- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] RDMA/hns: Fix double destruction of rsv_qp
by Junxian Huang 12 Jun '25

12 Jun '25

From: wenglianfa <wenglianfa(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICEQ4V ---------------------------------------------------------------------- rsv_qp will be double destroyed in error flow, first in free_mr_init(), and then in hns_roce_exit(). Here fix it. [23776.119039] list_del corruption, ffff589732eb9b50->next is LIST_POISON1 (dead000000000100) [23776.128188] WARNING: CPU: 8 PID: 1047115 at lib/list_debug.c:53 __list_del_entry_valid+0x148/0x240 [23776.137975] Modules linked in: hns_roce_hw_v2(E) kp_ktools(OE) hns3_cae(OE) hns3(E) hclge(E) hnae3(E) vxlan ip6_udp_tunnel udp_tunnel xt_CHECKSUM ipt_REJECT nf_reject_ipv4 ip6table_mangle ip6table_nat iptable_mangle nf_tables ip6table_filter ip6_tables tun vfio_iommu_type1(E) vfio_pci(E) vfio_virqfd(E) vfio(E) realtek ixgbe xt_MASQUERADE nf_conntrack_netlink iptable_nat xt_addrtype iptable_filter ip_tables xt_conntrack nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c br_netfilter bridge overlay vfat fat ipmi_ssif ses enclosure arm_spe_pmu arm_smmuv3_pmu hibmc_drm drm_vram_helper sg drm_ttm_helper acpi_ipmi ttm ipmi_si ipmi_devintf ipmi_msghandler hisi_uncore_hha_pmu uio_pdrv_genirq uio hisi_uncore_ddrc_pmu hisi_uncore_l3c_pmu hisi_uncore_pmu sch_fq_codel fuse hisi_sas_v3_hw hisi_sas_main ghash_ce libsas ahci sha2_ce xhci_pci scsi_transport_sas libahci hisi_qm sha256_arm64 hisi_dma sha1_ce sbsa_gwdt xhci_hcd virt_dma uacce megaraid_sas host_edma_drv libata mdio [23776.138107] i2c_designware_platform [23776.143902] hns3 0000:7d:00.0: prepare wait ok [23776.224538] gpio_dwapb i2c_designware_core hisi_trng_v2 gpio_generic rpcrdma sunrpc ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi ib_ipoib aes_ce_blk crypto_simd cryptd aes_ce_cipher [last unloaded: hns_roce_hw_v2] [23776.224573] CPU: 8 PID: 1047115 Comm: kworker/u193:3 Kdump: loaded Tainted: G OE 5.10.0 #1 [23776.224576] Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDD, BIOS 2280-V2 CS V5.B221.01 12/09/2021 [23776.224669] Workqueue: hclge hclge_service_task [hclge] [23776.229136] hns3 0000:7d:00.0: In reset process RoCE client uninit. [23776.234320] pstate: 60400089 (nZCv daIf +PAN -UAO -TCO BTYPE=--) [23776.234325] pc : __list_del_entry_valid+0x148/0x240 [23776.234327] lr : __list_del_entry_valid+0x13c/0x240 [23776.234328] sp : ffff80003798b9f0 [23776.234329] x29: ffff80003798b9f0 x28: ffff388ed4711000 [23776.234333] x27: ffffdc1eafe39c48 x26: 0000000000000000 [23776.234336] x25: 0000000000000000 x24: ffff388ed4711000 [23776.234342] x23: ffffdc1e886be378 x22: ffff388d9de39198 [23776.234348] x21: ffff589732eb9800 x20: ffff388d9de39610 [23776.234352] x19: ffffdc1eb0dad3b0 x18: ffff80003798b5c8 [23776.234356] x17: 0000000000000000 x16: ffffdc1ead5ed4c0 [23776.356567] x15: 0000000000000000 x14: ffffdc1eb0160c70 [23776.362727] x13: 00000000000bffe8 x12: ffffdc1eb0160cc8 [23776.368887] x11: 0000000000000001 x10: 0000000000000001 [23776.375044] x9 : ffffdc1eaca945fc x8 : c0000000ffff7fff [23776.381199] x7 : ffff3894ffdb5890 x6 : 0000000000003093 [23776.387357] x5 : ffff3894ffdb5898 x4 : 0000000000003093 [23776.393516] x3 : ffffdc1eb0a85460 x2 : 0000000000000000 [23776.399671] x1 : 0000000000000000 x0 : 0000000000000001 [23776.405825] Call trace: [23776.409129] __list_del_entry_valid+0x148/0x240 [23776.414525] hns_roce_qp_remove+0x4c/0x3f0 [hns_roce_hw_v2] [23776.420948] hns_roce_v2_destroy_qp_common+0x1dc/0x5f4 [hns_roce_hw_v2] [23776.428414] hns_roce_v2_destroy_qp+0x22c/0x46c [hns_roce_hw_v2] [23776.435272] free_mr_exit+0x6c/0x120 [hns_roce_hw_v2] [23776.441177] hns_roce_v2_exit+0x170/0x200 [hns_roce_hw_v2] [23776.447514] hns_roce_exit+0x118/0x350 [hns_roce_hw_v2] [23776.453595] __hns_roce_hw_v2_init_instance+0x1c8/0x304 [hns_roce_hw_v2] [23776.461142] hns_roce_hw_v2_reset_notify_init+0x170/0x21c [hns_roce_hw_v2] [23776.468865] hns_roce_hw_v2_reset_notify+0x6c/0x190 [hns_roce_hw_v2] [23776.476077] hclge_notify_roce_client+0x6c/0x160 [hclge] [23776.482246] hclge_reset_rebuild+0x150/0x5c0 [hclge] [23776.488074] hclge_reset+0x10c/0x140 [hclge] [23776.493207] hclge_reset_subtask+0x80/0x104 [hclge] [23776.498944] hclge_reset_service_task+0x168/0x3ac [hclge] [23776.505199] hclge_service_task+0x50/0x100 [hclge] [23776.510836] process_one_work+0x250/0x9a0 [23776.515695] worker_thread+0x324/0x990 [23776.520294] kthread+0x190/0x210 [23776.524375] ret_from_fork+0x10/0x18 Fixes: e96a09a3ded1 ("RDMA/hns: Fix Use-After-Free of rsv_qp") Signed-off-by: wenglianfa <wenglianfa(a)huawei.com> Signed-off-by: Donghua Huang <huangdonghua3(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 24 +++++++++++----------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index 2a93e4e905fd..595292fb88f7 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -3174,11 +3174,19 @@ static int hns_roce_v2_init(struct hns_roce_dev *hr_dev) { int ret; + if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08) { + ret = free_mr_init(hr_dev); + if (ret) { + dev_err(hr_dev->dev, "failed to init free mr!\n"); + return ret; + } + } + ret = hns_roce_v2_get_reset_page(hr_dev); if (ret) { dev_err(hr_dev->dev, "reset state init failed, ret = %d.\n", ret); - return ret; + goto error_get_reset_page_failed; } /* The hns ROCEE requires the extdb info to be cleared before using */ @@ -3205,6 +3213,9 @@ static int hns_roce_v2_init(struct hns_roce_dev *hr_dev) put_hem_table(hr_dev); err_clear_extdb_failed: hns_roce_v2_put_reset_page(hr_dev); +error_get_reset_page_failed: + if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08) + free_mr_exit(hr_dev); return ret; } @@ -7609,21 +7620,10 @@ static int __hns_roce_hw_v2_init_instance(struct hnae3_handle *handle) goto error_failed_roce_init; } - if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08) { - ret = free_mr_init(hr_dev); - if (ret) { - dev_err(hr_dev->dev, "failed to init free mr!\n"); - goto error_failed_free_mr_init; - } - } - handle->priv = hr_dev; return 0; -error_failed_free_mr_init: - hns_roce_exit(hr_dev, true); - error_failed_roce_init: kfree(hr_dev->priv); -- 2.33.0

2 1

[openeuler:openEuler-1.0-LTS 1665/1665] include/uapi/linux/sctp.h:390:1: error: alignment 4 of 'struct sctp_paddr_change' is less than 8
by kernel test robot 12 Jun '25

12 Jun '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7b14992c5fc2361904e3c2f345fe502cf7961adb commit: a6a7981cbf66d4951425d33cdce6ef39206eba83 [1665/1665] Net: ethernet: Support 3snic 3s9xx network card config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250612/202506121901.jXsG7S3b-lkp@…) compiler: aarch64-linux-gcc (GCC) 15.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250612/202506121901.jXsG7S3b-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506121901.jXsG7S3b-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from include/linux/sctp.h:57, from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx.c:14: >> include/uapi/linux/sctp.h:390:1: error: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Werror=packed-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:719:1: error: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Werror=packed-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:718:33: error: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Werror=packed-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ >> include/uapi/linux/sctp.h:732:1: error: alignment 4 of 'struct sctp_prim' is less than 8 [-Werror=packed-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:731:33: error: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Werror=packed-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ >> include/uapi/linux/sctp.h:783:1: error: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Werror=packed-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:775:33: error: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Werror=packed-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ >> include/uapi/linux/sctp.h:896:1: error: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Werror=packed-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:890:33: error: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Werror=packed-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- In file included from include/linux/sctp.h:57, from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:14: >> include/uapi/linux/sctp.h:390:1: error: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Werror=packed-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:719:1: error: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Werror=packed-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:718:33: error: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Werror=packed-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ >> include/uapi/linux/sctp.h:732:1: error: alignment 4 of 'struct sctp_prim' is less than 8 [-Werror=packed-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:731:33: error: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Werror=packed-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ >> include/uapi/linux/sctp.h:783:1: error: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Werror=packed-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:775:33: error: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Werror=packed-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ >> include/uapi/linux/sctp.h:896:1: error: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Werror=packed-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:890:33: error: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Werror=packed-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:42:5: error: no previous prototype for 'sss_nic_alloc_sq_resource' [-Werror=missing-prototypes] 42 | int sss_nic_alloc_sq_resource(struct sss_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:87:6: error: no previous prototype for 'sss_nic_free_sq_resource' [-Werror=missing-prototypes] 87 | void sss_nic_free_sq_resource(struct sss_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:104:6: error: no previous prototype for 'sss_nic_init_all_sq' [-Werror=missing-prototypes] 104 | void sss_nic_init_all_sq(struct sss_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:128:5: error: no previous prototype for 'sss_nic_alloc_sq_desc_group' [-Werror=missing-prototypes] 128 | int sss_nic_alloc_sq_desc_group(struct sss_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:153:6: error: no previous prototype for 'sss_nic_free_sq_desc_group' [-Werror=missing-prototypes] 153 | void sss_nic_free_sq_desc_group(struct sss_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:200:6: error: no previous prototype for 'sss_nic_flush_all_sq' [-Werror=missing-prototypes] 200 | void sss_nic_flush_all_sq(struct sss_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- In file included from include/linux/sctp.h:57, from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:18: >> include/uapi/linux/sctp.h:390:1: error: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Werror=packed-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:719:1: error: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Werror=packed-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:718:33: error: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Werror=packed-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ >> include/uapi/linux/sctp.h:732:1: error: alignment 4 of 'struct sctp_prim' is less than 8 [-Werror=packed-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:731:33: error: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Werror=packed-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ >> include/uapi/linux/sctp.h:783:1: error: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Werror=packed-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:775:33: error: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Werror=packed-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ >> include/uapi/linux/sctp.h:896:1: error: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Werror=packed-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:890:33: error: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Werror=packed-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:80:5: error: no previous prototype for 'sss_nic_alloc_rq_res_group' [-Werror=missing-prototypes] 80 | int sss_nic_alloc_rq_res_group(struct sss_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:136:6: error: no previous prototype for 'sss_nic_free_rq_res_group' [-Werror=missing-prototypes] 136 | void sss_nic_free_rq_res_group(struct sss_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:208:5: error: no previous prototype for 'sss_nic_init_rq_desc_group' [-Werror=missing-prototypes] 208 | int sss_nic_init_rq_desc_group(struct sss_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:235:6: error: no previous prototype for 'sss_nic_free_rq_desc_group' [-Werror=missing-prototypes] 235 | void sss_nic_free_rq_desc_group(struct sss_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:241:5: error: no previous prototype for 'sss_nic_alloc_rq_desc_group' [-Werror=missing-prototypes] 241 | int sss_nic_alloc_rq_desc_group(struct sss_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:267:5: error: no previous prototype for 'sss_nic_update_rx_rss' [-Werror=missing-prototypes] 267 | int sss_nic_update_rx_rss(struct sss_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:282:6: error: no previous prototype for 'sss_nic_reset_rx_rss' [-Werror=missing-prototypes] 282 | void sss_nic_reset_rx_rss(struct net_device *netdev) | ^~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- In file included from include/linux/sctp.h:57, from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_reset.c:18: >> include/uapi/linux/sctp.h:390:1: error: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Werror=packed-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:719:1: error: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Werror=packed-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:718:33: error: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Werror=packed-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ >> include/uapi/linux/sctp.h:732:1: error: alignment 4 of 'struct sctp_prim' is less than 8 [-Werror=packed-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:731:33: error: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Werror=packed-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ >> include/uapi/linux/sctp.h:783:1: error: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Werror=packed-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:775:33: error: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Werror=packed-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ >> include/uapi/linux/sctp.h:896:1: error: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Werror=packed-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ >> include/uapi/linux/sctp.h:890:33: error: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Werror=packed-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_reset.c:179:6: error: no previous prototype for 'sss_nic_rq_watchdog_handler' [-Werror=missing-prototypes] 179 | void sss_nic_rq_watchdog_handler(struct work_struct *work) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:492:5: error: no previous prototype for 'sss_nic_get_io_stats_size' [-Werror=missing-prototypes] 492 | u32 sss_nic_get_io_stats_size(const struct sss_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~ In file included from arch/arm64/include/asm/bitops.h:39, from include/linux/bitops.h:20, from include/linux/kernel.h:11, from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:6: In function 'test_bit', inlined from 'sss_nic_add_ethtool_link_mode' at drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:764:7: >> include/asm-generic/bitops/non-atomic.h:106:27: error: array subscript 'long unsigned int[0]' is partly outside array bounds of 'u32[1]' {aka 'unsigned int[1]'} [-Werror=array-bounds=] 106 | return 1UL & (addr[BIT_WORD(nr)] >> (nr & (BITS_PER_LONG-1))); | ~~~~^~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c: In function 'sss_nic_add_ethtool_link_mode': drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:759:40: note: object 'hw_mode' of size 4 759 | u32 hw_mode, u32 op) | ~~~~^~~~~~~ cc1: all warnings being treated as errors vim +390 include/uapi/linux/sctp.h ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 374 ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 375 /* ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 376 * 5.3.1.2 SCTP_PEER_ADDR_CHANGE ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 377 * ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 378 * When a destination address on a multi-homed peer encounters a change ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 379 * an interface details event is sent. The information has the ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 380 * following structure: ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 381 */ ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 382 struct sctp_paddr_change { ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 383 __u16 spc_type; ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 384 __u16 spc_flags; ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 385 __u32 spc_length; ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 386 struct sockaddr_storage spc_aaddr; ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 387 int spc_state; ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 388 int spc_error; ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 389 sctp_assoc_t spc_assoc_id; 20c9c825b12fcb include/net/sctp/user.h Sridhar Samudrala 2005-10-06 @390 } __attribute__((packed, aligned(4))); ^1da177e4c3f41 include/net/sctp/user.h Linus Torvalds 2005-04-16 391 :::::: The code at line 390 was first introduced by commit :::::: 20c9c825b12fcb8526a29cf20a17a5a3fc581726 [SCTP] Fix SCTP socket options to work with 32-bit apps on 64-bit kernels. :::::: TO: Sridhar Samudrala <sri(a)us.ibm.com> :::::: CC: David S. Miller <davem(a)davemloft.net> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] arm64: uaccess: avoid blocking within critical sections
by Yuntao Liu 12 Jun '25

12 Jun '25

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.16-rc3 commit 94902d849e85093aafcdbea2be8e2beff47233e6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICERQ4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 94902d849e85093aafcdbea2be8e2beff47233e6 ] As Vincent reports in: https://lore.kernel.org/r/20211118163417.21617-1-vincent.whitchurch@axis.com The put_user() in schedule_tail() can get stuck in a livelock, similar to a problem recently fixed on riscv in commit: 285a76bb2cf51b0c ("riscv: evaluate put_user() arg before enabling user access") In __raw_put_user() we have a critical section between uaccess_ttbr0_enable() and uaccess_ttbr0_disable() where we cannot safely call into the scheduler without having taken an exception, as schedule() and other scheduling functions will not save/restore the TTBR0 state. If either of the `x` or `ptr` arguments to __raw_put_user() contain a blocking call, we may call into the scheduler within the critical section. This can result in two problems: 1) The access within the critical section will occur without the required TTBR0 tables installed. This will fault, and where the required tables permit access, the access will be retried without the required tables, resulting in a livelock. 2) When TTBR0 SW PAN is in use, check_and_switch_context() does not modify TTBR0, leaving a stale value installed. The mappings of the blocked task will erroneously be accessible to regular accesses in the context of the new task. Additionally, if the tables are subsequently freed, local TLB maintenance required to reuse the ASID may be lost, potentially resulting in TLB corruption (e.g. in the presence of CnP). The same issue exists for __raw_get_user() in the critical section between uaccess_ttbr0_enable() and uaccess_ttbr0_disable(). A similar issue exists for __get_kernel_nofault() and __put_kernel_nofault() for the critical section between __uaccess_enable_tco_async() and __uaccess_disable_tco_async(), as the TCO state is not context-switched by direct calls into the scheduler. Here the TCO state may be lost from the context of the current task, resulting in unexpected asynchronous tag check faults. It may also be leaked to another task, suppressing expected tag check faults. To fix all of these cases, we must ensure that we do not directly call into the scheduler in their respective critical sections. This patch reworks __raw_put_user(), __raw_get_user(), __get_kernel_nofault(), and __put_kernel_nofault(), ensuring that parameters are evaluated outside of the critical sections. To make this requirement clear, comments are added describing the problem, and line spaces added to separate the critical sections from other portions of the macros. For __raw_get_user() and __raw_put_user() the `err` parameter is conditionally assigned to, and we must currently evaluate this in the critical section. This behaviour is relied upon by the signal code, which uses chains of put_user_error() and get_user_error(), checking the return value at the end. In all cases, the `err` parameter is a plain int rather than a more complex expression with a blocking call, so this is safe. In future we should try to clean up the `err` usage to remove the potential for this to be a problem. Aside from the changes to time of evaluation, there should be no functional change as a result of this patch. Reported-by: Vincent Whitchurch <vincent.whitchurch(a)axis.com> Link: https://lore.kernel.org/r/20211118163417.21617-1-vincent.whitchurch@axis.com Fixes: f253d827f33c ("arm64: uaccess: refactor __{get,put}_user") Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Link: https://lore.kernel.org/r/20211122125820.55286-1-mark.rutland@arm.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: arch/arm64/include/asm/uaccess.h [adjust context] Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- arch/arm64/include/asm/uaccess.h | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h index 635436bd8712..03c2db710f92 100644 --- a/arch/arm64/include/asm/uaccess.h +++ b/arch/arm64/include/asm/uaccess.h @@ -256,12 +256,22 @@ do { \ (x) = (__force __typeof__(*(ptr)))__gu_val; \ } while (0) +/* + * We must not call into the scheduler between uaccess_ttbr0_enable() and + * uaccess_ttbr0_disable(). As `x` and `ptr` could contain blocking functions, + * we must evaluate these outside of the critical section. + */ #define __raw_get_user(x, ptr, err) \ do { \ + __typeof__(*(ptr)) __user *__rgu_ptr = (ptr); \ + __typeof__(x) __rgu_val; \ __chk_user_ptr(ptr); \ + \ uaccess_ttbr0_enable(); \ - __raw_get_mem("ldtr", x, ptr, err, U); \ + __raw_get_mem("ldtr", __rgu_val, __rgu_ptr, err, U); \ uaccess_ttbr0_disable(); \ + \ + (x) = __rgu_val; \ } while (0) #define __get_user_error(x, ptr, err) \ @@ -329,11 +339,19 @@ do { \ } \ } while (0) +/* + * We must not call into the scheduler between uaccess_ttbr0_enable() and + * uaccess_ttbr0_disable(). As `x` and `ptr` could contain blocking functions, + * we must evaluate these outside of the critical section. + */ #define __raw_put_user(x, ptr, err) \ do { \ - __chk_user_ptr(ptr); \ + __typeof__(*(ptr)) __user *__rpu_ptr = (ptr); \ + __typeof__(*(ptr)) __rpu_val = (x); \ + __chk_user_ptr(__rpu_ptr); \ + \ uaccess_ttbr0_enable(); \ - __raw_put_mem("sttr", x, ptr, err, U); \ + __raw_put_mem("sttr", __rpu_val, __rpu_ptr, err, U); \ uaccess_ttbr0_disable(); \ } while (0) -- 2.34.1

2 1

[PATCH OLK-5.10] arm64: uaccess: avoid blocking within critical sections
by Yuntao Liu 12 Jun '25

12 Jun '25

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.16-rc3 commit 94902d849e85093aafcdbea2be8e2beff47233e6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICERQ4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 94902d849e85093aafcdbea2be8e2beff47233e6 ] As Vincent reports in: https://lore.kernel.org/r/20211118163417.21617-1-vincent.whitchurch@axis.com The put_user() in schedule_tail() can get stuck in a livelock, similar to a problem recently fixed on riscv in commit: 285a76bb2cf51b0c ("riscv: evaluate put_user() arg before enabling user access") In __raw_put_user() we have a critical section between uaccess_ttbr0_enable() and uaccess_ttbr0_disable() where we cannot safely call into the scheduler without having taken an exception, as schedule() and other scheduling functions will not save/restore the TTBR0 state. If either of the `x` or `ptr` arguments to __raw_put_user() contain a blocking call, we may call into the scheduler within the critical section. This can result in two problems: 1) The access within the critical section will occur without the required TTBR0 tables installed. This will fault, and where the required tables permit access, the access will be retried without the required tables, resulting in a livelock. 2) When TTBR0 SW PAN is in use, check_and_switch_context() does not modify TTBR0, leaving a stale value installed. The mappings of the blocked task will erroneously be accessible to regular accesses in the context of the new task. Additionally, if the tables are subsequently freed, local TLB maintenance required to reuse the ASID may be lost, potentially resulting in TLB corruption (e.g. in the presence of CnP). The same issue exists for __raw_get_user() in the critical section between uaccess_ttbr0_enable() and uaccess_ttbr0_disable(). A similar issue exists for __get_kernel_nofault() and __put_kernel_nofault() for the critical section between __uaccess_enable_tco_async() and __uaccess_disable_tco_async(), as the TCO state is not context-switched by direct calls into the scheduler. Here the TCO state may be lost from the context of the current task, resulting in unexpected asynchronous tag check faults. It may also be leaked to another task, suppressing expected tag check faults. To fix all of these cases, we must ensure that we do not directly call into the scheduler in their respective critical sections. This patch reworks __raw_put_user(), __raw_get_user(), __get_kernel_nofault(), and __put_kernel_nofault(), ensuring that parameters are evaluated outside of the critical sections. To make this requirement clear, comments are added describing the problem, and line spaces added to separate the critical sections from other portions of the macros. For __raw_get_user() and __raw_put_user() the `err` parameter is conditionally assigned to, and we must currently evaluate this in the critical section. This behaviour is relied upon by the signal code, which uses chains of put_user_error() and get_user_error(), checking the return value at the end. In all cases, the `err` parameter is a plain int rather than a more complex expression with a blocking call, so this is safe. In future we should try to clean up the `err` usage to remove the potential for this to be a problem. Aside from the changes to time of evaluation, there should be no functional change as a result of this patch. Reported-by: Vincent Whitchurch <vincent.whitchurch(a)axis.com> Link: https://lore.kernel.org/r/20211118163417.21617-1-vincent.whitchurch@axis.com Fixes: f253d827f33c ("arm64: uaccess: refactor __{get,put}_user") Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Link: https://lore.kernel.org/r/20211122125820.55286-1-mark.rutland@arm.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: arch/arm64/include/asm/uaccess.h [adjust context] Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- arch/arm64/include/asm/uaccess.h | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h index 635436bd8712..ec7ca14adb91 100644 --- a/arch/arm64/include/asm/uaccess.h +++ b/arch/arm64/include/asm/uaccess.h @@ -256,12 +256,22 @@ do { \ (x) = (__force __typeof__(*(ptr)))__gu_val; \ } while (0) +/* + * We must not call into the scheduler between uaccess_ttbr0_enable() and + * uaccess_ttbr0_disable(). As `x` and `ptr` could contain blocking functions, + * we must evaluate these outside of the critical section. + */ #define __raw_get_user(x, ptr, err) \ do { \ + __typeof__(*(ptr)) __user *__rgu_ptr = (ptr); \ + __typeof__(x) __rgu_val; \ __chk_user_ptr(ptr); \ + uaccess_ttbr0_enable(); \ - __raw_get_mem("ldtr", x, ptr, err, U); \ + __raw_get_mem("ldtr", __rgu_val, __rgu_ptr, err, U); \ uaccess_ttbr0_disable(); \ + \ + (x) = __rgu_val; \ } while (0) #define __get_user_error(x, ptr, err) \ @@ -329,11 +339,19 @@ do { \ } \ } while (0) +/* + * We must not call into the scheduler between uaccess_ttbr0_enable() and + * uaccess_ttbr0_disable(). As `x` and `ptr` could contain blocking functions, + * we must evaluate these outside of the critical section. + */ #define __raw_put_user(x, ptr, err) \ do { \ - __chk_user_ptr(ptr); \ + __typeof__(*(ptr)) __user *__rpu_ptr = (ptr); \ + __typeof__(*(ptr)) __rpu_val = (x); \ + __chk_user_ptr(__rpu_ptr); \ + \ uaccess_ttbr0_enable(); \ - __raw_put_mem("sttr", x, ptr, err, U); \ + __raw_put_mem("sttr", __rpu_val, __rpu_ptr, err, U); \ uaccess_ttbr0_disable(); \ } while (0) -- 2.34.1

2 1

[PATCH OLK-6.6 v3 0/2] Rewrite smt interference account logic
by Pu Lehui 12 Jun '25

12 Jun '25

Tengda Wu (1): interference: Fix the compilation warning of sched_task_is_throttled() Xu Kuohai (1): interference: Rewrite smt interference account logic kernel/cgroup/ifs.c | 110 +++++++++++++++++++++++++++++-------------- kernel/sched/sched.h | 18 +++---- 2 files changed, 83 insertions(+), 45 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 v2 0/2] Rewrite smt interference account logic
by Pu Lehui 12 Jun '25

12 Jun '25

Tengda Wu (1): interference: Fix the compilation warning of sched_task_is_throttled() Xu Kuohai (1): interference: Rewrite smt interference account logic kernel/cgroup/ifs.c | 110 +++++++++++++++++++++++++++++-------------- kernel/sched/sched.h | 18 +++---- 2 files changed, 83 insertions(+), 45 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 v2 0/5] Soft domain improves and bugfixes
by Zhang Qiao 12 Jun '25

12 Jun '25

v2: - Add fixes tag v1: - Fix compilation error Zhang Qiao (5): sched: Add cmdline sched_soft_domain switch for soft domain feature sched: Rework cpu.soft_domain_nr_cpu sched: Fix soft domain group memleak sched: Consider task affinity in wake_soft_domain() sched: Fix might sleep in atomic section issue kernel/sched/core.c | 16 ++-- kernel/sched/fair.c | 63 +++++++-------- kernel/sched/sched.h | 17 +++- kernel/sched/soft_domain.c | 162 ++++++++++++++++++++++++++++++++----- 4 files changed, 199 insertions(+), 59 deletions(-) -- 2.18.0.huawei.25

2 6

[PATCH OLK-6.6 0/2] Rewrite smt interference account logic
by Pu Lehui 12 Jun '25

12 Jun '25

Tengda Wu (1): interference: Fix the compilation warning of sched_task_is_throttled() Xu Kuohai (1): interference: Rewrite smt interference account logic kernel/cgroup/ifs.c | 109 +++++++++++++++++++++++++++++-------------- kernel/sched/sched.h | 18 +++---- 2 files changed, 82 insertions(+), 45 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/4] Fix file content inconsistency issue and incorporate subsequent fix patches
by Li Lingfeng 12 Jun '25

12 Jun '25

Li Lingfeng (1): fs: add fsnotify_open in backing_file_open NeilBrown (3): NFS: add atomic_open for NFSv3 to handle O_TRUNC correctly. NFS: abort nfs_atomic_open_v23 if name is too long. vfs: generate FS_CREATE before FS_OPEN when ->atomic_open used. fs/backing-file.c | 3 +++ fs/namei.c | 10 ++++++-- fs/nfs/dir.c | 57 +++++++++++++++++++++++++++++++++++++++--- fs/nfs/nfs3proc.c | 1 + fs/nfs/proc.c | 1 + fs/open.c | 22 ++++++++++------ include/linux/nfs_fs.h | 3 +++ 7 files changed, 85 insertions(+), 12 deletions(-) -- 2.31.1

2 5

[PATCH OLK-5.10 00/36] OLK-5.10 Bperf
by Xiaomeng Zhang 12 Jun '25

12 Jun '25

Dmitrii Dolgov (1): perf stat: Separate bperf from bpf_profiler Ian Rogers (3): perf test bpf-counters: Add test for BPF event modifier perf docs: Document bpf event modifier perf build: Properly guard libbpf includes Namhyung Kim (12): bpf: Allow bpf_get_current_ancestor_cgroup_id for tracing perf core: Factor out __perf_sw_event_sched perf core: Add PERF_COUNT_SW_CGROUP_SWITCHES event perf tools: Add 'cgroup-switches' software event perf tools: Add read_cgroup_id() function perf tools: Add cgroup_is_v2() helper perf bpf_counter: Move common functions to bpf_counter.h perf stat: Enable BPF counter with --for-each-cgroup perf stat: Fix BPF program section name perf stat: Fix handling of unsupported cgroup events when using BPF counters perf stat: Fix error check for bpf_program__attach perf test shell stat_bpf_counters: Fix test on Intel Song Liu (13): bpftool: Add Makefile target bootstrap perf build: Support build BPF skeletons with perf perf stat: Enable counting events for BPF programs perf stat: Introduce 'bperf' to share hardware PMCs with BPF perf stat: Measure 't0' and 'ref_time' after enable_counters() perf util: Move bpf_perf definitions to a libperf header perf bpf: check perf_attr_map is compatible with the perf binary perf stat: Introduce config stat.bpf-counter-events perf stat: Introduce ':b' modifier perf stat: Introduce bpf_counter_ops->disable() perf bpf: Fix building perf with BUILD_BPF_SKEL=1 by default in more distros perf bpf_skel: Do not use typedef to avoid error on old clang perf test: Add a shell test for 'perf stat --bpf-counters' new option Tengda Wu (2): perf stat: Support inherit events during fork() for bperf perf test: Use sqrtloop workload to test bperf event Veronika Molnarova (1): perf test stat_bpf_counter.sh: Stabilize the test results Xiaomeng Zhang (2): perf stat: Increase perf_attr_map entries perf stat: Fix incorrect display of bperf when event count is 0 Yonghong Song (1): bpf: Add rcu_read_lock in bpf_get_current_[ancestor_]cgroup_id() helpers Yu Kuai (1): perf stat: Fix error return code in bperf__load() include/linux/perf_event.h | 40 +- include/uapi/linux/perf_event.h | 1 + kernel/bpf/helpers.c | 22 +- kernel/trace/bpf_trace.c | 2 + tools/bpf/bpftool/Makefile | 2 + tools/build/Makefile.feature | 4 +- tools/include/uapi/linux/perf_event.h | 1 + tools/lib/perf/include/perf/bpf_perf.h | 32 + tools/perf/Documentation/perf-list.txt | 1 + tools/perf/Documentation/perf-stat.txt | 31 + tools/perf/Makefile.config | 9 + tools/perf/Makefile.perf | 65 +- tools/perf/builtin-stat.c | 110 ++- tools/perf/builtin-trace.c | 2 + tools/perf/tests/shell/stat_bpf_counters.sh | 76 ++ tools/perf/util/Build | 2 + tools/perf/util/bpf_counter.c | 833 ++++++++++++++++++ tools/perf/util/bpf_counter.h | 137 +++ tools/perf/util/bpf_counter_cgroup.c | 299 +++++++ tools/perf/util/bpf_skel/.gitignore | 3 + tools/perf/util/bpf_skel/bperf_cgroup.bpf.c | 191 ++++ tools/perf/util/bpf_skel/bperf_follower.bpf.c | 162 ++++ tools/perf/util/bpf_skel/bperf_leader.bpf.c | 55 ++ tools/perf/util/bpf_skel/bperf_u.h | 19 + .../util/bpf_skel/bpf_prog_profiler.bpf.c | 93 ++ tools/perf/util/cgroup.c | 47 + tools/perf/util/cgroup.h | 13 + tools/perf/util/config.c | 4 + tools/perf/util/evlist.c | 4 + tools/perf/util/evsel.c | 27 + tools/perf/util/evsel.h | 37 + tools/perf/util/parse-events.c | 12 +- tools/perf/util/parse-events.l | 3 +- tools/perf/util/python.c | 27 + tools/perf/util/stat-display.c | 4 +- tools/perf/util/stat.c | 2 +- tools/perf/util/target.c | 34 +- tools/perf/util/target.h | 8 + tools/scripts/Makefile.include | 1 + 39 files changed, 2364 insertions(+), 51 deletions(-) create mode 100644 tools/lib/perf/include/perf/bpf_perf.h create mode 100755 tools/perf/tests/shell/stat_bpf_counters.sh create mode 100644 tools/perf/util/bpf_counter.c create mode 100644 tools/perf/util/bpf_counter.h create mode 100644 tools/perf/util/bpf_counter_cgroup.c create mode 100644 tools/perf/util/bpf_skel/.gitignore create mode 100644 tools/perf/util/bpf_skel/bperf_cgroup.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_follower.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_leader.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_u.h create mode 100644 tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c -- 2.34.1

2 37