- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] CVE-2025-22022
by Wang Hai 03 Dec '25

03 Dec '25

Michal Pecio (1): usb: xhci: Apply the link chain quirk on NEC isoc endpoints Niklas Neronin (1): usb: xhci: move link chain bit quirk checks into one helper function. drivers/usb/host/xhci-mem.c | 10 ++-------- drivers/usb/host/xhci-ring.c | 8 ++------ drivers/usb/host/xhci.h | 16 ++++++++++++++-- 3 files changed, 18 insertions(+), 16 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6] rv: Use strings in da monitors tracepoints
by Lin Ruifeng 03 Dec '25

03 Dec '25

From: Gabriele Monaco <gmonaco(a)redhat.com> mainline inclusion from mainline-v6.17-rc1 commit 7f904ff6e58d398c4336f3c19c42b338324451f7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC9E CVE: CVE-2025-38636 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN: global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr ffffffffaada8980 by task ... Call Trace: <TASK> [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200 trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0 This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g. the next automaton's data in this case). The error is harmless as, while printing the string, we stop at the null terminator, but it should still be fixed. Use the __string facilities while defining the tracepoints to avoid reading out of bound memory. Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Tomas Glozar <tglozar(a)redhat.com> Cc: Juri Lelli <jlelli(a)redhat.com> Cc: Clark Williams <williams(a)redhat.com> Cc: John Kacur <jkacur(a)redhat.com> Link: https://lore.kernel.org/20250728135022.255578-4-gmonaco@redhat.com Fixes: 792575348ff7 ("rv/include: Add deterministic automata monitor definition via C macros") Reviewed-by: Nam Cao <namcao(a)linutronix.de> Signed-off-by: Gabriele Monaco <gmonaco(a)redhat.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: include/trace/events/rv.h kernel/trace/rv/rv_trace.h [Context conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- include/trace/events/rv.h | 76 +++++++++++++++++++-------------------- 1 file changed, 38 insertions(+), 38 deletions(-) diff --git a/include/trace/events/rv.h b/include/trace/events/rv.h index 56592da9301c..da213b91da33 100644 --- a/include/trace/events/rv.h +++ b/include/trace/events/rv.h @@ -16,23 +16,23 @@ DECLARE_EVENT_CLASS(event_da_monitor, TP_ARGS(state, event, next_state, final_state), TP_STRUCT__entry( - __array( char, state, MAX_DA_NAME_LEN ) - __array( char, event, MAX_DA_NAME_LEN ) - __array( char, next_state, MAX_DA_NAME_LEN ) - __field( bool, final_state ) + __string( state, state ) + __string( event, event ) + __string( next_state, next_state ) + __field( bool, final_state ) ), TP_fast_assign( - memcpy(__entry->state, state, MAX_DA_NAME_LEN); - memcpy(__entry->event, event, MAX_DA_NAME_LEN); - memcpy(__entry->next_state, next_state, MAX_DA_NAME_LEN); - __entry->final_state = final_state; + __assign_str(state, state); + __assign_str(event, event); + __assign_str(next_state, next_state); + __entry->final_state = final_state; ), TP_printk("%s x %s -> %s %s", - __entry->state, - __entry->event, - __entry->next_state, + __get_str(state), + __get_str(event), + __get_str(next_state), __entry->final_state ? "(final)" : "") ); @@ -43,18 +43,18 @@ DECLARE_EVENT_CLASS(error_da_monitor, TP_ARGS(state, event), TP_STRUCT__entry( - __array( char, state, MAX_DA_NAME_LEN ) - __array( char, event, MAX_DA_NAME_LEN ) + __string( state, state ) + __string( event, event ) ), TP_fast_assign( - memcpy(__entry->state, state, MAX_DA_NAME_LEN); - memcpy(__entry->event, event, MAX_DA_NAME_LEN); + __assign_str(state, state); + __assign_str(event, event); ), TP_printk("event %s not expected in the state %s", - __entry->event, - __entry->state) + __get_str(event), + __get_str(state)) ); #ifdef CONFIG_RV_MON_WIP @@ -76,26 +76,26 @@ DECLARE_EVENT_CLASS(event_da_monitor_id, TP_ARGS(id, state, event, next_state, final_state), TP_STRUCT__entry( - __field( int, id ) - __array( char, state, MAX_DA_NAME_LEN ) - __array( char, event, MAX_DA_NAME_LEN ) - __array( char, next_state, MAX_DA_NAME_LEN ) - __field( bool, final_state ) + __field( int, id ) + __string( state, state ) + __string( event, event ) + __string( next_state, next_state ) + __field( bool, final_state ) ), TP_fast_assign( - memcpy(__entry->state, state, MAX_DA_NAME_LEN); - memcpy(__entry->event, event, MAX_DA_NAME_LEN); - memcpy(__entry->next_state, next_state, MAX_DA_NAME_LEN); - __entry->id = id; - __entry->final_state = final_state; + __assign_str(state, state); + __assign_str(event, event); + __assign_str(next_state, next_state); + __entry->id = id; + __entry->final_state = final_state; ), TP_printk("%d: %s x %s -> %s %s", __entry->id, - __entry->state, - __entry->event, - __entry->next_state, + __get_str(state), + __get_str(event), + __get_str(next_state), __entry->final_state ? "(final)" : "") ); @@ -106,21 +106,21 @@ DECLARE_EVENT_CLASS(error_da_monitor_id, TP_ARGS(id, state, event), TP_STRUCT__entry( - __field( int, id ) - __array( char, state, MAX_DA_NAME_LEN ) - __array( char, event, MAX_DA_NAME_LEN ) + __field( int, id ) + __string( state, state ) + __string( event, event ) ), TP_fast_assign( - memcpy(__entry->state, state, MAX_DA_NAME_LEN); - memcpy(__entry->event, event, MAX_DA_NAME_LEN); - __entry->id = id; + __assign_str(state, state); + __assign_str(event, event); + __entry->id = id; ), TP_printk("%d: event %s not expected in the state %s", __entry->id, - __entry->event, - __entry->state) + __get_str(event), + __get_str(state)) ); #ifdef CONFIG_RV_MON_WWNR -- 2.43.0

2 1

[PATCH OLK-5.10] media: venus: hfi: add check to handle incorrect queue size
by Lin Ruifeng 03 Dec '25

03 Dec '25

From: Vikash Garodia <quic_vgarodia(a)quicinc.com> stable inclusion from stable-v5.10.237 commit a45957bcde529169188929816775a575de77d84f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BJU CVE: CVE-2025-23158 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 69baf245b23e20efda0079238b27fc63ecf13de1 upstream. qsize represents size of shared queued between driver and video firmware. Firmware can modify this value to an invalid large value. In such situation, empty_space will be bigger than the space actually available. Since new_wr_idx is not checked, so the following code will result in an OOB write. ... qsize = qhdr->q_size if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx) .... if (new_wr_idx < qsize) { memcpy(wr_ptr, packet, dwords << 2) --> OOB write Add check to ensure qsize is within the allocated size while reading and writing packets into the queue. Cc: stable(a)vger.kernel.org Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") Reviewed-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> Signed-off-by: Vikash Garodia <quic_vgarodia(a)quicinc.com> Signed-off-by: Hans Verkuil <hverkuil(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/media/platform/qcom/venus/hfi_venus.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c index 8b1375c97c81..d3f1efabbfd6 100644 --- a/drivers/media/platform/qcom/venus/hfi_venus.c +++ b/drivers/media/platform/qcom/venus/hfi_venus.c @@ -188,6 +188,9 @@ static int venus_write_queue(struct venus_hfi_device *hdev, /* ensure rd/wr indices's are read from memory */ rmb(); + if (qsize > IFACEQ_QUEUE_SIZE / 4) + return -EINVAL; + if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx); else @@ -256,6 +259,9 @@ static int venus_read_queue(struct venus_hfi_device *hdev, wr_idx = qhdr->write_idx; qsize = qhdr->q_size; + if (qsize > IFACEQ_QUEUE_SIZE / 4) + return -EINVAL; + /* make sure data is valid before using it */ rmb(); -- 2.43.0

2 1

[openeuler:OLK-6.6 3450/3450] include/linux/syscalls.h:246:25: error: conflicting types for 'sys_xsched_setattr'; have 'long int(pid_t, struct xsched_attr *)' {aka 'long int(int, struct xsched_attr *)'}
by kernel test robot 03 Dec '25

03 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 475ad739de0d59c667bb9fa8ab728d1d146c8e28 commit: 7d2bb3c7646cf1ebe76de965c3b31d7bc2b89845 [3450/3450] xsched: fix compile error when CONFIG_XCU_SCHEDULER is disabled config: loongarch-randconfig-002-20251203 (https://download.01.org/0day-ci/archive/20251203/202512031328.9eAOiuGN-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251203/202512031328.9eAOiuGN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512031328.9eAOiuGN-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/xsched/vstream.c:21: include/linux/syscalls.h:954:54: warning: 'struct xsched_attr' declared inside parameter list will not be visible outside of this definition or declaration 954 | asmlinkage long sys_xsched_setattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~ include/linux/syscalls.h:955:54: warning: 'struct xsched_attr' declared inside parameter list will not be visible outside of this definition or declaration 955 | asmlinkage long sys_xsched_getattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~ >> include/linux/syscalls.h:246:25: error: conflicting types for 'sys_xsched_setattr'; have 'long int(pid_t, struct xsched_attr *)' {aka 'long int(int, struct xsched_attr *)'} 246 | asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ | ^~~ include/linux/syscalls.h:232:9: note: in expansion of macro '__SYSCALL_DEFINEx' 232 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:222:36: note: in expansion of macro 'SYSCALL_DEFINEx' 222 | #define SYSCALL_DEFINE2(name, ...) SYSCALL_DEFINEx(2, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/xsched/vstream.c:660:1: note: in expansion of macro 'SYSCALL_DEFINE2' 660 | SYSCALL_DEFINE2(xsched_setattr, pid_t, pid, struct xsched_attr __user *, arg) | ^~~~~~~~~~~~~~~ include/linux/syscalls.h:954:17: note: previous declaration of 'sys_xsched_setattr' with type 'long int(pid_t, struct xsched_attr *)' {aka 'long int(int, struct xsched_attr *)'} 954 | asmlinkage long sys_xsched_setattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~~~~~~~~ >> include/linux/syscalls.h:246:25: error: conflicting types for 'sys_xsched_getattr'; have 'long int(pid_t, struct xsched_attr *)' {aka 'long int(int, struct xsched_attr *)'} 246 | asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ | ^~~ include/linux/syscalls.h:232:9: note: in expansion of macro '__SYSCALL_DEFINEx' 232 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:222:36: note: in expansion of macro 'SYSCALL_DEFINEx' 222 | #define SYSCALL_DEFINE2(name, ...) SYSCALL_DEFINEx(2, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/xsched/vstream.c:665:1: note: in expansion of macro 'SYSCALL_DEFINE2' 665 | SYSCALL_DEFINE2(xsched_getattr, pid_t, pid, struct xsched_attr __user *, arg) | ^~~~~~~~~~~~~~~ include/linux/syscalls.h:955:17: note: previous declaration of 'sys_xsched_getattr' with type 'long int(pid_t, struct xsched_attr *)' {aka 'long int(int, struct xsched_attr *)'} 955 | asmlinkage long sys_xsched_getattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~~~~~~~~ vim +246 include/linux/syscalls.h 1bd21c6c21e848 Dominik Brodowski 2018-04-05 235 e145242ea0df6b Dominik Brodowski 2018-04-09 236 /* e145242ea0df6b Dominik Brodowski 2018-04-09 237 * The asmlinkage stub is aliased to a function named __se_sys_*() which e145242ea0df6b Dominik Brodowski 2018-04-09 238 * sign-extends 32-bit ints to longs whenever needed. The actual work is e145242ea0df6b Dominik Brodowski 2018-04-09 239 * done within __do_sys_*(). e145242ea0df6b Dominik Brodowski 2018-04-09 240 */ 1bd21c6c21e848 Dominik Brodowski 2018-04-05 241 #ifndef __SYSCALL_DEFINEx bed1ffca022cc8 Frederic Weisbecker 2009-03-13 242 #define __SYSCALL_DEFINEx(x, name, ...) \ bee20031772af3 Arnd Bergmann 2018-06-19 243 __diag_push(); \ bee20031772af3 Arnd Bergmann 2018-06-19 244 __diag_ignore(GCC, 8, "-Wattribute-alias", \ bee20031772af3 Arnd Bergmann 2018-06-19 245 "Type aliasing is used to sanitize syscall arguments");\ 83460ec8dcac14 Andi Kleen 2013-11-12 @246 asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ e145242ea0df6b Dominik Brodowski 2018-04-09 247 __attribute__((alias(__stringify(__se_sys##name)))); \ c9a211951c7c79 Howard McLauchlan 2018-03-21 248 ALLOW_ERROR_INJECTION(sys##name, ERRNO); \ e145242ea0df6b Dominik Brodowski 2018-04-09 249 static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__));\ e145242ea0df6b Dominik Brodowski 2018-04-09 250 asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)); \ e145242ea0df6b Dominik Brodowski 2018-04-09 251 asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)) \ 1a94bc34768e46 Heiko Carstens 2009-01-14 252 { \ e145242ea0df6b Dominik Brodowski 2018-04-09 253 long ret = __do_sys##name(__MAP(x,__SC_CAST,__VA_ARGS__));\ 07fe6e00f6cca6 Al Viro 2013-01-21 254 __MAP(x,__SC_TEST,__VA_ARGS__); \ 2cf0966683430b Al Viro 2013-01-21 255 __PROTECT(x, ret,__MAP(x,__SC_ARGS,__VA_ARGS__)); \ 2cf0966683430b Al Viro 2013-01-21 256 return ret; \ 1a94bc34768e46 Heiko Carstens 2009-01-14 257 } \ bee20031772af3 Arnd Bergmann 2018-06-19 258 __diag_pop(); \ e145242ea0df6b Dominik Brodowski 2018-04-09 259 static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) 1bd21c6c21e848 Dominik Brodowski 2018-04-05 260 #endif /* __SYSCALL_DEFINEx */ 1a94bc34768e46 Heiko Carstens 2009-01-14 261 :::::: The code at line 246 was first introduced by commit :::::: 83460ec8dcac14142e7860a01fa59c267ac4657c syscalls.h: use gcc alias instead of assembler aliases for syscalls :::::: TO: Andi Kleen <ak(a)linux.intel.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 5bd996476c86f9b6d2039f9ab662f38d64fa6c70
by kernel test robot 03 Dec '25

03 Dec '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 5bd996476c86f9b6d2039f9ab662f38d64fa6c70 !19381 net/sched: Abort __tc_modify_qdisc if parent is a clsact/ingress qdisc Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild/202512031045.402km0Dt-lkp@intel.com block/blk-wbt.c:589:6: warning: no previous prototype for function 'wbt_issue' [-Wmissing-prototypes] block/blk-wbt.c:609:6: warning: no previous prototype for function 'wbt_requeue' [-Wmissing-prototypes] drivers/gpu/drm/amd/amdgpu/amdgpu_ids.o: warning: objtool: amdgpu_vmid_grab()+0xd3e: unreachable instruction fs/ext4/mballoc.o: warning: objtool: ext4_mb_complex_scan_group()+0x11a4: unreachable instruction kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats' kernel/sched/debug.c:991:17: error: no member named 'nr_wakeups_force_preferred_cpus' in 'struct dyn_affinity_stats' mm/early_ioremap.o: warning: objtool: missing symbol for section .text mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] Unverified Error/Warning (likely false positive, kindly check if interested): (.text+0x26a4): undefined reference to `_init' (.text+0x31): undefined reference to `_DYNAMIC' (.text+0x41): undefined reference to `_fini' /usr/include/bits/floatn.h:83:52: error: unsupported machine mode '__TC__' /usr/include/bits/floatn.h:97:9: error: __float128 is not supported on this target block/blk-throttle.c:2306:1-7: preceding lock on line 2212 block/cmdline-parser.o: warning: objtool: missing symbol for section .text crypto/ecc.c:1112:9: warning: 'priv' may be used uninitialized [-Wmaybe-uninitialized] crypto/lrw.c:456:13: warning: mismatch in argument 1 type of built-in function 'free'; expected 'void *' [-Wbuiltin-declaration-mismatch] crypto/xts.c:396:13: warning: mismatch in argument 1 type of built-in function 'free'; expected 'void *' [-Wbuiltin-declaration-mismatch] drivers/nvdimm/label.o: warning: objtool: nd_blk_namespace_label_update()+0x1326: unreachable instruction drivers/pinctrl/core.c:1338: error: Cannot parse struct or union! drivers/tty/tty_buffer.c:170:2: error: implicit declaration of function 'printk_safe_enter'; did you mean 'printk_nmi_enter'? [-Werror=implicit-function-declaration] drivers/tty/tty_buffer.c:172:2: error: implicit declaration of function 'printk_safe_exit'; did you mean 'printk_nmi_exit'? [-Werror=implicit-function-declaration] drivers/usb/typec/tcpm.c:4421:45: sparse: sparse: unsigned value that used to be signed checked against zero? include/asm-generic/io.h:742:19: warning: 'reg' may be used uninitialized in this function [-Wmaybe-uninitialized] include/linux/list.h:63:20: warning: storing the address of local variable 'wait' in '((struct list_head *)x)[1].prev' [-Wdangling-pointer=] include/linux/list.h:63:20: warning: storing the address of local variable 'waiter' in '*(struct list_head *)((char *)sem + 8).prev' [-Wdangling-pointer=] include/linux/list.h:65:19: warning: storing the address of local variable 'queue' in '*(struct list_head *)packet.prev' [-Wdangling-pointer=] include/linux/signal.h:180:29: warning: this statement may fall through [-Wimplicit-fallthrough=] include/linux/skbuff.h:1869:9: warning: array subscript 'struct sk_buff[0]' is partly outside array bounds of 'struct ieee80211_tx_data[1]' [-Warray-bounds] include/linux/string.h:333:16: warning: '__builtin_memset' offset [48, 55] is out of the bounds [0, 48] [-Warray-bounds] include/linux/thread_info.h:59:17: warning: 'header' may be used uninitialized [-Wmaybe-uninitialized] include/linux/tty_flip.h:27:32: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] include/linux/unaligned/access_ok.h:40:24: warning: array subscript -1 is outside array bounds of 'struct retrieve_data_struct_cmd[1]' [-Warray-bounds=] mm/memcontrol.c:6287: warning: bad line: | 0, otherwise. mm/page_owner.o: warning: objtool: missing symbol for section .text.unlikely. mm/rmap.c:906:17: warning: variable 'cstart' set but not used [-Wunused-but-set-variable] mm/swap_state.o: warning: objtool: missing symbol for section .text.unlikely. Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- crypto-ecc.c:warning:priv-may-be-used-uninitialized | |-- crypto-lrw.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | |-- crypto-xts.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-asm-generic-io.h:warning:this-statement-may-fall-through | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- include-linux-skbuff.h:warning:array-subscript-struct-sk_buff-is-partly-outside-array-bounds-of-struct-ieee80211_tx_data | |-- include-linux-string.h:warning:__builtin_memset-offset-is-out-of-the-bounds | |-- include-linux-unaligned-access_ok.h:warning:array-subscript-is-outside-array-bounds-of-struct-retrieve_data_struct_cmd | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test |-- arm64-allnoconfig | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-wait-in-((struct-list_head-)x)-.prev | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-waiter-in-(struct-list_head-)((char-)sem-).prev | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-defconfig | |-- crypto-ecc.c:warning:priv-may-be-used-uninitialized | |-- include-asm-generic-io.h:warning:this-statement-may-fall-through | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-waiter-in-(struct-list_head-)((char-)sem-).prev | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- include-linux-skbuff.h:warning:array-subscript-struct-sk_buff-is-partly-outside-array-bounds-of-struct-ieee80211_tx_data | `-- mm-memcontrol.c:warning:bad-line:otherwise. |-- arm64-randconfig-001-20250705 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter | `-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-001-20250930 | `-- include-asm-generic-io.h:warning:reg-may-be-used-uninitialized-in-this-function |-- arm64-randconfig-001-20251027 | |-- crypto-lrw.c:warning:mismatch-in-argument-type-of-built-in-function-free-expected-void | `-- crypto-xts.c:warning:mismatch-in-argument-type-of-built-in-function-free-expected-void |-- arm64-randconfig-001-20251029 | `-- include-linux-thread_info.h:warning:header-may-be-used-uninitialized |-- arm64-randconfig-001-20251125 | |-- crypto-ecc.c:warning:priv-may-be-used-uninitialized | |-- include-linux-skbuff.h:warning:array-subscript-struct-sk_buff-is-partly-outside-array-bounds-of-struct-ieee80211_tx_data | `-- include-linux-string.h:warning:__builtin_memset-offset-is-out-of-the-bounds |-- arm64-randconfig-001-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20250929 | `-- include-linux-list.h:warning:storing-the-address-of-local-variable-queue-in-(struct-list_head-)packet.prev |-- arm64-randconfig-002-20251014 | `-- include-linux-tty_flip.h:warning:writing-byte-into-a-region-of-size |-- arm64-randconfig-002-20251202 | |-- crypto-xts.