- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 2077/2077] kernel/module/strict_rwx.c:36:6: warning: no previous prototype for 'module_disable_ro'
by kernel test robot 02 Apr '25

02 Apr '25

Hi Zheng, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 75db7d4fff188725f4adc2de1281daa5b8680603 commit: c8783f92771c891518257c9deb22cd91d4e1a212 [2077/2077] livepatch/core: Revert module_enable_ro and module_disable_ro config: x86_64-randconfig-161-20250402 (https://download.01.org/0day-ci/archive/20250402/202504021840.VgjrPfcw-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021840.VgjrPfcw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021840.VgjrPfcw-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/module/strict_rwx.c:36:6: warning: no previous prototype for 'module_disable_ro' [-Wmissing-prototypes] 36 | void module_disable_ro(const struct module *mod) | ^~~~~~~~~~~~~~~~~ vim +/module_disable_ro +36 kernel/module/strict_rwx.c 34 35 #ifdef CONFIG_LIVEPATCH_WO_FTRACE > 36 void module_disable_ro(const struct module *mod) 37 { 38 if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) 39 return; 40 #ifdef CONFIG_STRICT_MODULE_RWX 41 if (!rodata_enabled) 42 return; 43 #endif 44 45 module_set_memory(mod, MOD_TEXT, set_memory_rw); 46 module_set_memory(mod, MOD_INIT_TEXT, set_memory_rw); 47 module_set_memory(mod, MOD_RODATA, set_memory_rw); 48 module_set_memory(mod, MOD_INIT_RODATA, set_memory_rw); 49 } 50 #endif /* CONFIG_LIVEPATCH_WO_FTRACE */ 51 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1546/1546] include/linux/uaccess.h:115:17: warning: 'stats' may be used uninitialized
by kernel test robot 02 Apr '25

02 Apr '25

Hi Guillaume, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7951fd324625a8af5097e1476cdc8c33c6009b48 commit: 528534f0deda05c668756313a22974429a9df05a [1546/1546] l2tp: remove pppol2tp_tunnel_ioctl() config: arm64-randconfig-002-20250401 (https://download.01.org/0day-ci/archive/20250402/202504021807.twewxnJE-lkp@…) compiler: aarch64-linux-gcc (GCC) 12.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021807.twewxnJE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021807.twewxnJE-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): net/l2tp/l2tp_ppp.c: In function 'pppol2tp_ioctl': net/l2tp/l2tp_ppp.c:1122:13: warning: variable 'val' set but not used [-Wunused-but-set-variable] 1122 | int val; | ^~~ In file included from net/l2tp/l2tp_ppp.c:62: net/l2tp/l2tp_ppp.c: At top level: include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'pppol2tp_init': 'cold' [-Wmissing-attributes] 132 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ net/l2tp/l2tp_ppp.c:1802:1: note: in expansion of macro 'module_init' 1802 | module_init(pppol2tp_init); | ^~~~~~~~~~~ net/l2tp/l2tp_ppp.c:1754:19: note: 'init_module' target declared here 1754 | static int __init pppol2tp_init(void) | ^~~~~~~~~~~~~ include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'pppol2tp_exit': 'cold' [-Wmissing-attributes] 138 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ net/l2tp/l2tp_ppp.c:1803:1: note: in expansion of macro 'module_exit' 1803 | module_exit(pppol2tp_exit); | ^~~~~~~~~~~ net/l2tp/l2tp_ppp.c:1792:20: note: 'cleanup_module' target declared here 1792 | static void __exit pppol2tp_exit(void) | ^~~~~~~~~~~~~ In file included from net/l2tp/l2tp_ppp.c:65: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:147:7, inlined from 'pppol2tp_ioctl' at net/l2tp/l2tp_ppp.c:1163:8: >> include/linux/uaccess.h:115:17: warning: 'stats' may be used uninitialized [-Wmaybe-uninitialized] 115 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:246, from include/linux/kernel.h:10, from include/linux/list.h:9, from include/linux/module.h:9: include/linux/kasan-checks.h: In function 'pppol2tp_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ net/l2tp/l2tp_ppp.c:1120:35: note: 'stats' declared here 1120 | struct pppol2tp_ioc_stats stats; | ^~~~~ vim +/stats +115 include/linux/uaccess.h d597580d373774 Al Viro 2017-03-20 107 d597580d373774 Al Viro 2017-03-20 108 #ifdef INLINE_COPY_FROM_USER d597580d373774 Al Viro 2017-03-20 109 static inline unsigned long d597580d373774 Al Viro 2017-03-20 110 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 111 { d597580d373774 Al Viro 2017-03-20 112 unsigned long res = n; 9c5f6908de03a4 Al Viro 2017-06-29 113 might_fault(); 9c5f6908de03a4 Al Viro 2017-06-29 114 if (likely(access_ok(VERIFY_READ, from, n))) { 9c5f6908de03a4 Al Viro 2017-06-29 @115 kasan_check_write(to, n); d597580d373774 Al Viro 2017-03-20 116 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 117 } d597580d373774 Al Viro 2017-03-20 118 if (unlikely(res)) d597580d373774 Al Viro 2017-03-20 119 memset(to + (n - res), 0, res); d597580d373774 Al Viro 2017-03-20 120 return res; d597580d373774 Al Viro 2017-03-20 121 } d597580d373774 Al Viro 2017-03-20 122 #else d597580d373774 Al Viro 2017-03-20 123 extern unsigned long d597580d373774 Al Viro 2017-03-20 124 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774 Al Viro 2017-03-20 125 #endif d597580d373774 Al Viro 2017-03-20 126 :::::: The code at line 115 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] gpio: aggregator: protect driver attr handlers against module unload
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v5.10.235 commit fd6aa1f8cbe0979eb66ac32ebc231bf0b10a2117 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY441 CVE: CVE-2025-21943 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 12f65d1203507f7db3ba59930fe29a3b8eee9945 upstream. Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race conditions with module unload, a reference needs to be held. Add try_module_get() in these handlers. For new_device_store, this eliminates what appears to be the most dangerous scenario: if an id is allocated from gpio_aggregator_idr but platform_device_register has not yet been called or completed, a concurrent module unload could fail to unregister/delete the device, leaving behind a dangling platform device/GPIO forwarder. This can result in various issues. The following simple reproducer demonstrates these problems: #!/bin/bash while :; do # note: whether 'gpiochip0 0' exists or not does not matter. echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device done & while :; do modprobe gpio-aggregator modprobe -r gpio-aggregator done & wait Starting with the following warning, several kinds of warnings will appear and the system may become unstable: ------------[ cut here ]------------ list_del corruption, ffff888103e2e980->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120 [...] RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120 [...] Call Trace: <TASK> ? __list_del_entry_valid_or_report+0xa3/0x120 ? __warn.cold+0x93/0xf2 ? __list_del_entry_valid_or_report+0xa3/0x120 ? report_bug+0xe6/0x170 ? __irq_work_queue_local+0x39/0xe0 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? __list_del_entry_valid_or_report+0xa3/0x120 gpiod_remove_lookup_table+0x22/0x60 new_device_store+0x315/0x350 [gpio_aggregator] kernfs_fop_write_iter+0x137/0x1f0 vfs_write+0x262/0x430 ksys_write+0x60/0xd0 do_syscall_64+0x6c/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]--- Fixes: 828546e24280 ("gpio: Add GPIO Aggregator") Cc: stable(a)vger.kernel.org Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Link: https://lore.kernel.org/r/20250224143134.3024598-2-koichiro.den@canonical.c… Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/gpio/gpio-aggregator.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/gpio/gpio-aggregator.c b/drivers/gpio/gpio-aggregator.c index d5f25246404d..4017f132656a 100644 --- a/drivers/gpio/gpio-aggregator.c +++ b/drivers/gpio/gpio-aggregator.c @@ -173,10 +173,15 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, struct platform_device *pdev; int res, id; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + /* kernfs guarantees string termination, so count + 1 is safe */ aggr = kzalloc(sizeof(*aggr) + count + 1, GFP_KERNEL); - if (!aggr) - return -ENOMEM; + if (!aggr) { + res = -ENOMEM; + goto put_module; + } memcpy(aggr->args, buf, count + 1); @@ -215,6 +220,7 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, } aggr->pdev = pdev; + module_put(THIS_MODULE); return count; remove_table: @@ -229,6 +235,8 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, kfree(aggr->lookups); free_ga: kfree(aggr); +put_module: + module_put(THIS_MODULE); return res; } @@ -257,13 +265,19 @@ static ssize_t delete_device_store(struct device_driver *driver, if (error) return error; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + mutex_lock(&gpio_aggregator_lock); aggr = idr_remove(&gpio_aggregator_idr, id); mutex_unlock(&gpio_aggregator_lock); - if (!aggr) + if (!aggr) { + module_put(THIS_MODULE); return -ENOENT; + } gpio_aggregator_free(aggr); + module_put(THIS_MODULE); return count; } static DRIVER_ATTR_WO(delete_device); -- 2.25.1

2 1

[PATCH OLK-6.6] gpio: aggregator: protect driver attr handlers against module unload
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v6.6.83 commit d99dc8f7ea01ee1b21306e0eda8eb18a4af80db6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY441 CVE: CVE-2025-21943 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 12f65d1203507f7db3ba59930fe29a3b8eee9945 upstream. Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race conditions with module unload, a reference needs to be held. Add try_module_get() in these handlers. For new_device_store, this eliminates what appears to be the most dangerous scenario: if an id is allocated from gpio_aggregator_idr but platform_device_register has not yet been called or completed, a concurrent module unload could fail to unregister/delete the device, leaving behind a dangling platform device/GPIO forwarder. This can result in various issues. The following simple reproducer demonstrates these problems: #!/bin/bash while :; do # note: whether 'gpiochip0 0' exists or not does not matter. echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device done & while :; do modprobe gpio-aggregator modprobe -r gpio-aggregator done & wait Starting with the following warning, several kinds of warnings will appear and the system may become unstable: ------------[ cut here ]------------ list_del corruption, ffff888103e2e980->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120 [...] RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120 [...] Call Trace: <TASK> ? __list_del_entry_valid_or_report+0xa3/0x120 ? __warn.cold+0x93/0xf2 ? __list_del_entry_valid_or_report+0xa3/0x120 ? report_bug+0xe6/0x170 ? __irq_work_queue_local+0x39/0xe0 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? __list_del_entry_valid_or_report+0xa3/0x120 gpiod_remove_lookup_table+0x22/0x60 new_device_store+0x315/0x350 [gpio_aggregator] kernfs_fop_write_iter+0x137/0x1f0 vfs_write+0x262/0x430 ksys_write+0x60/0xd0 do_syscall_64+0x6c/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]--- Fixes: 828546e24280 ("gpio: Add GPIO Aggregator") Cc: stable(a)vger.kernel.org Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Link: https://lore.kernel.org/r/20250224143134.3024598-2-koichiro.den@canonical.c… Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/gpio/gpio-aggregator.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/gpio/gpio-aggregator.c b/drivers/gpio/gpio-aggregator.c index 38e0fff9afe7..cc6ee4334602 100644 --- a/drivers/gpio/gpio-aggregator.c +++ b/drivers/gpio/gpio-aggregator.c @@ -121,10 +121,15 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, struct platform_device *pdev; int res, id; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + /* kernfs guarantees string termination, so count + 1 is safe */ aggr = kzalloc(sizeof(*aggr) + count + 1, GFP_KERNEL); - if (!aggr) - return -ENOMEM; + if (!aggr) { + res = -ENOMEM; + goto put_module; + } memcpy(aggr->args, buf, count + 1); @@ -163,6 +168,7 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, } aggr->pdev = pdev; + module_put(THIS_MODULE); return count; remove_table: @@ -177,6 +183,8 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, kfree(aggr->lookups); free_ga: kfree(aggr); +put_module: + module_put(THIS_MODULE); return res; } @@ -205,13 +213,19 @@ static ssize_t delete_device_store(struct device_driver *driver, if (error) return error; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + mutex_lock(&gpio_aggregator_lock); aggr = idr_remove(&gpio_aggregator_idr, id); mutex_unlock(&gpio_aggregator_lock); - if (!aggr) + if (!aggr) { + module_put(THIS_MODULE); return -ENOENT; + } gpio_aggregator_free(aggr); + module_put(THIS_MODULE); return count; } static DRIVER_ATTR_WO(delete_device); -- 2.25.1

2 1

[PATCH OLK-5.10] [Backport] gpio: aggregator: protect driver attr handlers against module unload
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v5.10.235 commit fd6aa1f8cbe0979eb66ac32ebc231bf0b10a2117 category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 12f65d1203507f7db3ba59930fe29a3b8eee9945 upstream. Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race conditions with module unload, a reference needs to be held. Add try_module_get() in these handlers. For new_device_store, this eliminates what appears to be the most dangerous scenario: if an id is allocated from gpio_aggregator_idr but platform_device_register has not yet been called or completed, a concurrent module unload could fail to unregister/delete the device, leaving behind a dangling platform device/GPIO forwarder. This can result in various issues. The following simple reproducer demonstrates these problems: #!/bin/bash while :; do # note: whether 'gpiochip0 0' exists or not does not matter. echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device done & while :; do modprobe gpio-aggregator modprobe -r gpio-aggregator done & wait Starting with the following warning, several kinds of warnings will appear and the system may become unstable: ------------[ cut here ]------------ list_del corruption, ffff888103e2e980->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120 [...] RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120 [...] Call Trace: <TASK> ? __list_del_entry_valid_or_report+0xa3/0x120 ? __warn.cold+0x93/0xf2 ? __list_del_entry_valid_or_report+0xa3/0x120 ? report_bug+0xe6/0x170 ? __irq_work_queue_local+0x39/0xe0 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? __list_del_entry_valid_or_report+0xa3/0x120 gpiod_remove_lookup_table+0x22/0x60 new_device_store+0x315/0x350 [gpio_aggregator] kernfs_fop_write_iter+0x137/0x1f0 vfs_write+0x262/0x430 ksys_write+0x60/0xd0 do_syscall_64+0x6c/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]--- Fixes: 828546e24280 ("gpio: Add GPIO Aggregator") Cc: stable(a)vger.kernel.org Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Link: https://lore.kernel.org/r/20250224143134.3024598-2-koichiro.den@canonical.c… Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/gpio/gpio-aggregator.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/gpio/gpio-aggregator.c b/drivers/gpio/gpio-aggregator.c index d5f25246404d..4017f132656a 100644 --- a/drivers/gpio/gpio-aggregator.c +++ b/drivers/gpio/gpio-aggregator.c @@ -173,10 +173,15 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, struct platform_device *pdev; int res, id; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + /* kernfs guarantees string termination, so count + 1 is safe */ aggr = kzalloc(sizeof(*aggr) + count + 1, GFP_KERNEL); - if (!aggr) - return -ENOMEM; + if (!aggr) { + res = -ENOMEM; + goto put_module; + } memcpy(aggr->args, buf, count + 1); @@ -215,6 +220,7 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, } aggr->pdev = pdev; + module_put(THIS_MODULE); return count; remove_table: @@ -229,6 +235,8 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, kfree(aggr->lookups); free_ga: kfree(aggr); +put_module: + module_put(THIS_MODULE); return res; } @@ -257,13 +265,19 @@ static ssize_t delete_device_store(struct device_driver *driver, if (error) return error; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + mutex_lock(&gpio_aggregator_lock); aggr = idr_remove(&gpio_aggregator_idr, id); mutex_unlock(&gpio_aggregator_lock); - if (!aggr) + if (!aggr) { + module_put(THIS_MODULE); return -ENOENT; + } gpio_aggregator_free(aggr); + module_put(THIS_MODULE); return count; } static DRIVER_ATTR_WO(delete_device); -- 2.25.1

2 1

[PATCH OLK-5.10] bpf, sockmap: Fix race between element replace and close()
by Liu Jian 02 Apr '25

02 Apr '25

From: Michal Luczaj <mhal(a)rbox.co> mainline inclusion from mainline-v6.13-rc3 commit ed1fc5d76b81a4d681211333c026202cad4d5649 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMZ CVE: CVE-2024-56664 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Element replace (with a socket different from the one stored) may race with socket's close() link popping & unlinking. __sock_map_delete() unconditionally unrefs the (wrong) element: // set map[0] = s0 map_update_elem(map, 0, s0) // drop fd of s0 close(s0) sock_map_close() lock_sock(sk) (s0!) sock_map_remove_links(sk) link = sk_psock_link_pop() sock_map_unlink(sk, link) sock_map_delete_from_link // replace map[0] with s1 map_update_elem(map, 0, s1) sock_map_update_elem (s1!) lock_sock(sk) sock_map_update_common psock = sk_psock(sk) spin_lock(&stab->lock) osk = stab->sks[idx] sock_map_add_link(..., &stab->sks[idx]) sock_map_unref(osk, &stab->sks[idx]) psock = sk_psock(osk) sk_psock_put(sk, psock) if (refcount_dec_and_test(&psock)) sk_psock_drop(sk, psock) spin_unlock(&stab->lock) unlock_sock(sk) __sock_map_delete spin_lock(&stab->lock) sk = *psk // s1 replaced s0; sk == s1 if (!sk_test || sk_test == sk) // sk_test (s0) != sk (s1); no branch sk = xchg(psk, NULL) if (sk) sock_map_unref(sk, psk) // unref s1; sks[idx] will dangle psock = sk_psock(sk) sk_psock_put(sk, psock) if (refcount_dec_and_test()) sk_psock_drop(sk, psock) spin_unlock(&stab->lock) release_sock(sk) Then close(map) enqueues bpf_map_free_deferred, which finally calls sock_map_free(). This results in some refcount_t warnings along with a KASAN splat [1]. Fix __sock_map_delete(), do not allow sock_map_unref() on elements that may have been replaced. [1]: BUG: KASAN: slab-use-after-free in sock_map_free+0x10e/0x330 Write of size 4 at addr ffff88811f5b9100 by task kworker/u64:12/1063 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Not tainted 6.12.0+ #125 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred Call Trace: <TASK> dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 kasan_report+0xb9/0x190 kasan_check_range+0x10f/0x1e0 sock_map_free+0x10e/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1202: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 unix_create1+0x88/0x8a0 unix_create+0xc5/0x180 __sock_create+0x241/0x650 __sys_socketpair+0x1ce/0x420 __x64_sys_socketpair+0x92/0x100 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 46: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 sk_psock_destroy+0x73e/0xa50 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 The buggy address belongs to the object at ffff88811f5b9080 which belongs to the cache UNIX-STREAM of size 1984 The buggy address is located 128 bytes inside of freed 1984-byte region [ffff88811f5b9080, ffff88811f5b9840) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11f5b8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff888127d49401 flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) page_type: f5(slab) raw: 0017ffffc0000040 ffff8881042e4500 dead000000000122 0000000000000000 raw: 0000000000000000 00000000800f000f 00000001f5000000 ffff888127d49401 head: 0017ffffc0000040 ffff8881042e4500 dead000000000122 0000000000000000 head: 0000000000000000 00000000800f000f 00000001f5000000 ffff888127d49401 head: 0017ffffc0000003 ffffea00047d6e01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88811f5b9000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88811f5b9080: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811f5b9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811f5b9200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Disabling lock debugging due to kernel taint refcount_t: addition on 0; use-after-free. WARNING: CPU: 14 PID: 1063 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Tainted: G B 6.12.0+ #125 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred RIP: 0010:refcount_warn_saturate+0xce/0x150 Code: 34 73 eb 03 01 e8 82 53 ad fe 0f 0b eb b1 80 3d 27 73 eb 03 00 75 a8 48 c7 c7 80 bd 95 84 c6 05 17 73 eb 03 01 e8 62 53 ad fe <0f> 0b eb 91 80 3d 06 73 eb 03 00 75 88 48 c7 c7 e0 bd 95 84 c6 05 RSP: 0018:ffff88815c49fc70 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88811f5b9100 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: 0000000000000002 R08: 0000000000000001 R09: ffffed10bcde6349 R10: ffff8885e6f31a4b R11: 0000000000000000 R12: ffff88813be0b000 R13: ffff88811f5b9100 R14: ffff88811f5b9080 R15: ffff88813be0b024 FS: 0000000000000000(0000) GS:ffff8885e6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055dda99b0250 CR3: 000000015dbac000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> ? __warn.cold+0x5f/0x1ff ? refcount_warn_saturate+0xce/0x150 ? report_bug+0x1ec/0x390 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xce/0x150 sock_map_free+0x2e5/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> irq event stamp: 10741 hardirqs last enabled at (10741): [<ffffffff84400ec6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 hardirqs last disabled at (10740): [<ffffffff811e532d>] handle_softirqs+0x60d/0x770 softirqs last enabled at (10506): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 softirqs last disabled at (10301): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 refcount_t: underflow; use-after-free. WARNING: CPU: 14 PID: 1063 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Tainted: G B W 6.12.0+ #125 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred RIP: 0010:refcount_warn_saturate+0xee/0x150 Code: 17 73 eb 03 01 e8 62 53 ad fe 0f 0b eb 91 80 3d 06 73 eb 03 00 75 88 48 c7 c7 e0 bd 95 84 c6 05 f6 72 eb 03 01 e8 42 53 ad fe <0f> 0b e9 6e ff ff ff 80 3d e6 72 eb 03 00 0f 85 61 ff ff ff 48 c7 RSP: 0018:ffff88815c49fc70 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88811f5b9100 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: 0000000000000003 R08: 0000000000000001 R09: ffffed10bcde6349 R10: ffff8885e6f31a4b R11: 0000000000000000 R12: ffff88813be0b000 R13: ffff88811f5b9100 R14: ffff88811f5b9080 R15: ffff88813be0b024 FS: 0000000000000000(0000) GS:ffff8885e6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055dda99b0250 CR3: 000000015dbac000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> ? __warn.cold+0x5f/0x1ff ? refcount_warn_saturate+0xee/0x150 ? report_bug+0x1ec/0x390 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xee/0x150 sock_map_free+0x2d3/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> irq event stamp: 10741 hardirqs last enabled at (10741): [<ffffffff84400ec6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 hardirqs last disabled at (10740): [<ffffffff811e532d>] handle_softirqs+0x60d/0x770 softirqs last enabled at (10506): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 softirqs last disabled at (10301): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Michal Luczaj <mhal(a)rbox.co> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Reviewed-by: John Fastabend <john.fastabend(a)gmail.com> Link: https://lore.kernel.org/bpf/20241202-sockmap-replace-v1-3-1e88579e7bd5@rbox… Conflicts: net/core/sock_map.c [Did not backport 35d2b7ffffc1d.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/sock_map.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/net/core/sock_map.c b/net/core/sock_map.c index c3c7f4469c80..beb8768a9285 100644 --- a/net/core/sock_map.c +++ b/net/core/sock_map.c @@ -431,12 +431,11 @@ static void *sock_map_lookup_sys(struct bpf_map *map, void *key) static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, struct sock **psk) { - struct sock *sk; + struct sock *sk = NULL; int err = 0; raw_spin_lock_bh(&stab->lock); - sk = *psk; - if (!sk_test || sk_test == sk) + if (!sk_test || sk_test == *psk) sk = xchg(psk, NULL); if (likely(sk)) -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-56642
by Liu Jian 02 Apr '25

02 Apr '25

CVE-2024-56642 Eric Dumazet (1): tipc: fix NULL deref in cleanup_bearer() Kuniyuki Iwashima (1): tipc: Fix use-after-free of kernel socket in cleanup_bearer(). net/tipc/udp_media.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2024-57857
by Liu Jian 02 Apr '25

02 Apr '25

CVE-2024-57857 Bernard Metzler (1): RDMA/siw: Remove direct link to net_device Liu Jian (1): RDMA: Export ib_device_get_netdev() drivers/infiniband/core/device.c | 4 +++ drivers/infiniband/sw/siw/siw.h | 7 +++--- drivers/infiniband/sw/siw/siw_cm.c | 27 ++++++++++++++++----- drivers/infiniband/sw/siw/siw_main.c | 14 +---------- drivers/infiniband/sw/siw/siw_verbs.c | 35 ++++++++++++++++++--------- include/rdma/ib_verbs.h | 2 ++ 6 files changed, 55 insertions(+), 34 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] dmaengine: Fix double increment of client_count in dma_chan_get()
by Xiaomeng Zhang 02 Apr '25

02 Apr '25

From: Koba Ko <koba.ko(a)canonical.com> stable inclusion from stable-v4.19.272 commit c6221afe573413fd2981e291f7df4a58283e0654 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVX7 CVE: CVE-2022-49753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f3dc1b3b4750851a94212dba249703dd0e50bb20 ] The first time dma_chan_get() is called for a channel the channel client_count is incorrectly incremented twice for public channels, first in balance_ref_count(), and again prior to returning. This results in an incorrect client count which will lead to the channel resources not being freed when they should be. A simple test of repeated module load and unload of async_tx on a Dell Power Edge R7425 also shows this resulting in a kref underflow warning. [ 124.329662] async_tx: api initialized (async) [ 129.000627] async_tx: api initialized (async) [ 130.047839] ------------[ cut here ]------------ [ 130.052472] refcount_t: underflow; use-after-free. [ 130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 [ 130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr intel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm mgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si syscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops k10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat fat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul libahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas i40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash dm_log dm_mod [last unloaded: async_tx] [ 130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not tainted 5.14.0-185.el9.x86_64 #1 [ 130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS 1.18.0 01/17/2022 [ 130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110 [ 130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d 26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a bd 55 00 <0f> 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff 48 c7 [ 130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286 [ 130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000 [ 130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0 [ 130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff [ 130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970 [ 130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 130.198739] FS: 00007f646435c740(0000) GS:ffff9daf9de00000(0000) knlGS:0000000000000000 [ 130.206832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0 [ 130.219729] Call Trace: [ 130.222192] <TASK> [ 130.224305] dma_chan_put+0x10d/0x110 [ 130.227988] dmaengine_put+0x7a/0xa0 [ 130.231575] __do_sys_delete_module.constprop.0+0x178/0x280 [ 130.237157] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [ 130.242652] do_syscall_64+0x5c/0x90 [ 130.246240] ? exc_page_fault+0x62/0x150 [ 130.250178] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 130.255243] RIP: 0033:0x7f6463a3f5ab [ 130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 [ 130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab [ 130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8 [ 130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000 [ 130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8 [ 130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8 [ 130.320875] </TASK> [ 130.323081] ---[ end trace eff7156d56b5cf25 ]--- cat /sys/class/dma/dma0chan*/in_use would get the wrong result. 2 2 2 Fixes: d2f4f99db3e9 ("dmaengine: Rework dma_chan_get") Signed-off-by: Koba Ko <koba.ko(a)canonical.com> Reviewed-by: Jie Hai <haijie1(a)huawei.com> Test-by: Jie Hai <haijie1(a)huawei.com> Reviewed-by: Jerry Snitselaar <jsnitsel(a)redhat.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Tested-by: Joel Savitz <jsavitz(a)redhat.com> Link: https://lore.kernel.org/r/20221201030050.978595-1-koba.ko@canonical.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/dma/dmaengine.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index f1a441ab395d..450b1c4b2129 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -223,7 +223,8 @@ static int dma_chan_get(struct dma_chan *chan) /* The channel is already in use, update client count */ if (chan->client_count) { __module_get(owner); - goto out; + chan->client_count++; + return 0; } if (!try_module_get(owner)) @@ -236,11 +237,11 @@ static int dma_chan_get(struct dma_chan *chan) goto err_out; } + chan->client_count++; + if (!dma_has_cap(DMA_PRIVATE, chan->device->cap_mask)) balance_ref_count(chan); -out: - chan->client_count++; return 0; err_out: -- 2.34.1

2 1

[PATCH OLK-6.6] scsi: ufs: core: bsg: Fix crash when arpmb command fails
by Xiangwei Li 02 Apr '25

02 Apr '25

From: Arthur Simchaev <arthur.simchaev(a)sandisk.com> stable inclusion from stable-v6.6.81 commit 32fb5ec825f6f76bc28902181c65429a904a07fe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVSZ CVE: CVE-2025-21873 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f27a95845b01e86d67c8b014b4f41bd3327daa63 upstream. If the device doesn't support arpmb we'll crash due to copying user data in bsg_transport_sg_io_fn(). In the case where ufs_bsg_exec_advanced_rpmb_req() returns an error, do not set the job's reply_len. Memory crash backtrace: 3,1290,531166405,-;ufshcd 0000:00:12.5: ARPMB OP failed: error code -22 4,1308,531166555,-;Call Trace: 4,1309,531166559,-; <TASK> 4,1310,531166565,-; ? show_regs+0x6d/0x80 4,1311,531166575,-; ? die+0x37/0xa0 4,1312,531166583,-; ? do_trap+0xd4/0xf0 4,1313,531166593,-; ? do_error_trap+0x71/0xb0 4,1314,531166601,-; ? usercopy_abort+0x6c/0x80 4,1315,531166610,-; ? exc_invalid_op+0x52/0x80 4,1316,531166622,-; ? usercopy_abort+0x6c/0x80 4,1317,531166630,-; ? asm_exc_invalid_op+0x1b/0x20 4,1318,531166643,-; ? usercopy_abort+0x6c/0x80 4,1319,531166652,-; __check_heap_object+0xe3/0x120 4,1320,531166661,-; check_heap_object+0x185/0x1d0 4,1321,531166670,-; __check_object_size.part.0+0x72/0x150 4,1322,531166679,-; __check_object_size+0x23/0x30 4,1323,531166688,-; bsg_transport_sg_io_fn+0x314/0x3b0 Fixes: 6ff265fc5ef6 ("scsi: ufs: core: bsg: Add advanced RPMB support in ufs_bsg") Cc: stable(a)vger.kernel.org Reviewed-by: Bean Huo <beanhuo(a)micron.com> Signed-off-by: Arthur Simchaev <arthur.simchaev(a)sandisk.com> Link: https://lore.kernel.org/r/20250220142039.250992-1-arthur.simchaev@sandisk.c… Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- drivers/ufs/core/ufs_bsg.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c index 8fbd46cd8c2b..0043d69077b6 100644 --- a/drivers/ufs/core/ufs_bsg.c +++ b/drivers/ufs/core/ufs_bsg.c @@ -194,10 +194,12 @@ static int ufs_bsg_request(struct bsg_job *job) ufshcd_rpm_put_sync(hba); kfree(buff); bsg_reply->result = ret; - job->reply_len = !rpmb ? sizeof(struct ufs_bsg_reply) : sizeof(struct ufs_rpmb_reply); /* complete the job here only if no error */ - if (ret == 0) + if (ret == 0) { + job->reply_len = rpmb ? sizeof(struct ufs_rpmb_reply) : + sizeof(struct ufs_bsg_reply); bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len); + } return ret; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] EDAC/highbank: Fix memory leak in highbank_mc_probe()
by Xiangwei Li 02 Apr '25

02 Apr '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.272 commit 0db40e23b56d217eebd385bebb64057ef764b2c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVWI CVE: CVE-2022-49757 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e7a293658c20a7945014570e1921bf7d25d68a36 ] When devres_open_group() fails, it returns -ENOMEM without freeing memory allocated by edac_mc_alloc(). Call edac_mc_free() on the error handling path to avoid a memory leak. [ bp: Massage commit message. ] Fixes: a1b01edb2745 ("edac: add support for Calxeda highbank memory controller") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Andre Przywara <andre.przywara(a)arm.com> Link: https://lore.kernel.org/r/20221229054825.1361993-1-linmq006@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- drivers/edac/highbank_mc_edac.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/edac/highbank_mc_edac.c b/drivers/edac/highbank_mc_edac.c index 6092e61be605..bcf41601a977 100644 --- a/drivers/edac/highbank_mc_edac.c +++ b/drivers/edac/highbank_mc_edac.c @@ -185,8 +185,10 @@ static int highbank_mc_probe(struct platform_device *pdev) drvdata = mci->pvt_info; platform_set_drvdata(pdev, mci); - if (!devres_open_group(&pdev->dev, NULL, GFP_KERNEL)) - return -ENOMEM; + if (!devres_open_group(&pdev->dev, NULL, GFP_KERNEL)) { + res = -ENOMEM; + goto free; + } r = platform_get_resource(pdev, IORESOURCE_MEM, 0); if (!r) { @@ -254,6 +256,7 @@ static int highbank_mc_probe(struct platform_device *pdev) edac_mc_del_mc(&pdev->dev); err: devres_release_group(&pdev->dev, NULL); +free: edac_mc_free(mci); return res; } -- 2.25.1

2 1

[PATCH OLK-5.10] uprobes: Reject the shared zeropage in uprobe_write_opcode()
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Tong Tiangen <tongtiangen(a)huawei.com> mainline inclusion from mainline-v6.14-rc5 commit bddf10d26e6e5114e7415a0e442ec6f51a559468 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVTY CVE: CVE-2025-21881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We triggered the following crash in syzkaller tests: BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3 flags: 0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff) raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_unref_page_prepare+0x401/0x500 free_unref_page+0x6d/0x1b0 uprobe_write_opcode+0x460/0x8e0 install_breakpoint.part.0+0x51/0x80 register_for_each_vma+0x1d9/0x2b0 __uprobe_register+0x245/0x300 bpf_uprobe_multi_link_attach+0x29b/0x4f0 link_create+0x1e2/0x280 __sys_bpf+0x75f/0xac0 __x64_sys_bpf+0x1a/0x30 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2 BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1 The following syzkaller test case can be used to reproduce: r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000120000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40) The cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage() and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and old_folio's refcount. Therefore, two bugs are introduced: 1. The RSS count is incorrect, when process exit, the check_mm() report error "Bad rss-count". 2. The reserved folio (zero folio) is freed when folio->refcount is zero, then free_pages_prepare->free_page_is_bad() report error "Bad page state". There is more, the following warning could also theoretically be triggered: __replace_page() -> ... -> folio_remove_rmap_pte() -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio) Considering that uprobe hit on the zero folio is a very rare case, just reject zero old folio immediately after get_user_page_vma_remote(). [ mingo: Cleaned up the changelog ] Fixes: 7396fa818d62 ("uprobes/core: Make background page replacement logic account for rss_stat counters") Fixes: 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Oleg Nesterov <oleg(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Link: https://lore.kernel.org/r/20250224031149.1598949-1-tongtiangen@huawei.com Conflict: kernel/events/uprobes.c [c8070b787519 ('mm: Don't pin ZERO_PAGE in pin_user_pages()') is not merged, use is_zero_pfn instead of is_zero_page.] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/events/uprobes.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index e045b12662f1..8a6c5ee003c2 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -488,6 +488,11 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm, if (ret <= 0) goto put_old; + if (is_zero_pfn(page_to_pfn(old_page))) { + ret = -EINVAL; + goto put_old; + } + if (WARN(!is_register && PageCompound(old_page), "uprobe unregister should never work on compound page\n")) { ret = -EINVAL; -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] Fix kmemleak false positive
by Lin Yujun 02 Apr '25

02 Apr '25

Waiman Long (1): efi/arm64: Fix kmemleak false positive in arm64_efi_rt_init() arch/arm64/kernel/efi.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] Fix kmemleak false positive
by Lin Yujun 02 Apr '25

02 Apr '25

Waiman Long (1): efi/arm64: Fix kmemleak false positive in arm64_efi_rt_init() arch/arm64/kernel/efi.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10] powerpc: Fix save r13 on kprobe/ftrace entry
by Chen Zhongjin 02 Apr '25

02 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY4FQ -------------------------------- In kprobe and ftrace entry, r13 will be saved to stack and restored after handler. There is a period between entry and handler where the task can be scheduled, then the r13 for one cpu will be restored to another cpu, and cause the paca_ptrs wrong. Fix this by stop saving and restoring r13 in kprobe/ftrace entry. Fixes: 51c9c0843993 ("powerpc/kprobes: Implement Optprobes") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- arch/powerpc/kernel/optprobes_head.S | 10 ++++++---- arch/powerpc/kernel/trace/ftrace_64_mprofile.S | 10 ++++++---- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/arch/powerpc/kernel/optprobes_head.S b/arch/powerpc/kernel/optprobes_head.S index ff8ba4d3824d..9d803cc2392f 100644 --- a/arch/powerpc/kernel/optprobes_head.S +++ b/arch/powerpc/kernel/optprobes_head.S @@ -36,8 +36,9 @@ optprobe_template_entry: addi r0,r1,INT_FRAME_SIZE std r0,GPR1(r1) SAVE_10GPRS(2,r1) - SAVE_10GPRS(12,r1) - SAVE_10GPRS(22,r1) + SAVE_GPR(12,r1) + SAVE_10GPRS(14,r1) + SAVE_8GPRS(24,r1) /* Save SPRS */ mfmsr r5 std r5,_MSR(r1) @@ -119,8 +120,9 @@ optprobe_template_call_emulate: mtcr r5 REST_GPR(0,r1) REST_10GPRS(2,r1) - REST_10GPRS(12,r1) - REST_10GPRS(22,r1) + REST_GPR(12,r1) + REST_10GPRS(14,r1) + REST_8GPRS(24,r1) /* Restore the previous SP */ addi r1,r1,INT_FRAME_SIZE diff --git a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S index 0bc39ff53233..32e354d9ee9b 100644 --- a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S +++ b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S @@ -51,8 +51,9 @@ _GLOBAL(ftrace_regs_caller) cmpdi r3, 0 beq ftrace_no_trace - SAVE_10GPRS(12, r1) - SAVE_10GPRS(22, r1) + SAVE_GPR(12,r1) + SAVE_10GPRS(14,r1) + SAVE_8GPRS(24,r1) /* Save previous stack pointer (r1) */ addi r8, r1, SWITCH_FRAME_SIZE+STACK_FRAME_MIN_SIZE @@ -115,8 +116,9 @@ ftrace_regs_call: /* Restore gprs */ REST_GPR(0,r1) REST_10GPRS(2,r1) - REST_10GPRS(12,r1) - REST_10GPRS(22,r1) + REST_GPR(12,r1) + REST_10GPRS(14,r1) + REST_8GPRS(24,r1) /* Restore possibly modified LR */ ld r0, _LINK(r1) -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1537/1537] kernel/seccomp.o: warning: objtool: do_seccomp()+0xa8a: unreachable instruction
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7951fd324625a8af5097e1476cdc8c33c6009b48 commit: e5d58f5ee731b2ff4e5c801cb875c804c63593e4 [1537/1537] seccomp: Invalidate seccomp mode to catch death failures config: x86_64-buildonly-randconfig-004-20250331 (https://download.01.org/0day-ci/archive/20250402/202504021615.GKzmsAcB-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021615.GKzmsAcB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021615.GKzmsAcB-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/seccomp.c:190: warning: Function parameter or member 'ret' not described in 'ACTION_ONLY' kernel/seccomp.c:190: warning: Excess function parameter 'sd' description in 'ACTION_ONLY' kernel/seccomp.c:190: warning: Excess function parameter 'match' description in 'ACTION_ONLY' kernel/seccomp.c:320: warning: Function parameter or member 'flags' not described in 'seccomp_sync_threads' >> kernel/seccomp.o: warning: objtool: do_seccomp()+0xa8a: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.15-rc1 commit 2c118f50d7fd4d9aefc4533a26f83338b2906b7a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYAPJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit: 2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again") was intended to ensure alignment of the stack pointer; but it also moved the initialization of the "stack" variable down into the loop header. This was likely intended as a no-op cleanup, since the commit message does not mention it; however, this caused a behavioral change because the value of "regs" is different between the two places. Originally, get_stack_pointer() used the regs provided by the caller; after that commit, get_stack_pointer() instead uses the regs at the top of the stack frame the unwinder is looking at. Often, there are no such regs at all, and "regs" is NULL, causing get_stack_pointer() to fall back to the task's current stack pointer, which is not what we want here, but probably happens to mostly work. Other times, the original regs will point to another regs frame - in that case, the linear guess unwind logic in show_trace_log_lvl() will start unwinding too far up the stack, causing the first frame found by the proper unwinder to never be visited, resulting in a stack trace consisting purely of guess lines. Fix it by moving the "stack = " assignment back where it belongs. Fixes: 2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20250325-2025-03-unwind-fixes-v1-2-acd774364768@g… Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- arch/x86/kernel/dumpstack.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c index f18ca44c904b..52dc5839d1e8 100644 --- a/arch/x86/kernel/dumpstack.c +++ b/arch/x86/kernel/dumpstack.c @@ -195,6 +195,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, printk("%sCall Trace:\n", log_lvl); unwind_start(&state, task, regs, stack); + stack = stack ?: get_stack_pointer(task, regs); regs = unwind_get_entry_regs(&state, &partial); /* @@ -213,9 +214,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, * - hardirq stack * - entry stack */ - for (stack = stack ?: get_stack_pointer(task, regs); - stack; - stack = stack_info.next_sp) { + for (; stack; stack = stack_info.next_sp) { const char *stack_name; stack = PTR_ALIGN(stack, sizeof(long)); -- 2.25.1

2 1

[PATCH v3 OLK-6.6 0/6] Support the FEAT_HDBSS introduced in Armv9.5
by Zhenyu Ye 02 Apr '25

02 Apr '25

From: eillon <yezhenyu2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB103D CVE: NA ---------------------------------------------------------------------- This series of patches add support to the Hardware Dirty state tracking Structure(HDBSS) feature, which is introduced by the ARM architecture in the DDI0601(ID121123) version. The HDBSS feature is an extension to the architecture that enhances tracking translation table descriptors' dirty state, identified as FEAT_HDBSS. The goal of this feature is to reduce the cost of surveying for dirtied granules, with minimal effect on recording when a granule has been dirtied. The purpose of this feature is to make the execution overhead of live migration lower to both the guest and the host, compared to existing approaches (write-protect or search stage 2 tables). After these patches, users(such as qemu) can use the KVM_CAP_ARM_HW_DIRTY_STATE_TRACK ioctl to enable or disable the HDBSS feature before and after the live migration. Changes in v3: - fix kabi broken Changes in v2: - adapt the commit format See patches for details, Thanks. eillon (5): arm64/sysreg: add HDBSS related register information arm64/kvm: support set the DBM attr during memory abort arm64/kvm: using ioctl to enable/disable the HDBSS feature arm64/kvm: support to handle the HDBSSF event arm64/config: add config to control whether enable HDBSS feature arch/arm64/Kconfig | 12 ++++ arch/arm64/configs/openeuler_defconfig | 6 ++ arch/arm64/include/asm/cpufeature.h | 14 ++++ arch/arm64/include/asm/esr.h | 2 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 8 +++ arch/arm64/include/asm/kvm_mmu.h | 14 ++++ arch/arm64/include/asm/kvm_pgtable.h | 1 + arch/arm64/include/asm/sysreg.h | 14 ++++ arch/arm64/kvm/arm.c | 88 ++++++++++++++++++++++++++ arch/arm64/kvm/handle_exit.c | 50 +++++++++++++++ arch/arm64/kvm/hyp/pgtable.c | 12 ++++ arch/arm64/kvm/hyp/vhe/switch.c | 3 + arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 4 ++ arch/arm64/kvm/mmu.c | 17 ++++- arch/arm64/kvm/reset.c | 9 +++ arch/arm64/tools/sysreg | 28 ++++++++ include/linux/kvm_host.h | 3 + include/uapi/linux/kvm.h | 2 + tools/include/uapi/linux/kvm.h | 2 + 20 files changed, 289 insertions(+), 1 deletion(-) -- 2.39.3

