ipv4/ipmr_base.c:334 Call trace: mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] (P) mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 (P) mr_rtm_dumproute+0x254/0x454 net/ipv4/ipmr_base.c:382 ipmr_rtm_dumproute+0x248/0x4b4 net/ipv4/ipmr.c:2648 rtnl_dump_all+0x2e4/0x4e8 net/core/rtnetlink.c:4327 rtnl_dumpit+0x98/0x1d0 net/core/rtnetlink.c:6791 netlink_dump+0x4f0/0xbc0 net/netlink/af_netlink.c:2317 netlink_recvmsg+0x56c/0xe64 net/netlink/af_netlink.c:1973 sock_recvmsg_nosec net/socket.c:1033 [inline] sock_recvmsg net/socket.c:1055 [inline] sock_read_iter+0x2d8/0x40c net/socket.c:1125 new_sync_read fs/read_write.c:484 [inline] vfs_read+0x740/0x970 fs/read_write.c:565 ksys_read+0x15c/0x26c fs/read_write.c:708 Fixes: cb167893f41e ("net: Plumb support for filtering ipv4 and ipv6 multicast route dumps") Reported-by: syzbot+5cfae50c0e5f2c500013(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/678fe2d1.050a0220.15cac.00b3.GAE@google.com/… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20250121181241.841212-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv4/ipmr_base.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/net/ipv4/ipmr_base.c b/net/ipv4/ipmr_base.c index aa8738a91210..0c4bb906af21 100644 --- a/net/ipv4/ipmr_base.c +++ b/net/ipv4/ipmr_base.c @@ -320,9 +320,6 @@ int mr_table_dump(struct mr_table *mrt, struct sk_buff *skb, list_for_each_entry(mfc, &mrt->mfc_unres_queue, list) { if (e < s_e) goto next_entry2; - if (filter->dev && - !mr_mfc_uses_dev(mrt, mfc, filter->dev)) - goto next_entry2; err = fill(mrt, skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, mfc, RTM_NEWROUTE, flags); -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 08 Mar '25

08 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 98d5b0444e788687e54a325fc84907a8bacbe635 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250308/202503080120.II99gux6-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503080120.II99gux6-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] nilfs2: fix possible int overflows in nilfs_fiemap()
by Chen Zhongjin 07 Mar '25

07 Mar '25

From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> stable inclusion from stable-v6.6.78 commit f2bd0f1ab47822fe5bd699c8458b896c4b2edea1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8Z CVE: CVE-2025-21736 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 6438ef381c183444f7f9d1de18f22661cba1e946 upstream. Since nilfs_bmap_lookup_contig() in nilfs_fiemap() calculates its result by being prepared to go through potentially maxblocks == INT_MAX blocks, the value in n may experience an overflow caused by left shift of blkbits. While it is extremely unlikely to occur, play it safe and cast right hand expression to wider type to mitigate the issue. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Link: https://lkml.kernel.org/r/20250124222133.5323-1-konishi.ryusuke@gmail.com Fixes: 622daaff0a89 ("nilfs2: fiemap support") Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- fs/nilfs2/inode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c index 489592644b68..5f2d73f36e0d 100644 --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -1267,7 +1267,7 @@ int nilfs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, if (size) { if (phys && blkphy << blkbits == phys + size) { /* The current extent goes on */ - size += n << blkbits; + size += (u64)n << blkbits; } else { /* Terminate the current extent */ ret = fiemap_fill_next_extent( @@ -1280,14 +1280,14 @@ int nilfs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, flags = FIEMAP_EXTENT_MERGED; logical = blkoff << blkbits; phys = blkphy << blkbits; - size = n << blkbits; + size = (u64)n << blkbits; } } else { /* Start a new extent */ flags = FIEMAP_EXTENT_MERGED; logical = blkoff << blkbits; phys = blkphy << blkbits; - size = n << blkbits; + size = (u64)n << blkbits; } blkoff += n; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] hfsplus: don't query the device logical block size multiple times
by Chen Zhongjin 07 Mar '25

07 Mar '25

From: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> stable inclusion from stable-v4.19.325 commit baccb5e12577b7a9eff54ffba301fdaa0f3ee5a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADN CVE: CVE-2024-56548 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 1c82587cb57687de3f18ab4b98a8850c789bedcf ] Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size. Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized. Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096. The produced KASAN report before the fix looks like this: [ 419.944641] ================================================================== [ 419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [ 419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [ 419.947612] [ 419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [ 419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 419.950035] Call Trace: [ 419.950384] <TASK> [ 419.950676] dump_stack_lvl+0x57/0x78 [ 419.951212] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.951830] print_report+0x14c/0x49e [ 419.952361] ? __virt_addr_valid+0x267/0x278 [ 419.952979] ? kmem_cache_debug_flags+0xc/0x1d [ 419.953561] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.954231] kasan_report+0x89/0xb0 [ 419.954748] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.955367] hfsplus_read_wrapper+0x659/0xa0a [ 419.955948] ? __pfx_hfsplus_read_wrapper+0x10/0x10 [ 419.956618] ? do_raw_spin_unlock+0x59/0x1a9 [ 419.957214] ? _raw_spin_unlock+0x1a/0x2e [ 419.957772] hfsplus_fill_super+0x348/0x1590 [ 419.958355] ? hlock_class+0x4c/0x109 [ 419.958867] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.959499] ? __pfx_string+0x10/0x10 [ 419.960006] ? lock_acquire+0x3e2/0x454 [ 419.960532] ? bdev_name.constprop.0+0xce/0x243 [ 419.961129] ? __pfx_bdev_name.constprop.0+0x10/0x10 [ 419.961799] ? pointer+0x3f0/0x62f [ 419.962277] ? __pfx_pointer+0x10/0x10 [ 419.962761] ? vsnprintf+0x6c4/0xfba [ 419.963178] ? __pfx_vsnprintf+0x10/0x10 [ 419.963621] ? setup_bdev_super+0x376/0x3b3 [ 419.964029] ? snprintf+0x9d/0xd2 [ 419.964344] ? __pfx_snprintf+0x10/0x10 [ 419.964675] ? lock_acquired+0x45c/0x5e9 [ 419.965016] ? set_blocksize+0x139/0x1c1 [ 419.965381] ? sb_set_blocksize+0x6d/0xae [ 419.965742] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.966179] mount_bdev+0x12f/0x1bf [ 419.966512] ? __pfx_mount_bdev+0x10/0x10 [ 419.966886] ? vfs_parse_fs_string+0xce/0x111 [ 419.967293] ? __pfx_vfs_parse_fs_string+0x10/0x10 [ 419.967702] ? __pfx_hfsplus_mount+0x10/0x10 [ 419.968073] legacy_get_tree+0x104/0x178 [ 419.968414] vfs_get_tree+0x86/0x296 [ 419.968751] path_mount+0xba3/0xd0b [ 419.969157] ? __pfx_path_mount+0x10/0x10 [ 419.969594] ? kmem_cache_free+0x1e2/0x260 [ 419.970311] do_mount+0x99/0xe0 [ 419.970630] ? __pfx_do_mount+0x10/0x10 [ 419.971008] __do_sys_mount+0x199/0x1c9 [ 419.971397] do_syscall_64+0xd0/0x135 [ 419.971761] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 419.972233] RIP: 0033:0x7c3cb812972e [ 419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [ 419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [ 419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: 00007ffe306325d0 [ 419.976363] RBP: 00007ffe30632720 R08: 00007ffe30632610 R09: 0000000000000000 [ 419.977034] R10: 0000000000200008 R11: 0000000000000286 R12: 0000000000000000 [ 419.977713] R13: 00007ffe306328e8 R14: 00005a0eb298bc68 R15: 00007c3cb8356000 [ 419.978375] </TASK> [ 419.978589] Fixes: 6596528e391a ("hfsplus: ensure bio requests are not smaller than the hardware sectors") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> Link: https://lore.kernel.org/r/20241107114109.839253-1-cascardo@igalia.com Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- fs/hfsplus/hfsplus_fs.h | 3 ++- fs/hfsplus/wrapper.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h index dd7ad9f13e3a..8454300825b9 100644 --- a/fs/hfsplus/hfsplus_fs.h +++ b/fs/hfsplus/hfsplus_fs.h @@ -156,6 +156,7 @@ struct hfsplus_sb_info { /* Runtime variables */ u32 blockoffset; + u32 min_io_size; sector_t part_start; sector_t sect_count; int fs_shift; @@ -304,7 +305,7 @@ struct hfsplus_readdir_data { */ static inline unsigned short hfsplus_min_io_size(struct super_block *sb) { - return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev), + return max_t(unsigned short, HFSPLUS_SB(sb)->min_io_size, HFSPLUS_SECTOR_SIZE); } diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c index 08c1580bdf7a..eb76ba8e8fec 100644 --- a/fs/hfsplus/wrapper.c +++ b/fs/hfsplus/wrapper.c @@ -170,6 +170,8 @@ int hfsplus_read_wrapper(struct super_block *sb) if (!blocksize) goto out; + sbi->min_io_size = blocksize; + if (hfsplus_get_last_session(sb, &part_start, &part_size)) goto out; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] hfsplus: don't query the device logical block size multiple times
by Chen Zhongjin 07 Mar '25

07 Mar '25

From: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> stable inclusion from stable-v4.19.325 commit baccb5e12577b7a9eff54ffba301fdaa0f3ee5a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADN CVE: CVE-2024-56548 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… 66090815a24ce14cf51ef5453fc0218fe8a39bc2 -------------------------------- [ Upstream commit 1c82587cb57687de3f18ab4b98a8850c789bedcf ] Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size. Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized. Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096. The produced KASAN report before the fix looks like this: [ 419.944641] ================================================================== [ 419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [ 419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [ 419.947612] [ 419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [ 419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 419.950035] Call Trace: [ 419.950384] <TASK> [ 419.950676] dump_stack_lvl+0x57/0x78 [ 419.951212] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.951830] print_report+0x14c/0x49e [ 419.952361] ? __virt_addr_valid+0x267/0x278 [ 419.952979] ? kmem_cache_debug_flags+0xc/0x1d [ 419.953561] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.954231] kasan_report+0x89/0xb0 [ 419.954748] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.955367] hfsplus_read_wrapper+0x659/0xa0a [ 419.955948] ? __pfx_hfsplus_read_wrapper+0x10/0x10 [ 419.956618] ? do_raw_spin_unlock+0x59/0x1a9 [ 419.957214] ? _raw_spin_unlock+0x1a/0x2e [ 419.957772] hfsplus_fill_super+0x348/0x1590 [ 419.958355] ? hlock_class+0x4c/0x109 [ 419.958867] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.959499] ? __pfx_string+0x10/0x10 [ 419.960006] ? lock_acquire+0x3e2/0x454 [ 419.960532] ? bdev_name.constprop.0+0xce/0x243 [ 419.961129] ? __pfx_bdev_name.constprop.0+0x10/0x10 [ 419.961799] ? pointer+0x3f0/0x62f [ 419.962277] ? __pfx_pointer+0x10/0x10 [ 419.962761] ? vsnprintf+0x6c4/0xfba [ 419.963178] ? __pfx_vsnprintf+0x10/0x10 [ 419.963621] ? setup_bdev_super+0x376/0x3b3 [ 419.964029] ? snprintf+0x9d/0xd2 [ 419.964344] ? __pfx_snprintf+0x10/0x10 [ 419.964675] ? lock_acquired+0x45c/0x5e9 [ 419.965016] ? set_blocksize+0x139/0x1c1 [ 419.965381] ? sb_set_blocksize+0x6d/0xae [ 419.965742] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.966179] mount_bdev+0x12f/0x1bf [ 419.966512] ? __pfx_mount_bdev+0x10/0x10 [ 419.966886] ? vfs_parse_fs_string+0xce/0x111 [ 419.967293] ? __pfx_vfs_parse_fs_string+0x10/0x10 [ 419.967702] ? __pfx_hfsplus_mount+0x10/0x10 [ 419.968073] legacy_get_tree+0x104/0x178 [ 419.968414] vfs_get_tree+0x86/0x296 [ 419.968751] path_mount+0xba3/0xd0b [ 419.969157] ? __pfx_path_mount+0x10/0x10 [ 419.969594] ? kmem_cache_free+0x1e2/0x260 [ 419.970311] do_mount+0x99/0xe0 [ 419.970630] ? __pfx_do_mount+0x10/0x10 [ 419.971008] __do_sys_mount+0x199/0x1c9 [ 419.971397] do_syscall_64+0xd0/0x135 [ 419.971761] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 419.972233] RIP: 0033:0x7c3cb812972e [ 419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [ 419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [ 419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: 00007ffe306325d0 [ 419.976363] RBP: 00007ffe30632720 R08: 00007ffe30632610 R09: 0000000000000000 [ 419.977034] R10: 0000000000200008 R11: 0000000000000286 R12: 0000000000000000 [ 419.977713] R13: 00007ffe306328e8 R14: 00005a0eb298bc68 R15: 00007c3cb8356000 [ 419.978375] </TASK> [ 419.978589] Fixes: 6596528e391a ("hfsplus: ensure bio requests are not smaller than the hardware sectors") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> Link: https://lore.kernel.org/r/20241107114109.839253-1-cascardo@igalia.com Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- fs/hfsplus/hfsplus_fs.h | 3 ++- fs/hfsplus/wrapper.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h index dd7ad9f13e3a..8454300825b9 100644 --- a/fs/hfsplus/hfsplus_fs.h +++ b/fs/hfsplus/hfsplus_fs.h @@ -156,6 +156,7 @@ struct hfsplus_sb_info { /* Runtime variables */ u32 blockoffset; + u32 min_io_size; sector_t part_start; sector_t sect_count; int fs_shift; @@ -304,7 +305,7 @@ struct hfsplus_readdir_data { */ static inline unsigned short hfsplus_min_io_size(struct super_block *sb) { - return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev), + return max_t(unsigned short, HFSPLUS_SB(sb)->min_io_size, HFSPLUS_SECTOR_SIZE); } diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c index 08c1580bdf7a..eb76ba8e8fec 100644 --- a/fs/hfsplus/wrapper.c +++ b/fs/hfsplus/wrapper.c @@ -170,6 +170,8 @@ int hfsplus_read_wrapper(struct super_block *sb) if (!blocksize) goto out; + sbi->min_io_size = blocksize; + if (hfsplus_get_last_session(sb, &part_start, &part_size)) goto out; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
by Chen Zhongjin 07 Mar '25

07 Mar '25

From: Xin Xiong <xiongx18(a)fudan.edu.cn> stable inclusion from stable-v4.19.238 commit 72d77ddb2224ebc00648f4f78f8a9a259dccbdf7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP45K CVE: CVE-2022-49137 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit dfced44f122c500004a48ecc8db516bb6a295a1b ] This issue takes place in an error path in amdgpu_cs_fence_to_handle_ioctl(). When `info->in.what` falls into default case, the function simply returns -EINVAL, forgetting to decrement the reference count of a dma_fence obj, which is bumped earlier by amdgpu_cs_get_fence(). This may result in reference count leaks. Fix it by decreasing the refcount of specific object before returning the error code. Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Xin Xiong <xiongx18(a)fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf(a)gmail.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index aa2731848c3a..d1554485f8e5 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -1469,6 +1469,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data, return 0; default: + dma_fence_put(fence); return -EINVAL; } } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/hfi1: Prevent use of lock before it is initialized
by Chen Zhongjin 07 Mar '25

07 Mar '25

From: Douglas Miller <doug.miller(a)cornelisnetworks.com> stable inclusion from stable-v4.19.247 commit 66090815a24ce14cf51ef5453fc0218fe8a39bc2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6TA CVE: CVE-2022-49433 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 05c03dfd09c069c4ffd783b47b2da5dcc9421f2c ] If there is a failure during probe of hfi1 before the sdma_map_lock is initialized, the call to hfi1_free_devdata() will attempt to use a lock that has not been initialized. If the locking correctness validator is on then an INFO message and stack trace resembling the following may be seen: INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. Call Trace: register_lock_class+0x11b/0x880 __lock_acquire+0xf3/0x7930 lock_acquire+0xff/0x2d0 _raw_spin_lock_irq+0x46/0x60 sdma_clean+0x42a/0x660 [hfi1] hfi1_free_devdata+0x3a7/0x420 [hfi1] init_one+0x867/0x11a0 [hfi1] pci_device_probe+0x40e/0x8d0 The use of sdma_map_lock in sdma_clean() is for freeing the sdma_map memory, and sdma_map is not allocated/initialized until after sdma_map_lock has been initialized. This code only needs to be run if sdma_map is not NULL, and so checking for that condition will avoid trying to use the lock before it is initialized. Fixes: 473291b3ea0e ("IB/hfi1: Fix for early release of sdma context") Fixes: 7724105686e7 ("IB/hfi1: add driver files") Link: https://lore.kernel.org/r/20220520183701.48973.72434.stgit@awfm-01.cornelis… Reported-by: Zheyu Ma <zheyuma97(a)gmail.com> Signed-off-by: Douglas Miller <doug.miller(a)cornelisnetworks.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/infiniband/hw/hfi1/sdma.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c index 291c12f588b5..3866e42d998a 100644 --- a/drivers/infiniband/hw/hfi1/sdma.c +++ b/drivers/infiniband/hw/hfi1/sdma.c @@ -1313,11 +1313,13 @@ void sdma_clean(struct hfi1_devdata *dd, size_t num_engines) kvfree(sde->tx_ring); sde->tx_ring = NULL; } - spin_lock_irq(&dd->sde_map_lock); - sdma_map_free(rcu_access_pointer(dd->sdma_map)); - RCU_INIT_POINTER(dd->sdma_map, NULL); - spin_unlock_irq(&dd->sde_map_lock); - synchronize_rcu(); + if (rcu_access_pointer(dd->sdma_map)) { + spin_lock_irq(&dd->sde_map_lock); + sdma_map_free(rcu_access_pointer(dd->sdma_map)); + RCU_INIT_POINTER(dd->sdma_map, NULL); + spin_unlock_irq(&dd->sde_map_lock); + synchronize_rcu(); + } kfree(dd->per_sdma); dd->per_sdma = NULL; -- 2.25.1

2 1

[PATCH OLK-5.10] Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
by Yang Yingliang 07 Mar '25

07 Mar '25

From: Fedor Pchelkin <pchelkin(a)ispras.ru> mainline inclusion from mainline-v6.14-rc1 commit 5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5E CVE: CVE-2024-58009 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A NULL sock pointer is passed into l2cap_sock_alloc() when it is called from l2cap_sock_new_connection_cb() and the error handling paths should also be aware of it. Seemingly a more elegant solution would be to swap bt_sock_alloc() and l2cap_chan_create() calls since they are not interdependent to that moment but then l2cap_chan_create() adds the soon to be deallocated and still dummy-initialized channel to the global list accessible by many L2CAP paths. The channel would be removed from the list in short period of time but be a bit more straight-forward here and just check for NULL instead of changing the order of function calls. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool. Fixes: 7c4f78cdb8e7 ("Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()") Cc: stable(a)vger.kernel.org Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index c736aba98161..6537d0867fb3 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1864,7 +1864,8 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, chan = l2cap_chan_create(); if (!chan) { sk_free(sk); - sock->sk = NULL; + if (sock) + sock->sk = NULL; return NULL; } -- 2.25.1

2 1

[PATCH OLK-6.6 0/1] fix CVE-2024-57999
by Lin Yujun 07 Mar '25

07 Mar '25

Gaurav Batra (1): powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW arch/powerpc/kernel/iommu.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6] clk: qcom: dispcc-sm6350: Add missing parent_map for a clock
by Yifan Qiao 07 Mar '25

07 Mar '25

From: Luca Weiss <luca.weiss(a)fairphone.com> mainline inclusion from mainline-v6.14-rc1 commit d4cdb196f182d2fbe336c968228be00d8c3fed05 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBRED1 CVE: CVE-2024-58080 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If a clk_rcg2 has a parent, it should also have parent_map defined, otherwise we'll get a NULL pointer dereference when calling clk_set_rate like the following: [ 3.388105] Call trace: [ 3.390664] qcom_find_src_index+0x3c/0x70 (P) [ 3.395301] qcom_find_src_index+0x1c/0x70 (L) [ 3.399934] _freq_tbl_determine_rate+0x48/0x100 [ 3.404753] clk_rcg2_determine_rate+0x1c/0x28 [ 3.409387] clk_core_determine_round_nolock+0x58/0xe4 [ 3.421414] clk_core_round_rate_nolock+0x48/0xfc [ 3.432974] clk_core_round_rate_nolock+0xd0/0xfc [ 3.444483] clk_core_set_rate_nolock+0x8c/0x300 [ 3.455886] clk_set_rate+0x38/0x14c Add the parent_map property for the clock where it's missing and also un-inline the parent_data as well to keep the matching parent_map and parent_data together. Fixes: 837519775f1d ("clk: qcom: Add display clock controller driver for SM6350") Cc: stable(a)vger.kernel.org Signed-off-by: Luca Weiss <luca.weiss(a)fairphone.com> Reviewed-by: Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> Link: https://lore.kernel.org/r/20241220-sm6350-parent_map-v1-2-64f3d04cb2eb@fair… Signed-off-by: Bjorn Andersson <andersson(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/clk/qcom/dispcc-sm6350.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/clk/qcom/dispcc-sm6350.c b/drivers/clk/qcom/dispcc-sm6350.c index 441f042f5ea4..ddacb4f76eca 100644 --- a/drivers/clk/qcom/dispcc-sm6350.c +++ b/drivers/clk/qcom/dispcc-sm6350.c @@ -187,13 +187,12 @@ static struct clk_rcg2 disp_cc_mdss_dp_aux_clk_src = { .cmd_rcgr = 0x1144, .mnd_width = 0, .hid_width = 5, + .parent_map = disp_cc_parent_map_6, .freq_tbl = ftbl_disp_cc_mdss_dp_aux_clk_src, .clkr.hw.init = &(struct clk_init_data){ .name = "disp_cc_mdss_dp_aux_clk_src", - .parent_data = &(const struct clk_parent_data){ - .fw_name = "bi_tcxo", - }, - .num_parents = 1, + .parent_data = disp_cc_parent_data_6, + .num_parents = ARRAY_SIZE(disp_cc_parent_data_6), .ops = &clk_rcg2_ops, }, }; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/2] Ignore SB_RDONLY when mounting and remounting nfs
by Li Lingfeng 07 Mar '25

07 Mar '25

When NFS_MOUNT_UNSHARED is not set, NFS forces the sharing of a superblock among each filesystem that mounts sub-directories elonging to a single exported root path. To prevent interference between different filesystems, ignore SB_RDONLY when mounting and remounting nfs. Li Lingfeng (2): nfs: clear SB_RDONLY before getting superblock nfs: ignore SB_RDONLY when remounting nfs fs/nfs/super.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) -- 2.31.1

2 3

[openeuler:openEuler-1.0-LTS 1447/1447] kernel/sched/fair.c:6701:33: error: 'struct task_group' has no member named 'se'
by kernel test robot 07 Mar '25

07 Mar '25

Hi Hui, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 55990887ff37ac2fa796d5182eb2f462955a4d6e commit: 70a232a564cfa99401d197708cf380398ad5e2d7 [1447/1447] sched: Adjust wakeup cpu range according CPU util dynamicly config: arm64-randconfig-r064-20250307 (https://download.01.org/0day-ci/archive/20250307/202503071126.Eez53po7-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250307/202503071126.Eez53po7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503071126.Eez53po7-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/sched/fair.c:3675:6: warning: no previous prototype for 'sync_entity_load_avg' [-Wmissing-prototypes] 3675 | void sync_entity_load_avg(struct sched_entity *se) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/fair.c:3688:6: warning: no previous prototype for 'remove_entity_load_avg' [-Wmissing-prototypes] 3688 | void remove_entity_load_avg(struct sched_entity *se) | ^~~~~~~~~~~~~~~~~~~~~~ In file included from arch/arm64/include/asm/current.h:5, from include/linux/sched.h:12, from kernel/sched/sched.h:5, from kernel/sched/fair.c:23: kernel/sched/fair.c: In function 'set_task_select_cpus': >> kernel/sched/fair.c:6701:33: error: 'struct task_group' has no member named 'se' 6701 | if (unlikely(!tg->se[cpu])) | ^~ include/linux/compiler.h:77:45: note: in definition of macro 'unlikely' 77 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ kernel/sched/fair.c:6707:61: error: 'struct task_group' has no member named 'se' 6707 | spare = (long)(capacity_of(cpu) - tg->se[cpu]->avg.util_avg); | ^~ kernel/sched/fair.c:6720:35: error: 'struct task_group' has no member named 'se' 6720 | util_avg_sum += tg->se[cpu]->avg.util_avg; | ^~ kernel/sched/fair.c: In function 'select_task_rq_fair': kernel/sched/fair.c:6747:23: warning: variable 'time' set but not used [-Wunused-but-set-variable] 6747 | unsigned long time; | ^~~~ kernel/sched/fair.c: In function 'pick_next_task_fair': kernel/sched/fair.c:7291:23: warning: variable 'time' set but not used [-Wunused-but-set-variable] 7291 | unsigned long time; | ^~~~ In file included from include/linux/migrate.h:6, from kernel/sched/sched.h:52: include/linux/mempolicy.h: At top level: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ vim +6701 kernel/sched/fair.c 6670 6671 /* 6672 * set_task_select_cpus: select the cpu range for task 6673 * @p: the task whose available cpu range will to set 6674 * @idlest_cpu: the cpu which is the idlest in prefer cpus 6675 * 6676 * If sum of 'util_avg' among 'preferred_cpus' lower than the percentage 6677 * 'sysctl_sched_util_low_pct' of 'preferred_cpus' capacity, select 6678 * 'preferred_cpus' range for task, otherwise select 'preferred_cpus' for task. 6679 * 6680 * The available cpu range set to p->select_cpus. Idlest cpu in preferred cpus 6681 * set to @idlest_cpu, which is set to wakeup cpu when fast path wakeup cpu 6682 * without p->select_cpus. 6683 */ 6684 static void set_task_select_cpus(struct task_struct *p, int *idlest_cpu, 6685 int sd_flag) 6686 { 6687 unsigned long util_avg_sum = 0; 6688 unsigned long tg_capacity = 0; 6689 long min_util = INT_MIN; 6690 struct task_group *tg; 6691 long spare; 6692 int cpu; 6693 6694 p->select_cpus = &p->cpus_allowed; 6695 if (!prefer_cpus_valid(p)) 6696 return; 6697 6698 rcu_read_lock(); 6699 tg = task_group(p); 6700 for_each_cpu(cpu, p->prefer_cpus) { > 6701 if (unlikely(!tg->se[cpu])) 6702 continue; 6703 6704 if (idlest_cpu && available_idle_cpu(cpu)) { 6705 *idlest_cpu = cpu; 6706 } else if (idlest_cpu) { 6707 spare = (long)(capacity_of(cpu) - tg->se[cpu]->avg.util_avg); 6708 if (spare > min_util) { 6709 min_util = spare; 6710 *idlest_cpu = cpu; 6711 } 6712 } 6713 6714 if (available_idle_cpu(cpu)) { 6715 rcu_read_unlock(); 6716 p->select_cpus = p->prefer_cpus; 6717 return; 6718 } 6719 6720 util_avg_sum += tg->se[cpu]->avg.util_avg; 6721 tg_capacity += capacity_of(cpu); 6722 } 6723 rcu_read_unlock(); 6724 6725 if (tg_capacity > cpumask_weight(p->prefer_cpus) && 6726 util_avg_sum * 100 <= tg_capacity * sysctl_sched_util_low_pct) { 6727 p->select_cpus = p->prefer_cpus; 6728 } 6729 } 6730 #endif 6731 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup
by Huang Xiaojia 07 Mar '25

07 Mar '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.247 commit 5b8aa2ba38c010f47c965dd9bb5a8561813ed649 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP5WK CVE: CVE-2022-49439 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fcee96924ba1596ca80a6770b2567ca546f9a482 ] of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: abc3aeae3aaa ("fsl-rio: Add two ports and rapidio message units support") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://lore.kernel.org/r/20220512123724.62931-1-linmq006@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- arch/powerpc/sysdev/fsl_rio.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c index 5011ffea4e4b..c48ebe677962 100644 --- a/arch/powerpc/sysdev/fsl_rio.c +++ b/arch/powerpc/sysdev/fsl_rio.c @@ -509,8 +509,10 @@ int fsl_rio_setup(struct platform_device *dev) if (rc) { dev_err(&dev->dev, "Can't get %pOF property 'reg'\n", rmu_node); + of_node_put(rmu_node); goto err_rmu; } + of_node_put(rmu_node); rmu_regs_win = ioremap(rmu_regs.start, resource_size(&rmu_regs)); if (!rmu_regs_win) { dev_err(&dev->dev, "Unable to map rmu register window\n"); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ARM: hisi: Add missing of_node_put after of_find_compatible_node
by Huang Xiaojia 07 Mar '25

07 Mar '25

From: Peng Wu <wupeng58(a)huawei.com> stable inclusion from stable-v4.19.247 commit dd4be8ecfb41a29e7c4e551b4e866157ce4a3429 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6KO CVE: CVE-2022-49447 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9bc72e47d4630d58a840a66a869c56b29554cfe4 ] of_find_compatible_node will increment the refcount of the returned device_node. Calling of_node_put() to avoid the refcount leak Signed-off-by: Peng Wu <wupeng58(a)huawei.com> Signed-off-by: Wei Xu <xuwei5(a)hisilicon.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- arch/arm/mach-hisi/platsmp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm/mach-hisi/platsmp.c b/arch/arm/mach-hisi/platsmp.c index da5689ababf7..d7fbfb6d293d 100644 --- a/arch/arm/mach-hisi/platsmp.c +++ b/arch/arm/mach-hisi/platsmp.c @@ -70,14 +70,17 @@ static void __init hi3xxx_smp_prepare_cpus(unsigned int max_cpus) } ctrl_base = of_iomap(np, 0); if (!ctrl_base) { + of_node_put(np); pr_err("failed to map address\n"); return; } if (of_property_read_u32(np, "smp-offset", &offset) < 0) { + of_node_put(np); pr_err("failed to find smp-offset property\n"); return; } ctrl_base += offset; + of_node_put(np); } } @@ -163,6 +166,7 @@ static int hip01_boot_secondary(unsigned int cpu, struct task_struct *idle) if (WARN_ON(!node)) return -1; ctrl_base = of_iomap(node, 0); + of_node_put(node); /* set the secondary core boot from DDR */ remap_reg_value = readl_relaxed(ctrl_base + REG_SC_CTRL); -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] backport mainline bugfix patch
by Lin Yujun 07 Mar '25

07 Mar '25

Thomas Gleixner (1): genirq: Make handle_enforce_irqctx() unconditionally available Yogesh Lal (1): irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly drivers/irqchip/irq-gic-v3.c | 2 +- kernel/irq/internals.h | 9 +++------ 2 files changed, 4 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] backport mainline bugfix patch
by Lin Yujun 07 Mar '25

07 Mar '25

Thomas Gleixner (1): genirq: Make handle_enforce_irqctx() unconditionally available Yogesh Lal (1): irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly drivers/irqchip/irq-gic-v3.c | 2 +- kernel/irq/internals.h | 9 +++------ 2 files changed, 4 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] orangefs: fix a oob in orangefs_debug_write
by Yifan Qiao 07 Mar '25

07 Mar '25

From: Mike Marshall <hubcap(a)omnibond.com> mainline inclusion from mainline-v6.14-rc1 commit f7c848431632598ff9bce57a659db6af60d75b39 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's suggestion and made this patch. Signed-off-by: Mike Marshall <hubcap(a)omnibond.com> Reported-by: syzbot+fc519d7875f2d9186c1f(a)syzkaller.appspotmail.com Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/orangefs/orangefs-debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c index 1b508f543384..fa41db088488 100644 --- a/fs/orangefs/orangefs-debugfs.c +++ b/fs/orangefs/orangefs-debugfs.c @@ -393,9 +393,9 @@ static ssize_t orangefs_debug_write(struct file *file, * Thwart users who try to jamb a ridiculous number * of bytes into the debug file... */ - if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) { + if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) { silly = count; - count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1; + count = ORANGEFS_MAX_DEBUG_STRING_LEN; } buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL); -- 2.39.2

2 1

[PATCH OLK-5.10] orangefs: fix a oob in orangefs_debug_write
by Yifan Qiao 07 Mar '25

07 Mar '25

From: Mike Marshall <hubcap(a)omnibond.com> mainline inclusion from mainline-v6.14-rc1 commit f7c848431632598ff9bce57a659db6af60d75b39 category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's suggestion and made this patch. Signed-off-by: Mike Marshall <hubcap(a)omnibond.com> Reported-by: syzbot+fc519d7875f2d9186c1f(a)syzkaller.appspotmail.com Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/orangefs/orangefs-debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c index 1b508f543384..fa41db088488 100644 --- a/fs/orangefs/orangefs-debugfs.c +++ b/fs/orangefs/orangefs-debugfs.c @@ -393,9 +393,9 @@ static ssize_t orangefs_debug_write(struct file *file, * Thwart users who try to jamb a ridiculous number * of bytes into the debug file... */ - if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) { + if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) { silly = count; - count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1; + count = ORANGEFS_MAX_DEBUG_STRING_LEN; } buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL); -- 2.39.2

2 1

[PATCH OLK-5.10] crypto: qat - add param check for DH
by Yifan Qiao 07 Mar '25

07 Mar '25

From: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> mainline inclusion from mainline-v5.19-rc1 commit 2acbb8771f6ac82422886e63832ee7a0f4b1635b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBP212 CVE: CVE-2022-49564 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reject requests with a source buffer that is bigger than the size of the key. This is to prevent a possible integer underflow that might happen when copying the source scatterlist into a linear buffer. Cc: stable(a)vger.kernel.org Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> Reviewed-by: Adam Guerin <adam.guerin(a)intel.com> Reviewed-by: Wojciech Ziemba <wojciech.ziemba(a)intel.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/crypto/qat/qat_common/qat_asym_algs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c index 846569ec9066..50c81a2a560e 100644 --- a/drivers/crypto/qat/qat_common/qat_asym_algs.c +++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c @@ -228,6 +228,10 @@ static int qat_dh_compute_value(struct kpp_request *req) req->dst_len = ctx->p_size; return -EOVERFLOW; } + + if (req->src_len > ctx->p_size) + return -EINVAL; + memset(msg, '\0', sizeof(*msg)); ICP_QAT_FW_PKE_HDR_VALID_FLAG_SET(msg->pke_hdr, ICP_QAT_FW_COMN_REQ_FLAG_SET); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] crypto: qat - add param check for DH
by Yifan Qiao 07 Mar '25

07 Mar '25

From: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> mainline inclusion from mainline-v5.19-rc1 commit 2acbb8771f6ac82422886e63832ee7a0f4b1635b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBP212 CVE: CVE-2022-49564 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reject requests with a source buffer that is bigger than the size of the key. This is to prevent a possible integer underflow that might happen when copying the source scatterlist into a linear buffer. Cc: stable(a)vger.kernel.org Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> Reviewed-by: Adam Guerin <adam.guerin(a)intel.com> Reviewed-by: Wojciech Ziemba <wojciech.ziemba(a)intel.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/crypto/qat/qat_common/qat_asym_algs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c index 320e7854b4ee..7eab5078fecd 100644 --- a/drivers/crypto/qat/qat_common/qat_asym_algs.c +++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c @@ -273,6 +273,10 @@ static int qat_dh_compute_value(struct kpp_request *req) req->dst_len = ctx->p_size; return -EOVERFLOW; } + + if (req->src_len > ctx->p_size) + return -EINVAL; + memset(msg, '\0', sizeof(*msg)); ICP_QAT_FW_PKE_HDR_VALID_FLAG_SET(msg->pke_hdr, ICP_QAT_FW_COMN_REQ_FLAG_SET); -- 2.39.2

2 1

[PATCH OLK-6.6] orangefs: fix a oob in orangefs_debug_write
by Yifan Qiao 07 Mar '25

07 Mar '25

From: Mike Marshall <hubcap(a)omnibond.com> mainline inclusion from mainline-v6.14-rc1 commit f7c848431632598ff9bce57a659db6af60d75b39 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's suggestion and made this patch. Signed-off-by: Mike Marshall <hubcap(a)omnibond.com> Reported-by: syzbot+fc519d7875f2d9186c1f(a)syzkaller.appspotmail.com Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/orangefs/orangefs-debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c index 1b508f543384..fa41db088488 100644 --- a/fs/orangefs/orangefs-debugfs.c +++ b/fs/orangefs/orangefs-debugfs.c @@ -393,9 +393,9 @@ static ssize_t orangefs_debug_write(struct file *file, * Thwart users who try to jamb a ridiculous number * of bytes into the debug file... */ - if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) { + if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) { silly = count; - count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1; + count = ORANGEFS_MAX_DEBUG_STRING_LEN; } buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL); -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 1447/1447] kernel/futex.o: warning: objtool: get_futex_key()+0xf8b: unreachable instruction
by kernel test robot 07 Mar '25

07 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: fa7c6902e19233b35b7caf7c8d591f1c48aa2be1 commit: b404141975c53fb7b92d74e28466b98b81db4b2e [1447/1447] futex: Provide and use pi_state_update_owner() config: x86_64-buildonly-randconfig-002-20250306 (https://download.01.org/0day-ci/archive/20250307/202503070152.Lezu4e8K-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250307/202503070152.Lezu4e8K-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503070152.Lezu4e8K-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/futex.c:56: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. >> kernel/futex.o: warning: objtool: get_futex_key()+0xf8b: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
by Yang Yingliang 06 Mar '25

06 Mar '25

From: Fedor Pchelkin <pchelkin(a)ispras.ru> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANO CVE: CVE-2024-56605 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.gi… ---------------------------------------- A NULL sock pointer is passed into l2cap_sock_alloc() when it is called from l2cap_sock_new_connection_cb() and the error handling paths should also be aware of it. Seemingly a more elegant solution would be to swap bt_sock_alloc() and l2cap_chan_create() calls since they are not interdependent to that moment but then l2cap_chan_create() adds the soon to be deallocated and still dummy-initialized channel to the global list accessible by many L2CAP paths. The channel would be removed from the list in short period of time but be a bit more straight-forward here and just check for NULL instead of changing the order of function calls. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool. Fixes: 7c4f78cdb8e7 ("Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()") Cc: stable(a)vger.kernel.org Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index c736aba98161..6537d0867fb3 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1864,7 +1864,8 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, chan = l2cap_chan_create(); if (!chan) { sk_free(sk); - sock->sk = NULL; + if (sock) + sock->sk = NULL; return NULL; } -- 2.25.1

1 0

[PATCH OLK-5.10] Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
by Yang Yingliang 06 Mar '25

06 Mar '25

From: Fedor Pchelkin <pchelkin(a)ispras.ru> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANO CVE: CVE-2024-56605 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.gi… ---------------------------------------- A NULL sock pointer is passed into l2cap_sock_alloc() when it is called from l2cap_sock_new_connection_cb() and the error handling paths should also be aware of it. Seemingly a more elegant solution would be to swap bt_sock_alloc() and l2cap_chan_create() calls since they are not interdependent to that moment but then l2cap_chan_create() adds the soon to be deallocated and still dummy-initialized channel to the global list accessible by many L2CAP paths. The channel would be removed from the list in short period of time but be a bit more straight-forward here and just check for NULL instead of changing the order of function calls. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool. Fixes: 7c4f78cdb8e7 ("Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()") Cc: stable(a)vger.kernel.org Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index c736aba98161..6537d0867fb3 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1864,7 +1864,8 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, chan = l2cap_chan_create(); if (!chan) { sk_free(sk); - sock->sk = NULL; + if (sock) + sock->sk = NULL; return NULL; } -- 2.25.1

2 1

[PATCH OLK-5.10] srcu: Tighten cleanup_srcu_struct() GP checks
by Yang Yingliang 06 Mar '25

06 Mar '25

From: "Paul E. McKenney" <paulmck(a)kernel.org> mainline inclusion from mainline-v5.19-rc1 commit 8ed00760203d8018bee042fbfe8e076579be2c2b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP415 CVE: CVE-2022-49651 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently, cleanup_srcu_struct() checks for a grace period in progress, but it does not check for a grace period that has not yet started but which might start at any time. Such a situation could result in a use-after-free bug, so this commit adds a check for a grace period that is needed but not yet started to cleanup_srcu_struct(). Signed-off-by: Paul E. McKenney <paulmck(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/rcu/srcutree.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c index 464636475636..579dcc77f28d 100644 --- a/kernel/rcu/srcutree.c +++ b/kernel/rcu/srcutree.c @@ -390,9 +390,11 @@ void cleanup_srcu_struct(struct srcu_struct *ssp) return; /* Forgot srcu_barrier(), so just leak it! */ } if (WARN_ON(rcu_seq_state(READ_ONCE(ssp->srcu_gp_seq)) != SRCU_STATE_IDLE) || + WARN_ON(rcu_seq_current(&ssp->srcu_gp_seq) != ssp->srcu_gp_seq_needed) || WARN_ON(srcu_readers_active(ssp))) { - pr_info("%s: Active srcu_struct %p state: %d\n", - __func__, ssp, rcu_seq_state(READ_ONCE(ssp->srcu_gp_seq))); + pr_info("%s: Active srcu_struct %p read state: %d gp state: %lu/%lu\n", + __func__, ssp, rcu_seq_state(READ_ONCE(ssp->srcu_gp_seq)), + rcu_seq_current(&ssp->srcu_gp_seq), ssp->srcu_gp_seq_needed); return; /* Caller forgot to stop doing call_srcu()? */ } free_percpu(ssp->sda); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] iio: trigger: sysfs: fix use-after-free on remove
by Yang Yingliang 06 Mar '25

06 Mar '25

From: Vincent Whitchurch <vincent.whitchurch(a)axis.com> stable inclusion from stable-v4.19.250 commit 31ff3309b47d98313c61b8301bf595820cc3cc33 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP74F CVE: CVE-2022-49685 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 78601726d4a59a291acc5a52da1d3a0a6831e4e8 upstream. Ensure that the irq_work has completed before the trigger is freed. ================================================================== BUG: KASAN: use-after-free in irq_work_run_list Read of size 8 at addr 0000000064702248 by task python3/25 Call Trace: irq_work_run_list irq_work_tick update_process_times tick_sched_handle tick_sched_timer __hrtimer_run_queues hrtimer_interrupt Allocated by task 25: kmem_cache_alloc_trace iio_sysfs_trig_add dev_attr_store sysfs_kf_write kernfs_fop_write_iter new_sync_write vfs_write ksys_write sys_write Freed by task 25: kfree iio_sysfs_trig_remove dev_attr_store sysfs_kf_write kernfs_fop_write_iter new_sync_write vfs_write ksys_write sys_write ================================================================== Fixes: f38bc926d022 ("staging:iio:sysfs-trigger: Use irq_work to properly active trigger") Signed-off-by: Vincent Whitchurch <vincent.whitchurch(a)axis.com> Reviewed-by: Lars-Peter Clausen <lars(a)metafoo.de> Link: https://lore.kernel.org/r/20220519091925.1053897-1-vincent.whitchurch@axis.… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iio/trigger/iio-trig-sysfs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iio/trigger/iio-trig-sysfs.c b/drivers/iio/trigger/iio-trig-sysfs.c index 3f0dc9a1a514..cccc07e637a4 100644 --- a/drivers/iio/trigger/iio-trig-sysfs.c +++ b/drivers/iio/trigger/iio-trig-sysfs.c @@ -198,6 +198,7 @@ static int iio_sysfs_trigger_remove(int id) } iio_trigger_unregister(t->trig); + irq_work_sync(&t->work); iio_trigger_free(t->trig); list_del(&t->l); -- 2.25.1

2 1

[PATCH OLK-4.19] iio: trigger: sysfs: fix use-after-free on remove
by Yang Yingliang 06 Mar '25

06 Mar '25

From: Vincent Whitchurch <vincent.whitchurch(a)axis.com> stable inclusion from stable-v4.19.250 commit 31ff3309b47d98313c61b8301bf595820cc3cc33 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP74F CVE: CVE-2022-49685 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 78601726d4a59a291acc5a52da1d3a0a6831e4e8 upstream. Ensure that the irq_work has completed before the trigger is freed. ================================================================== BUG: KASAN: use-after-free in irq_work_run_list Read of size 8 at addr 0000000064702248 by task python3/25 Call Trace: irq_work_run_list irq_work_tick update_process_times tick_sched_handle tick_sched_timer __hrtimer_run_queues hrtimer_interrupt Allocated by task 25: kmem_cache_alloc_trace iio_sysfs_trig_add dev_attr_store sysfs_kf_write kernfs_fop_write_iter new_sync_write vfs_write ksys_write sys_write Freed by task 25: kfree iio_sysfs_trig_remove dev_attr_store sysfs_kf_write kernfs_fop_write_iter new_sync_write vfs_write ksys_write sys_write ================================================================== Fixes: f38bc926d022 ("staging:iio:sysfs-trigger: Use irq_work to properly active trigger") Signed-off-by: Vincent Whitchurch <vincent.whitchurch(a)axis.com> Reviewed-by: Lars-Peter Clausen <lars(a)metafoo.de> Link: https://lore.kernel.org/r/20220519091925.1053897-1-vincent.whitchurch@axis.… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iio/trigger/iio-trig-sysfs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iio/trigger/iio-trig-sysfs.c b/drivers/iio/trigger/iio-trig-sysfs.c index 3f0dc9a1a514..cccc07e637a4 100644 --- a/drivers/iio/trigger/iio-trig-sysfs.c +++ b/drivers/iio/trigger/iio-trig-sysfs.c @@ -198,6 +198,7 @@ static int iio_sysfs_trigger_remove(int id) } iio_trigger_unregister(t->trig); + irq_work_sync(&t->work); iio_trigger_free(t->trig); list_del(&t->l); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] media: cx25821: Fix the warning when removing the module
by Tirui Yin 06 Mar '25

06 Mar '25

From: Zheyu Ma <zheyuma97(a)gmail.com> stable inclusion from stable-v4.19.247 commit 258639bc55a586ee6df92d89786ccf1c71546d70 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3AF CVE: CVE-2022-49525 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2203436a4d24302871617373a7eb21bc17e38762 ] When removing the module, we will get the following warning: [ 14.746697] remove_proc_entry: removing non-empty directory 'irq/21', leaking at least 'cx25821[1]' [ 14.747449] WARNING: CPU: 4 PID: 368 at fs/proc/generic.c:717 remove_proc_entry+0x389/0x3f0 [ 14.751611] RIP: 0010:remove_proc_entry+0x389/0x3f0 [ 14.759589] Call Trace: [ 14.759792] <TASK> [ 14.759975] unregister_irq_proc+0x14c/0x170 [ 14.760340] irq_free_descs+0x94/0xe0 [ 14.760640] mp_unmap_irq+0xb6/0x100 [ 14.760937] acpi_unregister_gsi_ioapic+0x27/0x40 [ 14.761334] acpi_pci_irq_disable+0x1d3/0x320 [ 14.761688] pci_disable_device+0x1ad/0x380 [ 14.762027] ? _raw_spin_unlock_irqrestore+0x2d/0x60 [ 14.762442] ? cx25821_shutdown+0x20/0x9f0 [cx25821] [ 14.762848] cx25821_finidev+0x48/0xc0 [cx25821] [ 14.763242] pci_device_remove+0x92/0x240 Fix this by freeing the irq before call pci_disable_device(). Signed-off-by: Zheyu Ma <zheyuma97(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/media/pci/cx25821/cx25821-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c index 2f0171134f7e..48b81c458159 100644 --- a/drivers/media/pci/cx25821/cx25821-core.c +++ b/drivers/media/pci/cx25821/cx25821-core.c @@ -1348,11 +1348,11 @@ static void cx25821_finidev(struct pci_dev *pci_dev) struct cx25821_dev *dev = get_cx25821(v4l2_dev); cx25821_shutdown(dev); - pci_disable_device(pci_dev); /* unregister stuff */ if (pci_dev->irq) free_irq(pci_dev->irq, dev); + pci_disable_device(pci_dev); cx25821_dev_unregister(dev); v4l2_device_unregister(v4l2_dev); -- 2.22.0

2 1

[PATCH OLK-5.10] bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
by Tirui Yin 06 Mar '25

06 Mar '25

From: Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> mainline inclusion from mainline-v5.19-rc3 commit 928ea98252ad75118950941683893cf904541da9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP74W CVE: CVE-2022-49711 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to fsl_destroy_mc_io(). However, mc->root_mc_bus_dev is already freed in fsl_mc_device_remove(). Then reference to mc->root_mc_bus_dev->mc_io triggers KASAN use-after-free. To avoid the use-after-free, keep the reference to mc->root_mc_bus_dev->mc_io in a local variable and pass to fsl_destroy_mc_io(). This patch needs rework to apply to kernels older than v5.15. Fixes: f93627146f0e ("staging: fsl-mc: fix asymmetry in destroy of mc_io") Cc: stable(a)vger.kernel.org # v5.15+ Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Link: https://lore.kernel.org/r/20220601105159.87752-1-shinichiro.kawasaki@wdc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index e329cdd7156c..5ffe7333a3c9 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -1080,14 +1080,14 @@ static int fsl_mc_bus_probe(struct platform_device *pdev) static int fsl_mc_bus_remove(struct platform_device *pdev) { struct fsl_mc *mc = platform_get_drvdata(pdev); + struct fsl_mc_io *mc_io; if (!fsl_mc_is_root_dprc(&mc->root_mc_bus_dev->dev)) return -EINVAL; + mc_io = mc->root_mc_bus_dev->mc_io; fsl_mc_device_remove(mc->root_mc_bus_dev); - - fsl_destroy_mc_io(mc->root_mc_bus_dev->mc_io); - mc->root_mc_bus_dev->mc_io = NULL; + fsl_destroy_mc_io(mc_io); return 0; } -- 2.22.0

2 1

[PATCH OLK-5.10] ASoC: atmel: Fix error handling in snd_proto_probe
by Tirui Yin 06 Mar '25

06 Mar '25

mainline inclusion from mainline-v5.18-rc1 commit b0bfaf0544d08d093d6211d7ef8816fb0b5b6c75 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3KX CVE: CVE-2022-49246 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done. This function only calls of_node_put() in the regular path. And it will cause refcount leak in error paths. Fix this by calling of_node_put() in error handling too. Fixes: a45f8853a5f9 ("ASoC: Add driver for PROTO Audio CODEC (with a WM8731)") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Reviewed-by: Codrin Ciubotariu <codrin.ciubotariu(a)microchip.com> Link: https://lore.kernel.org/r/20220308013949.20323-1-linmq006@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Conflicts: sound/soc/atmel/mikroe-proto.c [adapt for OLK-5.10, fix this conflict] Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: yongqiang Liu <liuyongqiang13(a)huawei.com> --- sound/soc/atmel/mikroe-proto.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/sound/soc/atmel/mikroe-proto.c b/sound/soc/atmel/mikroe-proto.c index f9a85fd01b79..01e5ab79f576 100644 --- a/sound/soc/atmel/mikroe-proto.c +++ b/sound/soc/atmel/mikroe-proto.c @@ -115,7 +115,8 @@ static int snd_proto_probe(struct platform_device *pdev) cpu_np = of_parse_phandle(np, "i2s-controller", 0); if (!cpu_np) { dev_err(&pdev->dev, "i2s-controller missing\n"); - return -EINVAL; + ret = -EINVAL; + goto put_codec_node; } dai->cpus->of_node = cpu_np; dai->platforms->of_node = cpu_np; @@ -124,7 +125,8 @@ static int snd_proto_probe(struct platform_device *pdev) &bitclkmaster, &framemaster); if (bitclkmaster != framemaster) { dev_err(&pdev->dev, "Must be the same bitclock and frame master\n"); - return -EINVAL; + ret = -EINVAL; + goto put_cpu_node; } if (bitclkmaster) { dai_fmt &= ~SND_SOC_DAIFMT_MASTER_MASK; @@ -133,18 +135,21 @@ static int snd_proto_probe(struct platform_device *pdev) else dai_fmt |= SND_SOC_DAIFMT_CBS_CFS; } - of_node_put(bitclkmaster); - of_node_put(framemaster); - dai->dai_fmt = dai_fmt; - of_node_put(codec_np); - of_node_put(cpu_np); + dai->dai_fmt = dai_fmt; ret = snd_soc_register_card(&snd_proto); if (ret && ret != -EPROBE_DEFER) dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n", ret); + +put_cpu_node: + of_node_put(bitclkmaster); + of_node_put(framemaster); + of_node_put(cpu_np); +put_codec_node: + of_node_put(codec_np); return ret; } -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] virtio_console: eliminate anonymous module_init & module_exit
by Tirui Yin 06 Mar '25

06 Mar '25

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-v4.19.238 commit 0f3d824bd70a1303464d5e93ee3e7afe7832fe89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP714 CVE: CVE-2022-49100 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fefb8a2a941338d871e2d83fbd65fbfa068857bd ] Eliminate anonymous module_init() and module_exit(), which can lead to confusion or ambiguity when reading System.map, crashes/oops/bugs, or an initcall_debug log. Give each of these init and exit functions unique driver-specific names to eliminate the anonymous names. Example 1: (System.map) ffffffff832fc78c t init ffffffff832fc79e t init ffffffff832fc8f8 t init Example 2: (initcall_debug log) calling init+0x0/0x12 @ 1 initcall init+0x0/0x12 returned 0 after 15 usecs calling init+0x0/0x60 @ 1 initcall init+0x0/0x60 returned 0 after 2 usecs calling init+0x0/0x9a @ 1 initcall init+0x0/0x9a returned 0 after 74 usecs Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Reviewed-by: Amit Shah <amit(a)kernel.org> Cc: virtualization(a)lists.linux-foundation.org Cc: Arnd Bergmann <arnd(a)arndb.de> Link: https://lore.kernel.org/r/20220316192010.19001-3-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/char/virtio_console.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index 46188d0a54b8..b6c966516946 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -2256,7 +2256,7 @@ static struct virtio_driver virtio_rproc_serial = { .remove = virtcons_remove, }; -static int __init init(void) +static int __init virtio_console_init(void) { int err; @@ -2293,7 +2293,7 @@ static int __init init(void) return err; } -static void __exit fini(void) +static void __exit virtio_console_fini(void) { reclaim_dma_bufs(); @@ -2303,8 +2303,8 @@ static void __exit fini(void) class_destroy(pdrvdata.class); debugfs_remove_recursive(pdrvdata.debugfs_dir); } -module_init(init); -module_exit(fini); +module_init(virtio_console_init); +module_exit(virtio_console_fini); MODULE_DEVICE_TABLE(virtio, id_table); MODULE_DESCRIPTION("Virtio console driver"); -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] can: gs_usb: gs_usb_open/close(): fix memory leak
by Jinjie Ruan 06 Mar '25

06 Mar '25

From: Rhett Aultman <rhett.aultman(a)samsara.com> stable inclusion from stable-v4.19.252 commit d91492638b054f4a359621ef216242be5973ed6b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6SC CVE: CVE-2022-49661 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2bda24ef95c0311ab93bda00db40486acf30bd0a upstream. The gs_usb driver appears to suffer from a malady common to many USB CAN adapter drivers in that it performs usb_alloc_coherent() to allocate a number of USB request blocks (URBs) for RX, and then later relies on usb_kill_anchored_urbs() to free them, but this doesn't actually free them. As a result, this may be leaking DMA memory that's been used by the driver. This commit is an adaptation of the techniques found in the esd_usb2 driver where a similar design pattern led to a memory leak. It explicitly frees the RX URBs and their DMA memory via a call to usb_free_coherent(). Since the RX URBs were allocated in the gs_can_open(), we remove them in gs_can_close() rather than in the disconnect function as was done in esd_usb2. For more information, see the 928150fad41b ("can: esd_usb2: fix memory leak"). Link: https://lore.kernel.org/all/alpine.DEB.2.22.394.2206031547001.1630869@thela… Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Cc: stable(a)vger.kernel.org Signed-off-by: Rhett Aultman <rhett.aultman(a)samsara.com> Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/net/can/usb/gs_usb.c [Just context conflicts in gs_can_close().] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/net/can/usb/gs_usb.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c index 3a39f51a9e24..8e2267def4c5 100644 --- a/drivers/net/can/usb/gs_usb.c +++ b/drivers/net/can/usb/gs_usb.c @@ -186,6 +186,8 @@ struct gs_can { struct usb_anchor tx_submitted; atomic_t active_tx_urbs; + void *rxbuf[GS_MAX_RX_URBS]; + dma_addr_t rxbuf_dma[GS_MAX_RX_URBS]; }; /* usb interface struct */ @@ -590,6 +592,7 @@ static int gs_can_open(struct net_device *netdev) for (i = 0; i < GS_MAX_RX_URBS; i++) { struct urb *urb; u8 *buf; + dma_addr_t buf_dma; /* alloc rx urb */ urb = usb_alloc_urb(0, GFP_KERNEL); @@ -600,7 +603,7 @@ static int gs_can_open(struct net_device *netdev) buf = usb_alloc_coherent(dev->udev, sizeof(struct gs_host_frame), GFP_KERNEL, - &urb->transfer_dma); + &buf_dma); if (!buf) { netdev_err(netdev, "No memory left for USB buffer\n"); @@ -608,6 +611,8 @@ static int gs_can_open(struct net_device *netdev) return -ENOMEM; } + urb->transfer_dma = buf_dma; + /* fill, anchor, and submit rx urb */ usb_fill_bulk_urb(urb, dev->udev, @@ -631,10 +636,17 @@ static int gs_can_open(struct net_device *netdev) rc); usb_unanchor_urb(urb); + usb_free_coherent(dev->udev, + sizeof(struct gs_host_frame), + buf, + buf_dma); usb_free_urb(urb); break; } + dev->rxbuf[i] = buf; + dev->rxbuf_dma[i] = buf_dma; + /* Drop reference, * USB core will take care of freeing it */ @@ -698,12 +710,19 @@ static int gs_can_close(struct net_device *netdev) int rc; struct gs_can *dev = netdev_priv(netdev); struct gs_usb *parent = dev->parent; + unsigned int i; netif_stop_queue(netdev); /* Stop polling */ - if (atomic_dec_and_test(&parent->active_channels)) + if (atomic_dec_and_test(&parent->active_channels)) { usb_kill_anchored_urbs(&parent->rx_submitted); + for (i = 0; i < GS_MAX_RX_URBS; i++) + usb_free_coherent(dev->udev, + sizeof(struct gs_host_frame), + dev->rxbuf[i], + dev->rxbuf_dma[i]); + } /* Stop sending URBs */ usb_kill_anchored_urbs(&dev->tx_submitted); -- 2.34.1

2 1

[PATCH OLK-5.10] KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel
by Yang Yingliang 06 Mar '25

06 Mar '25

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit a8de7f100bb5989d9c3627d3a223ee1c863f3b69 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC6G CVE: CVE-2025-21779 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Advertise support for Hyper-V's SEND_IPI and SEND_IPI_EX hypercalls if and only if the local API is emulated/virtualized by KVM, and explicitly reject said hypercalls if the local APIC is emulated in userspace, i.e. don't rely on userspace to opt-in to KVM_CAP_HYPERV_ENFORCE_CPUID. Rejecting SEND_IPI and SEND_IPI_EX fixes a NULL-pointer dereference if Hyper-V enlightenments are exposed to the guest without an in-kernel local APIC: dump_stack+0xbe/0xfd __kasan_report.cold+0x34/0x84 kasan_report+0x3a/0x50 __apic_accept_irq+0x3a/0x5c0 kvm_hv_send_ipi.isra.0+0x34e/0x820 kvm_hv_hypercall+0x8d9/0x9d0 kvm_emulate_hypercall+0x506/0x7e0 __vmx_handle_exit+0x283/0xb60 vmx_handle_exit+0x1d/0xd0 vcpu_enter_guest+0x16b0/0x24c0 vcpu_run+0xc0/0x550 kvm_arch_vcpu_ioctl_run+0x170/0x6d0 kvm_vcpu_ioctl+0x413/0xb20 __se_sys_ioctl+0x111/0x160 do_syscal1_64+0x30/0x40 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Note, checking the sending vCPU is sufficient, as the per-VM irqchip_mode can't be modified after vCPUs are created, i.e. if one vCPU has an in-kernel local APIC, then all vCPUs have an in-kernel local APIC. Reported-by: Dongjie Zou <zoudongjie(a)huawei.com> Fixes: 214ff83d4473 ("KVM: x86: hyperv: implement PV IPI send hypercalls") Fixes: 2bc39970e932 ("x86/kvm/hyper-v: Introduce KVM_GET_SUPPORTED_HV_CPUID") Cc: stable(a)vger.kernel.org Reviewed-by: Vitaly Kuznetsov <vkuznets(a)redhat.com> Link: https://lore.kernel.org/r/20250118003454.2619573-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Conflicts: arch/x86/kvm/hyperv.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/x86/kvm/hyperv.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c index 20eb8f55e1f1..e097faf12c82 100644 --- a/arch/x86/kvm/hyperv.c +++ b/arch/x86/kvm/hyperv.c @@ -1618,6 +1618,9 @@ static u64 kvm_hv_send_ipi(struct kvm_vcpu *current_vcpu, u64 ingpa, u64 outgpa, u32 vector; bool all_cpus; + if (!lapic_in_kernel(current_vcpu)) + return HV_STATUS_INVALID_HYPERCALL_INPUT; + if (!ex) { if (!fast) { if (unlikely(kvm_read_guest(kvm, ingpa, &send_ipi, @@ -2060,7 +2063,8 @@ int kvm_vcpu_ioctl_get_hv_cpuid(struct kvm_vcpu *vcpu, struct kvm_cpuid2 *cpuid, ent->eax |= HV_X64_REMOTE_TLB_FLUSH_RECOMMENDED; ent->eax |= HV_X64_APIC_ACCESS_RECOMMENDED; ent->eax |= HV_X64_RELAXED_TIMING_RECOMMENDED; - ent->eax |= HV_X64_CLUSTER_IPI_RECOMMENDED; + if (!vcpu || lapic_in_kernel(vcpu)) + ent->eax |= HV_X64_CLUSTER_IPI_RECOMMENDED; ent->eax |= HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED; if (evmcs_ver) ent->eax |= HV_X64_ENLIGHTENED_VMCS_RECOMMENDED; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] xtensa: Fix refcount leak bug in time.c
by Liu Kai 06 Mar '25

06 Mar '25

From: Liang He <windhl(a)126.com> stable inclusion from stable-v4.19.250 commit f1eaf4ba5372ad111f687a80c67e270708e14c23 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2LY CVE: CVE-2022-49682 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a0117dc956429f2ede17b323046e1968d1849150 upstream. In calibrate_ccount(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Cc: stable(a)vger.kernel.org Signed-off-by: Liang He <windhl(a)126.com> Message-Id: <20220617124432.4049006-1-windhl(a)126.com> Signed-off-by: Max Filippov <jcmvbkbc(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- arch/xtensa/kernel/time.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/xtensa/kernel/time.c b/arch/xtensa/kernel/time.c index 378186b5eb40..071c5f59d620 100644 --- a/arch/xtensa/kernel/time.c +++ b/arch/xtensa/kernel/time.c @@ -146,6 +146,7 @@ static void __init calibrate_ccount(void) cpu = of_find_compatible_node(NULL, NULL, "cdns,xtensa-cpu"); if (cpu) { clk = of_clk_get(cpu, 0); + of_node_put(cpu); if (!IS_ERR(clk)) { ccount_freq = clk_get_rate(clk); return; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] pinctrl: ralink: Check for null return of devm_kcalloc
by Liu Kai 06 Mar '25

06 Mar '25

From: William Dean <williamsukatube(a)gmail.com> stable inclusion from stable-v4.19.254 commit 13596e6c9e541e90e5fc2c52b23f08b951370da9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3KQ CVE: CVE-2022-49608 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c3b821e8e406d5650e587b7ac624ac24e9b780a8 ] Because of the possible failure of the allocation, data->domains might be NULL pointer and will cause the dereference of the NULL pointer later. Therefore, it might be better to check it and directly return -ENOMEM without releasing data manually if fails, because the comment of the devm_kmalloc() says "Memory allocated with this function is automatically freed on driver detach.". Fixes: a86854d0c599b ("treewide: devm_kzalloc() -> devm_kcalloc()") Reported-by: Hacash Robot <hacashRobot(a)santino.com> Signed-off-by: William Dean <williamsukatube(a)gmail.com> Link: https://lore.kernel.org/r/20220710154922.2610876-1-williamsukatube@163.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c index 80e7067cfb79..d4e18c10a137 100644 --- a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c +++ b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c @@ -267,6 +267,8 @@ static int rt2880_pinmux_pins(struct rt2880_priv *p) p->func[i]->pin_count, sizeof(int), GFP_KERNEL); + if (!p->func[i]->pins) + return -ENOMEM; for (j = 0; j < p->func[i]->pin_count; j++) p->func[i]->pins[j] = p->func[i]->pin_first + j; -- 2.34.1

2 1

[PATCH OLK-6.6] wifi: brcmfmac: Check the return value of of_property_read_string_index()
by Liu Kai 06 Mar '25

06 Mar '25

From: Stefan Dösinger <stefan(a)codeweavers.com> stable inclusion from stable-v6.6.78 commit c9480e9f2d10135476101619bcbd1c49c15d595f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC39 CVE: CVE-2025-21750 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 082d9e263af8de68f0c34f67b251818205160f6e ] Somewhen between 6.10 and 6.11 the driver started to crash on my MacBookPro14,3. The property doesn't exist and 'tmp' remains uninitialized, so we pass a random pointer to devm_kstrdup(). The crash I am getting looks like this: BUG: unable to handle page fault for address: 00007f033c669379 PF: supervisor read access in kernel mode PF: error_code(0x0001) - permissions violation PGD 8000000101341067 P4D 8000000101341067 PUD 101340067 PMD 1013bb067 PTE 800000010aee9025 Oops: Oops: 0001 [#1] SMP PTI CPU: 4 UID: 0 PID: 827 Comm: (udev-worker) Not tainted 6.11.8-gentoo #1 Hardware name: Apple Inc. MacBookPro14,3/Mac-551B86E5744E2388, BIOS 529.140.2.0.0 06/23/2024 RIP: 0010:strlen+0x4/0x30 Code: f7 75 ec 31 c0 c3 cc cc cc cc 48 89 f8 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 14 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3 cc RSP: 0018:ffffb4aac0683ad8 EFLAGS: 00010202 RAX: 00000000ffffffea RBX: 00007f033c669379 RCX: 0000000000000001 RDX: 0000000000000cc0 RSI: 00007f033c669379 RDI: 00007f033c669379 RBP: 00000000ffffffea R08: 0000000000000000 R09: 00000000c0ba916a R10: ffffffffffffffff R11: ffffffffb61ea260 R12: ffff91f7815b50c8 R13: 0000000000000cc0 R14: ffff91fafefffe30 R15: ffffb4aac0683b30 FS: 00007f033ccbe8c0(0000) GS:ffff91faeed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f033c669379 CR3: 0000000107b1e004 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x149/0x4c0 ? raw_spin_rq_lock_nested+0xe/0x20 ? sched_balance_newidle+0x22b/0x3c0 ? update_load_avg+0x78/0x770 ? exc_page_fault+0x6f/0x150 ? asm_exc_page_fault+0x26/0x30 ? __pfx_pci_conf1_write+0x10/0x10 ? strlen+0x4/0x30 devm_kstrdup+0x25/0x70 brcmf_of_probe+0x273/0x350 [brcmfmac] Signed-off-by: Stefan Dösinger <stefan(a)codeweavers.com> Acked-by: Arend van Spriel <arend.vanspriel(a)broadcom.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://patch.msgid.link/20250106170958.3595-1-stefan@codeweavers.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c index 73fc701204e2..90d2c536bdaf 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c @@ -96,13 +96,13 @@ void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type, /* Set board-type to the first string of the machine compatible prop */ root = of_find_node_by_path("/"); if (root && err) { - char *board_type; + char *board_type = NULL; const char *tmp; - of_property_read_string_index(root, "compatible", 0, &tmp); - /* get rid of '/' in the compatible string to be able to find the FW */ - board_type = devm_kstrdup(dev, tmp, GFP_KERNEL); + if (!of_property_read_string_index(root, "compatible", 0, &tmp)) + board_type = devm_kstrdup(dev, tmp, GFP_KERNEL); + if (!board_type) { of_node_put(root); return; -- 2.34.1

2 1

[PATCH OLK-6.6] media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread
by Liu Kai 06 Mar '25