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- kernel-time-posix-cpu-timers.c:warning:now-may-be-used-uninitialized-in-this-function | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- arm64-randconfig-003-20250830 | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- arm64-randconfig-003-20250930 | |-- include-linux-uaccess.h:warning:be-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:bulk-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:dc-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:fl-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:from-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:fs-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:gd-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:guest_cid-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:lnr-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:mreq-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:oir-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:r32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:start-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:tx32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ucnt-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:uss32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:v-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:v32-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:vr-may-be-used-uninitialized |-- arm64-randconfig-003-20251027 | |-- lib-lockref.c:error:unable-to-generate-reloads-for: | `-- lib-lockref.c:internal-compiler-error:in-curr_insn_transform-at-lra-constraints.c |-- arm64-randconfig-003-20251115 | `-- include-linux-unaligned-access_ok.h:warning:array-subscript-is-outside-array-bounds-of-struct-retrieve_data_struct_cmd |-- arm64-randconfig-003-20251202 | |-- crypto-ecc.c:warning:priv-may-be-used-uninitialized | |-- crypto-xts.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- include-linux-skbuff.h:warning:array-subscript-struct-sk_buff-is-partly-outside-array-bounds-of-struct-ieee80211_tx_data | |-- include-linux-unaligned-access_ok.h:warning:array-subscript-is-outside-array-bounds-of-struct-retrieve_data_struct_cmd | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-004-20250729 | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:agt_ctrl-may-be-used-uninitialized-in-this-function | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:c_value_r-may-be-used-uninitialized-in-this-function | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:data-may-be-used-uninitialized-in-this-function | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:r_data-may-be-used-uninitialized-in-this-function | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:r_value-may-be-used-uninitialized-in-this-function | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:read_value-may-be-used-uninitialized-in-this-function | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:spi_val-may-be-used-uninitialized-in-this-function | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:temp-may-be-used-uninitialized-in-this-function | `-- drivers-scsi-qla2xxx-qla_nx2.c:warning:value-may-be-used-uninitialized-in-this-function |-- arm64-randconfig-004-20251111 | |-- crypto-lrw.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | `-- crypto-xts.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) |-- arm64-randconfig-004-20251202 | |-- crypto-ecc.c:warning:priv-may-be-used-uninitialized | |-- crypto-lrw.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | |-- crypto-xts.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-asm-generic-io.h:warning:this-statement-may-fall-through | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- include-linux-string.h:warning:__builtin_memset-offset-is-out-of-the-bounds | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- arm64-randconfig-r061-20251031 | `-- drivers-block-rbd.c:WARNING-opportunity-for-min() |-- arm64-randconfig-r134-20251105 | `-- drivers-usb-typec-tcpm.c:sparse:sparse:unsigned-value-that-used-to-be-signed-checked-against-zero |-- x86_64-allmodconfig | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-allnoconfig | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-allnoconfig-bpf | |-- (.text):undefined-reference-to-_DYNAMIC | |-- (.text):undefined-reference-to-_fini | |-- (.text):undefined-reference-to-_init | |-- usr-include-bits-floatn.h:error:__float128-is-not-supported-on-this-target | `-- usr-include-bits-floatn.h:error:unsupported-machine-mode-__TC__ |-- x86_64-allyesconfig | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250401 | `-- drivers-nvdimm-label.o:warning:objtool:nd_blk_namespace_label_update:unreachable-instruction |-- x86_64-buildonly-randconfig-001-20250718 | |-- block-cmdline-parser.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-swap_state.o:warning:objtool:missing-symbol-for-section-.text.unlikely. |-- x86_64-buildonly-randconfig-003-20250207 | `-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool |-- x86_64-buildonly-randconfig-003-20250704 | `-- mm-page_owner.o:warning:objtool:missing-symbol-for-section-.text.unlikely. |-- x86_64-buildonly-randconfig-003-20251028 | |-- block-bfq-cgroup.o:warning:objtool:missing-symbol-for-section-.text | |-- block-bfq-wf2q.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-lib.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-mq-pci.o:warning:objtool:missing-symbol-for-section-.text | |-- block-cmdline-parser.o:warning:objtool:missing-symbol-for-section-.text | |-- block-ioctl.o:warning:objtool:missing-symbol-for-section-.text | |-- block-partitions-check.o:warning:objtool:missing-symbol-for-section-.text | |-- block-scsi_ioctl.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-debug.o:warning:objtool:missing-symbol-for-section-.text.unlikely. | |-- mm-kmemleak.o:warning:objtool:missing-symbol-for-section-.ref.text | `-- mm-memcontrol.o:warning:objtool:missing-symbol-for-section-.text.unlikely. |-- x86_64-buildonly-randconfig-003-20251202 | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-buildonly-randconfig-005-20241216 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250714 | |-- block-bfq-cgroup.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-mq-rdma.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-isdn-mISDN-dsp_cmx.o:warning:objtool:missing-symbol-for-section-.text.unlikely. | |-- drivers-isdn-mISDN-dsp_hwec.o:warning:objtool:missing-symbol-for-section-.text.unlikely. | `-- drivers-net-can-usb-peak_usb-pcan_usb_core.o:warning:objtool:missing-symbol-for-section-.text.unlikely. |-- x86_64-buildonly-randconfig-005-20250806 | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | `-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue |-- x86_64-buildonly-randconfig-005-20250820 | `-- mm-early_ioremap.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-006-20250924 | |-- drivers-media-pci-cobalt-cobalt-i2c.o:warning:objtool:missing-symbol-for-section-.text.unlikely. | `-- drivers-media-pci-cobalt-cobalt-irq.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-randconfig-001-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-002-20251202 | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-006-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-011-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-014-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-015-20251202 | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-016-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-071-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-072-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-073-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-074-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-075-20251202 | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-076-20251202 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-101-20241223 | `-- fs-ext4-mballoc.o:warning:objtool:ext4_mb_complex_scan_group:unreachable-instruction |-- x86_64-randconfig-101-20251203 | |-- block-blk-core.c:preceding-lock-on-line | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- crypto-aead.c:opportunity-for-str_yes_no(alg-cra_flags-CRYPTO_ALG_ASYNC) | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-103-20250219 | |-- kernel-sched-debug.c:error:no-member-named-nr_wakeups_force_preferred_cpus-in-struct-dyn_affinity_stats | `-- kernel-sched-debug.c:error:no-member-named-nr_wakeups_preferred_cpus-in-struct-dyn_affinity_stats |-- x86_64-randconfig-103-20250305 | `-- drivers-gpu-drm-amd-amdgpu-amdgpu_ids.o:warning:objtool:amdgpu_vmid_grab:unreachable-instruction |-- x86_64-randconfig-103-20251115 | `-- block-blk-throttle.c:preceding-lock-on-line |-- x86_64-randconfig-103-20251203 | |-- crypto-aead.c:opportunity-for-str_yes_no(alg-cra_flags-CRYPTO_ALG_ASYNC) | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-121-20251203 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-122-20251203 | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- fs-ext4-mballoc.o:warning:objtool:ext4_mb_complex_scan_group:unreachable-instruction | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-161-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used `-- x86_64-rhel-9.4-rust |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool |-- mm-memcontrol.c:warning:bad-line:otherwise. |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type `-- mm-rmap.c:warning:variable-cstart-set-but-not-used elapsed time: 1451m configs tested: 36 configs skipped: 8 tested configs: arm64 allmodconfig gcc-15.1.0 arm64 allnoconfig gcc-15.1.0 arm64 defconfig gcc-15.1.0 arm64 randconfig-001-20251202 gcc-8.5.0 arm64 randconfig-002-20251202 gcc-10.5.0 arm64 randconfig-003-20251202 gcc-14.3.0 arm64 randconfig-004-20251202 gcc-12.5.0 x86_64 allmodconfig clang-22 x86_64 allnoconfig clang-22 x86_64 allyesconfig clang-22 x86_64 buildonly-randconfig-001-20251202 gcc-14 x86_64 buildonly-randconfig-002-20251202 gcc-14 x86_64 buildonly-randconfig-003-20251202 clang-22 x86_64 buildonly-randconfig-004-20251202 gcc-13 x86_64 buildonly-randconfig-005-20251202 gcc-14 x86_64 buildonly-randconfig-006-20251202 gcc-13 x86_64 defconfig gcc-14 x86_64 randconfig-001-20251202 clang-22 x86_64 randconfig-002-20251202 clang-22 x86_64 randconfig-003-20251202 gcc-14 x86_64 randconfig-004-20251202 gcc-14 x86_64 randconfig-005-20251202 gcc-14 x86_64 randconfig-006-20251202 clang-22 x86_64 randconfig-011-20251202 clang-22 x86_64 randconfig-012-20251202 gcc-13 x86_64 randconfig-013-20251202 gcc-14 x86_64 randconfig-014-20251202 clang-22 x86_64 randconfig-015-20251202 clang-22 x86_64 randconfig-016-20251202 clang-22 x86_64 randconfig-071-20251202 clang-22 x86_64 randconfig-072-20251202 clang-22 x86_64 randconfig-073-20251202 clang-22 x86_64 randconfig-074-20251202 clang-22 x86_64 randconfig-075-20251202 clang-22 x86_64 randconfig-076-20251202 clang-22 x86_64 rhel-9.4-rust clang-22 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] drm/scheduler: signal scheduled fence when kill job
by Yao Kai 03 Dec '25

