- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] nfsd: provide locking for v4_end_grace
by Li Lingfeng 25 Nov '25

25 Nov '25

From: NeilBrown <neil(a)brown.name> maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID8DQ8 Reference: https://lore.kernel.org/all/175144911127.565058.5990359597048022103@noble.n… ------------------ Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly. We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is held while client_tracking_op->init() is called and that can wait for an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a deadlock. nfsd4_end_grace() is also called by the landromat work queue and this doesn't require locking as server shutdown will stop the work and wait for it before freeing anything that nfsd4_end_grace() might access. However, we must be sure that writing to v4_end_grace doesn't restart the work item after shutdown has already waited for it. For this we add a new flag protected with nn->client_lock. It is set only while it is safe to make client tracking calls, and v4_end_grace only schedules work while the flag is set with the spinlock held. So this patch adds a nfsd_net field "client_tracking_active" which is set as described. Another field "grace_end_forced", is set when v4_end_grace is written. After this is set, and providing client_tracking_active is set, the laundromat is scheduled. This "grace_end_forced" field bypasses other checks for whether the grace period has finished. This resolves a race which can result in use-after-free. Reported-by: Li Lingfeng <lilingfeng3(a)huawei.com> Cc: stable(a)vger.kernel.org Signed-off-by: NeilBrown <neil(a)brown.name> Conflicts: fs/nfsd/nfs4state.c fs/nfsd/nfsctl.c fs/nfsd/state.h [Commit bad4c585ccaa ("NFSD: send OP_CB_RECALL_ANY to clients when number of delegations reaches its limit") added the declaration of deleg_reaper; commit d17452aa33a6 ("nfsd: dynamically allocate the nfsd-client shrinker") replace unregister_shrinker with shrinker_free; commit 39d432fc7630 ("NFSD: trace nfsctl operations") replace nfsd4_end_grace with trace_nfsd_end_grace; commit 1ac3629bf012 ("nfsd: prepare for supporting admin-revocation of state") added the declaration of nfsd4_revoke_states;] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/netns.h | 2 ++ fs/nfsd/nfs4state.c | 29 +++++++++++++++++++++++++++-- fs/nfsd/nfsctl.c | 3 +-- fs/nfsd/state.h | 2 +- 4 files changed, 31 insertions(+), 5 deletions(-) diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h index 72770fe0fdfe..e80691241aef 100644 --- a/fs/nfsd/netns.h +++ b/fs/nfsd/netns.h @@ -65,6 +65,8 @@ struct nfsd_net { struct lock_manager nfsd4_manager; bool grace_ended; + bool grace_end_forced; + bool client_tracking_active; time64_t boot_time; struct dentry *nfsd_client_dir; diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 435e7dc60903..a813c1123b37 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -84,7 +84,7 @@ static u64 current_sessionid = 1; /* forward declarations */ static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner); static void nfs4_free_ol_stateid(struct nfs4_stid *stid); -void nfsd4_end_grace(struct nfsd_net *nn); +static void nfsd4_end_grace(struct nfsd_net *nn); static void _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps); static void nfsd4_file_hash_remove(struct nfs4_file *fi); @@ -5902,7 +5902,7 @@ nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, return nfs_ok; } -void +static void nfsd4_end_grace(struct nfsd_net *nn) { /* do nothing if grace period already ended */ @@ -5935,6 +5935,20 @@ nfsd4_end_grace(struct nfsd_net *nn) */ } +bool +nfsd4_force_end_grace(struct nfsd_net *nn) +{ + if (!nn->client_tracking_ops) + return false; + spin_lock(&nn->client_lock); + if (nn->client_tracking_active) { + nn->grace_end_forced = true; + mod_delayed_work(laundry_wq, &nn->laundromat_work, 0); + } + spin_unlock(&nn->client_lock); + return true; +} + /* * If we've waited a lease period but there are still clients trying to * reclaim, wait a little longer to give them a chance to finish. @@ -5944,6 +5958,8 @@ static bool clients_still_reclaiming(struct nfsd_net *nn) time64_t double_grace_period_end = nn->boot_time + 2 * nn->nfsd4_lease; + if (nn->grace_end_forced) + return false; if (nn->track_reclaim_completes && atomic_read(&nn->nr_reclaim_complete) == nn->reclaim_str_hashtbl_size) @@ -8175,6 +8191,8 @@ static int nfs4_state_create_net(struct net *net) nn->unconf_name_tree = RB_ROOT; nn->boot_time = ktime_get_real_seconds(); nn->grace_ended = false; + nn->grace_end_forced = false; + nn->client_tracking_active = false; nn->nfsd4_manager.block_opens = true; INIT_LIST_HEAD(&nn->nfsd4_manager.list); INIT_LIST_HEAD(&nn->client_lru); @@ -8255,6 +8273,10 @@ nfs4_state_start_net(struct net *net) return ret; locks_start_grace(net, &nn->nfsd4_manager); nfsd4_client_tracking_init(net); + /* safe for laundromat to run now */ + spin_lock(&nn->client_lock); + nn->client_tracking_active = true; + spin_unlock(&nn->client_lock); if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0) goto skip_grace; printk(KERN_INFO "NFSD: starting %lld-second grace period (net %x)\n", @@ -8301,6 +8323,9 @@ nfs4_state_shutdown_net(struct net *net) shrinker_free(nn->nfsd_client_shrinker); cancel_work_sync(&nn->nfsd_shrinker_work); + spin_lock(&nn->client_lock); + nn->client_tracking_active = false; + spin_unlock(&nn->client_lock); cancel_delayed_work_sync(&nn->laundromat_work); locks_end_grace(&nn->nfsd4_manager); diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index 887035b74467..ba8d653de273 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -1110,10 +1110,9 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size) case 'Y': case 'y': case '1': - if (!nn->nfsd_serv) + if (!nfsd4_force_end_grace(nn)) return -EBUSY; trace_nfsd_end_grace(netns(file)); - nfsd4_end_grace(nn); break; default: return -EINVAL; diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index cbddcf484dba..5da7785609b0 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -717,7 +717,7 @@ static inline void get_nfs4_file(struct nfs4_file *fi) struct nfsd_file *find_any_file(struct nfs4_file *f); /* grace period management */ -void nfsd4_end_grace(struct nfsd_net *nn); +bool nfsd4_force_end_grace(struct nfsd_net *nn); /* nfs4recover operations */ extern int nfsd4_client_tracking_init(struct net *net); -- 2.46.1

