- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6] BUILD REGRESSION b28aab59b06935f0d1c9bce8f013f25b4094764d
by kernel test robot 28 Mar '25

28 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: b28aab59b06935f0d1c9bce8f013f25b4094764d !15593 io_uring: prevent opcode speculation Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503280313.olFyEFIT-lkp@intel.com https://lore.kernel.org/oe-kbuild/202503271832.WycjTkRa-lkp@intel.com clang: warning: -Wl,-soname=linux-ilp32-vdso.so.1: 'linker' input unused [-Wunused-command-line-argument] error: unknown target ABI 'ilp32' Unverified Error/Warning (likely false positive, kindly check if interested): drivers/hid/hid-thrustmaster.c:178 thrustmaster_interrupts() warn: possible memory leak of 'send_buf' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-virtcca_get_tmi_version | |-- drivers-coda-coda_pci.c:warning:Excess-function-parameter-pdev-description-in-virtcca_pci_get_rom_size | |-- drivers-coda-coda_pci.c:warning:Function-parameter-or-member-p-not-described-in-virtcca_pci_get_rom_size | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-defconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-002-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-003-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-004-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-r112-20250328 | |-- clang:warning:Wl-soname-linux-ilp32-vdso.so.:linker-input-unused | `-- error:unknown-target-ABI-ilp32 |-- loongarch-allmodconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allnoconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allyesconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-defconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-002-20250327 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-r061-20250327 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allyesconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250327 | |-- drivers-gpu-drm-sti-sti_dvo.c:error:implicit-declaration-of-function-devm_ioremap | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size |-- x86_64-randconfig-101-20250328 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-102-20250328 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-103-20250328 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-104-20250328 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-121-20250328 | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-122-20250328 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-123-20250328 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-161-20250326 | `-- drivers-hid-hid-thrustmaster.c-thrustmaster_interrupts()-warn:possible-memory-leak-of-send_buf `-- x86_64-randconfig-161-20250327 `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used elapsed time: 1448m configs tested: 21 configs skipped: 124 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250327 gcc-5.5.0 arm64 randconfig-002-20250327 clang-21 arm64 randconfig-003-20250327 clang-21 arm64 randconfig-004-20250327 clang-21 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250327 gcc-14.2.0 loongarch randconfig-002-20250327 gcc-14.2.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250327 gcc-12 x86_64 buildonly-randconfig-002-20250327 gcc-12 x86_64 buildonly-randconfig-003-20250327 clang-20 x86_64 buildonly-randconfig-004-20250327 clang-20 x86_64 buildonly-randconfig-005-20250327 gcc-12 x86_64 buildonly-randconfig-006-20250327 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Radu Rendec <rrendec(a)redhat.com> stable inclusion from stable-v5.10.235 commit e4fde33107351ec33f1a64188612fbc6ca659284 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4K CVE: CVE-2025-21785 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2 ] The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level). Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information") Signed-off-by: Radu Rendec <rrendec(a)redhat.com> Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 0c0cd4d26b87..80a4ab1c43fd 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -96,16 +96,18 @@ static int __populate_cache_leaves(unsigned int cpu) unsigned int level, idx; enum cache_type type; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf = this_cpu_ci->info_list; + struct cacheinfo *infos = this_cpu_ci->info_list; for (idx = 0, level = 1; level <= this_cpu_ci->num_levels && - idx < this_cpu_ci->num_leaves; idx++, level++) { + idx < this_cpu_ci->num_leaves; level++) { type = get_cache_type(level); if (type == CACHE_TYPE_SEPARATE) { - ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); - ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); + if (idx + 1 >= this_cpu_ci->num_leaves) + break; + ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level); + ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level); } else { - ci_leaf_init(this_leaf++, type, level); + ci_leaf_init(&infos[idx++], type, level); } } return 0; -- 2.43.0

2 1

[PATCH OLK-5.10] arm64: mm: add mc support for __buffer_migrate_page
by Wupeng Ma 28 Mar '25

28 Mar '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB0OV7 -------------------------------- During our test, panic happens when kernel try to read a user page in __buffer_migrate_page with the following trace: Internal error: synchronous external abort: ffffffff96000410 [#1] SMP pstate: 00401009 (nzcv daif +PAN -UAO -TCO BTYPE=--) pc : copy_page+0x40/0xbc lr : copy_highpage+0x3c/0x60 sp : ffff8040de1caec0 Call trace: copy_page+0x40/0xbc migrate_page_copy+0x44/0xd0 __buffer_migrate_page.part.0+0x288/0x3f0 buffer_migrate_page+0x28/0x60 move_to_new_page+0x68/0x274 __unmap_and_move+0x424/0x574 unmap_and_move+0x84/0x67c migrate_pages+0x160/0x540 compact_zone+0x1d8/0x5b4 compact_zone_order+0xa4/0xfc try_to_compact_pages+0xb0/0x2a0 __alloc_pages_direct_compact+0x9c/0x210 __alloc_pages+0x844/0x1214 alloc_pages_vma+0x388/0x3e0 do_huge_pmd_anonymous_page+0x170/0x574 __handle_mm_fault+0x374/0x3ac handle_mm_fault+0xf4/0x260 __get_user_pages+0x218/0x42c __gup_longterm_locked+0x94/0x2c0 internal_get_user_pages_fast+0x140/0x240 pin_user_pages_fast+0x24/0x50 __ib_umem_get.part.0+0x22c/0x4e0 [ib_uverbs] ib_umem_get+0x90/0xc0 [ib_uverbs] hns_roce_mtr_create+0x78/0x334 [hns_roce_hw_v2] alloc_mr_pbl+0xe4/0x18c [hns_roce_hw_v2] hns_roce_reg_user_mr+0xf4/0x1a0 [hns_roce_hw_v2] ib_uverbs_reg_mr+0x120/0x2c0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xe4/0x180 [ib_uverbs] ib_uverbs_run_method+0x33c/0x3d4 [ib_uverbs] ib_uverbs_cmd_verbs+0x128/0x1dc [ib_uverbs] ib_uverbs_ioctl+0xfc/0x1d0 [ib_uverbs] __arm64_sys_ioctl+0xb0/0x110 invoke_syscall+0x50/0x134 el0_svc_common.constprop.0+0x10c/0x12c do_el0_svc+0x34/0xe0 el0_svc+0x20/0x30 el0_sync_handler+0xb8/0xc0 el0_sync+0x160/0x180 Code: 91020021 f2402c1f d503201f a8300c02 (a9400c22) ---[ end trace ccd629679fc3e8d1 ]--- To fix this, Use migrate_page_mc_extra to replace migrate_page_copy in __buffer_migrate_page to add mc support for this function. Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/migrate.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/mm/migrate.c b/mm/migrate.c index cf8c05ea821e..0d79382f9697 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -820,6 +820,7 @@ static int __buffer_migrate_page(struct address_space *mapping, struct buffer_head *bh, *head; int rc; int expected_count; + bool copy_done = false; if (!page_has_buffers(page)) return migrate_page(mapping, newpage, page, mode); @@ -860,7 +861,13 @@ static int __buffer_migrate_page(struct address_space *mapping, } } - rc = migrate_page_move_mapping(mapping, newpage, page, 0); + if (IS_ENABLED(CONFIG_ARM64) && IS_ENABLED(CONFIG_ARCH_HAS_COPY_MC) && + (mode != MIGRATE_SYNC_NO_COPY)) { + rc = migrate_page_mc_extra(mapping, newpage, page, mode, 0); + copy_done = true; + } else { + rc = migrate_page_move_mapping(mapping, newpage, page, 0); + } if (rc != MIGRATEPAGE_SUCCESS) goto unlock_buffers; @@ -873,6 +880,9 @@ static int __buffer_migrate_page(struct address_space *mapping, } while (bh != head); + if (copy_done) + goto unlock_buffers; + if (mode != MIGRATE_SYNC_NO_COPY) migrate_page_copy(newpage, page); else -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Radu Rendec <rrendec(a)redhat.com> stable inclusion from stable-v5.10.235 commit e4fde33107351ec33f1a64188612fbc6ca659284 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4K CVE: CVE-2025-21785 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2 ] The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level). Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information") Signed-off-by: Radu Rendec <rrendec(a)redhat.com> Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 0c0cd4d26b87..80a4ab1c43fd 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -96,16 +96,18 @@ static int __populate_cache_leaves(unsigned int cpu) unsigned int level, idx; enum cache_type type; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf = this_cpu_ci->info_list; + struct cacheinfo *infos = this_cpu_ci->info_list; for (idx = 0, level = 1; level <= this_cpu_ci->num_levels && - idx < this_cpu_ci->num_leaves; idx++, level++) { + idx < this_cpu_ci->num_leaves; level++) { type = get_cache_type(level); if (type == CACHE_TYPE_SEPARATE) { - ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); - ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); + if (idx + 1 >= this_cpu_ci->num_leaves) + break; + ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level); + ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level); } else { - ci_leaf_init(this_leaf++, type, level); + ci_leaf_init(&infos[idx++], type, level); } } return 0; -- 2.43.0

2 1

[PATCH OLK-5.10] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Radu Rendec <rrendec(a)redhat.com> [ Upstream commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2 ] The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level). Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information") Signed-off-by: Radu Rendec <rrendec(a)redhat.com> Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 97c42be71338..1510f457b615 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -87,16 +87,18 @@ int populate_cache_leaves(unsigned int cpu) unsigned int level, idx; enum cache_type type; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf = this_cpu_ci->info_list; + struct cacheinfo *infos = this_cpu_ci->info_list; for (idx = 0, level = 1; level <= this_cpu_ci->num_levels && - idx < this_cpu_ci->num_leaves; idx++, level++) { + idx < this_cpu_ci->num_leaves; level++) { type = get_cache_type(level); if (type == CACHE_TYPE_SEPARATE) { - ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); - ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); + if (idx + 1 >= this_cpu_ci->num_leaves) + break; + ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level); + ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level); } else { - ci_leaf_init(this_leaf++, type, level); + ci_leaf_init(&infos[idx++], type, level); } } return 0; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] PM / devfreq: rk3399_dmc: Disable edev on remove()
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Brian Norris <briannorris(a)chromium.org> stable inclusion from stable-v4.19.247 commit 664736e2cc09e504ce58ec61164d029d1f2651bb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6Y5 CVE: CVE-2022-49460 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2fccf9e6050e0e3b8b4cd275d41daf7f7fa22804 ] Otherwise we hit an unablanced enable-count when unbinding the DFI device: [ 1279.659119] ------------[ cut here ]------------ [ 1279.659179] WARNING: CPU: 2 PID: 5638 at drivers/devfreq/devfreq-event.c:360 devfreq_event_remove_edev+0x84/0x8c ... [ 1279.659352] Hardware name: Google Kevin (DT) [ 1279.659363] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO BTYPE=--) [ 1279.659371] pc : devfreq_event_remove_edev+0x84/0x8c [ 1279.659380] lr : devm_devfreq_event_release+0x1c/0x28 ... [ 1279.659571] Call trace: [ 1279.659582] devfreq_event_remove_edev+0x84/0x8c [ 1279.659590] devm_devfreq_event_release+0x1c/0x28 [ 1279.659602] release_nodes+0x1cc/0x244 [ 1279.659611] devres_release_all+0x44/0x60 [ 1279.659621] device_release_driver_internal+0x11c/0x1ac [ 1279.659629] device_driver_detach+0x20/0x2c [ 1279.659641] unbind_store+0x7c/0xb0 [ 1279.659650] drv_attr_store+0x2c/0x40 [ 1279.659663] sysfs_kf_write+0x44/0x58 [ 1279.659672] kernfs_fop_write_iter+0xf4/0x190 [ 1279.659684] vfs_write+0x2b0/0x2e4 [ 1279.659693] ksys_write+0x80/0xec [ 1279.659701] __arm64_sys_write+0x24/0x30 [ 1279.659714] el0_svc_common+0xf0/0x1d8 [ 1279.659724] do_el0_svc_compat+0x28/0x3c [ 1279.659738] el0_svc_compat+0x10/0x1c [ 1279.659746] el0_sync_compat_handler+0xa8/0xcc [ 1279.659758] el0_sync_compat+0x188/0x1c0 [ 1279.659768] ---[ end trace cec200e5094155b4 ]--- Signed-off-by: Brian Norris <briannorris(a)chromium.org> Signed-off-by: Chanwoo Choi <cw00.choi(a)samsung.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/devfreq/rk3399_dmc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/devfreq/rk3399_dmc.c b/drivers/devfreq/rk3399_dmc.c index e795ad2b3f6b..eefda6edc89c 100644 --- a/drivers/devfreq/rk3399_dmc.c +++ b/drivers/devfreq/rk3399_dmc.c @@ -411,6 +411,8 @@ static int rk3399_dmcfreq_remove(struct platform_device *pdev) { struct rk3399_dmcfreq *dmcfreq = dev_get_drvdata(&pdev->dev); + devfreq_event_disable_edev(dmcfreq->edev); + /* * Before remove the opp table we need to unregister the opp notifier. */ -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2024-57976
by Zizhi Wo 28 Mar '25

28 Mar '25

*** BLURB HERE *** Naohiro Aota (1): btrfs: zoned: fix extent range end unlock in cow_file_range() Qu Wenruo (1): btrfs: do proper folio cleanup when cow_file_range() failed fs/btrfs/inode.c | 63 ++++++++++++++++++++++++++---------------------- 1 file changed, 34 insertions(+), 29 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 1/2] btrfs: do proper folio cleanup when cow_file_range() failed
by Zizhi Wo 28 Mar '25

28 Mar '25

From: Qu Wenruo <wqu(a)suse.com> stable inclusion from stable-v6.13.2 commit 692cf71173bb41395c855acbbbe197d3aedfa5d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBJV CVE: CVE-2024-57976 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 06f364284794f149d2abc167c11d556cf20c954b upstream. [BUG] When testing with COW fixup marked as BUG_ON() (this is involved with the new pin_user_pages*() change, which should not result new out-of-band dirty pages), I hit a crash triggered by the BUG_ON() from hitting COW fixup path. This BUG_ON() happens just after a failed btrfs_run_delalloc_range(): BTRFS error (device dm-2): failed to run delalloc range, root 348 ino 405 folio 65536 submit_bitmap 6-15 start 90112 len 106496: -28 ------------[ cut here ]------------ kernel BUG at fs/btrfs/extent_io.c:1444! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 0 UID: 0 PID: 434621 Comm: kworker/u24:8 Tainted: G OE 6.12.0-rc7-custom+ #86 Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs] pc : extent_writepage_io+0x2d4/0x308 [btrfs] lr : extent_writepage_io+0x2d4/0x308 [btrfs] Call trace: extent_writepage_io+0x2d4/0x308 [btrfs] extent_writepage+0x218/0x330 [btrfs] extent_write_cache_pages+0x1d4/0x4b0 [btrfs] btrfs_writepages+0x94/0x150 [btrfs] do_writepages+0x74/0x190 filemap_fdatawrite_wbc+0x88/0xc8 start_delalloc_inodes+0x180/0x3b0 [btrfs] btrfs_start_delalloc_roots+0x174/0x280 [btrfs] shrink_delalloc+0x114/0x280 [btrfs] flush_space+0x250/0x2f8 [btrfs] btrfs_async_reclaim_data_space+0x180/0x228 [btrfs] process_one_work+0x164/0x408 worker_thread+0x25c/0x388 kthread+0x100/0x118 ret_from_fork+0x10/0x20 Code: aa1403e1 9402f3ef aa1403e0 9402f36f (d4210000) ---[ end trace 0000000000000000 ]--- [CAUSE] That failure is mostly from cow_file_range(), where we can hit -ENOSPC. Although the -ENOSPC is already a bug related to our space reservation code, let's just focus on the error handling. For example, we have the following dirty range [0, 64K) of an inode, with 4K sector size and 4K page size: 0 16K 32K 48K 64K |///////////////////////////////////////| |#######################################| Where |///| means page are still dirty, and |###| means the extent io tree has EXTENT_DELALLOC flag. - Enter extent_writepage() for page 0 - Enter btrfs_run_delalloc_range() for range [0, 64K) - Enter cow_file_range() for range [0, 64K) - Function btrfs_reserve_extent() only reserved one 16K extent So we created extent map and ordered extent for range [0, 16K) 0 16K 32K 48K 64K |////////|//////////////////////////////| |<- OE ->|##############################| And range [0, 16K) has its delalloc flag cleared. But since we haven't yet submit any bio, involved 4 pages are still dirty. - Function btrfs_reserve_extent() returns with -ENOSPC Now we have to run error cleanup, which will clear all EXTENT_DELALLOC* flags and clear the dirty flags for the remaining ranges: 0 16K 32K 48K 64K |////////| | | | | Note that range [0, 16K) still has its pages dirty. - Some time later, writeback is triggered again for the range [0, 16K) since the page range still has dirty flags. - btrfs_run_delalloc_range() will do nothing because there is no EXTENT_DELALLOC flag. - extent_writepage_io() finds page 0 has no ordered flag Which falls into the COW fixup path, triggering the BUG_ON(). Unfortunately this error handling bug dates back to the introduction of btrfs. Thankfully with the abuse of COW fixup, at least it won't crash the kernel. [FIX] Instead of immediately unlocking the extent and folios, we keep the extent and folios locked until either erroring out or the whole delalloc range finished. When the whole delalloc range finished without error, we just unlock the whole range with PAGE_SET_ORDERED (and PAGE_UNLOCK for !keep_locked cases), with EXTENT_DELALLOC and EXTENT_LOCKED cleared. And the involved folios will be properly submitted, with their dirty flags cleared during submission. For the error path, it will be a little more complex: - The range with ordered extent allocated (range (1)) We only clear the EXTENT_DELALLOC and EXTENT_LOCKED, as the remaining flags are cleaned up by btrfs_mark_ordered_io_finished()->btrfs_finish_one_ordered(). For folios we finish the IO (clear dirty, start writeback and immediately finish the writeback) and unlock the folios. - The range with reserved extent but no ordered extent (range(2)) - The range we never touched (range(3)) For both range (2) and range(3) the behavior is not changed. Now even if cow_file_range() failed halfway with some successfully reserved extents/ordered extents, we will keep all folios clean, so there will be no future writeback triggered on them. CC: stable(a)vger.kernel.org Fixes: 524272607e88 ("btrfs: Handle delalloc error correctly to avoid ordered extent hang") Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/btrfs/inode.c [Some context conflicts are encountered when adapting: 1. ram_size -> cur_size: 5599f39356c6 ("btrfs: simplify range tracking in cow_file_range()"), just simplify the process and do not affect the logic. 2. There is no lock_extent related code: 0ab540995ae0 ("btrfs: push lock_extent into cow_file_range_inline")\a0766d8f35d8 ("btrfs: push extent lock into cow_file_range"), this is to narrow the scope of lock, but does not affect this patch. 3. extent_clear_unlock_delalloc() missed a parameter named "cached": 6b0a63a4fa31 ("btrfs: add a cached state to extent_clear_unlock_delalloc"), does not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/btrfs/inode.c | 54 ++++++++++++++++++++++++------------------------ 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 71902110c2fe..862cc8703bf0 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -1356,6 +1356,17 @@ static noinline int cow_file_range(struct btrfs_inode *inode, alloc_hint = get_extent_allocation_hint(inode, start, num_bytes); + /* + * We're not doing compressed IO, don't unlock the first page (which + * the caller expects to stay locked), don't clear any dirty bits and + * don't set any writeback bits. + * + * Do set the Ordered (Private2) bit so we know this page was properly + * setup for writepage. + */ + page_ops = (keep_locked ? 0 : PAGE_UNLOCK); + page_ops |= PAGE_SET_ORDERED; + /* * Relocation relies on the relocated extents to have exactly the same * size as the original extents. Normally writeback for relocation data @@ -1456,21 +1467,6 @@ static noinline int cow_file_range(struct btrfs_inode *inode, btrfs_dec_block_group_reservations(fs_info, ins.objectid); - /* - * We're not doing compressed IO, don't unlock the first page - * (which the caller expects to stay locked), don't clear any - * dirty bits and don't set any writeback bits - * - * Do set the Ordered (Private2) bit so we know this page was - * properly setup for writepage. - */ - page_ops = (keep_locked ? 0 : PAGE_UNLOCK); - page_ops |= PAGE_SET_ORDERED; - - extent_clear_unlock_delalloc(inode, start, start + ram_size - 1, - locked_page, - EXTENT_LOCKED | EXTENT_DELALLOC, - page_ops); if (num_bytes < cur_alloc_size) num_bytes = 0; else @@ -1487,6 +1483,8 @@ static noinline int cow_file_range(struct btrfs_inode *inode, if (ret) goto out_unlock; } + extent_clear_unlock_delalloc(inode, orig_start, end, locked_page, + EXTENT_LOCKED | EXTENT_DELALLOC, page_ops); done: if (done_offset) *done_offset = end; @@ -1507,29 +1505,31 @@ static noinline int cow_file_range(struct btrfs_inode *inode, * We process each region below. */ - clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | - EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV; - page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; - /* * For the range (1). We have already instantiated the ordered extents * for this region. They are cleaned up by * btrfs_cleanup_ordered_extents() in e.g, - * btrfs_run_delalloc_range(). EXTENT_LOCKED | EXTENT_DELALLOC are - * already cleared in the above loop. And, EXTENT_DELALLOC_NEW | - * EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV are handled by the cleanup - * function. + * btrfs_run_delalloc_range(). + * EXTENT_DELALLOC_NEW | EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV + * are also handled by the cleanup function. * - * However, in case of @keep_locked, we still need to unlock the pages - * (except @locked_page) to ensure all the pages are unlocked. + * So here we only clear EXTENT_LOCKED and EXTENT_DELALLOC flag, and + * finish the writeback of the involved folios, which will be never submitted. */ - if (keep_locked && orig_start < start) { + if (orig_start < start) { + clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC; + page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; + if (!locked_page) mapping_set_error(inode->vfs_inode.i_mapping, ret); extent_clear_unlock_delalloc(inode, orig_start, start - 1, - locked_page, 0, page_ops); + locked_page, clear_bits, page_ops); } + clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | + EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV; + page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; + /* * For the range (2). If we reserved an extent for our delalloc range * (or a subrange) and failed to create the respective ordered extent, -- 2.39.2

2 3

[openeuler:OLK-5.10] BUILD REGRESSION 8c45ad1b4135b7bbeb7c208ce99391363bd666f7
by kernel test robot 28 Mar '25

28 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 8c45ad1b4135b7bbeb7c208ce99391363bd666f7 !15595 io_uring: prevent opcode speculation Unverified Error/Warning (likely false positive, kindly check if interested): drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.o: warning: objtool: st_lsm6dsx_shub_wait_complete() falls through to next function st_lsm6dsx_shub_read_output() drivers/media/test-drivers/vivid/vivid-kthread-cap.o: warning: objtool: vivid_copy_buffer() falls through to next function scale_line() drivers/media/test-drivers/vivid/vivid-kthread-cap.o: warning: objtool: vivid_thread_vid_cap_tick() falls through to next function plane_vaddr() fs/btrfs/free-space-cache.o: warning: objtool: add_bytes_to_bitmap() falls through to next function tree_insert_offset() fs/btrfs/free-space-tree.o: warning: objtool: update_free_space_extent_count() falls through to next function alloc_bitmap() fs/ufs/balloc.o: warning: objtool: ufs_free_fragments() falls through to next function ufs_clusteracct() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-alldefconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-allnoconfig | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-allnoconfig | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_file_name-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_log-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_HDD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CLEAR_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_ENABLE_MSIX-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_MASK_DISABLE-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_STATUS_EXIST_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_SSD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_mgrq_resend-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_notify-Werror-Wmissing-prototypes | `-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:error:unused-function-ps3_scsih_dev_id_get-Werror-Wunused-function |-- x86_64-buildonly-randconfig-001-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-003-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-004-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-005-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-101-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-media-tuners-e4000.o:warning:objtool:e4000_set_params-falls-through-to-next-function-e4000_standby() | |-- drivers-nvdimm-namespace_devs.o:warning:objtool:size_store-falls-through-to-next-function-nd_namespace_label_update() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:bitmap_clear_bits-falls-through-to-next-function-free_bitmap() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-102-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-103-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-104-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- fs-ufs-ialloc.o:warning:objtool:ufs_new_inode-falls-through-to-next-function-ufs2_init_inodes_chunk() | |-- fs-ufs-inode.o:warning:objtool:ufs_iget-falls-through-to-next-function-ufs_set_inode_ops() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-121-20250326 | |-- drivers-iio-imu-st_lsm6dsx-st_lsm6dsx_shub.o:warning:objtool:st_lsm6dsx_shub_wait_complete-falls-through-to-next-function-st_lsm6dsx_shub_read_output() | |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_copy_buffer-falls-through-to-next-function-scale_line() | |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_thread_vid_cap_tick-falls-through-to-next-function-plane_vaddr() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-tree_insert_offset() | `-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-alloc_bitmap() |-- x86_64-randconfig-121-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-122-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-memcontrol.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__user-buffer | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static `-- x86_64-randconfig-161-20250327 |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- drivers-gpu-drm-bridge-tc358768.o:warning:objtool:tc358768_bridge_pre_enable-falls-through-to-next-function-tc358768_bridge_enable() |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() |-- fs-btrfs-free-space-cache.o:warning:objtool:bitmap_clear_bits-falls-through-to-next-function-free_bitmap() |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() |-- fs-ufs-balloc.o:warning:objtool:ufs_free_fragments-falls-through-to-next-function-ufs_clusteracct() |-- fs-ufs-ialloc.o:warning:objtool:ufs_new_inode-falls-through-to-next-function-ufs2_init_inodes_chunk() |-- fs-ufs-inode.o:warning:objtool:ufs_iget-falls-through-to-next-function-ufs_set_inode_ops() |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- net-ceph-striper.o:warning:objtool:ceph_calc_file_object_mapping-falls-through-to-next-function-ceph_file_to_extents() elapsed time: 1455m configs tested: 17 configs skipped: 128 tested configs: arm64 alldefconfig gcc-14.2.0 arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250327 gcc-5.5.0 arm64 randconfig-002-20250327 clang-21 arm64 randconfig-003-20250327 clang-21 arm64 randconfig-004-20250327 clang-21 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250327 gcc-12 x86_64 buildonly-randconfig-002-20250327 gcc-12 x86_64 buildonly-randconfig-003-20250327 clang-20 x86_64 buildonly-randconfig-004-20250327 clang-20 x86_64 buildonly-randconfig-005-20250327 gcc-12 x86_64 buildonly-randconfig-006-20250327 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1525/1525] drivers/char/svm.c:353:35: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 28 Mar '25

28 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3f8283040b83a49bdad8dc3dd4ccd3f50910af28 commit: b8c0480a3eba11ee6616019a3aaa75ee38f06f02 [1525/1525] svm: serach dts to init children device config: arm64-randconfig-r112-20250328 (https://download.01.org/0day-ci/archive/20250328/202503280904.ByoMg5CF-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250328/202503280904.ByoMg5CF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503280904.ByoMg5CF-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/char/svm.c:353:35: sparse: sparse: Using plain integer as NULL pointer vim +353 drivers/char/svm.c 221 222 static int svm_init_core(struct svm_device *sdev) 223 { 224 int err = 0; 225 struct device *dev = sdev->dev; 226 struct acpi_device *adev = ACPI_COMPANION(sdev->dev); 227 struct acpi_device *cdev = NULL; 228 int id = 0; 229 230 down_write(&svm_sem); 231 if (!svm_bus_type.iommu_ops) { 232 err = bus_register(&svm_bus_type); 233 if (err) { 234 up_write(&svm_sem); 235 dev_err(dev, "failed to register svm_bus_type\n"); 236 return err; 237 } 238 239 err = bus_set_iommu(&svm_bus_type, dev->bus->iommu_ops); 240 if (err) { 241 up_write(&svm_sem); 242 dev_err(dev, "failed to set iommu for svm_bus_type\n"); 243 goto err_unregister_bus; 244 } 245 } else if (svm_bus_type.iommu_ops != dev->bus->iommu_ops) { 246 err = -EBUSY; 247 up_write(&svm_sem); 248 dev_err(dev, "iommu_ops configured, but changed!\n"); 249 goto err_unregister_bus; 250 } 251 up_write(&svm_sem); 252 253 list_for_each_entry(cdev, &adev->children, node) { 254 err = svm_acpi_add_core(sdev, cdev, id++); 255 if (err) 256 device_for_each_child(dev, NULL, svm_remove_core); 257 } 258 259 return err; 260 261 err_unregister_bus: 262 bus_unregister(&svm_bus_type); 263 264 return err; 265 } 266 #else 267 static int svm_of_add_core(struct svm_device *sdev, struct device_node *np) 268 { 269 int err; 270 struct resource res; 271 struct core_device *cdev = NULL; 272 char *name = NULL; 273 274 name = devm_kasprintf(sdev->dev, GFP_KERNEL, "svm%llu_%s", 275 sdev->id, np->name); 276 if (name == NULL) 277 return -ENOMEM; 278 279 cdev = kzalloc(sizeof(*cdev), GFP_KERNEL); 280 if (cdev == NULL) 281 return -ENOMEM; 282 283 cdev->dev.of_node = np; 284 cdev->dev.parent = sdev->dev; 285 cdev->dev.bus = &svm_bus_type; 286 cdev->dev.release = cdev_device_release; 287 cdev->smmu_bypass = of_property_read_bool(np, "hisi,smmu_bypass"); 288 dev_set_name(&cdev->dev, "%s", name); 289 290 err = device_register(&cdev->dev); 291 if (err) { 292 dev_info(&cdev->dev, "core_device register failed\n"); 293 put_device(&cdev->dev); 294 kfree(cdev); 295 return err; 296 } 297 298 err = of_dma_configure(&cdev->dev, np, true); 299 if (err) { 300 dev_dbg(&cdev->dev, "of_dma_configure failed\n"); 301 goto err_unregister_dev; 302 } 303 304 err = of_address_to_resource(np, 0, &res); 305 if (err) { 306 dev_info(&cdev->dev, "no reg, FW should install the sid\n"); 307 } else { 308 /* If the reg specified, install sid for the core */ 309 void __iomem *core_base = NULL; 310 int sid = cdev->dev.iommu_fwspec->ids[0]; 311 312 core_base = ioremap(res.start, resource_size(&res)); 313 if (core_base == NULL) { 314 err = -ENOMEM; 315 dev_err(&cdev->dev, "ioremap failed\n"); 316 goto err_unregister_dev; 317 } 318 319 writel_relaxed(sid, core_base + CORE_SID); 320 iounmap(core_base); 321 } 322 323 /* If core device is smmu bypass, request direct map. */ 324 if (cdev->smmu_bypass) { 325 err = iommu_request_dm_for_dev(&cdev->dev); 326 if (err) 327 goto err_unregister_dev; 328 329 return 0; 330 } 331 332 cdev->group = iommu_group_get(&cdev->dev); 333 if (IS_ERR_OR_NULL(cdev->group)) { 334 err = -ENXIO; 335 dev_err(&cdev->dev, "smmu is not right configured\n"); 336 goto err_unregister_dev; 337 } 338 339 cdev->domain = iommu_domain_alloc(sdev->dev->bus); 340 if (cdev->domain == NULL) { 341 err = -ENOMEM; 342 dev_info(&cdev->dev, "failed to alloc domain\n"); 343 goto err_unregister_dev; 344 } 345 346 err = iommu_attach_group(cdev->domain, cdev->group); 347 if (err) { 348 dev_err(&cdev->dev, "failed group to domain\n"); 349 goto err_free_domain; 350 } 351 352 err = iommu_sva_device_init(&cdev->dev, IOMMU_SVA_FEAT_IOPF, > 353 UINT_MAX, 0); 354 if (err) { 355 dev_err(&cdev->dev, "failed to init sva device\n"); 356 goto err_detach_group; 357 } 358 359 return 0; 360 361 err_detach_group: 362 iommu_detach_group(cdev->domain, cdev->group); 363 err_free_domain: 364 iommu_domain_free(cdev->domain); 365 err_unregister_dev: 366 device_unregister(&cdev->dev); 367 368 return err; 369 } 370 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0