- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 2139/2139] drivers/cpufreq/cppc_cpufreq.c:852:19: error: dereferencing pointer to incomplete type 'struct fb_ctr_pair'
by kernel test robot 21 Apr '25

21 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bf197758b04f43e61ebab66520f1420c1b64853c commit: 12f136b2134d4ded731c3ef23ac08c85b9c0b1fa [2139/2139] cpufreq: CPPC: Keep the target core awake when reading its cpufreq rate config: arm64-randconfig-002-20250421 (https://download.01.org/0day-ci/archive/20250421/202504211352.ik4vkTIa-lkp@…) compiler: aarch64-linux-gcc (GCC) 7.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250421/202504211352.ik4vkTIa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504211352.ik4vkTIa-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/cpufreq/cppc_cpufreq.c: In function 'cppc_get_perf_ctrs_pair': >> drivers/cpufreq/cppc_cpufreq.c:852:19: error: dereferencing pointer to incomplete type 'struct fb_ctr_pair' int cpu = fb_ctrs->cpu; ^~ drivers/cpufreq/cppc_cpufreq.c: In function 'cppc_cpufreq_get_rate': drivers/cpufreq/cppc_cpufreq.c:866:9: error: variable 'fb_ctrs' has initializer but incomplete type struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^~~~~~~~~~~ drivers/cpufreq/cppc_cpufreq.c:866:34: error: 'struct fb_ctr_pair' has no member named 'cpu' struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^~~ drivers/cpufreq/cppc_cpufreq.c:866:40: warning: excess elements in struct initializer struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^~~ drivers/cpufreq/cppc_cpufreq.c:866:40: note: (near initialization for 'fb_ctrs') drivers/cpufreq/cppc_cpufreq.c:866:21: error: storage size of 'fb_ctrs' isn't known struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^~~~~~~ drivers/cpufreq/cppc_cpufreq.c:866:21: warning: unused variable 'fb_ctrs' [-Wunused-variable] vim +852 drivers/cpufreq/cppc_cpufreq.c 848 849 static int cppc_get_perf_ctrs_pair(void *val) 850 { 851 struct fb_ctr_pair *fb_ctrs = val; > 852 int cpu = fb_ctrs->cpu; 853 int ret; 854 855 ret = cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t0); 856 if (ret) 857 return ret; 858 859 udelay(2); /* 2usec delay between sampling */ 860 861 return cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t1); 862 } 863 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[OLK-6.6 00/10] crypto: hisilicon - some bugfix
by Weili Qian 21 Apr '25

21 Apr '25

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Weili Qian (8): crypto: hisilicon/sec2: fix memory use-after-free issue crypto: hisilicon/qm - invalidate queues in use crypto: hisilicon/qm - mask axi error before memory init crypto: hisilicon/qm - modify interrupt processing resource application crypto: hisilicon/qm - fix the pf2vf timeout when global reset crypto: hisilicon/qm - obtain the mailbox configuration at one time hisi_acc_vfio_pci: obtain the mailbox configuration at one time crypto: hisilicon/qm - disable error report before flr Wenkai Lin (1): crypto: hisilicon/sec2 - fix for gcm spec check Zhiqi Song (1): crypto: hisilicon/hpre - fix dma unmap sequence drivers/crypto/hisilicon/hpre/hpre_crypto.c | 8 +- drivers/crypto/hisilicon/hpre/hpre_main.c | 103 ++-- drivers/crypto/hisilicon/qm.c | 561 ++++++++++++------ drivers/crypto/hisilicon/sec2/sec_crypto.c | 53 +- drivers/crypto/hisilicon/sec2/sec_main.c | 92 ++- drivers/crypto/hisilicon/zip/zip_main.c | 104 ++-- .../vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 45 +- include/linux/hisi_acc_qm.h | 33 +- 8 files changed, 604 insertions(+), 395 deletions(-) -- 2.43.0

1 10

[PATCH OLK-6.6 v3 00/18] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 21 Apr '25

21 Apr '25

Compare to v2: Patch 09: Merge the changes related to the impact on the common layer in Patch 10. Patch 18: New patch added. Compare to v1: Patch 5: Update the condition for MPAM to determine whether to perform MBM overflow checking. Patch 15: Split the original patch and merge part of the fix content into Patch 9. Jason Zeng (1): fs/resctrl: Support arch specific struct resctrl_arch_staged_config Zeng Heng (17): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value arch/x86/include/asm/resctrl.h | 33 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 16 +- drivers/platform/mpam/mpam_devices.c | 111 +++++-- drivers/platform/mpam/mpam_internal.h | 25 +- drivers/platform/mpam/mpam_resctrl.c | 355 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 141 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 135 ++++---- include/linux/arm_mpam.h | 11 + include/linux/resctrl.h | 32 +- include/linux/resctrl_types.h | 20 ++ 11 files changed, 692 insertions(+), 192 deletions(-) -- 2.25.1

2 19

[PATCH OLK-6.6 v3 00/18] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 21 Apr '25

21 Apr '25

Compare to v2: Patch 09: Merge the changes related to the impact on the common layer in Patch 10. Patch 18: New patch added. Compare to v1: Patch 5: Update the condition for MPAM to determine whether to perform MBM overflow checking. Patch 15: Split the original patch and merge part of the fix content into Patch 9. Jason Zeng (1): fs/resctrl: Support arch specific struct resctrl_arch_staged_config Zeng Heng (17): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value arch/x86/include/asm/resctrl.h | 33 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 16 +- drivers/platform/mpam/mpam_devices.c | 111 +++++-- drivers/platform/mpam/mpam_internal.h | 25 +- drivers/platform/mpam/mpam_resctrl.c | 355 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 141 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 135 ++++---- include/linux/arm_mpam.h | 11 + include/linux/resctrl.h | 32 +- include/linux/resctrl_types.h | 20 ++ 11 files changed, 692 insertions(+), 192 deletions(-) -- 2.25.1

2 19

[PATCH OLK-5.10 0/4] block: fix UAF in blk_mq_has_sqsched()
by Zheng Qixing 21 Apr '25

21 Apr '25

The issue occurs in blk_mq_has_sqsched() function which accesses q->elevator pointer and its members without any protection. During device state changes, related memory structures might be freed, causing a Use-After-Free vulnerability. This patch introduces a QUEUE_FLAG_SQ_SCHED flag that is set during scheduler initialization, eliminating the need for runtime checks of scheduler features. This removes the need to access q->elevator at unsafe moments, resolving the UAF issue. Bart Van Assche (1): block: Decode all flag names in the debugfs output Christoph Hellwig (1): block: remove QUEUE_FLAG_DEAD Ming Lei (2): blk-mq: protect q->elevator by ->sysfs_lock in blk_mq_elv_switch_none blk-mq: avoid to touch q->elevator without any protection block/bfq-iosched.c | 3 +++ block/blk-core.c | 2 -- block/blk-mq-debugfs.c | 9 ++++----- block/blk-mq-sched.c | 1 + block/blk-mq.c | 22 +++++----------------- block/kyber-iosched.c | 3 ++- block/mq-deadline.c | 3 +++ drivers/block/mtip32xx/mtip32xx.c | 2 +- include/linux/blkdev.h | 4 ++-- include/linux/elevator.h | 2 -- 10 files changed, 21 insertions(+), 30 deletions(-) -- 2.39.2

2 5

[PATCH OLK-5.10] md/raid1: fix bitmap update when all write requests fail
by Zheng Qixing 21 Apr '25

21 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBKHTZ ------------------------ When writing to a RAID1 array where all member disks have bad sectors at the target location, the bitmap update is skipped because all bios[] are NULL, leading to bitmap counter inconsistency. This can cause subsequent I/O operations to hang while waiting for bitmap counter to reach the expected value. Fix this by updating the bitmap when all member disks have bad sectors. Fixes: 1f68f0c4b677 ("md/raid1: avoid writing to known-bad blocks on known-bad drives.") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 7c9155a5a468..11f649ed2466 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1537,6 +1537,13 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, } } + /* + * Corresponding to md_bitmap_endwrite() from close_write(), in the case + * io range from all member disks are badblocks. + */ + if (first_clone) + md_bitmap_startwrite(bitmap, r1_bio->sector, r1_bio->sectors, 0); + r1_bio_write_done(r1_bio); /* In case raid1d snuck in to freeze_array */ -- 2.39.2

2 1

[PATCH OLK-5.10] md/raid1: fix memory leak in raid1_run() if no active rdev
by Zheng Qixing 21 Apr '25