2 1

[PATCH OLK-5.10] drm/vmwgfx: Fix Use-after-free in validation
by Lin Ruifeng 25 Nov '25

25 Nov '25

From: Ian Forbes <ian.forbes(a)broadcom.com> stable inclusion from stable-v5.10.246 commit fb7165e5f3b3b10721ff70553583ad12e90e447a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6794 CVE: CVE-2025-40111 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ] Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely. Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") Reported-by: Kuzey Arda Bulut <kuzeyardabulut(a)gmail.com> Signed-off-by: Ian Forbes <ian.forbes(a)broadcom.com> Reviewed-by: Zack Rusin <zack.rusin(a)broadcom.com> Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c index e69bc373ae2e..535d1ab1a52f 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c @@ -342,8 +342,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, } } node->res = vmw_resource_reference_unless_doomed(res); - if (!node->res) + if (!node->res) { + hash_del_rcu(&node->hash.head); return -ESRCH; + } node->first_usage = 1; if (!res->dev_priv->has_mob) { -- 2.43.0

2 1

[PATCH OLK-6.6] drm/vmwgfx: Fix Use-after-free in validation
by Lin Ruifeng 25 Nov '25

25 Nov '25

From: Ian Forbes <ian.forbes(a)broadcom.com> stable inclusion from stable-v6.6.113 commit 867bda5d95d36f10da398fd4409e21c7002b2332 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6794 CVE: CVE-2025-40111 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ] Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely. Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") Reported-by: Kuzey Arda Bulut <kuzeyardabulut(a)gmail.com> Signed-off-by: Ian Forbes <ian.forbes(a)broadcom.com> Reviewed-by: Zack Rusin <zack.rusin(a)broadcom.com> Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c index aaacbdcbd742..a4a11e725d18 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c @@ -326,8 +326,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key); } node->res = vmw_resource_reference_unless_doomed(res); - if (!node->res) + if (!node->res) { + hash_del_rcu(&node->hash.head); return -ESRCH; + } node->first_usage = 1; if (!res->dev_priv->has_mob) { -- 2.43.0

2 1

[openeuler:OLK-6.6 3316/3316] crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'data' not described in 'pgp_parse_packets'
by kernel test robot 25 Nov '25

25 Nov '25

Hi David, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 041fb9446ce5643d6c19a4b5bcbb3068054a42fd commit: b78af6579e15dcdff86504da90af77f3e890270e [3316/3316] PGPLIB: Basic packet parser config: x86_64-buildonly-randconfig-002-20251125 (https://download.01.org/0day-ci/archive/20251125/202511250630.aTlUN4lt-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511250630.aTlUN4lt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511250630.aTlUN4lt-lkp@intel.com/ All warnings (new ones prefixed by >>): >> crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'data' not described in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'datalen' not described in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Excess function parameter '_data' description in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Excess function parameter '_datalen' description in 'pgp_parse_packets' vim +189 crypto/asymmetric_keys/pgp_library.c 178 179 /** 180 * pgp_parse_packets - Parse a set of PGP packets 181 * @_data: Data to be parsed (updated) 182 * @_datalen: Amount of data (updated) 183 * @ctx: Parsing context 184 * 185 * Parse a set of PGP packets [RFC 4880: 4]. 186 */ 187 int pgp_parse_packets(const u8 *data, size_t datalen, 188 struct pgp_parse_context *ctx) > 189 { 190 enum pgp_packet_tag type; 191 ssize_t pktlen; 192 u8 headerlen; 193 int ret; 194 195 while (datalen > 2) { 196 pktlen = pgp_parse_packet_header(&data, &datalen, &type, 197 &headerlen); 198 if (pktlen < 0) 199 return pktlen; 200 201 if ((ctx->types_of_interest >> type) & 1) { 202 ret = ctx->process_packet(ctx, type, headerlen, 203 data, pktlen); 204 if (ret < 0) 205 return ret; 206 } 207 data += pktlen; 208 datalen -= pktlen; 209 } 210 211 if (datalen != 0) { 212 pr_debug("Excess octets in packet stream\n"); 213 return -EBADMSG; 214 } 215 216 return 0; 217 } 218 EXPORT_SYMBOL_GPL(pgp_parse_packets); 219 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3316/3316] kernel/xsched/cgroup.c:327:34: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration
by kernel test robot 25 Nov '25

25 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 041fb9446ce5643d6c19a4b5bcbb3068054a42fd commit: 43bbefc53356009d3603faa2c6e6a2858f724e4d [3316/3316] xsched: Add XCU control group implementation and its backend in xsched CFS config: x86_64-buildonly-randconfig-003-20251125 (https://download.01.org/0day-ci/archive/20251125/202511250338.G8XPRtIi-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511250338.G8XPRtIi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511250338.G8XPRtIi-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/xsched/cgroup.c:21: include/linux/xsched.h:265:36: error: field 'css' has incomplete type 265 | struct cgroup_subsys_state css; | ^~~ In file included from include/linux/container_of.h:5, from include/linux/kernel.h:22, from arch/x86/include/asm/percpu.h:27, from arch/x86/include/asm/current.h:10, from include/linux/sched.h:12, from include/linux/cgroup.h:12, from kernel/xsched/cgroup.c:18: kernel/xsched/cgroup.c: In function 'xcu_cg_from_css': include/linux/compiler_types.h:411:27: error: expression in static assertion is not an integer 411 | #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:78:56: note: in definition of macro '__static_assert' 78 | #define __static_assert(expr, msg, ...) _Static_assert(expr, msg) | ^~~~ include/linux/container_of.h:20:9: note: in expansion of macro 'static_assert' 20 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \ | ^~~~~~~~~~~~~ include/linux/container_of.h:20:23: note: in expansion of macro '__same_type' 20 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \ | ^~~~~~~~~~~ kernel/xsched/cgroup.c:184:22: note: in expansion of macro 'container_of' 184 | return css ? container_of(css, struct xsched_group, css) : NULL; | ^~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_css_online': kernel/xsched/cgroup.c:254:53: error: invalid use of undefined type 'struct cgroup_subsys_state' 254 | struct cgroup_subsys_state *parent_css = css->parent; | ^~ kernel/xsched/cgroup.c: At top level: >> kernel/xsched/cgroup.c:327:34: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration 327 | static int xcu_can_attach(struct cgroup_taskset *tset) | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_can_attach': kernel/xsched/cgroup.c:335:9: error: implicit declaration of function 'cgroup_taskset_for_each'; did you mean 'cgroup_task_frozen'? [-Wimplicit-function-declaration] 335 | cgroup_taskset_for_each(task, dst_css, tset) { | ^~~~~~~~~~~~~~~~~~~~~~~ | cgroup_task_frozen kernel/xsched/cgroup.c:335:53: error: expected ';' before '{' token 335 | cgroup_taskset_for_each(task, dst_css, tset) { | ^~ | ; >> kernel/xsched/cgroup.c:333:13: warning: unused variable 'ret' [-Wunused-variable] 333 | int ret = 0; | ^~~ >> kernel/xsched/cgroup.c:332:34: warning: unused variable 'entry' [-Wunused-variable] 332 | struct xcg_attach_entry *entry; | ^~~~~ >> kernel/xsched/cgroup.c:331:40: warning: unused variable 'dst_xcg' [-Wunused-variable] 331 | struct xsched_group *old_xcg, *dst_xcg; | ^~~~~~~ >> kernel/xsched/cgroup.c:331:30: warning: unused variable 'old_xcg' [-Wunused-variable] 331 | struct xsched_group *old_xcg, *dst_xcg; | ^~~~~~~ >> kernel/xsched/cgroup.c:330:47: warning: unused variable 'old_css' [-Wunused-variable] 330 | struct cgroup_subsys_state *dst_css, *old_css; | ^~~~~~~ >> kernel/xsched/cgroup.c:355:1: warning: no return statement in function returning non-void [-Wreturn-type] 355 | } | ^ kernel/xsched/cgroup.c: At top level: kernel/xsched/cgroup.c:357:38: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration 357 | static void xcu_cancel_attach(struct cgroup_taskset *tset) | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:368:6: warning: no previous prototype for 'xcu_move_task' [-Wmissing-prototypes] 368 | void xcu_move_task(struct task_struct *task, struct xsched_group *old_xcg, | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:401:31: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration 401 | static void xcu_attach(struct cgroup_taskset *tset) | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xsched_group_inherit': kernel/xsched/cgroup.c:432:15: error: implicit declaration of function 'task_get_css' [-Wimplicit-function-declaration] 432 | css = task_get_css(task, xcu_cgrp_id); | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:432:34: error: 'xcu_cgrp_id' undeclared (first use in this function) 432 | css = task_get_css(task, xcu_cgrp_id); | ^~~~~~~~~~~ kernel/xsched/cgroup.c:432:34: note: each undeclared identifier is reported only once for each function it appears in kernel/xsched/cgroup.c: In function 'xcu_sched_class_show': kernel/xsched/cgroup.c:440:43: error: implicit declaration of function 'seq_css' [-Wimplicit-function-declaration] 440 | struct cgroup_subsys_state *css = seq_css(sf); | ^~~~~~~ kernel/xsched/cgroup.c:440:43: error: initialization of 'struct cgroup_subsys_state *' from 'int' makes pointer from integer without a cast [-Wint-conversion] kernel/xsched/cgroup.c: In function 'xcu_sched_class_write': kernel/xsched/cgroup.c:490:43: error: implicit declaration of function 'of_css' [-Wimplicit-function-declaration] 490 | struct cgroup_subsys_state *css = of_css(of); | ^~~~~~ kernel/xsched/cgroup.c:490:43: error: initialization of 'struct cgroup_subsys_state *' from 'int' makes pointer from integer without a cast [-Wint-conversion] kernel/xsched/cgroup.c:508:29: error: invalid use of undefined type 'struct cgroup_subsys_state' 508 | if (!list_empty(&css->children)) | ^~ kernel/xsched/cgroup.c: At top level: >> kernel/xsched/cgroup.c:520:65: warning: 'struct cftype' declared inside parameter list will not be visible outside of this definition or declaration 520 | static s64 xcu_read_s64(struct cgroup_subsys_state *css, struct cftype *cft) | ^~~~~~ kernel/xsched/cgroup.c: In function 'xcu_read_s64': kernel/xsched/cgroup.c:525:20: error: invalid use of undefined type 'struct cftype' 525 | switch (cft->private) { | ^~ In file included from include/linux/kernel.h:31: kernel/xsched/cgroup.c:530:63: error: invalid use of undefined type 'struct cftype' 530 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~ include/linux/printk.h:427:33: note: in definition of macro 'printk_index_wrap' 427 | _p_func(_fmt, ##__VA_ARGS__); \ | ^~~~~~~~~~~ include/linux/printk.h:498:9: note: in expansion of macro 'printk' 498 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~ include/linux/xsched.h:20:9: note: in expansion of macro 'pr_err' 20 | pr_err(pr_fmt(XSCHED_ERR_PREFIX fmt), ##__VA_ARGS__) | ^~~~~~ kernel/xsched/cgroup.c:530:17: note: in expansion of macro 'XSCHED_ERR' 530 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~~~~~~~~~ kernel/xsched/cgroup.c: At top level: kernel/xsched/cgroup.c:581:66: warning: 'struct cftype' declared inside parameter list will not be visible outside of this definition or declaration 581 | static int xcu_write_s64(struct cgroup_subsys_state *css, struct cftype *cft, | ^~~~~~ kernel/xsched/cgroup.c: In function 'xcu_write_s64': kernel/xsched/cgroup.c:587:20: error: invalid use of undefined type 'struct cftype' 587 | switch (cft->private) { | ^~ kernel/xsched/cgroup.c:597:63: error: invalid use of undefined type 'struct cftype' 597 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~ include/linux/printk.h:427:33: note: in definition of macro 'printk_index_wrap' 427 | _p_func(_fmt, ##__VA_ARGS__); \ | ^~~~~~~~~~~ include/linux/printk.h:498:9: note: in expansion of macro 'printk' 498 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~ include/linux/xsched.h:20:9: note: in expansion of macro 'pr_err' 20 | pr_err(pr_fmt(XSCHED_ERR_PREFIX fmt), ##__VA_ARGS__) | ^~~~~~ kernel/xsched/cgroup.c:597:17: note: in expansion of macro 'XSCHED_ERR' 597 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_stat': kernel/xsched/cgroup.c:607:43: error: initialization of 'struct cgroup_subsys_state *' from 'int' makes pointer from integer without a cast [-Wint-conversion] 607 | struct cgroup_subsys_state *css = seq_css(sf); | ^~~~~~~ kernel/xsched/cgroup.c: At top level: kernel/xsched/cgroup.c:630:22: error: array type has incomplete element type 'struct cftype' 630 | static struct cftype xcu_cg_files[] = { | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:633:26: error: 'CFTYPE_NOT_ON_ROOT' undeclared here (not in a function) 633 | .flags = CFTYPE_NOT_ON_ROOT, | ^~~~~~~~~~~~~~~~~~ kernel/xsched/cgroup.c:651:8: error: variable 'xcu_cgrp_subsys' has initializer but incomplete type 651 | struct cgroup_subsys xcu_cgrp_subsys = { | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:652:10: error: 'struct cgroup_subsys' has no member named 'css_alloc' 652 | .css_alloc = xcu_css_alloc, | ^~~~~~~~~ >> kernel/xsched/cgroup.c:652:22: warning: excess elements in struct initializer 652 | .css_alloc = xcu_css_alloc, | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:652:22: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:653:10: error: 'struct cgroup_subsys' has no member named 'css_online' 653 | .css_online = xcu_css_online, | ^~~~~~~~~~ kernel/xsched/cgroup.c:653:23: warning: excess elements in struct initializer 653 | .css_online = xcu_css_online, | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:653:23: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:654:10: error: 'struct cgroup_subsys' has no member named 'css_offline' 654 | .css_offline = xcu_css_offline, | ^~~~~~~~~~~ kernel/xsched/cgroup.c:654:24: warning: excess elements in struct initializer 654 | .css_offline = xcu_css_offline, | ^~~~~~~~~~~~~~~ kernel/xsched/cgroup.c:654:24: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:655:10: error: 'struct cgroup_subsys' has no member named 'css_free' 655 | .css_free = xcu_css_free, | ^~~~~~~~ kernel/xsched/cgroup.c:655:21: warning: excess elements in struct initializer 655 | .css_free = xcu_css_free, | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:655:21: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:656:10: error: 'struct cgroup_subsys' has no member named 'can_attach' 656 | .can_attach = xcu_can_attach, | ^~~~~~~~~~ kernel/xsched/cgroup.c:656:23: warning: excess elements in struct initializer 656 | .can_attach = xcu_can_attach, | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:656:23: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:657:10: error: 'struct cgroup_subsys' has no member named 'cancel_attach' 657 | .cancel_attach = xcu_cancel_attach, | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:657:26: warning: excess elements in struct initializer 657 | .cancel_attach = xcu_cancel_attach, | ^~~~~~~~~~~~~~~~~ kernel/xsched/cgroup.c:657:26: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:658:10: error: 'struct cgroup_subsys' has no member named 'attach' 658 | .attach = xcu_attach, | ^~~~~~ kernel/xsched/cgroup.c:658:19: warning: excess elements in struct initializer 658 | .attach = xcu_attach, | ^~~~~~~~~~ kernel/xsched/cgroup.c:658:19: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:659:10: error: 'struct cgroup_subsys' has no member named 'dfl_cftypes' 659 | .dfl_cftypes = xcu_cg_files, | ^~~~~~~~~~~ kernel/xsched/cgroup.c:659:24: warning: excess elements in struct initializer 659 | .dfl_cftypes = xcu_cg_files, | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:659:24: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:660:10: error: 'struct cgroup_subsys' has no member named 'legacy_cftypes' 660 | .legacy_cftypes = xcu_cg_files, | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:660:27: warning: excess elements in struct initializer 660 | .legacy_cftypes = xcu_cg_files, | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:660:27: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:661:10: error: 'struct cgroup_subsys' has no member named 'early_init' 661 | .early_init = false, | ^~~~~~~~~~ kernel/xsched/cgroup.c:661:23: warning: excess elements in struct initializer 661 | .early_init = false, | ^~~~~ kernel/xsched/cgroup.c:661:23: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:651:22: error: storage size of 'xcu_cgrp_subsys' isn't known 651 | struct cgroup_subsys xcu_cgrp_subsys = { | ^~~~~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_cg_from_css': >> kernel/xsched/cgroup.c:185:1: warning: control reaches end of non-void function [-Wreturn-type] 185 | } | ^ kernel/xsched/cgroup.c: At top level: >> kernel/xsched/cgroup.c:630:22: warning: 'xcu_cg_files' defined but not used [-Wunused-variable] 630 | static struct cftype xcu_cg_files[] = { | ^~~~~~~~~~~~ >> kernel/xsched/cgroup.c:309:12: warning: 'xcu_task_can_attach' defined but not used [-Wunused-function] 309 | static int xcu_task_can_attach(struct task_struct *task, | ^~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] vim +327 kernel/xsched/cgroup.c 181 182 inline struct xsched_group *xcu_cg_from_css(struct cgroup_subsys_state *css) 183 { 184 return css ? container_of(css, struct xsched_group, css) : NULL; > 185 } 186 187 /* 188 * Determine whether the given css corresponds to root_xsched_group.css. 189 * 190 * Parameter only_css_self: 191 * - true : Only check whether the css pointer itself is NULL 192 * (i.e., the subsystem root). Do not dereference xg->parent. 193 * Used in the allocation path (css_alloc). 194 * - false : Further check whether the associated xsched_group 195 * has no parent (i.e., a normal root check). 196 */ 197 static inline bool xsched_group_css_is_root(struct cgroup_subsys_state *css, bool only_css_self) 198 { 199 struct xsched_group *xg; 200 201 /* NULL indicates the subsystem root */ 202 if (!css) 203 return true; 204 205 /* 206 * During the allocation phase, 207 * cannot find its parent xsched_group via xg->parent, 208 * so can only determine on the css itself. 209 */ 210 if (only_css_self) 211 return false; 212 213 xg = xcu_cg_from_css(css); 214 215 return xg && !xg->parent; 216 } 217 218 /** 219 * xcu_css_alloc() - Allocate and init xcu cgroup. 220 * @parent_css: css of parent xcu cgroup 221 * 222 * Called from kernel/cgroup.c with cgroup_lock() held. 223 * First called in subsys initialization to create root xcu cgroup, when 224 * XCUs haven't been initialized yet. Func used on every new cgroup creation, 225 * on second call to set root xsched_group runqueue. 226 * 227 * Return: pointer of new xcu cgroup css on success, -ENOMEM otherwise. 228 */ 229 static struct cgroup_subsys_state * 230 xcu_css_alloc(struct cgroup_subsys_state *parent_css) 231 { 232 struct xsched_group *xg; 233 234 if (xsched_group_css_is_root(parent_css, true)) 235 return &root_xsched_group.css; 236 237 xg = kmem_cache_alloc(xsched_group_cache, GFP_KERNEL | __GFP_ZERO); 238 if (!xg) 239 return ERR_PTR(-ENOMEM); 240 241 return &xg->css; 242 } 243 244 static void xcu_css_free(struct cgroup_subsys_state *css) 245 { 246 struct xsched_group *xcg = xcu_cg_from_css(css); 247 248 kmem_cache_free(xsched_group_cache, xcg); 249 } 250 251 static int xcu_css_online(struct cgroup_subsys_state *css) 252 { 253 struct xsched_group *xg = xcu_cg_from_css(css); 254 struct cgroup_subsys_state *parent_css = css->parent; 255 struct xsched_group *parent_xg; 256 int err; 257 258 if (!parent_css) 259 return 0; 260 261 parent_xg = xcu_cg_from_css(parent_css); 262 err = xcu_cg_init(xg, parent_xg); 263 if (err) { 264 kmem_cache_free(xsched_group_cache, xg); 265 XSCHED_ERR("Failed to initialize new xsched_group @ %s.\n", __func__); 266 return err; 267 } 268 269 return 0; 270 } 271 272 static void xcu_css_offline(struct cgroup_subsys_state *css) 273 { 274 struct xsched_group *xcg; 275 276 xcg = xcu_cg_from_css(css); 277 if (!xsched_group_css_is_root(css, false)) { 278 switch (xcg->sched_class) { 279 case XSCHED_TYPE_CFS: 280 xcu_cfs_cg_deinit(xcg); 281 break; 282 default: 283 XSCHED_INFO("xcu_cgroup: deinit RT group css=0x%lx\n", 284 (uintptr_t)&xcg->css); 285 break; 286 } 287 } 288 list_del(&xcg->group_node); 289 } 290 291 static void xsched_group_xse_attach(struct xsched_group *xg, 292 struct xsched_entity *xse) 293 { 294 spin_lock(&xg->lock); 295 list_add_tail(&xse->group_node, &xg->members); 296 spin_unlock(&xg->lock); 297 xse->parent_grp = xg; 298 } 299 300 void xsched_group_xse_detach(struct xsched_entity *xse) 301 { 302 struct xsched_group *xcg = xse->parent_grp; 303 304 spin_lock(&xcg->lock); 305 list_del(&xse->group_node); 306 spin_unlock(&xcg->lock); 307 } 308 > 309 static int xcu_task_can_attach(struct task_struct *task, 310 struct xsched_group *old) 311 { 312 struct xsched_entity *xse; 313 bool has_xse = false; 314 315 spin_lock(&old->lock); 316 list_for_each_entry(xse, &old->members, group_node) { 317 if (xse->owner_pid == task_pid_nr(task)) { 318 has_xse = true; 319 break; 320 } 321 } 322 spin_unlock(&old->lock); 323 324 return has_xse ? -EINVAL : 0; 325 } 326 > 327 static int xcu_can_attach(struct cgroup_taskset *tset) 328 { 329 struct task_struct *task; > 330 struct cgroup_subsys_state *dst_css, *old_css; > 331 struct xsched_group *old_xcg, *dst_xcg; > 332 struct xcg_attach_entry *entry; > 333 int ret = 0; 334 335 cgroup_taskset_for_each(task, dst_css, tset) { 336 rcu_read_lock(); 337 old_css = task_css(task, xcu_cgrp_id); 338 rcu_read_unlock(); 339 dst_xcg = xcu_cg_from_css(dst_css); 340 old_xcg = xcu_cg_from_css(old_css); 341 342 ret = xcu_task_can_attach(task, old_xcg); 343 if (ret) 344 break; 345 346 /* record entry for this task */ 347 entry = kmem_cache_alloc(xcg_attach_entry_cache, GFP_KERNEL | __GFP_ZERO); 348 entry->task = task; 349 entry->old_xcg = old_xcg; 350 entry->new_xcg = dst_xcg; 351 list_add_tail(&entry->node, &xcg_attach_list); 352 } 353 354 return ret; > 355 } 356 357 static void xcu_cancel_attach(struct cgroup_taskset *tset) 358 { 359 struct xcg_attach_entry *entry, *tmp; 360 361 /* error: clear all entries */ 362 list_for_each_entry_safe(entry, tmp, &xcg_attach_list, node) { 363 list_del(&entry->node); 364 kmem_cache_free(xcg_attach_entry_cache, entry); 365 } 366 } 367 368 void xcu_move_task(struct task_struct *task, struct xsched_group *old_xcg, 369 struct xsched_group *new_xcg) 370 { 371 struct xsched_entity *xse, *tmp; 372 struct xsched_cu *xcu; 373 374 spin_lock(&old_xcg->lock); 375 list_for_each_entry_safe(xse, tmp, &old_xcg->members, group_node) { 376 if (xse->owner_pid != task_pid_nr(task)) 377 continue; 378 379 xcu = xse->xcu; 380 381 if (old_xcg != xse->parent_grp) { 382 WARN_ON(old_xcg != xse->parent_grp); 383 return; 384 } 385 386 /* delete from the old_xcg */ 387 list_del(&xse->group_node); 388 389 mutex_lock(&xcu->xcu_lock); 390 /* dequeue from the current runqueue */ 391 dequeue_ctx(xse, xcu); 392 /* attach to the new_xcg */ 393 xsched_group_xse_attach(new_xcg, xse); 394 /* enqueue to the runqueue in new_xcg */ 395 enqueue_ctx(xse, xcu); 396 mutex_unlock(&xcu->xcu_lock); 397 } 398 spin_unlock(&old_xcg->lock); 399 } 400 401 static void xcu_attach(struct cgroup_taskset *tset) 402 { 403 struct xcg_attach_entry *entry, *tmp; 404 405 list_for_each_entry(entry, &xcg_attach_list, node) { 406 xcu_move_task(entry->task, entry->old_xcg, entry->new_xcg); 407 } 408 409 /* cleanup */ 410 list_for_each_entry_safe(entry, tmp, &xcg_attach_list, node) { 411 list_del(&entry->node); 412 kmem_cache_free(xcg_attach_entry_cache, entry); 413 } 414 } 415 416 /** 417 * xsched_group_inherit() - Attach new entity to task's xsched_group. 418 * @task: task_struct 419 * @xse: xsched entity 420 * 421 * Called in xsched context initialization to attach xse to task's group 422 * and inherit its xse scheduling class and bandwidth control policy. 423 * 424 * Return: Zero on success. 425 */ 426 void xsched_group_inherit(struct task_struct *task, struct xsched_entity *xse) 427 { 428 struct cgroup_subsys_state *css; 429 struct xsched_group *xg; 430 431 xse->owner_pid = task_pid_nr(task); 432 css = task_get_css(task, xcu_cgrp_id); 433 xg = xcu_cg_from_css(css); 434 xsched_group_xse_attach(xg, xse); 435 css_put(css); 436 } 437 438 static int xcu_sched_class_show(struct seq_file *sf, void *v) 439 { 440 struct cgroup_subsys_state *css = seq_css(sf); 441 struct xsched_group *xg = xcu_cg_from_css(css); 442 443 seq_printf(sf, "%s\n", xcu_sched_name[xg->sched_class]); 444 return 0; 445 } 446 447 /** 448 * xcu_cg_set_sched_class() - Set scheduling type for group. 449 * @xg: xsched group 450 * @type: scheduler type 451 * 452 * Scheduler type can be changed if task is child of root group 453 * and haven't got scheduling entities. 454 * 455 * Return: Zero on success or -EINVAL 456 */ 457 static int xcu_cg_set_sched_class(struct xsched_group *xg, int type) 458 { 459 if (type == xg->sched_class) 460 return 0; 461 462 /* can't change scheduler when there are running members */ 463 if (!list_empty(&xg->members)) 464 return -EBUSY; 465 466 /* deinit old type if necessary */ 467 switch (xg->sched_class) { 468 case XSCHED_TYPE_CFS: 469 xcu_cfs_cg_deinit(xg); 470 break; 471 default: 472 break; 473 } 474 475 /* update type */ 476 xg->sched_class = type; 477 478 /* init new type if necessary */ 479 switch (type) { 480 case XSCHED_TYPE_CFS: 481 return xcu_cfs_cg_init(xg, xg->parent); 482 default: 483 return 0; 484 } 485 } 486 487 static ssize_t xcu_sched_class_write(struct kernfs_open_file *of, char *buf, 488 size_t nbytes, loff_t off) 489 { 490 struct cgroup_subsys_state *css = of_css(of); 491 struct xsched_group *xg = xcu_cg_from_css(css); 492 char type_name[4]; 493 int type = -1; 494 495 ssize_t ret = sscanf(buf, "%3s", type_name); 496 497 if (ret < 1) 498 return -EINVAL; 499 500 for (type = 0; type < XSCHED_TYPE_NUM; type++) { 501 if (!strcmp(type_name, xcu_sched_name[type])) 502 break; 503 } 504 505 if (type == XSCHED_TYPE_NUM) 506 return -EINVAL; 507 508 if (!list_empty(&css->children)) 509 return -EBUSY; 510 511 /* only root child can switch scheduler type */ 512 if (!xg->parent || !xsched_group_css_is_root(&xg->parent->css, false)) 513 return -EINVAL; 514 515 ret = xcu_cg_set_sched_class(xg, type); 516 517 return (ret) ? ret : nbytes; 518 } 519 > 520 static s64 xcu_read_s64(struct cgroup_subsys_state *css, struct cftype *cft) 521 { 522 s64 ret = 0; 523 struct xsched_group *xcucg = xcu_cg_from_css(css); 524 525 switch (cft->private) { 526 case XCU_FILE_SHARES: 527 ret = xcucg->shares_cfg; 528 break; 529 default: 530 XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); 531 break; 532 } 533 534 return ret; 535 } 536 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3316/3316] block/blk-io-hierarchy/iodump.c:188:22: error: 'struct bio' has no member named 'bi_blkg'
by kernel test robot 25 Nov '25

25 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 041fb9446ce5643d6c19a4b5bcbb3068054a42fd commit: 1bf8f90fb90c600d9f372e6be4ef251cc8905f04 [3316/3316] block-io-hierarchy: core hierarchy stats and iodump implementation config: x86_64-buildonly-randconfig-001-20251125 (https://download.01.org/0day-ci/archive/20251125/202511250327.zVFjEAbx-lkp@…) compiler: gcc-12 (Debian 12.4.0-5) 12.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511250327.zVFjEAbx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511250327.zVFjEAbx-lkp@intel.com/ All errors (new ones prefixed by >>): block/blk-io-hierarchy/iodump.c: In function '__hierarchy_show_bio': >> block/blk-io-hierarchy/iodump.c:188:22: error: 'struct bio' has no member named 'bi_blkg' 188 | blkg_path(bio->bi_blkg, path, PATH_LEN); | ^~ >> block/blk-io-hierarchy/iodump.c:188:9: error: too many arguments to function 'blkg_path' 188 | blkg_path(bio->bi_blkg, path, PATH_LEN); | ^~~~~~~~~ In file included from block/blk-io-hierarchy/iodump.c:21: block/blk-io-hierarchy/../blk-cgroup.h:535:21: note: declared here 535 | static inline char *blkg_path(struct blkcg_gq *blkg) { return NULL; } | ^~~~~~~~~ vim +188 block/blk-io-hierarchy/iodump.c 179 180 static void __hierarchy_show_bio(struct seq_file *m, struct bio *bio, 181 enum stage_group stage, u64 duration) 182 { 183 char rwbs[RWB_LEN]; 184 char path[PATH_LEN] = {0}; 185 struct task_struct *task = get_pid_task(bio->pid, PIDTYPE_PID); 186 187 blk_fill_rwbs(rwbs, bio->bi_opf); > 188 blkg_path(bio->bi_blkg, path, PATH_LEN); 189 190 seq_printf(m, "%s-%d %s stage %s bio %s %llu + %u cgroup %s started %llu ns ago\n", 191 task ? task->comm : "null", task ? task->pid : 0, 192 bio->bi_bdev->bd_disk->disk_name, 193 hierarchy_stage_name(stage), rwbs, bio->bi_iter.bi_sector, 194 bio_sectors(bio), path, duration); 195 196 if (task) 197 put_task_struct(task); 198 } 199 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3309/3309] drivers/gpu/drm/loongson/lsdc_plane.c:444:7: warning: variable 'formats' is used uninitialized whenever switch case is taken
by kernel test robot 25 Nov '25

25 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 16b8586be5cdac465d2c81e7cdaffcc80384bfb7 commit: 80764bc784413eb604c7d472db55b1ca72d4bbc5 [3309/3309] drm/loongson: add kernel modesetting driver support for ls7a1000/ls7a2000 config: x86_64-buildonly-randconfig-001-20251124 (https://download.01.org/0day-ci/archive/20251125/202511250117.AjD77new-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9e9fe08b16ea2c4d9867fb4974edf2a3776d6ece) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511250117.AjD77new-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511250117.AjD77new-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/gpu/drm/loongson/lsdc_plane.c:98:13: warning: variable 'lo32_addr_reg' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 98 | } else if (index == 1) { | ^~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:114:33: note: uninitialized use occurs here 114 | writel(paddr, ldev->reg_base + lo32_addr_reg); | ^~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:98:9: note: remove the 'if' if its condition is always true 98 | } else if (index == 1) { | ^~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:77:19: note: initialize the variable 'lo32_addr_reg' to silence this warning 77 | u32 lo32_addr_reg; | ^ | = 0 drivers/gpu/drm/loongson/lsdc_plane.c:98:13: warning: variable 'hi32_addr_reg' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 98 | } else if (index == 1) { | ^~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:115:48: note: uninitialized use occurs here 115 | writel((paddr >> 32) & 0xFF, ldev->reg_base + hi32_addr_reg); | ^~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:98:9: note: remove the 'if' if its condition is always true 98 | } else if (index == 1) { | ^~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:78:19: note: initialize the variable 'hi32_addr_reg' to silence this warning 78 | u32 hi32_addr_reg; | ^ | = 0 drivers/gpu/drm/loongson/lsdc_plane.c:98:13: warning: variable 'val' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 98 | } else if (index == 1) { | ^~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:120:9: note: uninitialized use occurs here 120 | writel(val | CFG_PAGE_FLIP_BIT, ldev->reg_base + cfg_reg); | ^~~ drivers/gpu/drm/loongson/lsdc_plane.c:98:9: note: remove the 'if' if its condition is always true 98 | } else if (index == 1) { | ^~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:80:9: note: initialize the variable 'val' to silence this warning 80 | u32 val; | ^ | = 0 drivers/gpu/drm/loongson/lsdc_plane.c:98:13: warning: variable 'cfg_reg' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 98 | } else if (index == 1) { | ^~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:120:51: note: uninitialized use occurs here 120 | writel(val | CFG_PAGE_FLIP_BIT, ldev->reg_base + cfg_reg); | ^~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:98:9: note: remove the 'if' if its condition is always true 98 | } else if (index == 1) { | ^~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:79:13: note: initialize the variable 'cfg_reg' to silence this warning 79 | u32 cfg_reg; | ^ | = 0 >> drivers/gpu/drm/loongson/lsdc_plane.c:444:7: warning: variable 'formats' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized] 444 | case DRM_PLANE_TYPE_OVERLAY: | ^~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:451:12: note: uninitialized use occurs here 451 | formats, format_count, | ^~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:429:20: note: initialize the variable 'formats' to silence this warning 429 | const u32 *formats; | ^ | = NULL drivers/gpu/drm/loongson/lsdc_plane.c:444:7: warning: variable 'format_count' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized] 444 | case DRM_PLANE_TYPE_OVERLAY: | ^~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:451:21: note: uninitialized use occurs here 451 | formats, format_count, | ^~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:428:27: note: initialize the variable 'format_count' to silence this warning 428 | unsigned int format_count; | ^ | = 0 >> drivers/gpu/drm/loongson/lsdc_plane.c:444:7: warning: variable 'name' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized] 444 | case DRM_PLANE_TYPE_OVERLAY: | ^~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:453:18: note: uninitialized use occurs here 453 | type, name, index); | ^~~~ drivers/gpu/drm/loongson/lsdc_plane.c:430:18: note: initialize the variable 'name' to silence this warning 430 | const char *name; | ^ | = NULL 7 warnings generated. vim +/formats +444 drivers/gpu/drm/loongson/lsdc_plane.c 420 421 int lsdc_plane_init(struct lsdc_device *ldev, 422 struct drm_plane *plane, 423 enum drm_plane_type type, 424 unsigned int index) 425 { 426 struct drm_device *ddev = ldev->ddev; 427 int zpos = lsdc_plane_get_default_zpos(type); 428 unsigned int format_count; 429 const u32 *formats; 430 const char *name; 431 int ret; 432 433 switch (type) { 434 case DRM_PLANE_TYPE_PRIMARY: 435 formats = lsdc_primary_formats; 436 format_count = ARRAY_SIZE(lsdc_primary_formats); 437 name = "primary-%u"; 438 break; 439 case DRM_PLANE_TYPE_CURSOR: 440 formats = lsdc_cursor_formats; 441 format_count = ARRAY_SIZE(lsdc_cursor_formats); 442 name = "cursor-%u"; 443 break; > 444 case DRM_PLANE_TYPE_OVERLAY: -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] init/Kconfig: Move ARCH_SUPPORTS_SCHED_SOFT_QUOTA to drop CGROUPS dependency
by Chen Jinghuang 24 Nov '25

24 Nov '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID8CIH ---------------------------------------- ARCH_SUPPORTS_SCHED_SOFT_QUOTA was previously in a CGROUPS-dependent block, causing build warning when ARCH_SUPPORTS_SCHED_SOFT_QUOTA=y and CGROUPS=n. Move it to a generic, CGROUPS-independent section in init/Kconfig to fix the errors, while preserving its original role as an arch capability flag. Fixes: a91091aed1fa ("sched: More flexible use of CPU quota when CPU is idle") Signed-off-by: Chen Jinghuang<chenjinghuang2(a)huawei.com> --- init/Kconfig | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/init/Kconfig b/init/Kconfig index 485583e8ecbe..874daa00304c 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -950,6 +950,9 @@ config NUMA_BALANCING_DEFAULT_ENABLED If set, automatic NUMA balancing will be enabled if running on a NUMA machine. +config ARCH_SUPPORTS_SCHED_SOFT_QUOTA + bool + menuconfig CGROUPS bool "Control Group support" select KERNFS @@ -1178,9 +1181,6 @@ config SCHED_SOFT_DOMAIN # # For architectures that want to enable the support for SCHED_SOFT_QUOTA # -config ARCH_SUPPORTS_SCHED_SOFT_QUOTA - bool - config SCHED_SOFT_QUOTA bool "More flexible use of CPU quota" depends on ARCH_SUPPORTS_SCHED_SOFT_QUOTA -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Avoid RCU context warning when unpinning htab with internal structs
by Luo Gengkun 24 Nov '25

24 Nov '25

From: KaFai Wan <kafai.wan(a)linux.dev> stable inclusion from stable-v6.6.113 commit b6e9645be9eb93f7aff3ca887f8edb6f1d63358f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID8BLB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ] When unpinning a BPF hash table (htab or htab_lru) that contains internal structures (timer, workqueue, or task_work) in its values, a BUG warning is triggered: BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0 ... The issue arises from the interaction between BPF object unpinning and RCU callback mechanisms: 1. BPF object unpinning uses ->free_inode() which schedules cleanup via call_rcu(), deferring the actual freeing to an RCU callback that executes within the RCU_SOFTIRQ context. 2. During cleanup of hash tables containing internal structures, htab_map_free_internal_structs() is invoked, which includes cond_resched() or cond_resched_rcu() calls to yield the CPU during potentially long operations. However, cond_resched() or cond_resched_rcu() cannot be safely called from atomic RCU softirq context, leading to the BUG warning when attempting to reschedule. Fix this by changing from ->free_inode() to ->destroy_inode() and rename bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link). This allows direct inode freeing without RCU callback scheduling, avoiding the invalid context warning. Reported-by: Le Chen <tom2cat(a)sjtu.edu.cn> Closes: https://lore.kernel.org/all/1444123482.1827743.1750996347470.JavaMail.zimbr… Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.") Suggested-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: KaFai Wan <kafai.wan(a)linux.dev> Acked-by: Yonghong Song <yonghong.song(a)linux.dev> Link: https://lore.kernel.org/r/20251008102628.808045-2-kafai.wan@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/bpf/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c index 99d0625b6c82..9a9630adcba4 100644 --- a/kernel/bpf/inode.c +++ b/kernel/bpf/inode.c @@ -607,7 +607,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root) return 0; } -static void bpf_free_inode(struct inode *inode) +static void bpf_destroy_inode(struct inode *inode) { enum bpf_type type; @@ -622,7 +622,7 @@ static const struct super_operations bpf_super_ops = { .statfs = simple_statfs, .drop_inode = generic_delete_inode, .show_options = bpf_show_options, - .free_inode = bpf_free_inode, + .destroy_inode = bpf_destroy_inode, }; enum { -- 2.34.1

2 1

[PATCH OLK-6.6] sunrpc: fix null pointer dereference on zero-length checksum
by Wang Liang 24 Nov '25

24 Nov '25

From: Lei Lu <llfamsec(a)gmail.com> stable inclusion from stable-v6.6.112 commit 81cec07d303186d0d8c623ef8b5ecd3b81e94cf6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B5E CVE: CVE-2025-40129 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6df164e29bd4e6505c5a2e0e5f1e1f6957a16a42 upstream. In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that the value of checksum.len is not less than XDR_UNIT. Fixes: 0653028e8f1c ("SUNRPC: Convert gss_verify_header() to use xdr_stream") Cc: stable(a)kernel.org Signed-off-by: Lei Lu <llfamsec(a)gmail.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sunrpc/auth_gss/svcauth_gss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c index cf30bd649e27..d063b63516f8 100644 --- a/net/sunrpc/auth_gss/svcauth_gss.c +++ b/net/sunrpc/auth_gss/svcauth_gss.c @@ -724,7 +724,7 @@ svcauth_gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci, rqstp->rq_auth_stat = rpc_autherr_badverf; return SVC_DENIED; } - if (flavor != RPC_AUTH_GSS) { + if (flavor != RPC_AUTH_GSS || checksum.len < XDR_UNIT) { rqstp->rq_auth_stat = rpc_autherr_badverf; return SVC_DENIED; } -- 2.34.1

2 1