03 Dec '25

From: "Lin.Cao" <lincao12(a)amd.com> stable inclusion from stable-v6.6.96 commit c5734f9bab6f0d40577ad0633af4090a5fda2407 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXL7 CVE: CVE-2025-38436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 471db2c2d4f80ee94225a1ef246e4f5011733e50 ] When an entity from application B is killed, drm_sched_entity_kill() removes all jobs belonging to that entity through drm_sched_entity_kill_jobs_work(). If application A's job depends on a scheduled fence from application B's job, and that fence is not properly signaled during the killing process, application A's dependency cannot be cleared. This leads to application A hanging indefinitely while waiting for a dependency that will never be resolved. Fix this issue by ensuring that scheduled fences are properly signaled when an entity is killed, allowing dependent applications to continue execution. Signed-off-by: Lin.Cao <lincao12(a)amd.com> Reviewed-by: Philipp Stanner <phasta(a)kernel.org> Signed-off-by: Christian König <christian.koenig(a)amd.com> Link: https://lore.kernel.org/r/20250515020713.1110476-1-lincao12@amd.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yao Kai <yaokai34(a)huawei.com> --- drivers/gpu/drm/scheduler/sched_entity.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c index 53130a50584c..eed3b8bed9e4 100644 --- a/drivers/gpu/drm/scheduler/sched_entity.c +++ b/drivers/gpu/drm/scheduler/sched_entity.c @@ -167,6 +167,7 @@ static void drm_sched_entity_kill_jobs_work(struct work_struct *wrk) { struct drm_sched_job *job = container_of(wrk, typeof(*job), work); + drm_sched_fence_scheduled(job->s_fence, NULL); drm_sched_fence_finished(job->s_fence, -ESRCH); WARN_ON(job->s_fence->parent); job->sched->ops->free_job(job); -- 2.43.0

2 1

[PATCH OLK-5.10] vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
by Yin Tirui 03 Dec '25

03 Dec '25

From: Mike Christie <michael.christie(a)oracle.com> mainline inclusion from mainline-v6.15-rc1 commit 5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP35K CVE: CVE-2025-22083 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If vhost_scsi_set_endpoint is called multiple times without a vhost_scsi_clear_endpoint between them, we can hit multiple bugs found by Haoran Zhang: 1. Use-after-free when no tpgs are found: This fixes a use after free that occurs when vhost_scsi_set_endpoint is called more than once and calls after the first call do not find any tpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds tpgs to add to the vs_tpg array match=true, so we will do: vhost_vq_set_backend(vq, vs_tpg); ... kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; If vhost_scsi_set_endpoint is called again and no tpgs are found match=false so we skip the vhost_vq_set_backend call leaving the pointer to the vs_tpg we then free via: kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; If a scsi request is then sent we do: vhost_scsi_handle_vq -> vhost_scsi_get_req -> vhost_vq_get_backend which sees the vs_tpg we just did a kfree on. 2. Tpg dir removal hang: This patch fixes an issue where we cannot remove a LIO/target layer tpg (and structs above it like the target) dir due to the refcount dropping to -1. The problem is that if vhost_scsi_set_endpoint detects a tpg is already in the vs->vs_tpg array or if the tpg has been removed so target_depend_item fails, the undepend goto handler will do target_undepend_item on all tpgs in the vs_tpg array dropping their refcount to 0. At this time vs_tpg contains both the tpgs we have added in the current vhost_scsi_set_endpoint call as well as tpgs we added in previous calls which are also in vs->vs_tpg. Later, when vhost_scsi_clear_endpoint runs it will do target_undepend_item on all the tpgs in the vs->vs_tpg which will drop their refcount to -1. Userspace will then not be able to remove the tpg and will hang when it tries to do rmdir on the tpg dir. 3. Tpg leak: This fixes a bug where we can leak tpgs and cause them to be un-removable because the target name is overwritten when vhost_scsi_set_endpoint is called multiple times but with different target names. The bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setup a vhost-scsi device to target/tpg mapping, then calls VHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs we haven't seen before (target1 has tpg1 but target2 has tpg2). When this happens we don't teardown the old target tpg mapping and just overwrite the target name and the vs->vs_tpg array. Later when we do vhost_scsi_clear_endpoint, we are passed in either target1 or target2's name and we will only match that target's tpgs when we loop over the vs->vs_tpg. We will then return from the function without doing target_undepend_item on the tpgs. Because of all these bugs, it looks like being able to call vhost_scsi_set_endpoint multiple times was never supported. The major user, QEMU, already has checks to prevent this use case. So to fix the issues, this patch prevents vhost_scsi_set_endpoint from being called if it's already successfully added tpgs. To add, remove or change the tpg config or target name, you must do a vhost_scsi_clear_endpoint first. Fixes: 25b98b64e284 ("vhost scsi: alloc cmds per vq instead of session") Fixes: 4f7f46d32c98 ("tcm_vhost: Use vq->private_data to indicate if the endpoint is setup") Reported-by: Haoran Zhang <wh1sper(a)zju.edu.cn> Closes: https://lore.kernel.org/virtualization/e418a5ee-45ca-4d18-9b5d-6f8b6b1add8e… Signed-off-by: Mike Christie <michael.christie(a)oracle.com> Reviewed-by: Stefan Hajnoczi <stefanha(a)redhat.com> Message-Id: <20250129210922.121533-1-michael.christie(a)oracle.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Stefano Garzarella <sgarzare(a)redhat.com> Conflicts: drivers/vhost/scsi.c [Fixing context conflicts] Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- drivers/vhost/scsi.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index a23a65e7d828..f896c8a83f1a 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -1589,14 +1589,19 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } } + if (vs->vs_tpg) { + pr_err("vhost-scsi endpoint already set for %s.\n", + vs->vs_vhost_wwpn); + ret = -EEXIST; + goto out; + } + len = sizeof(vs_tpg[0]) * VHOST_SCSI_MAX_TARGET; vs_tpg = kzalloc(len, GFP_KERNEL); if (!vs_tpg) { ret = -ENOMEM; goto out; } - if (vs->vs_tpg) - memcpy(vs_tpg, vs->vs_tpg, len); list_for_each_entry(tpg, &vhost_scsi_list, tv_tpg_list) { mutex_lock(&tpg->tv_tpg_mutex); @@ -1611,11 +1616,6 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, tv_tport = tpg->tport; if (!strcmp(tv_tport->tport_name, t->vhost_wwpn)) { - if (vs->vs_tpg && vs->vs_tpg[tpg->tport_tpgt]) { - mutex_unlock(&tpg->tv_tpg_mutex); - ret = -EEXIST; - goto undepend; - } /* * In order to ensure individual vhost-scsi configfs * groups cannot be removed while in use by vhost ioctl, @@ -1660,15 +1660,15 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } ret = 0; } else { - ret = -EEXIST; + ret = -ENODEV; + goto free_tpg; } /* - * Act as synchronize_rcu to make sure access to - * old vs->vs_tpg is finished. + * Act as synchronize_rcu to make sure requests after this point + * see a fully setup device. */ vhost_scsi_flush(vs); - kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; goto out; @@ -1685,6 +1685,7 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, target_undepend_item(&tpg->se_tpg.tpg_group.cg_item); } } +free_tpg: kfree(vs_tpg); out: mutex_unlock(&vs->dev.mutex); @@ -1773,6 +1774,7 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs, vhost_scsi_flush(vs); kfree(vs->vs_tpg); vs->vs_tpg = NULL; + memset(vs->vs_vhost_wwpn, 0, sizeof(vs->vs_vhost_wwpn)); WARN_ON(vs->vs_events_nr); mutex_unlock(&vs->dev.mutex); mutex_unlock(&vhost_scsi_mutex); -- 2.22.0

2 1

[RFC PATCH openEuler-1.0-LTS 0/4] add mcs support for migrate pages
by Wupeng Ma 03 Dec '25

03 Dec '25

Add mcs support for migrate page & support disabling soft offline for HugeTLB pages. Since UCE kernel recovery is needed by this. This should be enable with the following step: - echo 1 > /proc/sys/kernel/uce_kernel_recovery Disable soft offline support for hugetlb with the following step: - echo 3 > /proc/sys/vm/enable_soft_offline Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages Wupeng Ma (2): uce: add copy_mc_highpage{s} arm64: mm: Add copy mc support for migrate_page .../ABI/testing/sysfs-memory-page-offline | 3 + include/linux/highmem.h | 55 +++++++++++++ include/linux/mm.h | 1 + kernel/sysctl.c | 9 +++ mm/memory-failure.c | 25 +++++- mm/migrate.c | 79 ++++++++++++++++--- 6 files changed, 162 insertions(+), 10 deletions(-) -- 2.43.0

1 4

[RFC PATCH openEuler-1.0-LTS 0/4] add mcs support for migrate pages
by Wupeng Ma 03 Dec '25

03 Dec '25

Add mcs support for migrate page & support disabling soft offline for HugeTLB pages. Since UCE kernel recovery is needed by this. This should be enable with the following step: - echo 1 > /proc/sys/kernel/uce_kernel_recovery Disable soft offline support for hugetlb with the following step: - echo 3 > /proc/sys/vm/enable_soft_offline Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages Wupeng Ma (2): uce: add copy_mc_highpage{s} arm64: mm: Add copy mc support for migrate_page .../ABI/testing/sysfs-memory-page-offline | 3 + include/linux/highmem.h | 55 +++++++++++++ include/linux/mm.h | 1 + kernel/sysctl.c | 9 +++ mm/memory-failure.c | 25 +++++- mm/migrate.c | 79 ++++++++++++++++--- 6 files changed, 162 insertions(+), 10 deletions(-) -- 2.43.0

1 4

[RFC PATCH openEuler-1.0-LTS 0/4] add mcs support for migrate pages
by Wupeng Ma 03 Dec '25

03 Dec '25

Add mcs support for migrate page & support disabling soft offline for HugeTLB pages. Since UCE kernel recovery is needed by this. This should be enable with the following step: - echo 1 > /proc/sys/kernel/uce_kernel_recovery Disable soft offline support for hugetlb with the following step: - echo 3 > /proc/sys/vm/enable_soft_offline Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages Wupeng Ma (2): uce: add copy_mc_highpage{s} arm64: mm: Add copy mc support for migrate_page .../ABI/testing/sysfs-memory-page-offline | 3 + include/linux/highmem.h | 55 +++++++++++++ include/linux/mm.h | 1 + kernel/sysctl.c | 9 +++ mm/memory-failure.c | 25 +++++- mm/migrate.c | 77 ++++++++++++++++--- 6 files changed, 160 insertions(+), 10 deletions(-) -- 2.43.0

1 4