21 Apr '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBKXOB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux.git/commit/?h=… ---------------------- When `raid1_set_limits()` fails or when the array has no active `rdev`, the allocated memory for `conf` is not properly freed. Add raid1_free() call to properly free the conf in error path. Fixes: 799af947ed13 ("md/raid1: don't free conf on raid0_run failure") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> Conflicts: drivers/md/raid1.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 333b611aa152..7c9155a5a468 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -45,6 +45,7 @@ static void allow_barrier(struct r1conf *conf, sector_t sector_nr); static void lower_barrier(struct r1conf *conf, sector_t sector_nr); +static void raid1_free(struct mddev *mddev, void *priv); #define raid1_log(md, fmt, args...) \ do { if ((md)->queue) blk_add_trace_msg((md)->queue, "raid1 " fmt, ##args); } while (0) @@ -3127,6 +3128,8 @@ static int raid1_run(struct mddev *mddev) */ if (conf->raid_disks - mddev->degraded < 1) { md_unregister_thread(&conf->thread); + if (!mddev->private) + raid1_free(mddev, conf); return -EINVAL; } -- 2.39.2

2 1

[PATCH OLK-5.10] md: bypass block throttle for superblock update
by Zheng Qixing 21 Apr '25

21 Apr '25

From: Junxiao Bi <junxiao.bi(a)oracle.com> mainline inclusion from mainline-v6.8-rc1 commit d6e035aad6c09991da1c667fb83419329a3baed8 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBLD3D Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ commit 5e2cf333b7bd ("md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d") introduced a hung bug and will be reverted in next patch, since the issue that commit is fixing is due to md superblock write is throttled by wbt, to fix it, we can have superblock write bypass block layer throttle. Fixes: 5e2cf333b7bd ("md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d") Cc: stable(a)vger.kernel.org # v5.19+ Suggested-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Junxiao Bi <junxiao.bi(a)oracle.com> Reviewed-by: Logan Gunthorpe <logang(a)deltatee.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Song Liu <song(a)kernel.org> Link: https://lore.kernel.org/r/20231108182216.73611-1-junxiao.bi@oracle.com Conflicts: drivers/md/md.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/md.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index a4d03d7f571a..d00ceffb8812 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -924,7 +924,8 @@ void md_super_write(struct mddev *mddev, struct md_rdev *rdev, test_bit(FailFast, &rdev->flags) && !test_bit(LastDev, &rdev->flags)) ff = MD_FAILFAST; - bio->bi_opf = REQ_OP_WRITE | REQ_SYNC | REQ_PREFLUSH | REQ_FUA | ff; + bio->bi_opf = REQ_OP_WRITE | REQ_SYNC | REQ_IDLE | REQ_META + | REQ_PREFLUSH | REQ_FUA | ff; atomic_inc(&mddev->pending_writes); submit_bio(bio); -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] md/raid1: fix memleak and double free in
by Zheng Qixing 21 Apr '25

21 Apr '25

Fix memleak and double free in raid1_run(). Christoph Hellwig (1): md/raid1: don't free conf on raid0_run failure Zheng Qixing (1): md/raid1: fix memory leak in raid1_run() if no active rdev drivers/md/raid1.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6] ASoC: imx-card: Add NULL check in imx_card_probe()
by Luo Gengkun 21 Apr '25

21 Apr '25

From: Henry Martin <bsdhenrymartin(a)gmail.com> stable inclusion from stable-v6.6.87 commit e283a5bf4337a7300ac5e6ae363cc8b242a0b4b7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QS4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 93d34608fd162f725172e780b1c60cc93a920719 ] devm_kasprintf() returns NULL when memory allocation fails. Currently, imx_card_probe() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue. Fixes: aa736700f42f ("ASoC: imx-card: Add imx-card machine driver") Signed-off-by: Henry Martin <bsdhenrymartin(a)gmail.com> Reviewed-by: Frank Li <Frank.Li(a)nxp.com> Link: https://patch.msgid.link/20250401142510.29900-1-bsdhenrymartin@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/soc/fsl/imx-card.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/soc/fsl/imx-card.c b/sound/soc/fsl/imx-card.c index f8144bf4c90d..7128bcf3a743 100644 --- a/sound/soc/fsl/imx-card.c +++ b/sound/soc/fsl/imx-card.c @@ -742,6 +742,8 @@ static int imx_card_probe(struct platform_device *pdev) data->dapm_routes[i].sink = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%d %s", i + 1, "Playback"); + if (!data->dapm_routes[i].sink) + return -ENOMEM; data->dapm_routes[i].source = "CPU-Playback"; } } @@ -759,6 +761,8 @@ static int imx_card_probe(struct platform_device *pdev) data->dapm_routes[i].source = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%d %s", i + 1, "Capture"); + if (!data->dapm_routes[i].source) + return -ENOMEM; data->dapm_routes[i].sink = "CPU-Capture"; } } -- 2.34.1

2 1