2 7

[PATCH OLK-5.10] x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.15-rc1 commit 2c118f50d7fd4d9aefc4533a26f83338b2906b7a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYAPJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit: 2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again") was intended to ensure alignment of the stack pointer; but it also moved the initialization of the "stack" variable down into the loop header. This was likely intended as a no-op cleanup, since the commit message does not mention it; however, this caused a behavioral change because the value of "regs" is different between the two places. Originally, get_stack_pointer() used the regs provided by the caller; after that commit, get_stack_pointer() instead uses the regs at the top of the stack frame the unwinder is looking at. Often, there are no such regs at all, and "regs" is NULL, causing get_stack_pointer() to fall back to the task's current stack pointer, which is not what we want here, but probably happens to mostly work. Other times, the original regs will point to another regs frame - in that case, the linear guess unwind logic in show_trace_log_lvl() will start unwinding too far up the stack, causing the first frame found by the proper unwinder to never be visited, resulting in a stack trace consisting purely of guess lines. Fix it by moving the "stack = " assignment back where it belongs. Fixes: 2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20250325-2025-03-unwind-fixes-v1-2-acd774364768@g… Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- arch/x86/kernel/dumpstack.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c index b726174024da..d9cbcdbdf1e0 100644 --- a/arch/x86/kernel/dumpstack.c +++ b/arch/x86/kernel/dumpstack.c @@ -195,6 +195,7 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, printk("%sCall Trace:\n", log_lvl); unwind_start(&state, task, regs, stack); + stack = stack ?: get_stack_pointer(task, regs); regs = unwind_get_entry_regs(&state, &partial); /* @@ -213,9 +214,7 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, * - hardirq stack * - entry stack */ - for (stack = stack ?: get_stack_pointer(task, regs); - stack; - stack = stack_info.next_sp) { + for (; stack; stack = stack_info.next_sp) { const char *stack_name; stack = PTR_ALIGN(stack, sizeof(long)); -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] Sync two patches to olk
by Chen Zhongjin 02 Apr '25

02 Apr '25

See: https://gitee.com/openeuler/kernel/issues/IBY4FJ https://gitee.com/openeuler/kernel/issues/IBY4FQ Chen Zhongjin (2): kprobes: Fix deadlock when unwinding kretprobe_trampoline powerpc: Fix save r13 on kprobe/ftrace entry arch/powerpc/kernel/optprobes_head.S | 10 ++++++---- arch/powerpc/kernel/trace/ftrace_64_mprofile.S | 10 ++++++---- kernel/kprobes.c | 9 +++++++-- 3 files changed, 19 insertions(+), 10 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS V1 0/2] fix-CVE-2022-49538
by Cheng Yu 02 Apr '25

02 Apr '25

fix-CVE-2022-49538 Amadeusz Sławiński (1): ALSA: jack: Access input_dev under mutex Takashi Iwai (1): ALSA: jack: Fix mutex call in snd_jack_report() include/sound/jack.h | 1 + sound/core/jack.c | 39 +++++++++++++++++++++++++++++---------- 2 files changed, 30 insertions(+), 10 deletions(-) -- 2.25.1

2 3

[openeuler:OLK-5.10 2830/2830] fs/ext4/file.o: warning: objtool: ext4_file_write_iter()+0x893: unreachable instruction
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 1a6f72935307d39713f310345f6049fcc3058091 commit: 52c6fec939dd6f0de6d534d8b08ac06be8cfe5c4 [2830/2830] ext4: properly sync file size update after O_SYNC direct IO config: x86_64-buildonly-randconfig-004-20250331 (https://download.01.org/0day-ci/archive/20250402/202504021552.RjBa0DvI-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021552.RjBa0DvI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021552.RjBa0DvI-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/ext4/file.o: warning: objtool: ext4_file_write_iter()+0x893: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] perf/core: Fix pmus_lock vs. pmus_srcu ordering
by Luo Gengkun 02 Apr '25

02 Apr '25

From: Peter Zijlstra <peterz(a)infradead.org> stable inclusion from stable-v6.6.83 commit 7c823e4c30d6fdc16089e13924260086eaea76be category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBXQNU Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2565e42539b120b81a68a58da961ce5d1e34eac8 ] Commit a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") placed pmus_lock inside pmus_srcu, this makes perf_pmu_unregister() trip lockdep. Move the locking about such that only pmu_idr and pmus (list) are modified while holding pmus_lock. This avoids doing synchronize_srcu() while holding pmus_lock and all is well again. Fixes: a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20241104135517.679556858@infradead.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 0b9e703641d1..9b5d35c4a3ec 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -11670,6 +11670,8 @@ void perf_pmu_unregister(struct pmu *pmu) { mutex_lock(&pmus_lock); list_del_rcu(&pmu->entry); + idr_remove(&pmu_idr, pmu->type); + mutex_unlock(&pmus_lock); /* * We dereference the pmu list under both SRCU and regular RCU, so @@ -11679,7 +11681,6 @@ void perf_pmu_unregister(struct pmu *pmu) synchronize_rcu(); free_percpu(pmu->pmu_disable_count); - idr_remove(&pmu_idr, pmu->type); if (pmu_bus_running && pmu->dev && pmu->dev != PMU_NULL_DEV) { if (pmu->nr_addr_filters) device_remove_file(pmu->dev, &dev_attr_nr_addr_filters); @@ -11687,7 +11688,6 @@ void perf_pmu_unregister(struct pmu *pmu) put_device(pmu->dev); } free_pmu_context(pmu); - mutex_unlock(&pmus_lock); } EXPORT_SYMBOL_GPL(perf_pmu_unregister); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-21963 && CVE-2025-21964
by Li Lingfeng 02 Apr '25

02 Apr '25

CVE-2025-21963 && CVE-2025-21964 Murad Masimov (2): cifs: Fix integer overflow while processing acregmax mount option cifs: Fix integer overflow while processing acdirmax mount option fs/smb/client/fs_context.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- 2.31.1

2 3

[PATCH OLK-6.6] tracing: Fix bad hist from corrupting named_triggers list
by Tengda Wu 02 Apr '25

02 Apr '25

From: Steven Rostedt <rostedt(a)goodmis.org> stable inclusion from stable-v6.6.81 commit 43b254d46c740bf9dbe65709afa021dd726dfa99 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY44G CVE: CVE-2025-21899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e upstream. The following commands causes a crash: ~# cd /sys/kernel/tracing/events/rcu/rcu_callback ~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=bad:keys=common_pid' > trigger Because the following occurs: event_trigger_write() { trigger_process_regex() { event_hist_trigger_parse() { data = event_trigger_alloc(..); event_trigger_register(.., data) { cmd_ops->reg(.., data, ..) [hist_register_trigger()] { data->ops->init() [event_hist_trigger_init()] { save_named_trigger(name, data) { list_add(&data->named_list, &named_triggers); } } } } ret = create_actions(); (return -EINVAL) if (ret) goto out_unreg; [..] ret = hist_trigger_enable(data, ...) { list_add_tail_rcu(&data->list, &file->triggers); <<<---- SKIPPED!!! (this is important!) [..] out_unreg: event_hist_unregister(.., data) { cmd_ops->unreg(.., data, ..) [hist_unregister_trigger()] { list_for_each_entry(iter, &file->triggers, list) { if (!hist_trigger_match(data, iter, named_data, false)) <- never matches continue; [..] test = iter; } if (test && test->ops->free) <<<-- test is NULL test->ops->free(test) [event_hist_trigger_free()] { [..] if (data->name) del_named_trigger(data) { list_del(&data->named_list); <<<<-- NEVER gets removed! } } } } [..] kfree(data); <<<-- frees item but it is still on list The next time a hist with name is registered, it causes an u-a-f bug and the kernel can crash. Move the code around such that if event_trigger_register() succeeds, the next thing called is hist_trigger_enable() which adds it to the list. A bunch of actions is called if get_named_trigger_data() returns false. But that doesn't need to be called after event_trigger_register(), so it can be moved up, allowing event_trigger_register() to be called just before hist_trigger_enable() keeping them together and allowing the file->triggers to be properly populated. Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20250227163944.1c37f85f@gandalf.local.home Fixes: 067fe038e70f6 ("tracing: Add variable reference handling to hist triggers") Reported-by: Tomas Glozar <tglozar(a)redhat.com> Tested-by: Tomas Glozar <tglozar(a)redhat.com> Reviewed-by: Tom Zanussi <zanussi(a)kernel.org> Closes: https://lore.kernel.org/all/CAP4=nvTsxjckSBTz=Oe_UYh8keD9_sZC4i++4h72mJLic4… Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events_hist.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index dd16faf0d150..604d63380a90 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -6660,27 +6660,27 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops, if (existing_hist_update_only(glob, trigger_data, file)) goto out_free; - ret = event_trigger_register(cmd_ops, file, glob, trigger_data); - if (ret < 0) - goto out_free; + if (!get_named_trigger_data(trigger_data)) { - if (get_named_trigger_data(trigger_data)) - goto enable; + ret = create_actions(hist_data); + if (ret) + goto out_free; - ret = create_actions(hist_data); - if (ret) - goto out_unreg; + if (has_hist_vars(hist_data) || hist_data->n_var_refs) { + ret = save_hist_vars(hist_data); + if (ret) + goto out_free; + } - if (has_hist_vars(hist_data) || hist_data->n_var_refs) { - ret = save_hist_vars(hist_data); + ret = tracing_map_init(hist_data->map); if (ret) - goto out_unreg; + goto out_free; } - ret = tracing_map_init(hist_data->map); - if (ret) - goto out_unreg; -enable: + ret = event_trigger_register(cmd_ops, file, glob, trigger_data); + if (ret < 0) + goto out_free; + ret = hist_trigger_enable(trigger_data, file); if (ret) goto out_unreg; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
by Pu Lehui 02 Apr '25

02 Apr '25

From: Luis Gerhorst <gerhorst(a)cs.fau.de> stable inclusion from stable-v4.19.272 commit aae109414a57ab4164218f36e2e4a17f027fcaaa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVYS CVE: CVE-2023-53024 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e4f4db47794c9f474b184ee1418f42e6a07412b6 ] To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") inserts lfence instructions after 1) initializing a stack slot and 2) spilling a pointer to the stack. However, this does not cover cases where a stack slot is first initialized with a pointer (subject to sanitization) but then overwritten with a scalar (not subject to sanitization because the slot was already initialized). In this case, the second write may be subject to speculative store bypass (SSB) creating a speculative pointer-as-scalar type confusion. This allows the program to subsequently leak the numerical pointer value using, for example, a branch-based cache side channel. To fix this, also sanitize scalars if they write a stack slot that previously contained a pointer. Assuming that pointer-spills are only generated by LLVM on register-pressure, the performance impact on most real-world BPF programs should be small. The following unprivileged BPF bytecode drafts a minimal exploit and the mitigation: [...] // r6 = 0 or 1 (skalar, unknown user input) // r7 = accessible ptr for side channel // r10 = frame pointer (fp), to be leaked // r9 = r10 # fp alias to encourage ssb *(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked // lfence added here because of pointer spill to stack. // // Ommitted: Dummy bpf_ringbuf_output() here to train alias predictor // for no r9-r10 dependency. // *(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr // 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID, // store may be subject to SSB // // fix: also add an lfence when the slot contained a ptr // r8 = *(u64 *)(r9 - 8) // r8 = architecturally a scalar, speculatively a ptr // // leak ptr using branch-based cache side channel: r8 &= 1 // choose bit to leak if r8 == 0 goto SLOW // no mispredict // architecturally dead code if input r6 is 0, // only executes speculatively iff ptr bit is 1 r8 = *(u64 *)(r7 + 0) # encode bit in cache (0: slow, 1: fast) SLOW: [...] After running this, the program can time the access to *(r7 + 0) to determine whether the chosen pointer bit was 0 or 1. Repeat this 64 times to recover the whole address on amd64. In summary, sanitization can only be skipped if one scalar is overwritten with another scalar. Scalar-confusion due to speculative store bypass can not lead to invalid accesses because the pointer bounds deducted during verification are enforced using branchless logic. See 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic") for details. Do not make the mitigation depend on !env->allow_{uninit_stack,ptr_leaks} because speculative leaks are likely unexpected if these were enabled. For example, leaking the address to a protected log file may be acceptable while disabling the mitigation might unintentionally leak the address into the cached-state of a map that is accessible to unprivileged processes. Fixes: 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") Signed-off-by: Luis Gerhorst <gerhorst(a)cs.fau.de> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Henriette Hofmeier <henriette.hofmeier(a)rub.de> Link: https://lore.kernel.org/bpf/edc95bad-aada-9cfc-ffe2-fa9bb206583c@cs.fau.de Link: https://lore.kernel.org/bpf/20230109150544.41465-1-gerhorst@cs.fau.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index c3c592654cf1..e00cb52fb480 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -1013,7 +1013,9 @@ static int check_stack_write(struct bpf_verifier_env *env, bool sanitize = reg && is_spillable_regtype(reg->type); for (i = 0; i < size; i++) { - if (state->stack[spi].slot_type[i] == STACK_INVALID) { + u8 type = state->stack[spi].slot_type[i]; + + if (type != STACK_MISC && type != STACK_ZERO) { sanitize = true; break; } -- 2.34.1

2 1

[PATCH OLK-6.6] HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
by Pu Lehui 02 Apr '25

02 Apr '25

From: Zhang Lixu <lixu.zhang(a)intel.com> stable inclusion from stable-v6.6.83 commit 560f4d1299342504a6ab8a47f575b5e6b8345ada category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY43Y CVE: CVE-2025-21928 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 07583a0010696a17fb0942e0b499a62785c5fc9f ] The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory. This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed. Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver") Signed-off-by: Zhang Lixu <lixu.zhang(a)intel.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/hid/intel-ish-hid/ishtp-hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.c b/drivers/hid/intel-ish-hid/ishtp-hid.c index 00c6f0ebf356..be2c62fc8251 100644 --- a/drivers/hid/intel-ish-hid/ishtp-hid.c +++ b/drivers/hid/intel-ish-hid/ishtp-hid.c @@ -261,12 +261,14 @@ int ishtp_hid_probe(unsigned int cur_hid_dev, */ void ishtp_hid_remove(struct ishtp_cl_data *client_data) { + void *data; int i; for (i = 0; i < client_data->num_hid_devices; ++i) { if (client_data->hid_sensor_hubs[i]) { - kfree(client_data->hid_sensor_hubs[i]->driver_data); + data = client_data->hid_sensor_hubs[i]->driver_data; hid_destroy_device(client_data->hid_sensor_hubs[i]); + kfree(data); client_data->hid_sensor_hubs[i] = NULL; } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] ALSA: jack: Access input_dev under mutex
by Cheng Yu 02 Apr '25

02 Apr '25

From: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> stable inclusion from stable-v4.19.247 commit c093b62c40027c21d649c5534ad7aa3605a99b00 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3KT CVE: CVE-2022-49538 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1b6a6fc5280e97559287b61eade2d4b363e836f2 ] It is possible when using ASoC that input_dev is unregistered while calling snd_jack_report, which causes NULL pointer dereference. In order to prevent this serialize access to input_dev using mutex lock. Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> Reviewed-by: Cezary Rojewski <cezary.rojewski(a)intel.com> Link: https://lore.kernel.org/r/20220412091628.3056922-1-amadeuszx.slawinski@linu… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: sound/core/jack.c [Context conflicts.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- include/sound/jack.h | 1 + sound/core/jack.c | 34 +++++++++++++++++++++++++++------- 2 files changed, 28 insertions(+), 7 deletions(-) diff --git a/include/sound/jack.h b/include/sound/jack.h index 1e84bfb553cf..4742f842b457 100644 --- a/include/sound/jack.h +++ b/include/sound/jack.h @@ -77,6 +77,7 @@ struct snd_jack { const char *id; #ifdef CONFIG_SND_JACK_INPUT_DEV struct input_dev *input_dev; + struct mutex input_dev_lock; int registered; int type; char name[100]; diff --git a/sound/core/jack.c b/sound/core/jack.c index 84c2a17c56ee..2f43fe667759 100644 --- a/sound/core/jack.c +++ b/sound/core/jack.c @@ -48,8 +48,11 @@ static int snd_jack_dev_disconnect(struct snd_device *device) #ifdef CONFIG_SND_JACK_INPUT_DEV struct snd_jack *jack = device->device_data; - if (!jack->input_dev) + mutex_lock(&jack->input_dev_lock); + if (!jack->input_dev) { + mutex_unlock(&jack->input_dev_lock); return 0; + } /* If the input device is registered with the input subsystem * then we need to use a different deallocator. */ @@ -58,6 +61,7 @@ static int snd_jack_dev_disconnect(struct snd_device *device) else input_free_device(jack->input_dev); jack->input_dev = NULL; + mutex_unlock(&jack->input_dev_lock); #endif /* CONFIG_SND_JACK_INPUT_DEV */ return 0; } @@ -93,8 +97,11 @@ static int snd_jack_dev_register(struct snd_device *device) snprintf(jack->name, sizeof(jack->name), "%s %s", card->shortname, jack->id); - if (!jack->input_dev) + mutex_lock(&jack->input_dev_lock); + if (!jack->input_dev) { + mutex_unlock(&jack->input_dev_lock); return 0; + } jack->input_dev->name = jack->name; @@ -119,6 +126,7 @@ static int snd_jack_dev_register(struct snd_device *device) if (err == 0) jack->registered = 1; + mutex_unlock(&jack->input_dev_lock); return err; } #endif /* CONFIG_SND_JACK_INPUT_DEV */ @@ -235,9 +243,11 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, jack->id = kstrdup(id, GFP_KERNEL); - /* don't creat input device for phantom jack */ - if (!phantom_jack) { #ifdef CONFIG_SND_JACK_INPUT_DEV + mutex_init(&jack->input_dev_lock); + + /* don't create input device for phantom jack */ + if (!phantom_jack) { int i; jack->input_dev = input_allocate_device(); @@ -255,8 +265,8 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, input_set_capability(jack->input_dev, EV_SW, jack_switch_types[i]); -#endif /* CONFIG_SND_JACK_INPUT_DEV */ } +#endif /* CONFIG_SND_JACK_INPUT_DEV */ err = snd_device_new(card, SNDRV_DEV_JACK, jack, &ops); if (err < 0) @@ -296,10 +306,14 @@ EXPORT_SYMBOL(snd_jack_new); void snd_jack_set_parent(struct snd_jack *jack, struct device *parent) { WARN_ON(jack->registered); - if (!jack->input_dev) + mutex_lock(&jack->input_dev_lock); + if (!jack->input_dev) { + mutex_unlock(&jack->input_dev_lock); return; + } jack->input_dev->dev.parent = parent; + mutex_unlock(&jack->input_dev_lock); } EXPORT_SYMBOL(snd_jack_set_parent); @@ -347,6 +361,8 @@ EXPORT_SYMBOL(snd_jack_set_key); /** * snd_jack_report - Report the current status of a jack + * Note: This function uses mutexes and should be called from a + * context which can sleep (such as a workqueue). * * @jack: The jack to report status for * @status: The current status of the jack @@ -366,8 +382,11 @@ void snd_jack_report(struct snd_jack *jack, int status) status & jack_kctl->mask_bits); #ifdef CONFIG_SND_JACK_INPUT_DEV - if (!jack->input_dev) + mutex_lock(&jack->input_dev_lock); + if (!jack->input_dev) { + mutex_unlock(&jack->input_dev_lock); return; + } for (i = 0; i < ARRAY_SIZE(jack->key); i++) { int testbit = SND_JACK_BTN_0 >> i; @@ -386,6 +405,7 @@ void snd_jack_report(struct snd_jack *jack, int status) } input_sync(jack->input_dev); + mutex_unlock(&jack->input_dev_lock); #endif /* CONFIG_SND_JACK_INPUT_DEV */ } EXPORT_SYMBOL(snd_jack_report); -- 2.25.1

2 1

[PATCH OLK-6.6] uprobes: Reject the shared zeropage in uprobe_write_opcode()
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Tong Tiangen <tongtiangen(a)huawei.com> stable inclusion from stable-v6.6.81 commit 0b6f19714588cf2366b0364234f97ba963688f63 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVTY CVE: CVE-2025-21881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit bddf10d26e6e5114e7415a0e442ec6f51a559468 ] We triggered the following crash in syzkaller tests: BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3 flags: 0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff) raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_unref_page_prepare+0x401/0x500 free_unref_page+0x6d/0x1b0 uprobe_write_opcode+0x460/0x8e0 install_breakpoint.part.0+0x51/0x80 register_for_each_vma+0x1d9/0x2b0 __uprobe_register+0x245/0x300 bpf_uprobe_multi_link_attach+0x29b/0x4f0 link_create+0x1e2/0x280 __sys_bpf+0x75f/0xac0 __x64_sys_bpf+0x1a/0x30 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2 BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1 The following syzkaller test case can be used to reproduce: r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000120000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40) The cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage() and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and old_folio's refcount. Therefore, two bugs are introduced: 1. The RSS count is incorrect, when process exit, the check_mm() report error "Bad rss-count". 2. The reserved folio (zero folio) is freed when folio->refcount is zero, then free_pages_prepare->free_page_is_bad() report error "Bad page state". There is more, the following warning could also theoretically be triggered: __replace_page() -> ... -> folio_remove_rmap_pte() -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio) Considering that uprobe hit on the zero folio is a very rare case, just reject zero old folio immediately after get_user_page_vma_remote(). [ mingo: Cleaned up the changelog ] Fixes: 7396fa818d62 ("uprobes/core: Make background page replacement logic account for rss_stat counters") Fixes: 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Oleg Nesterov <oleg(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Link: https://lore.kernel.org/r/20250224031149.1598949-1-tongtiangen@huawei.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/events/uprobes.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index a14b0059f177..c135c9704deb 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -483,6 +483,11 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm, if (ret <= 0) goto put_old; + if (is_zero_page(old_page)) { + ret = -EINVAL; + goto put_old; + } + if (WARN(!is_register && PageCompound(old_page), "uprobe unregister should never work on compound page\n")) { ret = -EINVAL; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS V1] ALSA: jack: Fix mutex call in snd_jack_report()
by Cheng Yu 02 Apr '25

02 Apr '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v4.19.291 commit 839f4e860eb6aff659ad05900963cf0410063eda category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3KT CVE: CVE-2022-49538 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 89dbb335cb6a627a4067bc42caa09c8bc3326d40 ] snd_jack_report() is supposed to be callable from an IRQ context, too, and it's indeed used in that way from virtsnd driver. The fix for input_dev race in commit 1b6a6fc5280e ("ALSA: jack: Access input_dev under mutex"), however, introduced a mutex lock in snd_jack_report(), and this resulted in a potential sleep-in-atomic. For addressing that problem, this patch changes the relevant code to use the object get/put and removes the mutex usage. That is, snd_jack_report(), it takes input_get_device() and leaves with input_put_device() for assuring the input_dev being assigned. Although the whole mutex could be reduced, we keep it because it can be still a protection for potential races between creation and deletion. Fixes: 1b6a6fc5280e ("ALSA: jack: Access input_dev under mutex") Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/cf95f7fe-a748-4990-8378-000491b40329@moroto.mount… Tested-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20230706155357.3470-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- sound/core/jack.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/sound/core/jack.c b/sound/core/jack.c index 2f43fe667759..0e26488d8db2 100644 --- a/sound/core/jack.c +++ b/sound/core/jack.c @@ -371,6 +371,7 @@ void snd_jack_report(struct snd_jack *jack, int status) { struct snd_jack_kctl *jack_kctl; #ifdef CONFIG_SND_JACK_INPUT_DEV + struct input_dev *idev; int i; #endif @@ -382,30 +383,28 @@ void snd_jack_report(struct snd_jack *jack, int status) status & jack_kctl->mask_bits); #ifdef CONFIG_SND_JACK_INPUT_DEV - mutex_lock(&jack->input_dev_lock); - if (!jack->input_dev) { - mutex_unlock(&jack->input_dev_lock); + idev = input_get_device(jack->input_dev); + if (!idev) return; - } for (i = 0; i < ARRAY_SIZE(jack->key); i++) { int testbit = SND_JACK_BTN_0 >> i; if (jack->type & testbit) - input_report_key(jack->input_dev, jack->key[i], + input_report_key(idev, jack->key[i], status & testbit); } for (i = 0; i < ARRAY_SIZE(jack_switch_types); i++) { int testbit = 1 << i; if (jack->type & testbit) - input_report_switch(jack->input_dev, + input_report_switch(idev, jack_switch_types[i], status & testbit); } - input_sync(jack->input_dev); - mutex_unlock(&jack->input_dev_lock); + input_sync(idev); + input_put_device(idev); #endif /* CONFIG_SND_JACK_INPUT_DEV */ } EXPORT_SYMBOL(snd_jack_report); -- 2.25.1

2 1

[PATCH OLK-5.10] uprobes: Reject the shared zeropage in uprobe_write_opcode()
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Tong Tiangen <tongtiangen(a)huawei.com> mainline inclusion from mainline-v6.14-rc5 commit bddf10d26e6e5114e7415a0e442ec6f51a559468 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVTY CVE: CVE-2025-21881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We triggered the following crash in syzkaller tests: BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3 flags: 0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff) raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_unref_page_prepare+0x401/0x500 free_unref_page+0x6d/0x1b0 uprobe_write_opcode+0x460/0x8e0 install_breakpoint.part.0+0x51/0x80 register_for_each_vma+0x1d9/0x2b0 __uprobe_register+0x245/0x300 bpf_uprobe_multi_link_attach+0x29b/0x4f0 link_create+0x1e2/0x280 __sys_bpf+0x75f/0xac0 __x64_sys_bpf+0x1a/0x30 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2 BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1 The following syzkaller test case can be used to reproduce: r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000120000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40) The cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage() and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and old_folio's refcount. Therefore, two bugs are introduced: 1. The RSS count is incorrect, when process exit, the check_mm() report error "Bad rss-count". 2. The reserved folio (zero folio) is freed when folio->refcount is zero, then free_pages_prepare->free_page_is_bad() report error "Bad page state". There is more, the following warning could also theoretically be triggered: __replace_page() -> ... -> folio_remove_rmap_pte() -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio) Considering that uprobe hit on the zero folio is a very rare case, just reject zero old folio immediately after get_user_page_vma_remote(). [ mingo: Cleaned up the changelog ] Fixes: 7396fa818d62 ("uprobes/core: Make background page replacement logic account for rss_stat counters") Fixes: 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Oleg Nesterov <oleg(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Link: https://lore.kernel.org/r/20250224031149.1598949-1-tongtiangen@huawei.com Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/events/uprobes.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index e045b12662f1..424b24dd029e 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -488,6 +488,11 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm, if (ret <= 0) goto put_old; + if (is_zero_page(old_page)) { + ret = -EINVAL; + goto put_old; + } + if (WARN(!is_register && PageCompound(old_page), "uprobe unregister should never work on compound page\n")) { ret = -EINVAL; -- 2.25.1

2 1

[PATCH v2 OLK-6.6 0/5] Support the FEAT_HDBSS introduced in Armv9.5
by Zhenyu Ye 02 Apr '25

02 Apr '25

From: eillon <yezhenyu2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB103D CVE: NA ---------------------------------------------------------------------- This series of patches add support to the Hardware Dirty state tracking Structure(HDBSS) feature, which is introduced by the ARM architecture in the DDI0601(ID121123) version. The HDBSS feature is an extension to the architecture that enhances tracking translation table descriptors' dirty state, identified as FEAT_HDBSS. The goal of this feature is to reduce the cost of surveying for dirtied granules, with minimal effect on recording when a granule has been dirtied. The purpose of this feature is to make the execution overhead of live migration lower to both the guest and the host, compared to existing approaches (write-protect or search stage 2 tables). After these patches, users(such as qemu) can use the KVM_CAP_ARM_HW_DIRTY_STATE_TRACK ioctl to enable or disable the HDBSS feature before and after the live migration. Changes in v2: - adapt the commit format See patches for details, Thanks. eillon (5): arm64/sysreg: add HDBSS related register information arm64/kvm: support set the DBM attr during memory abort arm64/kvm: using ioctl to enable/disable the HDBSS feature arm64/kvm: support to handle the HDBSSF event arm64/config: add config to control whether enable HDBSS feature arch/arm64/Kconfig | 12 ++++ arch/arm64/configs/openeuler_defconfig | 6 ++ arch/arm64/include/asm/cpufeature.h | 14 ++++ arch/arm64/include/asm/esr.h | 2 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 8 +++ arch/arm64/include/asm/kvm_mmu.h | 14 ++++ arch/arm64/include/asm/kvm_pgtable.h | 1 + arch/arm64/include/asm/sysreg.h | 14 ++++ arch/arm64/kvm/arm.c | 88 ++++++++++++++++++++++++++ arch/arm64/kvm/handle_exit.c | 50 +++++++++++++++ arch/arm64/kvm/hyp/pgtable.c | 12 ++++ arch/arm64/kvm/hyp/vhe/switch.c | 3 + arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 4 ++ arch/arm64/kvm/mmu.c | 17 ++++- arch/arm64/kvm/reset.c | 9 +++ arch/arm64/tools/sysreg | 28 ++++++++ include/linux/kvm_host.h | 3 + include/uapi/linux/kvm.h | 2 + tools/include/uapi/linux/kvm.h | 2 + 20 files changed, 289 insertions(+), 1 deletion(-) -- 2.39.3

2 6

[PATCH openEuler-1.0-LTS] ftrace: Avoid potential division by zero in function_stat_show()
by Pu Lehui 02 Apr '25

02 Apr '25

From: Nikolay Kuratov <kniv(a)yandex-team.ru> mainline inclusion from mainline-v6.14-rc5 commit a1a7eb89ca0b89dc1c326eeee2596f263291aca3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY5DV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Check whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64} produce zero and skip stddev computation in that case. For now don't care about rec->counter * rec->counter overflow because rec->time * rec->time overflow will likely happen earlier. Cc: stable(a)vger.kernel.org Cc: Wen Yang <wenyang(a)linux.alibaba.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20250206090156.1561783-1-kniv@yandex-team.ru Fixes: e31f7939c1c27 ("ftrace: Avoid potential division by zero in function profiler") Signed-off-by: Nikolay Kuratov <kniv(a)yandex-team.ru> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/ftrace.c [The conflicts were due to some minor issue] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/ftrace.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 36de4ab34431..8199571d9ab3 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -544,6 +544,7 @@ static int function_stat_show(struct seq_file *m, void *v) static struct trace_seq s; unsigned long long avg; unsigned long long stddev; + unsigned long long stddev_denom; #endif mutex_lock(&ftrace_profile_lock); @@ -565,23 +566,19 @@ static int function_stat_show(struct seq_file *m, void *v) #ifdef CONFIG_FUNCTION_GRAPH_TRACER seq_puts(m, " "); - /* Sample standard deviation (s^2) */ - if (rec->counter <= 1) - stddev = 0; - else { - /* - * Apply Welford's method: - * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) - */ + /* + * Variance formula: + * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) + * Maybe Welford's method is better here? + * Divide only by 1000 for ns^2 -> us^2 conversion. + * trace_print_graph_duration will divide by 1000 again. + */ + stddev = 0; + stddev_denom = rec->counter * (rec->counter - 1) * 1000; + if (stddev_denom) { stddev = rec->counter * rec->time_squared - rec->time * rec->time; - - /* - * Divide only 1000 for ns^2 -> us^2 conversion. - * trace_print_graph_duration will divide 1000 again. - */ - stddev = div64_ul(stddev, - rec->counter * (rec->counter - 1) * 1000); + stddev = div64_ul(stddev, stddev_denom); } trace_seq_init(&s); -- 2.34.1

2 1

[PATCH OLK-6.6] ftrace: Avoid potential division by zero in function_stat_show()
by Pu Lehui 02 Apr '25

02 Apr '25

From: Nikolay Kuratov <kniv(a)yandex-team.ru> stable inclusion from stable-v6.6.81 commit f58a3f8e284d0bdf94164a8e61cd4e70d337a1a3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY5DV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a1a7eb89ca0b89dc1c326eeee2596f263291aca3 upstream. Check whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64} produce zero and skip stddev computation in that case. For now don't care about rec->counter * rec->counter overflow because rec->time * rec->time overflow will likely happen earlier. Cc: stable(a)vger.kernel.org Cc: Wen Yang <wenyang(a)linux.alibaba.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20250206090156.1561783-1-kniv@yandex-team.ru Fixes: e31f7939c1c27 ("ftrace: Avoid potential division by zero in function profiler") Signed-off-by: Nikolay Kuratov <kniv(a)yandex-team.ru> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/ftrace.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 1043936b352d..fe26b58e753f 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -538,6 +538,7 @@ static int function_stat_show(struct seq_file *m, void *v) static struct trace_seq s; unsigned long long avg; unsigned long long stddev; + unsigned long long stddev_denom; #endif mutex_lock(&ftrace_profile_lock); @@ -559,23 +560,19 @@ static int function_stat_show(struct seq_file *m, void *v) #ifdef CONFIG_FUNCTION_GRAPH_TRACER seq_puts(m, " "); - /* Sample standard deviation (s^2) */ - if (rec->counter <= 1) - stddev = 0; - else { - /* - * Apply Welford's method: - * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) - */ + /* + * Variance formula: + * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) + * Maybe Welford's method is better here? + * Divide only by 1000 for ns^2 -> us^2 conversion. + * trace_print_graph_duration will divide by 1000 again. + */ + stddev = 0; + stddev_denom = rec->counter * (rec->counter - 1) * 1000; + if (stddev_denom) { stddev = rec->counter * rec->time_squared - rec->time * rec->time; - - /* - * Divide only 1000 for ns^2 -> us^2 conversion. - * trace_print_graph_duration will divide 1000 again. - */ - stddev = div64_ul(stddev, - rec->counter * (rec->counter - 1) * 1000); + stddev = div64_ul(stddev, stddev_denom); } trace_seq_init(&s); -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Add tracepoints with null-able arguments
by Pu Lehui 02 Apr '25

02 Apr '25

From: Jiri Olsa <jolsa(a)kernel.org> mainline inclusion from mainline-v6.15-rc1 commit c83e2d970bae8616b94c40caa43d85f2f2c7d81e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY5DV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Some of the tracepoints slipped when we did the first scan, adding them now. Fixes: 838a10bd2ebf ("bpf: Augment raw_tp arguments with PTR_MAYBE_NULL") Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Link: https://lore.kernel.org/r/20250210175913.2893549-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/btf.c | 99 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 99 insertions(+) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index bbc99401b4e7..39fc33e6368f 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -5997,6 +5997,8 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = { /* rxrpc */ { "rxrpc_recvdata", 0x1 }, { "rxrpc_resend", 0x10 }, + { "rxrpc_tq", 0x10 }, + { "rxrpc_client", 0x1 }, /* sunrpc */ { "xs_stream_read_data", 0x1 }, /* ... from xprt_cong_event event class */ @@ -6017,6 +6019,103 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = { { "mr_integ_alloc", 0x2000 }, /* bpf_testmod */ { "bpf_testmod_test_read", 0x0 }, + /* amdgpu */ + { "amdgpu_vm_bo_map", 0x1 }, + { "amdgpu_vm_bo_unmap", 0x1 }, + /* netfs */ + { "netfs_folioq", 0x1 }, + /* xfs from xfs_defer_pending_class */ + { "xfs_defer_create_intent", 0x1 }, + { "xfs_defer_cancel_list", 0x1 }, + { "xfs_defer_pending_finish", 0x1 }, + { "xfs_defer_pending_abort", 0x1 }, + { "xfs_defer_relog_intent", 0x1 }, + { "xfs_defer_isolate_paused", 0x1 }, + { "xfs_defer_item_pause", 0x1 }, + { "xfs_defer_item_unpause", 0x1 }, + /* xfs from xfs_defer_pending_item_class */ + { "xfs_defer_add_item", 0x1 }, + { "xfs_defer_cancel_item", 0x1 }, + { "xfs_defer_finish_item", 0x1 }, + /* xfs from xfs_icwalk_class */ + { "xfs_ioc_free_eofblocks", 0x10 }, + { "xfs_blockgc_free_space", 0x10 }, + /* xfs from xfs_btree_cur_class */ + { "xfs_btree_updkeys", 0x100 }, + { "xfs_btree_overlapped_query_range", 0x100 }, + /* xfs from xfs_imap_class*/ + { "xfs_map_blocks_found", 0x10000 }, + { "xfs_map_blocks_alloc", 0x10000 }, + { "xfs_iomap_alloc", 0x1000 }, + { "xfs_iomap_found", 0x1000 }, + /* xfs from xfs_fs_class */ + { "xfs_inodegc_flush", 0x1 }, + { "xfs_inodegc_push", 0x1 }, + { "xfs_inodegc_start", 0x1 }, + { "xfs_inodegc_stop", 0x1 }, + { "xfs_inodegc_queue", 0x1 }, + { "xfs_inodegc_throttle", 0x1 }, + { "xfs_fs_sync_fs", 0x1 }, + { "xfs_blockgc_start", 0x1 }, + { "xfs_blockgc_stop", 0x1 }, + { "xfs_blockgc_worker", 0x1 }, + { "xfs_blockgc_flush_all", 0x1 }, + /* xfs_scrub */ + { "xchk_nlinks_live_update", 0x10 }, + /* xfs_scrub from xchk_metapath_class */ + { "xchk_metapath_lookup", 0x100 }, + /* nfsd */ + { "nfsd_dirent", 0x1 }, + { "nfsd_file_acquire", 0x1001 }, + { "nfsd_file_insert_err", 0x1 }, + { "nfsd_file_cons_err", 0x1 }, + /* nfs4 */ + { "nfs4_setup_sequence", 0x1 }, + { "pnfs_update_layout", 0x10000 }, + { "nfs4_inode_callback_event", 0x200 }, + { "nfs4_inode_stateid_callback_event", 0x200 }, + /* nfs from pnfs_layout_event */ + { "pnfs_mds_fallback_pg_init_read", 0x10000 }, + { "pnfs_mds_fallback_pg_init_write", 0x10000 }, + { "pnfs_mds_fallback_pg_get_mirror_count", 0x10000 }, + { "pnfs_mds_fallback_read_done", 0x10000 }, + { "pnfs_mds_fallback_write_done", 0x10000 }, + { "pnfs_mds_fallback_read_pagelist", 0x10000 }, + { "pnfs_mds_fallback_write_pagelist", 0x10000 }, + /* coda */ + { "coda_dec_pic_run", 0x10 }, + { "coda_dec_pic_done", 0x10 }, + /* cfg80211 */ + { "cfg80211_scan_done", 0x11 }, + { "rdev_set_coalesce", 0x10 }, + { "cfg80211_report_wowlan_wakeup", 0x100 }, + { "cfg80211_inform_bss_frame", 0x100 }, + { "cfg80211_michael_mic_failure", 0x10000 }, + /* cfg80211 from wiphy_work_event */ + { "wiphy_work_queue", 0x10 }, + { "wiphy_work_run", 0x10 }, + { "wiphy_work_cancel", 0x10 }, + { "wiphy_work_flush", 0x10 }, + /* hugetlbfs */ + { "hugetlbfs_alloc_inode", 0x10 }, + /* spufs */ + { "spufs_context", 0x10 }, + /* kvm_hv */ + { "kvm_page_fault_enter", 0x100 }, + /* dpu */ + { "dpu_crtc_setup_mixer", 0x100 }, + /* binder */ + { "binder_transaction", 0x100 }, + /* bcachefs */ + { "btree_path_free", 0x100 }, + /* hfi1_tx */ + { "hfi1_sdma_progress", 0x1000 }, + /* iptfs */ + { "iptfs_ingress_postq_event", 0x1000 }, + /* neigh */ + { "neigh_update", 0x10 }, + /* snd_firewire_lib */ + { "amdtp_packet", 0x100 }, }; bool btf_ctx_access(int off, int size, enum bpf_access_type type, -- 2.34.1

2 1

[openeuler:OLK-5.10 2830/2830] fs/xfs/libxfs/xfs_da_btree.o: warning: objtool: xfs_da3_split()+0x787: unreachable instruction
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 411f2e6e24ad11083d85f2ab7324b1f77ad0d371 commit: f2c902d8c653f8021f9761092a27f7b9db42b662 [2830/2830] tracing: Make tracepoint lockdep check actually test something config: x86_64-buildonly-randconfig-004-20250331 (https://download.01.org/0day-ci/archive/20250402/202504021010.h7TdpCwx-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021010.h7TdpCwx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021010.h7TdpCwx-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/xfs/libxfs/xfs_da_btree.o: warning: objtool: xfs_da3_split()+0x787: unreachable instruction -- >> fs/xfs/libxfs/xfs_attr_leaf.o: warning: objtool: xfs_attr3_leaf_split()+0x2da: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] dmaengine: Fix double increment of client_count in dma_chan_get()
by Xiaomeng Zhang 02 Apr '25

02 Apr '25

From: Koba Ko <koba.ko(a)canonical.com> stable inclusion from stable-v4.19.272 commit c6221afe573413fd2981e291f7df4a58283e0654 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBWVX7 CVE: CVE-2022-49753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f3dc1b3b4750851a94212dba249703dd0e50bb20 ] The first time dma_chan_get() is called for a channel the channel client_count is incorrectly incremented twice for public channels, first in balance_ref_count(), and again prior to returning. This results in an incorrect client count which will lead to the channel resources not being freed when they should be. A simple test of repeated module load and unload of async_tx on a Dell Power Edge R7425 also shows this resulting in a kref underflow warning. [ 124.329662] async_tx: api initialized (async) [ 129.000627] async_tx: api initialized (async) [ 130.047839] ------------[ cut here ]------------ [ 130.052472] refcount_t: underflow; use-after-free. [ 130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 [ 130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr intel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm mgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si syscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops k10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat fat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul libahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas i40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash dm_log dm_mod [last unloaded: async_tx] [ 130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not tainted 5.14.0-185.el9.x86_64 #1 [ 130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS 1.18.0 01/17/2022 [ 130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110 [ 130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d 26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a bd 55 00 <0f> 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff 48 c7 [ 130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286 [ 130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000 [ 130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0 [ 130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff [ 130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970 [ 130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 130.198739] FS: 00007f646435c740(0000) GS:ffff9daf9de00000(0000) knlGS:0000000000000000 [ 130.206832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0 [ 130.219729] Call Trace: [ 130.222192] <TASK> [ 130.224305] dma_chan_put+0x10d/0x110 [ 130.227988] dmaengine_put+0x7a/0xa0 [ 130.231575] __do_sys_delete_module.constprop.0+0x178/0x280 [ 130.237157] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [ 130.242652] do_syscall_64+0x5c/0x90 [ 130.246240] ? exc_page_fault+0x62/0x150 [ 130.250178] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 130.255243] RIP: 0033:0x7f6463a3f5ab [ 130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 [ 130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab [ 130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8 [ 130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000 [ 130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8 [ 130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8 [ 130.320875] </TASK> [ 130.323081] ---[ end trace eff7156d56b5cf25 ]--- cat /sys/class/dma/dma0chan*/in_use would get the wrong result. 2 2 2 Fixes: d2f4f99db3e9 ("dmaengine: Rework dma_chan_get") Signed-off-by: Koba Ko <koba.ko(a)canonical.com> Reviewed-by: Jie Hai <haijie1(a)huawei.com> Test-by: Jie Hai <haijie1(a)huawei.com> Reviewed-by: Jerry Snitselaar <jsnitsel(a)redhat.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Tested-by: Joel Savitz <jsavitz(a)redhat.com> Link: https://lore.kernel.org/r/20221201030050.978595-1-koba.ko@canonical.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/dma/dmaengine.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index f1a441ab395d..450b1c4b2129 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -223,7 +223,8 @@ static int dma_chan_get(struct dma_chan *chan) /* The channel is already in use, update client count */ if (chan->client_count) { __module_get(owner); - goto out; + chan->client_count++; + return 0; } if (!try_module_get(owner)) @@ -236,11 +237,11 @@ static int dma_chan_get(struct dma_chan *chan) goto err_out; } + chan->client_count++; + if (!dma_has_cap(DMA_PRIVATE, chan->device->cap_mask)) balance_ref_count(chan); -out: - chan->client_count++; return 0; err_out: -- 2.34.1

2 1

[PATCH v2 OLK-6.6 0/5] Support the FEAT_HDBSS introduced in Armv9.5
by Zhenyu Ye 02 Apr '25

02 Apr '25

From: eillon <yezhenyu2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB103D CVE: NA This series of patches add support to the Hardware Dirty state tracking Structure(HDBSS) feature, which is introduced by the ARM architecture in the DDI0601(ID121123) version. The HDBSS feature is an extension to the architecture that enhances tracking translation table descriptors' dirty state, identified as FEAT_HDBSS. The goal of this feature is to reduce the cost of surveying for dirtied granules, with minimal effect on recording when a granule has been dirtied. The purpose of this feature is to make the execution overhead of live migration lower to both the guest and the host, compared to existing approaches (write-protect or search stage 2 tables). After these patches, users(such as qemu) can use the KVM_CAP_ARM_HW_DIRTY_STATE_TRACK ioctl to enable or disable the HDBSS feature before and after the live migration. See patches for details, Thanks. eillon (5): arm64/sysreg: add HDBSS related register information arm64/kvm: support set the DBM attr during memory abort arm64/kvm: using ioctl to enable/disable the HDBSS feature arm64/kvm: support to handle the HDBSSF event arm64/config: add config to control whether enable HDBSS feature arch/arm64/Kconfig | 12 ++++ arch/arm64/configs/openeuler_defconfig | 6 ++ arch/arm64/include/asm/cpufeature.h | 14 ++++ arch/arm64/include/asm/esr.h | 2 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 8 +++ arch/arm64/include/asm/kvm_mmu.h | 14 ++++ arch/arm64/include/asm/kvm_pgtable.h | 1 + arch/arm64/include/asm/sysreg.h | 14 ++++ arch/arm64/kvm/arm.c | 88 ++++++++++++++++++++++++++ arch/arm64/kvm/handle_exit.c | 50 +++++++++++++++ arch/arm64/kvm/hyp/pgtable.c | 12 ++++ arch/arm64/kvm/hyp/vhe/switch.c | 3 + arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 4 ++ arch/arm64/kvm/mmu.c | 17 ++++- arch/arm64/kvm/reset.c | 9 +++ arch/arm64/tools/sysreg | 28 ++++++++ include/linux/kvm_host.h | 3 + include/uapi/linux/kvm.h | 2 + tools/include/uapi/linux/kvm.h | 2 + 20 files changed, 289 insertions(+), 1 deletion(-) -- 2.39.3

2 6

[openeuler:openEuler-1.0-LTS 1537/1537] fs/f2fs/gc.o: warning: objtool: f2fs_gc()+0x1f3f: unreachable instruction
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 8b9ea9010139596e71aae4be5264c3dd901b13cb [1537/1537] pagecache: support percpu refcount to imporve performance config: x86_64-buildonly-randconfig-004-20250331 (https://download.01.org/0day-ci/archive/20250402/202504021020.oxRcBdkg-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021020.oxRcBdkg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021020.oxRcBdkg-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/f2fs/gc.o: warning: objtool: f2fs_gc()+0x1f3f: unreachable instruction -- >> fs/f2fs/file.o: warning: objtool: truncate_partial_data_page()+0x213: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] fix CVE-2025-21712
by Zheng Qixing 02 Apr '25

02 Apr '25

Patch 1 is to fix the UAF issue in CVE-2025-21712. Patch 2 is to fix status collection for external bitmaps. Yu Kuai (1): md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime Zheng Qixing (1): md/md-bitmap: fix stats collection for external bitmaps drivers/md/md-bitmap.c | 3 ++- drivers/md/md.c | 5 +++++ 2 files changed, 7 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[openeuler:OLK-5.10 2836/2836] arch/x86/kernel/fpu/core.c:452:15: warning: no previous prototype for 'get_fpu_registers_pos'
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 411f2e6e24ad11083d85f2ab7324b1f77ad0d371 commit: 0cd6fd52741f659d2a57501ca933ab33040cb911 [2836/2836] mm: Enhanced copy capabilities for Hygon processor config: x86_64-randconfig-101-20250402 (https://download.01.org/0day-ci/archive/20250402/202504020854.WbZXJEHJ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504020854.WbZXJEHJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504020854.WbZXJEHJ-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kernel/fpu/core.c:444:14: warning: no previous prototype for 'get_fpustate_free_space' [-Wmissing-prototypes] 444 | unsigned int get_fpustate_free_space(struct fpu *fpu) | ^~~~~~~~~~~~~~~~~~~~~~~ >> arch/x86/kernel/fpu/core.c:452:15: warning: no previous prototype for 'get_fpu_registers_pos' [-Wmissing-prototypes] 452 | unsigned long get_fpu_registers_pos(struct fpu *fpu, unsigned int off) | ^~~~~~~~~~~~~~~~~~~~~ arch/x86/kernel/fpu/core.c:533:6: warning: no previous prototype for 'save_fpregs_to_fpkernelstate' [-Wmissing-prototypes] 533 | void save_fpregs_to_fpkernelstate(struct fpu *kfpu) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/get_fpu_registers_pos +452 arch/x86/kernel/fpu/core.c 451 > 452 unsigned long get_fpu_registers_pos(struct fpu *fpu, unsigned int off) 453 { 454 unsigned long addr = 0; 455 456 if (fpu && (fpu_kernel_nonatomic_xstate_size > off)) { 457 addr = (unsigned long)&fpu->__fpstate.regs.__padding[0]; 458 addr += fpu_kernel_cfg.default_size + off; 459 } 460 return addr; 461 } 462 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1544/1544] mm/share_pool.c:4577:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared
by kernel test robot 02 Apr '25

02 Apr '25

Hi Zhou, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 0886320b818787f720824229f153f161c89faf70 [1544/1544] mm/sharepool: Charge Buddy hugepage to memcg config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250402/202504020332.I3Yx3nDu-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250402/202504020332.I3Yx3nDu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504020332.I3Yx3nDu-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c:1086:29: sparse: sparse: incompatible types for operation (<=): mm/share_pool.c:1086:29: sparse: int *num mm/share_pool.c:1086:29: sparse: int mm/share_pool.c:3299:21: sparse: sparse: undefined identifier 'huge_ptep_get' mm/share_pool.c:3299:34: sparse: sparse: invalid initializer mm/share_pool.c:4577:32: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c:4585:30: sparse: sparse: undefined identifier 'huge_pte_none' mm/share_pool.c:4606:23: sparse: sparse: undefined identifier 'huge_add_to_page_cache' mm/share_pool.c:4625:14: sparse: sparse: undefined identifier 'huge_pte_none' mm/share_pool.c:4631:9: sparse: sparse: undefined identifier 'set_huge_pte_at' mm/share_pool.c:4633:9: sparse: sparse: undefined identifier 'hugetlb_count_add' mm/share_pool.c:4797:24: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c: In function 'mg_sp_group_id_by_pid': mm/share_pool.c:1086:29: warning: ordered comparison of pointer with integer zero [-Wextra] 1086 | if (!spg_ids || num <= 0) | ^~ mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:3299:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 3299 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:3299:21: error: invalid initializer mm/share_pool.c: In function 'sharepool_no_page': mm/share_pool.c:4577:32: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 4577 | page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage >> mm/share_pool.c:4577:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared (first use in this function) 4577 | page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); | ^~~~~~~~~~~~~~~~~~~ mm/share_pool.c:4577:64: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:4585:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 4585 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock mm/share_pool.c:4606:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 4606 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache mm/share_pool.c:4631:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 4631 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at mm/share_pool.c:4633:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 4633 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:4797:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 4797 | page = hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE cc1: some warnings being treated as errors vim +/HUGETLB_ALLOC_BUDDY +4577 mm/share_pool.c 4541 4542 vm_fault_t sharepool_no_page(struct mm_struct *mm, 4543 struct vm_area_struct *vma, 4544 struct address_space *mapping, pgoff_t idx, 4545 unsigned long address, pte_t *ptep, unsigned int flags) 4546 { 4547 struct hstate *h = hstate_vma(vma); 4548 vm_fault_t ret = VM_FAULT_SIGBUS; 4549 unsigned long size; 4550 struct page *page; 4551 pte_t new_pte; 4552 spinlock_t *ptl; 4553 unsigned long haddr = address & huge_page_mask(h); 4554 bool new_page = false; 4555 int err; 4556 int node_id; 4557 struct sp_area *spa; 4558 bool charge_hpage = false; 4559 struct mem_cgroup *memcg; 4560 4561 spa = vma->vm_private_data; 4562 if (!spa) { 4563 pr_err("share pool: vma is invalid, not from sp mmap\n"); 4564 return ret; 4565 } 4566 node_id = spa->node_id; 4567 4568 retry: 4569 page = find_lock_page(mapping, idx); 4570 if (!page) { 4571 size = i_size_read(mapping->host) >> huge_page_shift(h); 4572 if (idx >= size) 4573 goto out; 4574 4575 page = alloc_huge_page(vma, haddr, 0); 4576 if (IS_ERR(page)) { > 4577 page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); 4578 if (!page) 4579 page = ERR_PTR(-ENOMEM); 4580 else if (!PageKmemcg(page)) 4581 charge_hpage = true; 4582 } 4583 if (IS_ERR(page)) { 4584 ptl = huge_pte_lock(h, mm, ptep); 4585 if (!huge_pte_none(huge_ptep_get(ptep))) { 4586 ret = 0; 4587 spin_unlock(ptl); 4588 goto out; 4589 } 4590 spin_unlock(ptl); 4591 ret = vmf_error(PTR_ERR(page)); 4592 goto out; 4593 } 4594 4595 if (charge_hpage && 4596 mem_cgroup_try_charge_delay(page, vma->vm_mm, GFP_KERNEL, &memcg, true)) { 4597 put_page(page); 4598 ret = vmf_error(-ENOMEM); 4599 goto out; 4600 } 4601 4602 __SetPageUptodate(page); 4603 new_page = true; 4604 4605 /* sharepool pages are all shared */ 4606 err = huge_add_to_page_cache(page, mapping, idx); 4607 if (err) { 4608 if (charge_hpage) { 4609 mem_cgroup_cancel_charge(page, memcg, true); 4610 charge_hpage = false; 4611 } 4612 put_page(page); 4613 if (err == -EEXIST) 4614 goto retry; 4615 goto out; 4616 } 4617 } 4618 4619 ptl = huge_pte_lock(h, mm, ptep); 4620 size = i_size_read(mapping->host) >> huge_page_shift(h); 4621 if (idx >= size) 4622 goto backout; 4623 4624 ret = 0; 4625 if (!huge_pte_none(huge_ptep_get(ptep))) 4626 goto backout; 4627 4628 page_dup_rmap(page, true); 4629 new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) 4630 && (vma->vm_flags & VM_SHARED))); 4631 set_huge_pte_at(mm, haddr, ptep, new_pte); 4632 4633 hugetlb_count_add(pages_per_huge_page(h), mm); 4634 4635 if (charge_hpage) 4636 mem_cgroup_commit_charge(page, memcg, false, true); 4637 4638 spin_unlock(ptl); 4639 4640 if (new_page) 4641 SetPagePrivate(&page[1]); 4642 4643 unlock_page(page); 4644 out: 4645 return ret; 4646 4647 backout: 4648 spin_unlock(ptl); 4649 unlock_page(page); 4650 if (charge_hpage) 4651 mem_cgroup_cancel_charge(page, memcg, true); 4652 put_page(page); 4653 goto out; 4654 } 4655 EXPORT_SYMBOL(sharepool_no_page); 4656 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1544/1544] mm/share_pool.c:2435:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'?
by kernel test robot 02 Apr '25

02 Apr '25

Hi Weilong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 4e851c2bb53e45d92e266c65cf0c203624e74710 [1544/1544] ascend: share_pool: Use sharepool_no_page to alloc hugepage config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250402/202504020010.TmMNnpc4-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250402/202504020010.TmMNnpc4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504020010.TmMNnpc4-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c:58:5: sparse: sparse: symbol 'enable_mdc_default_group' was not declared. Should it be static? mm/share_pool.c:1685:21: sparse: sparse: undefined identifier 'huge_ptep_get' mm/share_pool.c:1685:34: sparse: sparse: invalid initializer mm/share_pool.c:2435:30: sparse: sparse: undefined identifier 'huge_pte_none' mm/share_pool.c:2448:23: sparse: sparse: undefined identifier 'huge_add_to_page_cache' mm/share_pool.c:2464:14: sparse: sparse: undefined identifier 'huge_pte_none' mm/share_pool.c:2470:9: sparse: sparse: undefined identifier 'set_huge_pte_at' mm/share_pool.c:2472:9: sparse: sparse: undefined identifier 'hugetlb_count_add' mm/share_pool.c:2508:24: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:1685:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 1685 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:1685:21: error: invalid initializer mm/share_pool.c: In function 'sharepool_no_page': >> mm/share_pool.c:2435:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 2435 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock >> mm/share_pool.c:2448:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 2448 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache >> mm/share_pool.c:2470:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 2470 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at >> mm/share_pool.c:2472:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 2472 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:2508:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 2508 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage mm/share_pool.c:2508:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 2508 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:2508:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:2511:1: warning: control reaches end of non-void function [-Wreturn-type] 2511 | } | ^ cc1: some warnings being treated as errors vim +2435 mm/share_pool.c 2403 2404 vm_fault_t sharepool_no_page(struct mm_struct *mm, 2405 struct vm_area_struct *vma, 2406 struct address_space *mapping, pgoff_t idx, 2407 unsigned long address, pte_t *ptep, unsigned int flags) 2408 { 2409 struct hstate *h = hstate_vma(vma); 2410 vm_fault_t ret = VM_FAULT_SIGBUS; 2411 unsigned long size; 2412 struct page *page; 2413 pte_t new_pte; 2414 spinlock_t *ptl; 2415 unsigned long haddr = address & huge_page_mask(h); 2416 bool new_page = false; 2417 int err; 2418 2419 retry: 2420 page = find_lock_page(mapping, idx); 2421 if (!page) { 2422 size = i_size_read(mapping->host) >> huge_page_shift(h); 2423 if (idx >= size) 2424 goto out; 2425 2426 page = alloc_huge_page(vma, haddr, 0); 2427 if (IS_ERR(page)) { 2428 page = alloc_huge_page_node(hstate_file(vma->vm_file), 2429 numa_mem_id()); 2430 if (!page) 2431 page = ERR_PTR(-ENOMEM); 2432 } 2433 if (IS_ERR(page)) { 2434 ptl = huge_pte_lock(h, mm, ptep); > 2435 if (!huge_pte_none(huge_ptep_get(ptep))) { 2436 ret = 0; 2437 spin_unlock(ptl); 2438 goto out; 2439 } 2440 spin_unlock(ptl); 2441 ret = vmf_error(PTR_ERR(page)); 2442 goto out; 2443 } 2444 __SetPageUptodate(page); 2445 new_page = true; 2446 2447 /* sharepool pages are all shared */ > 2448 err = huge_add_to_page_cache(page, mapping, idx); 2449 if (err) { 2450 put_page(page); 2451 if (err == -EEXIST) 2452 goto retry; 2453 goto out; 2454 } 2455 } 2456 2457 2458 ptl = huge_pte_lock(h, mm, ptep); 2459 size = i_size_read(mapping->host) >> huge_page_shift(h); 2460 if (idx >= size) 2461 goto backout; 2462 2463 ret = 0; 2464 if (!huge_pte_none(huge_ptep_get(ptep))) 2465 goto backout; 2466 2467 page_dup_rmap(page, true); 2468 new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) 2469 && (vma->vm_flags & VM_SHARED))); > 2470 set_huge_pte_at(mm, haddr, ptep, new_pte); 2471 > 2472 hugetlb_count_add(pages_per_huge_page(h), mm); 2473 2474 spin_unlock(ptl); 2475 2476 if (new_page) { 2477 SetPagePrivate(&page[1]); 2478 } 2479 2480 unlock_page(page); 2481 out: 2482 return ret; 2483 2484 backout: 2485 spin_unlock(ptl); 2486 unlock_page(page); 2487 put_page(page); 2488 goto out; 2489 } 2490 EXPORT_SYMBOL(sharepool_no_page); 2491 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1544/1544] fs/proc/etmem_swap.c:86: undefined reference to `proc_swap_pages_operations'
by kernel test robot 01 Apr '25

01 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: fb3893e8dd62797b531a46bd3c49b2c14dc6eb27 [1544/1544] etmem: add etmem-swap feature config: x86_64-randconfig-r113-20250401 (https://download.01.org/0day-ci/archive/20250401/202504012235.IEGC6Idv-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250401/202504012235.IEGC6Idv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504012235.IEGC6Idv-lkp@intel.com/ All errors (new ones prefixed by >>): ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: .tmp_vmlinux1 has a LOAD segment with RWX permissions ld: fs/proc/etmem_scan.o: in function `page_scan_entry': fs/proc/etmem_scan.c:1031: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.c:1032: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.c:1031: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.c:1033: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.c:1032: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.o:fs/proc/etmem_scan.c:1034: more undefined references to `proc_page_scan_operations' follow ld: fs/proc/etmem_swap.o: in function `swap_pages_entry': >> fs/proc/etmem_swap.c:86: undefined reference to `proc_swap_pages_operations' >> ld: fs/proc/etmem_swap.c:87: undefined reference to `proc_swap_pages_operations' >> ld: fs/proc/etmem_swap.c:86: undefined reference to `proc_swap_pages_operations' ld: fs/proc/etmem_swap.c:88: undefined reference to `proc_swap_pages_operations' >> ld: fs/proc/etmem_swap.c:87: undefined reference to `proc_swap_pages_operations' ld: fs/proc/etmem_swap.o:fs/proc/etmem_swap.c:89: more undefined references to `proc_swap_pages_operations' follow vim +86 fs/proc/etmem_swap.c 83 84 static int swap_pages_entry(void) 85 { > 86 proc_swap_pages_operations.owner = THIS_MODULE; > 87 proc_swap_pages_operations.write = swap_pages_write; 88 proc_swap_pages_operations.open = swap_pages_open; 89 proc_swap_pages_operations.release = swap_pages_release; 90 91 return 0; 92 } 93 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH v1 OLK-6.6 0/5] Support the FEAT_HDBSS introduced in Armv9.5
by Zhenyu Ye 01 Apr '25

01 Apr '25

From: eillon <yezhenyu2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB103D CVE: NA This series of patches add support to the Hardware Dirty state tracking Structure(HDBSS) feature, which is introduced by the ARM architecture in the DDI0601(ID121123) version. The HDBSS feature is an extension to the architecture that enhances tracking translation table descriptors' dirty state, identified as FEAT_HDBSS. The goal of this feature is to reduce the cost of surveying for dirtied granules, with minimal effect on recording when a granule has been dirtied. The purpose of this feature is to make the execution overhead of live migration lower to both the guest and the host, compared to existing approaches (write-protect or search stage 2 tables). After these patches, users(such as qemu) can use the KVM_CAP_ARM_HW_DIRTY_STATE_TRACK ioctl to enable or disable the HDBSS feature before and after the live migration. See patches for details, Thanks. eillon (5): arm64/sysreg: add HDBSS related register information arm64/kvm: support set the DBM attr during memory abort arm64/kvm: using ioctl to enable/disable the HDBSS feature arm64/kvm: support to handle the HDBSSF event arm64/config: add config to control whether enable HDBSS feature arch/arm64/Kconfig | 12 ++++ arch/arm64/include/asm/cpufeature.h | 14 +++++ arch/arm64/include/asm/esr.h | 2 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 8 +++ arch/arm64/include/asm/kvm_mmu.h | 14 +++++ arch/arm64/include/asm/kvm_pgtable.h | 1 + arch/arm64/include/asm/sysreg.h | 14 +++++ arch/arm64/kvm/arm.c | 88 ++++++++++++++++++++++++++++ arch/arm64/kvm/handle_exit.c | 50 ++++++++++++++++ arch/arm64/kvm/hyp/pgtable.c | 12 ++++ arch/arm64/kvm/hyp/vhe/switch.c | 3 + arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 4 ++ arch/arm64/kvm/mmu.c | 17 +++++- arch/arm64/kvm/reset.c | 9 +++ arch/arm64/tools/sysreg | 28 +++++++++ include/linux/kvm_host.h | 3 + include/uapi/linux/kvm.h | 2 + tools/include/uapi/linux/kvm.h | 2 + 19 files changed, 283 insertions(+), 1 deletion(-) -- 2.39.3

2 6

[PATCH OLK-5.10] tracing: Fix use-after-free in print_graph_function_flags during tracer switching
by Tengda Wu 01 Apr '25

01 Apr '25

From: Tengda Wu <wutengda(a)huaweicloud.com> mainline inclusion from mainline-v6.15 commit 7f81f27b1093e4895e87b74143c59c055c3b1906 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBWWU7 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the following script: $ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tracer The root cause lies in the two calls to print_graph_function_flags within print_trace_line during each s_show(): * One through 'iter->trace->print_line()'; * Another through 'event->funcs->trace()', which is hidden in print_trace_fmt() before print_trace_line returns. Tracer switching only updates the former, while the latter continues to use the print_line function of the old tracer, which in the script above is print_graph_function_flags. Moreover, when switching from the 'function_graph' tracer to the 'timerlat' tracer, s_start only calls graph_trace_close of the 'function_graph' tracer to free 'iter->private', but does not set it to NULL. This provides an opportunity for 'event->funcs->trace()' to use an invalid 'iter->private'. To fix this issue, set 'iter->private' to NULL immediately after freeing it in graph_trace_close(), ensuring that an invalid pointer is not passed to other tracers. Additionally, clean up the unnecessary 'iter->private = NULL' during each 'cat trace' when using wakeup and irqsoff tracers. [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Zheng Yejian <zhengyejian1(a)huawei.com> Link: https://lore.kernel.org/20250320122137.23635-1-wutengda@huaweicloud.com Fixes: eecb91b9f98d ("tracing: Fix memleak due to race between current_tracer and trace") Closes: https://lore.kernel.org/all/CAMgjq7BW79KDSCyp+tZHjShSzHsScSiJxn5ffskp-QzVM0… Reported-by: Kairui Song <kasong(a)tencent.com> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_functions_graph.c | 1 + kernel/trace/trace_irqsoff.c | 2 -- kernel/trace/trace_sched_wakeup.c | 2 -- 3 files changed, 1 insertion(+), 4 deletions(-) diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c index 677538c3b9ec..591ca962cc9e 100644 --- a/kernel/trace/trace_functions_graph.c +++ b/kernel/trace/trace_functions_graph.c @@ -1244,6 +1244,7 @@ void graph_trace_close(struct trace_iterator *iter) if (data) { free_percpu(data->cpu_data); kfree(data); + iter->private = NULL; } } diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c index 4a11967c8daa..1dded26115b3 100644 --- a/kernel/trace/trace_irqsoff.c +++ b/kernel/trace/trace_irqsoff.c @@ -231,8 +231,6 @@ static void irqsoff_trace_open(struct trace_iterator *iter) { if (is_graph(iter->tr)) graph_trace_open(iter); - else - iter->private = NULL; } static void irqsoff_trace_close(struct trace_iterator *iter) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index c1f582e0e97f..f1c603358ff3 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -168,8 +168,6 @@ static void wakeup_trace_open(struct trace_iterator *iter) { if (is_graph(iter->tr)) graph_trace_open(iter); - else - iter->private = NULL; } static void wakeup_trace_close(struct trace_iterator *iter) -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1544/1544] block/blk-cgroup.c:478:19: sparse: sparse: incompatible types in comparison expression (different address spaces):
by kernel test robot 01 Apr '25

01 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 725ee753b5064f03287858bc346d883b8f39319a [1544/1544] bdi: fix use-after-free for the bdi device config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250401/202504012009.zDgdqz6W-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250401/202504012009.zDgdqz6W-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504012009.zDgdqz6W-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> block/blk-cgroup.c:478:19: sparse: sparse: incompatible types in comparison expression (different address spaces): block/blk-cgroup.c:478:19: sparse: struct rcu_device [noderef] __rcu * block/blk-cgroup.c:478:19: sparse: struct rcu_device * block/blk-cgroup.c:816:5: sparse: sparse: context imbalance in 'blkg_conf_prep' - wrong count at exit block/blk-cgroup.c:1794: warning: Function parameter or member 'q' not described in 'blkcg_schedule_throttle' block/blk-cgroup.c:1794: warning: Function parameter or member 'use_memdelay' not described in 'blkcg_schedule_throttle' block/blk-cgroup.c:1819: warning: Function parameter or member 'blkg' not described in 'blkcg_add_delay' block/blk-cgroup.c:1819: warning: Function parameter or member 'now' not described in 'blkcg_add_delay' block/blk-cgroup.c:1819: warning: Function parameter or member 'delta' not described in 'blkcg_add_delay' vim +478 block/blk-cgroup.c 472 473 const char *blkg_dev_name(struct blkcg_gq *blkg) 474 { 475 /* some drivers (floppy) instantiate a queue w/o disk registered */ 476 struct rcu_device *rcu_dev; 477 > 478 rcu_dev = rcu_dereference(blkg->q->backing_dev_info->rcu_dev); 479 if (rcu_dev) 480 return dev_name(&rcu_dev->dev); 481 return NULL; 482 } 483 EXPORT_SYMBOL_GPL(blkg_dev_name); 484 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2068/2068] drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:545:5: error: no previous prototype for 'