tree: https://gitee.com/openeuler/kernel.git OLK-5.10
head: 3e6d44ea60eb8609ba59273c12276e3236cd76b2
commit: b12b4a14e6dc13b75697ebc80f513fedd068345e [4121/30000] xfs: remove xfs_dqrele_all_inodes
config: x86_64-randconfig-161-20240906 (https://download.01.org/0day-ci/archive/20240909/202409091024.XP4R6muy-lkp@…)
compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202409091024.XP4R6muy-lkp@intel.com/
New smatch warnings:
fs/xfs/xfs_icache.c:52 xfs_icwalk_tag() warn: unsigned 'goal' is never less than zero.
Old smatch warnings:
fs/xfs/xfs_icache.c:534 xfs_iget_cache_hit() warn: missing unwind goto?
vim +/goal +52 fs/xfs/xfs_icache.c
656d89e710ffc0 Darrick J. Wong 2022-01-07 47
656d89e710ffc0 Darrick J. Wong 2022-01-07 48 /* Compute the inode radix tree tag for this goal. */
656d89e710ffc0 Darrick J. Wong 2022-01-07 49 static inline unsigned int
656d89e710ffc0 Darrick J. Wong 2022-01-07 50 xfs_icwalk_tag(enum xfs_icwalk_goal goal)
656d89e710ffc0 Darrick J. Wong 2022-01-07 51 {
656d89e710ffc0 Darrick J. Wong 2022-01-07 @52 return goal < 0 ? XFS_ICWALK_NULL_TAG : goal;
656d89e710ffc0 Darrick J. Wong 2022-01-07 53 }
656d89e710ffc0 Darrick J. Wong 2022-01-07 54
:::::: The code at line 52 was first introduced by commit
:::::: 656d89e710ffc01bc169a476208c84a0048cb554 xfs: pass the goal of the incore inode walk to xfs_inode_walk()
:::::: TO: Darrick J. Wong <djwong(a)kernel.org>
:::::: CC: Zheng Zengkai <zhengzengkai(a)huawei.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
From: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp>
stable inclusion
from stable-v5.10.224
commit b7b8d9f5e679af60c94251fd6728dde34be69a71
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYL
CVE: CVE-2024-44971
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
-------------------------------------------------
[ Upstream commit e3862093ee93fcfbdadcb7957f5f8974fffa806a ]
bcm_sf2_mdio_register() calls of_phy_find_device() and then
phy_device_remove() in a loop to remove existing PHY devices.
of_phy_find_device() eventually calls bus_find_device(), which calls
get_device() on the returned struct device * to increment the refcount.
The current implementation does not decrement the refcount, which causes
memory leak.
This commit adds the missing phy_device_free() call to decrement the
refcount via put_device() to balance the refcount.
Fixes: 771089c2a485 ("net: dsa: bcm_sf2: Ensure that MDIO diversion is used")
Signed-off-by: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp>
Tested-by: Florian Fainelli <florian.fainelli(a)broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli(a)broadcom.com>
Link: https://patch.msgid.link/20240806011327.3817861-1-joe@pf.is.s.u-tokyo.ac.jp
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Liu Jian <liujian56(a)huawei.com>
---
drivers/net/dsa/bcm_sf2.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index a5849663f65c..d0f94a5fae5a 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -558,8 +558,10 @@ static int bcm_sf2_mdio_register(struct dsa_switch *ds)
of_remove_property(child, prop);
phydev = of_phy_find_device(child);
- if (phydev)
+ if (phydev) {
phy_device_remove(phydev);
+ phy_device_free(phydev);
+ }
}
err = mdiobus_register(priv->slave_mii_bus);
--
2.34.1
From: Chris Wulff <crwulff(a)gmail.com>
mainline inclusion
from mainline-v6.11-rc3
commit 973a57891608a98e894db2887f278777f564de18
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZ1
CVE: CVE-2024-44960
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
Make sure the descriptor has been set before looking at maxpacket.
This fixes a null pointer panic in this case.
This may happen if the gadget doesn't properly set up the endpoint
for the current speed, or the gadget descriptors are malformed and
the descriptor for the speed/endpoint are not found.
No current gadget driver is known to have this problem, but this
may cause a hard-to-find bug during development of new gadgets.
Fixes: 54f83b8c8ea9 ("USB: gadget: Reject endpoints with 0 maxpacket value")
Cc: stable(a)vger.kernel.org
Signed-off-by: Chris Wulff <crwulff(a)gmail.com>
Link: https://lore.kernel.org/r/20240725010419.314430-2-crwulff@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Ye Bin <yebin10(a)huawei.com>
---
drivers/usb/gadget/udc/core.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index b45dd7827ff9..1335a715f5dd 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -99,12 +99,10 @@ int usb_ep_enable(struct usb_ep *ep)
goto out;
/* UDC drivers can't handle endpoints with maxpacket size 0 */
- if (usb_endpoint_maxp(ep->desc) == 0) {
- /*
- * We should log an error message here, but we can't call
- * dev_err() because there's no way to find the gadget
- * given only ep.
- */
+ if (!ep->desc || usb_endpoint_maxp(ep->desc) == 0) {
+ WARN_ONCE(1, "%s: ep%d (%s) has %s\n", __func__, ep->address, ep->name,
+ (!ep->desc) ? "NULL descriptor" : "maxpacket 0");
+
ret = -EINVAL;
goto out;
}
--
2.34.1
From: Chris Wulff <crwulff(a)gmail.com>
mainline inclusion
from mainline-v6.11-rc3
commit 973a57891608a98e894db2887f278777f564de18
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZ1
CVE: CVE-2024-44960
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
Make sure the descriptor has been set before looking at maxpacket.
This fixes a null pointer panic in this case.
This may happen if the gadget doesn't properly set up the endpoint
for the current speed, or the gadget descriptors are malformed and
the descriptor for the speed/endpoint are not found.
No current gadget driver is known to have this problem, but this
may cause a hard-to-find bug during development of new gadgets.
Fixes: 54f83b8c8ea9 ("USB: gadget: Reject endpoints with 0 maxpacket value")
Cc: stable(a)vger.kernel.org
Signed-off-by: Chris Wulff <crwulff(a)gmail.com>
Link: https://lore.kernel.org/r/20240725010419.314430-2-crwulff@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Ye Bin <yebin10(a)huawei.com>
---
drivers/usb/gadget/udc/core.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 7330c1999104..77ee0dbc52c5 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -99,12 +99,10 @@ int usb_ep_enable(struct usb_ep *ep)
goto out;
/* UDC drivers can't handle endpoints with maxpacket size 0 */
- if (usb_endpoint_maxp(ep->desc) == 0) {
- /*
- * We should log an error message here, but we can't call
- * dev_err() because there's no way to find the gadget
- * given only ep.
- */
+ if (!ep->desc || usb_endpoint_maxp(ep->desc) == 0) {
+ WARN_ONCE(1, "%s: ep%d (%s) has %s\n", __func__, ep->address, ep->name,
+ (!ep->desc) ? "NULL descriptor" : "maxpacket 0");
+
ret = -EINVAL;
goto out;
}
--
2.34.1
From: Chris Wulff <crwulff(a)gmail.com>
mainline inclusion
from mainline-v6.11-rc3
commit 973a57891608a98e894db2887f278777f564de18
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZ1
CVE: CVE-2024-44960
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
Make sure the descriptor has been set before looking at maxpacket.
This fixes a null pointer panic in this case.
This may happen if the gadget doesn't properly set up the endpoint
for the current speed, or the gadget descriptors are malformed and
the descriptor for the speed/endpoint are not found.
No current gadget driver is known to have this problem, but this
may cause a hard-to-find bug during development of new gadgets.
Fixes: 54f83b8c8ea9 ("USB: gadget: Reject endpoints with 0 maxpacket value")
Cc: stable(a)vger.kernel.org
Signed-off-by: Chris Wulff <crwulff(a)gmail.com>
Link: https://lore.kernel.org/r/20240725010419.314430-2-crwulff@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Ye Bin <yebin10(a)huawei.com>
---
drivers/usb/gadget/udc/core.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index e80aa717c8b5..dd2fafc5b0c3 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -99,12 +99,10 @@ int usb_ep_enable(struct usb_ep *ep)
goto out;
/* UDC drivers can't handle endpoints with maxpacket size 0 */
- if (usb_endpoint_maxp(ep->desc) == 0) {
- /*
- * We should log an error message here, but we can't call
- * dev_err() because there's no way to find the gadget
- * given only ep.
- */
+ if (!ep->desc || usb_endpoint_maxp(ep->desc) == 0) {
+ WARN_ONCE(1, "%s: ep%d (%s) has %s\n", __func__, ep->address, ep->name,
+ (!ep->desc) ? "NULL descriptor" : "maxpacket 0");
+
ret = -EINVAL;
goto out;
}
--
2.34.1
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: 13b424f97ef548612c760cfd0892f96de96707e0
commit: f38a43c2e1f2214acbda5d46af4518aa1d9d5e92 [14696/23701] mm: don't rely on system state to detect hot-plug operations
config: x86_64-randconfig-123-20240906 (https://download.01.org/0day-ci/archive/20240907/202409072051.qFE23qXy-lkp@…)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240907/202409072051.qFE23qXy-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202409072051.qFE23qXy-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
>> drivers/base/node.c:429:5: sparse: sparse: symbol 'register_mem_block_under_node_early' was not declared. Should it be static?
drivers/base/node.c:429:5: warning: no previous prototype for 'register_mem_block_under_node_early' [-Wmissing-prototypes]
429 | int register_mem_block_under_node_early(struct memory_block *mem_blk, void *arg)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
vim +/register_mem_block_under_node_early +429 drivers/base/node.c
427
428 /* register memory section under specified node if it spans that node */
> 429 int register_mem_block_under_node_early(struct memory_block *mem_blk, void *arg)
430 {
431 int nid = *(int *)arg;
432 unsigned long pfn, sect_start_pfn, sect_end_pfn;
433
434 sect_start_pfn = section_nr_to_pfn(mem_blk->start_section_nr);
435 sect_end_pfn = section_nr_to_pfn(mem_blk->end_section_nr);
436 sect_end_pfn += PAGES_PER_SECTION - 1;
437 for (pfn = sect_start_pfn; pfn <= sect_end_pfn; pfn++) {
438 int page_nid;
439
440 /*
441 * memory block could have several absent sections from start.
442 * skip pfn range from absent section
443 */
444 if (!pfn_present(pfn)) {
445 pfn = round_down(pfn + PAGES_PER_SECTION,
446 PAGES_PER_SECTION) - 1;
447 continue;
448 }
449
450 /*
451 * We need to check if page belongs to nid only at the boot
452 * case because node's ranges can be interleaved.
453 */
454 page_nid = get_nid_for_pfn(pfn);
455 if (page_nid < 0)
456 continue;
457 if (page_nid != nid)
458 continue;
459
460 return do_register_memory_block_under_node(nid, mem_blk);
461 }
462 /* mem section does not span the specified node */
463 return 0;
464 }
465
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki