- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] net/hinic3: Modify driver version
by LinKun 20 Oct '25

20 Oct '25

From: zhuyikai <zhuyikai1(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICGDO6?from=project-issue CVE: NA -------------------------------- Modify driver version. Fixes: 79871cd2cd72 ("net/hinic3: Synchronize new NIC features and bug fixes") Signed-off-by: zhuyikai <zhuyikai1(a)h-partners.com> --- hinic3/hinic3_crm.h | 2 +- hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/hinic3/hinic3_crm.h b/hinic3/hinic3_crm.h index 7979244..5a11331 100644 --- a/hinic3/hinic3_crm.h +++ b/hinic3/hinic3_crm.h @@ -8,7 +8,7 @@ #include "mpu_cmd_base_defs.h" -#define HINIC3_DRV_VERSION "17.7.8.1" +#define HINIC3_DRV_VERSION "17.7.8.101" #define HINIC3_DRV_DESC "Intelligent Network Interface Card Driver" #define HIUDK_DRV_DESC "Intelligent Network Unified Driver" diff --git a/hinic3/hinic3_nic_dev.h b/hinic3/hinic3_nic_dev.h index 137098b..3d2a962 100644 --- a/hinic3/hinic3_nic_dev.h +++ b/hinic3/hinic3_nic_dev.h @@ -18,7 +18,7 @@ #include "vram_common.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "17.7.8.1" +#define HINIC3_NIC_DRV_VERSION "17.7.8.101" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-53265
by Wang Zhaolong 20 Oct '25

20 Oct '25

George Kennedy (1): ubi: ensure that VID header offset + VID header size <= alloc, size Zhihao Cheng (1): ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size drivers/mtd/ubi/build.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) -- 2.34.3

2 3

[PATCH OLK-6.6] sched/core: Add sched_change_qos_group() in sched_cgroup_fork()
by Wang Tao 20 Oct '25

20 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID23FN ------------------ We use sched_change_qos_group() to change task qos group for the new task in cgroup_post_fork() if we enable the qos sched feature. Since commit 39c4261191bf ("sched/fair: Remove redundant cpu_cgrp_subsys->fork()") has remove cpu_cgrp_subsys->fork(), if we enable qos sched feature, the function "sched_change_qos_group" is lost. cgroup_post_fork() ss->fork() := cpu_cgroup_fork() --> removed sched_change_group(..., TASK_SET_GROUP) #ifdef CONFIG_QOS_SCHED sched_change_qos_group(); --> lost #endif So this patch add the function "sched_change_qos_group" in sched_cgroup_fork(). Fixes: 39c4261191bf ("sched/fair: Remove redundant cpu_cgrp_subsys->fork()") Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/sched/core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 47877f3b52f6..2740e9b918f5 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -120,6 +120,10 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_update_nr_running_tp); DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); +#ifdef CONFIG_QOS_SCHED +static void sched_change_qos_group(struct task_struct *tsk, struct task_group *tg); +#endif + #ifdef CONFIG_SCHED_DEBUG /* * Debugging: various feature bits @@ -4863,6 +4867,7 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p) void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs) { unsigned long flags; + struct task_group *tg_qos __maybe_unused = NULL; /* * Because we're not yet on the pid-hash, p->pi_lock isn't strictly @@ -4876,6 +4881,9 @@ void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs) struct task_group, css); tg = autogroup_task_group(p, tg); p->sched_task_group = tg; +#ifdef CONFIG_QOS_SCHED + tg_qos = tg; +#endif } #endif rseq_migrate(p); @@ -4884,6 +4892,10 @@ void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs) * so use __set_task_cpu(). */ __set_task_cpu(p, smp_processor_id()); +#ifdef CONFIG_QOS_SCHED + sched_change_qos_group(p, tg_qos); +#endif + if (p->sched_class->task_fork) p->sched_class->task_fork(p); raw_spin_unlock_irqrestore(&p->pi_lock, flags); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-53271
by Wang Zhaolong 20 Oct '25

20 Oct '25

Li Zetao (2): ubi: Fix use-after-free when volume resizing failed ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() drivers/mtd/ubi/vmt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.3

2 3

[PATCH openEuler-1.0-LTS] cifs: Fix warning and UAF when destroy the MR list
by Wang Zhaolong 20 Oct '25

20 Oct '25

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> stable inclusion from stable-v4.19.276 commit 275a3d2b9408fc4895e342f772cab9a89960546e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYQRV CVE: CVE-2023-53427 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3e161c2791f8e661eed24a2c624087084d910215 ] If the MR allocate failed, the MR recovery work not initialized and list not cleared. Then will be warning and UAF when release the MR: WARNING: CPU: 4 PID: 824 at kernel/workqueue.c:3066 __flush_work.isra.0+0xf7/0x110 CPU: 4 PID: 824 Comm: mount.cifs Not tainted 6.1.0-rc5+ #82 RIP: 0010:__flush_work.isra.0+0xf7/0x110 Call Trace: <TASK> __cancel_work_timer+0x2ba/0x2e0 smbd_destroy+0x4e1/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 BUG: KASAN: use-after-free in smbd_destroy+0x4fc/0x990 Read of size 8 at addr ffff88810b156a08 by task mount.cifs/824 CPU: 4 PID: 824 Comm: mount.cifs Tainted: G W 6.1.0-rc5+ #82 Call Trace: dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 smbd_destroy+0x4fc/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Allocated by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x7a/0x90 _smbd_get_connection+0x1b6f/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 __kmem_cache_free+0xc8/0x330 _smbd_get_connection+0x1c6a/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Let's initialize the MR recovery work before MR allocate to prevent the warning, remove the MRs from the list to prevent the UAF. Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") Acked-by: Paulo Alcantara (SUSE) <pc(a)cjr.nz> Reviewed-by: Tom Talpey <tom(a)talpey.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/cifs/smbdirect.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c index 784628ec4bc4..71b9be2159ed 100644 --- a/fs/cifs/smbdirect.c +++ b/fs/cifs/smbdirect.c @@ -2376,10 +2376,11 @@ static int allocate_mr_list(struct smbd_connection *info) init_waitqueue_head(&info->wait_mr); spin_lock_init(&info->mr_list_lock); atomic_set(&info->mr_ready_count, 0); atomic_set(&info->mr_used_count, 0); init_waitqueue_head(&info->wait_for_mr_cleanup); + INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work); /* Allocate more MRs (2x) than hardware responder_resources */ for (i = 0; i < info->responder_resources * 2; i++) { smbdirect_mr = kzalloc(sizeof(*smbdirect_mr), GFP_KERNEL); if (!smbdirect_mr) goto out; @@ -2404,17 +2405,17 @@ static int allocate_mr_list(struct smbd_connection *info) smbdirect_mr->conn = info; list_add_tail(&smbdirect_mr->list, &info->mr_list); atomic_inc(&info->mr_ready_count); } - INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work); return 0; out: kfree(smbdirect_mr); list_for_each_entry_safe(smbdirect_mr, tmp, &info->mr_list, list) { + list_del(&smbdirect_mr->list); ib_dereg_mr(smbdirect_mr->mr); kfree(smbdirect_mr->sgl); kfree(smbdirect_mr); } return -ENOMEM; -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
by Wang Zhaolong 20 Oct '25

20 Oct '25

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v4.19.276 commit f006f596fe851c3b6aae60b79f89f89f0e515d2f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0REZ CVE: CVE-2023-53481 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Following process will trigger an infinite loop in ubi_wl_put_peb(): ubifs_bgt ubi_bgt ubifs_leb_unmap ubi_leb_unmap ubi_eba_unmap_leb ubi_wl_put_peb wear_leveling_worker e1 = rb_entry(rb_first(&ubi->used) e2 = get_peb_for_wl(ubi) ubi_io_read_vid_hdr // return err (flash fault) out_error: ubi->move_from = ubi->move_to = NULL wl_entry_destroy(ubi, e1) ubi->lookuptbl[e->pnum] = NULL retry: e = ubi->lookuptbl[pnum]; // return NULL if (e == ubi->move_from) { // NULL == NULL gets true goto retry; // infinite loop !!! $ top PID USER PR NI VIRT RES SHR S %CPU %MEM COMMAND 7676 root 20 0 0 0 0 R 100.0 0.0 ubifs_bgt0_0 Fix it by: 1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has been removed from 'ubi->lookuptbl'. 2) Using 'ubi->wl_lock' protecting wl entry deletion to preventing an use-after-free problem for wl entry in ubi_wl_put_peb(). Fetch a reproducer in [Link]. Fixes: 43f9b25a9cdd7b1 ("UBI: bugfix: protect from volume removal") Fixes: ee59ba8b064f692 ("UBI: Fix stale pointers in ubi->lookuptbl") Link: https://bugzilla.kernel.org/show_bug.cgi?id=216111 Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- drivers/mtd/ubi/wl.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c index 6f2ac865ff05..c6b62bc16114 100644 --- a/drivers/mtd/ubi/wl.c +++ b/drivers/mtd/ubi/wl.c @@ -959,15 +959,15 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, ubi_err(ubi, "error %d while moving PEB %d (LEB %d:%d) to PEB %d", err, e1->pnum, vol_id, lnum, e2->pnum); spin_lock(&ubi->wl_lock); ubi->move_from = ubi->move_to = NULL; ubi->move_to_put = ubi->wl_scheduled = 0; + wl_entry_destroy(ubi, e1); + wl_entry_destroy(ubi, e2); spin_unlock(&ubi->wl_lock); ubi_free_vid_buf(vidb); - wl_entry_destroy(ubi, e1); - wl_entry_destroy(ubi, e2); out_ro: ubi_ro_mode(ubi); mutex_unlock(&ubi->move_mutex); up_read(&ubi->fm_eba_sem); @@ -1224,10 +1224,22 @@ int ubi_wl_put_peb(struct ubi_device *ubi, int vol_id, int lnum, down_read(&ubi->fm_protect); retry: spin_lock(&ubi->wl_lock); e = ubi->lookuptbl[pnum]; + if (!e) { + /* + * This wl entry has been removed for some errors by other + * process (eg. wear leveling worker), corresponding process + * (except __erase_worker, which cannot concurrent with + * ubi_wl_put_peb) will set ubi ro_mode at the same time, + * just ignore this wl entry. + */ + spin_unlock(&ubi->wl_lock); + up_read(&ubi->fm_protect); + return 0; + } if (e == ubi->move_from) { /* * User is putting the physical eraseblock which was selected to * be moved. It will be scheduled for erasure in the * wear-leveling worker. -- 2.34.3

2 1

[PATCH OLK-6.6] sdei_watchdog: Add CPU_PM_ENTER_FAILED handling in sdei_watchdog_pm_notifier
by Bowen You 20 Oct '25

20 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LQCC CVE: NA ------------------------------------------------- The `CPU_PM_ENTER_FAILED` case was added to align with the handling in `sdei_pm_notifier`. This ensures proper masking/unmasking of events for the CPU when entering idle fails, maintaining consistency across CPU power management actions. Fixes: c8f96adca7fa ("arm64/watchdog: fix watchdog failure in low power scenarios") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/arm64/kernel/watchdog_sdei.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/kernel/watchdog_sdei.c b/arch/arm64/kernel/watchdog_sdei.c index d8019becf10d..9d63bb063718 100644 --- a/arch/arm64/kernel/watchdog_sdei.c +++ b/arch/arm64/kernel/watchdog_sdei.c @@ -123,6 +123,7 @@ static int sdei_watchdog_pm_notifier(struct notifier_block *nb, rv = sdei_api_event_disable(sdei_watchdog_event_num); break; case CPU_PM_EXIT: + case CPU_PM_ENTER_FAILED: if (per_cpu(sdei_usr_en, smp_processor_id())) rv = sdei_api_event_enable(sdei_watchdog_event_num); break; -- 2.34.1

2 1

[PATCH OLK-6.6] sdei_watchdog: Add CPU_PM_ENTER_FAILED handling in sdei_watchdog_pm_notifier
by Bowen You 19 Oct '25

19 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LQCC CVE: NA ------------------------------------------------- The `CPU_PM_ENTER_FAILED` case was added to align with the handling in `sdei_pm_notifier`. This ensures proper masking/unmasking of events for the CPU when entering idle fails, maintaining consistency across CPU power management actions. Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/arm64/kernel/watchdog_sdei.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/kernel/watchdog_sdei.c b/arch/arm64/kernel/watchdog_sdei.c index d8019becf10d..9d63bb063718 100644 --- a/arch/arm64/kernel/watchdog_sdei.c +++ b/arch/arm64/kernel/watchdog_sdei.c @@ -123,6 +123,7 @@ static int sdei_watchdog_pm_notifier(struct notifier_block *nb, rv = sdei_api_event_disable(sdei_watchdog_event_num); break; case CPU_PM_EXIT: + case CPU_PM_ENTER_FAILED: if (per_cpu(sdei_usr_en, smp_processor_id())) rv = sdei_api_event_enable(sdei_watchdog_event_num); break; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1739/1739] kernel/cgroup/cgroup.c:5286:48: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 19 Oct '25

19 Oct '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e98deea13d81cacd6479edf0de6267118ae7c639 commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [1739/1739] dhugetlb: backport dynamic hugetlb feature config: arm64-randconfig-r121-20250728 (https://download.01.org/0day-ci/archive/20251019/202510190902.kewkpNkE-lkp@…) compiler: aarch64-linux-gcc (GCC) 8.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251019/202510190902.kewkpNkE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510190902.kewkpNkE-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/cgroup/cgroup.c:5286:48: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct cgroup_subsys_state *css @@ got struct cgroup_subsys_state [noderef] <asn:4> * @@ kernel/cgroup/cgroup.c:5286:48: sparse: expected struct cgroup_subsys_state *css kernel/cgroup/cgroup.c:5286:48: sparse: got struct cgroup_subsys_state [noderef] <asn:4> * kernel/cgroup/cgroup.c:2685:20: sparse: sparse: context imbalance in 'cgroup_procs_write_start' - wrong count at exit kernel/cgroup/cgroup.c:2741:9: sparse: sparse: context imbalance in 'cgroup_procs_write_finish' - wrong count at exit kernel/cgroup/cgroup.c:2874:9: sparse: sparse: context imbalance in 'cgroup_lock_and_drain_offline' - wrong count at exit kernel/cgroup/cgroup.c:4528:16: sparse: sparse: context imbalance in 'cgroup_procs_write' - wrong count at exit kernel/cgroup/cgroup.c:4580:16: sparse: sparse: context imbalance in 'cgroup_threads_write' - wrong count at exit vim +5286 kernel/cgroup/cgroup.c 5234 5235 /** 5236 * cgroup_destroy_locked - the first stage of cgroup destruction 5237 * @cgrp: cgroup to be destroyed 5238 * 5239 * css's make use of percpu refcnts whose killing latency shouldn't be 5240 * exposed to userland and are RCU protected. Also, cgroup core needs to 5241 * guarantee that css_tryget_online() won't succeed by the time 5242 * ->css_offline() is invoked. To satisfy all the requirements, 5243 * destruction is implemented in the following two steps. 5244 * 5245 * s1. Verify @cgrp can be destroyed and mark it dying. Remove all 5246 * userland visible parts and start killing the percpu refcnts of 5247 * css's. Set up so that the next stage will be kicked off once all 5248 * the percpu refcnts are confirmed to be killed. 5249 * 5250 * s2. Invoke ->css_offline(), mark the cgroup dead and proceed with the 5251 * rest of destruction. Once all cgroup references are gone, the 5252 * cgroup is RCU-freed. 5253 * 5254 * This function implements s1. After this step, @cgrp is gone as far as 5255 * the userland is concerned and a new cgroup with the same name may be 5256 * created. As cgroup doesn't care about the names internally, this 5257 * doesn't cause any problem. 5258 */ 5259 static int cgroup_destroy_locked(struct cgroup *cgrp) 5260 __releases(&cgroup_mutex) __acquires(&cgroup_mutex) 5261 { 5262 struct cgroup *tcgrp, *parent = cgroup_parent(cgrp); 5263 struct cgroup_subsys_state *css; 5264 struct cgrp_cset_link *link; 5265 int ssid; 5266 5267 lockdep_assert_held(&cgroup_mutex); 5268 5269 /* 5270 * Only migration can raise populated from zero and we're already 5271 * holding cgroup_mutex. 5272 */ 5273 if (cgroup_is_populated(cgrp)) 5274 return -EBUSY; 5275 5276 /* 5277 * Make sure there's no live children. We can't test emptiness of 5278 * ->self.children as dead children linger on it while being 5279 * drained; otherwise, "rmdir parent/child parent" may fail. 5280 */ 5281 if (css_has_online_children(&cgrp->self)) 5282 return -EBUSY; 5283 5284 #ifdef CONFIG_MEMCG 5285 /* If we use dynamic hugetlb, make sure dhugtlb_pool is free */ > 5286 if (!dhugetlb_pool_is_free(cgrp->subsys[memory_cgrp_id])) 5287 return -EBUSY; 5288 #endif 5289 /* 5290 * Mark @cgrp and the associated csets dead. The former prevents 5291 * further task migration and child creation by disabling 5292 * cgroup_lock_live_group(). The latter makes the csets ignored by 5293 * the migration path. 5294 */ 5295 cgrp->self.flags &= ~CSS_ONLINE; 5296 5297 spin_lock_irq(&css_set_lock); 5298 list_for_each_entry(link, &cgrp->cset_links, cset_link) 5299 link->cset->dead = true; 5300 spin_unlock_irq(&css_set_lock); 5301 5302 /* initiate massacre of all css's */ 5303 for_each_css(css, ssid, cgrp) 5304 kill_css(css); 5305 5306 /* clear and remove @cgrp dir, @cgrp has an extra ref on its kn */ 5307 css_clear_dir(&cgrp->self); 5308 kernfs_remove(cgrp->kn); 5309 5310 if (parent && cgroup_is_threaded(cgrp)) 5311 parent->nr_threaded_children--; 5312 5313 spin_lock_irq(&css_set_lock); 5314 for (tcgrp = cgroup_parent(cgrp); tcgrp; tcgrp = cgroup_parent(tcgrp)) { 5315 tcgrp->nr_descendants--; 5316 tcgrp->nr_dying_descendants++; 5317 } 5318 spin_unlock_irq(&css_set_lock); 5319 5320 cgroup1_check_for_release(parent); 5321 5322 /* put the base reference */ 5323 percpu_ref_kill(&cgrp->self.refcnt); 5324 5325 return 0; 5326 }; 5327 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1739/1739] mm/page_alloc.c:4648:27: sparse: sparse: invalid assignment: &=
by kernel test robot 19 Oct '25