06 Mar '25

From: Edward Adam Davis <eadavis(a)qq.com> stable inclusion from stable-v6.6.79 commit 2c5601b99d79d196fe4a37159e3dfb38e778ea18 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC66 CVE: CVE-2024-57834 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1221989555db711578a327a9367f1be46500cb48 ] syzbot report a null-ptr-deref in vidtv_mux_stop_thread. [1] If dvb->mux is not initialized successfully by vidtv_mux_init() in the vidtv_start_streaming(), it will trigger null pointer dereference about mux in vidtv_mux_stop_thread(). Adjust the timing of streaming initialization and check it before stopping it. [1] KASAN: null-ptr-deref in range [0x0000000000000128-0x000000000000012f] CPU: 0 UID: 0 PID: 5842 Comm: syz-executor248 Not tainted 6.13.0-rc4-syzkaller-00012-g9b2ffa6148b1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:vidtv_mux_stop_thread+0x26/0x80 drivers/media/test-drivers/vidtv/vidtv_mux.c:471 Code: 90 90 90 90 66 0f 1f 00 55 53 48 89 fb e8 82 2e c8 f9 48 8d bb 28 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 02 7e 3b 0f b6 ab 28 01 00 00 31 ff 89 ee e8 RSP: 0018:ffffc90003f2faa8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87cfb125 RDX: 0000000000000025 RSI: ffffffff87d120ce RDI: 0000000000000128 RBP: ffff888029b8d220 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000003 R12: ffff888029b8d188 R13: ffffffff8f590aa0 R14: ffffc9000581c5c8 R15: ffff888029a17710 FS: 00007f7eef5156c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7eef5e635c CR3: 0000000076ca6000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> vidtv_stop_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:209 [inline] vidtv_stop_feed+0x151/0x250 drivers/media/test-drivers/vidtv/vidtv_bridge.c:252 dmx_section_feed_stop_filtering+0x90/0x160 drivers/media/dvb-core/dvb_demux.c:1000 dvb_dmxdev_feed_stop.isra.0+0x1ee/0x270 drivers/media/dvb-core/dmxdev.c:486 dvb_dmxdev_filter_stop+0x22a/0x3a0 drivers/media/dvb-core/dmxdev.c:559 dvb_dmxdev_filter_free drivers/media/dvb-core/dmxdev.c:840 [inline] dvb_demux_release+0x92/0x550 drivers/media/dvb-core/dmxdev.c:1246 __fput+0x3f8/0xb60 fs/file_table.c:450 task_work_run+0x14e/0x250 kernel/task_work.c:239 get_signal+0x1d3/0x2610 kernel/signal.c:2790 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f Reported-by: syzbot+5e248227c80a3be8e96a(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5e248227c80a3be8e96a Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Signed-off-by: Hans Verkuil <hverkuil(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/media/test-drivers/vidtv/vidtv_bridge.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/media/test-drivers/vidtv/vidtv_bridge.c b/drivers/media/test-drivers/vidtv/vidtv_bridge.c index 8b04e12af286..6e030584d598 100644 --- a/drivers/media/test-drivers/vidtv/vidtv_bridge.c +++ b/drivers/media/test-drivers/vidtv/vidtv_bridge.c @@ -191,10 +191,11 @@ static int vidtv_start_streaming(struct vidtv_dvb *dvb) mux_args.mux_buf_sz = mux_buf_sz; - dvb->streaming = true; dvb->mux = vidtv_mux_init(dvb->fe[0], dev, &mux_args); if (!dvb->mux) return -ENOMEM; + + dvb->streaming = true; vidtv_mux_start_thread(dvb->mux); dev_dbg_ratelimited(dev, "Started streaming\n"); @@ -205,6 +206,11 @@ static int vidtv_stop_streaming(struct vidtv_dvb *dvb) { struct device *dev = &dvb->pdev->dev; + if (!dvb->streaming) { + dev_warn_ratelimited(dev, "No streaming. Skipping.\n"); + return 0; + } + dvb->streaming = false; vidtv_mux_stop_thread(dvb->mux); vidtv_mux_destroy(dvb->mux); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] nfsd: clear acl_access/acl_default after releasing them
by Li Lingfeng 06 Mar '25

06 Mar '25

mainline inclusion from mainline-v6.14-rc3 commit 7faf14a7b0366f153284db0ad3347c457ea70136 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC30 CVE: CVE-2025-21796 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a pointer pointing to the released posix_acl, which will trigger a WARNING in nfs3svc_release_getacl like this: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 26 PID: 3199 at lib/refcount.c:28 refcount_warn_saturate+0xb5/0x170 Modules linked in: CPU: 26 UID: 0 PID: 3199 Comm: nfsd Not tainted 6.12.0-rc6-00079-g04ae226af01f-dirty #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:refcount_warn_saturate+0xb5/0x170 Code: cc cc 0f b6 1d b3 20 a5 03 80 fb 01 0f 87 65 48 d8 00 83 e3 01 75 e4 48 c7 c7 c0 3b 9b 85 c6 05 97 20 a5 03 01 e8 fb 3e 30 ff <0f> 0b eb cd 0f b6 1d 8a3 RSP: 0018:ffffc90008637cd8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff83904fde RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88871ed36380 RBP: ffff888158beeb40 R08: 0000000000000001 R09: fffff520010c6f56 R10: ffffc90008637ab7 R11: 0000000000000001 R12: 0000000000000001 R13: ffff888140e77400 R14: ffff888140e77408 R15: ffffffff858b42c0 FS: 0000000000000000(0000) GS:ffff88871ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000562384d32158 CR3: 000000055cc6a000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? refcount_warn_saturate+0xb5/0x170 ? __warn+0xa5/0x140 ? refcount_warn_saturate+0xb5/0x170 ? report_bug+0x1b1/0x1e0 ? handle_bug+0x53/0xa0 ? exc_invalid_op+0x17/0x40 ? asm_exc_invalid_op+0x1a/0x20 ? tick_nohz_tick_stopped+0x1e/0x40 ? refcount_warn_saturate+0xb5/0x170 ? refcount_warn_saturate+0xb5/0x170 nfs3svc_release_getacl+0xc9/0xe0 svc_process_common+0x5db/0xb60 ? __pfx_svc_process_common+0x10/0x10 ? __rcu_read_unlock+0x69/0xa0 ? __pfx_nfsd_dispatch+0x10/0x10 ? svc_xprt_received+0xa1/0x120 ? xdr_init_decode+0x11d/0x190 svc_process+0x2a7/0x330 svc_handle_xprt+0x69d/0x940 svc_recv+0x180/0x2d0 nfsd+0x168/0x200 ? __pfx_nfsd+0x10/0x10 kthread+0x1a2/0x1e0 ? kthread+0xf4/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ... Clear acl_access/acl_default after posix_acl_release is called to prevent UAF from being triggered. Fixes: a257cdd0e217 ("[PATCH] NFSD: Add server support for NFSv3 ACLs.") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20241107014705.2509463-1-lilingfeng@huaweicloud… Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Rick Macklem <rmacklem(a)uoguelph.ca> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/nfs2acl.c fs/nfsd/nfs3acl.c [Commit f0af22101d90 ("NFSD: Call NFSv2 encoders on error returns") remove definition of RETURN_STATUS; commit 14168d678a0f ("NFSD: Remove the RETURN_STATUS() macro") remove definition of RETURN_STATUS.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs2acl.c | 2 ++ fs/nfsd/nfs3acl.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c index cbab1d2d8a75..7637646c9d8e 100644 --- a/fs/nfsd/nfs2acl.c +++ b/fs/nfsd/nfs2acl.c @@ -83,6 +83,8 @@ static __be32 nfsacld_proc_getacl(struct svc_rqst *rqstp) fail: posix_acl_release(resp->acl_access); posix_acl_release(resp->acl_default); + resp->acl_access = NULL; + resp->acl_default = NULL; RETURN_STATUS(nfserr); } diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c index 13bca4a2f89d..04cc86a520ca 100644 --- a/fs/nfsd/nfs3acl.c +++ b/fs/nfsd/nfs3acl.c @@ -76,6 +76,8 @@ static __be32 nfsd3_proc_getacl(struct svc_rqst *rqstp) fail: posix_acl_release(resp->acl_access); posix_acl_release(resp->acl_default); + resp->acl_access = NULL; + resp->acl_default = NULL; RETURN_STATUS(nfserr); } -- 2.31.1

2 1

[PATCH OLK-6.6] libbpf: Fix segfault due to libelf functions not setting errno
by Xiaomeng Zhang 06 Mar '25

06 Mar '25

From: Quentin Monnet <qmo(a)kernel.org> mainline inclusion from mainline-v6.14-rc1 commit e10500b69c3f3378f3dcfc8c2fe4cdb74fc844f5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBR43L Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Libelf functions do not set errno on failure. Instead, it relies on its internal _elf_errno value, that can be retrieved via elf_errno (or the corresponding message via elf_errmsg()). From "man libelf": If a libelf function encounters an error it will set an internal error code that can be retrieved with elf_errno. Each thread maintains its own separate error code. The meaning of each error code can be determined with elf_errmsg, which returns a string describing the error. As a consequence, libbpf should not return -errno when a function from libelf fails, because an empty value will not be interpreted as an error and won't prevent the program to stop. This is visible in bpf_linker__add_file(), for example, where we call a succession of functions that rely on libelf: err = err ?: linker_load_obj_file(linker, filename, opts, &obj); err = err ?: linker_append_sec_data(linker, &obj); err = err ?: linker_append_elf_syms(linker, &obj); err = err ?: linker_append_elf_relos(linker, &obj); err = err ?: linker_append_btf(linker, &obj); err = err ?: linker_append_btf_ext(linker, &obj); If the object file that we try to process is not, in fact, a correct object file, linker_load_obj_file() may fail with errno not being set, and return 0. In this case we attempt to run linker_append_elf_sysms() and may segfault. This can happen (and was discovered) with bpftool: $ bpftool gen object output.o sample_ret0.bpf.c libbpf: failed to get ELF header for sample_ret0.bpf.c: invalid `Elf' handle zsh: segmentation fault (core dumped) bpftool gen object output.o sample_ret0.bpf.c Fix the issue by returning a non-null error code (-EINVAL) when libelf functions fail. Fixes: faf6ed321cf6 ("libbpf: Add BPF static linker APIs") Signed-off-by: Quentin Monnet <qmo(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20241205135942.65262-1-qmo@kernel.org Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- tools/lib/bpf/linker.c | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-) diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c index 88cc7236f122..736ebceea233 100644 --- a/tools/lib/bpf/linker.c +++ b/tools/lib/bpf/linker.c @@ -567,17 +567,15 @@ static int linker_load_obj_file(struct bpf_linker *linker, const char *filename, } obj->elf = elf_begin(obj->fd, ELF_C_READ_MMAP, NULL); if (!obj->elf) { - err = -errno; pr_warn_elf("failed to parse ELF file '%s'", filename); - return err; + return -EINVAL; } /* Sanity check ELF file high-level properties */ ehdr = elf64_getehdr(obj->elf); if (!ehdr) { - err = -errno; pr_warn_elf("failed to get ELF header for %s", filename); - return err; + return -EINVAL; } if (ehdr->e_ident[EI_DATA] != host_endianness) { err = -EOPNOTSUPP; @@ -593,9 +591,8 @@ static int linker_load_obj_file(struct bpf_linker *linker, const char *filename, } if (elf_getshdrstrndx(obj->elf, &obj->shstrs_sec_idx)) { - err = -errno; pr_warn_elf("failed to get SHSTRTAB section index for %s", filename); - return err; + return -EINVAL; } scn = NULL; @@ -605,26 +602,23 @@ static int linker_load_obj_file(struct bpf_linker *linker, const char *filename, shdr = elf64_getshdr(scn); if (!shdr) { - err = -errno; pr_warn_elf("failed to get section #%zu header for %s", sec_idx, filename); - return err; + return -EINVAL; } sec_name = elf_strptr(obj->elf, obj->shstrs_sec_idx, shdr->sh_name); if (!sec_name) { - err = -errno; pr_warn_elf("failed to get section #%zu name for %s", sec_idx, filename); - return err; + return -EINVAL; } data = elf_getdata(scn, 0); if (!data) { - err = -errno; pr_warn_elf("failed to get section #%zu (%s) data from %s", sec_idx, sec_name, filename); - return err; + return -EINVAL; } sec = add_src_sec(obj, sec_name); @@ -2602,14 +2596,14 @@ int bpf_linker__finalize(struct bpf_linker *linker) /* Finalize ELF layout */ if (elf_update(linker->elf, ELF_C_NULL) < 0) { - err = -errno; + err = -EINVAL; pr_warn_elf("failed to finalize ELF layout"); return libbpf_err(err); } /* Write out final ELF contents */ if (elf_update(linker->elf, ELF_C_WRITE) < 0) { - err = -errno; + err = -EINVAL; pr_warn_elf("failed to write ELF contents"); return libbpf_err(err); } -- 2.34.1

2 1

[PATCH OLK-6.6] LoongArch: csum: Fix OoB access in IP checksum code for negative lengths
by Jinjie Ruan 06 Mar '25

06 Mar '25

From: Yuli Wang <wangyuli(a)uniontech.com> stable inclusion from stable-v6.6.79 commit 964a8895704a22efc06a2a3276b624a5ae985a06 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4E CVE: CVE-2025-21789 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6287f1a8c16138c2ec750953e35039634018c84a ] Commit 69e3a6aa6be2 ("LoongArch: Add checksum optimization for 64-bit system") would cause an undefined shift and an out-of-bounds read. Commit 8bd795fedb84 ("arm64: csum: Fix OoB access in IP checksum code for negative lengths") fixes the same issue on ARM64. Fixes: 69e3a6aa6be2 ("LoongArch: Add checksum optimization for 64-bit system") Co-developed-by: Wentao Guan <guanwentao(a)uniontech.com> Signed-off-by: Wentao Guan <guanwentao(a)uniontech.com> Signed-off-by: Yuli Wang <wangyuli(a)uniontech.com> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/loongarch/lib/csum.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/loongarch/lib/csum.c b/arch/loongarch/lib/csum.c index a5e84b403c3b..df309ae4045d 100644 --- a/arch/loongarch/lib/csum.c +++ b/arch/loongarch/lib/csum.c @@ -25,7 +25,7 @@ unsigned int __no_sanitize_address do_csum(const unsigned char *buff, int len) const u64 *ptr; u64 data, sum64 = 0; - if (unlikely(len == 0)) + if (unlikely(len <= 0)) return 0; offset = (unsigned long)buff & 7; -- 2.34.1

2 1

[OLK-6.6] LoongArch: csum: Fix OoB access in IP checksum code for negative lengths
by Jinjie Ruan 06 Mar '25

06 Mar '25

From: Yuli Wang <wangyuli(a)uniontech.com> stable inclusion from stable-v6.6.79 commit 964a8895704a22efc06a2a3276b624a5ae985a06 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4E CVE: CVE-2025-21789 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6287f1a8c16138c2ec750953e35039634018c84a ] Commit 69e3a6aa6be2 ("LoongArch: Add checksum optimization for 64-bit system") would cause an undefined shift and an out-of-bounds read. Commit 8bd795fedb84 ("arm64: csum: Fix OoB access in IP checksum code for negative lengths") fixes the same issue on ARM64. Fixes: 69e3a6aa6be2 ("LoongArch: Add checksum optimization for 64-bit system") Co-developed-by: Wentao Guan <guanwentao(a)uniontech.com> Signed-off-by: Wentao Guan <guanwentao(a)uniontech.com> Signed-off-by: Yuli Wang <wangyuli(a)uniontech.com> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/loongarch/lib/csum.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/loongarch/lib/csum.c b/arch/loongarch/lib/csum.c index a5e84b403c3b..df309ae4045d 100644 --- a/arch/loongarch/lib/csum.c +++ b/arch/loongarch/lib/csum.c @@ -25,7 +25,7 @@ unsigned int __no_sanitize_address do_csum(const unsigned char *buff, int len) const u64 *ptr; u64 data, sum64 = 0; - if (unlikely(len == 0)) + if (unlikely(len <= 0)) return 0; offset = (unsigned long)buff & 7; -- 2.34.1

1 0

[PATCH OLK-6.6] gpiolib: Fix crash on error in gpiochip_get_ngpios()
by Yifan Qiao 06 Mar '25

06 Mar '25

From: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> mainline inclusion from mainline-v6.14-rc3 commit 7b4aebeecbbd5b5fe73e35fad3f62ed21aa7ef44 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBPULH CVE: CVE-2025-21783 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The gpiochip_get_ngpios() uses chip_*() macros to print messages. However these macros rely on gpiodev to be initialised and set, which is not the case when called via bgpio_init(). In such a case the printing messages will crash on NULL pointer dereference. Replace chip_*() macros by the respective dev_*() ones to avoid such crash. Fixes: 55b2395e4e92 ("gpio: mmio: handle "ngpios" properly in bgpio_init()") Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Link: https://lore.kernel.org/r/20250213155646.2882324-1-andriy.shevchenko@linux.… Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/gpio/gpiolib.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index 5c0016c77d2a..efb592b6f6aa 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -723,13 +723,13 @@ int gpiochip_get_ngpios(struct gpio_chip *gc, struct device *dev) } if (gc->ngpio == 0) { - chip_err(gc, "tried to insert a GPIO chip with zero lines\n"); + dev_err(dev, "tried to insert a GPIO chip with zero lines\n"); return -EINVAL; } if (gc->ngpio > FASTPATH_NGPIO) - chip_warn(gc, "line cnt %u is greater than fast path cnt %u\n", - gc->ngpio, FASTPATH_NGPIO); + dev_warn(dev, "line cnt %u is greater than fast path cnt %u\n", + gc->ngpio, FASTPATH_NGPIO); return 0; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] ALSA: usb-audio: Cancel pending work at closing a MIDI substream
by Zhang Kunbo 06 Mar '25

06 Mar '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.121 commit 40bdb5ec957aca5c5c1924602bef6b0ab18e22d3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6ZR CVE: CVE-2022-49545 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0125de38122f0f66bf61336158d12a1aabfe6425 upstream. At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For fixing the race, make sure to cancel the pending work at closing. Reported-by: syzbot+6912c9592caca7ca0e7d(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/000000000000e7e75005dfd07cf6@google.com Link: https://lore.kernel.org/r/20220525131203.11299-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: sound/usb/midi.c [ c7d9efdff68e0 (ALSA: usb-audio: Replace tasklet with work) not merged, so usb midi still use tasklet instead of work, so we use tasklet's api to fix this] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- sound/usb/midi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index dcfc546d81b9..aca055b05d6d 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -1161,6 +1161,9 @@ static int snd_usbmidi_output_open(struct snd_rawmidi_substream *substream) static int snd_usbmidi_output_close(struct snd_rawmidi_substream *substream) { + struct usbmidi_out_port *port = substream->runtime->private_data; + + tasklet_kill(&port->ep->tasklet); return substream_open(substream, 0, 0); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] md/bitmap: don't set sb values if can't pass sanity check
by Zheng Qixing 06 Mar '25

06 Mar '25

From: Heming Zhao <heming.zhao(a)suse.com> stable inclusion from stable-v4.19.247 commit 422e8f7ba1e08c8e0e88d375bcb550bc2bbfe96d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP417 CVE: CVE-2022-49526 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit e68cb83a57a458b01c9739e2ad9cb70b04d1e6d2 ] If bitmap area contains invalid data, kernel will crash then mdadm triggers "Segmentation fault". This is cluster-md speical bug. In non-clustered env, mdadm will handle broken metadata case. In clustered array, only kernel space handles bitmap slot info. But even this bug only happened in clustered env, current sanity check is wrong, the code should be changed. How to trigger: (faulty injection) dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sda dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sdb mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sda /dev/sdb mdadm -Ss echo aaa > magic.txt == below modifying slot 2 bitmap data == dd if=magic.txt of=/dev/sda seek=16384 bs=1 count=3 <== destroy magic dd if=/dev/zero of=/dev/sda seek=16436 bs=1 count=4 <== ZERO chunksize mdadm -A /dev/md0 /dev/sda /dev/sdb == kernel crashes. mdadm outputs "Segmentation fault" == Reason of kernel crash: In md_bitmap_read_sb (called by md_bitmap_create), bad bitmap magic didn't block chunksize assignment, and zero value made DIV_ROUND_UP_SECTOR_T() trigger "divide error". Crash log: kernel: md: md0 stopped. kernel: md/raid1:md0: not clean -- starting background reconstruction kernel: md/raid1:md0: active with 2 out of 2 mirrors kernel: dlm: ... ... kernel: md-cluster: Joined cluster 44810aba-38bb-e6b8-daca-bc97a0b254aa slot 1 kernel: md0: invalid bitmap file superblock: bad magic kernel: md_bitmap_copy_from_slot can't get bitmap from slot 2 kernel: md-cluster: Could not gather bitmaps from slot 2 kernel: divide error: 0000 [#1] SMP NOPTI kernel: CPU: 0 PID: 1603 Comm: mdadm Not tainted 5.14.6-1-default kernel: Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) kernel: RIP: 0010:md_bitmap_create+0x1d1/0x850 [md_mod] kernel: RSP: 0018:ffffc22ac0843ba0 EFLAGS: 00010246 kernel: ... ... kernel: Call Trace: kernel: ? dlm_lock_sync+0xd0/0xd0 [md_cluster 77fe..7a0] kernel: md_bitmap_copy_from_slot+0x2c/0x290 [md_mod 24ea..d3a] kernel: load_bitmaps+0xec/0x210 [md_cluster 77fe..7a0] kernel: md_bitmap_load+0x81/0x1e0 [md_mod 24ea..d3a] kernel: do_md_run+0x30/0x100 [md_mod 24ea..d3a] kernel: md_ioctl+0x1290/0x15a0 [md_mod 24ea....d3a] kernel: ? mddev_unlock+0xaa/0x130 [md_mod 24ea..d3a] kernel: ? blkdev_ioctl+0xb1/0x2b0 kernel: block_ioctl+0x3b/0x40 kernel: __x64_sys_ioctl+0x7f/0xb0 kernel: do_syscall_64+0x59/0x80 kernel: ? exit_to_user_mode_prepare+0x1ab/0x230 kernel: ? syscall_exit_to_user_mode+0x18/0x40 kernel: ? do_syscall_64+0x69/0x80 kernel: entry_SYSCALL_64_after_hwframe+0x44/0xae kernel: RIP: 0033:0x7f4a15fa722b kernel: ... ... kernel: ---[ end trace 8afa7612f559c868 ]--- kernel: RIP: 0010:md_bitmap_create+0x1d1/0x850 [md_mod] Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com> Acked-by: Guoqing Jiang <guoqing.jiang(a)linux.dev> Signed-off-by: Heming Zhao <heming.zhao(a)suse.com> Signed-off-by: Song Liu <song(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/md-bitmap.c | 44 ++++++++++++++++++++++-------------------- 1 file changed, 23 insertions(+), 21 deletions(-) diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c index f05417673bf2..488330d504f0 100644 --- a/drivers/md/md-bitmap.c +++ b/drivers/md/md-bitmap.c @@ -641,14 +641,6 @@ static int md_bitmap_read_sb(struct bitmap *bitmap) daemon_sleep = le32_to_cpu(sb->daemon_sleep) * HZ; write_behind = le32_to_cpu(sb->write_behind); sectors_reserved = le32_to_cpu(sb->sectors_reserved); - /* Setup nodes/clustername only if bitmap version is - * cluster-compatible - */ - if (sb->version == cpu_to_le32(BITMAP_MAJOR_CLUSTERED)) { - nodes = le32_to_cpu(sb->nodes); - strlcpy(bitmap->mddev->bitmap_info.cluster_name, - sb->cluster_name, 64); - } /* verify that the bitmap-specific fields are valid */ if (sb->magic != cpu_to_le32(BITMAP_MAGIC)) @@ -670,6 +662,16 @@ static int md_bitmap_read_sb(struct bitmap *bitmap) goto out; } + /* + * Setup nodes/clustername only if bitmap version is + * cluster-compatible + */ + if (sb->version == cpu_to_le32(BITMAP_MAJOR_CLUSTERED)) { + nodes = le32_to_cpu(sb->nodes); + strlcpy(bitmap->mddev->bitmap_info.cluster_name, + sb->cluster_name, 64); + } + /* keep the array size field of the bitmap superblock up to date */ sb->sync_size = cpu_to_le64(bitmap->mddev->resync_max_sectors); @@ -702,9 +704,9 @@ static int md_bitmap_read_sb(struct bitmap *bitmap) out: kunmap_atomic(sb); - /* Assigning chunksize is required for "re_read" */ - bitmap->mddev->bitmap_info.chunksize = chunksize; if (err == 0 && nodes && (bitmap->cluster_slot < 0)) { + /* Assigning chunksize is required for "re_read" */ + bitmap->mddev->bitmap_info.chunksize = chunksize; err = md_setup_cluster(bitmap->mddev, nodes); if (err) { pr_warn("%s: Could not setup cluster service (%d)\n", @@ -715,18 +717,18 @@ static int md_bitmap_read_sb(struct bitmap *bitmap) goto re_read; } - out_no_sb: - if (test_bit(BITMAP_STALE, &bitmap->flags)) - bitmap->events_cleared = bitmap->mddev->events; - bitmap->mddev->bitmap_info.chunksize = chunksize; - bitmap->mddev->bitmap_info.daemon_sleep = daemon_sleep; - bitmap->mddev->bitmap_info.max_write_behind = write_behind; - bitmap->mddev->bitmap_info.nodes = nodes; - if (bitmap->mddev->bitmap_info.space == 0 || - bitmap->mddev->bitmap_info.space > sectors_reserved) - bitmap->mddev->bitmap_info.space = sectors_reserved; - if (err) { + if (err == 0) { + if (test_bit(BITMAP_STALE, &bitmap->flags)) + bitmap->events_cleared = bitmap->mddev->events; + bitmap->mddev->bitmap_info.chunksize = chunksize; + bitmap->mddev->bitmap_info.daemon_sleep = daemon_sleep; + bitmap->mddev->bitmap_info.max_write_behind = write_behind; + bitmap->mddev->bitmap_info.nodes = nodes; + if (bitmap->mddev->bitmap_info.space == 0 || + bitmap->mddev->bitmap_info.space > sectors_reserved) + bitmap->mddev->bitmap_info.space = sectors_reserved; + } else { md_bitmap_print_sb(bitmap); if (bitmap->cluster_slot < 0) md_cluster_stop(bitmap->mddev); -- 2.39.2

2 1

[PATCH OLK-6.6] USB: hub: Ignore non-compliant devices with too many configs or interfaces
by Bowen You 06 Mar '25

06 Mar '25

From: Alan Stern <stern(a)rowland.harvard.edu> mainline inclusion from mainline-v6.12-rc1 commit 2240fed37afbcdb5e8b627bc7ad986891100e05d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC7J CVE: CVE-2025-21776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Robert Morris created a test program which can cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate pointer: Oops: general protection fault, probably for non-canonical address 0xcccccccccccccccc: 0000 [#1] SMP DEBUG_PAGEALLOC PTI CPU: 7 UID: 0 PID: 117 Comm: kworker/7:1 Not tainted 6.13.0-rc3-00017-gf44d154d6e3d #14 Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_hub_adjust_deviceremovable+0x78/0x110 ... Call Trace: <TASK> ? die_addr+0x31/0x80 ? exc_general_protection+0x1b4/0x3c0 ? asm_exc_general_protection+0x26/0x30 ? usb_hub_adjust_deviceremovable+0x78/0x110 hub_probe+0x7c7/0xab0 usb_probe_interface+0x14b/0x350 really_probe+0xd0/0x2d0 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x6e/0x110 driver_probe_device+0x1a/0x90 __device_attach_driver+0x7e/0xc0 bus_for_each_drv+0x7f/0xd0 __device_attach+0xaa/0x1a0 bus_probe_device+0x8b/0xa0 device_add+0x62e/0x810 usb_set_configuration+0x65d/0x990 usb_generic_driver_probe+0x4b/0x70 usb_probe_device+0x36/0xd0 The cause of this error is that the device has two interfaces, and the hub driver binds to interface 1 instead of interface 0, which is where usb_hub_to_struct_hub() looks. We can prevent the problem from occurring by refusing to accept hub devices that violate the USB spec by having more than one configuration or interface. Reported-and-tested-by: Robert Morris <rtm(a)csail.mit.edu> Cc: stable <stable(a)kernel.org> Closes: https://lore.kernel.org/linux-usb/95564.1737394039@localhost/ Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/r/c27f3bf4-63d8-4fb5-ac82-09e3cd19f61c@rowland.harv… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/usb/core/hub.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index 1ba3feb5e190..f295609649b1 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1818,6 +1818,17 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id) desc = intf->cur_altsetting; hdev = interface_to_usbdev(intf); + /* + * The USB 2.0 spec prohibits hubs from having more than one + * configuration or interface, and we rely on this prohibition. + * Refuse to accept a device that violates it. + */ + if (hdev->descriptor.bNumConfigurations > 1 || + hdev->actconfig->desc.bNumInterfaces > 1) { + dev_err(&intf->dev, "Invalid hub with more than one config or interface\n"); + return -EINVAL; + } + /* * Set default autosuspend delay as 0 to speedup bus suspend, * based on the below considerations: -- 2.34.1

2 1

[PATCH OLK-6.6] md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime
by Zheng Qixing 06 Mar '25

06 Mar '25

From: Yu Kuai <yukuai3(a)huawei.com> stable inclusion from stable-v6.6.80 commit 52848a095b55a302af92f52ca0de5b3112059bb8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBEG CVE: CVE-2025-21712 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit 8d28d0ddb986f56920ac97ae704cc3340a699a30 ] After commit ec6bb299c7c3 ("md/md-bitmap: add 'sync_size' into struct md_bitmap_stats"), following panic is reported: Oops: general protection fault, probably for non-canonical address RIP: 0010:bitmap_get_stats+0x2b/0xa0 Call Trace: <TASK> md_seq_show+0x2d2/0x5b0 seq_read_iter+0x2b9/0x470 seq_read+0x12f/0x180 proc_reg_read+0x57/0xb0 vfs_read+0xf6/0x380 ksys_read+0x6c/0xf0 do_syscall_64+0x82/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Root cause is that bitmap_get_stats() can be called at anytime if mddev is still there, even if bitmap is destroyed, or not fully initialized. Deferenceing bitmap in this case can crash the kernel. Meanwhile, the above commit start to deferencing bitmap->storage, make the problem easier to trigger. Fix the problem by protecting bitmap_get_stats() with bitmap_info.mutex. Cc: stable(a)vger.kernel.org # v6.12+ Fixes: 32a7627cf3a3 ("[PATCH] md: optimised resync using Bitmap based intent logging") Reported-and-tested-by: Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> Closes: https://lore.kernel.org/linux-raid/ca3a91a2-50ae-4f68-b317-abd9889f3907@ora… Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Link: https://lore.kernel.org/r/20250124092055.4050195-1-yukuai1@huaweicloud.com Signed-off-by: Song Liu <song(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/md/md-bitmap.c [Due to not merging commit 38f287d7e495 ("md/md-bitmap: replace md_bitmap_status() with a new helper md_bitmap_get_stats()").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/md-bitmap.c | 5 ++++- drivers/md/md.c | 5 +++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c index faeb0faf8552..1ac7bd6e7fb5 100644 --- a/drivers/md/md-bitmap.c +++ b/drivers/md/md-bitmap.c @@ -2105,7 +2105,10 @@ void md_bitmap_status(struct seq_file *seq, struct bitmap *bitmap) if (!bitmap) return; - + if (bitmap->mddev->bitmap_info.external) + return; + if (!bitmap->storage.sb_page) /* no superblock */ + return; counts = &bitmap->counts; chunk_kb = bitmap->mddev->bitmap_info.chunksize >> 10; diff --git a/drivers/md/md.c b/drivers/md/md.c index 31b275bad88c..9fd5d05e03b2 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -8340,6 +8340,10 @@ static int md_seq_show(struct seq_file *seq, void *v) return 0; spin_unlock(&all_mddevs_lock); + + /* prevent bitmap to be freed after checking */ + mutex_lock(&mddev->bitmap_info.mutex); + spin_lock(&mddev->lock); if (mddev->pers || mddev->raid_disks || !list_empty(&mddev->disks)) { seq_printf(seq, "%s : %sactive", mdname(mddev), @@ -8410,6 +8414,7 @@ static int md_seq_show(struct seq_file *seq, void *v) seq_printf(seq, "\n"); } spin_unlock(&mddev->lock); + mutex_unlock(&mddev->bitmap_info.mutex); spin_lock(&all_mddevs_lock); if (atomic_dec_and_test(&mddev->active)) __mddev_put(mddev); -- 2.39.2

2 1

[PATCH OLK-6.6] ata: libata-sff: Ensure that we cannot write outside the allocated buffer
by Zheng Qixing 06 Mar '25

06 Mar '25

From: Niklas Cassel <cassel(a)kernel.org> stable inclusion from stable-v6.6.78 commit d5e6e3000309359eae2a17117aa6e3c44897bf6c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ CVE: CVE-2025-21738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit 6e74e53b34b6dec5a50e1404e2680852ec6768d2 upstream. reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len set to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to ATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to write outside the allocated buffer, overwriting random memory. While a ATA device is supposed to abort a ATA_NOP command, there does seem to be a bug either in libata-sff or QEMU, where either this status is not set, or the status is cleared before read by ata_sff_hsm_move(). Anyway, that is most likely a separate bug. Looking at __atapi_pio_bytes(), it already has a safety check to ensure that __atapi_pio_bytes() cannot write outside the allocated buffer. Add a similar check to ata_pio_sector(), such that also ata_pio_sector() cannot write outside the allocated buffer. Cc: stable(a)vger.kernel.org Reported-by: reveliofuzzing <reveliofuzzing(a)gmail.com> Closes: https://lore.kernel.org/linux-ide/CA+-ZZ_jTgxh3bS7m+KX07_EWckSnW3N2adX3KV63… Link: https://lore.kernel.org/r/20250127154303.15567-2-cassel@kernel.org Signed-off-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/ata/libata-sff.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c index 8fcc622fcb3d..9b6529f2dfcb 100644 --- a/drivers/ata/libata-sff.c +++ b/drivers/ata/libata-sff.c @@ -602,7 +602,7 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) { struct ata_port *ap = qc->ap; struct page *page; - unsigned int offset; + unsigned int offset, count; if (!qc->cursg) { qc->curbytes = qc->nbytes; @@ -618,25 +618,27 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) page = nth_page(page, (offset >> PAGE_SHIFT)); offset %= PAGE_SIZE; - trace_ata_sff_pio_transfer_data(qc, offset, qc->sect_size); + /* don't overrun current sg */ + count = min(qc->cursg->length - qc->cursg_ofs, qc->sect_size); + + trace_ata_sff_pio_transfer_data(qc, offset, count); /* * Split the transfer when it splits a page boundary. Note that the * split still has to be dword aligned like all ATA data transfers. */ WARN_ON_ONCE(offset % 4); - if (offset + qc->sect_size > PAGE_SIZE) { + if (offset + count > PAGE_SIZE) { unsigned int split_len = PAGE_SIZE - offset; ata_pio_xfer(qc, page, offset, split_len); - ata_pio_xfer(qc, nth_page(page, 1), 0, - qc->sect_size - split_len); + ata_pio_xfer(qc, nth_page(page, 1), 0, count - split_len); } else { - ata_pio_xfer(qc, page, offset, qc->sect_size); + ata_pio_xfer(qc, page, offset, count); } - qc->curbytes += qc->sect_size; - qc->cursg_ofs += qc->sect_size; + qc->curbytes += count; + qc->cursg_ofs += count; if (qc->cursg_ofs == qc->cursg->length) { qc->cursg = sg_next(qc->cursg); -- 2.39.2

2 1

[PATCH OLK-6.6] blk-cgroup: Fix class @block_class's subsystem refcount leakage
by Zheng Qixing 06 Mar '25

06 Mar '25

From: Zijun Hu <quic_zijuhu(a)quicinc.com> stable inclusion from stable-v6.6.78 commit 993121481b5a87829f1e8163f47158b72679f309 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC90 CVE: CVE-2025-21745 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit d1248436cbef1f924c04255367ff4845ccd9025e upstream. blkcg_fill_root_iostats() iterates over @block_class's devices by class_dev_iter_(init|next)(), but does not end iterating with class_dev_iter_exit(), so causes the class's subsystem refcount leakage. Fix by ending the iterating with class_dev_iter_exit(). Fixes: ef45fe470e1e ("blk-cgroup: show global disk stats in root cgroup io.stat") Reviewed-by: Michal Koutný <mkoutny(a)suse.com> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: stable(a)vger.kernel.org Acked-by: Tejun Heo <tj(a)kernel.org> Signed-off-by: Zijun Hu <quic_zijuhu(a)quicinc.com> Link: https://lore.kernel.org/r/20250105-class_fix-v6-2-3a2f1768d4d4@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-cgroup.c | 1 + 1 file changed, 1 insertion(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 7809546cd418..37e0b92e2e87 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -1139,6 +1139,7 @@ static void blkcg_fill_root_iostats(void) blkg_iostat_set(&blkg->iostat.cur, &tmp); u64_stats_update_end_irqrestore(&blkg->iostat.sync, flags); } + class_dev_iter_exit(&iter); } static void blkcg_print_one_stat(struct blkcg_gq *blkg, struct seq_file *s) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] drm/amdkfd: Check for potential null return of kmalloc_array()
by Luo Gengkun 06 Mar '25

06 Mar '25

From: QintaoShen <unSimple1993(a)163.com> stable inclusion from stable-v4.19.239 commit 94869bb0de69a812f70231b0eb480bb2f7ae73a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP16T CVE: CVE-2022-49055 Reference: https://git.kernel.org/stable/c/94869bb0de69a812f70231b0eb480bb2f7ae73a6 -------------------------------- [ Upstream commit ebbb7bb9e80305820dc2328a371c1b35679f2667 ] As the kmalloc_array() may return null, the 'event_waiters[i].wait' would lead to null-pointer dereference. Therefore, it is better to check the return value of kmalloc_array() to avoid this confusion. Signed-off-by: QintaoShen <unSimple1993(a)163.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c index e9f0e0a1b41c..892077377339 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c @@ -532,6 +532,8 @@ static struct kfd_event_waiter *alloc_event_waiters(uint32_t num_events) event_waiters = kmalloc_array(num_events, sizeof(struct kfd_event_waiter), GFP_KERNEL); + if (!event_waiters) + return NULL; for (i = 0; (event_waiters) && (i < num_events) ; i++) { init_wait(&event_waiters[i].wait); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] rtl818x: Prevent using not initialized queues
by Luo Gengkun 06 Mar '25

06 Mar '25

From: Alexander Wetzel <alexander(a)wetzel-home.de> stable inclusion from stable-v4.19.247 commit 9d5e96cc1f1720019ce27b127a31695148d38bb0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1BA CVE: CVE-2022-49326 Reference: https://git.kernel.org/stable/c/9d5e96cc1f1720019ce27b127a31695148d38bb0 -------------------------------- commit 746285cf81dc19502ab238249d75f5990bd2d231 upstream. Using not existing queues can panic the kernel with rtl8180/rtl8185 cards. Ignore the skb priority for those cards, they only have one tx queue. Pierre Asselin (pa(a)panix.com) reported the kernel crash in the Gentoo forum: https://forums.gentoo.org/viewtopic-t-1147832-postdays-0-postorder-asc-star… He also confirmed that this patch fixes the issue. In summary this happened: After updating wpa_supplicant from 2.9 to 2.10 the kernel crashed with a "divide error: 0000" when connecting to an AP. Control port tx now tries to use IEEE80211_AC_VO for the priority, which wpa_supplicants starts to use in 2.10. Since only the rtl8187se part of the driver supports QoS, the priority of the skb is set to IEEE80211_AC_BE (2) by mac80211 for rtl8180/rtl8185 cards. rtl8180 is then unconditionally reading out the priority and finally crashes on drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c line 544 without this patch: idx = (ring->idx + skb_queue_len(&ring->queue)) % ring->entries "ring->entries" is zero for rtl8180/rtl8185 cards, tx_ring[2] never got initialized. Cc: stable(a)vger.kernel.org Reported-by: pa(a)panix.com Tested-by: pa(a)panix.com Signed-off-by: Alexander Wetzel <alexander(a)wetzel-home.de> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20220422145228.7567-1-alexander@wetzel-home.de Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c index 225c1c8851cc..77bf8a601ca4 100644 --- a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c +++ b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c @@ -460,8 +460,10 @@ static void rtl8180_tx(struct ieee80211_hw *dev, struct rtl8180_priv *priv = dev->priv; struct rtl8180_tx_ring *ring; struct rtl8180_tx_desc *entry; + unsigned int prio = 0; unsigned long flags; - unsigned int idx, prio, hw_prio; + unsigned int idx, hw_prio; + dma_addr_t mapping; u32 tx_flags; u8 rc_flags; @@ -470,7 +472,9 @@ static void rtl8180_tx(struct ieee80211_hw *dev, /* do arithmetic and then convert to le16 */ u16 frame_duration = 0; - prio = skb_get_queue_mapping(skb); + /* rtl8180/rtl8185 only has one useable tx queue */ + if (dev->queues > IEEE80211_AC_BK) + prio = skb_get_queue_mapping(skb); ring = &priv->tx_ring[prio]; mapping = pci_map_single(priv->pdev, skb->data, -- 2.34.1

2 1

[PATCH OLK-6.6] gpiolib: Fix crash on error in gpiochip_get_ngpios()
by Yifan Qiao 06 Mar '25

06 Mar '25

From: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> The gpiochip_get_ngpios() uses chip_*() macros to print messages. However these macros rely on gpiodev to be initialised and set, which is not the case when called via bgpio_init(). In such a case the printing messages will crash on NULL pointer dereference. Replace chip_*() macros by the respective dev_*() ones to avoid such crash. Fixes: 55b2395e4e92 ("gpio: mmio: handle "ngpios" properly in bgpio_init()") Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Link: https://lore.kernel.org/r/20250213155646.2882324-1-andriy.shevchenko@linux.… Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/gpio/gpiolib.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index 5c0016c77d2a..efb592b6f6aa 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -723,13 +723,13 @@ int gpiochip_get_ngpios(struct gpio_chip *gc, struct device *dev) } if (gc->ngpio == 0) { - chip_err(gc, "tried to insert a GPIO chip with zero lines\n"); + dev_err(dev, "tried to insert a GPIO chip with zero lines\n"); return -EINVAL; } if (gc->ngpio > FASTPATH_NGPIO) - chip_warn(gc, "line cnt %u is greater than fast path cnt %u\n", - gc->ngpio, FASTPATH_NGPIO); + dev_warn(dev, "line cnt %u is greater than fast path cnt %u\n", + gc->ngpio, FASTPATH_NGPIO); return 0; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] dm integrity: fix memory corruption when tag_size is less than digest size
by Yuntao Liu 06 Mar '25

06 Mar '25

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v4.19.240 commit 6a95d91c0b315c965198f6ab7dec7c94129e17e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1KX CVE: CVE-2022-49044 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 08c1af8f1c13bbf210f1760132f4df24d0ed46d6 upstream. It is possible to set up dm-integrity in such a way that the "tag_size" parameter is less than the actual digest size. In this situation, a part of the digest beyond tag_size is ignored. In this case, dm-integrity would write beyond the end of the ic->recalc_tags array and corrupt memory. The corruption happened in integrity_recalc->integrity_sector_checksum->crypto_shash_final. Fix this corruption by increasing the tags array so that it has enough padding at the end to accomodate the loop in integrity_recalc() being able to write a full digest size for the last member of the tags array. Cc: stable(a)vger.kernel.org # v4.19+ Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/md/dm-integrity.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c index 66016ce253ce..db09e8748ec8 100644 --- a/drivers/md/dm-integrity.c +++ b/drivers/md/dm-integrity.c @@ -3509,6 +3509,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) } if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING)) { + size_t recalc_tags_size; if (!ic->internal_hash) { r = -EINVAL; ti->error = "Recalculate is only valid with internal hash"; @@ -3527,8 +3528,10 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) r = -ENOMEM; goto bad; } - ic->recalc_tags = kvmalloc_array(RECALC_SECTORS >> ic->sb->log2_sectors_per_block, - ic->tag_size, GFP_KERNEL); + recalc_tags_size = (RECALC_SECTORS >> ic->sb->log2_sectors_per_block) * ic->tag_size; + if (crypto_shash_digestsize(ic->internal_hash) > ic->tag_size) + recalc_tags_size += crypto_shash_digestsize(ic->internal_hash) - ic->tag_size; + ic->recalc_tags = kvmalloc(recalc_tags_size, GFP_KERNEL); if (!ic->recalc_tags) { ti->error = "Cannot allocate tags for recalculating"; r = -ENOMEM; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
by Yuntao Liu 06 Mar '25

06 Mar '25

From: Tim Gardner <tim.gardner(a)canonical.com> stable inclusion from stable-v4.19.238 commit 72dd5c46a152136712a55bf026a9aa8c1b12b60d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6T4 CVE: CVE-2021-47642 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 37a1a2e6eeeb101285cd34e12e48a881524701aa ] Coverity complains of a possible buffer overflow. However, given the 'static' scope of nvidia_setup_i2c_bus() it looks like that can't happen after examiniing the call sites. CID 19036 (#1 of 1): Copy into fixed size buffer (STRING_OVERFLOW) 1. fixed_size_dest: You might overrun the 48-character fixed-size string chan->adapter.name by copying name without checking the length. 2. parameter_as_source: Note: This defect has an elevated risk because the source argument is a parameter of the current function. 89 strcpy(chan->adapter.name, name); Fix this warning by using strscpy() which will silence the warning and prevent any future buffer overflows should the names used to identify the channel become much longer. Cc: Antonino Daplas <adaplas(a)gmail.com> Cc: linux-fbdev(a)vger.kernel.org Cc: dri-devel(a)lists.freedesktop.org Cc: linux-kernel(a)vger.kernel.org Signed-off-by: Tim Gardner <tim.gardner(a)canonical.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/video/fbdev/nvidia/nv_i2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/nvidia/nv_i2c.c b/drivers/video/fbdev/nvidia/nv_i2c.c index d7994a173245..0b48965a6420 100644 --- a/drivers/video/fbdev/nvidia/nv_i2c.c +++ b/drivers/video/fbdev/nvidia/nv_i2c.c @@ -86,7 +86,7 @@ static int nvidia_setup_i2c_bus(struct nvidia_i2c_chan *chan, const char *name, { int rc; - strcpy(chan->adapter.name, name); + strscpy(chan->adapter.name, name, sizeof(chan->adapter.name)); chan->adapter.owner = THIS_MODULE; chan->adapter.class = i2c_class; chan->adapter.algo_data = &chan->algo; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] dm integrity: fix memory corruption when tag_size is less than digest size
by Yuntao Liu 06 Mar '25

06 Mar '25

From: Mikulas Patocka <mpatocka(a)redhat.com> commit 08c1af8f1c13bbf210f1760132f4df24d0ed46d6 upstream. It is possible to set up dm-integrity in such a way that the "tag_size" parameter is less than the actual digest size. In this situation, a part of the digest beyond tag_size is ignored. In this case, dm-integrity would write beyond the end of the ic->recalc_tags array and corrupt memory. The corruption happened in integrity_recalc->integrity_sector_checksum->crypto_shash_final. Fix this corruption by increasing the tags array so that it has enough padding at the end to accomodate the loop in integrity_recalc() being able to write a full digest size for the last member of the tags array. Cc: stable(a)vger.kernel.org # v4.19+ Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/md/dm-integrity.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c index 66016ce253ce..db09e8748ec8 100644 --- a/drivers/md/dm-integrity.c +++ b/drivers/md/dm-integrity.c @@ -3509,6 +3509,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) } if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING)) { + size_t recalc_tags_size; if (!ic->internal_hash) { r = -EINVAL; ti->error = "Recalculate is only valid with internal hash"; @@ -3527,8 +3528,10 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) r = -ENOMEM; goto bad; } - ic->recalc_tags = kvmalloc_array(RECALC_SECTORS >> ic->sb->log2_sectors_per_block, - ic->tag_size, GFP_KERNEL); + recalc_tags_size = (RECALC_SECTORS >> ic->sb->log2_sectors_per_block) * ic->tag_size; + if (crypto_shash_digestsize(ic->internal_hash) > ic->tag_size) + recalc_tags_size += crypto_shash_digestsize(ic->internal_hash) - ic->tag_size; + ic->recalc_tags = kvmalloc(recalc_tags_size, GFP_KERNEL); if (!ic->recalc_tags) { ti->error = "Cannot allocate tags for recalculating"; r = -ENOMEM; -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] Mainline Patch
by Xiaomeng Zhang 06 Mar '25

06 Mar '25

Hou Tao (1): bpf: Use preempt_count() directly in bpf_send_signal_common() Puranjay Mohan (1): bpf: Send signals asynchronously if !preemptible kernel/trace/bpf_trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] Mainline Patch
by Xiaomeng Zhang 06 Mar '25

06 Mar '25

Hou Tao (1): bpf: Use preempt_count() directly in bpf_send_signal_common() Puranjay Mohan (1): bpf: Send signals asynchronously if !preemptible kernel/trace/bpf_trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6] block: mark GFP_NOIO around sysfs ->store()
by Li Lingfeng 06 Mar '25

06 Mar '25

From: Ming Lei <tom.leiming(a)gmail.com> mainline inclusion from mainline-v6.14-rc1 commit 7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLKB CVE: CVE-2025-21817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- sysfs ->store is called with queue freezed, meantime we have several ->store() callbacks(update_nr_requests, wbt, scheduler) to allocate memory with GFP_KERNEL which may run into direct reclaim code path, then potential deadlock can be caused. Fix the issue by marking NOIO around sysfs ->store() Reported-by: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> Cc: stable(a)vger.kernel.org Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: John Garry <john.g.garry(a)oracle.com> Link: https://lore.kernel.org/r/20250113015833.698458-1-ming.lei@redhat.com Link: https://lore.kernel.org/linux-block/Z4RkemI9f6N5zoEF@fedora/T/#mc774c65eeca… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-sysfs.c [Commit a16230649ce27f8ac7dd8a5b079d9657aa96de16 ("block: add a store_limit operations for sysfs entries") add check of store_limit in queue_attr_store; commit af2814149883 ("block: freeze the queue in queue_attr_store") move blk_mq_freeze_queue to queue_attr_store.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/blk-sysfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index 2de6c14dfecf..8d1bab14b83a 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -773,13 +773,16 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, struct queue_sysfs_entry *entry = to_queue(attr); struct gendisk *disk = container_of(kobj, struct gendisk, queue_kobj); struct request_queue *q = disk->queue; + unsigned int noio_flag; ssize_t res; if (!entry->store) return -EIO; mutex_lock(&q->sysfs_lock); + noio_flag = memalloc_noio_save(); res = entry->store(q, page, length); + memalloc_noio_restore(noio_flag); mutex_unlock(&q->sysfs_lock); return res; } -- 2.31.1

2 1

[PATCH OLK-6.6] USB: hub: Ignore non-compliant devices with too many configs or interfaces
by Bowen You 06 Mar '25

06 Mar '25

From: Alan Stern <stern(a)rowland.harvard.edu> mainline inclusion from mainline-v6.12-rc1 commit 2240fed37afbcdb5e8b627bc7ad986891100e05d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC7J CVE: CVE-2025-21776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Robert Morris created a test program which can cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate pointer: Oops: general protection fault, probably for non-canonical address 0xcccccccccccccccc: 0000 [#1] SMP DEBUG_PAGEALLOC PTI CPU: 7 UID: 0 PID: 117 Comm: kworker/7:1 Not tainted 6.13.0-rc3-00017-gf44d154d6e3d #14 Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_hub_adjust_deviceremovable+0x78/0x110 ... Call Trace: <TASK> ? die_addr+0x31/0x80 ? exc_general_protection+0x1b4/0x3c0 ? asm_exc_general_protection+0x26/0x30 ? usb_hub_adjust_deviceremovable+0x78/0x110 hub_probe+0x7c7/0xab0 usb_probe_interface+0x14b/0x350 really_probe+0xd0/0x2d0 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x6e/0x110 driver_probe_device+0x1a/0x90 __device_attach_driver+0x7e/0xc0 bus_for_each_drv+0x7f/0xd0 __device_attach+0xaa/0x1a0 bus_probe_device+0x8b/0xa0 device_add+0x62e/0x810 usb_set_configuration+0x65d/0x990 usb_generic_driver_probe+0x4b/0x70 usb_probe_device+0x36/0xd0 The cause of this error is that the device has two interfaces, and the hub driver binds to interface 1 instead of interface 0, which is where usb_hub_to_struct_hub() looks. We can prevent the problem from occurring by refusing to accept hub devices that violate the USB spec by having more than one configuration or interface. Reported-and-tested-by: Robert Morris <rtm(a)csail.mit.edu> Cc: stable <stable(a)kernel.org> Closes: https://lore.kernel.org/linux-usb/95564.1737394039@localhost/ Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/r/c27f3bf4-63d8-4fb5-ac82-09e3cd19f61c@rowland.harv… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/usb/core/hub.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index 1ba3feb5e190..f295609649b1 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1818,6 +1818,17 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id) desc = intf->cur_altsetting; hdev = interface_to_usbdev(intf); + /* + * The USB 2.0 spec prohibits hubs from having more than one + * configuration or interface, and we rely on this prohibition. + * Refuse to accept a device that violates it. + */ + if (hdev->descriptor.bNumConfigurations > 1 || + hdev->actconfig->desc.bNumInterfaces > 1) { + dev_err(&intf->dev, "Invalid hub with more than one config or interface\n"); + return -EINVAL; + } + /* * Set default autosuspend delay as 0 to speedup bus suspend, * based on the below considerations: -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 498e359119c3e45a3f0b2a869228d2b910836bc0
by kernel test robot 06 Mar '25

06 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 498e359119c3e45a3f0b2a869228d2b910836bc0 !15307 net: sfc: add missing xdp queue reinitialization Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-002-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-004-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- Warning:arch-x86-kernel-cpu-resctrl-monitor.c-references-a-file-that-doesn-t-exist:Documentation-x86-resctrl.rst | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250305 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250305 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250305 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250305 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch `-- x86_64-defconfig |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch elapsed time: 760m configs tested: 15 configs skipped: 85 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250305 clang-15 arm64 randconfig-002-20250305 gcc-14.2.0 arm64 randconfig-003-20250305 clang-21 arm64 randconfig-004-20250305 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250305 clang-19 x86_64 buildonly-randconfig-002-20250305 gcc-12 x86_64 buildonly-randconfig-003-20250305 clang-19 x86_64 buildonly-randconfig-004-20250305 gcc-12 x86_64 buildonly-randconfig-005-20250305 clang-19 x86_64 buildonly-randconfig-006-20250305 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 3c67b39e386a36efca1f95d96d16cf1a716b5617
by kernel test robot 06 Mar '25

06 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 3c67b39e386a36efca1f95d96d16cf1a716b5617 !15314 drm/imx: Fix memory leak in imx_pd_connector_get_modes Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-allnoconfig | |-- mm-hugetlb.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-shmem.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-swap.c:linux-memremap.h-is-included-more-than-once. | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250305 | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-defconfig | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-101-20250305 | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-102-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-103-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-104-20250305 | |-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-161-20250305 |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 931m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250305 gcc-14.2.0 arm64 randconfig-002-20250305 gcc-14.2.0 arm64 randconfig-003-20250305 gcc-14.2.0 arm64 randconfig-004-20250305 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250305 clang-19 x86_64 buildonly-randconfig-002-20250305 gcc-12 x86_64 buildonly-randconfig-003-20250305 clang-19 x86_64 buildonly-randconfig-004-20250305 gcc-12 x86_64 buildonly-randconfig-005-20250305 clang-19 x86_64 buildonly-randconfig-006-20250305 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ALSA: usb-audio: Cancel pending work at closing a MIDI substream
by Zhang Kunbo 06 Mar '25

06 Mar '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.121 commit 40bdb5ec957aca5c5c1924602bef6b0ab18e22d3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6ZR CVE: CVE-2022-49545 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0125de38122f0f66bf61336158d12a1aabfe6425 upstream. At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For fixing the race, make sure to cancel the pending work at closing. Reported-by: syzbot+6912c9592caca7ca0e7d(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/000000000000e7e75005dfd07cf6@google.com Link: https://lore.kernel.org/r/20220525131203.11299-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- sound/usb/midi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index dcfc546d81b9..4ec7cbdddfd0 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -1161,6 +1161,9 @@ static int snd_usbmidi_output_open(struct snd_rawmidi_substream *substream) static int snd_usbmidi_output_close(struct snd_rawmidi_substream *substream) { + struct usbmidi_out_port *port = substream->runtime->private_data; + + cancel_work_sync(&port->ep->work); return substream_open(substream, 0, 0); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ipw2x00: Fix potential NULL dereference in libipw_xmit()
by Zhang Kunbo 05 Mar '25

05 Mar '25

From: Haowen Bai <baihaowen(a)meizu.com> stable inclusion from stable-v4.19.247 commit 167affc11781d7d35c4c3a7630a549ac74dd0b21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6MY CVE: CVE-2022-49544 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8366bbabe1d207cf7c5b11ae50e223ae6fc278b ] crypt and crypt->ops could be null, so we need to checking null before dereference Signed-off-by: Haowen Bai <baihaowen(a)meizu.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/1648797055-25730-1-git-send-email-baihaowen@meizu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/net/wireless/intel/ipw2x00/libipw_tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c index 84205aa508df..daa4f9eb08ff 100644 --- a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c +++ b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c @@ -397,7 +397,7 @@ netdev_tx_t libipw_xmit(struct sk_buff *skb, struct net_device *dev) /* Each fragment may need to have room for encryption * pre/postfix */ - if (host_encrypt) + if (host_encrypt && crypt && crypt->ops) bytes_per_frag -= crypt->ops->extra_mpdu_prefix_len + crypt->ops->extra_mpdu_postfix_len; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
by Zhang Kunbo 05 Mar '25

05 Mar '25

From: Liu Zixian <liuzixian4(a)huawei.com> stable inclusion from stable-v4.19.247 commit edafcad84c4134ebec4bc24b29ca4497a1184eea category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1Y3 CVE: CVE-2022-49532 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 194d250cdc4a40ccbd179afd522a9e9846957402 ] drm_cvt_mode may return NULL and we should check it. This bug is found by syzkaller: FAULT_INJECTION stacktrace: [ 168.567394] FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 [ 168.567403] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567406] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567408] Call trace: [ 168.567414] dump_backtrace+0x0/0x310 [ 168.567418] show_stack+0x28/0x38 [ 168.567423] dump_stack+0xec/0x15c [ 168.567427] should_fail+0x3ac/0x3d0 [ 168.567437] __should_failslab+0xb8/0x120 [ 168.567441] should_failslab+0x28/0xc0 [ 168.567445] kmem_cache_alloc_trace+0x50/0x640 [ 168.567454] drm_mode_create+0x40/0x90 [ 168.567458] drm_cvt_mode+0x48/0xc78 [ 168.567477] virtio_gpu_conn_get_modes+0xa8/0x140 [virtio_gpu] [ 168.567485] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567492] drm_mode_getconnector+0x2e0/0xa70 [ 168.567496] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567514] drm_ioctl+0x558/0x6d0 [ 168.567522] do_vfs_ioctl+0x160/0xf30 [ 168.567525] ksys_ioctl+0x98/0xd8 [ 168.567530] __arm64_sys_ioctl+0x50/0xc8 [ 168.567536] el0_svc_common+0xc8/0x320 [ 168.567540] el0_svc_handler+0xf8/0x160 [ 168.567544] el0_svc+0x10/0x218 KASAN stacktrace: [ 168.567561] BUG: KASAN: null-ptr-deref in virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567565] Read of size 4 at addr 0000000000000054 by task syz/6425 [ 168.567566] [ 168.567571] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567573] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567575] Call trace: [ 168.567578] dump_backtrace+0x0/0x310 [ 168.567582] show_stack+0x28/0x38 [ 168.567586] dump_stack+0xec/0x15c [ 168.567591] kasan_report+0x244/0x2f0 [ 168.567594] __asan_load4+0x58/0xb0 [ 168.567607] virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567612] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567617] drm_mode_getconnector+0x2e0/0xa70 [ 168.567621] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567624] drm_ioctl+0x558/0x6d0 [ 168.567628] do_vfs_ioctl+0x160/0xf30 [ 168.567632] ksys_ioctl+0x98/0xd8 [ 168.567636] __arm64_sys_ioctl+0x50/0xc8 [ 168.567641] el0_svc_common+0xc8/0x320 [ 168.567645] el0_svc_handler+0xf8/0x160 [ 168.567649] el0_svc+0x10/0x218 Signed-off-by: Liu Zixian <liuzixian4(a)huawei.com> Link: http://patchwork.freedesktop.org/patch/msgid/20220322091730.1653-1-liuzixia… Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/gpu/drm/virtio/virtgpu_display.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/virtio/virtgpu_display.c b/drivers/gpu/drm/virtio/virtgpu_display.c index 25503b933599..7511f416eb67 100644 --- a/drivers/gpu/drm/virtio/virtgpu_display.c +++ b/drivers/gpu/drm/virtio/virtgpu_display.c @@ -180,6 +180,8 @@ static int virtio_gpu_conn_get_modes(struct drm_connector *connector) DRM_DEBUG("add mode: %dx%d\n", width, height); mode = drm_cvt_mode(connector->dev, width, height, 60, false, false, false); + if (!mode) + return count; mode->type |= DRM_MODE_TYPE_PREFERRED; drm_mode_probed_add(connector, mode); count++; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 00/23] Support perf --bpf-counters
by Tengda Wu 05 Mar '25

05 Mar '25

This is a minimal patch series to enable '--bpf-counters' options for perf tool in 5.10 kernel version. How to compile? =============== 1. Download openEuler kernel source code: git clone https://gitee.com/openeuler/kernel.git 2. Download these patches, apply them in kernel/ directory: cd kernel/ git am --reject /path/to/*.patch 3. Prepare some requirements before compiling perf tool: Not list one by one here, please refer to [1]. [1] https://medium.com/@manas.marwah/building-perf-tool-fc838f084f71 4. Compile perf tool: cd tools/perf make BUILD_BPF_SKEL=1 If successful, you will see a binary file named 'perf' under tools/perf/ directory. How to use? =========== 1. Use bperf to sample a process: $ perf stat --bpf-counters -e cycles,instructions \ perf bench sched messaging -g 1 -l 100 -t # Running 'sched/messaging' benchmark: # 20 sender and receiver threads per group # 1 groups == 40 threads run Total time: 0.011 [sec] Performance counter stats for 'perf bench sched messaging -g 1 -l 100 -t': 639,816,606 cycles 284,102,919 instructions # 0.44 insn per cycle 0.018093452 seconds time elapsed 0.023612000 seconds user 0.255643000 seconds sys 2. Use bperf to sample a container: $ perf stat --bpf-counters -e cycles,instructions --timeout 1000 \ --for-each-cgroup docker/66166578dd7d17655923862792a0b9d60c8785fdc1bb8da8b76daedb205c4b10 Performance counter stats for 'system wide': 7,402,983 cycles docker/66166578dd7d17655923862792a0b9d60c8785fdc1bb8da8b76daedb205c4b10 6,036,926 instructions docker/66166578dd7d17655923862792a0b9d60c8785fdc1bb8da8b76daedb205c4b10 # 0.82 insn per cycle 1.004999462 seconds time elapsed How to integrate via bpf? ======================== If you are interested in process sampling, please check the following bpf progs: tools/perf/util/bpf_skel/bperf_leader.bpf.c tools/perf/util/bpf_skel/bperf_follower.bpf.c And if you are interested in container sampling, please check the following bpf prog: tools/perf/util/bpf_skel/bperf_cgroup.bpf.c There have some documents in tools/perf/util/bpf_counter.c, search the keywords 'bperf: share hardware PMCs with BPF' in it and see how bperf works. That's all. Enjoy. Namhyung Kim (9): bpf: Allow bpf_get_current_ancestor_cgroup_id for tracing perf core: Factor out __perf_sw_event_sched perf core: Add PERF_COUNT_SW_CGROUP_SWITCHES event perf tools: Add 'cgroup-switches' software event perf tools: Add read_cgroup_id() function perf tools: Add cgroup_is_v2() helper perf bpf_counter: Move common functions to bpf_counter.h perf stat: Enable BPF counter with --for-each-cgroup perf stat: Fix BPF program section name Song Liu (12): bpftool: Add Makefile target bootstrap perf build: Support build BPF skeletons with perf perf stat: Enable counting events for BPF programs perf stat: Introduce 'bperf' to share hardware PMCs with BPF perf stat: Measure 't0' and 'ref_time' after enable_counters() perf util: Move bpf_perf definitions to a libperf header perf bpf: check perf_attr_map is compatible with the perf binary perf stat: Introduce config stat.bpf-counter-events perf stat: Introduce ':b' modifier perf stat: Introduce bpf_counter_ops->disable() perf bpf: Fix building perf with BUILD_BPF_SKEL=1 by default in more distros perf bpf_skel: Do not use typedef to avoid error on old clang Tengda Wu (1): perf stat: Support inherit events during fork() for bperf Xiaomeng Zhang (1): perf stat: Increase perf_attr_map entries include/linux/perf_event.h | 40 +- include/uapi/linux/perf_event.h | 1 + kernel/trace/bpf_trace.c | 2 + tools/bpf/bpftool/Makefile | 2 + tools/build/Makefile.feature | 4 +- tools/include/uapi/linux/perf_event.h | 7 + tools/lib/perf/include/perf/bpf_perf.h | 31 + tools/perf/Documentation/perf-stat.txt | 31 + tools/perf/Makefile.config | 9 + tools/perf/Makefile.perf | 65 +- tools/perf/builtin-stat.c | 111 ++- tools/perf/util/Build | 2 + tools/perf/util/bpf_counter.c | 828 ++++++++++++++++++ tools/perf/util/bpf_counter.h | 131 +++ tools/perf/util/bpf_counter_cgroup.c | 307 +++++++ tools/perf/util/bpf_skel/.gitignore | 3 + tools/perf/util/bpf_skel/bperf_cgroup.bpf.c | 191 ++++ tools/perf/util/bpf_skel/bperf_follower.bpf.c | 162 ++++ tools/perf/util/bpf_skel/bperf_leader.bpf.c | 55 ++ tools/perf/util/bpf_skel/bperf_u.h | 19 + .../util/bpf_skel/bpf_prog_profiler.bpf.c | 93 ++ tools/perf/util/cgroup.c | 47 + tools/perf/util/cgroup.h | 13 + tools/perf/util/config.c | 4 + tools/perf/util/evlist.c | 4 + tools/perf/util/evsel.c | 27 + tools/perf/util/evsel.h | 32 + tools/perf/util/parse-events.c | 12 +- tools/perf/util/parse-events.l | 3 +- tools/perf/util/python.c | 27 + tools/perf/util/stat-display.c | 4 +- tools/perf/util/stat.c | 2 +- tools/perf/util/target.c | 34 +- tools/perf/util/target.h | 8 + tools/scripts/Makefile.include | 1 + 35 files changed, 2266 insertions(+), 46 deletions(-) create mode 100644 tools/lib/perf/include/perf/bpf_perf.h create mode 100644 tools/perf/util/bpf_counter.c create mode 100644 tools/perf/util/bpf_counter.h create mode 100644 tools/perf/util/bpf_counter_cgroup.c create mode 100644 tools/perf/util/bpf_skel/.gitignore create mode 100644 tools/perf/util/bpf_skel/bperf_cgroup.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_follower.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_leader.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_u.h create mode 100644 tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c -- 2.34.1

2 24

[PATCH OLK-6.6] btrfs: fix use-after-free when attempting to join an aborted transaction
by Long Li 05 Mar '25

05 Mar '25

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.10-rc2 commit e2f0943cf37305dbdeaf9846e3c941451bcdef63 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPCA5 CVE: CVE-2025-21753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When we are trying to join the current transaction and if it's aborted, we read its 'aborted' field after unlocking fs_info->trans_lock and without holding any extra reference count on it. This means that a concurrent task that is aborting the transaction may free the transaction before we read its 'aborted' field, leading to a use-after-free. Fix this by reading the 'aborted' field while holding fs_info->trans_lock since any freeing task must first acquire that lock and set fs_info->running_transaction to NULL before freeing the transaction. This was reported by syzbot and Dmitry with the following stack traces from KASAN: ================================================================== BUG: KASAN: slab-use-after-free in join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 Read of size 4 at addr ffff888011839024 by task kworker/u4:9/1128 CPU: 0 UID: 0 PID: 1128 Comm: kworker/u4:9 Not tainted 6.13.0-rc7-syzkaller-00019-gc45323b7560e #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: events_unbound btrfs_async_reclaim_data_space Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697 flush_space+0x448/0xcf0 fs/btrfs/space-info.c:803 btrfs_async_reclaim_data_space+0x159/0x510 fs/btrfs/space-info.c:1321 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 5315: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 kmalloc_noprof include/linux/slab.h:901 [inline] join_transaction+0x144/0xda0 fs/btrfs/transaction.c:308 start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697 btrfs_create_common+0x1b2/0x2e0 fs/btrfs/inode.c:6572 lookup_open fs/namei.c:3649 [inline] open_last_lookups fs/namei.c:3748 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3984 do_filp_open+0x27f/0x4e0 fs/namei.c:4014 do_sys_openat2+0x13e/0x1d0 fs/open.c:1402 do_sys_open fs/open.c:1417 [inline] __do_sys_creat fs/open.c:1495 [inline] __se_sys_creat fs/open.c:1489 [inline] __x64_sys_creat+0x123/0x170 fs/open.c:1489 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5336: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 cleanup_transaction fs/btrfs/transaction.c:2063 [inline] btrfs_commit_transaction+0x2c97/0x3720 fs/btrfs/transaction.c:2598 insert_balance_item+0x1284/0x20b0 fs/btrfs/volumes.c:3757 btrfs_balance+0x992/0x10c0 fs/btrfs/volumes.c:4633 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3670 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888011839000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 36 bytes inside of freed 2048-byte region [ffff888011839000, ffff888011839800) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11838 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801ac42000 ffffea0000493400 dead000000000002 raw: 0000000000000000 0000000000080008 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801ac42000 ffffea0000493400 dead000000000002 head: 0000000000000000 0000000000080008 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea0000460e01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 57, tgid 57 (kworker/0:2), ts 67248182943, free_ts 67229742023 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558 prep_new_page mm/page_alloc.c:1566 [inline] get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753 alloc_pages_mpol_noprof+0x3e1/0x780 mm/mempolicy.c:2269 alloc_slab_page+0x6a/0x110 mm/slub.c:2423 allocate_slab+0x5a/0x2b0 mm/slub.c:2589 new_slab mm/slub.c:2642 [inline] ___slab_alloc+0xc27/0x14a0 mm/slub.c:3830 __slab_alloc+0x58/0xa0 mm/slub.c:3920 __slab_alloc_node mm/slub.c:3995 [inline] slab_alloc_node mm/slub.c:4156 [inline] __do_kmalloc_node mm/slub.c:4297 [inline] __kmalloc_node_track_caller_noprof+0x2e9/0x4c0 mm/slub.c:4317 kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:609 __alloc_skb+0x1f3/0x440 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1323 [inline] alloc_skb_with_frags+0xc3/0x820 net/core/skbuff.c:6612 sock_alloc_send_pskb+0x91a/0xa60 net/core/sock.c:2884 sock_alloc_send_skb include/net/sock.h:1803 [inline] mld_newpack+0x1c3/0xaf0 net/ipv6/mcast.c:1747 add_grhead net/ipv6/mcast.c:1850 [inline] add_grec+0x1492/0x19a0 net/ipv6/mcast.c:1988 mld_send_cr net/ipv6/mcast.c:2114 [inline] mld_ifc_work+0x691/0xd90 net/ipv6/mcast.c:2651 page last free pid 5300 tgid 5300 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0xd3f/0x1010 mm/page_alloc.c:2659 __slab_free+0x2c2/0x380 mm/slub.c:4524 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4119 [inline] slab_alloc_node mm/slub.c:4168 [inline] __do_kmalloc_node mm/slub.c:4297 [inline] __kmalloc_noprof+0x236/0x4c0 mm/slub.c:4310 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] fib_create_info+0xc14/0x25b0 net/ipv4/fib_semantics.c:1435 fib_table_insert+0x1f6/0x1f20 net/ipv4/fib_trie.c:1231 fib_magic+0x3d8/0x620 net/ipv4/fib_frontend.c:1112 fib_add_ifaddr+0x40c/0x5e0 net/ipv4/fib_frontend.c:1156 fib_netdev_event+0x375/0x490 net/ipv4/fib_frontend.c:1494 notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85 __dev_notify_flags+0x207/0x400 dev_change_flags+0xf0/0x1a0 net/core/dev.c:9045 do_setlink+0xc90/0x4210 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3875 [inline] rtnl_newlink+0x1bb6/0x2210 net/core/rtnetlink.c:4012 Memory state around the buggy address: ffff888011838f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888011838f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888011839000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888011839080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888011839100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Reported-by: syzbot+45212e9d87a98c3f5b42(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/678e7da5.050a0220.303755.007c.GAE@googl… Reported-by: Dmitry Vyukov <dvyukov(a)google.com> Link: https://lore.kernel.org/linux-btrfs/CACT4Y+ZFBdo7pT8L2AzM=vegZwjp-wNkVJZQf0… Fixes: 871383be592b ("btrfs: add missing unlocks to transaction abort paths") Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/transaction.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c index 0548072c642f..aa03db69a016 100644 --- a/fs/btrfs/transaction.c +++ b/fs/btrfs/transaction.c @@ -278,8 +278,10 @@ static noinline int join_transaction(struct btrfs_fs_info *fs_info, cur_trans = fs_info->running_transaction; if (cur_trans) { if (TRANS_ABORTED(cur_trans)) { + const int abort_error = cur_trans->aborted; + spin_unlock(&fs_info->trans_lock); - return cur_trans->aborted; + return abort_error; } if (btrfs_blocked_trans_types[cur_trans->state] & type) { spin_unlock(&fs_info->trans_lock); -- 2.39.2

2 1

[PATCH OLK-6.6] partitions: mac: fix handling of bogus partition table
by Long Li 05 Mar '25

05 Mar '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.10-rc2 commit 80e648042e512d5a767da251d44132553fe04ae0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5K CVE: CVE-2025-21772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix several issues in partition probing: - The bailout for a bad partoffset must use put_dev_sector(), since the preceding read_part_sector() succeeded. - If the partition table claims a silly sector size like 0xfff bytes (which results in partition table entries straddling sector boundaries), bail out instead of accessing out-of-bounds memory. - We must not assume that the partition table contains proper NUL termination - use strnlen() and strncmp() instead of strlen() and strcmp(). Cc: stable(a)vger.kernel.org Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20250214-partition-mac-v1-1-c1c626dffbd5@google.c… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- block/partitions/mac.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/block/partitions/mac.c b/block/partitions/mac.c index 7b521df00a39..6415213cd184 100644 --- a/block/partitions/mac.c +++ b/block/partitions/mac.c @@ -51,13 +51,25 @@ int mac_partition(struct parsed_partitions *state) } secsize = be16_to_cpu(md->block_size); put_dev_sector(sect); + + /* + * If the "block size" is not a power of 2, things get weird - we might + * end up with a partition straddling a sector boundary, so we wouldn't + * be able to read a partition entry with read_part_sector(). + * Real block sizes are probably (?) powers of two, so just require + * that. + */ + if (!is_power_of_2(secsize)) + return -1; datasize = round_down(secsize, 512); data = read_part_sector(state, datasize / 512, &sect); if (!data) return -1; partoffset = secsize % 512; - if (partoffset + sizeof(*part) > datasize) + if (partoffset + sizeof(*part) > datasize) { + put_dev_sector(sect); return -1; + } part = (struct mac_partition *) (data + partoffset); if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) { put_dev_sector(sect); @@ -110,8 +122,8 @@ int mac_partition(struct parsed_partitions *state) int i, l; goodness++; - l = strlen(part->name); - if (strcmp(part->name, "/") == 0) + l = strnlen(part->name, sizeof(part->name)); + if (strncmp(part->name, "/", sizeof(part->name)) == 0) goodness++; for (i = 0; i <= l - 4; ++i) { if (strncasecmp(part->name + i, "root", -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] net: tipc: fix possible refcount leak in tipc_sk_create()
by Wang Liang 05 Mar '25

05 Mar '25

From: Hangyu Hua <hbh25y(a)gmail.com> stable inclusion from stable-v4.19.253 commit ef488669b2652bde5b6ee5a409a5b048a2a50db4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP398 CVE: CVE-2022-49620 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 00aff3590fc0a73bddd3b743863c14e76fd35c0c ] Free sk in case tipc_sk_insert() fails. Signed-off-by: Hangyu Hua <hbh25y(a)gmail.com> Reviewed-by: Tung Nguyen <tung.q.nguyen(a)dektech.com.au> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/tipc/socket.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/tipc/socket.c b/net/tipc/socket.c index 6a1e7ff667ad..f8a555def98f 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -453,6 +453,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock, sock_init_data(sock, sk); tipc_set_sk_state(sk, TIPC_OPEN); if (tipc_sk_insert(tsk)) { + sk_free(sk); pr_warn("Socket create failed; port number exhausted\n"); return -EINVAL; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2025-21702
by Wang Liang 05 Mar '25

05 Mar '25

Eric Dumazet (1): net_sched: sch_fifo: implement lockless __fifo_dump() Quang Le (1): pfifo_tail_enqueue: Drop new packet when sch->limit == 0 net/sched/sch_fifo.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] net: sched: Disallow replacing of child qdisc from one parent to another
by Wang Liang 05 Mar '25

05 Mar '25

From: Jamal Hadi Salim <jhs(a)mojatatu.com> mainline inclusion from mainline-v6.14-rc1 commit bc50835e83f60f56e9bec2b392fb5544f250fb6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBM687 CVE: CVE-2025-21700 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script Step 1. create root qdisc tc qdisc add dev lo root handle 1:0 drr step2. a class for packet aggregation do demonstrate uaf tc class add dev lo classid 1:1 drr step3. a class for nesting tc class add dev lo classid 1:2 drr step4. a class to graft qdisc to tc class add dev lo classid 1:3 drr step5. tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024 step6. tc qdisc add dev lo parent 1:2 handle 3:0 drr step7. tc class add dev lo classid 3:1 drr step 8. tc qdisc add dev lo parent 3:1 handle 4:0 pfifo step 9. Display the class/qdisc layout tc class ls dev lo class drr 1:1 root leaf 2: quantum 64Kb class drr 1:2 root leaf 3: quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent 3:1 limit 1000p qdisc drr 3: dev lo parent 1:2 step10. trigger the bug <=== prevented by this patch tc qdisc replace dev lo parent 1:3 handle 4:0 step 11. Redisplay again the qdiscs/classes tc class ls dev lo class drr 1:1 root leaf 2: quantum 64Kb class drr 1:2 root leaf 3: quantum 64Kb class drr 1:3 root leaf 4: quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p qdisc drr 3: dev lo parent 1:2 Observe that a) parent for 4:0 does not change despite the replace request. There can only be one parent. b) refcount has gone up by two for 4:0 and c) both class 1:3 and 3:1 are pointing to it. Step 12. send one packet to plug echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001)) step13. send one packet to the grafted fifo echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003)) step14. lets trigger the uaf tc class delete dev lo classid 1:3 tc class delete dev lo classid 1:1 The semantics of "replace" is for a del/add _on the same node_ and not a delete from one node(3:1) and add to another node (1:3) as in step10. While we could "fix" with a more complex approach there could be consequences to expectations so the patch takes the preventive approach of "disallow such config". Joint work with Lion Ackermann <nnamrec(a)gmail.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20250116013713.900000-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sched/sch_api.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 36a5d3ceead2..489d8213e305 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -1519,6 +1519,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, q = qdisc_lookup(dev, tcm->tcm_handle); if (!q) goto create_n_graft; + if (q->parent != tcm->tcm_parent) { + NL_SET_ERR_MSG(extack, "Cannot move an existing qdisc to a different parent"); + return -EINVAL; + } if (n->nlmsg_flags & NLM_F_EXCL) { NL_SET_ERR_MSG(extack, "Exclusivity flag on, cannot override"); return -EEXIST; -- 2.34.1

2 1

[PATCH OLK-6.6] perf/core: Save raw sample data conditionally based on sample type
by Luo Gengkun 05 Mar '25

05 Mar '25

From: Yabin Cui <yabinc(a)google.com> stable inclusion from stable-v6.6.76 commit c0dbecb204cfb91999d0b785048be4a95bbc8c9c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBQXZY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b9c44b91476b67327a521568a854babecc4070ab ] Currently, space for raw sample data is always allocated within sample records for both BPF output and tracepoint events. This leads to unused space in sample records when raw sample data is not requested. This patch enforces checking sample type of an event in perf_sample_save_raw_data(). So raw sample data will only be saved if explicitly requested, reducing overhead when it is not needed. Fixes: 0a9081cf0a11 ("perf/core: Add perf_sample_save_raw_data() helper") Signed-off-by: Yabin Cui <yabinc(a)google.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Ian Rogers <irogers(a)google.com> Acked-by: Namhyung Kim <namhyung(a)kernel.org> Link: https://lore.kernel.org/r/20240515193610.2350456-2-yabinc@google.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/s390/kernel/perf_cpum_cf.c | 2 +- arch/s390/kernel/perf_pai_crypto.c | 2 +- arch/s390/kernel/perf_pai_ext.c | 2 +- arch/x86/events/amd/ibs.c | 2 +- include/linux/perf_event.h | 6 +++++ kernel/events/core.c | 35 +++++++++++++++--------------- kernel/trace/bpf_trace.c | 11 +++++----- 7 files changed, 34 insertions(+), 26 deletions(-) diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c index 5466e7bada03..65a66df5bb86 100644 --- a/arch/s390/kernel/perf_cpum_cf.c +++ b/arch/s390/kernel/perf_cpum_cf.c @@ -977,7 +977,7 @@ static int cfdiag_push_sample(struct perf_event *event, if (event->attr.sample_type & PERF_SAMPLE_RAW) { raw.frag.size = cpuhw->usedss; raw.frag.data = cpuhw->stop; - perf_sample_save_raw_data(&data, &raw); + perf_sample_save_raw_data(&data, event, &raw); } overflow = perf_event_overflow(event, &data, &regs); diff --git a/arch/s390/kernel/perf_pai_crypto.c b/arch/s390/kernel/perf_pai_crypto.c index 4a4e914c283c..044fba8332b2 100644 --- a/arch/s390/kernel/perf_pai_crypto.c +++ b/arch/s390/kernel/perf_pai_crypto.c @@ -365,7 +365,7 @@ static int paicrypt_push_sample(void) if (event->attr.sample_type & PERF_SAMPLE_RAW) { raw.frag.size = rawsize; raw.frag.data = cpump->save; - perf_sample_save_raw_data(&data, &raw); + perf_sample_save_raw_data(&data, event, &raw); } overflow = perf_event_overflow(event, &data, &regs); diff --git a/arch/s390/kernel/perf_pai_ext.c b/arch/s390/kernel/perf_pai_ext.c index b5febe22d054..089bd3104b39 100644 --- a/arch/s390/kernel/perf_pai_ext.c +++ b/arch/s390/kernel/perf_pai_ext.c @@ -454,7 +454,7 @@ static int paiext_push_sample(void) if (event->attr.sample_type & PERF_SAMPLE_RAW) { raw.frag.size = rawsize; raw.frag.data = cpump->save; - perf_sample_save_raw_data(&data, &raw); + perf_sample_save_raw_data(&data, event, &raw); } overflow = perf_event_overflow(event, &data, &regs); diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c index e91970b01d62..c3a2f6f57770 100644 --- a/arch/x86/events/amd/ibs.c +++ b/arch/x86/events/amd/ibs.c @@ -1118,7 +1118,7 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) .data = ibs_data.data, }, }; - perf_sample_save_raw_data(&data, &raw); + perf_sample_save_raw_data(&data, event, &raw); } if (perf_ibs == &perf_ibs_op) diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h index fe692e9bd0b2..420f15ddce39 100644 --- a/include/linux/perf_event.h +++ b/include/linux/perf_event.h @@ -1287,12 +1287,18 @@ static inline void perf_sample_save_callchain(struct perf_sample_data *data, } static inline void perf_sample_save_raw_data(struct perf_sample_data *data, + struct perf_event *event, struct perf_raw_record *raw) { struct perf_raw_frag *frag = &raw->frag; u32 sum = 0; int size; + if (!(event->attr.sample_type & PERF_SAMPLE_RAW)) + return; + if (WARN_ON_ONCE(data->sample_flags & PERF_SAMPLE_RAW)) + return; + do { sum += frag->size; if (perf_raw_frag_last(frag)) diff --git a/kernel/events/core.c b/kernel/events/core.c index f53d7c6ad513..ca4f20005586 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -10168,9 +10168,9 @@ static struct pmu perf_tracepoint = { }; static int perf_tp_filter_match(struct perf_event *event, - struct perf_sample_data *data) + struct perf_raw_record *raw) { - void *record = data->raw->frag.data; + void *record = raw->frag.data; /* only top level events have filters set */ if (event->parent) @@ -10182,7 +10182,7 @@ static int perf_tp_filter_match(struct perf_event *event, } static int perf_tp_event_match(struct perf_event *event, - struct perf_sample_data *data, + struct perf_raw_record *raw, struct pt_regs *regs) { if (event->hw.state & PERF_HES_STOPPED) @@ -10193,7 +10193,7 @@ static int perf_tp_event_match(struct perf_event *event, if (event->attr.exclude_kernel && !user_mode(regs)) return 0; - if (!perf_tp_filter_match(event, data)) + if (!perf_tp_filter_match(event, raw)) return 0; return 1; @@ -10219,6 +10219,7 @@ EXPORT_SYMBOL_GPL(perf_trace_run_bpf_submit); static void __perf_tp_event_target_task(u64 count, void *record, struct pt_regs *regs, struct perf_sample_data *data, + struct perf_raw_record *raw, struct perf_event *event) { struct trace_entry *entry = record; @@ -10228,13 +10229,17 @@ static void __perf_tp_event_target_task(u64 count, void *record, /* Cannot deliver synchronous signal to other task. */ if (event->attr.sigtrap) return; - if (perf_tp_event_match(event, data, regs)) + if (perf_tp_event_match(event, raw, regs)) { + perf_sample_data_init(data, 0, 0); + perf_sample_save_raw_data(data, event, raw); perf_swevent_event(event, count, data, regs); + } } static void perf_tp_event_target_task(u64 count, void *record, struct pt_regs *regs, struct perf_sample_data *data, + struct perf_raw_record *raw, struct perf_event_context *ctx) { unsigned int cpu = smp_processor_id(); @@ -10242,15 +10247,15 @@ static void perf_tp_event_target_task(u64 count, void *record, struct perf_event *event, *sibling; perf_event_groups_for_cpu_pmu(event, &ctx->pinned_groups, cpu, pmu) { - __perf_tp_event_target_task(count, record, regs, data, event); + __perf_tp_event_target_task(count, record, regs, data, raw, event); for_each_sibling_event(sibling, event) - __perf_tp_event_target_task(count, record, regs, data, sibling); + __perf_tp_event_target_task(count, record, regs, data, raw, sibling); } perf_event_groups_for_cpu_pmu(event, &ctx->flexible_groups, cpu, pmu) { - __perf_tp_event_target_task(count, record, regs, data, event); + __perf_tp_event_target_task(count, record, regs, data, raw, event); for_each_sibling_event(sibling, event) - __perf_tp_event_target_task(count, record, regs, data, sibling); + __perf_tp_event_target_task(count, record, regs, data, raw, sibling); } } @@ -10268,15 +10273,10 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size, }, }; - perf_sample_data_init(&data, 0, 0); - perf_sample_save_raw_data(&data, &raw); - perf_trace_buf_update(record, event_type); hlist_for_each_entry_rcu(event, head, hlist_entry) { - if (perf_tp_event_match(event, &data, regs)) { - perf_swevent_event(event, count, &data, regs); - + if (perf_tp_event_match(event, &raw, regs)) { /* * Here use the same on-stack perf_sample_data, * some members in data are event-specific and @@ -10286,7 +10286,8 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size, * because data->sample_flags is set. */ perf_sample_data_init(&data, 0, 0); - perf_sample_save_raw_data(&data, &raw); + perf_sample_save_raw_data(&data, event, &raw); + perf_swevent_event(event, count, &data, regs); } } @@ -10303,7 +10304,7 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size, goto unlock; raw_spin_lock(&ctx->lock); - perf_tp_event_target_task(count, record, regs, &data, ctx); + perf_tp_event_target_task(count, record, regs, &data, &raw, ctx); raw_spin_unlock(&ctx->lock); unlock: rcu_read_unlock(); diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 4485f5f383cc..560563536e8e 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -616,7 +616,8 @@ static const struct bpf_func_proto bpf_perf_event_read_value_proto = { static __always_inline u64 __bpf_perf_event_output(struct pt_regs *regs, struct bpf_map *map, - u64 flags, struct perf_sample_data *sd) + u64 flags, struct perf_raw_record *raw, + struct perf_sample_data *sd) { struct bpf_array *array = container_of(map, struct bpf_array, map); unsigned int cpu = smp_processor_id(); @@ -641,6 +642,8 @@ __bpf_perf_event_output(struct pt_regs *regs, struct bpf_map *map, if (unlikely(event->oncpu != cpu)) return -EOPNOTSUPP; + perf_sample_save_raw_data(sd, event, raw); + return perf_event_output(event, sd, regs); } @@ -684,9 +687,8 @@ BPF_CALL_5(bpf_perf_event_output, struct pt_regs *, regs, struct bpf_map *, map, } perf_sample_data_init(sd, 0, 0); - perf_sample_save_raw_data(sd, &raw); - err = __bpf_perf_event_output(regs, map, flags, sd); + err = __bpf_perf_event_output(regs, map, flags, &raw, sd); out: this_cpu_dec(bpf_trace_nest_level); preempt_enable(); @@ -745,9 +747,8 @@ u64 bpf_event_output(struct bpf_map *map, u64 flags, void *meta, u64 meta_size, perf_fetch_caller_regs(regs); perf_sample_data_init(sd, 0, 0); - perf_sample_save_raw_data(sd, &raw); - ret = __bpf_perf_event_output(regs, map, flags, sd); + ret = __bpf_perf_event_output(regs, map, flags, &raw, sd); out: this_cpu_dec(bpf_event_output_nest_level); preempt_enable(); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] Fix CVE-2022-49253
by Hongbo Li 05 Mar '25

05 Mar '25

Fix CVE-2022-49253. Dan Carpenter (1): media: usb: go7007: s2250-board: fix leak in probe() drivers/media/usb/go7007/s2250-board.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/2] Fixes CVE-2025-21767
by Yang Yingliang 05 Mar '25

05 Mar '25

Waiman Long (2): clocksource: Use pr_info() for "Checking clocksource synchronization" message clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context kernel/time/clocksource.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2022-49308
by Hongbo Li 05 Mar '25

05 Mar '25

Fix CVE-2022-49308. Dinghao Liu (1): extcon: Fix error handling in extcon_dev_register bumwoo lee (1): extcon: Modify extcon device to be created after driver data is set drivers/extcon/extcon.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/1] Fix Fix CVE-2022-49351
by Hongbo Li 05 Mar '25

05 Mar '25

Fix Fix CVE-2022-49351. Miaoqian Lin (1): net: altera: Fix refcount leak in altera_tse_mdio_create drivers/net/ethernet/altera/altera_tse_main.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-25.03 v6 0/4] Add TrIO support in EROFS
by Hongbo Li 05 Mar '25

05 Mar '25

TrIO can accelerate the cold start of containers during on-demand loading. It aggregates the read I/O operations required for container runtime during the first container launch. In the following startups, TrIO pulls the necessary I/O data to the container node in a single large I/O operation and uses this I/O information to construct the runtime rootfs. By improving the efficiency of network I/O, TrIO speeds up container startup in on-demand loading scenarios. TrIO consists of both kernel-space and user-space code. The kernel-space code has been adapted at the overlayfs layer, introducing the CONFIG_EROFS_TRIO configuration to provide isolation. The user-space code requires adaptation by the user, and detailed usage methods are introduced in the tools/trio/README.md section. Patches 1~2 correspond to the kernel adaptations, while patches 3~4 are the scripts and best practices that TrIO relies on for its operation. v6: - Add folio_put after filemap_get_folio. - Filter trace with lowerdir v5: - Adapt to the large folio tracepoint in erofs. - Adapt to the multiple type of page size (4k and 64k). v4: - Avoid the memleak of meta_buf. - Fix some exception handle from reviewer's suggestions. - Use spinlock in kprobe context. v3: - Obtain and keep the trio_object in open. - Only close readahead in trio case. Hongbo Li (4): erofs:trio: Add trio_manager in erofs erofs: trio: Support TrIO feature in erofs TrIO: Add tools for using TrIO TrIO: Add README.md arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/erofs/Kconfig | 11 + fs/erofs/Makefile | 1 + fs/erofs/fscache.c | 22 +- fs/erofs/inode.c | 2 + fs/erofs/internal.h | 56 +++ fs/erofs/super.c | 49 +- fs/erofs/trio_manager.c | 365 +++++++++++++++ tools/trio/README.md | 446 +++++++++++++++++++ tools/trio/bpf/iotracker/Makefile | 99 ++++ tools/trio/bpf/iotracker/iotracker.bpf.c | 52 +++ tools/trio/bpf/iotracker/iotracker.c | 57 +++ tools/trio/bpf/rio_tracker_mod/Makefile | 9 + tools/trio/bpf/rio_tracker_mod/rio_tracker.c | 370 +++++++++++++++ tools/trio/scripts/trace_parser.py | 287 ++++++++++++ 16 files changed, 1825 insertions(+), 3 deletions(-) create mode 100644 fs/erofs/trio_manager.c create mode 100644 tools/trio/README.md create mode 100644 tools/trio/bpf/iotracker/Makefile create mode 100644 tools/trio/bpf/iotracker/iotracker.bpf.c create mode 100644 tools/trio/bpf/iotracker/iotracker.c create mode 100644 tools/trio/bpf/rio_tracker_mod/Makefile create mode 100644 tools/trio/bpf/rio_tracker_mod/rio_tracker.c create mode 100644 tools/trio/scripts/trace_parser.py -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] can: m_can: m_can_tx_handler(): fix use after free of skb
by Xiangwei Li 05 Mar '25

05 Mar '25

From: Marc Kleine-Budde <mkl(a)pengutronix.de> stable inclusion from stable-v4.19.253 commit 7728d937ec403a1ceff9483023252d2cb8777f81 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6AL CVE: CVE-2022-49275 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2e8e79c416aae1de224c0f1860f2e3350fa171f8 upstream. can_put_echo_skb() will clone skb then free the skb. Move the can_put_echo_skb() for the m_can version 3.0.x directly before the start of the xmit in hardware, similar to the 3.1.x branch. Fixes: 80646733f11c ("can: m_can: update to support CAN FD features") Link: https://lore.kernel.org/all/20220317081305.739554-1-mkl@pengutronix.de Cc: stable(a)vger.kernel.org Reported-by: Hangyu Hua <hbh25y(a)gmail.com> Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> [sudip: adjust context] Signed-off-by: Sudip Mukherjee <sudipm.mukherjee(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- drivers/net/can/m_can/m_can.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c index deb274a19ba0..3e0084ff3c9c 100644 --- a/drivers/net/can/m_can/m_can.c +++ b/drivers/net/can/m_can/m_can.c @@ -1443,8 +1443,6 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb, M_CAN_FIFO_DATA(i / 4), *(u32 *)(cf->data + i)); - can_put_echo_skb(skb, dev, 0); - if (priv->can.ctrlmode & CAN_CTRLMODE_FD) { cccr = m_can_read(priv, M_CAN_CCCR); cccr &= ~(CCCR_CMR_MASK << CCCR_CMR_SHIFT); @@ -1461,6 +1459,9 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb, m_can_write(priv, M_CAN_CCCR, cccr); } m_can_write(priv, M_CAN_TXBTIE, 0x1); + + can_put_echo_skb(skb, dev, 0); + m_can_write(priv, M_CAN_TXBAR, 0x1); /* End of xmit function for version 3.0.x */ } else { -- 2.25.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 2fb29dd60fee873c8d757037e478fa2c03ac8bd3
by kernel test robot 05 Mar '25

05 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2fb29dd60fee873c8d757037e478fa2c03ac8bd3 !15293 ras: ACPI: HED: Always initialize before evged Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-defconfig | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-002-20250304 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-003-20250304 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-004-20250304 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- Warning:arch-x86-kernel-cpu-resctrl-monitor.c-references-a-file-that-doesn-t-exist:Documentation-x86-resctrl.rst | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250304 | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250304 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250304 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250304 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250304 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250304 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch `-- x86_64-defconfig |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch elapsed time: 743m configs tested: 16 configs skipped: 119 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250304 clang-21 arm64 randconfig-002-20250304 gcc-14.2.0 arm64 randconfig-003-20250304 gcc-14.2.0 arm64 randconfig-004-20250304 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250304 clang-19 x86_64 buildonly-randconfig-002-20250304 gcc-12 x86_64 buildonly-randconfig-003-20250304 gcc-12 x86_64 buildonly-randconfig-004-20250304 gcc-12 x86_64 buildonly-randconfig-005-20250304 gcc-12 x86_64 buildonly-randconfig-006-20250304 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
by Xiaomeng Zhang 05 Mar '25

05 Mar '25

From: Kuan-Wei Chiu <visitorckw(a)gmail.com> mainline inclusion from mainline-v6.14-rc1 commit 3d6f83df8ff2d5de84b50377e4f0d45e25311c7a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBQPCU Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Shifting 1 << 31 on a 32-bit int causes signed integer overflow, which leads to undefined behavior. To prevent this, cast 1 to u32 before performing the shift, ensuring well-defined behavior. This change explicitly avoids any potential overflow by ensuring that the shift occurs on an unsigned 32-bit integer. Signed-off-by: Kuan-Wei Chiu <visitorckw(a)gmail.com> Acked-by: Petr Mladek <pmladek(a)suse.com> Link: https://lore.kernel.org/r/20240928113608.1438087-1-visitorckw@gmail.com Signed-off-by: Petr Mladek <pmladek(a)suse.com> Conflicts: kernel/printk/printk.c [Fix context conflicts.] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/printk/printk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index f6b48484a300..8d324657bbda 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -476,7 +476,7 @@ static struct latched_seq clear_seq = { /* record buffer */ #define LOG_ALIGN __alignof__(unsigned long) #define __LOG_BUF_LEN (1 << CONFIG_LOG_BUF_SHIFT) -#define LOG_BUF_LEN_MAX (u32)(1 << 31) +#define LOG_BUF_LEN_MAX ((u32)1 << 31) static char __log_buf[__LOG_BUF_LEN] __aligned(LOG_ALIGN); static char *log_buf = __log_buf; static u32 log_buf_len = __LOG_BUF_LEN; -- 2.34.1

2 1

[PATCH openEuler-25.03 v6 0/4] Add TrIO support in EROFS
by Hongbo Li 05 Mar '25

05 Mar '25

TrIO can accelerate the cold start of containers during on-demand loading. It aggregates the read I/O operations required for container runtime during the first container launch. In the following startups, TrIO pulls the necessary I/O data to the container node in a single large I/O operation and uses this I/O information to construct the runtime rootfs. By improving the efficiency of network I/O, TrIO speeds up container startup in on-demand loading scenarios. TrIO consists of both kernel-space and user-space code. The kernel-space code has been adapted at the overlayfs layer, introducing the CONFIG_EROFS_TRIO configuration to provide isolation. The user-space code requires adaptation by the user, and detailed usage methods are introduced in the tools/trio/README.md section. Patches 1~2 correspond to the kernel adaptations, while patches 3~4 are the scripts and best practices that TrIO relies on for its operation. v6: - Add folio_put after filemap_get_folio. v5: - Adapt to the large folio tracepoint in erofs. - Adapt to the multiple type of page size (4k and 64k). v4: - Avoid the memleak of meta_buf. - Fix some exception handle from reviewer's suggestions. - Use spinlock in kprobe context. v3: - Obtain and keep the trio_object in open. - Only close readahead in trio case. Hongbo Li (4): erofs:trio: Add trio_manager in erofs erofs: trio: Support TrIO feature in erofs TrIO: Add tools for using TrIO TrIO: Add README.md arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/erofs/Kconfig | 11 + fs/erofs/Makefile | 1 + fs/erofs/fscache.c | 22 +- fs/erofs/inode.c | 2 + fs/erofs/internal.h | 56 ++ fs/erofs/super.c | 49 +- fs/erofs/trio_manager.c | 365 +++++++++++++ tools/trio/README.md | 517 +++++++++++++++++++ tools/trio/bpf/iotracker/Makefile | 99 ++++ tools/trio/bpf/iotracker/iotracker.bpf.c | 52 ++ tools/trio/bpf/iotracker/iotracker.c | 57 ++ tools/trio/bpf/rio_tracker_mod/Makefile | 9 + tools/trio/bpf/rio_tracker_mod/rio_tracker.c | 370 +++++++++++++ tools/trio/scripts/trace_parser.py | 287 ++++++++++ 16 files changed, 1896 insertions(+), 3 deletions(-) create mode 100644 fs/erofs/trio_manager.c create mode 100644 tools/trio/README.md create mode 100644 tools/trio/bpf/iotracker/Makefile create mode 100644 tools/trio/bpf/iotracker/iotracker.bpf.c create mode 100644 tools/trio/bpf/iotracker/iotracker.c create mode 100644 tools/trio/bpf/rio_tracker_mod/Makefile create mode 100644 tools/trio/bpf/rio_tracker_mod/rio_tracker.c create mode 100644 tools/trio/scripts/trace_parser.py -- 2.34.1

2 5

[PATCH OLK-6.6] USB: hub: Ignore non-compliant devices with too many configs or interfaces
by Bowen You 05 Mar '25

05 Mar '25

From: Alan Stern <stern(a)rowland.harvard.edu> mainline inclusion from mainline-v6.12-rc1 commit 2240fed37afbcdb5e8b627bc7ad986891100e05d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC7J CVE: CVE-2025-21776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Robert Morris created a test program which can cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate pointer: Oops: general protection fault, probably for non-canonical address 0xcccccccccccccccc: 0000 [#1] SMP DEBUG_PAGEALLOC PTI CPU: 7 UID: 0 PID: 117 Comm: kworker/7:1 Not tainted 6.13.0-rc3-00017-gf44d154d6e3d #14 Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_hub_adjust_deviceremovable+0x78/0x110 ... Call Trace: <TASK> ? die_addr+0x31/0x80 ? exc_general_protection+0x1b4/0x3c0 ? asm_exc_general_protection+0x26/0x30 ? usb_hub_adjust_deviceremovable+0x78/0x110 hub_probe+0x7c7/0xab0 usb_probe_interface+0x14b/0x350 really_probe+0xd0/0x2d0 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x6e/0x110 driver_probe_device+0x1a/0x90 __device_attach_driver+0x7e/0xc0 bus_for_each_drv+0x7f/0xd0 __device_attach+0xaa/0x1a0 bus_probe_device+0x8b/0xa0 device_add+0x62e/0x810 usb_set_configuration+0x65d/0x990 usb_generic_driver_probe+0x4b/0x70 usb_probe_device+0x36/0xd0 The cause of this error is that the device has two interfaces, and the hub driver binds to interface 1 instead of interface 0, which is where usb_hub_to_struct_hub() looks. We can prevent the problem from occurring by refusing to accept hub devices that violate the USB spec by having more than one configuration or interface. Reported-and-tested-by: Robert Morris <rtm(a)csail.mit.edu> Cc: stable <stable(a)kernel.org> Closes: https://lore.kernel.org/linux-usb/95564.1737394039@localhost/ Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/r/c27f3bf4-63d8-4fb5-ac82-09e3cd19f61c@rowland.harv… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/usb/core/hub.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index 1ba3feb5e190..f295609649b1 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1818,6 +1818,17 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id) desc = intf->cur_altsetting; hdev = interface_to_usbdev(intf); + /* + * The USB 2.0 spec prohibits hubs from having more than one + * configuration or interface, and we rely on this prohibition. + * Refuse to accept a device that violates it. + */ + if (hdev->descriptor.bNumConfigurations > 1 || + hdev->actconfig->desc.bNumInterfaces > 1) { + dev_err(&intf->dev, "Invalid hub with more than one config or interface\n"); + return -EINVAL; + } + /* * Set default autosuspend delay as 0 to speedup bus suspend, * based on the below considerations: -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] md/raid1: fix bitmap update when all write requests fail
by Zheng Qixing 05 Mar '25

05 Mar '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBKHTZ ------------------------ When writing to a RAID1 array where all member disks have bad sectors at the target location, the bitmap update is skipped because all bios[] are NULL, leading to bitmap counter inconsistency. This can cause subsequent I/O operations to hang while waiting for bitmap counter to reach the expected value. Fix this by updating the bitmap when all member disks have bad sectors. Fixes: 1f68f0c4b677 ("md/raid1: avoid writing to known-bad blocks on known-bad drives.") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index ee3826db193d..62e73ac32a3b 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1551,6 +1551,13 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, } } + /* + * Corresponding to md_bitmap_endwrite() from close_write(), in the case + * io range from all member disks are badblocks. + */ + if (first_clone) + md_bitmap_startwrite(bitmap, r1_bio->sector, r1_bio->sectors, 0); + r1_bio_write_done(r1_bio); /* In case raid1d snuck in to freeze_array */ -- 2.39.2

2 1

[PATCH openEuler-25.03 v5 0/4] Add TrIO support in EROFS
by Hongbo Li 04 Mar '25

04 Mar '25

TrIO can accelerate the cold start of containers during on-demand loading. It aggregates the read I/O operations required for container runtime during the first container launch. In the following startups, TrIO pulls the necessary I/O data to the container node in a single large I/O operation and uses this I/O information to construct the runtime rootfs. By improving the efficiency of network I/O, TrIO speeds up container startup in on-demand loading scenarios. TrIO consists of both kernel-space and user-space code. The kernel-space code has been adapted at the overlayfs layer, introducing the CONFIG_EROFS_TRIO configuration to provide isolation. The user-space code requires adaptation by the user, and detailed usage methods are introduced in the tools/trio/README.md section. Patches 1~2 correspond to the kernel adaptations, while patches 3~4 are the scripts and best practices that TrIO relies on for its operation. v5: - Adapt to the large folio tracepoint in erofs. - Adapt to the multiple type of page size (4k and 64k). v4: - Avoid the memleak of meta_buf. - Fix some exception handle from reviewer's suggestions. - Use spinlock in kprobe context. v3: - Obtain and keep the trio_object in open. - Only close readahead in trio case. Hongbo Li (4): erofs:trio: Add trio_manager in erofs erofs: trio: Support TrIO feature in erofs TrIO: Add tools for using TrIO TrIO: Add README.md arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/erofs/Kconfig | 11 + fs/erofs/Makefile | 1 + fs/erofs/fscache.c | 22 +- fs/erofs/inode.c | 2 + fs/erofs/internal.h | 56 +++ fs/erofs/super.c | 49 +- fs/erofs/trio_manager.c | 365 +++++++++++++++ tools/trio/README.md | 444 +++++++++++++++++++ tools/trio/bpf/iotracker/Makefile | 99 +++++ tools/trio/bpf/iotracker/iotracker.bpf.c | 52 +++ tools/trio/bpf/iotracker/iotracker.c | 57 +++ tools/trio/bpf/rio_tracker_mod/Makefile | 9 + tools/trio/bpf/rio_tracker_mod/rio_tracker.c | 365 +++++++++++++++ tools/trio/scripts/trace_parser.py | 287 ++++++++++++ 16 files changed, 1818 insertions(+), 3 deletions(-) create mode 100644 fs/erofs/trio_manager.c create mode 100644 tools/trio/README.md create mode 100644 tools/trio/bpf/iotracker/Makefile create mode 100644 tools/trio/bpf/iotracker/iotracker.bpf.c create mode 100644 tools/trio/bpf/iotracker/iotracker.c create mode 100644 tools/trio/bpf/rio_tracker_mod/Makefile create mode 100644 tools/trio/bpf/rio_tracker_mod/rio_tracker.c create mode 100644 tools/trio/scripts/trace_parser.py -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
by Xiangwei Li 04 Mar '25

04 Mar '25

From: Junxiao Bi via Ocfs2-devel <ocfs2-devel(a)oss.oracle.com> stable inclusion from stable-v4.19.247 commit 733a35c00ef363a1c774d7ea486e0735b7c13a15 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP72J CVE: CVE-2022-49337 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 863e0d81b6683c4cbc588ad831f560c90e494bef upstream. When user_dlm_destroy_lock failed, it didn't clean up the flags it set before exit. For USER_LOCK_IN_TEARDOWN, if this function fails because of lock is still in used, next time when unlink invokes this function, it will return succeed, and then unlink will remove inode and dentry if lock is not in used(file closed), but the dlm lock is still linked in dlm lock resource, then when bast come in, it will trigger a panic due to user-after-free. See the following panic call trace. To fix this, USER_LOCK_IN_TEARDOWN should be reverted if fail. And also error should be returned if USER_LOCK_IN_TEARDOWN is set to let user know that unlink fail. For the case of ocfs2_dlm_unlock failure, besides USER_LOCK_IN_TEARDOWN, USER_LOCK_BUSY is also required to be cleared. Even though spin lock is released in between, but USER_LOCK_IN_TEARDOWN is still set, for USER_LOCK_BUSY, if before every place that waits on this flag, USER_LOCK_IN_TEARDOWN is checked to bail out, that will make sure no flow waits on the busy flag set by user_dlm_destroy_lock(), then we can simplely revert USER_LOCK_BUSY when ocfs2_dlm_unlock fails. Fix user_dlm_cluster_lock() which is the only function not following this. [ 941.336392] (python,26174,16):dlmfs_unlink:562 ERROR: unlink 004fb0000060000b5a90b8c847b72e1, error -16 from destroy [ 989.757536] ------------[ cut here ]------------ [ 989.757709] kernel BUG at fs/ocfs2/dlmfs/userdlm.c:173! [ 989.757876] invalid opcode: 0000 [#1] SMP [ 989.758027] Modules linked in: ksplice_2zhuk2jr_ib_ipoib_new(O) ksplice_2zhuk2jr(O) mptctl mptbase xen_netback xen_blkback xen_gntalloc xen_gntdev xen_evtchn cdc_ether usbnet mii ocfs2 jbd2 rpcsec_gss_krb5 auth_rpcgss nfsv4 nfsv3 nfs_acl nfs fscache lockd grace ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs bnx2fc fcoe libfcoe libfc scsi_transport_fc sunrpc ipmi_devintf bridge stp llc rds_rdma rds bonding ib_sdp ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm falcon_lsm_serviceable(PE) falcon_nf_netcontain(PE) mlx4_vnic falcon_kal(E) falcon_lsm_pinned_13402(E) mlx4_ib ib_sa ib_mad ib_core ib_addr xenfs xen_privcmd dm_multipath iTCO_wdt iTCO_vendor_support pcspkr sb_edac edac_core i2c_i801 lpc_ich mfd_core ipmi_ssif i2c_core ipmi_si ipmi_msghandler [ 989.760686] ioatdma sg ext3 jbd mbcache sd_mod ahci libahci ixgbe dca ptp pps_core vxlan udp_tunnel ip6_udp_tunnel megaraid_sas mlx4_core crc32c_intel be2iscsi bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi ipv6 cxgb3 mdio libiscsi_tcp qla4xxx iscsi_boot_sysfs libiscsi scsi_transport_iscsi wmi dm_mirror dm_region_hash dm_log dm_mod [last unloaded: ksplice_2zhuk2jr_ib_ipoib_old] [ 989.761987] CPU: 10 PID: 19102 Comm: dlm_thread Tainted: P OE 4.1.12-124.57.1.el6uek.x86_64 #2 [ 989.762290] Hardware name: Oracle Corporation ORACLE SERVER X5-2/ASM,MOTHERBOARD,1U, BIOS 30350100 06/17/2021 [ 989.762599] task: ffff880178af6200 ti: ffff88017f7c8000 task.ti: ffff88017f7c8000 [ 989.762848] RIP: e030:[<ffffffffc07d4316>] [<ffffffffc07d4316>] __user_dlm_queue_lockres.part.4+0x76/0x80 [ocfs2_dlmfs] [ 989.763185] RSP: e02b:ffff88017f7cbcb8 EFLAGS: 00010246 [ 989.763353] RAX: 0000000000000000 RBX: ffff880174d48008 RCX: 0000000000000003 [ 989.763565] RDX: 0000000000120012 RSI: 0000000000000003 RDI: ffff880174d48170 [ 989.763778] RBP: ffff88017f7cbcc8 R08: ffff88021f4293b0 R09: 0000000000000000 [ 989.763991] R10: ffff880179c8c000 R11: 0000000000000003 R12: ffff880174d48008 [ 989.764204] R13: 0000000000000003 R14: ffff880179c8c000 R15: ffff88021db7a000 [ 989.764422] FS: 0000000000000000(0000) GS:ffff880247480000(0000) knlGS:ffff880247480000 [ 989.764685] CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 989.764865] CR2: ffff8000007f6800 CR3: 0000000001ae0000 CR4: 0000000000042660 [ 989.765081] Stack: [ 989.765167] 0000000000000003 ffff880174d48040 ffff88017f7cbd18 ffffffffc07d455f [ 989.765442] ffff88017f7cbd88 ffffffff816fb639 ffff88017f7cbd38 ffff8800361b5600 [ 989.765717] ffff88021db7a000 ffff88021f429380 0000000000000003 ffffffffc0453020 [ 989.765991] Call Trace: [ 989.766093] [<ffffffffc07d455f>] user_bast+0x5f/0xf0 [ocfs2_dlmfs] [ 989.766287] [<ffffffff816fb639>] ? schedule_timeout+0x169/0x2d0 [ 989.766475] [<ffffffffc0453020>] ? o2dlm_lock_ast_wrapper+0x20/0x20 [ocfs2_stack_o2cb] [ 989.766738] [<ffffffffc045303a>] o2dlm_blocking_ast_wrapper+0x1a/0x20 [ocfs2_stack_o2cb] [ 989.767010] [<ffffffffc0864ec6>] dlm_do_local_bast+0x46/0xe0 [ocfs2_dlm] [ 989.767217] [<ffffffffc084f5cc>] ? dlm_lockres_calc_usage+0x4c/0x60 [ocfs2_dlm] [ 989.767466] [<ffffffffc08501f1>] dlm_thread+0xa31/0x1140 [ocfs2_dlm] [ 989.767662] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.767834] [<ffffffff816f78ce>] ? __schedule+0x23e/0x810 [ 989.768006] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.768178] [<ffffffff816f78ce>] ? __schedule+0x23e/0x810 [ 989.768349] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.768521] [<ffffffff816f78ce>] ? __schedule+0x23e/0x810 [ 989.768693] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.768893] [<ffffffff816f78ce>] ? __schedule+0x23e/0x810 [ 989.769067] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.769241] [<ffffffff810ce4d0>] ? wait_woken+0x90/0x90 [ 989.769411] [<ffffffffc084f7c0>] ? dlm_kick_thread+0x80/0x80 [ocfs2_dlm] [ 989.769617] [<ffffffff810a8bbb>] kthread+0xcb/0xf0 [ 989.769774] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.769945] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.770117] [<ffffffff810a8af0>] ? kthread_create_on_node+0x180/0x180 [ 989.770321] [<ffffffff816fdaa1>] ret_from_fork+0x61/0x90 [ 989.770492] [<ffffffff810a8af0>] ? kthread_create_on_node+0x180/0x180 [ 989.770689] Code: d0 00 00 00 f0 45 7d c0 bf 00 20 00 00 48 89 83 c0 00 00 00 48 89 83 c8 00 00 00 e8 55 c1 8c c0 83 4b 04 10 48 83 c4 08 5b 5d c3 <0f> 0b 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 55 41 54 53 48 83 [ 989.771892] RIP [<ffffffffc07d4316>] __user_dlm_queue_lockres.part.4+0x76/0x80 [ocfs2_dlmfs] [ 989.772174] RSP <ffff88017f7cbcb8> [ 989.772704] ---[ end trace ebd1e38cebcc93a8 ]--- [ 989.772907] Kernel panic - not syncing: Fatal exception [ 989.773173] Kernel Offset: disabled Link: https://lkml.kernel.org/r/20220518235224.87100-2-junxiao.bi@oracle.com Signed-off-by: Junxiao Bi <junxiao.bi(a)oracle.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Joseph Qi <jiangqi903(a)gmail.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- fs/ocfs2/dlmfs/userdlm.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/dlmfs/userdlm.c b/fs/ocfs2/dlmfs/userdlm.c index 9cecf4857195..24dbbbf13827 100644 --- a/fs/ocfs2/dlmfs/userdlm.c +++ b/fs/ocfs2/dlmfs/userdlm.c @@ -449,6 +449,11 @@ int user_dlm_cluster_lock(struct user_lock_res *lockres, } spin_lock(&lockres->l_lock); + if (lockres->l_flags & USER_LOCK_IN_TEARDOWN) { + spin_unlock(&lockres->l_lock); + status = -EAGAIN; + goto bail; + } /* We only compare against the currently granted level * here. If the lock is blocked waiting on a downconvert, @@ -615,7 +620,7 @@ int user_dlm_destroy_lock(struct user_lock_res *lockres) spin_lock(&lockres->l_lock); if (lockres->l_flags & USER_LOCK_IN_TEARDOWN) { spin_unlock(&lockres->l_lock); - return 0; + goto bail; } lockres->l_flags |= USER_LOCK_IN_TEARDOWN; @@ -629,12 +634,17 @@ int user_dlm_destroy_lock(struct user_lock_res *lockres) } if (lockres->l_ro_holders || lockres->l_ex_holders) { + lockres->l_flags &= ~USER_LOCK_IN_TEARDOWN; spin_unlock(&lockres->l_lock); goto bail; } status = 0; if (!(lockres->l_flags & USER_LOCK_ATTACHED)) { + /* + * lock is never requested, leave USER_LOCK_IN_TEARDOWN set + * to avoid new lock request coming in. + */ spin_unlock(&lockres->l_lock); goto bail; } @@ -645,6 +655,10 @@ int user_dlm_destroy_lock(struct user_lock_res *lockres) status = ocfs2_dlm_unlock(conn, &lockres->l_lksb, DLM_LKF_VALBLK); if (status) { + spin_lock(&lockres->l_lock); + lockres->l_flags &= ~USER_LOCK_IN_TEARDOWN; + lockres->l_flags &= ~USER_LOCK_BUSY; + spin_unlock(&lockres->l_lock); user_log_dlm_error("ocfs2_dlm_unlock", status, lockres); goto bail; } -- 2.25.1

2 1

[PATCH openEuler-25.03 v5 0/4] Add TrIO support in EROFS
by Hongbo Li 04 Mar '25

04 Mar '25

TrIO can accelerate the cold start of containers during on-demand loading. It aggregates the read I/O operations required for container runtime during the first container launch. In the following startups, TrIO pulls the necessary I/O data to the container node in a single large I/O operation and uses this I/O information to construct the runtime rootfs. By improving the efficiency of network I/O, TrIO speeds up container startup in on-demand loading scenarios. TrIO consists of both kernel-space and user-space code. The kernel-space code has been adapted at the overlayfs layer, introducing the CONFIG_EROFS_TRIO configuration to provide isolation. The user-space code requires adaptation by the user, and detailed usage methods are introduced in the tools/trio/README.md section. Patches 1~2 correspond to the kernel adaptations, while patches 3~4 are the scripts and best practices that TrIO relies on for its operation. v5: - Adapt to the large folio tracepoint in erofs. - Adapt to the multiple type of page size (4k and 64k). v4: - Avoid the memleak of meta_buf. - Fix some exception handle from reviewer's suggestions. - Use spinlock in kprobe context. v3: - Obtain and keep the trio_object in open. - Only close readahead in trio case. Hongbo Li (4): erofs:trio: Add trio_manager in erofs erofs: trio: Support TrIO feature in erofs TrIO: Add tools for using TrIO TrIO: Add README.md arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/erofs/Kconfig | 11 + fs/erofs/Makefile | 1 + fs/erofs/fscache.c | 22 +- fs/erofs/inode.c | 2 + fs/erofs/internal.h | 56 ++ fs/erofs/super.c | 49 +- fs/erofs/trio_manager.c | 365 +++++++++++++ tools/trio/README.md | 517 +++++++++++++++++++ tools/trio/bpf/iotracker/Makefile | 99 ++++ tools/trio/bpf/iotracker/iotracker.bpf.c | 52 ++ tools/trio/bpf/iotracker/iotracker.c | 57 ++ tools/trio/bpf/rio_tracker_mod/Makefile | 9 + tools/trio/bpf/rio_tracker_mod/rio_tracker.c | 366 +++++++++++++ tools/trio/scripts/trace_parser.py | 287 ++++++++++ 16 files changed, 1892 insertions(+), 3 deletions(-) create mode 100644 fs/erofs/trio_manager.c create mode 100644 tools/trio/README.md create mode 100644 tools/trio/bpf/iotracker/Makefile create mode 100644 tools/trio/bpf/iotracker/iotracker.bpf.c create mode 100644 tools/trio/bpf/iotracker/iotracker.c create mode 100644 tools/trio/bpf/rio_tracker_mod/Makefile create mode 100644 tools/trio/bpf/rio_tracker_mod/rio_tracker.c create mode 100644 tools/trio/scripts/trace_parser.py -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] drm/imx: Fix memory leak in imx_pd_connector_get_modes
by Yang Yingliang 04 Mar '25

04 Mar '25

From: José Expósito <jose.exposito89(a)gmail.com> stable inclusion from stable-v4.19.238 commit 41624d7c0c3df71dee170c610744aaa5909327b8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1KE CVE: CVE-2022-49091 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bce81feb03a20fca7bbdd1c4af16b4e9d5c0e1d3 ] Avoid leaking the display mode variable if of_get_drm_display_mode fails. Fixes: 76ecd9c9fb24 ("drm/imx: parallel-display: check return code from of_get_drm_display_mode()") Addresses-Coverity-ID: 1443943 ("Resource leak") Signed-off-by: José Expósito <jose.exposito89(a)gmail.com> Signed-off-by: Philipp Zabel <p.zabel(a)pengutronix.de> Link: https://lore.kernel.org/r/20220108165230.44610-1-jose.exposito89@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/gpu/drm/imx/parallel-display.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c index aefd04e18f93..e9dff31b377c 100644 --- a/drivers/gpu/drm/imx/parallel-display.c +++ b/drivers/gpu/drm/imx/parallel-display.c @@ -77,8 +77,10 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector) ret = of_get_drm_display_mode(np, &imxpd->mode, &imxpd->bus_flags, OF_USE_NATIVE_MODE); - if (ret) + if (ret) { + drm_mode_destroy(connector->dev, mode); return ret; + } drm_mode_copy(mode, &imxpd->mode); mode->type |= DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
by Yang Yingliang 04 Mar '25

04 Mar '25

From: Wang Hai <wanghai38(a)huawei.com> stable inclusion from stable-v4.19.238 commit dd3a6cc7385b89ec2303f39dfc3bafa4e24cec4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6B9 CVE: CVE-2021-47652 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1791f487f877a9e83d81c8677bd3e7b259e7cb27 ] I got a null-ptr-deref report: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:fb_destroy_modelist+0x38/0x100 ... Call Trace: ufx_usb_probe.cold+0x2b5/0xac1 [smscufx] usb_probe_interface+0x1aa/0x3c0 [usbcore] really_probe+0x167/0x460 ... ret_from_fork+0x1f/0x30 If fb_alloc_cmap() fails in ufx_usb_probe(), fb_destroy_modelist() will be called to destroy modelist in the error handling path. But modelist has not been initialized yet, so it will result in null-ptr-deref. Initialize modelist before calling fb_alloc_cmap() to fix this bug. Fixes: 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display adapters") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Acked-by: Thomas Zimmermann <tzimmermann(a)suse.de> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/video/fbdev/smscufx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c index 2256e5816090..8d31b0806cb7 100644 --- a/drivers/video/fbdev/smscufx.c +++ b/drivers/video/fbdev/smscufx.c @@ -1670,6 +1670,7 @@ static int ufx_usb_probe(struct usb_interface *interface, info->par = dev; info->pseudo_palette = dev->pseudo_palette; info->fbops = &ufx_ops; + INIT_LIST_HEAD(&info->modelist); retval = fb_alloc_cmap(&info->cmap, 256, 0); if (retval < 0) { @@ -1680,8 +1681,6 @@ static int ufx_usb_probe(struct usb_interface *interface, INIT_DELAYED_WORK(&dev->free_framebuffer_work, ufx_free_framebuffer_work); - INIT_LIST_HEAD(&info->modelist); - retval = ufx_reg_read(dev, 0x3000, &id_rev); check_warn_goto_error(retval, "error %d reading 0x3000 register from device", retval); dev_dbg(dev->gdev, "ID_REV register value 0x%08x", id_rev); -- 2.25.1

2 1

[openeuler:OLK-6.6] BUILD SUCCESS 9d22d5b77cca4df43e85e93e7748def7e4d35cae
by kernel test robot 04 Mar '25

04 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 9d22d5b77cca4df43e85e93e7748def7e4d35cae !15278 tracing/osnoise: Fix resetting of tracepoints Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-051-20250304 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-052-20250304 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-053-20250304 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-055-20250304 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- loongarch-allmodconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-002-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250304 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-defconfig |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 720m configs tested: 19 configs skipped: 104 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250304 clang-21 arm64 randconfig-002-20250304 gcc-14.2.0 arm64 randconfig-003-20250304 gcc-14.2.0 arm64 randconfig-004-20250304 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250304 gcc-14.2.0 loongarch randconfig-002-20250304 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250304 clang-19 x86_64 buildonly-randconfig-002-20250304 gcc-12 x86_64 buildonly-randconfig-003-20250304 gcc-12 x86_64 buildonly-randconfig-004-20250304 gcc-12 x86_64 buildonly-randconfig-005-20250304 gcc-12 x86_64 buildonly-randconfig-006-20250304 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] md/raid1: fix bitmap update when all write requests fail
by Zheng Qixing 04 Mar '25

04 Mar '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBKHTZ CVE: NA ------------------------ When writing to a RAID1 array where all member disks have bad sectors at the target location, the bitmap update is skipped because all bios[] are NULL, leading to bitmap counter inconsistency. This can cause subsequent I/O operations to hang while waiting for bitmap counter to reach the expected value. Fix this by updating the bitmap when all member disks have bad sectors. Fixes: 1f68f0c4b677 ("md/raid1: avoid writing to known-bad blocks on known-bad drives.") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index ee3826db193d..62e73ac32a3b 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1551,6 +1551,13 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, } } + /* + * Corresponding to md_bitmap_endwrite() from close_write(), in the case + * io range from all member disks are badblocks. + */ + if (first_clone) + md_bitmap_startwrite(bitmap, r1_bio->sector, r1_bio->sectors, 0); + r1_bio_write_done(r1_bio); /* In case raid1d snuck in to freeze_array */ -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
by Xiangwei Li 04 Mar '25

04 Mar '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.247 commit 86c3c5f8e4bd1325e24f6fba9017cade29933377 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3U4 CVE: CVE-2022-49367 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 02ded5a173619b11728b8bf75a3fd995a2c1ff28 ] of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. mv88e6xxx_mdio_register() pass the device node to of_mdiobus_register(). We don't need the device node after it. Add missing of_node_put() to avoid refcount leak. Fixes: a3c53be55c95 ("net: dsa: mv88e6xxx: Support multiple MDIO busses") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Reviewed-by: Marek Behún <kabel(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- drivers/net/dsa/mv88e6xxx/chip.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c index 93c893731acb..db02240af1dd 100644 --- a/drivers/net/dsa/mv88e6xxx/chip.c +++ b/drivers/net/dsa/mv88e6xxx/chip.c @@ -2778,6 +2778,7 @@ static int mv88e6xxx_mdios_register(struct mv88e6xxx_chip *chip, */ child = of_get_child_by_name(np, "mdio"); err = mv88e6xxx_mdio_register(chip, child, false); + of_node_put(child); if (err) return err; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] drm/imx: Fix memory leak in imx_pd_connector_get_modes
by Yang Yingliang 04 Mar '25

04 Mar '25

From: José Expósito <jose.exposito89(a)gmail.com> stable inclusion from stable-v4.19.238 commit 515d077ee3085ae343b6bea7fd031f9906645f38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1KE CVE: CVE-2022-49091 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bce81feb03a20fca7bbdd1c4af16b4e9d5c0e1d3 ] Avoid leaking the display mode variable if of_get_drm_display_mode fails. Fixes: 76ecd9c9fb24 ("drm/imx: parallel-display: check return code from of_get_drm_display_mode()") Addresses-Coverity-ID: 1443943 ("Resource leak") Signed-off-by: José Expósito <jose.exposito89(a)gmail.com> Signed-off-by: Philipp Zabel <p.zabel(a)pengutronix.de> Link: https://lore.kernel.org/r/20220108165230.44610-1-jose.exposito89@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/gpu/drm/imx/parallel-display.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c index aefd04e18f93..e9dff31b377c 100644 --- a/drivers/gpu/drm/imx/parallel-display.c +++ b/drivers/gpu/drm/imx/parallel-display.c @@ -77,8 +77,10 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector) ret = of_get_drm_display_mode(np, &imxpd->mode, &imxpd->bus_flags, OF_USE_NATIVE_MODE); - if (ret) + if (ret) { + drm_mode_destroy(connector->dev, mode); return ret; + } drm_mode_copy(mode, &imxpd->mode); mode->type |= DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED, -- 2.25.1

2 1

[PATCH OLK-6.6] usb: xhci: Fix NULL pointer dereference on certain command aborts
by Li Lingfeng 04 Mar '25

04 Mar '25

From: Michal Pecio <michal.pecio(a)gmail.com> stable inclusion from stable-v6.6.76 commit b649f0d5bc256f691c7d234c3986685d54053de1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBJC CVE: CVE-2024-57981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e0a19912adb68a4b2b74fd77001c96cd83eb073 upstream. If a command is queued to the final usable TRB of a ring segment, the enqueue pointer is advanced to the subsequent link TRB and no further. If the command is later aborted, when the abort completion is handled the dequeue pointer is advanced to the first TRB of the next segment. If no further commands are queued, xhci_handle_stopped_cmd_ring() sees the ring pointers unequal and assumes that there is a pending command, so it calls xhci_mod_cmd_timer() which crashes if cur_cmd was NULL. Don't attempt timer setup if cur_cmd is NULL. The subsequent doorbell ring likely is unnecessary too, but it's harmless. Leave it alone. This is probably Bug 219532, but no confirmation has been received. The issue has been independently reproduced and confirmed fixed using a USB MCU programmed to NAK the Status stage of SET_ADDRESS forever. Everything continued working normally after several prevented crashes. Link: https://bugzilla.kernel.org/show_bug.cgi?id=219532 Fixes: c311e391a7ef ("xhci: rework command timeout and cancellation,") CC: stable(a)vger.kernel.org Signed-off-by: Michal Pecio <michal.pecio(a)gmail.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://lore.kernel.org/r/20241227120142.1035206-4-mathias.nyman@linux.inte… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/usb/host/xhci-ring.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index b0641f51fcb8..73cd26d349f0 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -419,7 +419,8 @@ static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci, if ((xhci->cmd_ring->dequeue != xhci->cmd_ring->enqueue) && !(xhci->xhc_state & XHCI_STATE_DYING)) { xhci->current_cmd = cur_cmd; - xhci_mod_cmd_timer(xhci); + if (cur_cmd) + xhci_mod_cmd_timer(xhci); xhci_ring_cmd_db(xhci); } } -- 2.31.1

2 1

[PATCH OLK-6.6 0/3] CVE-2025-21732
by Ye Bin 04 Mar '25

04 Mar '25

From: Ye Bin <yebin(a)huaweicloud.com> Jason Gunthorpe (1): RDMA/mlx5: Ensure created mkeys always have a populated rb_key Or Har-Toov (1): RDMA/mlx5: Change check for cacheable mkeys Yishai Hadas (1): RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 + drivers/infiniband/hw/mlx5/mr.c | 46 ++++++++++++++++++++++------ drivers/infiniband/hw/mlx5/odp.c | 2 ++ 3 files changed, 39 insertions(+), 10 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] net: sfc: add missing xdp queue reinitialization
by Yang Yingliang 04 Mar '25

04 Mar '25

From: Taehee Yoo <ap420073(a)gmail.com> mainline inclusion from mainline-v5.18-rc2 commit 059a47f1da93811d37533556d67e72f2261b1127 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP5MU CVE: CVE-2022-49096 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- After rx/tx ring buffer size is changed, kernel panic occurs when it acts XDP_TX or XDP_REDIRECT. When tx/rx ring buffer size is changed(ethtool -G), sfc driver reallocates and reinitializes rx and tx queues and their buffer (tx_queue->buffer). But it misses reinitializing xdp queues(efx->xdp_tx_queues). So, while it is acting XDP_TX or XDP_REDIRECT, it uses the uninitialized tx_queue->buffer. A new function efx_set_xdp_channels() is separated from efx_set_channels() to handle only xdp queues. Splat looks like: BUG: kernel NULL pointer dereference, address: 000000000000002a #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#4] PREEMPT SMP NOPTI RIP: 0010:efx_tx_map_chunk+0x54/0x90 [sfc] CPU: 2 PID: 0 Comm: swapper/2 Tainted: G D 5.17.0+ #55 e8beeee8289528f11357029357cf Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 RSP: 0018:ffff92f121e45c60 EFLAGS: 00010297 RIP: 0010:efx_tx_map_chunk+0x54/0x90 [sfc] RAX: 0000000000000040 RBX: ffff92ea506895c0 RCX: ffffffffc0330870 RDX: 0000000000000001 RSI: 00000001139b10ce RDI: ffff92ea506895c0 RBP: ffffffffc0358a80 R08: 00000001139b110d R09: 0000000000000000 R10: 0000000000000001 R11: ffff92ea414c0088 R12: 0000000000000040 R13: 0000000000000018 R14: 00000001139b10ce R15: ffff92ea506895c0 FS: 0000000000000000(0000) GS:ffff92f121ec0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 CR2: 000000000000002a CR3: 00000003e6810004 CR4: 00000000007706e0 RSP: 0018:ffff92f121e85c60 EFLAGS: 00010297 PKRU: 55555554 RAX: 0000000000000040 RBX: ffff92ea50689700 RCX: ffffffffc0330870 RDX: 0000000000000001 RSI: 00000001145a90ce RDI: ffff92ea50689700 RBP: ffffffffc0358a80 R08: 00000001145a910d R09: 0000000000000000 R10: 0000000000000001 R11: ffff92ea414c0088 R12: 0000000000000040 R13: 0000000000000018 R14: 00000001145a90ce R15: ffff92ea50689700 FS: 0000000000000000(0000) GS:ffff92f121e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000002a CR3: 00000003e6810005 CR4: 00000000007706e0 PKRU: 55555554 Call Trace: <IRQ> efx_xdp_tx_buffers+0x12b/0x3d0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] __efx_rx_packet+0x5c3/0x930 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] efx_rx_packet+0x28c/0x2e0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] efx_ef10_ev_process+0x5f8/0xf40 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] ? enqueue_task_fair+0x95/0x550 efx_poll+0xc4/0x360 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] Fixes: 3990a8fffbda ("sfc: allocate channels for XDP tx queues") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: drivers/net/ethernet/sfc/efx_channels.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/ethernet/sfc/efx_channels.c | 85 ++++++++++++++----------- 1 file changed, 47 insertions(+), 38 deletions(-) diff --git a/drivers/net/ethernet/sfc/efx_channels.c b/drivers/net/ethernet/sfc/efx_channels.c index c49168ba7a4d..5beb2eed297c 100644 --- a/drivers/net/ethernet/sfc/efx_channels.c +++ b/drivers/net/ethernet/sfc/efx_channels.c @@ -744,6 +744,51 @@ void efx_remove_channels(struct efx_nic *efx) kfree(efx->xdp_tx_queues); } +static void efx_set_xdp_channels(struct efx_nic *efx) +{ + struct efx_tx_queue *tx_queue; + struct efx_channel *channel; + unsigned int next_queue = 0; + int xdp_queue_number = 0; + + /* We need to mark which channels really have RX and TX + * queues, and adjust the TX queue numbers if we have separate + * RX-only and TX-only channels. + */ + efx_for_each_channel(channel, efx) { + if (channel->channel < efx->tx_channel_offset) + continue; + + if (efx_channel_is_xdp_tx(channel)) { + efx_for_each_channel_tx_queue(tx_queue, channel) { + tx_queue->queue = next_queue++; + + /* We may have a few left-over XDP TX + * queues owing to xdp_tx_queue_count + * not dividing evenly by EFX_MAX_TXQ_PER_CHANNEL. + * We still allocate and probe those + * TXQs, but never use them. + */ + if (xdp_queue_number < efx->xdp_tx_queue_count) { + netif_dbg(efx, drv, efx->net_dev, "Channel %u TXQ %u is XDP %u, HW %u\n", + channel->channel, tx_queue->label, + xdp_queue_number, tx_queue->queue); + efx->xdp_tx_queues[xdp_queue_number] = tx_queue; + xdp_queue_number++; + } + } + } else { + efx_for_each_channel_tx_queue(tx_queue, channel) { + tx_queue->queue = next_queue++; + netif_dbg(efx, drv, efx->net_dev, "Channel %u TXQ %u is HW %u\n", + channel->channel, tx_queue->label, + tx_queue->queue); + } + } + } + WARN_ON(xdp_queue_number != efx->xdp_tx_queue_count); +} + int efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries) { struct efx_channel *other_channel[EFX_MAX_CHANNELS], *channel, @@ -817,6 +862,7 @@ int efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries) efx_init_napi_channel(efx->channel[i]); } + efx_set_xdp_channels(efx); out: efx->ptp_data = NULL; /* Destroy unused channel structures */ @@ -854,10 +900,7 @@ int efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries) int efx_set_channels(struct efx_nic *efx) { - struct efx_tx_queue *tx_queue; struct efx_channel *channel; - unsigned int next_queue = 0; - int xdp_queue_number; int rc; if (efx->xdp_tx_queue_count) { @@ -871,47 +914,13 @@ int efx_set_channels(struct efx_nic *efx) return -ENOMEM; } - /* We need to mark which channels really have RX and TX - * queues, and adjust the TX queue numbers if we have separate - * RX-only and TX-only channels. - */ - xdp_queue_number = 0; efx_for_each_channel(channel, efx) { if (channel->channel < efx->n_rx_channels) channel->rx_queue.core_index = channel->channel; else channel->rx_queue.core_index = -1; - - if (channel->channel >= efx->tx_channel_offset) { - if (efx_channel_is_xdp_tx(channel)) { - efx_for_each_channel_tx_queue(tx_queue, channel) { - tx_queue->queue = next_queue++; - - /* We may have a few left-over XDP TX - * queues owing to xdp_tx_queue_count - * not dividing evenly by EFX_MAX_TXQ_PER_CHANNEL. - * We still allocate and probe those - * TXQs, but never use them. - */ - if (xdp_queue_number < efx->xdp_tx_queue_count) { - netif_dbg(efx, drv, efx->net_dev, "Channel %u TXQ %u is XDP %u, HW %u\n", - channel->channel, tx_queue->label, - xdp_queue_number, tx_queue->queue); - efx->xdp_tx_queues[xdp_queue_number] = tx_queue; - xdp_queue_number++; - } - } - } else { - efx_for_each_channel_tx_queue(tx_queue, channel) { - tx_queue->queue = next_queue++; - netif_dbg(efx, drv, efx->net_dev, "Channel %u TXQ %u is HW %u\n", - channel->channel, tx_queue->label, - tx_queue->queue); - } - } - } } - WARN_ON(xdp_queue_number != efx->xdp_tx_queue_count); + efx_set_xdp_channels(efx); rc = netif_set_real_num_tx_queues(efx->net_dev, efx->n_tx_channels); if (rc) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] um: Fix out-of-bounds read in LDT setup
by Xiangwei Li 04 Mar '25

04 Mar '25

From: Vincent Whitchurch <vincent.whitchurch(a)axis.com> mainline inclusion from mainline-v5.19-rc1 commit 2a4a62a14be1947fa945c5c11ebf67326381a568 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP73Y CVE: CVE-2022-49395 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… syscall_stub_data() expects the data_count parameter to be the number of longs, not bytes. ================================================================== BUG: KASAN: stack-out-of-bounds in syscall_stub_data+0x70/0xe0 Read of size 128 at addr 000000006411f6f0 by task swapper/1 CPU: 0 PID: 1 Comm: swapper Not tainted 5.18.0+ #18 Call Trace: show_stack.cold+0x166/0x2a7 __dump_stack+0x3a/0x43 dump_stack_lvl+0x1f/0x27 print_report.cold+0xdb/0xf81 kasan_report+0x119/0x1f0 kasan_check_range+0x3a3/0x440 memcpy+0x52/0x140 syscall_stub_data+0x70/0xe0 write_ldt_entry+0xac/0x190 init_new_ldt+0x515/0x960 init_new_context+0x2c4/0x4d0 mm_init.constprop.0+0x5ed/0x760 mm_alloc+0x118/0x170 0x60033f48 do_one_initcall+0x1d7/0x860 0x60003e7b kernel_init+0x6e/0x3d4 new_thread_handler+0x1e7/0x2c0 The buggy address belongs to stack of task swapper/1 and is located at offset 64 in frame: init_new_ldt+0x0/0x960 This frame has 2 objects: [32, 40) 'addr' [64, 80) 'desc' ================================================================== Fixes: 858259cf7d1c443c83 ("uml: maintain own LDT entries") Signed-off-by: Vincent Whitchurch <vincent.whitchurch(a)axis.com> Cc: stable(a)vger.kernel.org Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- arch/x86/um/ldt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/x86/um/ldt.c b/arch/x86/um/ldt.c index 3ee234b6234d..255a44dd415a 100644 --- a/arch/x86/um/ldt.c +++ b/arch/x86/um/ldt.c @@ -23,9 +23,11 @@ static long write_ldt_entry(struct mm_id *mm_idp, int func, { long res; void *stub_addr; + + BUILD_BUG_ON(sizeof(*desc) % sizeof(long)); + res = syscall_stub_data(mm_idp, (unsigned long *)desc, - (sizeof(*desc) + sizeof(long) - 1) & - ~(sizeof(long) - 1), + sizeof(*desc) / sizeof(long), addr, &stub_addr); if (!res) { unsigned long args[] = { func, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] md/raid1: fix bitmap update when all write requests fail
by Zheng Qixing 04 Mar '25

04 Mar '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBKHTZ ------------------------ When writing to a RAID1 array where all member disks have bad sectors at the target location, the bitmap update is skipped because all bios[] are NULL, leading to bitmap counter inconsistency. This can cause subsequent I/O operations to hang while waiting for bitmap counter to reach the expected value. Fix this by updating the bitmap when all member disks have bad sectors. Fixes: 1f68f0c4b677 ("md/raid1: avoid writing to known-bad blocks on known-bad drives.") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index ee3826db193d..62e73ac32a3b 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1551,6 +1551,13 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, } } + /* + * Corresponding to md_bitmap_endwrite() from close_write(), in the case + * io range from all member disks are badblocks. + */ + if (first_clone) + md_bitmap_startwrite(bitmap, r1_bio->sector, r1_bio->sectors, 0); + r1_bio_write_done(r1_bio); /* In case raid1d snuck in to freeze_array */ -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] md: bypass block throttle for superblock update
by Zheng Qixing 04 Mar '25

04 Mar '25

From: Junxiao Bi <junxiao.bi(a)oracle.com> mainline inclusion from mainline-v6.8-rc1 commit d6e035aad6c09991da1c667fb83419329a3baed8 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBLD3D Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ commit 5e2cf333b7bd ("md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d") introduced a hung bug and will be reverted in next patch, since the issue that commit is fixing is due to md superblock write is throttled by wbt, to fix it, we can have superblock write bypass block layer throttle. Fixes: 5e2cf333b7bd ("md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d") Cc: stable(a)vger.kernel.org # v5.19+ Suggested-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Junxiao Bi <junxiao.bi(a)oracle.com> Reviewed-by: Logan Gunthorpe <logang(a)deltatee.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Song Liu <song(a)kernel.org> Link: https://lore.kernel.org/r/20231108182216.73611-1-junxiao.bi@oracle.com Conflicts: drivers/md/md.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/md.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 80f7b58c202e..b9748a0a0e30 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -871,7 +871,8 @@ void md_super_write(struct mddev *mddev, struct md_rdev *rdev, test_bit(FailFast, &rdev->flags) && !test_bit(LastDev, &rdev->flags)) ff = MD_FAILFAST; - bio->bi_opf = REQ_OP_WRITE | REQ_SYNC | REQ_PREFLUSH | REQ_FUA | ff; + bio->bi_opf = REQ_OP_WRITE | REQ_SYNC | REQ_IDLE | REQ_META + | REQ_PREFLUSH | REQ_FUA | ff; atomic_inc(&mddev->pending_writes); submit_bio(bio); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] md/raid1: fix memory leak in raid1_run() if no active rdev
by Zheng Qixing 04 Mar '25

04 Mar '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBKXOB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux.git/commit/?h=… ---------------------- When `raid1_set_limits()` fails or when the array has no active `rdev`, the allocated memory for `conf` is not properly freed. Add raid1_free() call to properly free the conf in error path. Fixes: 799af947ed13 ("md/raid1: don't free conf on raid0_run failure") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> Conflicts: drivers/md/raid1.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index ee3826db193d..3113184f4d99 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -77,6 +77,7 @@ static int max_queued_requests = 1024; static void allow_barrier(struct r1conf *conf, sector_t sector_nr); static void lower_barrier(struct r1conf *conf, sector_t sector_nr); +static void raid1_free(struct mddev *mddev, void *priv); #define raid1_log(md, fmt, args...) \ do { if ((md)->queue) blk_add_trace_msg((md)->queue, "raid1 " fmt, ##args); } while (0) @@ -3148,6 +3149,8 @@ static int raid1_run(struct mddev *mddev) */ if (conf->raid_disks - mddev->degraded < 1) { md_unregister_thread(&conf->thread); + if (!mddev->private) + raid1_free(mddev, conf); return -EINVAL; } -- 2.39.2

2 1

[PATCH OLK-6.6] USB: hub: Ignore non-compliant devices with too many configs or interfaces
by Bowen You 04 Mar '25

04 Mar '25

From: Alan Stern <stern(a)rowland.harvard.edu> Robert Morris created a test program which can cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate pointer: Oops: general protection fault, probably for non-canonical address 0xcccccccccccccccc: 0000 [#1] SMP DEBUG_PAGEALLOC PTI CPU: 7 UID: 0 PID: 117 Comm: kworker/7:1 Not tainted 6.13.0-rc3-00017-gf44d154d6e3d #14 Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_hub_adjust_deviceremovable+0x78/0x110 ... Call Trace: <TASK> ? die_addr+0x31/0x80 ? exc_general_protection+0x1b4/0x3c0 ? asm_exc_general_protection+0x26/0x30 ? usb_hub_adjust_deviceremovable+0x78/0x110 hub_probe+0x7c7/0xab0 usb_probe_interface+0x14b/0x350 really_probe+0xd0/0x2d0 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x6e/0x110 driver_probe_device+0x1a/0x90 __device_attach_driver+0x7e/0xc0 bus_for_each_drv+0x7f/0xd0 __device_attach+0xaa/0x1a0 bus_probe_device+0x8b/0xa0 device_add+0x62e/0x810 usb_set_configuration+0x65d/0x990 usb_generic_driver_probe+0x4b/0x70 usb_probe_device+0x36/0xd0 The cause of this error is that the device has two interfaces, and the hub driver binds to interface 1 instead of interface 0, which is where usb_hub_to_struct_hub() looks. We can prevent the problem from occurring by refusing to accept hub devices that violate the USB spec by having more than one configuration or interface. Reported-and-tested-by: Robert Morris <rtm(a)csail.mit.edu> Cc: stable <stable(a)kernel.org> Closes: https://lore.kernel.org/linux-usb/95564.1737394039@localhost/ Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/r/c27f3bf4-63d8-4fb5-ac82-09e3cd19f61c@rowland.harv… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/usb/core/hub.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index 1ba3feb5e190..f295609649b1 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1818,6 +1818,17 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id) desc = intf->cur_altsetting; hdev = interface_to_usbdev(intf); + /* + * The USB 2.0 spec prohibits hubs from having more than one + * configuration or interface, and we rely on this prohibition. + * Refuse to accept a device that violates it. + */ + if (hdev->descriptor.bNumConfigurations > 1 || + hdev->actconfig->desc.bNumInterfaces > 1) { + dev_err(&intf->dev, "Invalid hub with more than one config or interface\n"); + return -EINVAL; + } + /* * Set default autosuspend delay as 0 to speedup bus suspend, * based on the below considerations: -- 2.34.1

2 1

[PATCH OLK-6.6] ptp: Ensure info->enable callback is always set
by Pu Lehui 04 Mar '25

04 Mar '25

From: Thomas Weißschuh <linux(a)weissschuh.net> stable inclusion from stable-v6.6.78 commit 81846070cba17125a866e8023c01d3465b153339 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLLG CVE: CVE-2025-21814 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fd53aa40e65f518453115b6f56183b0c201db26b upstream. The ioctl and sysfs handlers unconditionally call the ->enable callback. Not all drivers implement that callback, leading to NULL dereferences. Example of affected drivers: ptp_s390.c, ptp_vclock.c and ptp_mock.c. Instead use a dummy callback if no better was specified by the driver. Fixes: d94ba80ebbea ("ptp: Added a brand new class driver for ptp clocks.") Cc: stable(a)vger.kernel.org Signed-off-by: Thomas Weißschuh <linux(a)weissschuh.net> Acked-by: Richard Cochran <richardcochran(a)gmail.com> Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Link: https://patch.msgid.link/20250123-ptp-enable-v1-1-b015834d3a47@weissschuh.n… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/ptp/ptp_clock.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c index b586da2e3002..6b7e8b7ebcef 100644 --- a/drivers/ptp/ptp_clock.c +++ b/drivers/ptp/ptp_clock.c @@ -189,6 +189,11 @@ static int ptp_getcycles64(struct ptp_clock_info *info, struct timespec64 *ts) return info->gettime64(info, ts); } +static int ptp_enable(struct ptp_clock_info *ptp, struct ptp_clock_request *request, int on) +{ + return -EOPNOTSUPP; +} + static void ptp_aux_kworker(struct kthread_work *work) { struct ptp_clock *ptp = container_of(work, struct ptp_clock, @@ -251,6 +256,9 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, ptp->info->getcrosscycles = ptp->info->getcrosststamp; } + if (!ptp->info->enable) + ptp->info->enable = ptp_enable; + if (ptp->info->do_aux_work) { kthread_init_delayed_work(&ptp->aux_work, ptp_aux_kworker); ptp->kworker = kthread_create_worker(0, "ptp%d", ptp->index); -- 2.34.1

2 1

[PATCH OLK-6.6] usbnet: ipheth: fix possible overflow in DPE length check
by Pu Lehui 04 Mar '25

04 Mar '25

From: Foster Snowhill <forst(a)pen.gy> stable inclusion from stable-v6.6.78 commit 18bf6f5cce3172cb303c3f0551aa9443d5ed74f8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC69 CVE: CVE-2025-21743 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c219427ed296f94bb4b91d08626776dc7719ee27 upstream. Originally, it was possible for the DPE length check to overflow if wDatagramIndex + wDatagramLength > U16_MAX. This could lead to an OoB read. Move the wDatagramIndex term to the other side of the inequality. An existing condition ensures that wDatagramIndex < urb->actual_length. Fixes: a2d274c62e44 ("usbnet: ipheth: add CDC NCM support") Cc: stable(a)vger.kernel.org Signed-off-by: Foster Snowhill <forst(a)pen.gy> Reviewed-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/net/usb/ipheth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c index 46afb95ffabe..45daae234cb8 100644 --- a/drivers/net/usb/ipheth.c +++ b/drivers/net/usb/ipheth.c @@ -243,8 +243,8 @@ static int ipheth_rcvbulk_callback_ncm(struct urb *urb) while (le16_to_cpu(dpe->wDatagramIndex) != 0 && le16_to_cpu(dpe->wDatagramLength) != 0) { if (le16_to_cpu(dpe->wDatagramIndex) >= urb->actual_length || - le16_to_cpu(dpe->wDatagramIndex) + - le16_to_cpu(dpe->wDatagramLength) > urb->actual_length) { + le16_to_cpu(dpe->wDatagramLength) > urb->actual_length - + le16_to_cpu(dpe->wDatagramIndex)) { dev->net->stats.rx_length_errors++; return retval; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] af_packet: avoid erroring out after sock_init_data() in packet_create()
by Zhang Changzhong 04 Mar '25

04 Mar '25

From: Ignat Korchagin <ignat(a)cloudflare.com> mainline inclusion from mainline-v6.13-rc1 commit 46f2a11cb82b657fd15bab1c47821b635e03838b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJZ2Y CVE: CVE-2024-56606 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- After sock_init_data() the allocated sk object is attached to the provided sock object. On error, packet_create() frees the sk object leaving the dangling pointer in the sock object on return. Some other code may try to use this pointer and cause use-after-free. Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241014153808.51894-2-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/packet/af_packet.c [commit 89ed5b519004 ("af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/packet/af_packet.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index e26ee04..98b9e4f 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -3276,18 +3276,18 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, if (sock->type == SOCK_PACKET) sock->ops = &packet_ops_spkt; + po = pkt_sk(sk); + err = packet_alloc_pending(po); + if (err) + goto out_sk_free; + sock_init_data(sock, sk); - po = pkt_sk(sk); init_completion(&po->skb_completion); sk->sk_family = PF_PACKET; po->num = proto; po->xmit = dev_queue_xmit; - err = packet_alloc_pending(po); - if (err) - goto out2; - packet_cached_dev_reset(po); sk->sk_destruct = packet_sock_destruct; @@ -3322,7 +3322,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, preempt_enable(); return 0; -out2: +out_sk_free: sk_free(sk); out: return err; -- 2.9.5

2 1

[PATCH OLK-5.10] netfilter: nf_set_pipapo: fix initial map fill
by Zhang Changzhong 04 Mar '25

04 Mar '25

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.11-rc1 commit 791a615b7ad2258c560f91852be54b0480837c93 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJKDJ CVE: CVE-2024-57947 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The initial buffer has to be inited to all-ones, but it must restrict it to the size of the first field, not the total field size. After each round in the map search step, the result and the fill map are swapped, so if we have a set where f->bsize of the first element is smaller than m->bsize_max, those one-bits are leaked into future rounds result map. This makes pipapo find an incorrect matching results for sets where first field size is not the largest. Followup patch adds a test case to nft_concat_range.sh selftest script. Thanks to Stefano Brivio for pointing out that we need to zero out the remainder explicitly, only correcting memset() argument isn't enough. Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Reported-by: Yi Chen <yiche(a)redhat.com> Cc: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Reviewed-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_set_pipapo_avx2.c [commit f04df573faf9 ("netfilter: nft_set_pipapo: constify lookup fn args where possible") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 4 ++-- net/netfilter/nft_set_pipapo.h | 21 +++++++++++++++++++++ net/netfilter/nft_set_pipapo_avx2.c | 10 ++++++---- 3 files changed, 29 insertions(+), 6 deletions(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 65ecf486..1a76c9b 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -432,7 +432,7 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, res_map = scratch->map + (map_index ? m->bsize_max : 0); fill_map = scratch->map + (map_index ? 0 : m->bsize_max); - memset(res_map, 0xff, m->bsize_max * sizeof(*res_map)); + pipapo_resmap_init(m, res_map); nft_pipapo_for_each_field(f, i, m) { bool last = i == m->field_count - 1; @@ -536,7 +536,7 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net, goto out; } - memset(res_map, 0xff, m->bsize_max * sizeof(*res_map)); + pipapo_resmap_init(m, res_map); nft_pipapo_for_each_field(f, i, m) { bool last = i == m->field_count - 1; diff --git a/net/netfilter/nft_set_pipapo.h b/net/netfilter/nft_set_pipapo.h index 2e709ae..8f8f58a 100644 --- a/net/netfilter/nft_set_pipapo.h +++ b/net/netfilter/nft_set_pipapo.h @@ -287,4 +287,25 @@ static u64 pipapo_estimate_size(const struct nft_set_desc *desc) return size; } +/** + * pipapo_resmap_init() - Initialise result map before first use + * @m: Matching data, including mapping table + * @res_map: Result map + * + * Initialize all bits covered by the first field to one, so that after + * the first step, only the matching bits of the first bit group remain. + * + * If other fields have a large bitmap, set remainder of res_map to 0. + */ +static inline void pipapo_resmap_init(const struct nft_pipapo_match *m, unsigned long *res_map) +{ + const struct nft_pipapo_field *f = m->f; + int i; + + for (i = 0; i < f->bsize; i++) + res_map[i] = ULONG_MAX; + + for (i = f->bsize; i < m->bsize_max; i++) + res_map[i] = 0ul; +} #endif /* _NFT_SET_PIPAPO_H */ diff --git a/net/netfilter/nft_set_pipapo_avx2.c b/net/netfilter/nft_set_pipapo_avx2.c index 60fb8bc..fdc6c43 100644 --- a/net/netfilter/nft_set_pipapo_avx2.c +++ b/net/netfilter/nft_set_pipapo_avx2.c @@ -1027,6 +1027,7 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, /** * nft_pipapo_avx2_lookup_slow() - Fallback function for uncommon field sizes + * @mdata: Matching data, including mapping table * @map: Previous match result, used as initial bitmap * @fill: Destination bitmap to be filled with current match result * @f: Field, containing lookup and mapping tables @@ -1042,7 +1043,8 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, * Return: -1 on no match, rule index of match if @last, otherwise first long * word index to be checked next (i.e. first filled word). */ -static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill, +static int nft_pipapo_avx2_lookup_slow(const struct nft_pipapo_match *mdata, + unsigned long *map, unsigned long *fill, struct nft_pipapo_field *f, int offset, const u8 *pkt, bool first, bool last) { @@ -1052,7 +1054,7 @@ static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill, lt += offset * NFT_PIPAPO_LONGS_PER_M256; if (first) - memset(map, 0xff, bsize * sizeof(*map)); + pipapo_resmap_init(mdata, map); for (i = offset; i < bsize; i++) { if (f->bb == 8) @@ -1173,7 +1175,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, } else if (f->groups == 16) { NFT_SET_PIPAPO_AVX2_LOOKUP(8, 16); } else { - ret = nft_pipapo_avx2_lookup_slow(res, fill, f, + ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f, ret, rp, first, last); } @@ -1189,7 +1191,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, } else if (f->groups == 32) { NFT_SET_PIPAPO_AVX2_LOOKUP(4, 32); } else { - ret = nft_pipapo_avx2_lookup_slow(res, fill, f, + ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f, ret, rp, first, last); } -- 2.9.5

2 1

[PATCH OLK-6.6 0/5] CVE-2024-57952
by Yongjian Sun 04 Mar '25

04 Mar '25

*** BLURB HERE *** Chuck Lever (5): [Backport] libfs: Return ENOSPC when the directory offset range is exhausted [Backport] Revert "libfs: Add simple_offset_empty()" [Backport] Revert "libfs: fix infinite directory reads for offset dir" [Backport] libfs: Replace simple_offset end-of-directory detection libfs: Use d_children list to iterate simple_offset directories fs/libfs.c | 164 ++++++++++++++++++++++----------------------- include/linux/fs.h | 1 - mm/shmem.c | 4 +- 3 files changed, 81 insertions(+), 88 deletions(-) -- 2.39.2

2 6

[PATCH openEuler-1.0-LTS] bpf, arm64: Clear prog->jited_len along prog->jited
by Pu Lehui 04 Mar '25

04 Mar '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.247 commit aaf61a312af63e1cfe2264c4c5b8cd4ea3626025 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP65P CVE: CVE-2022-49341 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 10f3b29c65bb2fe0d47c2945cd0b4087be1c5218 ] syzbot reported an illegal copy_to_user() attempt from bpf_prog_get_info_by_fd() [1] There was no repro yet on this bug, but I think that commit 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns") is exposing a prior bug in bpf arm64. bpf_prog_get_info_by_fd() looks at prog->jited_len to determine if the JIT image can be copied out to user space. My theory is that syzbot managed to get a prog where prog->jited_len has been set to 43, while prog->bpf_func has ben cleared. It is not clear why copy_to_user(uinsns, NULL, ulen) is triggering this particular warning. I thought find_vma_area(NULL) would not find a vm_struct. As we do not hold vmap_area_lock spinlock, it might be possible that the found vm_struct was garbage. [1] usercopy: Kernel memory exposure attempt detected from vmalloc (offset 792633534417210172, size 43)! kernel BUG at mm/usercopy.c:101! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 25002 Comm: syz-executor.1 Not tainted 5.18.0-syzkaller-10139-g8291eaafed36 #0 Hardware name: linux,dummy-virt (DT) pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usercopy_abort+0x90/0x94 mm/usercopy.c:101 lr : usercopy_abort+0x90/0x94 mm/usercopy.c:89 sp : ffff80000b773a20 x29: ffff80000b773a30 x28: faff80000b745000 x27: ffff80000b773b48 x26: 0000000000000000 x25: 000000000000002b x24: 0000000000000000 x23: 00000000000000e0 x22: ffff80000b75db67 x21: 0000000000000001 x20: 000000000000002b x19: ffff80000b75db3c x18: 00000000fffffffd x17: 2820636f6c6c616d x16: 76206d6f72662064 x15: 6574636574656420 x14: 74706d6574746120 x13: 2129333420657a69 x12: 73202c3237313031 x11: 3237313434333533 x10: 3336323937207465 x9 : 657275736f707865 x8 : ffff80000a30c550 x7 : ffff80000b773830 x6 : ffff80000b773830 x5 : 0000000000000000 x4 : ffff00007fbbaa10 x3 : 0000000000000000 x2 : 0000000000000000 x1 : f7ff000028fc0000 x0 : 0000000000000064 Call trace: usercopy_abort+0x90/0x94 mm/usercopy.c:89 check_heap_object mm/usercopy.c:186 [inline] __check_object_size mm/usercopy.c:252 [inline] __check_object_size+0x198/0x36c mm/usercopy.c:214 check_object_size include/linux/thread_info.h:199 [inline] check_copy_size include/linux/thread_info.h:235 [inline] copy_to_user include/linux/uaccess.h:159 [inline] bpf_prog_get_info_by_fd.isra.0+0xf14/0xfdc kernel/bpf/syscall.c:3993 bpf_obj_get_info_by_fd+0x12c/0x510 kernel/bpf/syscall.c:4253 __sys_bpf+0x900/0x2150 kernel/bpf/syscall.c:4956 __do_sys_bpf kernel/bpf/syscall.c:5021 [inline] __se_sys_bpf kernel/bpf/syscall.c:5019 [inline] __arm64_sys_bpf+0x28/0x40 kernel/bpf/syscall.c:5019 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:52 el0_svc_common.constprop.0+0x44/0xec arch/arm64/kernel/syscall.c:142 do_el0_svc+0xa0/0xc0 arch/arm64/kernel/syscall.c:206 el0_svc+0x44/0xb0 arch/arm64/kernel/entry-common.c:624 el0t_64_sync_handler+0x1ac/0x1b0 arch/arm64/kernel/entry-common.c:642 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:581 Code: aa0003e3 d00038c0 91248000 97fff65f (d4210000) Fixes: db496944fdaa ("bpf: arm64: add JIT support for multi-function programs") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Song Liu <songliubraving(a)fb.com> Link: https://lore.kernel.org/bpf/20220531215113.1100754-1-eric.dumazet@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/arm64/net/bpf_jit_comp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 04d82cf2d461..49ec5ce974f3 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -946,6 +946,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) bpf_jit_binary_free(header); prog->bpf_func = NULL; prog->jited = 0; + prog->jited_len = 0; goto out_off; } bpf_jit_binary_lock_ro(header); -- 2.34.1

2 1

[openeuler:OLK-6.6] BUILD SUCCESS 252f84b8f8205e5b1f29719d9139ed187c2873f4
by kernel test robot 04 Mar '25

04 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 252f84b8f8205e5b1f29719d9139ed187c2873f4 !15227 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.54-6.6.55 LTS Conflicts Patches Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-defconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250303 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250303 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250303 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250303 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-051-20250303 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-052-20250303 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-053-20250303 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-054-20250303 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-055-20250303 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- loongarch-allmodconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allyesconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-defconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250303 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-002-20250303 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-r123-20250304 | |-- drivers-scsi-leapioraid-leapioraid_func.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-usertype-value-got-restricted-__le32-usertype | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250303 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250303 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250303 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250303 | |-- drivers-cpufreq-acpi-cpufreq.c:warning:sched_set_itmt-defined-but-not-used | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250303 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250303 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-defconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-randconfig-161-20250303 |-- mm-compaction.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:vm_compaction-proc_handler |-- mm-compaction.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:vm_compaction-procname |-- mm-kasan-kasan_test.c-rcu_uaf_reclaim()-warn:statement-has-no-effect |-- mm-kasan-kasan_test.c-workqueue_uaf()-warn:statement-has-no-effect |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 725m configs tested: 21 configs skipped: 124 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250303 clang-21 arm64 randconfig-002-20250303 clang-19 arm64 randconfig-003-20250303 gcc-14.2.0 arm64 randconfig-004-20250303 clang-19 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250303 gcc-14.2.0 loongarch randconfig-002-20250303 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250303 clang-19 x86_64 buildonly-randconfig-002-20250303 gcc-12 x86_64 buildonly-randconfig-003-20250303 clang-19 x86_64 buildonly-randconfig-004-20250303 gcc-12 x86_64 buildonly-randconfig-005-20250303 gcc-12 x86_64 buildonly-randconfig-006-20250303 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1980/1980] drivers/scsi/leapioraid/leapioraid_func.c:3291:16: sparse: sparse: incorrect type in argument 1 (different base types)
by kernel test robot 04 Mar '25

04 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 252f84b8f8205e5b1f29719d9139ed187c2873f4 commit: 7fea595ef48e9ab13bd31df067b19152153e1925 [1980/1980] SCSI: LEAPIORAID: Supports LEAPIO RAID controller config: loongarch-randconfig-r123-20250304 (https://download.01.org/0day-ci/archive/20250304/202503040511.Dk9g0ZiZ-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250304/202503040511.Dk9g0ZiZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503040511.Dk9g0ZiZ-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/scsi/leapioraid/leapioraid_func.c:304:35: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 static [addressable] [assigned] [toplevel] [usertype] s_addr @@ got unsigned int [addressable] [usertype] ip @@ drivers/scsi/leapioraid/leapioraid_func.c:304:35: sparse: expected restricted __be32 static [addressable] [assigned] [toplevel] [usertype] s_addr drivers/scsi/leapioraid/leapioraid_func.c:304:35: sparse: got unsigned int [addressable] [usertype] ip drivers/scsi/leapioraid/leapioraid_func.c:325:21: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long [usertype] iov_len @@ got restricted __le32 [usertype] datasize @@ drivers/scsi/leapioraid/leapioraid_func.c:325:21: sparse: expected unsigned long [usertype] iov_len drivers/scsi/leapioraid/leapioraid_func.c:325:21: sparse: got restricted __le32 [usertype] datasize drivers/scsi/leapioraid/leapioraid_func.c:369:71: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __le32 [usertype] datasize @@ got unsigned int [assigned] [usertype] send_sz @@ drivers/scsi/leapioraid/leapioraid_func.c:369:71: sparse: expected restricted __le32 [usertype] datasize drivers/scsi/leapioraid/leapioraid_func.c:369:71: sparse: got unsigned int [assigned] [usertype] send_sz drivers/scsi/leapioraid/leapioraid_func.c:671:1: sparse: sparse: symbol 'leapioraid_base_stop_smart_polling' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_func.c:1395:67: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/scsi/leapioraid/leapioraid_func.c:1395:67: sparse: expected void volatile [noderef] __iomem *addr drivers/scsi/leapioraid/leapioraid_func.c:1395:67: sparse: got unsigned long long [usertype] * drivers/scsi/leapioraid/leapioraid_func.c:1427:51: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/scsi/leapioraid/leapioraid_func.c:1427:51: sparse: expected void volatile [noderef] __iomem *addr drivers/scsi/leapioraid/leapioraid_func.c:1427:51: sparse: got unsigned long long [usertype] * drivers/scsi/leapioraid/leapioraid_func.c:1300:1: sparse: sparse: symbol 'leapioraid_base_process_reply_queue' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_func.c:1468:5: sparse: sparse: symbol 'leapioraid_base_irqpoll' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_func.c:1490:1: sparse: sparse: symbol 'leapioraid_base_init_irqpolls' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_func.c:1924:21: sparse: sparse: symbol 'leapioraid_pcie_link_speed' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_func.c:2946:31: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/scsi/leapioraid/leapioraid_func.c:3291:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] value @@ got restricted __le32 [usertype] @@ drivers/scsi/leapioraid/leapioraid_func.c:3291:16: sparse: expected unsigned int [usertype] value drivers/scsi/leapioraid/leapioraid_func.c:3291:16: sparse: got restricted __le32 [usertype] drivers/scsi/leapioraid/leapioraid_func.c:3304:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] value @@ got restricted __le32 [usertype] @@ drivers/scsi/leapioraid/leapioraid_func.c:3304:16: sparse: expected unsigned int [usertype] value drivers/scsi/leapioraid/leapioraid_func.c:3304:16: sparse: got restricted __le32 [usertype] drivers/scsi/leapioraid/leapioraid_func.c:3317:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] value @@ got restricted __le32 [usertype] @@ drivers/scsi/leapioraid/leapioraid_func.c:3317:16: sparse: expected unsigned int [usertype] value drivers/scsi/leapioraid/leapioraid_func.c:3317:16: sparse: got restricted __le32 [usertype] drivers/scsi/leapioraid/leapioraid_func.c:3330:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] value @@ got restricted __le32 [usertype] @@ drivers/scsi/leapioraid/leapioraid_func.c:3330:16: sparse: expected unsigned int [usertype] value drivers/scsi/leapioraid/leapioraid_func.c:3330:16: sparse: got restricted __le32 [usertype] drivers/scsi/leapioraid/leapioraid_func.c:3373:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] ImageSize @@ got unsigned long [assigned] [usertype] data_length @@ drivers/scsi/leapioraid/leapioraid_func.c:3373:32: sparse: expected restricted __le32 [usertype] ImageSize drivers/scsi/leapioraid/leapioraid_func.c:3373:32: sparse: got unsigned long [assigned] [usertype] data_length drivers/scsi/leapioraid/leapioraid_func.c:4414:1: sparse: sparse: symbol 'leapioraid_base_flush_ios_and_panic' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_func.c:4747:40: sparse: sparse: invalid assignment: |= drivers/scsi/leapioraid/leapioraid_func.c:4747:40: sparse: left side has type restricted __le16 drivers/scsi/leapioraid/leapioraid_func.c:4747:40: sparse: right side has type int drivers/scsi/leapioraid/leapioraid_func.c:4799:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le64 [addressable] [assigned] [usertype] BufAddr @@ got unsigned long long [usertype] log_buffer_dma @@ drivers/scsi/leapioraid/leapioraid_func.c:4799:29: sparse: expected restricted __le64 [addressable] [assigned] [usertype] BufAddr drivers/scsi/leapioraid/leapioraid_func.c:4799:29: sparse: got unsigned long long [usertype] log_buffer_dma drivers/scsi/leapioraid/leapioraid_func.c:4800:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [addressable] [assigned] [usertype] BufSize @@ got int @@ drivers/scsi/leapioraid/leapioraid_func.c:4800:29: sparse: expected restricted __le32 [addressable] [assigned] [usertype] BufSize drivers/scsi/leapioraid/leapioraid_func.c:4800:29: sparse: got int drivers/scsi/leapioraid/leapioraid_func.c:5242:67: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/scsi/leapioraid/leapioraid_func.c:5242:67: sparse: expected void volatile [noderef] __iomem *addr drivers/scsi/leapioraid/leapioraid_func.c:5242:67: sparse: got unsigned long long [usertype] * drivers/scsi/leapioraid/leapioraid_func.c: note: in included file (through include/linux/module.h): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true vim +3291 drivers/scsi/leapioraid/leapioraid_func.c 3280 3281 static void 3282 leapioraid_base_put_smid_scsi_io_atomic(struct LEAPIORAID_ADAPTER *ioc, 3283 u16 smid, u16 handle) 3284 { 3285 struct LeapioraidAtomicReqDesc_t descriptor; 3286 u32 *request = (u32 *) &descriptor; 3287 3288 descriptor.RequestFlags = LEAPIORAID_REQ_DESCRIPT_FLAGS_SCSI_IO; 3289 descriptor.MSIxIndex = leapioraid_base_set_and_get_msix_index(ioc, smid); 3290 descriptor.SMID = cpu_to_le16(smid); > 3291 writel(cpu_to_le32(*request), &ioc->chip->AtomicRequestDescriptorPost); 3292 } 3293 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1345/1345] net/netfilter/nf_nat_proto.o: warning: objtool: missing symbol for section .text
by kernel test robot 03 Mar '25

03 Mar '25

Hi Florian, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: df3541670ca99b09f2f70d1733516ef7a2289b29 commit: 83abe3a3b85762720192809ac8695ff9255cfd23 [1345/1345] netfilter: nat: remove csum_recalc hook config: x86_64-buildonly-randconfig-004-20241224 (https://download.01.org/0day-ci/archive/20250303/202503032046.ehJfxCPP-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250303/202503032046.ehJfxCPP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503032046.ehJfxCPP-lkp@intel.com/ All warnings (new ones prefixed by >>): net/netfilter/nf_nat_proto.c:56:6: warning: no previous prototype for function 'nf_nat_csum_recalc' [-Wmissing-prototypes] 56 | void nf_nat_csum_recalc(struct sk_buff *skb, | ^ net/netfilter/nf_nat_proto.c:56:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 56 | void nf_nat_csum_recalc(struct sk_buff *skb, | ^ | static 1 warning generated. >> net/netfilter/nf_nat_proto.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] tcp: Defer ts_recent changes until req is owned
by Liu Jian 03 Mar '25

03 Mar '25

From: Wang Hai <wanghai38(a)huawei.com> mainline inclusion from mainline-v6.14-rc5 commit 8d52da23b6c68a0f6bad83959ebb61a2cf623c4e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBN5ZW CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Recently a bug was discovered where the server had entered TCP_ESTABLISHED state, but the upper layers were not notified. The same 5-tuple packet may be processed by different CPUSs, so two CPUs may receive different ack packets at the same time when the state is TCP_NEW_SYN_RECV. In that case, req->ts_recent in tcp_check_req may be changed concurrently, which will probably cause the newsk's ts_recent to be incorrectly large. So that tcp_validate_incoming will fail. At this point, newsk will not be able to enter the TCP_ESTABLISHED. cpu1 cpu2 tcp_check_req tcp_check_req req->ts_recent = rcv_tsval = t1 req->ts_recent = rcv_tsval = t2 syn_recv_sock tcp_sk(child)->rx_opt.ts_recent = req->ts_recent = t2 // t1 < t2 tcp_child_process tcp_rcv_state_process tcp_validate_incoming tcp_paws_check if ((s32)(rx_opt->ts_recent - rx_opt->rcv_tsval) <= paws_win) // t2 - t1 > paws_win, failed tcp_v4_do_rcv tcp_rcv_state_process // TCP_ESTABLISHED The cpu2's skb or a newly received skb will call tcp_v4_do_rcv to get the newsk into the TCP_ESTABLISHED state, but at this point it is no longer possible to notify the upper layer application. A notification mechanism could be added here, but the fix is more complex, so the current fix is used. In tcp_check_req, req->ts_recent is used to assign a value to tcp_sk(child)->rx_opt.ts_recent, so removing the change in req->ts_recent and changing tcp_sk(child)->rx_opt.ts_recent directly after owning the req fixes this bug. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Reviewed-by: Jason Xing <kerneljasonxing(a)gmail.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/ipv4/tcp_minisocks.c [Did not backport d4f2c86b2b7e2.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv4/tcp_minisocks.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index e2dbc9ab892a..f121307c0cb5 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -743,9 +743,6 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, /* In sequence, PAWS is OK. */ - if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_nxt)) - req->ts_recent = tmp_opt.rcv_tsval; - if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) { /* Truncate SYN, it is out of window starting at tcp_rsk(req)->rcv_isn + 1. */ @@ -794,6 +791,10 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, if (!child) goto listen_overflow; + if (own_req && tmp_opt.saw_tstamp && + !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_nxt)) + tcp_sk(child)->rx_opt.ts_recent = tmp_opt.rcv_tsval; + sock_rps_save_rxhash(child, skb); tcp_synack_rtt_meas(child, req); *req_stolen = !own_req; -- 2.34.1

2 1

[PATCH OLK-5.10 0/1] Fix CVE-2022-49285
by Hongbo Li 03 Mar '25

03 Mar '25

Fix CVE-2022-49285. Haibo Chen (1): iio: accel: mma8452: use the correct logic to get mma8452_data drivers/iio/accel/mma8452.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6] wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion
by Li Huafei 03 Mar '25

03 Mar '25

From: Ping-Ke Shih <pkshih(a)realtek.com> mainline inclusion from mainline-v6.14-rc1 commit ba4bb0402c60e945c4c396c51f0acac3c3e3ea5c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBK7 CVE: CVE-2025-21729 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The rtwdev->scanning flag isn't protected by mutex originally, so cancel_hw_scan can pass the condition, but suddenly hw_scan completion unset the flag and calls ieee80211_scan_completed() that will free local->hw_scan_req. Then, cancel_hw_scan raises null-ptr-deref and use-after-free. Fix it by moving the check condition to where protected by mutex. KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f] CPU: 2 PID: 6922 Comm: kworker/2:2 Tainted: G OE Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB6WW (2.76 ) 09/10/2019 Workqueue: events cfg80211_conn_work [cfg80211] RIP: 0010:rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] Code: 00 45 89 6c 24 1c 0f 85 23 01 00 00 48 8b 85 20 ff ff ff 48 8d RSP: 0018:ffff88811fd9f068 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff88811fd9f258 RCX: 0000000000000001 RDX: 0000000000000011 RSI: 0000000000000001 RDI: 0000000000000089 RBP: ffff88811fd9f170 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88811fd9f108 R11: 0000000000000000 R12: ffff88810e47f960 R13: 0000000000000000 R14: 000000000000ffff R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881d6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007531dfca55b0 CR3: 00000001be296004 CR4: 00000000001706e0 Call Trace: <TASK> ? show_regs+0x61/0x73 ? __die_body+0x20/0x73 ? die_addr+0x4f/0x7b ? exc_general_protection+0x191/0x1db ? asm_exc_general_protection+0x27/0x30 ? rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] ? rtw89_fw_h2c_scan_offload_be+0x458/0x13c3 [rtw89_core] ? __pfx_rtw89_fw_h2c_scan_offload_be+0x10/0x10 [rtw89_core] ? do_raw_spin_lock+0x75/0xdb ? __pfx_do_raw_spin_lock+0x10/0x10 rtw89_hw_scan_offload+0xb5e/0xbf7 [rtw89_core] ? _raw_spin_unlock+0xe/0x24 ? __mutex_lock.constprop.0+0x40c/0x471 ? __pfx_rtw89_hw_scan_offload+0x10/0x10 [rtw89_core] ? __mutex_lock_slowpath+0x13/0x1f ? mutex_lock+0xa2/0xdc ? __pfx_mutex_lock+0x10/0x10 rtw89_hw_scan_abort+0x58/0xb7 [rtw89_core] rtw89_ops_cancel_hw_scan+0x120/0x13b [rtw89_core] ieee80211_scan_cancel+0x468/0x4d0 [mac80211] ieee80211_prep_connection+0x858/0x899 [mac80211] ieee80211_mgd_auth+0xbea/0xdde [mac80211] ? __pfx_ieee80211_mgd_auth+0x10/0x10 [mac80211] ? cfg80211_find_elem+0x15/0x29 [cfg80211] ? is_bss+0x1b7/0x1d7 [cfg80211] ieee80211_auth+0x18/0x27 [mac80211] cfg80211_mlme_auth+0x3bb/0x3e7 [cfg80211] cfg80211_conn_do_work+0x410/0xb81 [cfg80211] ? __pfx_cfg80211_conn_do_work+0x10/0x10 [cfg80211] ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? __kasan_check_write+0x14/0x22 ? mutex_lock+0x8e/0xdc ? __pfx_mutex_lock+0x10/0x10 ? __pfx___radix_tree_lookup+0x10/0x10 cfg80211_conn_work+0x245/0x34d [cfg80211] ? __pfx_cfg80211_conn_work+0x10/0x10 [cfg80211] ? update_cfs_rq_load_avg+0x3bc/0x3d7 ? sched_clock_noinstr+0x9/0x1a ? sched_clock+0x10/0x24 ? sched_clock_cpu+0x7e/0x42e ? newidle_balance+0x796/0x937 ? __pfx_sched_clock_cpu+0x10/0x10 ? __pfx_newidle_balance+0x10/0x10 ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? _raw_spin_unlock+0xe/0x24 ? raw_spin_rq_unlock+0x47/0x54 ? raw_spin_rq_unlock_irq+0x9/0x1f ? finish_task_switch.isra.0+0x347/0x586 ? __schedule+0x27bf/0x2892 ? mutex_unlock+0x80/0xd0 ? do_raw_spin_lock+0x75/0xdb ? __pfx___schedule+0x10/0x10 process_scheduled_works+0x58c/0x821 worker_thread+0x4c7/0x586 ? __kasan_check_read+0x11/0x1f kthread+0x285/0x294 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x6f ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Fixes: 895907779752 ("rtw89: 8852a: add ieee80211_ops::hw_scan") Signed-off-by: Ping-Ke Shih <pkshih(a)realtek.com> Link: https://patch.msgid.link/20250107114254.6769-1-pkshih@realtek.com Conflicts: drivers/net/wireless/realtek/rtw89/mac80211.c [ Context conflicts caused by not backport commit aad0394e7a02 ("wifi: rtw89: tweak driver architecture for impending MLO support"). ] Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/net/wireless/realtek/rtw89/mac80211.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c index 5b9de1f41dc7..892a538a7ea5 100644 --- a/drivers/net/wireless/realtek/rtw89/mac80211.c +++ b/drivers/net/wireless/realtek/rtw89/mac80211.c @@ -872,11 +872,13 @@ static void rtw89_ops_cancel_hw_scan(struct ieee80211_hw *hw, if (!RTW89_CHK_FW_FEATURE(SCAN_OFFLOAD, &rtwdev->fw)) return; + mutex_lock(&rtwdev->mutex); + if (!rtwdev->scanning) - return; + goto out; - mutex_lock(&rtwdev->mutex); rtw89_hw_scan_abort(rtwdev, vif); +out: mutex_unlock(&rtwdev->mutex); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2022-49404
by Liao Chen 03 Mar '25

03 Mar '25

fix CVE-2022-49404 Dennis Dalessandro (1): RDMA/hfi1: Fix potential integer multiplication overflow errors drivers/infiniband/hw/hfi1/init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] [Backport] fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()
by Yongjian Sun 03 Mar '25

03 Mar '25

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> mainline inclusion from mainline-v6.12-rc3 commit 2afd4d267e6dbaec8d3ccd4f5396cb84bc67aa2e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5A CVE: CVE-2024-52560 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Extended the `mi_enum_attr()` function interface with an additional parameter, `struct ntfs_inode *ni`, to allow marking the inode as bad as soon as an error is detected. Reported-by: syzbot+73d8fc29ec7cba8286fa(a)syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Conflicts: fs/ntfs3/record.c [Context Changed] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ntfs3/attrib.c | 11 +++---- fs/ntfs3/frecord.c | 59 +++++++++++++++++++----------------- fs/ntfs3/ntfs_fs.h | 21 ++++++------- fs/ntfs3/record.c | 75 ++++++++++++++++++++++++---------------------- 4 files changed, 88 insertions(+), 78 deletions(-) diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c index fc6cea60044e..98b459a54beb 100644 --- a/fs/ntfs3/attrib.c +++ b/fs/ntfs3/attrib.c @@ -788,7 +788,8 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type, if (err) goto out; - attr = mi_find_attr(mi, NULL, type, name, name_len, &le->id); + attr = mi_find_attr(ni, mi, NULL, type, name, name_len, + &le->id); if (!attr) { err = -EINVAL; goto bad_inode; @@ -1180,7 +1181,7 @@ int attr_data_get_block(struct ntfs_inode *ni, CLST vcn, CLST clen, CLST *lcn, goto out; } - attr = mi_find_attr(mi, NULL, ATTR_DATA, NULL, 0, &le->id); + attr = mi_find_attr(ni, mi, NULL, ATTR_DATA, NULL, 0, &le->id); if (!attr) { err = -EINVAL; goto out; @@ -1805,7 +1806,7 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size, goto out; } - attr = mi_find_attr(mi, NULL, ATTR_DATA, NULL, 0, + attr = mi_find_attr(ni, mi, NULL, ATTR_DATA, NULL, 0, &le->id); if (!attr) { err = -EINVAL; @@ -2050,8 +2051,8 @@ int attr_collapse_range(struct ntfs_inode *ni, u64 vbo, u64 bytes) } /* Look for required attribute. */ - attr = mi_find_attr(mi, NULL, ATTR_DATA, NULL, - 0, &le->id); + attr = mi_find_attr(ni, mi, NULL, ATTR_DATA, + NULL, 0, &le->id); if (!attr) { err = -EINVAL; goto out; diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c index 12e03feb3074..3a254bc5af74 100644 --- a/fs/ntfs3/frecord.c +++ b/fs/ntfs3/frecord.c @@ -75,7 +75,7 @@ struct ATTR_STD_INFO *ni_std(struct ntfs_inode *ni) { const struct ATTRIB *attr; - attr = mi_find_attr(&ni->mi, NULL, ATTR_STD, NULL, 0, NULL); + attr = mi_find_attr(ni, &ni->mi, NULL, ATTR_STD, NULL, 0, NULL); return attr ? resident_data_ex(attr, sizeof(struct ATTR_STD_INFO)) : NULL; } @@ -89,7 +89,7 @@ struct ATTR_STD_INFO5 *ni_std5(struct ntfs_inode *ni) { const struct ATTRIB *attr; - attr = mi_find_attr(&ni->mi, NULL, ATTR_STD, NULL, 0, NULL); + attr = mi_find_attr(ni, &ni->mi, NULL, ATTR_STD, NULL, 0, NULL); return attr ? resident_data_ex(attr, sizeof(struct ATTR_STD_INFO5)) : NULL; @@ -201,7 +201,8 @@ struct ATTRIB *ni_find_attr(struct ntfs_inode *ni, struct ATTRIB *attr, *mi = &ni->mi; /* Look for required attribute in primary record. */ - return mi_find_attr(&ni->mi, attr, type, name, name_len, NULL); + return mi_find_attr(ni, &ni->mi, attr, type, name, name_len, + NULL); } /* First look for list entry of required type. */ @@ -217,7 +218,7 @@ struct ATTRIB *ni_find_attr(struct ntfs_inode *ni, struct ATTRIB *attr, return NULL; /* Look for required attribute. */ - attr = mi_find_attr(m, NULL, type, name, name_len, &le->id); + attr = mi_find_attr(ni, m, NULL, type, name, name_len, &le->id); if (!attr) goto out; @@ -259,7 +260,7 @@ struct ATTRIB *ni_enum_attr_ex(struct ntfs_inode *ni, struct ATTRIB *attr, if (mi) *mi = &ni->mi; /* Enum attributes in primary record. */ - return mi_enum_attr(&ni->mi, attr); + return mi_enum_attr(ni, &ni->mi, attr); } /* Get next list entry. */ @@ -275,7 +276,7 @@ struct ATTRIB *ni_enum_attr_ex(struct ntfs_inode *ni, struct ATTRIB *attr, *mi = mi2; /* Find attribute in loaded record. */ - return rec_find_attr_le(mi2, le2); + return rec_find_attr_le(ni, mi2, le2); } /* @@ -293,7 +294,8 @@ struct ATTRIB *ni_load_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, if (!ni->attr_list.size) { if (pmi) *pmi = &ni->mi; - return mi_find_attr(&ni->mi, NULL, type, name, name_len, NULL); + return mi_find_attr(ni, &ni->mi, NULL, type, name, name_len, + NULL); } le = al_find_ex(ni, NULL, type, name, name_len, NULL); @@ -319,7 +321,7 @@ struct ATTRIB *ni_load_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, if (pmi) *pmi = mi; - attr = mi_find_attr(mi, NULL, type, name, name_len, &le->id); + attr = mi_find_attr(ni, mi, NULL, type, name, name_len, &le->id); if (!attr) return NULL; @@ -398,7 +400,8 @@ int ni_remove_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, int diff; if (base_only || type == ATTR_LIST || !ni->attr_list.size) { - attr = mi_find_attr(&ni->mi, NULL, type, name, name_len, id); + attr = mi_find_attr(ni, &ni->mi, NULL, type, name, name_len, + id); if (!attr) return -ENOENT; @@ -437,7 +440,7 @@ int ni_remove_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, al_remove_le(ni, le); - attr = mi_find_attr(mi, NULL, type, name, name_len, id); + attr = mi_find_attr(ni, mi, NULL, type, name, name_len, id); if (!attr) return -ENOENT; @@ -485,7 +488,7 @@ ni_ins_new_attr(struct ntfs_inode *ni, struct mft_inode *mi, name = le->name; } - attr = mi_insert_attr(mi, type, name, name_len, asize, name_off); + attr = mi_insert_attr(ni, mi, type, name, name_len, asize, name_off); if (!attr) { if (le_added) al_remove_le(ni, le); @@ -673,7 +676,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) if (err) return err; - attr_list = mi_find_attr(&ni->mi, NULL, ATTR_LIST, NULL, 0, NULL); + attr_list = mi_find_attr(ni, &ni->mi, NULL, ATTR_LIST, NULL, 0, NULL); if (!attr_list) return 0; @@ -695,7 +698,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) if (!mi) return 0; - attr = mi_find_attr(mi, NULL, le->type, le_name(le), + attr = mi_find_attr(ni, mi, NULL, le->type, le_name(le), le->name_len, &le->id); if (!attr) return 0; @@ -731,7 +734,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) goto out; } - attr = mi_find_attr(mi, NULL, le->type, le_name(le), + attr = mi_find_attr(ni, mi, NULL, le->type, le_name(le), le->name_len, &le->id); if (!attr) { /* Should never happened, 'cause already checked. */ @@ -740,7 +743,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) asize = le32_to_cpu(attr->size); /* Insert into primary record. */ - attr_ins = mi_insert_attr(&ni->mi, le->type, le_name(le), + attr_ins = mi_insert_attr(ni, &ni->mi, le->type, le_name(le), le->name_len, asize, le16_to_cpu(attr->name_off)); if (!attr_ins) { @@ -768,7 +771,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) if (!mi) continue; - attr = mi_find_attr(mi, NULL, le->type, le_name(le), + attr = mi_find_attr(ni, mi, NULL, le->type, le_name(le), le->name_len, &le->id); if (!attr) continue; @@ -831,7 +834,7 @@ int ni_create_attr_list(struct ntfs_inode *ni) free_b = 0; attr = NULL; - for (; (attr = mi_enum_attr(&ni->mi, attr)); le = Add2Ptr(le, sz)) { + for (; (attr = mi_enum_attr(ni, &ni->mi, attr)); le = Add2Ptr(le, sz)) { sz = le_size(attr->name_len); le->type = attr->type; le->size = cpu_to_le16(sz); @@ -886,7 +889,7 @@ int ni_create_attr_list(struct ntfs_inode *ni) u32 asize = le32_to_cpu(b->size); u16 name_off = le16_to_cpu(b->name_off); - attr = mi_insert_attr(mi, b->type, Add2Ptr(b, name_off), + attr = mi_insert_attr(ni, mi, b->type, Add2Ptr(b, name_off), b->name_len, asize, name_off); if (!attr) goto out; @@ -909,7 +912,7 @@ int ni_create_attr_list(struct ntfs_inode *ni) goto out; } - attr = mi_insert_attr(&ni->mi, ATTR_LIST, NULL, 0, + attr = mi_insert_attr(ni, &ni->mi, ATTR_LIST, NULL, 0, lsize + SIZEOF_RESIDENT, SIZEOF_RESIDENT); if (!attr) goto out; @@ -993,13 +996,13 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le, mi = rb_entry(node, struct mft_inode, node); if (is_mft_data && - (mi_enum_attr(mi, NULL) || + (mi_enum_attr(ni, mi, NULL) || vbo <= ((u64)mi->rno << sbi->record_bits))) { /* We can't accept this record 'cause MFT's bootstrapping. */ continue; } if (is_mft && - mi_find_attr(mi, NULL, ATTR_DATA, NULL, 0, NULL)) { + mi_find_attr(ni, mi, NULL, ATTR_DATA, NULL, 0, NULL)) { /* * This child record already has a ATTR_DATA. * So it can't accept any other records. @@ -1008,7 +1011,7 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le, } if ((type != ATTR_NAME || name_len) && - mi_find_attr(mi, NULL, type, name, name_len, NULL)) { + mi_find_attr(ni, mi, NULL, type, name, name_len, NULL)) { /* Only indexed attributes can share same record. */ continue; } @@ -1157,7 +1160,7 @@ static int ni_insert_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, /* Estimate the result of moving all possible attributes away. */ attr = NULL; - while ((attr = mi_enum_attr(&ni->mi, attr))) { + while ((attr = mi_enum_attr(ni, &ni->mi, attr))) { if (attr->type == ATTR_STD) continue; if (attr->type == ATTR_LIST) @@ -1175,7 +1178,7 @@ static int ni_insert_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, attr = NULL; for (;;) { - attr = mi_enum_attr(&ni->mi, attr); + attr = mi_enum_attr(ni, &ni->mi, attr); if (!attr) { /* We should never be here 'cause we have already check this case. */ err = -EINVAL; @@ -1259,7 +1262,7 @@ static int ni_expand_mft_list(struct ntfs_inode *ni) for (node = rb_first(&ni->mi_tree); node; node = rb_next(node)) { mi = rb_entry(node, struct mft_inode, node); - attr = mi_enum_attr(mi, NULL); + attr = mi_enum_attr(ni, mi, NULL); if (!attr) { mft_min = mi->rno; @@ -1280,7 +1283,7 @@ static int ni_expand_mft_list(struct ntfs_inode *ni) ni_remove_mi(ni, mi_new); } - attr = mi_find_attr(&ni->mi, NULL, ATTR_DATA, NULL, 0, NULL); + attr = mi_find_attr(ni, &ni->mi, NULL, ATTR_DATA, NULL, 0, NULL); if (!attr) { err = -EINVAL; goto out; @@ -1397,7 +1400,7 @@ int ni_expand_list(struct ntfs_inode *ni) continue; /* Find attribute in primary record. */ - attr = rec_find_attr_le(&ni->mi, le); + attr = rec_find_attr_le(ni, &ni->mi, le); if (!attr) { err = -EINVAL; goto out; @@ -3417,7 +3420,7 @@ int ni_write_inode(struct inode *inode, int sync, const char *hint) if (!mi->dirty) continue; - is_empty = !mi_enum_attr(mi, NULL); + is_empty = !mi_enum_attr(ni, mi, NULL); if (is_empty) clear_rec_inuse(mi->mrec); diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h index cfe9d3bf07f9..0aea6ab15c14 100644 --- a/fs/ntfs3/ntfs_fs.h +++ b/fs/ntfs3/ntfs_fs.h @@ -738,23 +738,24 @@ int mi_get(struct ntfs_sb_info *sbi, CLST rno, struct mft_inode **mi); void mi_put(struct mft_inode *mi); int mi_init(struct mft_inode *mi, struct ntfs_sb_info *sbi, CLST rno); int mi_read(struct mft_inode *mi, bool is_mft); -struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr); -// TODO: id? -struct ATTRIB *mi_find_attr(struct mft_inode *mi, struct ATTRIB *attr, - enum ATTR_TYPE type, const __le16 *name, - u8 name_len, const __le16 *id); -static inline struct ATTRIB *rec_find_attr_le(struct mft_inode *rec, +struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi, + struct ATTRIB *attr); +struct ATTRIB *mi_find_attr(struct ntfs_inode *ni, struct mft_inode *mi, + struct ATTRIB *attr, enum ATTR_TYPE type, + const __le16 *name, u8 name_len, const __le16 *id); +static inline struct ATTRIB *rec_find_attr_le(struct ntfs_inode *ni, + struct mft_inode *rec, struct ATTR_LIST_ENTRY *le) { - return mi_find_attr(rec, NULL, le->type, le_name(le), le->name_len, + return mi_find_attr(ni, rec, NULL, le->type, le_name(le), le->name_len, &le->id); } int mi_write(struct mft_inode *mi, int wait); int mi_format_new(struct mft_inode *mi, struct ntfs_sb_info *sbi, CLST rno, __le16 flags, bool is_mft); -struct ATTRIB *mi_insert_attr(struct mft_inode *mi, enum ATTR_TYPE type, - const __le16 *name, u8 name_len, u32 asize, - u16 name_off); +struct ATTRIB *mi_insert_attr(struct ntfs_inode *ni, struct mft_inode *mi, + enum ATTR_TYPE type, const __le16 *name, + u8 name_len, u32 asize, u16 name_off); bool mi_remove_attr(struct ntfs_inode *ni, struct mft_inode *mi, struct ATTRIB *attr); diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c index f810f0419d25..25aa5997a947 100644 --- a/fs/ntfs3/record.c +++ b/fs/ntfs3/record.c @@ -31,7 +31,7 @@ static inline int compare_attr(const struct ATTRIB *left, enum ATTR_TYPE type, * * Return: Unused attribute id that is less than mrec->next_attr_id. */ -static __le16 mi_new_attt_id(struct mft_inode *mi) +static __le16 mi_new_attt_id(struct ntfs_inode *ni, struct mft_inode *mi) { u16 free_id, max_id, t16; struct MFT_REC *rec = mi->mrec; @@ -52,7 +52,7 @@ static __le16 mi_new_attt_id(struct mft_inode *mi) attr = NULL; for (;;) { - attr = mi_enum_attr(mi, attr); + attr = mi_enum_attr(ni, mi, attr); if (!attr) { rec->next_attr_id = cpu_to_le16(max_id + 1); mi->dirty = true; @@ -195,7 +195,8 @@ int mi_read(struct mft_inode *mi, bool is_mft) * NOTE: mi->mrec - memory of size sbi->record_size * here we sure that mi->mrec->total == sbi->record_size (see mi_read) */ -struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) +struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi, + struct ATTRIB *attr) { const struct MFT_REC *rec = mi->mrec; u32 used = le32_to_cpu(rec->used); @@ -209,11 +210,11 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) off = le16_to_cpu(rec->attr_off); if (used > total) - return NULL; + goto out; if (off >= used || off < MFTRECORD_FIXUP_OFFSET_1 || !IS_ALIGNED(off, 4)) { - return NULL; + goto out; } /* Skip non-resident records. */ @@ -240,7 +241,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) /* NOTE: this code also checks attr->size availability. */ if (off + 8 > used) { static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8); - return NULL; + goto out; } if (attr->type == ATTR_END) { @@ -251,105 +252,109 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) /* 0x100 is last known attribute for now. */ t32 = le32_to_cpu(attr->type); if (!t32 || (t32 & 0xf) || (t32 > 0x100)) - return NULL; + goto out; /* attributes in record must be ordered by type */ if (t32 < prev_type) - return NULL; + goto out; asize = le32_to_cpu(attr->size); /* Check overflow and boundary. */ if (off + asize < off || off + asize > used) - return NULL; + goto out; /* Check size of attribute. */ if (!attr->non_res) { /* Check resident fields. */ if (asize < SIZEOF_RESIDENT) - return NULL; + goto out; t16 = le16_to_cpu(attr->res.data_off); if (t16 > asize) - return NULL; + goto out; if (le32_to_cpu(attr->res.data_size) > asize - t16) - return NULL; + goto out; t32 = sizeof(short) * attr->name_len; if (t32 && le16_to_cpu(attr->name_off) + t32 > t16) - return NULL; + goto out; return attr; } /* Check nonresident fields. */ if (attr->non_res != 1) - return NULL; + goto out; /* Can we use memory including attr->nres.valid_size? */ if (asize < SIZEOF_NONRESIDENT) - return NULL; + goto out; t16 = le16_to_cpu(attr->nres.run_off); if (t16 > asize) - return NULL; + goto out; t32 = sizeof(short) * attr->name_len; if (t32 && le16_to_cpu(attr->name_off) + t32 > t16) - return NULL; + goto out; /* Check start/end vcn. */ if (le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1) - return NULL; + goto out; data_size = le64_to_cpu(attr->nres.data_size); if (le64_to_cpu(attr->nres.valid_size) > data_size) - return NULL; + goto out; alloc_size = le64_to_cpu(attr->nres.alloc_size); if (data_size > alloc_size) - return NULL; + goto out; t32 = mi->sbi->cluster_mask; if (alloc_size & t32) - return NULL; + goto out; if (!attr->nres.svcn && is_attr_ext(attr)) { /* First segment of sparse/compressed attribute */ /* Can we use memory including attr->nres.total_size? */ if (asize < SIZEOF_NONRESIDENT_EX) - return NULL; + goto out; tot_size = le64_to_cpu(attr->nres.total_size); if (tot_size & t32) - return NULL; + goto out; if (tot_size > alloc_size) - return NULL; + goto out; } else { if (attr->nres.c_unit) - return NULL; + goto out; if (alloc_size > mi->sbi->volume.size) - return NULL; + goto out; } return attr; + +out: + _ntfs_bad_inode(&ni->vfs_inode); + return NULL; } /* * mi_find_attr - Find the attribute by type and name and id. */ -struct ATTRIB *mi_find_attr(struct mft_inode *mi, struct ATTRIB *attr, - enum ATTR_TYPE type, const __le16 *name, - u8 name_len, const __le16 *id) +struct ATTRIB *mi_find_attr(struct ntfs_inode *ni, struct mft_inode *mi, + struct ATTRIB *attr, enum ATTR_TYPE type, + const __le16 *name, u8 name_len, const __le16 *id) { u32 type_in = le32_to_cpu(type); u32 atype; next_attr: - attr = mi_enum_attr(mi, attr); + attr = mi_enum_attr(ni, mi, attr); if (!attr) return NULL; @@ -457,9 +462,9 @@ int mi_format_new(struct mft_inode *mi, struct ntfs_sb_info *sbi, CLST rno, * * Return: Not full constructed attribute or NULL if not possible to create. */ -struct ATTRIB *mi_insert_attr(struct mft_inode *mi, enum ATTR_TYPE type, - const __le16 *name, u8 name_len, u32 asize, - u16 name_off) +struct ATTRIB *mi_insert_attr(struct ntfs_inode *ni, struct mft_inode *mi, + enum ATTR_TYPE type, const __le16 *name, + u8 name_len, u32 asize, u16 name_off) { size_t tail; struct ATTRIB *attr; @@ -478,7 +483,7 @@ struct ATTRIB *mi_insert_attr(struct mft_inode *mi, enum ATTR_TYPE type, * at which we should insert it. */ attr = NULL; - while ((attr = mi_enum_attr(mi, attr))) { + while ((attr = mi_enum_attr(ni, mi, attr))) { int diff = compare_attr(attr, type, name, name_len, upcase); if (diff < 0) @@ -498,7 +503,7 @@ struct ATTRIB *mi_insert_attr(struct mft_inode *mi, enum ATTR_TYPE type, tail = used - PtrOffset(rec, attr); } - id = mi_new_attt_id(mi); + id = mi_new_attt_id(ni, mi); memmove(Add2Ptr(attr, asize), attr, tail); memset(attr, 0, asize); -- 2.39.2

2 1

[PATCH OLK-6.6] tracing/osnoise: Fix resetting of tracepoints
by Li Huafei 03 Mar '25

03 Mar '25

From: Steven Rostedt <rostedt(a)goodmis.org> stable inclusion from stable-v6.6.78 commit ee8c4c39a8f97467d63adfe03bcd45139d8c8b53 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8L CVE: CVE-2025-21733 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e3ff4245928f948f3eb2e852aa350b870421c358 upstream. If a timerlat tracer is started with the osnoise option OSNOISE_WORKLOAD disabled, but then that option is enabled and timerlat is removed, the tracepoints that were enabled on timerlat registration do not get disabled. If the option is disabled again and timelat is started, then it triggers a warning in the tracepoint code due to registering the tracepoint again without ever disabling it. Do not use the same user space defined options to know to disable the tracepoints when timerlat is removed. Instead, set a global flag when it is enabled and use that flag to know to disable the events. ~# echo NO_OSNOISE_WORKLOAD > /sys/kernel/tracing/osnoise/options ~# echo timerlat > /sys/kernel/tracing/current_tracer ~# echo OSNOISE_WORKLOAD > /sys/kernel/tracing/osnoise/options ~# echo nop > /sys/kernel/tracing/current_tracer ~# echo NO_OSNOISE_WORKLOAD > /sys/kernel/tracing/osnoise/options ~# echo timerlat > /sys/kernel/tracing/current_tracer Triggers: ------------[ cut here ]------------ WARNING: CPU: 6 PID: 1337 at kernel/tracepoint.c:294 tracepoint_add_func+0x3b6/0x3f0 Modules linked in: CPU: 6 UID: 0 PID: 1337 Comm: rtla Not tainted 6.13.0-rc4-test-00018-ga867c441128e-dirty #73 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:tracepoint_add_func+0x3b6/0x3f0 Code: 48 8b 53 28 48 8b 73 20 4c 89 04 24 e8 23 59 11 00 4c 8b 04 24 e9 36 fe ff ff 0f 0b b8 ea ff ff ff 45 84 e4 0f 84 68 fe ff ff <0f> 0b e9 61 fe ff ff 48 8b 7b 18 48 85 ff 0f 84 4f ff ff ff 49 8b RSP: 0018:ffffb9b003a87ca0 EFLAGS: 00010202 RAX: 00000000ffffffef RBX: ffffffff92f30860 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff9bf59e91ccd0 RDI: ffffffff913b6410 RBP: 000000000000000a R08: 00000000000005c7 R09: 0000000000000002 R10: ffffb9b003a87ce0 R11: 0000000000000002 R12: 0000000000000001 R13: ffffb9b003a87ce0 R14: ffffffffffffffef R15: 0000000000000008 FS: 00007fce81209240(0000) GS:ffff9bf6fdd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055e99b728000 CR3: 00000001277c0002 CR4: 0000000000172ef0 Call Trace: <TASK> ? __warn.cold+0xb7/0x14d ? tracepoint_add_func+0x3b6/0x3f0 ? report_bug+0xea/0x170 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? __pfx_trace_sched_migrate_callback+0x10/0x10 ? tracepoint_add_func+0x3b6/0x3f0 ? __pfx_trace_sched_migrate_callback+0x10/0x10 ? __pfx_trace_sched_migrate_callback+0x10/0x10 tracepoint_probe_register+0x78/0xb0 ? __pfx_trace_sched_migrate_callback+0x10/0x10 osnoise_workload_start+0x2b5/0x370 timerlat_tracer_init+0x76/0x1b0 tracing_set_tracer+0x244/0x400 tracing_set_trace_write+0xa0/0xe0 vfs_write+0xfc/0x570 ? do_sys_openat2+0x9c/0xe0 ksys_write+0x72/0xf0 do_syscall_64+0x79/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Tomas Glozar <tglozar(a)redhat.com> Cc: Gabriele Monaco <gmonaco(a)redhat.com> Cc: Luis Goncalves <lgoncalv(a)redhat.com> Cc: John Kacur <jkacur(a)redhat.com> Link: https://lore.kernel.org/20250123204159.4450c88e@gandalf.local.home Fixes: e88ed227f639e ("tracing/timerlat: Add user-space interface") Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- kernel/trace/trace_osnoise.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c index 3e2bc029fa8c..cc155590018f 100644 --- a/kernel/trace/trace_osnoise.c +++ b/kernel/trace/trace_osnoise.c @@ -1235,6 +1235,8 @@ static void trace_sched_migrate_callback(void *data, struct task_struct *p, int } } +static bool monitor_enabled; + static int register_migration_monitor(void) { int ret = 0; @@ -1243,16 +1245,25 @@ static int register_migration_monitor(void) * Timerlat thread migration check is only required when running timerlat in user-space. * Thus, enable callback only if timerlat is set with no workload. */ - if (timerlat_enabled() && !test_bit(OSN_WORKLOAD, &osnoise_options)) + if (timerlat_enabled() && !test_bit(OSN_WORKLOAD, &osnoise_options)) { + if (WARN_ON_ONCE(monitor_enabled)) + return 0; + ret = register_trace_sched_migrate_task(trace_sched_migrate_callback, NULL); + if (!ret) + monitor_enabled = true; + } return ret; } static void unregister_migration_monitor(void) { - if (timerlat_enabled() && !test_bit(OSN_WORKLOAD, &osnoise_options)) - unregister_trace_sched_migrate_task(trace_sched_migrate_callback, NULL); + if (!monitor_enabled) + return; + + unregister_trace_sched_migrate_task(trace_sched_migrate_callback, NULL); + monitor_enabled = false; } #else static int register_migration_monitor(void) -- 2.25.1

2 1