- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1345/1345] drivers/acpi/pmic/tps68470_pmic.c:380:10: error: implicit declaration of function 'dev_err_probe'
by kernel test robot 25 Dec '24

25 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 33267d4a7f512d371a3ea853568832174be4caba commit: 24564bb891ae98786176f703d1addc5588dafe61 [1345/1345] ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe() config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20241225/202412250010.Z1qbx7TD-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241225/202412250010.Z1qbx7TD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412250010.Z1qbx7TD-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/acpi/pmic/tps68470_pmic.c:380:10: error: implicit declaration of function 'dev_err_probe' [-Werror,-Wimplicit-function-declaration] 380 | return dev_err_probe(dev, -EINVAL, "regmap is missing\n"); | ^ drivers/acpi/pmic/tps68470_pmic.c:380:10: note: did you mean 'device_reprobe'? include/linux/device.h:1336:25: note: 'device_reprobe' declared here 1336 | extern int __must_check device_reprobe(struct device *dev); | ^ 1 error generated. vim +/dev_err_probe +380 drivers/acpi/pmic/tps68470_pmic.c 370 371 static int tps68470_pmic_opregion_probe(struct platform_device *pdev) 372 { 373 struct regmap *tps68470_regmap = dev_get_drvdata(pdev->dev.parent); 374 acpi_handle handle = ACPI_HANDLE(pdev->dev.parent); 375 struct device *dev = &pdev->dev; 376 struct tps68470_pmic_opregion *opregion; 377 acpi_status status; 378 379 if (!tps68470_regmap) > 380 return dev_err_probe(dev, -EINVAL, "regmap is missing\n"); 381 382 if (!handle) { 383 dev_warn(dev, "acpi handle is NULL\n"); 384 return -ENODEV; 385 } 386 387 opregion = devm_kzalloc(dev, sizeof(*opregion), GFP_KERNEL); 388 if (!opregion) 389 return -ENOMEM; 390 391 mutex_init(&opregion->lock); 392 opregion->regmap = tps68470_regmap; 393 394 status = acpi_install_address_space_handler(handle, 395 TI_PMIC_POWER_OPREGION_ID, 396 tps68470_pmic_pwr_handler, 397 NULL, opregion); 398 if (ACPI_FAILURE(status)) 399 goto out_mutex_destroy; 400 401 status = acpi_install_address_space_handler(handle, 402 TI_PMIC_VR_VAL_OPREGION_ID, 403 tps68470_pmic_vrval_handler, 404 NULL, opregion); 405 if (ACPI_FAILURE(status)) 406 goto out_remove_power_handler; 407 408 status = acpi_install_address_space_handler(handle, 409 TI_PMIC_CLOCK_OPREGION_ID, 410 tps68470_pmic_clk_handler, 411 NULL, opregion); 412 if (ACPI_FAILURE(status)) 413 goto out_remove_vr_val_handler; 414 415 status = acpi_install_address_space_handler(handle, 416 TI_PMIC_CLKFREQ_OPREGION_ID, 417 tps68470_pmic_cfreq_handler, 418 NULL, opregion); 419 if (ACPI_FAILURE(status)) 420 goto out_remove_clk_handler; 421 422 return 0; 423 424 out_remove_clk_handler: 425 acpi_remove_address_space_handler(handle, TI_PMIC_CLOCK_OPREGION_ID, 426 tps68470_pmic_clk_handler); 427 out_remove_vr_val_handler: 428 acpi_remove_address_space_handler(handle, TI_PMIC_VR_VAL_OPREGION_ID, 429 tps68470_pmic_vrval_handler); 430 out_remove_power_handler: 431 acpi_remove_address_space_handler(handle, TI_PMIC_POWER_OPREGION_ID, 432 tps68470_pmic_pwr_handler); 433 out_mutex_destroy: 434 mutex_destroy(&opregion->lock); 435 return -ENODEV; 436 } 437 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1343/1343] kernel/module.c:275:6: sparse: sparse: symbol 'set_module_sig_enforced' was not declared. Should it be static?
by kernel test robot 24 Dec '24

24 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 33267d4a7f512d371a3ea853568832174be4caba commit: e1f556835f4fdc766bbd0d4a44f3bbeb64671d1a [1343/1343] module: limit enabling module.sig_enforce config: arm64-randconfig-r113-20241223 (https://download.01.org/0day-ci/archive/20241224/202412242304.vlx7BMb1-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241224/202412242304.vlx7BMb1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412242304.vlx7BMb1-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/module.c:275:6: sparse: sparse: symbol 'set_module_sig_enforced' was not declared. Should it be static? kernel/module.c:3984:41: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/module.c:3984:41: sparse: struct mod_kallsyms [noderef] __rcu * kernel/module.c:3984:41: sparse: struct mod_kallsyms * kernel/module.c:4119:28: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/module.c:4119:28: sparse: struct mod_kallsyms [noderef] __rcu * kernel/module.c:4119:28: sparse: struct mod_kallsyms * kernel/module.c:4138:41: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/module.c:4138:41: sparse: struct mod_kallsyms [noderef] __rcu * kernel/module.c:4138:41: sparse: struct mod_kallsyms * kernel/module.c:275:6: warning: no previous prototype for 'set_module_sig_enforced' [-Wmissing-prototypes] 275 | void set_module_sig_enforced(void) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/module.c:4457:6: warning: no previous prototype for 'module_layout' [-Wmissing-prototypes] 4457 | void module_layout(struct module *mod, | ^~~~~~~~~~~~~ kernel/module.c: In function 'add_sect_attrs': kernel/module.c:1516:17: warning: array subscript 0 is outside array bounds of 'struct module_sect_attr[0]' [-Warray-bounds=] 1516 | sattr = &sect_attrs->attrs[0]; | ^~~~~~~~~~~~~~~~~~~~~ kernel/module.c:1471:33: note: while referencing 'attrs' 1471 | struct module_sect_attr attrs[0]; | ^~~~~ In function 'free_sect_attrs', inlined from 'add_sect_attrs' at kernel/module.c:1543:2: kernel/module.c:1488:40: warning: array subscript section is outside array bounds of 'struct module_sect_attr[0]' [-Warray-bounds=] 1488 | kfree(sect_attrs->attrs[section].name); | ~~~~~~~~~~~~~~~~~^~~~~~~~~ kernel/module.c: In function 'add_sect_attrs': kernel/module.c:1471:33: note: while referencing 'attrs' 1471 | struct module_sect_attr attrs[0]; | ^~~~~ kernel/module.c: In function 'add_notes_attrs': kernel/module.c:1617:17: warning: array subscript 0 is outside array bounds of 'struct bin_attribute[0]' [-Warray-bounds=] 1617 | nattr = &notes_attrs->attrs[0]; | ^~~~~~~~~~~~~~~~~~~~~~ kernel/module.c:1565:30: note: while referencing 'attrs' 1565 | struct bin_attribute attrs[0]; | ^~~~~ kernel/module.c:1639:43: warning: array subscript i is outside array bounds of 'struct bin_attribute[0]' [-Warray-bounds=] 1639 | &notes_attrs->attrs[i])) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/module.c:1565:30: note: while referencing 'attrs' 1565 | struct bin_attribute attrs[0]; | ^~~~~ In function 'free_notes_attrs', inlined from 'add_notes_attrs' at kernel/module.c:1646:2: kernel/module.c:1585:47: warning: array subscript i is outside array bounds of 'struct bin_attribute[0]' [-Warray-bounds=] 1585 | &notes_attrs->attrs[i]); | ^~~~~~~~~~~~~~~~~~~~~~ kernel/module.c: In function 'add_notes_attrs': kernel/module.c:1565:30: note: while referencing 'attrs' 1565 | struct bin_attribute attrs[0]; | ^~~~~ kernel/module.c:1623:66: warning: array subscript loaded is outside array bounds of 'struct module_sect_attr[0]' [-Warray-bounds=] 1623 | nattr->attr.name = mod->sect_attrs->attrs[loaded].name; | ~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~ kernel/module.c:1471:33: note: while referencing 'attrs' 1471 | struct module_sect_attr attrs[0]; | ^~~~~ In function 'free_notes_attrs', inlined from 'remove_notes_attrs' at kernel/module.c:1652:3, inlined from 'mod_sysfs_fini' at kernel/module.c:1852:2, inlined from 'mod_sysfs_teardown' at kernel/module.c:1895:2, inlined from 'free_module' at kernel/module.c:2171:2: kernel/module.c:1585:47: warning: array subscript i is outside array bounds of 'struct bin_attribute[0]' [-Warray-bounds=] 1585 | &notes_attrs->attrs[i]); | ^~~~~~~~~~~~~~~~~~~~~~ kernel/module.c: In function 'free_module': kernel/module.c:1565:30: note: while referencing 'attrs' 1565 | struct bin_attribute attrs[0]; | ^~~~~ In function 'free_sect_attrs', inlined from 'remove_sect_attrs' at kernel/module.c:1553:3, inlined from 'mod_sysfs_fini' at kernel/module.c:1853:2, inlined from 'mod_sysfs_teardown' at kernel/module.c:1895:2, inlined from 'free_module' at kernel/module.c:2171:2: kernel/module.c:1488:40: warning: array subscript section is outside array bounds of 'struct module_sect_attr[0]' [-Warray-bounds=] 1488 | kfree(sect_attrs->attrs[section].name); | ~~~~~~~~~~~~~~~~~^~~~~~~~~ kernel/module.c: In function 'free_module': kernel/module.c:1471:33: note: while referencing 'attrs' 1471 | struct module_sect_attr attrs[0]; | ^~~~~ vim +/set_module_sig_enforced +275 kernel/module.c 274 > 275 void set_module_sig_enforced(void) 276 { 277 sig_enforce = true; 278 } 279 #else 280 #define sig_enforce false 281 #endif 282 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1343/1343] drivers/iommu/iommu.c:979:31: sparse: sparse: dubious: !x | !y
by kernel test robot 24 Dec '24

24 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5a23f5b9f615aef1973a9e3894d42c2ddd7364b3 commit: ac084b72b429b1bc0378add3abecfe107a732b7a [1343/1343] iommu: introduce device fault report API config: arm64-randconfig-r113-20241223 (https://download.01.org/0day-ci/archive/20241224/202412242131.GLZuoZe5-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241224/202412242131.GLZuoZe5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412242131.GLZuoZe5-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/iommu/iommu.c:979:31: sparse: sparse: dubious: !x | !y drivers/iommu/iommu.c: In function 'iommu_unregister_device_fault_handler': drivers/iommu/iommu.c:937:13: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 937 | int ret = 0; | ^~~ In file included from arch/arm64/include/asm/atomic.h:34, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from include/linux/list.h:9, from include/linux/kobject.h:20, from include/linux/device.h:17, from drivers/iommu/iommu.c:21: In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'iommu_device_register' at drivers/iommu/iommu.c:101:2: arch/arm64/include/asm/atomic_lse.h:458:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 458 | asm volatile(ARM64_LSE_ATOMIC_INSN( 25- | ^~~ arch/arm64/include/asm/atomic_lse.h:479:1: note: in expansion of macro '__CMPXCHG_CASE' 479 | __CMPXCHG_CASE(w, , acq_4, a, "memory") | ^~~~~~~~~~~~~~ In file included from include/linux/mutex.h:16, from include/linux/kernfs.h:14, from include/linux/sysfs.h:16, from include/linux/kobject.h:21: drivers/iommu/iommu.c: In function 'iommu_device_register': drivers/iommu/iommu.c:97:24: note: object 'iommu_device_lock' of size 4 97 | static DEFINE_SPINLOCK(iommu_device_lock); | ^~~~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'iommu_device_register' at drivers/iommu/iommu.c:101:2: arch/arm64/include/asm/atomic_lse.h:458:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 458 | asm volatile(ARM64_LSE_ATOMIC_INSN( 49- | ^~~ arch/arm64/include/asm/atomic_lse.h:479:1: note: in expansion of macro '__CMPXCHG_CASE' 479 | __CMPXCHG_CASE(w, , acq_4, a, "memory") | ^~~~~~~~~~~~~~ drivers/iommu/iommu.c: In function 'iommu_device_register': drivers/iommu/iommu.c:97:24: note: object 'iommu_device_lock' of size 4 97 | static DEFINE_SPINLOCK(iommu_device_lock); | ^~~~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'iommu_device_unregister' at drivers/iommu/iommu.c:110:2: arch/arm64/include/asm/atomic_lse.h:458:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 458 | asm volatile(ARM64_LSE_ATOMIC_INSN( 69- | ^~~ arch/arm64/include/asm/atomic_lse.h:479:1: note: in expansion of macro '__CMPXCHG_CASE' 479 | __CMPXCHG_CASE(w, , acq_4, a, "memory") | ^~~~~~~~~~~~~~ drivers/iommu/iommu.c: In function 'iommu_device_unregister': drivers/iommu/iommu.c:97:24: note: object 'iommu_device_lock' of size 4 97 | static DEFINE_SPINLOCK(iommu_device_lock); | ^~~~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'iommu_device_unregister' at drivers/iommu/iommu.c:110:2: arch/arm64/include/asm/atomic_lse.h:458:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 458 | asm volatile(ARM64_LSE_ATOMIC_INSN( 89- | ^~~ arch/arm64/include/asm/atomic_lse.h:479:1: note: in expansion of macro '__CMPXCHG_CASE' 479 | __CMPXCHG_CASE(w, , acq_4, a, "memory") | ^~~~~~~~~~~~~~ drivers/iommu/iommu.c: In function 'iommu_device_unregister': drivers/iommu/iommu.c:97:24: note: object 'iommu_device_lock' of size 4 97 | static DEFINE_SPINLOCK(iommu_device_lock); | ^~~~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, vim +979 drivers/iommu/iommu.c 960 961 962 /** 963 * iommu_report_device_fault() - Report fault event to device 964 * @dev: the device 965 * @evt: fault event data 966 * 967 * Called by IOMMU model specific drivers when fault is detected, typically 968 * in a threaded IRQ handler. 969 * 970 * Return 0 on success, or an error. 971 */ 972 int iommu_report_device_fault(struct device *dev, struct iommu_fault_event *evt) 973 { 974 int ret = 0; 975 struct iommu_fault_event *evt_pending; 976 struct iommu_fault_param *fparam; 977 978 /* iommu_param is allocated when device is added to group */ > 979 if (!dev->iommu_param | !evt) 980 return -EINVAL; 981 /* we only report device fault if there is a handler registered */ 982 mutex_lock(&dev->iommu_param->lock); 983 if (!dev->iommu_param->fault_param || 984 !dev->iommu_param->fault_param->handler) { 985 ret = -EINVAL; 986 goto done_unlock; 987 } 988 fparam = dev->iommu_param->fault_param; 989 if (evt->type == IOMMU_FAULT_PAGE_REQ && evt->last_req) { 990 evt_pending = kzalloc(sizeof(*evt_pending), GFP_ATOMIC); 991 if (!evt_pending) { 992 ret = -ENOMEM; 993 goto done_unlock; 994 } 995 memcpy(evt_pending, evt, sizeof(struct iommu_fault_event)); 996 mutex_lock(&fparam->lock); 997 list_add_tail(&evt_pending->list, &fparam->faults); 998 mutex_unlock(&fparam->lock); 999 } 1000 ret = fparam->handler(evt, fparam->data); 1001 done_unlock: 1002 mutex_unlock(&dev->iommu_param->lock); 1003 return ret; 1004 } 1005 EXPORT_SYMBOL_GPL(iommu_report_device_fault); 1006 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] dhugetlb: keep refcount to 0 while page is actually free in pool
by Liu Shixin 24 Dec '24

24 Dec '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBDF90 -------------------------------- While we split/merge page in dynamic pool, the refcount of page may be increased to 1 due to prep_new_page(), and we then set the refcount to 0. That means there's a time window that the refcount of the free page is not 0. split_huge_pages_set() will scan all pages and try to get the refcount If try to get refcount in the above time window and put_page() after the refcount is set to 0, the refcount will be decreased to -1. It's dangerous if the refcount for page is not 0 when split/merge, so try not to get refcount there. Fixes: 0bc0d0d57eda ("dhugetlb: backport dynamic hugetlb feature") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/hugetlb.c | 4 ++-- mm/internal.h | 4 ++++ mm/page_alloc.c | 26 ++++++++++++++++++++++++++ 3 files changed, 32 insertions(+), 2 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 82a758bb8ac9..191ed8a6b0d0 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3575,8 +3575,8 @@ static void add_new_huge_page_to_pool(struct dhugetlb_pool *hpool, list_add_tail(&page->lru, &hpool->dhugetlb_1G_freelists); hpool->free_unreserved_1G++; } else { - prep_new_page(page, PMD_SHIFT - PAGE_SHIFT, __GFP_COMP, 0); - set_page_count(page, 0); + prep_new_frozen_free_page(page, PMD_SHIFT - PAGE_SHIFT, + __GFP_COMP); list_add_tail(&page->lru, &hpool->dhugetlb_2M_freelists); hpool->free_unreserved_2M++; } diff --git a/mm/internal.h b/mm/internal.h index 72f77379b58f..e50363ddb416 100644 --- a/mm/internal.h +++ b/mm/internal.h @@ -185,6 +185,10 @@ extern void prep_compound_page(struct page *page, unsigned int order); extern int check_new_page(struct page *page); extern void post_alloc_hook(struct page *page, unsigned int order, gfp_t gfp_flags); +#ifdef CONFIG_DYNAMIC_HUGETLB +extern void prep_new_frozen_free_page(struct page *page, unsigned int order, + gfp_t gfp_flags); +#endif extern int user_min_free_kbytes; #if defined CONFIG_COMPACTION || defined CONFIG_CMA diff --git a/mm/page_alloc.c b/mm/page_alloc.c index e2360fe3616d..787bbabc29d0 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -2100,6 +2100,32 @@ void prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags, clear_page_pfmemalloc(page); } +#ifdef CONFIG_DYNAMIC_HUGETLB +/* Similar with prep_new_page without set refcount to 1 */ +void prep_new_frozen_free_page(struct page *page, unsigned int order, + gfp_t gfp_flags) +{ + int i; + + set_page_private(page, 0); + + arch_alloc_page(page, order); + kernel_map_pages(page, 1 << order, 1); + kasan_alloc_pages(page, order); + kernel_poison_pages(page, 1 << order, 1); + set_page_owner(page, order, gfp_flags); + + if (!free_pages_prezeroed() && (gfp_flags & __GFP_ZERO)) + for (i = 0; i < (1 << order); i++) + clear_highpage(page + i); + + if (order && (gfp_flags & __GFP_COMP)) + prep_compound_page(page, order); + + clear_page_pfmemalloc(page); +} +#endif + /* * Go through the free lists for the given migratetype and remove * the smallest available page from the freelists -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ACPI: battery: Fix possible crash when unregistering a battery hook
by Heyuan Wang 24 Dec '24

24 Dec '24

From: Armin Wolf <W_Armin(a)gmx.de> stable inclusion from stable-v4.19.323 commit 76fb2cbf01571926da8ecf6876cc8cb07d3f5183 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBBN6V Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------------------- [ Upstream commit 76959aff14a0012ad6b984ec7686d163deccdc16 ] When a battery hook returns an error when adding a new battery, then the battery hook is automatically unregistered. However the battery hook provider cannot know that, so it will later call battery_hook_unregister() on the already unregistered battery hook, resulting in a crash. Fix this by using the list head to mark already unregistered battery hooks as already being unregistered so that they can be ignored by battery_hook_unregister(). Fixes: fa93854f7a7e ("battery: Add the battery hooking API") Signed-off-by: Armin Wolf <W_Armin(a)gmx.de> Link: https://patch.msgid.link/20241001212835.341788-3-W_Armin@gmx.de Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- drivers/acpi/battery.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c index b741ed87ab3d..46aa0e5e6f8b 100644 --- a/drivers/acpi/battery.c +++ b/drivers/acpi/battery.c @@ -724,7 +724,7 @@ static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook) list_for_each_entry(battery, &acpi_battery_list, list) { hook->remove_battery(battery->bat); } - list_del(&hook->list); + list_del_init(&hook->list); pr_info("extension unregistered: %s\n", hook->name); } @@ -732,7 +732,14 @@ static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook) void battery_hook_unregister(struct acpi_battery_hook *hook) { mutex_lock(&hook_mutex); - battery_hook_unregister_unlocked(hook); + /* + * Ignore already unregistered battery hooks. This might happen + * if a battery hook was previously unloaded due to an error when + * adding a new battery. + */ + if (!list_empty(&hook->list)) + battery_hook_unregister_unlocked(hook); + mutex_unlock(&hook_mutex); } EXPORT_SYMBOL_GPL(battery_hook_unregister); @@ -742,7 +749,6 @@ void battery_hook_register(struct acpi_battery_hook *hook) struct acpi_battery *battery; mutex_lock(&hook_mutex); - INIT_LIST_HEAD(&hook->list); list_add(&hook->list, &battery_hook_list); /* * Now that the driver is registered, we need -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-45009
by Wang Liang 24 Dec '24

24 Dec '24

Matthieu Baerts (NGI0) (2): mptcp: pm: only decrement add_addr_accepted for MPJ req mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow net/mptcp/pm_netlink.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/5] CVE-2024-46765
by Wang Liang 24 Dec '24

24 Dec '24

Anirudh Venkataramanan (1): ice: Consolidate VSI state and flags Jesse Brandeburg (1): ice: fix writeback enable logic Larysa Zaremba (1): ice: protect XDP configuration with a mutex Maciej Fijalkowski (1): ice: allow hot-swapping XDP programs Nick Nunley (1): ice: Remove vlan_ena from vsi structure drivers/net/ethernet/intel/ice/ice.h | 24 ++--- drivers/net/ethernet/intel/ice/ice_ethtool.c | 2 +- drivers/net/ethernet/intel/ice/ice_lib.c | 38 +++++--- drivers/net/ethernet/intel/ice/ice_main.c | 97 ++++++++++---------- drivers/net/ethernet/intel/ice/ice_txrx.c | 63 ++++++------- drivers/net/ethernet/intel/ice/ice_txrx.h | 1 - drivers/net/ethernet/intel/ice/ice_xsk.c | 3 +- 7 files changed, 120 insertions(+), 108 deletions(-) -- 2.34.1

2 6

[PATCH openEuler-22.03-LTS-SP1] igb: Initialize mailbox message for VF reset
by Wang Liang 24 Dec '24

24 Dec '24

From: Tony Nguyen <anthony.l.nguyen(a)intel.com> stable inclusion from stable-v5.10.161 commit f2479c3daaabccbac6c343a737615d0c595c6dc4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRIW CVE: CVE-2022-48949 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit de5dc44370fbd6b46bd7f1a1e00369be54a041c8 upstream. When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. The memory, however, is allocated from the stack meaning that information may be leaked to the VM. Initialize the message buffer to 0 so that no information is passed to the VM in this case. Fixes: 6ddbc4cf1f4d ("igb: Indicate failure on vf reset for empty mac address") Reported-by: Akihiko Odaki <akihiko.odaki(a)daynix.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Reviewed-by: Akihiko Odaki <akihiko.odaki(a)daynix.com> Reviewed-by: Leon Romanovsky <leonro(a)nvidia.com> Link: https://lore.kernel.org/r/20221212190031.3983342-1-anthony.l.nguyen@intel.c… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/intel/igb/igb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c index 7edbad2558e0..f5521d5304c0 100644 --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -7407,7 +7407,7 @@ static void igb_vf_reset_msg(struct igb_adapter *adapter, u32 vf) { struct e1000_hw *hw = &adapter->hw; unsigned char *vf_mac = adapter->vf_data[vf].vf_mac_addresses; - u32 reg, msgbuf[3]; + u32 reg, msgbuf[3] = {}; u8 *addr = (u8 *)(&msgbuf[1]); /* process all the same items cleared in a function level reset */ -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] Bluetooth: Fix not cleanup led when bt_init fails
by Wang Liang 24 Dec '24

24 Dec '24

From: Chen Zhongjin <chenzhongjin(a)huawei.com> stable inclusion from stable-v5.10.159 commit e7b950458156d410509a08c41930b75e72985938 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRIP CVE: CVE-2022-48971 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2f3957c7eb4e07df944169a3e50a4d6790e1c744 ] bt_init() calls bt_leds_init() to register led, but if it fails later, bt_leds_cleanup() is not called to unregister it. This can cause panic if the argument "bluetooth-power" in text is freed and then another led_trigger_register() tries to access it: BUG: unable to handle page fault for address: ffffffffc06d3bc0 RIP: 0010:strcmp+0xc/0x30 Call Trace: <TASK> led_trigger_register+0x10d/0x4f0 led_trigger_register_simple+0x7d/0x100 bt_init+0x39/0xf7 [bluetooth] do_one_initcall+0xd0/0x4e0 Fixes: e64c97b53bc6 ("Bluetooth: Add combined LED trigger for controller power") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/bluetooth/af_bluetooth.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c index b577e65a0c3e..14a917e70f3e 100644 --- a/net/bluetooth/af_bluetooth.c +++ b/net/bluetooth/af_bluetooth.c @@ -741,7 +741,7 @@ static int __init bt_init(void) err = bt_sysfs_init(); if (err < 0) - return err; + goto cleanup_led; err = sock_register(&bt_sock_family_ops); if (err) @@ -777,6 +777,8 @@ static int __init bt_init(void) sock_unregister(PF_BLUETOOTH); cleanup_sysfs: bt_sysfs_cleanup(); +cleanup_led: + bt_leds_cleanup(); return err; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net: tun: Fix use-after-free in tun_detach()
by Wang Liang 24 Dec '24

24 Dec '24

From: Shigeru Yoshida <syoshida(a)redhat.com> stable inclusion from stable-v5.10.158 commit 5f442e1d403e0496bacb74a58e2be7f500695e6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRER CVE: CVE-2022-49014 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5daadc86f27ea4d691e2131c04310d0418c6cd12 ] syzbot reported use-after-free in tun_detach() [1]. This causes call trace like below: ================================================================== BUG: KASAN: use-after-free in notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75 Read of size 8 at addr ffff88807324e2a8 by task syz-executor.0/3673 CPU: 0 PID: 3673 Comm: syz-executor.0 Not tainted 6.1.0-rc5-syzkaller-00044-gcc675d22e422 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15e/0x461 mm/kasan/report.c:395 kasan_report+0xbf/0x1f0 mm/kasan/report.c:495 notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75 call_netdevice_notifiers_info+0x86/0x130 net/core/dev.c:1942 call_netdevice_notifiers_extack net/core/dev.c:1983 [inline] call_netdevice_notifiers net/core/dev.c:1997 [inline] netdev_wait_allrefs_any net/core/dev.c:10237 [inline] netdev_run_todo+0xbc6/0x1100 net/core/dev.c:10351 tun_detach drivers/net/tun.c:704 [inline] tun_chr_close+0xe4/0x190 drivers/net/tun.c:3467 __fput+0x27c/0xa90 fs/file_table.c:320 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xb3d/0x2a30 kernel/exit.c:820 do_group_exit+0xd4/0x2a0 kernel/exit.c:950 get_signal+0x21b1/0x2440 kernel/signal.c:2858 arch_do_signal_or_restart+0x86/0x2300 arch/x86/kernel/signal.c:869 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd The cause of the issue is that sock_put() from __tun_detach() drops last reference count for struct net, and then notifier_call_chain() from netdev_state_change() accesses that struct net. This patch fixes the issue by calling sock_put() from tun_detach() after all necessary accesses for the struct net has done. Fixes: 83c1f36f9880 ("tun: send netlink notification when the device is modified") Reported-by: syzbot+106f9b687cd64ee70cd1(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=96eb7f1ce75ef933697f24eeab928c4a716ede… [1] Signed-off-by: Shigeru Yoshida <syoshida(a)redhat.com> Link: https://lore.kernel.org/r/20221124175134.1589053-1-syoshida@redhat.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/tun.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 98df0b4a3542..d8bb9f1fd916 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -698,7 +698,6 @@ static void __tun_detach(struct tun_file *tfile, bool clean) if (tun) xdp_rxq_info_unreg(&tfile->xdp_rxq); ptr_ring_cleanup(&tfile->tx_ring, tun_ptr_free); - sock_put(&tfile->sk); } } @@ -714,6 +713,9 @@ static void tun_detach(struct tun_file *tfile, bool clean) if (dev) netdev_state_change(dev); rtnl_unlock(); + + if (clean) + sock_put(&tfile->sk); } static void tun_detach_all(struct net_device *dev) -- 2.34.1

2 1