19 Oct '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e98deea13d81cacd6479edf0de6267118ae7c639 commit: 875ffd41499ee5a3512da409cbd4c2ffd32b3cfa [1739/1739] mm: Do limit checking after memory allocation for memory reliable config: arm64-randconfig-r121-20250728 (https://download.01.org/0day-ci/archive/20251019/202510190803.oHSjvBlI-lkp@…) compiler: aarch64-linux-gcc (GCC) 8.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251019/202510190803.oHSjvBlI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510190803.oHSjvBlI-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/page_alloc.c:140:1: sparse: sparse: symbol 'pcpu_drain_mutex' was not declared. Should it be static? mm/page_alloc.c:141:1: sparse: sparse: symbol '__pcpu_scope_pcpu_drain' was not declared. Should it be static? mm/page_alloc.c: note: in included file (through include/linux/mm.h): include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer >> mm/page_alloc.c:4648:27: sparse: sparse: invalid assignment: &= mm/page_alloc.c:4648:27: sparse: left side has type restricted gfp_t mm/page_alloc.c:4648:27: sparse: right side has type int In file included from mm/page_alloc.c:70: mm/page_alloc.c: In function 'deferred_init_memmap': include/linux/ktask.h:123:21: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] .kc_thread_func = (ktask_thread_func)(thread_func), 15- ^ include/linux/ktask.h:139:3: note: in expansion of macro 'KTASK_CTL_INITIALIZER' KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) 18- ^~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1730:3: note: in expansion of macro 'DEFINE_KTASK_CTL' DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, ^~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] .kc_thread_func = (ktask_thread_func)(thread_func), 24- ^ include/linux/ktask.h:139:3: note: in expansion of macro 'KTASK_CTL_INITIALIZER' KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) 27- ^~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1746:3: note: in expansion of macro 'DEFINE_KTASK_CTL' DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, ^~~~~~~~~~~~~~~~ mm/page_alloc.c:3083: warning: Function parameter or member 'mt' not described in '__putback_isolated_page' vim +4648 mm/page_alloc.c 4606 4607 /* 4608 * return true means memory allocation need retry and flag ___GFP_RELIABILITY 4609 * must be cleared. 4610 */ 4611 static inline bool check_after_alloc(gfp_t *gfp_mask, unsigned int order, 4612 int preferred_nid, nodemask_t *nodemask, 4613 struct page **_page) 4614 { 4615 if (!mem_reliable_is_enabled()) 4616 return false; 4617 4618 if (!(*gfp_mask & ___GFP_RELIABILITY)) 4619 return false; 4620 4621 if (!*_page) 4622 goto out_retry; 4623 4624 if (*gfp_mask & __GFP_NOFAIL) 4625 goto out; 4626 4627 /* check water mark, reserver mirrored mem for kernel */ 4628 if (!mem_reliable_watermark_ok(1 << order)) 4629 goto out_free_page; 4630 4631 /* percpu counter is not initialized, ignore limit check */ 4632 if (!mem_reliable_counter_initialized()) 4633 goto out; 4634 4635 /* spcial user task, systemd is limited by task_reliable_limit */ 4636 if (((current->flags & PF_RELIABLE) || is_global_init(current)) && 4637 !reliable_mem_limit_check(1 << order)) 4638 goto out_free_page; 4639 4640 goto out; 4641 4642 out_free_page: 4643 __free_pages(*_page, order); 4644 *_page = NULL; 4645 4646 out_retry: 4647 if (reliable_allow_fb_enabled() || is_global_init(current)) { > 4648 *gfp_mask &= ~___GFP_RELIABILITY; 4649 return true; 4650 } 4651 4652 if (*gfp_mask & (__GFP_NORETRY | __GFP_RETRY_MAYFAIL | __GFP_THISNODE)) 4653 goto out; 4654 4655 /* Coredumps can quickly deplete all memory reserves */ 4656 if (current->flags & PF_DUMPCORE) 4657 goto out; 4658 /* The OOM killer will not help higher order allocs */ 4659 if (order > PAGE_ALLOC_COSTLY_ORDER) 4660 goto out; 4661 4662 /* oom here */ 4663 mem_reliable_out_of_memory(*gfp_mask, order, preferred_nid, 4664 nodemask); 4665 out: 4666 return false; 4667 } 4668 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0