- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 3075/3075] drivers/net/ethernet/wangxun/txgbe/txgbe.h:1292:20: error: 'adapter' undeclared
by kernel test robot 31 Oct '25

31 Oct '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 7f38ece6b510adaa28c8e625ff574fe6357a3960 commit: 2048b5b7f264f56a4d9e73079e790e13c8596aaf [3075/3075] net: wangxun: txgbe: add support for wangxun 10G/25G/40G config: x86_64-randconfig-102-20251031 (https://download.01.org/0day-ci/archive/20251031/202510311058.pwU944FY-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251031/202510311058.pwU944FY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510311058.pwU944FY-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_xsk.h:7, from drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:28: drivers/net/ethernet/wangxun/txgbe/txgbe.h: In function 'txgbe_misc_isb': drivers/net/ethernet/wangxun/txgbe/txgbe.h:987:13: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 987 | u32 cur_diff = 0; | ^~~~~~~~ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c: In function 'txgbe_tx_timeout': drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:582:14: warning: variable 'real_tx_hang' set but not used [-Wunused-but-set-variable] 582 | bool real_tx_hang = false; | ^~~~~~~~~~~~ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c: In function 'txgbe_do_lan_reset': drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:2618:28: warning: variable 'tx_ring' set but not used [-Wunused-but-set-variable] 2618 | struct txgbe_ring *tx_ring; | ^~~~~~~ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c: At top level: >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:6915:6: warning: no previous prototype for 'txgbe_irq_rearm_queues' [-Wmissing-prototypes] 6915 | void txgbe_irq_rearm_queues(struct txgbe_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_e56.h:8, from drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c:10: drivers/net/ethernet/wangxun/txgbe/txgbe.h: In function 'txgbe_misc_isb': drivers/net/ethernet/wangxun/txgbe/txgbe.h:987:13: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 987 | u32 cur_diff = 0; | ^~~~~~~~ drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c: In function 'txgbe_init_fdir_signature': drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c:6111:31: warning: unused variable 'adapter' [-Wunused-variable] 6111 | struct txgbe_adapter *adapter = (struct txgbe_adapter *)hw->back; | ^~~~~~~ In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_type.h:9, from drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c:6: drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c: In function 'txgbe_fdir_set_input_mask': >> drivers/net/ethernet/wangxun/txgbe/txgbe.h:1292:20: error: 'adapter' undeclared (first use in this function) 1292 | netif_info(adapter, msglvl, adapter->netdev, format, ## arg) | ^~~~~~~ include/linux/netdevice.h:4407:35: note: in definition of macro 'netif_msg_drv' 4407 | #define netif_msg_drv(p) ((p)->msg_enable & NETIF_MSG_DRV) | ^ include/net/net_debug.h:109:9: note: in expansion of macro 'netif_level' 109 | netif_level(info, priv, type, dev, fmt, ##args) | ^~~~~~~~~~~ drivers/net/ethernet/wangxun/txgbe/txgbe.h:1292:9: note: in expansion of macro 'netif_info' 1292 | netif_info(adapter, msglvl, adapter->netdev, format, ## arg) | ^~~~~~~~~~ drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c:6450:17: note: in expansion of macro 'e_info' 6450 | e_info(drv, " bucket hash should always be 0 in mask\n"); | ^~~~~~ drivers/net/ethernet/wangxun/txgbe/txgbe.h:1292:20: note: each undeclared identifier is reported only once for each function it appears in 1292 | netif_info(adapter, msglvl, adapter->netdev, format, ## arg) | ^~~~~~~ include/linux/netdevice.h:4407:35: note: in definition of macro 'netif_msg_drv' 4407 | #define netif_msg_drv(p) ((p)->msg_enable & NETIF_MSG_DRV) | ^ include/net/net_debug.h:109:9: note: in expansion of macro 'netif_level' 109 | netif_level(info, priv, type, dev, fmt, ##args) | ^~~~~~~~~~~ drivers/net/ethernet/wangxun/txgbe/txgbe.h:1292:9: note: in expansion of macro 'netif_info' 1292 | netif_info(adapter, msglvl, adapter->netdev, format, ## arg) | ^~~~~~~~~~ drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c:6450:17: note: in expansion of macro 'e_info' 6450 | e_info(drv, " bucket hash should always be 0 in mask\n"); | ^~~~~~ drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c: In function 'txgbe_hic_get_lldp': drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c:7554:13: warning: variable 'status' set but not used [-Wunused-but-set-variable] 7554 | int status; | ^~~~~~ drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c: In function 'txgbe_hic_notify_led_active': drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c:7687:13: warning: variable 'status' set but not used [-Wunused-but-set-variable] 7687 | int status; | ^~~~~~ -- In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_sriov.c:15: drivers/net/ethernet/wangxun/txgbe/txgbe.h: In function 'txgbe_misc_isb': drivers/net/ethernet/wangxun/txgbe/txgbe.h:987:13: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 987 | u32 cur_diff = 0; | ^~~~~~~~ drivers/net/ethernet/wangxun/txgbe/txgbe_sriov.c: In function 'txgbe_set_vf_vlan_msg': >> drivers/net/ethernet/wangxun/txgbe/txgbe_sriov.c:865:25: error: label 'out' used but not defined 865 | goto out; | ^~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PTP_1588_CLOCK Depends on [n]: NET [=y] && POSIX_TIMERS [=n] Selected by [m]: - SXE [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] - SXE_VF [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] vim +/adapter +1292 drivers/net/ethernet/wangxun/txgbe/txgbe.h 1276 1277 #define hw_dbg(hw, format, arg...) \ 1278 netdev_dbg(txgbe_hw_to_netdev(hw), format, ## arg) 1279 #define hw_err(hw, format, arg...) \ 1280 netdev_err(txgbe_hw_to_netdev(hw), format, ## arg) 1281 #define e_dev_info(format, arg...) \ 1282 dev_info(pci_dev_to_dev(adapter->pdev), format, ## arg) 1283 #define e_dev_warn(format, arg...) \ 1284 dev_warn(pci_dev_to_dev(adapter->pdev), format, ## arg) 1285 #define e_dev_err(format, arg...) \ 1286 dev_err(pci_dev_to_dev(adapter->pdev), format, ## arg) 1287 #define e_dev_notice(format, arg...) \ 1288 dev_notice(pci_dev_to_dev(adapter->pdev), format, ## arg) 1289 #define e_dbg(msglvl, format, arg...) \ 1290 netif_dbg(adapter, msglvl, adapter->netdev, format, ## arg) 1291 #define e_info(msglvl, format, arg...) \ > 1292 netif_info(adapter, msglvl, adapter->netdev, format, ## arg) 1293 #define e_err(msglvl, format, arg...) \ 1294 netif_err(adapter, msglvl, adapter->netdev, format, ## arg) 1295 #define e_warn(msglvl, format, arg...) \ 1296 netif_warn(adapter, msglvl, adapter->netdev, format, ## arg) 1297 #define e_crit(msglvl, format, arg...) \ 1298 netif_crit(adapter, msglvl, adapter->netdev, format, ## arg) 1299 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] PCI/sysfs: Prohibit unaligned access to I/O port on non-x86
by Ziming Du 31 Oct '25

31 Oct '25

From: Yongqiang Liu <liuyongqiang13(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID4844 -------------------------------- Unaligned access is harmful for non-x86 archs such as arm64. When we use pwrite or pread to access the I/O port resources with unaligned offset, system will crash as follows: Unable to handle kernel paging request at virtual address fffffbfffe8010c1 Internal error: Oops: 0000000096000061 [#1] SMP Modules linked in: CPU: 1 PID: 44230 Comm: syz.1.10955 Not tainted 6.6.0+ #1 Hardware name: linux,dummy-virt (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __raw_writew arch/arm64/include/asm/io.h:33 [inline] pc : _outw include/asm-generic/io.h:594 [inline] pc : logic_outw+0x54/0x218 lib/logic_pio.c:305 lr : _outw include/asm-generic/io.h:593 [inline] lr : logic_outw+0x40/0x218 lib/logic_pio.c:305 sp : ffff800083097a30 x29: ffff800083097a30 x28: ffffba71ba86e130 x27: 1ffff00010612f93 x26: ffff3bae63b3a420 x25: ffffba71bbf585d0 x24: 0000000000005ac1 x23: 00000000000010c1 x22: ffff3baf0deb6488 x21: 0000000000000002 x20: 00000000000010c1 x19: 0000000000ffbffe x18: 0000000000000000 x17: 0000000000000000 x16: ffffba71b9f44b48 x15: 00000000200002c0 x14: 0000000000000000 x13: 0000000000000000 x12: ffff6775ca80451f x11: 1fffe775ca80451e x10: ffff6775ca80451e x9 : ffffba71bb78cf2c x8 : 0000988a357fbae2 x7 : ffff3bae540228f7 x6 : 0000000000000001 x5 : 1fffe775e2b43c78 x4 : dfff800000000000 x3 : ffffba71b9a00000 x2 : ffff80008d22a000 x1 : ffffc58ec6600000 x0 : fffffbfffe8010c1 Call trace: _outw include/asm-generic/io.h:594 [inline] logic_outw+0x54/0x218 lib/logic_pio.c:305 pci_resource_io drivers/pci/pci-sysfs.c:1157 [inline] pci_write_resource_io drivers/pci/pci-sysfs.c:1191 [inline] pci_write_resource_io+0x208/0x260 drivers/pci/pci-sysfs.c:1181 sysfs_kf_bin_write+0x188/0x210 fs/sysfs/file.c:158 kernfs_fop_write_iter+0x2e8/0x4b0 fs/kernfs/file.c:338 call_write_iter include/linux/fs.h:2085 [inline] new_sync_write fs/read_write.c:493 [inline] vfs_write+0x7bc/0xac8 fs/read_write.c:586 ksys_write+0x12c/0x270 fs/read_write.c:639 __do_sys_write fs/read_write.c:651 [inline] __se_sys_write fs/read_write.c:648 [inline] __arm64_sys_write+0x78/0xb8 fs/read_write.c:648 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x8c/0x2e0 arch/arm64/kernel/syscall.c:51 el0_svc_common.constprop.0+0x200/0x2a8 arch/arm64/kernel/syscall.c:134 do_el0_svc+0x4c/0x70 arch/arm64/kernel/syscall.c:176 el0_svc+0x44/0x1d8 arch/arm64/kernel/entry-common.c:806 el0t_64_sync_handler+0x100/0x130 arch/arm64/kernel/entry-common.c:844 el0t_64_sync+0x3c8/0x3d0 arch/arm64/kernel/entry.S:757 Powerpc seems affected as well, so prohibit the unaligned access on non-x86 archs. Fixes: 8633328be242 ("PCI: Allow read/write access to sysfs I/O port resources") Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/pci/pci-sysfs.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c index 48c56cb086524..e8c3a1b7d4a93 100644 --- a/drivers/pci/pci-sysfs.c +++ b/drivers/pci/pci-sysfs.c @@ -1204,6 +1204,13 @@ static int pci_mmap_resource_wc(struct file *filp, struct kobject *kobj, return pci_mmap_resource(kobj, attr, vma, 1); } +#if !defined(CONFIG_X86) +static bool is_unaligned(unsigned long port, size_t size) +{ + return port & (size - 1); +} +#endif + static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj, struct bin_attribute *attr, char *buf, loff_t off, size_t count, bool write) @@ -1220,6 +1227,11 @@ static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj, if (port + count - 1 > pci_resource_end(pdev, bar)) return -EINVAL; +#if !defined(CONFIG_X86) + if (is_unaligned(port, count)) + return -EFAULT; +#endif + switch (count) { case 1: if (write) -- 2.43.0

2 1

[PATCH v2 OLK-5.10] net/oenetcls: Balancing softirq to improve performance
by Yue Haibing 31 Oct '25

31 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICBFCS -------------------------------- Add numa affinity RPS to balance softirq, this fix high load performance regression. Fixes: d60758b0ffcd ("net/oenetcls: introduce oenetcls for network optimization") Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- include/linux/oenetcls.h | 32 ++++++++++++---- net/core/dev.c | 19 ++++++++- net/oenetcls/oenetcls_flow.c | 70 +++++++++++++++++++++++++++------- net/oenetcls/oenetcls_main.c | 11 ++++-- net/oenetcls/oenetcls_ntuple.c | 2 +- 5 files changed, 108 insertions(+), 26 deletions(-) diff --git a/include/linux/oenetcls.h b/include/linux/oenetcls.h index 29c0db40971f..09f89131f32b 100644 --- a/include/linux/oenetcls.h +++ b/include/linux/oenetcls.h @@ -5,12 +5,14 @@ struct oecls_hook_ops { void (*oecls_cfg_rxcls)(struct sock *sk, int is_del); void (*oecls_flow_update)(struct sock *sk); - void (*oecls_set_cpu)(struct sk_buff *skb); + void (*oecls_set_cpu)(struct sk_buff *skb, int *cpu, int *last_qtail); bool (*oecls_timeout)(struct net_device *dev, u16 rxq_index, u32 flow_id, u16 filter_id); }; +typedef int (*enqueue_f)(struct sk_buff *skb, int cpu, unsigned int *qtail); extern const struct oecls_hook_ops __rcu *oecls_ops; +extern struct static_key_false oecls_rps_needed; static inline void oenetcls_cfg_rxcls(struct sock *sk, int is_del) { @@ -34,27 +36,43 @@ static inline void oenetcls_flow_update(struct sock *sk) rcu_read_unlock(); } -static inline void oenetcls_skb_set_cpu(struct sk_buff *skb) +static inline bool +oenetcls_skb_set_cpu(struct sk_buff *skb, enqueue_f enq_func, int *ret) { const struct oecls_hook_ops *ops; + int cpu, last_qtail; + bool result = false; rcu_read_lock(); ops = rcu_dereference(oecls_ops); - if (ops && ops->oecls_set_cpu) - ops->oecls_set_cpu(skb); + if (ops && ops->oecls_set_cpu) { + ops->oecls_set_cpu(skb, &cpu, &last_qtail); + if (cpu >= 0) { + *ret = enq_func(skb, cpu, &last_qtail); + result = true; + } + } rcu_read_unlock(); + return result; } -static inline void oenetcls_skblist_set_cpu(struct list_head *head) +static inline void +oenetcls_skblist_set_cpu(struct list_head *head, enqueue_f enq_func) { const struct oecls_hook_ops *ops; struct sk_buff *skb, *next; + int cpu, last_qtail; rcu_read_lock(); ops = rcu_dereference(oecls_ops); if (ops && ops->oecls_set_cpu) { - list_for_each_entry_safe(skb, next, head, list) - ops->oecls_set_cpu(skb); + list_for_each_entry_safe(skb, next, head, list) { + ops->oecls_set_cpu(skb, &cpu, &last_qtail); + if (cpu >= 0) { + skb_list_del_init(skb); + enq_func(skb, cpu, &last_qtail); + } + } } rcu_read_unlock(); } diff --git a/net/core/dev.c b/net/core/dev.c index 05477c431afd..df6c0ac02a5e 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -154,6 +154,8 @@ #include <linux/oenetcls.h> const struct oecls_hook_ops __rcu *oecls_ops __read_mostly; EXPORT_SYMBOL_GPL(oecls_ops); +struct static_key_false oecls_rps_needed __read_mostly; +EXPORT_SYMBOL(oecls_rps_needed); #endif #define MAX_GRO_SKBS 8 @@ -5889,6 +5891,10 @@ static int netif_receive_skb_internal(struct sk_buff *skb) rcu_read_lock(); #ifdef CONFIG_RPS +#if IS_ENABLED(CONFIG_OENETCLS) + if (static_branch_unlikely(&oecls_rps_needed)) + goto oecls_rps; +#endif if (static_branch_unlikely(&rps_needed)) { struct rps_dev_flow voidflow, *rflow = &voidflow; int cpu = get_rps_cpu(skb->dev, skb, &rflow); @@ -5902,7 +5908,11 @@ static int netif_receive_skb_internal(struct sk_buff *skb) #endif #if IS_ENABLED(CONFIG_OENETCLS) - oenetcls_skb_set_cpu(skb); +oecls_rps: + if (oenetcls_skb_set_cpu(skb, enqueue_to_backlog, &ret)) { + rcu_read_unlock(); + return ret; + } #endif ret = __netif_receive_skb(skb); @@ -5926,6 +5936,10 @@ static void netif_receive_skb_list_internal(struct list_head *head) rcu_read_lock(); #ifdef CONFIG_RPS +#if IS_ENABLED(CONFIG_OENETCLS) + if (static_branch_unlikely(&oecls_rps_needed)) + goto oecls_rps_list; +#endif if (static_branch_unlikely(&rps_needed)) { list_for_each_entry_safe(skb, next, head, list) { struct rps_dev_flow voidflow, *rflow = &voidflow; @@ -5941,7 +5955,8 @@ static void netif_receive_skb_list_internal(struct list_head *head) #endif #if IS_ENABLED(CONFIG_OENETCLS) - oenetcls_skblist_set_cpu(head); +oecls_rps_list: + oenetcls_skblist_set_cpu(head, enqueue_to_backlog); #endif __netif_receive_skb_list(head); diff --git a/net/oenetcls/oenetcls_flow.c b/net/oenetcls/oenetcls_flow.c index 8d9fdb343d28..62bad2408966 100644 --- a/net/oenetcls/oenetcls_flow.c +++ b/net/oenetcls/oenetcls_flow.c @@ -133,8 +133,7 @@ static void set_oecls_cpu(struct net_device *dev, struct sk_buff *skb, struct oecls_dev_flow_table *dtb; struct oecls_dev_flow *rflow; u32 flow_id, hash; - u16 rxq_index; - int rc; + int rxq_index, rc; if (!skb_rx_queue_recorded(skb) || !dev->rx_cpu_rmap || !(dev->features & NETIF_F_NTUPLE)) @@ -152,7 +151,8 @@ static void set_oecls_cpu(struct net_device *dev, struct sk_buff *skb, hash = skb_get_hash(skb); flow_id = hash & dtb->mask; rflow = &dtb->flows[flow_id]; - if (rflow->isvalid && rflow->cpu == next_cpu) { + //Return if someone has configured this. + if (rflow->isvalid && cpu_to_node(rflow->cpu) == cpu_to_node(next_cpu)) { rflow->timeout = jiffies; return; } @@ -171,15 +171,41 @@ static void set_oecls_cpu(struct net_device *dev, struct sk_buff *skb, rflow->cpu = next_cpu; } +static int get_cpu_in_mask(int tcpu, u32 hash) +{ + const struct cpumask *mask; + int nr_cpus, cpu, index; + + mask = cpumask_of_node(cpu_to_node(tcpu)); + + nr_cpus = cpumask_weight(mask); + if (nr_cpus == 0) + return -1; + + index = reciprocal_scale(hash, nr_cpus); + if (index < 0) + return -1; + + cpu = cpumask_first(mask); + while (--nr_cpus > 0) { + if (index == 0) + break; + cpu = cpumask_next(cpu, mask); + index--; + } + + return cpu; +} + static void __oecls_set_cpu(struct sk_buff *skb, struct net_device *ndev, struct oecls_sock_flow_table *tb, struct oecls_dev_flow_table *dtb, - int old_rxq_id) + int old_rxq_id, int *rcpu, int *last_qtail) { + u32 last_recv_cpu, hash, val, cpu, tcpu; struct oecls_dev_flow *rflow; - u32 last_recv_cpu, hash, val; - u32 tcpu = 0; - u32 cpu = raw_smp_processor_id(); + int newcpu; + cpu = raw_smp_processor_id(); skb_reset_network_header(skb); hash = skb_get_hash(skb); if (!hash) @@ -193,14 +219,20 @@ static void __oecls_set_cpu(struct sk_buff *skb, struct net_device *ndev, if ((val ^ hash) & ~oecls_cpu_mask) return; - if (cpu_to_node(cpu) == cpu_to_node(last_recv_cpu)) + newcpu = get_cpu_in_mask(last_recv_cpu, hash); + if (newcpu >= 0) + *rcpu = newcpu; + else + newcpu = last_recv_cpu; + + if (cpu_to_node(cpu) == cpu_to_node(newcpu)) return; if (tcpu >= nr_cpu_ids) - set_oecls_cpu(ndev, skb, rflow, old_rxq_id, last_recv_cpu); + set_oecls_cpu(ndev, skb, rflow, old_rxq_id, newcpu); } -static void _oecls_set_cpu(struct sk_buff *skb) +static void _oecls_set_cpu(struct sk_buff *skb, int *cpu, int *last_qtail) { struct net_device *ndev = skb->dev; struct oecls_sock_flow_table *stb; @@ -208,6 +240,8 @@ static void _oecls_set_cpu(struct sk_buff *skb) struct netdev_rx_queue *rxqueue; int rxq_id = -1; + *cpu = -1; + last_qtail = 0;//unused if (!ndev) return; @@ -233,7 +267,7 @@ static void _oecls_set_cpu(struct sk_buff *skb) stb = rcu_dereference(oecls_sock_flow_table); dtb = rcu_dereference(rxqueue->oecls_ftb); if (stb && dtb) - __oecls_set_cpu(skb, ndev, stb, dtb, rxq_id); + __oecls_set_cpu(skb, ndev, stb, dtb, rxq_id, cpu, last_qtail); rcu_read_unlock(); } @@ -245,13 +279,13 @@ static void oecls_dev_flow_table_free(struct rcu_head *rcu) vfree(table); } -static void oecls_dev_flow_table_cleanup(struct net_device *netdev, int qid) +static void oecls_dev_flow_table_cleanup(struct net_device *netdev, int queues) { struct oecls_dev_flow_table *dtb; struct netdev_rx_queue *queue; int i; - for (i = 0; i < qid; i++) { + for (i = 0; i < queues; i++) { queue = netdev->_rx + i; spin_lock(&oecls_dev_flow_lock); dtb = rcu_dereference_protected(queue->oecls_ftb, @@ -407,11 +441,21 @@ int oecls_flow_res_init(void) RCU_INIT_POINTER(oecls_ops, &oecls_flow_ops); synchronize_rcu(); + +#ifdef CONFIG_RPS + static_branch_inc(&oecls_rps_needed); + oecls_debug("oecls_rps_needed true\n"); +#endif + return 0; } void oecls_flow_res_clean(void) { +#ifdef CONFIG_RPS + static_branch_dec(&oecls_rps_needed); + oecls_debug("oecls_rps_needed false\n"); +#endif rcu_assign_pointer(oecls_ops, NULL); synchronize_rcu(); diff --git a/net/oenetcls/oenetcls_main.c b/net/oenetcls/oenetcls_main.c index e5920351aada..ec37e38d7f48 100644 --- a/net/oenetcls/oenetcls_main.c +++ b/net/oenetcls/oenetcls_main.c @@ -23,11 +23,11 @@ static int mode; module_param(mode, int, 0444); MODULE_PARM_DESC(mode, "mode, default 0"); -static char ifname[64] = { 0 }; +static char ifname[128] = { 0 }; module_param_string(ifname, ifname, sizeof(ifname), 0444); MODULE_PARM_DESC(ifname, "ifname"); -static char appname[64] = "redis-server"; +static char appname[256] = "redis-server"; module_param_string(appname, appname, sizeof(appname), 0644); MODULE_PARM_DESC(appname, "appname, default redis-server"); @@ -43,6 +43,10 @@ static int check_cap = 1; module_param(check_cap, int, 0444); MODULE_PARM_DESC(check_cap, "check_cap, default 1"); +static char irqname[64] = "comp"; +module_param_string(irqname, irqname, sizeof(irqname), 0644); +MODULE_PARM_DESC(irqname, "nic irq name string, default comp"); + static bool check_params(void) { if (mode != 0 && mode != 1) @@ -371,7 +375,8 @@ static struct oecls_netdev_info *alloc_oecls_netdev_info(void) static bool check_irq_name(const char *irq_name, struct oecls_netdev_info *oecls_dev) { - if (!strstr(irq_name, "TxRx") && !strstr(irq_name, "comp") && !strstr(irq_name, "rx")) + if (!strstr(irq_name, "TxRx") && !strstr(irq_name, "comp") && !strstr(irq_name, "rx") && + strlen(irqname) > 0 && !strstr(irq_name, irqname)) return false; if (strstr(irq_name, oecls_dev->dev_name)) diff --git a/net/oenetcls/oenetcls_ntuple.c b/net/oenetcls/oenetcls_ntuple.c index 5bb1b1916a4c..888dc5b5005b 100644 --- a/net/oenetcls/oenetcls_ntuple.c +++ b/net/oenetcls/oenetcls_ntuple.c @@ -59,7 +59,7 @@ static void add_sk_rule(int devid, u32 dip4, u16 dport, void *sk, int action, in hlist_add_head(&entry->node, sk_hlist); return; out: - oecls_debug("alloc failed rule:%p entry:%p\n", rule, entry); + oecls_debug("alloc rule failed\n"); free_to_l0(entry); free_to_l0(rule); } -- 2.34.1

2 1

[PATCH OLK-5.10] tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
by Tengda Wu 31 Oct '25

31 Oct '25

From: Yuan Chen <chenyuan(a)kylinos.cn> mainline inclusion from mainline-v6.18-rc1 commit 9cf9aa7b0acfde7545c1a1d912576e9bab28dc6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WIW CVE: CVE-2025-40042 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a critical race condition in kprobe initialization that can lead to NULL pointer dereference and kernel crash. [1135630.084782] Unable to handle kernel paging request at virtual address 0000710a04630000 ... [1135630.260314] pstate: 404003c9 (nZcv DAIF +PAN -UAO) [1135630.269239] pc : kprobe_perf_func+0x30/0x260 [1135630.277643] lr : kprobe_dispatcher+0x44/0x60 [1135630.286041] sp : ffffaeff4977fa40 [1135630.293441] x29: ffffaeff4977fa40 x28: ffffaf015340e400 [1135630.302837] x27: 0000000000000000 x26: 0000000000000000 [1135630.312257] x25: ffffaf029ed108a8 x24: ffffaf015340e528 [1135630.321705] x23: ffffaeff4977fc50 x22: ffffaeff4977fc50 [1135630.331154] x21: 0000000000000000 x20: ffffaeff4977fc50 [1135630.340586] x19: ffffaf015340e400 x18: 0000000000000000 [1135630.349985] x17: 0000000000000000 x16: 0000000000000000 [1135630.359285] x15: 0000000000000000 x14: 0000000000000000 [1135630.368445] x13: 0000000000000000 x12: 0000000000000000 [1135630.377473] x11: 0000000000000000 x10: 0000000000000000 [1135630.386411] x9 : 0000000000000000 x8 : 0000000000000000 [1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000 [1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000 [1135630.412545] x3 : 0000710a04630000 x2 : 0000000000000006 [1135630.421021] x1 : ffffaeff4977fc50 x0 : 0000710a04630000 [1135630.429410] Call trace: [1135630.434828] kprobe_perf_func+0x30/0x260 [1135630.441661] kprobe_dispatcher+0x44/0x60 [1135630.448396] aggr_pre_handler+0x70/0xc8 [1135630.454959] kprobe_breakpoint_handler+0x140/0x1e0 [1135630.462435] brk_handler+0xbc/0xd8 [1135630.468437] do_debug_exception+0x84/0x138 [1135630.475074] el1_dbg+0x18/0x8c [1135630.480582] security_file_permission+0x0/0xd0 [1135630.487426] vfs_write+0x70/0x1c0 [1135630.493059] ksys_write+0x5c/0xc8 [1135630.498638] __arm64_sys_write+0x24/0x30 [1135630.504821] el0_svc_common+0x78/0x130 [1135630.510838] el0_svc_handler+0x38/0x78 [1135630.516834] el0_svc+0x8/0x1b0 kernel/trace/trace_kprobe.c: 1308 0xffff3df8995039ec <kprobe_perf_func+0x2c>: ldr x21, [x24,#120] include/linux/compiler.h: 294 0xffff3df8995039f0 <kprobe_perf_func+0x30>: ldr x1, [x21,x0] kernel/trace/trace_kprobe.c 1308: head = this_cpu_ptr(call->perf_events); 1309: if (hlist_empty(head)) 1310: return 0; crash> struct trace_event_call -o struct trace_event_call { ... [120] struct hlist_head *perf_events; //(call->perf_event) ... } crash> struct trace_event_call ffffaf015340e528 struct trace_event_call { ... perf_events = 0xffff0ad5fa89f088, //this value is correct, but x21 = 0 ... } Race Condition Analysis: The race occurs between kprobe activation and perf_events initialization: CPU0 CPU1 ==== ==== perf_kprobe_init perf_trace_event_init tp_event->perf_events = list;(1) tp_event->class->reg (2)← KPROBE ACTIVE Debug exception triggers ... kprobe_dispatcher kprobe_perf_func (tk->tp.flags & TP_FLAG_PROFILE) head = this_cpu_ptr(call->perf_events)(3) (perf_events is still NULL) Problem: 1. CPU0 executes (1) assigning tp_event->perf_events = list 2. CPU0 executes (2) enabling kprobe functionality via class->reg() 3. CPU1 triggers and reaches kprobe_dispatcher 4. CPU1 checks TP_FLAG_PROFILE - condition passes (step 2 completed) 5. CPU1 calls kprobe_perf_func() and crashes at (3) because call->perf_events is still NULL CPU1 sees that kprobe functionality is enabled but does not see that perf_events has been assigned. Add pairing read and write memory barriers to guarantee that if CPU1 sees that kprobe functionality is enabled, it must also see that perf_events has been assigned. Link: https://lore.kernel.org/all/20251001022025.44626-1-chenyuan_fl@163.com/ Fixes: 50d780560785 ("tracing/kprobes: Add probe handler dispatcher to support perf and ftrace concurrent use") Cc: stable(a)vger.kernel.org Signed-off-by: Yuan Chen <chenyuan(a)kylinos.cn> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Conflicts: kernel/trace/trace_fprobe.c kernel/trace/trace_kprobe.c kernel/trace/trace_uprobe.c [The fprobe feature has not been integrated into this version; the kprobe and uprobe merge conflicts are caused by contextual issues.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_kprobe.c | 11 +++++++---- kernel/trace/trace_probe.h | 9 +++++++-- kernel/trace/trace_uprobe.c | 12 ++++++++---- 3 files changed, 22 insertions(+), 10 deletions(-) diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c index 557f92bcc7ff..752713d02c31 100644 --- a/kernel/trace/trace_kprobe.c +++ b/kernel/trace/trace_kprobe.c @@ -1679,14 +1679,15 @@ static int kprobe_register(struct trace_event_call *event, static int kprobe_dispatcher(struct kprobe *kp, struct pt_regs *regs) { struct trace_kprobe *tk = container_of(kp, struct trace_kprobe, rp.kp); + unsigned int flags = trace_probe_load_flag(&tk->tp); int ret = 0; raw_cpu_inc(*tk->nhit); - if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE)) + if (flags & TP_FLAG_TRACE) kprobe_trace_func(tk, regs); #ifdef CONFIG_PERF_EVENTS - if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE)) + if (flags & TP_FLAG_PROFILE) ret = kprobe_perf_func(tk, regs); #endif return ret; @@ -1697,13 +1698,15 @@ static int kretprobe_dispatcher(struct kretprobe_instance *ri, struct pt_regs *regs) { struct trace_kprobe *tk = container_of(ri->rp, struct trace_kprobe, rp); + unsigned int flags; raw_cpu_inc(*tk->nhit); - if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE)) + flags = trace_probe_load_flag(&tk->tp); + if (flags & TP_FLAG_TRACE) kretprobe_trace_func(tk, ri, regs); #ifdef CONFIG_PERF_EVENTS - if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE)) + if (flags & TP_FLAG_PROFILE) kretprobe_perf_func(tk, ri, regs); #endif return 0; /* We don't tweek kernel, so just return 0 */ diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h index cc27f25ce77e..716cefa9f41d 100644 --- a/kernel/trace/trace_probe.h +++ b/kernel/trace/trace_probe.h @@ -252,16 +252,21 @@ struct event_file_link { struct list_head list; }; +static inline unsigned int trace_probe_load_flag(struct trace_probe *tp) +{ + return smp_load_acquire(&tp->event->flags); +} + static inline bool trace_probe_test_flag(struct trace_probe *tp, unsigned int flag) { - return !!(tp->event->flags & flag); + return !!(trace_probe_load_flag(tp) & flag); } static inline void trace_probe_set_flag(struct trace_probe *tp, unsigned int flag) { - tp->event->flags |= flag; + smp_store_release(&tp->event->flags, tp->event->flags | flag); } static inline void trace_probe_clear_flag(struct trace_probe *tp, diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c index 8a4e6e782d22..d4d8fd3cd6d5 100644 --- a/kernel/trace/trace_uprobe.c +++ b/kernel/trace/trace_uprobe.c @@ -1482,6 +1482,7 @@ static int uprobe_dispatcher(struct uprobe_consumer *con, struct pt_regs *regs) struct uprobe_dispatch_data udd; struct uprobe_cpu_buffer *ucb; int dsize, esize; + unsigned int flags; int ret = 0; @@ -1506,11 +1507,12 @@ static int uprobe_dispatcher(struct uprobe_consumer *con, struct pt_regs *regs) store_trace_args(ucb->buf, &tu->tp, regs, esize, dsize); - if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE)) + flags = trace_probe_load_flag(&tu->tp); + if (flags & TP_FLAG_TRACE) ret |= uprobe_trace_func(tu, regs, ucb, dsize); #ifdef CONFIG_PERF_EVENTS - if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE)) + if (flags & TP_FLAG_PROFILE) ret |= uprobe_perf_func(tu, regs, ucb, dsize); #endif uprobe_buffer_put(ucb); @@ -1524,6 +1526,7 @@ static int uretprobe_dispatcher(struct uprobe_consumer *con, struct uprobe_dispatch_data udd; struct uprobe_cpu_buffer *ucb; int dsize, esize; + unsigned int flags; tu = container_of(con, struct trace_uprobe, consumer); @@ -1545,11 +1548,12 @@ static int uretprobe_dispatcher(struct uprobe_consumer *con, store_trace_args(ucb->buf, &tu->tp, regs, esize, dsize); - if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE)) + flags = trace_probe_load_flag(&tu->tp); + if (flags & TP_FLAG_TRACE) uretprobe_trace_func(tu, func, regs, ucb, dsize); #ifdef CONFIG_PERF_EVENTS - if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE)) + if (flags & TP_FLAG_PROFILE) uretprobe_perf_func(tu, func, regs, ucb, dsize); #endif uprobe_buffer_put(ucb); -- 2.34.1

2 1

[openeuler:OLK-6.6 3064/3064] mm/page_alloc.c:699 __del_page_from_free_list() warn: inconsistent indenting
by kernel test robot 31 Oct '25

31 Oct '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 7f38ece6b510adaa28c8e625ff574fe6357a3960 commit: 10f78461ef205a15e190d1474673dfa9add58723 [3064/3064] mm: page_alloc: consolidate free page accounting config: arm64-randconfig-r073-20251029 (https://download.01.org/0day-ci/archive/20251031/202510310815.0k5TUFKn-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.3.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510310815.0k5TUFKn-lkp@intel.com/ smatch warnings: mm/page_alloc.c:699 __del_page_from_free_list() warn: inconsistent indenting vim +699 mm/page_alloc.c 6ab0136310961e Alexander Duyck 2020-04-06 690 10f78461ef205a Johannes Weiner 2024-03-20 691 static inline void __del_page_from_free_list(struct page *page, struct zone *zone, 10f78461ef205a Johannes Weiner 2024-03-20 692 unsigned int order, int migratetype) 6ab0136310961e Alexander Duyck 2020-04-06 693 { 10f78461ef205a Johannes Weiner 2024-03-20 694 VM_WARN_ONCE(get_pageblock_migratetype(page) != migratetype, 10f78461ef205a Johannes Weiner 2024-03-20 695 "page type is %lu, passed migratetype is %d (nr=%d)\n", 10f78461ef205a Johannes Weiner 2024-03-20 696 get_pageblock_migratetype(page), migratetype, 1 << order); 10f78461ef205a Johannes Weiner 2024-03-20 697 36e66c554b5c6a Alexander Duyck 2020-04-06 698 /* clear reported state and update reported page count */ 36e66c554b5c6a Alexander Duyck 2020-04-06 @699 if (page_reported(page)) 36e66c554b5c6a Alexander Duyck 2020-04-06 700 __ClearPageReported(page); 36e66c554b5c6a Alexander Duyck 2020-04-06 701 bf75f200569dd0 Mel Gorman 2022-06-24 702 list_del(&page->buddy_list); 6ab0136310961e Alexander Duyck 2020-04-06 703 __ClearPageBuddy(page); 6ab0136310961e Alexander Duyck 2020-04-06 704 set_page_private(page, 0); 6ab0136310961e Alexander Duyck 2020-04-06 705 zone->free_area[order].nr_free--; 6ab0136310961e Alexander Duyck 2020-04-06 706 } 6ab0136310961e Alexander Duyck 2020-04-06 707 :::::: The code at line 699 was first introduced by commit :::::: 36e66c554b5c6a9d17a229faca7a61693527b0bd mm: introduce Reported pages :::::: TO: Alexander Duyck <alexander.h.duyck(a)linux.intel.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1900/1900] drivers/gpu/drm/phytium/phytium_fbdev.c:96:26: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 31 Oct '25

31 Oct '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c91cc1d257ea2f599d7cb6d2ec1fb76bacf12c2b commit: cad0702e5286d3cc80afe545de027858b855dd5a [1900/1900] DRM: Phytium display DRM driver config: arm64-randconfig-r132-20251030 (https://download.01.org/0day-ci/archive/20251031/202510310559.tj36zOcl-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251031/202510310559.tj36zOcl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510310559.tj36zOcl-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/gpu/drm/phytium/phytium_fbdev.c:96:26: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected char [noderef] <asn:2> *screen_base @@ got void * @@ drivers/gpu/drm/phytium/phytium_fbdev.c:96:26: sparse: expected char [noderef] <asn:2> *screen_base drivers/gpu/drm/phytium/phytium_fbdev.c:96:26: sparse: got void * drivers/gpu/drm/phytium/phytium_fbdev.c:113:5: warning: no previous prototype for 'phytium_drm_fbdev_init' [-Wmissing-prototypes] 113 | int phytium_drm_fbdev_init(struct drm_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_fbdev.c:144:6: warning: no previous prototype for 'phytium_drm_fbdev_fini' [-Wmissing-prototypes] 144 | void phytium_drm_fbdev_fini(struct drm_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/gpu/drm/phytium/x100_dp.c:852:6: sparse: sparse: symbol 'x100_dp_hw_spread_is_enable' was not declared. Should it be static? >> drivers/gpu/drm/phytium/x100_dp.c:864:5: sparse: sparse: symbol 'x100_dp_hw_reset' was not declared. Should it be static? >> drivers/gpu/drm/phytium/x100_dp.c:897:9: sparse: sparse: symbol 'x100_dp_hw_get_source_lane_count' was not declared. Should it be static? drivers/gpu/drm/phytium/x100_dp.c:852:6: warning: no previous prototype for 'x100_dp_hw_spread_is_enable' [-Wmissing-prototypes] 852 | bool x100_dp_hw_spread_is_enable(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/x100_dp.c:864:5: warning: no previous prototype for 'x100_dp_hw_reset' [-Wmissing-prototypes] 864 | int x100_dp_hw_reset(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/x100_dp.c:897:9: warning: no previous prototype for 'x100_dp_hw_get_source_lane_count' [-Wmissing-prototypes] 897 | uint8_t x100_dp_hw_get_source_lane_count(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/gpu/drm/phytium/phytium_pci.c:19:5: sparse: sparse: symbol 'dc_msi_enable' was not declared. Should it be static? drivers/gpu/drm/phytium/phytium_pci.c:23:6: sparse: sparse: symbol 'phytium_pci_vram_hw_init' was not declared. Should it be static? >> drivers/gpu/drm/phytium/phytium_pci.c:37:38: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *pool_virt_addr @@ got void [noderef] <asn:2> * @@ drivers/gpu/drm/phytium/phytium_pci.c:37:38: sparse: expected void *pool_virt_addr drivers/gpu/drm/phytium/phytium_pci.c:37:38: sparse: got void [noderef] <asn:2> * >> drivers/gpu/drm/phytium/phytium_pci.c:63:38: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] <asn:2> *addr @@ got void *pool_virt_addr @@ drivers/gpu/drm/phytium/phytium_pci.c:63:38: sparse: expected void [noderef] <asn:2> *addr drivers/gpu/drm/phytium/phytium_pci.c:63:38: sparse: got void *pool_virt_addr drivers/gpu/drm/phytium/phytium_pci.c:30:5: sparse: sparse: symbol 'phytium_pci_vram_init' was not declared. Should it be static? drivers/gpu/drm/phytium/phytium_pci.c:72:46: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] <asn:2> *addr @@ got void *pool_virt_addr @@ drivers/gpu/drm/phytium/phytium_pci.c:72:46: sparse: expected void [noderef] <asn:2> *addr drivers/gpu/drm/phytium/phytium_pci.c:72:46: sparse: got void *pool_virt_addr drivers/gpu/drm/phytium/phytium_pci.c:68:6: sparse: sparse: symbol 'phytium_pci_vram_fini' was not declared. Should it be static? drivers/gpu/drm/phytium/phytium_pci.c:99:34: sparse: sparse: undefined identifier 'PCI_VENDOR_ID_PHYTIUM' drivers/gpu/drm/phytium/phytium_pci.c:113:34: sparse: sparse: undefined identifier 'PCI_VENDOR_ID_PHYTIUM' drivers/gpu/drm/phytium/phytium_pci.c:137:6: sparse: sparse: symbol 'phytium_pci_dma_fini' was not declared. Should it be static? drivers/gpu/drm/phytium/phytium_pci.c:375:11: sparse: sparse: undefined identifier 'PCI_VENDOR_ID_PHYTIUM' drivers/gpu/drm/phytium/phytium_pci.c:376:11: sparse: sparse: undefined identifier 'PCI_VENDOR_ID_PHYTIUM' drivers/gpu/drm/phytium/phytium_pci.c:23:6: warning: no previous prototype for 'phytium_pci_vram_hw_init' [-Wmissing-prototypes] 23 | void phytium_pci_vram_hw_init(struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c:30:5: warning: no previous prototype for 'phytium_pci_vram_init' [-Wmissing-prototypes] 30 | int phytium_pci_vram_init(struct pci_dev *pdev, struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c:68:6: warning: no previous prototype for 'phytium_pci_vram_fini' [-Wmissing-prototypes] 68 | void phytium_pci_vram_fini(struct pci_dev *pdev, struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c:89:5: warning: no previous prototype for 'phytium_pci_dma_init' [-Wmissing-prototypes] 89 | int phytium_pci_dma_init(struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c: In function 'phytium_pci_dma_init': drivers/gpu/drm/phytium/phytium_pci.c:99:34: error: 'PCI_VENDOR_ID_PHYTIUM' undeclared (first use in this function); did you mean 'PCI_VENDOR_ID_PHILIPS'? 99 | gpu_dev = pci_get_device(PCI_VENDOR_ID_PHYTIUM, 0xdc20, NULL); | ^~~~~~~~~~~~~~~~~~~~~ | PCI_VENDOR_ID_PHILIPS drivers/gpu/drm/phytium/phytium_pci.c:99:34: note: each undeclared identifier is reported only once for each function it appears in drivers/gpu/drm/phytium/phytium_pci.c: At top level: drivers/gpu/drm/phytium/phytium_pci.c:137:6: warning: no previous prototype for 'phytium_pci_dma_fini' [-Wmissing-prototypes] 137 | void phytium_pci_dma_fini(struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~ In file included from drivers/gpu/drm/phytium/phytium_pci.c:7: include/linux/pci.h:888:19: error: 'PCI_VENDOR_ID_PHYTIUM' undeclared here (not in a function); did you mean 'PCI_VENDOR_ID_PHILIPS'? 888 | .vendor = PCI_VENDOR_ID_##vend, .device = (dev), 44- | ^~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c:375:11: note: in expansion of macro 'PCI_VDEVICE' 375 | { PCI_VDEVICE(PHYTIUM, 0xdc22), (kernel_ulong_t)&x100_info }, | ^~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c:329:12: warning: 'phytium_pci_pm_resume' defined but not used [-Wunused-function] 329 | static int phytium_pci_pm_resume(struct device *dev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c:306:12: warning: 'phytium_pci_pm_suspend' defined but not used [-Wunused-function] 306 | static int phytium_pci_pm_suspend(struct device *dev) | ^~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/gpu/drm/phytium/e2000_dp.c:471:6: sparse: sparse: symbol 'e2000_dp_hw_spread_is_enable' was not declared. Should it be static? >> drivers/gpu/drm/phytium/e2000_dp.c:476:5: sparse: sparse: symbol 'e2000_dp_hw_reset' was not declared. Should it be static? >> drivers/gpu/drm/phytium/e2000_dp.c:491:9: sparse: sparse: symbol 'e2000_dp_hw_get_source_lane_count' was not declared. Should it be static? drivers/gpu/drm/phytium/e2000_dp.c:471:6: warning: no previous prototype for 'e2000_dp_hw_spread_is_enable' [-Wmissing-prototypes] 471 | bool e2000_dp_hw_spread_is_enable(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/e2000_dp.c:476:5: warning: no previous prototype for 'e2000_dp_hw_reset' [-Wmissing-prototypes] 476 | int e2000_dp_hw_reset(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/e2000_dp.c:491:9: warning: no previous prototype for 'e2000_dp_hw_get_source_lane_count' [-Wmissing-prototypes] 491 | uint8_t e2000_dp_hw_get_source_lane_count(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/gpu/drm/phytium/phytium_platform.c:32:38: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *pool_virt_addr @@ got void [noderef] <asn:2> * @@ drivers/gpu/drm/phytium/phytium_platform.c:32:38: sparse: expected void *pool_virt_addr drivers/gpu/drm/phytium/phytium_platform.c:32:38: sparse: got void [noderef] <asn:2> * >> drivers/gpu/drm/phytium/phytium_platform.c:55:21: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got void *pool_virt_addr @@ drivers/gpu/drm/phytium/phytium_platform.c:55:21: sparse: expected void volatile [noderef] <asn:2> *addr drivers/gpu/drm/phytium/phytium_platform.c:55:21: sparse: got void *pool_virt_addr drivers/gpu/drm/phytium/phytium_platform.c:19:5: sparse: sparse: symbol 'phytium_platform_carveout_mem_init' was not declared. Should it be static? drivers/gpu/drm/phytium/phytium_platform.c:65:29: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got void *pool_virt_addr @@ drivers/gpu/drm/phytium/phytium_platform.c:65:29: sparse: expected void volatile [noderef] <asn:2> *addr drivers/gpu/drm/phytium/phytium_platform.c:65:29: sparse: got void *pool_virt_addr drivers/gpu/drm/phytium/phytium_platform.c:60:6: sparse: sparse: symbol 'phytium_platform_carveout_mem_fini' was not declared. Should it be static? drivers/gpu/drm/phytium/phytium_platform.c:298:10: sparse: sparse: Initializer entry defined twice drivers/gpu/drm/phytium/phytium_platform.c:306:10: sparse: also defined here drivers/gpu/drm/phytium/phytium_platform.c:19:5: warning: no previous prototype for 'phytium_platform_carveout_mem_init' [-Wmissing-prototypes] 19 | int phytium_platform_carveout_mem_init(struct platform_device *pdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_platform.c:60:6: warning: no previous prototype for 'phytium_platform_carveout_mem_fini' [-Wmissing-prototypes] 60 | void phytium_platform_carveout_mem_fini(struct platform_device *pdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_platform.c:253:12: warning: 'phytium_platform_pm_resume' defined but not used [-Wunused-function] 253 | static int phytium_platform_pm_resume(struct device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_platform.c:245:12: warning: 'phytium_platform_pm_suspend' defined but not used [-Wunused-function] 245 | static int phytium_platform_pm_suspend(struct device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +96 drivers/gpu/drm/phytium/phytium_fbdev.c 35 36 static int 37 phytium_drm_fbdev_create(struct drm_fb_helper *helper, struct drm_fb_helper_surface_size *sizes) 38 { 39 struct phytium_display_private *priv = helper_to_drm_private(helper); 40 struct drm_device *dev = helper->dev; 41 unsigned int bytes_per_pixel; 42 struct drm_mode_fb_cmd2 mode_cmd = {0}; 43 struct phytium_framebuffer *phytium_fb = NULL; 44 struct fb_info *fbi = NULL; 45 struct drm_framebuffer *fb = NULL; 46 size_t size = 0; 47 int ret = 0; 48 unsigned long offset; 49 50 bytes_per_pixel = DIV_ROUND_UP(sizes->surface_bpp, 8); 51 mode_cmd.width = sizes->surface_width; 52 mode_cmd.height = sizes->surface_height; 53 mode_cmd.pitches[0] = ALIGN(sizes->surface_width * bytes_per_pixel, 128); 54 mode_cmd.pixel_format = drm_mode_legacy_fb_format(sizes->surface_bpp, sizes->surface_depth); 55 size = PAGE_ALIGN(mode_cmd.pitches[0] * mode_cmd.height); 56 57 ret = mutex_lock_interruptible(&dev->struct_mutex); 58 if (ret < 0) { 59 DRM_ERROR("failed to get mutex lock\n"); 60 return ret; 61 } 62 63 priv->fbdev_phytium_gem = phytium_gem_create_object(dev, size); 64 if (!priv->fbdev_phytium_gem) { 65 DRM_ERROR("failed to create gem object\n"); 66 return -ENOMEM; 67 } 68 mutex_unlock(&dev->struct_mutex); 69 70 fbi = drm_fb_helper_alloc_fbi(helper); 71 if (IS_ERR(fbi)) { 72 DRM_DEV_ERROR(dev->dev, "Failed to create framebuffer info."); 73 ret = PTR_ERR(fbi); 74 goto out; 75 } 76 77 phytium_fb = phytium_fb_alloc(dev, &mode_cmd, &priv->fbdev_phytium_gem, 1); 78 if (IS_ERR(phytium_fb)) { 79 DRM_DEV_ERROR(dev->dev, "Failed to alloc DRM framebuffer.\n"); 80 ret = PTR_ERR(phytium_fb); 81 goto out; 82 } 83 84 helper->fb = &(phytium_fb->base); 85 fbi->par = helper; 86 fbi->flags = FBINFO_FLAG_DEFAULT; 87 fbi->fbops = &phytium_fbdev_ops; 88 89 fb = helper->fb; 90 drm_fb_helper_fill_fix(fbi, fb->pitches[0], fb->format->depth); 91 drm_fb_helper_fill_var(fbi, helper, sizes->fb_width, sizes->fb_height); 92 93 offset = fbi->var.xoffset * bytes_per_pixel; 94 offset += fbi->var.yoffset * fb->pitches[0]; 95 dev->mode_config.fb_base = 0; > 96 fbi->screen_base = priv->fbdev_phytium_gem->vaddr + offset; 97 fbi->screen_size = priv->fbdev_phytium_gem->base.size; 98 fbi->fix.smem_len = priv->fbdev_phytium_gem->base.size; 99 DRM_DEBUG_KMS("FB [%dx%d]-%d kvaddr=%pa offset=%ld size=%zu\n", fb->width, fb->height, 100 fb->format->depth, &priv->fbdev_phytium_gem->iova, offset, size); 101 fbi->skip_vt_switch = true; 102 103 return 0; 104 out: 105 phytium_gem_free_object(&priv->fbdev_phytium_gem->base); 106 return ret; 107 } 108 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1900/1900] block/blk-mq-sched.c:219:5: sparse: sparse: symbol '__blk_mq_sched_dispatch_requests' was not declared. Should it be static?
by kernel test robot 31 Oct '25

31 Oct '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c91cc1d257ea2f599d7cb6d2ec1fb76bacf12c2b commit: c1ea82c0ddde70d5998c2f547520afbee10bea2a [1900/1900] block: Limit number of items taken from the I/O scheduler in one go config: arm64-randconfig-r132-20251030 (https://download.01.org/0day-ci/archive/20251031/202510310155.LwSuBIyA-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251031/202510310155.LwSuBIyA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510310155.LwSuBIyA-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> block/blk-mq-sched.c:219:5: sparse: sparse: symbol '__blk_mq_sched_dispatch_requests' was not declared. Should it be static? block/blk-mq-sched.c:219:5: warning: no previous prototype for '__blk_mq_sched_dispatch_requests' [-Wmissing-prototypes] 219 | int __blk_mq_sched_dispatch_requests(struct blk_mq_hw_ctx *hctx) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/__blk_mq_sched_dispatch_requests +219 block/blk-mq-sched.c 218 > 219 int __blk_mq_sched_dispatch_requests(struct blk_mq_hw_ctx *hctx) 220 { 221 struct request_queue *q = hctx->queue; 222 struct elevator_queue *e = q->elevator; 223 const bool has_sched_dispatch = e && e->type->ops.mq.dispatch_request; 224 int ret = 0; 225 LIST_HEAD(rq_list); 226 227 /* 228 * If we have previous entries on our dispatch list, grab them first for 229 * more fair dispatch. 230 */ 231 if (!list_empty_careful(&hctx->dispatch)) { 232 spin_lock(&hctx->lock); 233 if (!list_empty(&hctx->dispatch)) 234 list_splice_init(&hctx->dispatch, &rq_list); 235 spin_unlock(&hctx->lock); 236 } 237 238 /* 239 * Only ask the scheduler for requests, if we didn't have residual 240 * requests from the dispatch list. This is to avoid the case where 241 * we only ever dispatch a fraction of the requests available because 242 * of low device queue depth. Once we pull requests out of the IO 243 * scheduler, we can no longer merge or sort them. So it's best to 244 * leave them there for as long as we can. Mark the hw queue as 245 * needing a restart in that case. 246 * 247 * We want to dispatch from the scheduler if there was nothing 248 * on the dispatch list or we were able to dispatch from the 249 * dispatch list. 250 */ 251 if (!list_empty(&rq_list)) { 252 blk_mq_sched_mark_restart_hctx(hctx); 253 if (blk_mq_dispatch_rq_list(q, &rq_list, false)) { 254 if (has_sched_dispatch) 255 ret = blk_mq_do_dispatch_sched(hctx); 256 else 257 ret = blk_mq_do_dispatch_ctx(hctx); 258 } 259 } else if (has_sched_dispatch) { 260 ret = blk_mq_do_dispatch_sched(hctx); 261 } else if (hctx->dispatch_busy) { 262 /* dequeue request one by one from sw queue if queue is busy */ 263 ret = blk_mq_do_dispatch_ctx(hctx); 264 } else { 265 blk_mq_flush_busy_ctxs(hctx, &rq_list); 266 blk_mq_dispatch_rq_list(q, &rq_list, false); 267 } 268 269 return ret; 270 } 271 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3058/3058] include/net/ip.h:463:14: error: default initialization of an object of type 'typeof (rt->dst.expires)' (aka 'const unsigned long') leaves the object uninitialized
by kernel test robot 30 Oct '25

30 Oct '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 7f38ece6b510adaa28c8e625ff574fe6357a3960 commit: 6864d14bb90f03a1e5b7fbcc04fc2ba4d692bd3e [3058/3058] support 3SNIC 910/920/930 NIC config: arm64-allyesconfig (https://download.01.org/0day-ci/archive/20251030/202510302146.pnDXGiyc-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project d1c086e82af239b245fe8d7832f2753436634990) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251030/202510302146.pnDXGiyc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510302146.pnDXGiyc-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from <built-in>:3: In file included from include/linux/compiler_types.h:150: include/linux/compiler-clang.h:42:9: error: '__SANITIZE_THREAD__' macro redefined [-Werror,-Wmacro-redefined] 42 | #define __SANITIZE_THREAD__ | ^ <built-in>:368:9: note: previous definition is here 368 | #define __SANITIZE_THREAD__ 1 | ^ In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:6: In file included from include/linux/pci.h:1663: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2204: include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: error: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Werror,-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:30: In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx.h:9: In file included from include/net/ip6_checksum.h:27: >> include/net/ip.h:463:14: error: default initialization of an object of type 'typeof (rt->dst.expires)' (aka 'const unsigned long') leaves the object uninitialized [-Werror,-Wdefault-const-init-var-unsafe] 463 | if (mtu && time_before(jiffies, rt->dst.expires)) | ^ include/linux/jiffies.h:135:26: note: expanded from macro 'time_before' 135 | #define time_before(a,b) time_after(b,a) | ^ include/linux/jiffies.h:125:3: note: expanded from macro 'time_after' 125 | (typecheck(unsigned long, a) && \ | ^ include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' 11 | typeof(x) __dummy2; \ | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:883:6: error: no previous prototype for function 'sss_nic_port_module_cable_plug' [-Werror,-Wmissing-prototypes] 883 | void sss_nic_port_module_cable_plug(struct sss_nic_dev *nic_dev, void *event_data) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:883:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 883 | void sss_nic_port_module_cable_plug(struct sss_nic_dev *nic_dev, void *event_data) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:889:6: error: no previous prototype for function 'sss_nic_port_module_cable_unplug' [-Werror,-Wmissing-prototypes] 889 | void sss_nic_port_module_cable_unplug(struct sss_nic_dev *nic_dev, void *event_data) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:889:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 889 | void sss_nic_port_module_cable_unplug(struct sss_nic_dev *nic_dev, void *event_data) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:895:6: error: no previous prototype for function 'sss_nic_port_module_link_err' [-Werror,-Wmissing-prototypes] 895 | void sss_nic_port_module_link_err(struct sss_nic_dev *nic_dev, void *event_data) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:895:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 895 | void sss_nic_port_module_link_err(struct sss_nic_dev *nic_dev, void *event_data) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1034:22: error: no previous prototype for function 'get_nic_uld_info' [-Werror,-Wmissing-prototypes] 1034 | struct sss_uld_info *get_nic_uld_info(void) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1034:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1034 | struct sss_uld_info *get_nic_uld_info(void) | ^ | static 11 errors generated. -- In file included from <built-in>:3: In file included from include/linux/compiler_types.h:150: include/linux/compiler-clang.h:42:9: error: '__SANITIZE_THREAD__' macro redefined [-Werror,-Wmacro-redefined] 42 | #define __SANITIZE_THREAD__ | ^ <built-in>:368:9: note: previous definition is here 368 | #define __SANITIZE_THREAD__ 1 | ^ In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx.c:6: In file included from include/net/xfrm.h:9: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/arm64/include/asm/cacheflush.h:11: In file included from include/linux/kgdb.h:19: In file included from include/linux/kprobes.h:28: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2204: include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: error: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Werror,-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx.c:6: In file included from include/net/xfrm.h:22: >> include/net/ip.h:463:14: error: default initialization of an object of type 'typeof (rt->dst.expires)' (aka 'const unsigned long') leaves the object uninitialized [-Werror,-Wdefault-const-init-var-unsafe] 463 | if (mtu && time_before(jiffies, rt->dst.expires)) | ^ include/linux/jiffies.h:135:26: note: expanded from macro 'time_before' 135 | #define time_before(a,b) time_after(b,a) | ^ include/linux/jiffies.h:125:3: note: expanded from macro 'time_after' 125 | (typecheck(unsigned long, a) && \ | ^ include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' 11 | typeof(x) __dummy2; \ | ^ In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx.c:6: In file included from include/net/xfrm.h:25: include/net/ip6_fib.h:279:10: error: default initialization of an object of type 'typeof (f6i->expires)' (aka 'const unsigned long') leaves the object uninitialized [-Werror,-Wdefault-const-init-var-unsafe] 279 | return time_after(jiffies, f6i->expires); | ^ include/linux/jiffies.h:126:3: note: expanded from macro 'time_after' 126 | typecheck(unsigned long, b) && \ | ^ include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' 11 | typeof(x) __dummy2; \ | ^ 8 errors generated. -- In file included from <built-in>:3: In file included from include/linux/compiler_types.h:150: include/linux/compiler-clang.h:42:9: error: '__SANITIZE_THREAD__' macro redefined [-Werror,-Wmacro-redefined] 42 | #define __SANITIZE_THREAD__ | ^ <built-in>:368:9: note: previous definition is here 368 | #define __SANITIZE_THREAD__ 1 | ^ In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:6: In file included from include/net/xfrm.h:9: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/arm64/include/asm/cacheflush.h:11: In file included from include/linux/kgdb.h:19: In file included from include/linux/kprobes.h:28: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2204: include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: error: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Werror,-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:6: In file included from include/net/xfrm.h:22: >> include/net/ip.h:463:14: error: default initialization of an object of type 'typeof (rt->dst.expires)' (aka 'const unsigned long') leaves the object uninitialized [-Werror,-Wdefault-const-init-var-unsafe] 463 | if (mtu && time_before(jiffies, rt->dst.expires)) | ^ include/linux/jiffies.h:135:26: note: expanded from macro 'time_before' 135 | #define time_before(a,b) time_after(b,a) | ^ include/linux/jiffies.h:125:3: note: expanded from macro 'time_after' 125 | (typecheck(unsigned long, a) && \ | ^ include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' 11 | typeof(x) __dummy2; \ | ^ In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:6: In file included from include/net/xfrm.h:25: include/net/ip6_fib.h:279:10: error: default initialization of an object of type 'typeof (f6i->expires)' (aka 'const unsigned long') leaves the object uninitialized [-Werror,-Wdefault-const-init-var-unsafe] 279 | return time_after(jiffies, f6i->expires); | ^ include/linux/jiffies.h:126:3: note: expanded from macro 'time_after' 126 | typecheck(unsigned long, b) && \ | ^ include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' 11 | typeof(x) __dummy2; \ | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:42:5: error: no previous prototype for function 'sss_nic_alloc_sq_resource' [-Werror,-Wmissing-prototypes] 42 | int sss_nic_alloc_sq_resource(struct sss_nic_dev *nic_dev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:42:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 42 | int sss_nic_alloc_sq_resource(struct sss_nic_dev *nic_dev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:87:6: error: no previous prototype for function 'sss_nic_free_sq_resource' [-Werror,-Wmissing-prototypes] 87 | void sss_nic_free_sq_resource(struct sss_nic_dev *nic_dev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:87:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 87 | void sss_nic_free_sq_resource(struct sss_nic_dev *nic_dev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:104:6: error: no previous prototype for function 'sss_nic_init_all_sq' [-Werror,-Wmissing-prototypes] 104 | void sss_nic_init_all_sq(struct sss_nic_dev *nic_dev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:104:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 104 | void sss_nic_init_all_sq(struct sss_nic_dev *nic_dev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:128:5: error: no previous prototype for function 'sss_nic_alloc_sq_desc_group' [-Werror,-Wmissing-prototypes] 128 | int sss_nic_alloc_sq_desc_group(struct sss_nic_dev *nic_dev) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:128:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 128 | int sss_nic_alloc_sq_desc_group(struct sss_nic_dev *nic_dev) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:153:6: error: no previous prototype for function 'sss_nic_free_sq_desc_group' [-Werror,-Wmissing-prototypes] 153 | void sss_nic_free_sq_desc_group(struct sss_nic_dev *nic_dev) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:153:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 153 | void sss_nic_free_sq_desc_group(struct sss_nic_dev *nic_dev) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:200:6: error: no previous prototype for function 'sss_nic_flush_all_sq' [-Werror,-Wmissing-prototypes] 200 | void sss_nic_flush_all_sq(struct sss_nic_dev *nic_dev) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:200:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 200 | void sss_nic_flush_all_sq(struct sss_nic_dev *nic_dev) | ^ | static 14 errors generated. -- In file included from <built-in>:3: In file included from include/linux/compiler_types.h:150: include/linux/compiler-clang.h:42:9: error: '__SANITIZE_THREAD__' macro redefined [-Werror,-Wmacro-redefined] 42 | #define __SANITIZE_THREAD__ | ^ <built-in>:368:9: note: previous definition is here 368 | #define __SANITIZE_THREAD__ 1 | ^ In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_dcb.c:7: In file included from include/linux/pci.h:1663: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2204: include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: error: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Werror,-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_dcb.c:23: In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx.h:9: In file included from include/net/ip6_checksum.h:27: >> include/net/ip.h:463:14: error: default initialization of an object of type 'typeof (rt->dst.expires)' (aka 'const unsigned long') leaves the object uninitialized [-Werror,-Wdefault-const-init-var-unsafe] 463 | if (mtu && time_before(jiffies, rt->dst.expires)) | ^ include/linux/jiffies.h:135:26: note: expanded from macro 'time_before' 135 | #define time_before(a,b) time_after(b,a) | ^ include/linux/jiffies.h:125:3: note: expanded from macro 'time_after' 125 | (typecheck(unsigned long, a) && \ | ^ include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' 11 | typeof(x) __dummy2; \ | ^ 7 errors generated. .. vim +463 include/net/ip.h 1b346576359c72 Hannes Frederic Sowa 2014-02-26 451 f87c10a8aa1e82 Hannes Frederic Sowa 2014-01-09 452 static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst, f87c10a8aa1e82 Hannes Frederic Sowa 2014-01-09 453 bool forwarding) f87c10a8aa1e82 Hannes Frederic Sowa 2014-01-09 454 { ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 455 const struct rtable *rt = container_of(dst, struct rtable, dst); f87c10a8aa1e82 Hannes Frederic Sowa 2014-01-09 456 struct net *net = dev_net(dst->dev); 02a1b175b0e92d Maciej Żenczykowski 2020-09-23 457 unsigned int mtu; f87c10a8aa1e82 Hannes Frederic Sowa 2014-01-09 458 60c158dc7b1f05 Kuniyuki Iwashima 2022-07-13 459 if (READ_ONCE(net->ipv4.sysctl_ip_fwd_use_pmtu) || d52e5a7e7ca494 Sabrina Dubroca 2018-03-14 460 ip_mtu_locked(dst) || ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 461 !forwarding) { ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 462 mtu = rt->rt_pmtu; ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 @463 if (mtu && time_before(jiffies, rt->dst.expires)) ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 464 goto out; ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 465 } f87c10a8aa1e82 Hannes Frederic Sowa 2014-01-09 466 02a1b175b0e92d Maciej Żenczykowski 2020-09-23 467 /* 'forwarding = true' case should always honour route mtu */ 02a1b175b0e92d Maciej Żenczykowski 2020-09-23 468 mtu = dst_metric_raw(dst, RTAX_MTU); ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 469 if (mtu) ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 470 goto out; ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 471 ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 472 mtu = READ_ONCE(dst->dev->mtu); ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 473 ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 474 if (unlikely(ip_mtu_locked(dst))) { ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 475 if (rt->rt_uses_gateway && mtu > 576) ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 476 mtu = 576; ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 477 } ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 478 ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 479 out: ac6627a28dbfb5 Vadim Fedorenko 2021-07-20 480 mtu = min_t(unsigned int, mtu, IP_MAX_MTU); 02a1b175b0e92d Maciej Żenczykowski 2020-09-23 481 fade56410c22ca Vadim Fedorenko 2021-06-25 482 return mtu - lwtunnel_headroom(dst->lwtstate, mtu); f87c10a8aa1e82 Hannes Frederic Sowa 2014-01-09 483 } f87c10a8aa1e82 Hannes Frederic Sowa 2014-01-09 484 :::::: The code at line 463 was first introduced by commit :::::: ac6627a28dbfb5d96736544a00c3938fa7ea6dfb net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward :::::: TO: Vadim Fedorenko <vfedorenko(a)novek.ru> :::::: CC: David S. Miller <davem(a)davemloft.net> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] cnic: Fix use-after-free bugs in cnic_delete_task
by Yao Kai 30 Oct '25

30 Oct '25

From: Duoming Zhou <duoming(a)zju.edu.cn> stable inclusion from stable-v6.6.108 commit 8eeb2091e72d75df8ceaa2172638d61b4cf8929a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0U8X CVE: CVE-2025-39945 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cfa7d9b1e3a8604afc84e9e51d789c29574fb216 ] The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(), which does not guarantee that the delayed work item 'delete_task' has fully completed if it was already running. Additionally, the delayed work item is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after the cyclic work items have finished executing, a delayed work item may still exist in the workqueue. This leads to use-after-free scenarios where the cnic_dev is deallocated by cnic_free_dev(), while delete_task remains active and attempt to dereference cnic_dev in cnic_delete_task(). A typical race condition is illustrated below: CPU 0 (cleanup) | CPU 1 (delayed work callback) cnic_netdev_event() | cnic_stop_hw() | cnic_delete_task() cnic_cm_stop_bnx2x_hw() | ... cancel_delayed_work() | /* the queue_delayed_work() flush_workqueue() | executes after flush_workqueue()*/ | queue_delayed_work() cnic_free_dev(dev)//free | cnic_delete_task() //new instance | dev = cp->dev; //use Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the cyclic delayed work item is properly canceled and that any ongoing execution of the work item completes before the cnic_dev is deallocated. Furthermore, since cancel_delayed_work_sync() uses __flush_work(work, true) to synchronously wait for any currently executing instance of the work item to finish, the flush_workqueue() becomes redundant and should be removed. This bug was identified through static analysis. To reproduce the issue and validate the fix, I simulated the cnic PCI device in QEMU and introduced intentional delays — such as inserting calls to ssleep() within the cnic_delete_task() function — to increase the likelihood of triggering the bug. Fixes: fdf24086f475 ("cnic: Defer iscsi connection cleanup") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yao Kai <yaokai34(a)huawei.com> --- drivers/net/ethernet/broadcom/cnic.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c index 7926aaef8f0c..ad2745c07c1a 100644 --- a/drivers/net/ethernet/broadcom/cnic.c +++ b/drivers/net/ethernet/broadcom/cnic.c @@ -4220,8 +4220,7 @@ static void cnic_cm_stop_bnx2x_hw(struct cnic_dev *dev) cnic_bnx2x_delete_wait(dev, 0); - cancel_delayed_work(&cp->delete_task); - flush_workqueue(cnic_wq); + cancel_delayed_work_sync(&cp->delete_task); if (atomic_read(&cp->iscsi_conn) != 0) netdev_warn(dev->netdev, "%d iSCSI connections not destroyed\n", -- 2.43.0

2 9

[PATCH openEuler-1.0-LTS] PCI/sysfs: Prohibit unaligned access to I/O port on non-x86
by Ziming Du 30 Oct '25

30 Oct '25

From: Yongqiang Liu <liuyongqiang13(a)huawei.com> hulk inclusion category: bugfix bugzilla: 190753 -------------------------------- Unaligned access is harmful for non-x86 archs such as arm64. When we use pwrite or pread to access the I/O port resources with unaligned offset, system will crash as follows: Unable to handle kernel paging request at virtual address fffffbfffe8010c1 Internal error: Oops: 0000000096000061 [#1] SMP Modules linked in: CPU: 1 PID: 44230 Comm: syz.1.10955 Not tainted 6.6.0+ #1 Hardware name: linux,dummy-virt (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __raw_writew arch/arm64/include/asm/io.h:33 [inline] pc : _outw include/asm-generic/io.h:594 [inline] pc : logic_outw+0x54/0x218 lib/logic_pio.c:305 lr : _outw include/asm-generic/io.h:593 [inline] lr : logic_outw+0x40/0x218 lib/logic_pio.c:305 sp : ffff800083097a30 x29: ffff800083097a30 x28: ffffba71ba86e130 x27: 1ffff00010612f93 x26: ffff3bae63b3a420 x25: ffffba71bbf585d0 x24: 0000000000005ac1 x23: 00000000000010c1 x22: ffff3baf0deb6488 x21: 0000000000000002 x20: 00000000000010c1 x19: 0000000000ffbffe x18: 0000000000000000 x17: 0000000000000000 x16: ffffba71b9f44b48 x15: 00000000200002c0 x14: 0000000000000000 x13: 0000000000000000 x12: ffff6775ca80451f x11: 1fffe775ca80451e x10: ffff6775ca80451e x9 : ffffba71bb78cf2c x8 : 0000988a357fbae2 x7 : ffff3bae540228f7 x6 : 0000000000000001 x5 : 1fffe775e2b43c78 x4 : dfff800000000000 x3 : ffffba71b9a00000 x2 : ffff80008d22a000 x1 : ffffc58ec6600000 x0 : fffffbfffe8010c1 Call trace: _outw include/asm-generic/io.h:594 [inline] logic_outw+0x54/0x218 lib/logic_pio.c:305 pci_resource_io drivers/pci/pci-sysfs.c:1157 [inline] pci_write_resource_io drivers/pci/pci-sysfs.c:1191 [inline] pci_write_resource_io+0x208/0x260 drivers/pci/pci-sysfs.c:1181 sysfs_kf_bin_write+0x188/0x210 fs/sysfs/file.c:158 kernfs_fop_write_iter+0x2e8/0x4b0 fs/kernfs/file.c:338 call_write_iter include/linux/fs.h:2085 [inline] new_sync_write fs/read_write.c:493 [inline] vfs_write+0x7bc/0xac8 fs/read_write.c:586 ksys_write+0x12c/0x270 fs/read_write.c:639 __do_sys_write fs/read_write.c:651 [inline] __se_sys_write fs/read_write.c:648 [inline] __arm64_sys_write+0x78/0xb8 fs/read_write.c:648 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x8c/0x2e0 arch/arm64/kernel/syscall.c:51 el0_svc_common.constprop.0+0x200/0x2a8 arch/arm64/kernel/syscall.c:134 do_el0_svc+0x4c/0x70 arch/arm64/kernel/syscall.c:176 el0_svc+0x44/0x1d8 arch/arm64/kernel/entry-common.c:806 el0t_64_sync_handler+0x100/0x130 arch/arm64/kernel/entry-common.c:844 el0t_64_sync+0x3c8/0x3d0 arch/arm64/kernel/entry.S:757 Powerpc seems affected as well, so prohibit the unaligned access on non-x86 archs. Fixes: 8633328be242 ("PCI: Allow read/write access to sysfs I/O port resources") Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/pci/pci-sysfs.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c index 48c56cb086524..e8c3a1b7d4a93 100644 --- a/drivers/pci/pci-sysfs.c +++ b/drivers/pci/pci-sysfs.c @@ -1204,6 +1204,13 @@ static int pci_mmap_resource_wc(struct file *filp, struct kobject *kobj, return pci_mmap_resource(kobj, attr, vma, 1); } +#if !defined(CONFIG_X86) +static bool is_unaligned(unsigned long port, size_t size) +{ + return port & (size - 1); +} +#endif + static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj, struct bin_attribute *attr, char *buf, loff_t off, size_t count, bool write) @@ -1220,6 +1227,11 @@ static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj, if (port + count - 1 > pci_resource_end(pdev, bar)) return -EINVAL; +#if !defined(CONFIG_X86) + if (is_unaligned(port, count)) + return -EFAULT; +#endif + switch (count) { case 1: if (write) -- 2.43.0

2 1