- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1421/1421] include/linux/thread_info.h:59:17: warning: 'ctl' may be used uninitialized
by kernel test robot 08 Feb '25

08 Feb '25

Hi Jens, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: c6e864fee7c3dd416048d129997c7def53cb9ed8 [1421/1421] net: separate out the msghdr copy from ___sys_{send,recv}msg() config: x86_64-buildonly-randconfig-002-20250208 (https://download.01.org/0day-ci/archive/20250208/202502082355.jrzYRRaD-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502082355.jrzYRRaD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502082355.jrzYRRaD-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In function '__sock_release', inlined from 'sock_close' at net/socket.c:1140:2: net/socket.c:579:21: warning: array subscript -1 is outside array bounds of 'struct inode[9078122083518480]' [-Warray-bounds] 579 | sock->ops->release(sock); | ~~~~^~~~~ net/socket.c:580:26: warning: array subscript -1 is outside array bounds of 'struct inode[9078122083518480]' [-Warray-bounds] 580 | sock->sk = NULL; In file included from arch/x86/include/asm/preempt.h:7, from include/linux/preempt.h:81, from include/linux/spinlock.h:51, from include/linux/mmzone.h:9, from include/linux/gfp.h:6, from include/linux/mm.h:11, from net/socket.c:61: In function 'check_object_size', inlined from 'check_copy_size' at include/linux/thread_info.h:90:2, inlined from 'copy_from_user' at include/linux/uaccess.h:143:6, inlined from '____sys_sendmsg' at net/socket.c:2110:7: >> include/linux/thread_info.h:59:17: warning: 'ctl' may be used uninitialized [-Wmaybe-uninitialized] 59 | __check_object_size(ptr, n, to_user); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/thread_info.h: In function '____sys_sendmsg': include/linux/thread_info.h:52:13: note: by argument 1 of type 'const void *' to '__check_object_size' declared here 52 | extern void __check_object_size(const void *ptr, unsigned long n, | ^~~~~~~~~~~~~~~~~~~ net/socket.c:2075:23: note: 'ctl' declared here 2075 | unsigned char ctl[sizeof(struct cmsghdr) + 20] | ^~~ In function 'check_object_size', inlined from 'check_copy_size' at include/linux/thread_info.h:90:2, inlined from 'copy_from_user' at include/linux/uaccess.h:143:6, inlined from '__do_sys_socketcall' at net/socket.c:2618:6, inlined from '__se_sys_socketcall' at net/socket.c:2602:1: include/linux/thread_info.h:59:17: warning: 'a' may be used uninitialized [-Wmaybe-uninitialized] 59 | __check_object_size(ptr, n, to_user); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/thread_info.h: In function '__se_sys_socketcall': include/linux/thread_info.h:52:13: note: by argument 1 of type 'const void *' to '__check_object_size' declared here 52 | extern void __check_object_size(const void *ptr, unsigned long n, | ^~~~~~~~~~~~~~~~~~~ net/socket.c:2604:23: note: 'a' declared here 2604 | unsigned long a[AUDITSC_ARGS]; | ^ net/socket.c:573: warning: Function parameter or member 'inode' not described in '__sock_release' vim +/ctl +59 include/linux/thread_info.h 0f60a8efe4005a Kees Cook 2016-07-12 50 f5509cc18daa7f Kees Cook 2016-06-07 51 #ifdef CONFIG_HARDENED_USERCOPY f5509cc18daa7f Kees Cook 2016-06-07 52 extern void __check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f Kees Cook 2016-06-07 53 bool to_user); f5509cc18daa7f Kees Cook 2016-06-07 54 a85d6b8242dc78 Kees Cook 2016-09-07 55 static __always_inline void check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f Kees Cook 2016-06-07 56 bool to_user) f5509cc18daa7f Kees Cook 2016-06-07 57 { 81409e9e280588 Kees Cook 2016-08-31 58 if (!__builtin_constant_p(n)) f5509cc18daa7f Kees Cook 2016-06-07 @59 __check_object_size(ptr, n, to_user); f5509cc18daa7f Kees Cook 2016-06-07 60 } f5509cc18daa7f Kees Cook 2016-06-07 61 #else f5509cc18daa7f Kees Cook 2016-06-07 62 static inline void check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f Kees Cook 2016-06-07 63 bool to_user) f5509cc18daa7f Kees Cook 2016-06-07 64 { } f5509cc18daa7f Kees Cook 2016-06-07 65 #endif /* CONFIG_HARDENED_USERCOPY */ f5509cc18daa7f Kees Cook 2016-06-07 66 :::::: The code at line 59 was first introduced by commit :::::: f5509cc18daa7f82bcc553be70df2117c8eedc16 mm: Hardened usercopy :::::: TO: Kees Cook <keescook(a)chromium.org> :::::: CC: Kees Cook <keescook(a)chromium.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2722/2722] fs/ceph/snap.o: warning: objtool: ceph_update_snap_trace()+0xb8c: unreachable instruction
by kernel test robot 08 Feb '25

08 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 263072f655dcd6fd63f7d5dd1f9c5553134982fa commit: 4925e6790b8bb3d912820724a224fbe9bf7ad4cf [2722/2722] ceph: blocklist the kclient when receiving corrupted snap trace config: x86_64-buildonly-randconfig-002-20250205 (https://download.01.org/0day-ci/archive/20250208/202502082313.lZnwkvkI-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502082313.lZnwkvkI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502082313.lZnwkvkI-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/ceph/snap.o: warning: objtool: ceph_update_snap_trace()+0xb8c: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2729/2729] mm/damon/core-test.h:284:2: warning: comparison of distinct pointer types ('typeof (__left) *' (aka 'unsigned int *') and 'typeof (__right) *' (aka 'int *'))
by kernel test robot 08 Feb '25

08 Feb '25

Hi SeongJae, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 263072f655dcd6fd63f7d5dd1f9c5553134982fa commit: 83b931be40b2829e20f38356509d8706ea6b6238 [2729/2729] mm/damon/core-test: test damon_set_regions config: x86_64-buildonly-randconfig-004-20250208 (https://download.01.org/0day-ci/archive/20250208/202502082340.S6mQ2xsd-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502082340.S6mQ2xsd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502082340.S6mQ2xsd-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/damon/core.c:13: In file included from include/linux/mm.h:1573: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/damon/core.c:1248: >> mm/damon/core-test.h:284:2: warning: comparison of distinct pointer types ('typeof (__left) *' (aka 'unsigned int *') and 'typeof (__right) *' (aka 'int *')) [-Wcompare-distinct-pointer-types] 284 | KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 3); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:1234:2: note: expanded from macro 'KUNIT_EXPECT_EQ' 1234 | KUNIT_BINARY_EQ_ASSERTION(test, KUNIT_EXPECTATION, left, right) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:871:2: note: expanded from macro 'KUNIT_BINARY_EQ_ASSERTION' 871 | KUNIT_BINARY_EQ_MSG_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 872 | assert_type, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 873 | left, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 874 | right, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 875 | NULL) | ~~~~~ include/kunit/test.h:861:2: note: expanded from macro 'KUNIT_BINARY_EQ_MSG_ASSERTION' 861 | KUNIT_BASE_EQ_MSG_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 862 | kunit_binary_assert, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 863 | KUNIT_INIT_BINARY_ASSERT_STRUCT, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 864 | assert_type, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 865 | left, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 866 | right, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 867 | fmt, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 868 | ##__VA_ARGS__) | ~~~~~~~~~~~~~~ include/kunit/test.h:772:2: note: expanded from macro 'KUNIT_BASE_EQ_MSG_ASSERTION' 772 | KUNIT_BASE_BINARY_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 773 | assert_class, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 774 | ASSERT_CLASS_INIT, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 775 | assert_type, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 776 | left, ==, right, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 777 | fmt, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 778 | ##__VA_ARGS__) | ~~~~~~~~~~~~~~ include/kunit/test.h:748:9: note: expanded from macro 'KUNIT_BASE_BINARY_ASSERTION' 748 | ((void)__typecheck(__left, __right)); \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/minmax.h:20:28: note: expanded from macro '__typecheck' 20 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~ 2 warnings generated. vim +284 mm/damon/core-test.h 269 270 static void damon_test_set_regions(struct kunit *test) 271 { 272 struct damon_target *t = damon_new_target(); 273 struct damon_region *r1 = damon_new_region(4, 16); 274 struct damon_region *r2 = damon_new_region(24, 32); 275 struct damon_addr_range range = {.start = 8, .end = 28}; 276 unsigned long expects[] = {8, 16, 16, 24, 24, 28}; 277 int expect_idx = 0; 278 struct damon_region *r; 279 280 damon_add_region(r1, t); 281 damon_add_region(r2, t); 282 damon_set_regions(t, &range, 1); 283 > 284 KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 3); 285 damon_for_each_region(r, t) { 286 KUNIT_EXPECT_EQ(test, r->ar.start, expects[expect_idx++]); 287 KUNIT_EXPECT_EQ(test, r->ar.end, expects[expect_idx++]); 288 } 289 damon_destroy_target(t); 290 } 291 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1418/1418] mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool'
by kernel test robot 08 Feb '25

08 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [1418/1418] dhugetlb: backport dynamic hugetlb feature config: x86_64-buildonly-randconfig-003-20250207 (https://download.01.org/0day-ci/archive/20250208/202502082245.oXwKH6sI-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502082245.oXwKH6sI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502082245.oXwKH6sI-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/hugetlb.c:13: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/hugetlb.c:35: include/linux/mm_inline.h:33:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 33 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:35:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 35 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ >> mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^ mm/hugetlb.c:1370:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^ | static In file included from mm/hugetlb.c:14: include/linux/mempolicy.h:329:13: warning: unused function '__do_mbind' [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ 5 warnings generated. vim +/free_huge_page_to_dhugetlb_pool +1370 mm/hugetlb.c 1324 1325 #ifdef CONFIG_DYNAMIC_HUGETLB 1326 static void free_huge_page_to_dhugetlb_pool(struct page *page, 1327 bool restore_reserve) 1328 { 1329 struct hstate *h = page_hstate(page); 1330 struct dhugetlb_pool *hpool; 1331 1332 hpool = get_dhugetlb_pool_from_dhugetlb_pagelist(page); 1333 if (unlikely(!hpool)) { 1334 pr_err("dhugetlb: free error: get hpool failed\n"); 1335 return; 1336 } 1337 1338 spin_lock(&hpool->lock); 1339 ClearPagePool(page); 1340 set_compound_page_dtor(page, NULL_COMPOUND_DTOR); 1341 if (!hstate_is_gigantic(h)) { 1342 list_add(&page->lru, &hpool->dhugetlb_2M_freelists); 1343 hpool->free_reserved_2M++; 1344 hpool->used_2M--; 1345 if (restore_reserve) { 1346 hpool->mmap_reserved_2M++; 1347 trace_dhugetlb_acct_memory(hpool, 1348 hpool->mmap_reserved_2M, 1349 DHUGETLB_RESV_2M); 1350 } 1351 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_2M, 1352 DHUGETLB_FREE_2M); 1353 } else { 1354 list_add(&page->lru, &hpool->dhugetlb_1G_freelists); 1355 hpool->free_reserved_1G++; 1356 hpool->used_1G--; 1357 if (restore_reserve) { 1358 hpool->mmap_reserved_1G++; 1359 trace_dhugetlb_acct_memory(hpool, 1360 hpool->mmap_reserved_1G, 1361 DHUGETLB_RESV_1G); 1362 } 1363 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_1G, 1364 DHUGETLB_FREE_1G); 1365 } 1366 spin_unlock(&hpool->lock); 1367 dhugetlb_pool_put(hpool); 1368 } 1369 #else > 1370 void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) 1371 { 1372 } 1373 #endif 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1418/1418] mm/.tmp_ioremap.o: warning: objtool: missing symbol for section .text
by kernel test robot 08 Feb '25

08 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: 004cface9c1c0b6351473934a4ce452193e05b07 [1418/1418] mm: Move vmap_range from mm/ioremap.c to mm/vmalloc.c config: x86_64-buildonly-randconfig-004-20250207 (https://download.01.org/0day-ci/archive/20250208/202502082225.bZGoGhTq-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502082225.bZGoGhTq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502082225.bZGoGhTq-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/.tmp_ioremap.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1899/1899] mm/memcontrol.c:4428:12: warning: 'mem_cgroup_check_swap_for_v1' defined but not used
by kernel test robot 08 Feb '25

08 Feb '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 96ebabc25b2677a2a225de204946e424cf3887c1 commit: a095a940f784db58ea4e87df361f9a4fd0dd977f [1899/1899] memcg: add restrict to swap to cgroup1 config: x86_64-buildonly-randconfig-001-20250207 (https://download.01.org/0day-ci/archive/20250208/202502082247.kdBxrDeT-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502082247.kdBxrDeT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502082247.kdBxrDeT-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/memcontrol.c:4428:12: warning: 'mem_cgroup_check_swap_for_v1' defined but not used [-Wunused-function] 4428 | static int mem_cgroup_check_swap_for_v1(struct folio *folio, swp_entry_t entry) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/mem_cgroup_check_swap_for_v1 +4428 mm/memcontrol.c 4427 > 4428 static int mem_cgroup_check_swap_for_v1(struct folio *folio, swp_entry_t entry) 4429 { 4430 return 0; 4431 } 4432 #endif 4433 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1418/1418] mm/memcontrol.c:432:54: warning: array subscript nid is outside array bounds of 'struct mem_cgroup_per_node *[0]'
by kernel test robot 08 Feb '25

08 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: fae91d6d8be5e20c47e459dbeb3d43bd5f9486f4 [1418/1418] mm/list_lru.c: set bit in memcg shrinker bitmap on first list_lru item appearance config: arm64-randconfig-002-20250207 (https://download.01.org/0day-ci/archive/20250208/202502082031.V2tZWUQg-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502082031.V2tZWUQg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502082031.V2tZWUQg-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/page_counter.h:6, from mm/memcontrol.c:34: mm/memcontrol.c: In function 'mem_cgroup_get_max': include/linux/kernel.h:845:45: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 845 | #define min(x, y) __careful_cmp(x, y, <) | ^ include/linux/kernel.h:828:30: note: in definition of macro '__cmp' 828 | #define __cmp(x, y, op) ((x) op (y) ? (x) : (y)) | ^~ include/linux/kernel.h:845:25: note: in expansion of macro '__careful_cmp' 845 | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~ mm/memcontrol.c:1365:28: note: in expansion of macro 'min' 1365 | swap_max = min(swap_max, (unsigned long)total_swap_pages); | ^~~ In file included from mm/memcontrol.c:35: In function 'mem_cgroup_nodeinfo', inlined from 'invalidate_reclaim_iterators' at mm/memcontrol.c:1042:9, inlined from 'mem_cgroup_css_released' at mm/memcontrol.c:4526:2: include/linux/memcontrol.h:352:31: warning: array subscript 0 is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 352 | return memcg->nodeinfo[nid]; | ~~~~~~~~~~~~~~~^~~~~ include/linux/memcontrol.h: In function 'mem_cgroup_css_released': include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ In function 'free_mem_cgroup_per_node_info', inlined from '__mem_cgroup_free' at mm/memcontrol.c:4353:3: mm/memcontrol.c:4339:57: warning: array subscript 0 is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 4339 | struct mem_cgroup_per_node *pn = memcg->nodeinfo[node]; | ~~~~~~~~~~~~~~~^~~~~~ include/linux/memcontrol.h: In function '__mem_cgroup_free': include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ In function 'alloc_mem_cgroup_per_node_info', inlined from 'mem_cgroup_alloc' at mm/memcontrol.c:4388:7: mm/memcontrol.c:4333:24: warning: array subscript 0 is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 4333 | memcg->nodeinfo[node] = pn; | ~~~~~~~~~~~~~~~^~~~~~ include/linux/memcontrol.h: In function 'mem_cgroup_alloc': include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ In file included from include/linux/compiler.h:245, from arch/arm64/include/asm/atomic.h:23, from include/linux/atomic.h:7, from include/linux/page_counter.h:5: In function 'memcg_alloc_shrinker_maps', inlined from 'mem_cgroup_css_online' at mm/memcontrol.c:4485:6: mm/memcontrol.c:391:51: warning: array subscript 0 is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 391 | rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_map, map); | ~~~~~~~~~~~~~~~^~~~~ arch/arm64/include/asm/barrier.h:95:42: note: in definition of macro '__smp_store_release' 95 | : "=Q" (*p) \ | ^ include/linux/rcupdate.h:411:17: note: in expansion of macro 'smp_store_release' 411 | smp_store_release(&p, RCU_INITIALIZER((typeof(p))_r_a_p__v)); \ | ^~~~~~~~~~~~~~~~~ mm/memcontrol.c:391:17: note: in expansion of macro 'rcu_assign_pointer' 391 | rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_map, map); | ^~~~~~~~~~~~~~~~~~ include/linux/memcontrol.h: In function 'mem_cgroup_css_online': include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ mm/memcontrol.c: In function 'memcg_set_shrinker_bit': >> mm/memcontrol.c:432:54: warning: array subscript nid is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 432 | map = rcu_dereference(memcg->nodeinfo[nid]->shrinker_map); | ~~~~~~~~~~~~~~~^~~~~ include/linux/compiler.h:252:36: note: in definition of macro '__READ_ONCE' 252 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^ include/linux/rcupdate.h:349:55: note: in expansion of macro 'READ_ONCE' 349 | typeof(*p) *________p1 = (typeof(*p) *__force)READ_ONCE(p); \ | ^~~~~~~~~ include/linux/rcupdate.h:486:9: note: in expansion of macro '__rcu_dereference_check' 486 | __rcu_dereference_check((p), (c) || rcu_read_lock_held(), __rcu) | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/rcupdate.h:544:28: note: in expansion of macro 'rcu_dereference_check' 544 | #define rcu_dereference(p) rcu_dereference_check(p, 0) | ^~~~~~~~~~~~~~~~~~~~~ mm/memcontrol.c:432:23: note: in expansion of macro 'rcu_dereference' 432 | map = rcu_dereference(memcg->nodeinfo[nid]->shrinker_map); | ^~~~~~~~~~~~~~~ include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ In function 'mem_cgroup_nodeinfo', inlined from 'mem_cgroup_lruvec' at include/linux/memcontrol.h:375:7, inlined from 'mem_cgroup_node_nr_lru_pages' at mm/memcontrol.c:722:26: include/linux/memcontrol.h:352:31: warning: array subscript <unknown> is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 352 | return memcg->nodeinfo[nid]; | ~~~~~~~~~~~~~~~^~~~~ include/linux/memcontrol.h: In function 'mem_cgroup_node_nr_lru_pages': include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ In function 'mem_cgroup_nodeinfo', inlined from 'mem_cgroup_iter' at mm/memcontrol.c:937:8: include/linux/memcontrol.h:352:31: warning: array subscript <unknown> is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 352 | return memcg->nodeinfo[nid]; | ~~~~~~~~~~~~~~~^~~~~ include/linux/memcontrol.h: In function 'mem_cgroup_iter': include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ mm/memcontrol.c: In function '__mem_cgroup_threshold': mm/memcontrol.c:3473:45: warning: array subscript i is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3473 | for (; i >= 0 && unlikely(t->entries[i].threshold > usage); i--) | ~~~~~~~~~~^~~ include/linux/compiler.h:77:45: note: in definition of macro 'unlikely' 77 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ include/linux/memcontrol.h:162:37: note: while referencing 'entries' 162 | struct mem_cgroup_threshold entries[0]; | ^~~~~~~ mm/memcontrol.c:3474:42: warning: array subscript i is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3474 | eventfd_signal(t->entries[i].eventfd, 1); | ~~~~~~~~~~^~~ include/linux/memcontrol.h:162:37: note: while referencing 'entries' 162 | struct mem_cgroup_threshold entries[0]; | ^~~~~~~ mm/memcontrol.c:3485:50: warning: array subscript i is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3485 | for (; i < t->size && unlikely(t->entries[i].threshold <= usage); i++) | ~~~~~~~~~~^~~ include/linux/compiler.h:77:45: note: in definition of macro 'unlikely' 77 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ include/linux/memcontrol.h:162:37: note: while referencing 'entries' 162 | struct mem_cgroup_threshold entries[0]; | ^~~~~~~ mm/memcontrol.c:3486:42: warning: array subscript i is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3486 | eventfd_signal(t->entries[i].eventfd, 1); | ~~~~~~~~~~^~~ include/linux/memcontrol.h:162:37: note: while referencing 'entries' 162 | struct mem_cgroup_threshold entries[0]; | ^~~~~~~ mm/memcontrol.c: In function 'memcg_check_events.isra': mm/memcontrol.c:502:31: warning: array subscript 0 is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 502 | return memcg->nodeinfo[nid]; | ~~~~~~~~~~~~~~~^~~~~ include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ mm/memcontrol.c: In function '__mem_cgroup_usage_unregister_event': mm/memcontrol.c:3680:49: warning: array subscript i is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3680 | if (thresholds->primary->entries[i].eventfd == eventfd) | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~ include/linux/memcontrol.h:162:37: note: while referencing 'entries' 162 | struct mem_cgroup_threshold entries[0]; | ^~~~~~~ mm/memcontrol.c:3683:63: warning: array subscript i is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3683 | new->entries[j] = thresholds->primary->entries[i]; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~ include/linux/memcontrol.h:162:37: note: while referencing 'entries' 162 | struct mem_cgroup_threshold entries[0]; | ^~~~~~~ mm/memcontrol.c:3683:29: warning: array subscript j is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3683 | new->entries[j] = thresholds->primary->entries[i]; | ~~~~~~~~~~~~^~~ include/linux/memcontrol.h:162:37: note: while referencing 'entries' 162 | struct mem_cgroup_threshold entries[0]; | ^~~~~~~ mm/memcontrol.c:3684:33: warning: array subscript j is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3684 | if (new->entries[j].threshold <= usage) { | ~~~~~~~~~~~~^~~ include/linux/memcontrol.h:162:37: note: while referencing 'entries' vim +432 mm/memcontrol.c 373 374 static int memcg_alloc_shrinker_maps(struct mem_cgroup *memcg) 375 { 376 struct memcg_shrinker_map *map; 377 int nid, size, ret = 0; 378 379 if (mem_cgroup_is_root(memcg)) 380 return 0; 381 382 mutex_lock(&memcg_shrinker_map_mutex); 383 size = memcg_shrinker_map_size; 384 for_each_node(nid) { 385 map = kvzalloc(sizeof(*map) + size, GFP_KERNEL); 386 if (!map) { 387 memcg_free_shrinker_maps(memcg); 388 ret = -ENOMEM; 389 break; 390 } > 391 rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_map, map); 392 } 393 mutex_unlock(&memcg_shrinker_map_mutex); 394 395 return ret; 396 } 397 398 int memcg_expand_shrinker_maps(int new_id) 399 { 400 int size, old_size, ret = 0; 401 struct mem_cgroup *memcg; 402 403 size = DIV_ROUND_UP(new_id + 1, BITS_PER_LONG) * sizeof(unsigned long); 404 old_size = memcg_shrinker_map_size; 405 if (size <= old_size) 406 return 0; 407 408 mutex_lock(&memcg_shrinker_map_mutex); 409 if (!root_mem_cgroup) 410 goto unlock; 411 412 for_each_mem_cgroup(memcg) { 413 if (mem_cgroup_is_root(memcg)) 414 continue; 415 ret = memcg_expand_one_shrinker_map(memcg, size, old_size); 416 if (ret) 417 goto unlock; 418 } 419 unlock: 420 if (!ret) 421 memcg_shrinker_map_size = size; 422 mutex_unlock(&memcg_shrinker_map_mutex); 423 return ret; 424 } 425 426 void memcg_set_shrinker_bit(struct mem_cgroup *memcg, int nid, int shrinker_id) 427 { 428 if (shrinker_id >= 0 && memcg && !mem_cgroup_is_root(memcg)) { 429 struct memcg_shrinker_map *map; 430 431 rcu_read_lock(); > 432 map = rcu_dereference(memcg->nodeinfo[nid]->shrinker_map); 433 set_bit(shrinker_id, map->map); 434 rcu_read_unlock(); 435 } 436 } 437 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1899/1899] mm/dynamic_pool.c:1612:51: warning: variable 'ret' is uninitialized when used here
by kernel test robot 08 Feb '25

08 Feb '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 8673e7441a723dd5e885e372a4d0351658286304 commit: cf98ffbc116bc49dc4506c68e20b02e26519ad35 [1899/1899] mm/dynamic_pool: fill dpool with pagelist config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20250208/202502081751.f1v777Vf-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502081751.f1v777Vf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502081751.f1v777Vf-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/dynamic_pool.c:10: In file included from include/linux/memblock.h:12: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ mm/dynamic_pool.c:836:6: warning: variable 'type' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] 836 | if (!dpool->online) | ^~~~~~~~~~~~~~ mm/dynamic_pool.c:865:36: note: uninitialized use occurs here 865 | trace_dpool_alloc_hugepage(dpool, type, folio, pool->free_huge_pages, | ^~~~ mm/dynamic_pool.c:836:2: note: remove the 'if' if its condition is always false 836 | if (!dpool->online) | ^~~~~~~~~~~~~~~~~~~ 837 | goto unlock; | ~~~~~~~~~~~ mm/dynamic_pool.c:826:10: note: initialize the variable 'type' to silence this warning 826 | int type; | ^ | = 0 mm/dynamic_pool.c:836:6: warning: variable 'pool' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] 836 | if (!dpool->online) | ^~~~~~~~~~~~~~ mm/dynamic_pool.c:865:49: note: uninitialized use occurs here 865 | trace_dpool_alloc_hugepage(dpool, type, folio, pool->free_huge_pages, | ^~~~ mm/dynamic_pool.c:836:2: note: remove the 'if' if its condition is always false 836 | if (!dpool->online) | ^~~~~~~~~~~~~~~~~~~ 837 | goto unlock; | ~~~~~~~~~~~ mm/dynamic_pool.c:823:25: note: initialize the variable 'pool' to silence this warning 823 | struct pages_pool *pool; | ^ | = NULL >> mm/dynamic_pool.c:1612:51: warning: variable 'ret' is uninitialized when used here [-Wuninitialized] 1612 | pr_err("init failed, create failed. ret: %d\n", ret); | ^~~ include/linux/printk.h:498:33: note: expanded from macro 'pr_err' 498 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~~~~ include/linux/printk.h:455:60: note: expanded from macro 'printk' 455 | #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__) | ^~~~~~~~~~~ include/linux/printk.h:427:19: note: expanded from macro 'printk_index_wrap' 427 | _p_func(_fmt, ##__VA_ARGS__); \ | ^~~~~~~~~~~ mm/dynamic_pool.c:1586:9: note: initialize the variable 'ret' to silence this warning 1586 | int ret; | ^ | = 0 8 warnings generated. vim +/ret +1612 mm/dynamic_pool.c 1582 1583 int dpool_init(struct dpool_info *arg) 1584 { 1585 struct dynamic_pool *dpool; 1586 int ret; 1587 1588 if (!dpool_enabled) 1589 return -EINVAL; 1590 1591 if (!arg || !arg->memcg || arg->range_cnt <= 0) { 1592 pr_err("init failed, arg is invalid\n"); 1593 return -EINVAL; 1594 } 1595 1596 mutex_lock(&dpool_mutex); 1597 1598 if (dpool_global_pool || arg->memcg->dpool) { 1599 pr_err("init failed, dpool is already exist\n"); 1600 ret = -EINVAL; 1601 goto unlock; 1602 } 1603 1604 if (!(arg->memcg->css.cgroup->self.flags & CSS_ONLINE)) { 1605 pr_err("init failed, memcg is not online\n"); 1606 ret = -EINVAL; 1607 goto unlock; 1608 } 1609 1610 dpool = dpool_create(arg->memcg, &pagelist_dpool_ops); 1611 if (!dpool) { > 1612 pr_err("init failed, create failed. ret: %d\n", ret); 1613 ret = -ENOMEM; 1614 goto unlock; 1615 } 1616 1617 dpool_global_pool = dpool; 1618 1619 BUG_ON(!dpool->ops->fill_pool); 1620 ret = dpool->ops->fill_pool(dpool, arg); 1621 if (ret) 1622 dpool_put(dpool); 1623 1624 unlock: 1625 mutex_unlock(&dpool_mutex); 1626 1627 return ret; 1628 } 1629 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2729/2729] mm/khugepaged.c:1646: warning: Function parameter or member 'reliable' not described in 'collapse_file'
by kernel test robot 08 Feb '25

08 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: d446fe23ba300d0cceac22dff0e7e9a8d21646e1 commit: 6263994761a3d3ad6e5fa3beff9ca8cbd38d3bf3 [2729/2729] mm: thp: Add memory reliable support for hugepaged collapse config: x86_64-buildonly-randconfig-002-20250208 (https://download.01.org/0day-ci/archive/20250208/202502081316.Lfy85pbg-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502081316.Lfy85pbg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502081316.Lfy85pbg-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/khugepaged.c:102: warning: Function parameter or member 'nr_pte_mapped_thp' not described in 'mm_slot' mm/khugepaged.c:102: warning: Function parameter or member 'pte_mapped_thp' not described in 'mm_slot' mm/khugepaged.c:1443: warning: Function parameter or member 'mm' not described in 'collapse_pte_mapped_thp' mm/khugepaged.c:1443: warning: Function parameter or member 'addr' not described in 'collapse_pte_mapped_thp' mm/khugepaged.c:1646: warning: Function parameter or member 'mm' not described in 'collapse_file' mm/khugepaged.c:1646: warning: Function parameter or member 'file' not described in 'collapse_file' mm/khugepaged.c:1646: warning: Function parameter or member 'start' not described in 'collapse_file' mm/khugepaged.c:1646: warning: Function parameter or member 'hpage' not described in 'collapse_file' mm/khugepaged.c:1646: warning: Function parameter or member 'node' not described in 'collapse_file' >> mm/khugepaged.c:1646: warning: Function parameter or member 'reliable' not described in 'collapse_file' vim +1646 mm/khugepaged.c f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1623 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1624 /** 99cb0dbd47a15d Song Liu 2019-09-23 1625 * collapse_file - collapse filemap/tmpfs/shmem pages into huge one. f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1626 * f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1627 * Basic scheme is simple, details are more complex: 87c460a0bded56 Hugh Dickins 2018-11-30 1628 * - allocate and lock a new huge page; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1629 * - scan page cache replacing old pages with the new one 99cb0dbd47a15d Song Liu 2019-09-23 1630 * + swap/gup in pages if necessary; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1631 * + fill in gaps; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1632 * + keep old pages around in case rollback is required; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1633 * - if replacing succeeds: f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1634 * + copy data over; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1635 * + free old pages; 87c460a0bded56 Hugh Dickins 2018-11-30 1636 * + unlock huge page; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1637 * - if replacing failed; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1638 * + put all pages back and unfreeze them; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1639 * + restore gaps in the page cache; 87c460a0bded56 Hugh Dickins 2018-11-30 1640 * + unlock and free huge page; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1641 */ 579c571e2efdb8 Song Liu 2019-09-23 1642 static void collapse_file(struct mm_struct *mm, 579c571e2efdb8 Song Liu 2019-09-23 1643 struct file *file, pgoff_t start, 6263994761a3d3 Ma Wupeng 2022-11-11 1644 struct page **hpage, int node, 6263994761a3d3 Ma Wupeng 2022-11-11 1645 bool reliable) f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 @1646 { 579c571e2efdb8 Song Liu 2019-09-23 1647 struct address_space *mapping = file->f_mapping; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1648 gfp_t gfp; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1649 struct page *new_page; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1650 pgoff_t index, end = start + HPAGE_PMD_NR; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1651 LIST_HEAD(pagelist); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1652 XA_STATE_ORDER(xas, &mapping->i_pages, start, HPAGE_PMD_ORDER); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1653 int nr_none = 0, result = SCAN_SUCCEED; 99cb0dbd47a15d Song Liu 2019-09-23 1654 bool is_shmem = shmem_file(file); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1655 99cb0dbd47a15d Song Liu 2019-09-23 1656 VM_BUG_ON(!IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS) && !is_shmem); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1657 VM_BUG_ON(start & (HPAGE_PMD_NR - 1)); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1658 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1659 /* Only allocate from the target node */ 41b6167e8f746b Michal Hocko 2017-01-10 1660 gfp = alloc_hugepage_khugepaged_gfpmask() | __GFP_THISNODE; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1661 6263994761a3d3 Ma Wupeng 2022-11-11 1662 if (reliable) 6263994761a3d3 Ma Wupeng 2022-11-11 1663 gfp |= GFP_RELIABLE; 6263994761a3d3 Ma Wupeng 2022-11-11 1664 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1665 new_page = khugepaged_alloc_page(hpage, gfp, node); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1666 if (!new_page) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1667 result = SCAN_ALLOC_HUGE_PAGE_FAIL; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1668 goto out; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1669 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1670 d9eb1ea2bf8734 Johannes Weiner 2020-06-03 1671 if (unlikely(mem_cgroup_charge(new_page, mm, gfp))) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1672 result = SCAN_CGROUP_CHARGE_FAIL; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1673 goto out; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1674 } 9d82c69438d0df Johannes Weiner 2020-06-03 1675 count_memcg_page_event(new_page, THP_COLLAPSE_ALLOC); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1676 95feeabb77149f Hugh Dickins 2018-11-30 1677 /* This will be less messy when we use multi-index entries */ 95feeabb77149f Hugh Dickins 2018-11-30 1678 do { 95feeabb77149f Hugh Dickins 2018-11-30 1679 xas_lock_irq(&xas); 95feeabb77149f Hugh Dickins 2018-11-30 1680 xas_create_range(&xas); 95feeabb77149f Hugh Dickins 2018-11-30 1681 if (!xas_error(&xas)) 95feeabb77149f Hugh Dickins 2018-11-30 1682 break; 95feeabb77149f Hugh Dickins 2018-11-30 1683 xas_unlock_irq(&xas); 95feeabb77149f Hugh Dickins 2018-11-30 1684 if (!xas_nomem(&xas, GFP_KERNEL)) { 95feeabb77149f Hugh Dickins 2018-11-30 1685 result = SCAN_FAIL; 95feeabb77149f Hugh Dickins 2018-11-30 1686 goto out; 95feeabb77149f Hugh Dickins 2018-11-30 1687 } 95feeabb77149f Hugh Dickins 2018-11-30 1688 } while (1); 95feeabb77149f Hugh Dickins 2018-11-30 1689 042a30824871fa Hugh Dickins 2018-11-30 1690 __SetPageLocked(new_page); 99cb0dbd47a15d Song Liu 2019-09-23 1691 if (is_shmem) 042a30824871fa Hugh Dickins 2018-11-30 1692 __SetPageSwapBacked(new_page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1693 new_page->index = start; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1694 new_page->mapping = mapping; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1695 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1696 /* 87c460a0bded56 Hugh Dickins 2018-11-30 1697 * At this point the new_page is locked and not up-to-date. 87c460a0bded56 Hugh Dickins 2018-11-30 1698 * It's safe to insert it into the page cache, because nobody would 87c460a0bded56 Hugh Dickins 2018-11-30 1699 * be able to map it or use it in another way until we unlock it. f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1700 */ f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1701 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1702 xas_set(&xas, start); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1703 for (index = start; index < end; index++) { 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1704 struct page *page = xas_next(&xas); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1705 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1706 VM_BUG_ON(index != xas.xa_index); 99cb0dbd47a15d Song Liu 2019-09-23 1707 if (is_shmem) { 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1708 if (!page) { 701270fa193aad Hugh Dickins 2018-11-30 1709 /* 99cb0dbd47a15d Song Liu 2019-09-23 1710 * Stop if extent has been truncated or 99cb0dbd47a15d Song Liu 2019-09-23 1711 * hole-punched, and is now completely 99cb0dbd47a15d Song Liu 2019-09-23 1712 * empty. 701270fa193aad Hugh Dickins 2018-11-30 1713 */ 701270fa193aad Hugh Dickins 2018-11-30 1714 if (index == start) { 701270fa193aad Hugh Dickins 2018-11-30 1715 if (!xas_next_entry(&xas, end - 1)) { 701270fa193aad Hugh Dickins 2018-11-30 1716 result = SCAN_TRUNCATED; 042a30824871fa Hugh Dickins 2018-11-30 1717 goto xa_locked; 701270fa193aad Hugh Dickins 2018-11-30 1718 } 701270fa193aad Hugh Dickins 2018-11-30 1719 xas_set(&xas, index); 701270fa193aad Hugh Dickins 2018-11-30 1720 } 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1721 if (!shmem_charge(mapping->host, 1)) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1722 result = SCAN_FAIL; 042a30824871fa Hugh Dickins 2018-11-30 1723 goto xa_locked; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1724 } 4101196b19d7f9 Matthew Wilcox (Oracle 2019-09-23 1725) xas_store(&xas, new_page); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1726 nr_none++; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1727 continue; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1728 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1729 3159f943aafdba Matthew Wilcox 2017-11-03 1730 if (xa_is_value(page) || !PageUptodate(page)) { 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1731 xas_unlock_irq(&xas); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1732 /* swap in or instantiate fallocated page */ f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1733 if (shmem_getpage(mapping->host, index, &page, f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1734 SGP_NOHUGE)) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1735 result = SCAN_FAIL; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1736 goto xa_unlocked; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1737 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1738 } else if (trylock_page(page)) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1739 get_page(page); 042a30824871fa Hugh Dickins 2018-11-30 1740 xas_unlock_irq(&xas); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1741 } else { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1742 result = SCAN_PAGE_LOCK; 042a30824871fa Hugh Dickins 2018-11-30 1743 goto xa_locked; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1744 } 99cb0dbd47a15d Song Liu 2019-09-23 1745 } else { /* !is_shmem */ 99cb0dbd47a15d Song Liu 2019-09-23 1746 if (!page || xa_is_value(page)) { 99cb0dbd47a15d Song Liu 2019-09-23 1747 xas_unlock_irq(&xas); 99cb0dbd47a15d Song Liu 2019-09-23 1748 page_cache_sync_readahead(mapping, &file->f_ra, 99cb0dbd47a15d Song Liu 2019-09-23 1749 file, index, e5a59d308f52bb David Howells 2020-09-04 1750 end - index); 99cb0dbd47a15d Song Liu 2019-09-23 1751 /* drain pagevecs to help isolate_lru_page() */ 99cb0dbd47a15d Song Liu 2019-09-23 1752 lru_add_drain(); 99cb0dbd47a15d Song Liu 2019-09-23 1753 page = find_lock_page(mapping, index); 99cb0dbd47a15d Song Liu 2019-09-23 1754 if (unlikely(page == NULL)) { 99cb0dbd47a15d Song Liu 2019-09-23 1755 result = SCAN_FAIL; 99cb0dbd47a15d Song Liu 2019-09-23 1756 goto xa_unlocked; 99cb0dbd47a15d Song Liu 2019-09-23 1757 } 75f360696ce9d8 Song Liu 2019-11-30 1758 } else if (PageDirty(page)) { 75f360696ce9d8 Song Liu 2019-11-30 1759 /* 75f360696ce9d8 Song Liu 2019-11-30 1760 * khugepaged only works on read-only fd, 75f360696ce9d8 Song Liu 2019-11-30 1761 * so this page is dirty because it hasn't 75f360696ce9d8 Song Liu 2019-11-30 1762 * been flushed since first write. There 75f360696ce9d8 Song Liu 2019-11-30 1763 * won't be new dirty pages. 75f360696ce9d8 Song Liu 2019-11-30 1764 * 75f360696ce9d8 Song Liu 2019-11-30 1765 * Trigger async flush here and hope the 75f360696ce9d8 Song Liu 2019-11-30 1766 * writeback is done when khugepaged 75f360696ce9d8 Song Liu 2019-11-30 1767 * revisits this page. 75f360696ce9d8 Song Liu 2019-11-30 1768 * 75f360696ce9d8 Song Liu 2019-11-30 1769 * This is a one-off situation. We are not 75f360696ce9d8 Song Liu 2019-11-30 1770 * forcing writeback in loop. 75f360696ce9d8 Song Liu 2019-11-30 1771 */ 75f360696ce9d8 Song Liu 2019-11-30 1772 xas_unlock_irq(&xas); 75f360696ce9d8 Song Liu 2019-11-30 1773 filemap_flush(mapping); 75f360696ce9d8 Song Liu 2019-11-30 1774 result = SCAN_FAIL; 75f360696ce9d8 Song Liu 2019-11-30 1775 goto xa_unlocked; ca1ab8b4a53297 Rongwei Wang 2021-11-15 1776 } else if (PageWriteback(page)) { ca1ab8b4a53297 Rongwei Wang 2021-11-15 1777 xas_unlock_irq(&xas); ca1ab8b4a53297 Rongwei Wang 2021-11-15 1778 result = SCAN_FAIL; ca1ab8b4a53297 Rongwei Wang 2021-11-15 1779 goto xa_unlocked; 99cb0dbd47a15d Song Liu 2019-09-23 1780 } else if (trylock_page(page)) { 99cb0dbd47a15d Song Liu 2019-09-23 1781 get_page(page); 99cb0dbd47a15d Song Liu 2019-09-23 1782 xas_unlock_irq(&xas); 99cb0dbd47a15d Song Liu 2019-09-23 1783 } else { 99cb0dbd47a15d Song Liu 2019-09-23 1784 result = SCAN_PAGE_LOCK; 99cb0dbd47a15d Song Liu 2019-09-23 1785 goto xa_locked; 99cb0dbd47a15d Song Liu 2019-09-23 1786 } 99cb0dbd47a15d Song Liu 2019-09-23 1787 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1788 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1789 /* b93b016313b3ba Matthew Wilcox 2018-04-10 1790 * The page must be locked, so we can drop the i_pages lock f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1791 * without racing with truncate. f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1792 */ f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1793 VM_BUG_ON_PAGE(!PageLocked(page), page); 4655e5e5f38726 Song Liu 2019-11-15 1794 4655e5e5f38726 Song Liu 2019-11-15 1795 /* make sure the page is up to date */ 4655e5e5f38726 Song Liu 2019-11-15 1796 if (unlikely(!PageUptodate(page))) { 4655e5e5f38726 Song Liu 2019-11-15 1797 result = SCAN_FAIL; 4655e5e5f38726 Song Liu 2019-11-15 1798 goto out_unlock; 4655e5e5f38726 Song Liu 2019-11-15 1799 } 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1800 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1801 /* 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1802 * If file was truncated then extended, or hole-punched, before 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1803 * we locked the first page, then a THP might be there already. 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1804 */ 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1805 if (PageTransCompound(page)) { 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1806 result = SCAN_PAGE_COMPOUND; 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1807 goto out_unlock; 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1808 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1809 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1810 if (page_mapping(page) != mapping) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1811 result = SCAN_TRUNCATED; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1812 goto out_unlock; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1813 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1814 ca1ab8b4a53297 Rongwei Wang 2021-11-15 1815 if (!is_shmem && (PageDirty(page) || ca1ab8b4a53297 Rongwei Wang 2021-11-15 1816 PageWriteback(page))) { 4655e5e5f38726 Song Liu 2019-11-15 1817 /* 4655e5e5f38726 Song Liu 2019-11-15 1818 * khugepaged only works on read-only fd, so this 4655e5e5f38726 Song Liu 2019-11-15 1819 * page is dirty because it hasn't been flushed 4655e5e5f38726 Song Liu 2019-11-15 1820 * since first write. 4655e5e5f38726 Song Liu 2019-11-15 1821 */ 4655e5e5f38726 Song Liu 2019-11-15 1822 result = SCAN_FAIL; 4655e5e5f38726 Song Liu 2019-11-15 1823 goto out_unlock; 4655e5e5f38726 Song Liu 2019-11-15 1824 } 4655e5e5f38726 Song Liu 2019-11-15 1825 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1826 if (isolate_lru_page(page)) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1827 result = SCAN_DEL_PAGE_LRU; 042a30824871fa Hugh Dickins 2018-11-30 1828 goto out_unlock; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1829 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1830 99cb0dbd47a15d Song Liu 2019-09-23 1831 if (page_has_private(page) && 99cb0dbd47a15d Song Liu 2019-09-23 1832 !try_to_release_page(page, GFP_KERNEL)) { 99cb0dbd47a15d Song Liu 2019-09-23 1833 result = SCAN_PAGE_HAS_PRIVATE; 2f33a706027c94 Hugh Dickins 2020-05-27 1834 putback_lru_page(page); 99cb0dbd47a15d Song Liu 2019-09-23 1835 goto out_unlock; 99cb0dbd47a15d Song Liu 2019-09-23 1836 } 99cb0dbd47a15d Song Liu 2019-09-23 1837 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1838 if (page_mapped(page)) 977fbdcd5986c9 Matthew Wilcox 2018-01-31 1839 unmap_mapping_pages(mapping, index, 1, false); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1840 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1841 xas_lock_irq(&xas); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1842 xas_set(&xas, index); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1843 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1844 VM_BUG_ON_PAGE(page != xas_load(&xas), page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1845 VM_BUG_ON_PAGE(page_mapped(page), page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1846 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1847 /* f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1848 * The page is expected to have page_count() == 3: f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1849 * - we hold a pin on it; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1850 * - one reference from page cache; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1851 * - one from isolate_lru_page; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1852 */ f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1853 if (!page_ref_freeze(page, 3)) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1854 result = SCAN_PAGE_COUNT; 042a30824871fa Hugh Dickins 2018-11-30 1855 xas_unlock_irq(&xas); 042a30824871fa Hugh Dickins 2018-11-30 1856 putback_lru_page(page); 042a30824871fa Hugh Dickins 2018-11-30 1857 goto out_unlock; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1858 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1859 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1860 /* f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1861 * Add the page to the list to be able to undo the collapse if f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1862 * something go wrong. f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1863 */ f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1864 list_add_tail(&page->lru, &pagelist); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1865 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1866 /* Finally, replace with the new page. */ 4101196b19d7f9 Matthew Wilcox (Oracle 2019-09-23 1867) xas_store(&xas, new_page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1868 continue; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1869 out_unlock: f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1870 unlock_page(page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1871 put_page(page); 042a30824871fa Hugh Dickins 2018-11-30 1872 goto xa_unlocked; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1873 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1874 99cb0dbd47a15d Song Liu 2019-09-23 1875 if (is_shmem) 042a30824871fa Hugh Dickins 2018-11-30 1876 __inc_node_page_state(new_page, NR_SHMEM_THPS); 09d91cda0e8207 Song Liu 2019-09-23 1877 else { 99cb0dbd47a15d Song Liu 2019-09-23 1878 __inc_node_page_state(new_page, NR_FILE_THPS); 09d91cda0e8207 Song Liu 2019-09-23 1879 filemap_nr_thps_inc(mapping); 09d91cda0e8207 Song Liu 2019-09-23 1880 } 99cb0dbd47a15d Song Liu 2019-09-23 1881 042a30824871fa Hugh Dickins 2018-11-30 1882 if (nr_none) { 9d82c69438d0df Johannes Weiner 2020-06-03 1883 __mod_lruvec_page_state(new_page, NR_FILE_PAGES, nr_none); 99cb0dbd47a15d Song Liu 2019-09-23 1884 if (is_shmem) 9d82c69438d0df Johannes Weiner 2020-06-03 1885 __mod_lruvec_page_state(new_page, NR_SHMEM, nr_none); 042a30824871fa Hugh Dickins 2018-11-30 1886 } 042a30824871fa Hugh Dickins 2018-11-30 1887 042a30824871fa Hugh Dickins 2018-11-30 1888 xa_locked: 042a30824871fa Hugh Dickins 2018-11-30 1889 xas_unlock_irq(&xas); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1890 xa_unlocked: 042a30824871fa Hugh Dickins 2018-11-30 1891 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1892 if (result == SCAN_SUCCEED) { 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1893 struct page *page, *tmp; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1894 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1895 /* 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1896 * Replacing old pages with new one has succeeded, now we 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1897 * need to copy the content and free the old pages. f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1898 */ 2af8ff291848cc Hugh Dickins 2018-11-30 1899 index = start; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1900 list_for_each_entry_safe(page, tmp, &pagelist, lru) { 2af8ff291848cc Hugh Dickins 2018-11-30 1901 while (index < page->index) { 2af8ff291848cc Hugh Dickins 2018-11-30 1902 clear_highpage(new_page + (index % HPAGE_PMD_NR)); 2af8ff291848cc Hugh Dickins 2018-11-30 1903 index++; 2af8ff291848cc Hugh Dickins 2018-11-30 1904 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1905 copy_highpage(new_page + (page->index % HPAGE_PMD_NR), f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1906 page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1907 list_del(&page->lru); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1908 page->mapping = NULL; 042a30824871fa Hugh Dickins 2018-11-30 1909 page_ref_unfreeze(page, 1); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1910 ClearPageActive(page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1911 ClearPageUnevictable(page); 042a30824871fa Hugh Dickins 2018-11-30 1912 unlock_page(page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1913 put_page(page); 2af8ff291848cc Hugh Dickins 2018-11-30 1914 index++; 2af8ff291848cc Hugh Dickins 2018-11-30 1915 } 2af8ff291848cc Hugh Dickins 2018-11-30 1916 while (index < end) { 2af8ff291848cc Hugh Dickins 2018-11-30 1917 clear_highpage(new_page + (index % HPAGE_PMD_NR)); 2af8ff291848cc Hugh Dickins 2018-11-30 1918 index++; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1919 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1920 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1921 SetPageUptodate(new_page); 87c460a0bded56 Hugh Dickins 2018-11-30 1922 page_ref_add(new_page, HPAGE_PMD_NR - 1); 6058eaec816f29 Johannes Weiner 2020-06-03 1923 if (is_shmem) 99cb0dbd47a15d Song Liu 2019-09-23 1924 set_page_dirty(new_page); 6058eaec816f29 Johannes Weiner 2020-06-03 1925 lru_cache_add(new_page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1926 042a30824871fa Hugh Dickins 2018-11-30 1927 /* 042a30824871fa Hugh Dickins 2018-11-30 1928 * Remove pte page tables, so we can re-fault the page as huge. 042a30824871fa Hugh Dickins 2018-11-30 1929 */ 042a30824871fa Hugh Dickins 2018-11-30 1930 retract_page_tables(mapping, start); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1931 *hpage = NULL; 87aa752906ecf6 Yang Shi 2018-08-17 1932 87aa752906ecf6 Yang Shi 2018-08-17 1933 khugepaged_pages_collapsed++; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1934 } else { 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1935 struct page *page; aaa52e340073b7 Hugh Dickins 2018-11-30 1936 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1937 /* Something went wrong: roll back page cache changes */ 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1938 xas_lock_irq(&xas); aaa52e340073b7 Hugh Dickins 2018-11-30 1939 mapping->nrpages -= nr_none; 99cb0dbd47a15d Song Liu 2019-09-23 1940 99cb0dbd47a15d Song Liu 2019-09-23 1941 if (is_shmem) aaa52e340073b7 Hugh Dickins 2018-11-30 1942 shmem_uncharge(mapping->host, nr_none); aaa52e340073b7 Hugh Dickins 2018-11-30 1943 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1944 xas_set(&xas, start); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1945 xas_for_each(&xas, page, end - 1) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1946 page = list_first_entry_or_null(&pagelist, f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1947 struct page, lru); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1948 if (!page || xas.xa_index < page->index) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1949 if (!nr_none) f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1950 break; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1951 nr_none--; 59749e6ce53735 Johannes Weiner 2016-12-12 1952 /* Put holes back where they were */ 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1953 xas_store(&xas, NULL); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1954 continue; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1955 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1956 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1957 VM_BUG_ON_PAGE(page->index != xas.xa_index, page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1958 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1959 /* Unfreeze the page. */ f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1960 list_del(&page->lru); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1961 page_ref_unfreeze(page, 2); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1962 xas_store(&xas, page); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1963 xas_pause(&xas); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1964 xas_unlock_irq(&xas); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1965 unlock_page(page); 042a30824871fa Hugh Dickins 2018-11-30 1966 putback_lru_page(page); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1967 xas_lock_irq(&xas); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1968 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1969 VM_BUG_ON(nr_none); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1970 xas_unlock_irq(&xas); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1971 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1972 new_page->mapping = NULL; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1973 } 042a30824871fa Hugh Dickins 2018-11-30 1974 042a30824871fa Hugh Dickins 2018-11-30 1975 unlock_page(new_page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1976 out: f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1977 VM_BUG_ON(!list_empty(&pagelist)); 9d82c69438d0df Johannes Weiner 2020-06-03 1978 if (!IS_ERR_OR_NULL(*hpage)) 9d82c69438d0df Johannes Weiner 2020-06-03 1979 mem_cgroup_uncharge(*hpage); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1980 /* TODO: tracepoints */ f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1981 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1982 :::::: The code at line 1646 was first introduced by commit :::::: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 khugepaged: add support of collapse for tmpfs/shmem pages :::::: TO: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] pinmux: Use sequential access to access desc->pinmux data
by Zhang Kunbo 08 Feb '25

08 Feb '25

From: Mukesh Ojha <quic_mojha(a)quicinc.com> stable inclusion from stable-v6.6.66 commit 2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIFR8 CVE: CVE-2024-47141 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e ] When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while accessing desc->mux_owner. Let's say two processes A, B executing in pin_request() for the same pin and process A updates the desc->mux_usecount but not yet updated the desc->mux_owner while process B see the desc->mux_usecount which got updated by A path and further executes strcmp and while accessing desc->mux_owner it crashes with NULL pointer. Serialize the access to mux related setting with a mutex lock. cpu0 (process A) cpu1(process B) pinctrl_select_state() { pinctrl_select_state() { pin_request() { pin_request() { ... .... } else { desc->mux_usecount++; desc->mux_usecount && strcmp(desc->mux_owner, owner)) { if (desc->mux_usecount > 1) return 0; desc->mux_owner = owner; } } Signed-off-by: Mukesh Ojha <quic_mojha(a)quicinc.com> Link: https://lore.kernel.org/20241014192930.1539673-1-quic_mojha@quicinc.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/pinctrl/pinmux.c [ Scope-based resource management is not merged yet (54da6a092431), so we lock the data-race region by hand ] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/pinctrl/core.c | 3 +++ drivers/pinctrl/core.h | 1 + drivers/pinctrl/pinmux.c | 49 ++++++++++++++++++++++++++++++++++------ 3 files changed, 46 insertions(+), 7 deletions(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index b7a6bab4ac01..118c4975c777 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -220,6 +220,9 @@ static int pinctrl_register_one_pin(struct pinctrl_dev *pctldev, /* Set owner */ pindesc->pctldev = pctldev; +#ifdef CONFIG_PINMUX + mutex_init(&pindesc->mux_lock); +#endif /* Copy basic pin info */ if (pin->name) { diff --git a/drivers/pinctrl/core.h b/drivers/pinctrl/core.h index 840103c40c14..f5e4ca19c17b 100644 --- a/drivers/pinctrl/core.h +++ b/drivers/pinctrl/core.h @@ -167,6 +167,7 @@ struct pin_desc { const char *mux_owner; const struct pinctrl_setting_mux *mux_setting; const char *gpio_owner; + struct mutex mux_lock; #endif }; diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c index bab888fe3f8e..53fe25e9e864 100644 --- a/drivers/pinctrl/pinmux.c +++ b/drivers/pinctrl/pinmux.c @@ -27,6 +27,7 @@ #include <linux/pinctrl/pinmux.h> #include "core.h" #include "pinmux.h" +#include <linux/mutex.h> int pinmux_check_ops(struct pinctrl_dev *pctldev) { @@ -84,15 +85,21 @@ bool pinmux_can_be_used_for_gpio(struct pinctrl_dev *pctldev, unsigned pin) { struct pin_desc *desc = pin_desc_get(pctldev, pin); const struct pinmux_ops *ops = pctldev->desc->pmxops; + bool can; /* Can't inspect pin, assume it can be used */ if (!desc || !ops) return true; - if (ops->strict && desc->mux_usecount) + mutex_lock(&desc->mux_lock); + if (ops->strict && desc->mux_usecount) { + mutex_unlock(&desc->mux_lock); return false; + } - return !(ops->strict && !!desc->gpio_owner); + can = !(ops->strict && !!desc->gpio_owner); + mutex_unlock(&desc->mux_lock); + return can; } /** @@ -123,11 +130,13 @@ static int pin_request(struct pinctrl_dev *pctldev, dev_dbg(pctldev->dev, "request pin %d (%s) for %s\n", pin, desc->name, owner); + mutex_lock(&desc->mux_lock); if ((!gpio_range || ops->strict) && desc->mux_usecount && strcmp(desc->mux_owner, owner)) { dev_err(pctldev->dev, "pin %s already requested by %s; cannot claim for %s\n", desc->name, desc->mux_owner, owner); + mutex_unlock(&desc->mux_lock); goto out; } @@ -135,6 +144,7 @@ static int pin_request(struct pinctrl_dev *pctldev, dev_err(pctldev->dev, "pin %s already requested by %s; cannot claim for %s\n", desc->name, desc->gpio_owner, owner); + mutex_unlock(&desc->mux_lock); goto out; } @@ -142,11 +152,14 @@ static int pin_request(struct pinctrl_dev *pctldev, desc->gpio_owner = owner; } else { desc->mux_usecount++; - if (desc->mux_usecount > 1) + if (desc->mux_usecount > 1) { + mutex_unlock(&desc->mux_lock); return 0; + } desc->mux_owner = owner; } + mutex_unlock(&desc->mux_lock); /* Let each pin increase references to this module */ if (!try_module_get(pctldev->owner)) { @@ -176,6 +189,7 @@ static int pin_request(struct pinctrl_dev *pctldev, out_free_pin: if (status) { + mutex_lock(&desc->mux_lock); if (gpio_range) { desc->gpio_owner = NULL; } else { @@ -183,6 +197,7 @@ static int pin_request(struct pinctrl_dev *pctldev, if (!desc->mux_usecount) desc->mux_owner = NULL; } + mutex_unlock(&desc->mux_lock); } out: if (status) @@ -217,16 +232,22 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, return NULL; } + mutex_lock(&desc->mux_lock); if (!gpio_range) { /* * A pin should not be freed more times than allocated. */ - if (WARN_ON(!desc->mux_usecount)) + if (WARN_ON(!desc->mux_usecount)) { + mutex_unlock(&desc->mux_lock); return NULL; + } desc->mux_usecount--; - if (desc->mux_usecount) + if (desc->mux_usecount) { + mutex_unlock(&desc->mux_lock); return NULL; + } } + mutex_unlock(&desc->mux_lock); /* * If there is no kind of request function for the pin we just assume @@ -237,6 +258,7 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, else if (ops->free) ops->free(pctldev, pin); + mutex_lock(&desc->mux_lock); if (gpio_range) { owner = desc->gpio_owner; desc->gpio_owner = NULL; @@ -245,6 +267,7 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, desc->mux_owner = NULL; desc->mux_setting = NULL; } + mutex_unlock(&desc->mux_lock); module_put(pctldev->owner); @@ -457,7 +480,9 @@ int pinmux_enable_setting(const struct pinctrl_setting *setting) pins[i]); continue; } + mutex_lock(&desc->mux_lock); desc->mux_setting = &(setting->data.mux); + mutex_unlock(&desc->mux_lock); } ret = ops->set_mux(pctldev, setting->data.mux.func, @@ -471,8 +496,11 @@ int pinmux_enable_setting(const struct pinctrl_setting *setting) err_set_mux: for (i = 0; i < num_pins; i++) { desc = pin_desc_get(pctldev, pins[i]); - if (desc) + if (desc) { + mutex_lock(&desc->mux_lock); desc->mux_setting = NULL; + mutex_unlock(&desc->mux_lock); + } } err_pin_request: /* On error release all taken pins */ @@ -491,6 +519,7 @@ void pinmux_disable_setting(const struct pinctrl_setting *setting) unsigned num_pins = 0; int i; struct pin_desc *desc; + bool is_equal; if (pctlops->get_group_pins) ret = pctlops->get_group_pins(pctldev, setting->data.mux.group, @@ -516,7 +545,11 @@ void pinmux_disable_setting(const struct pinctrl_setting *setting) pins[i]); continue; } - if (desc->mux_setting == &(setting->data.mux)) { + mutex_lock(&desc->mux_lock); + is_equal = (desc->mux_setting == &(setting->data.mux)); + mutex_unlock(&desc->mux_lock); + + if (is_equal) { pin_free(pctldev, pins[i], NULL); } else { const char *gname; @@ -608,6 +641,7 @@ static int pinmux_pins_show(struct seq_file *s, void *what) if (desc == NULL) continue; + mutex_lock(&desc->mux_lock); if (desc->mux_owner && !strcmp(desc->mux_owner, pinctrl_dev_get_name(pctldev))) is_hog = true; @@ -642,6 +676,7 @@ static int pinmux_pins_show(struct seq_file *s, void *what) desc->mux_setting->group)); else seq_putc(s, '\n'); + mutex_unlock(&desc->mux_lock); } mutex_unlock(&pctldev->mutex); -- 2.34.1

2 1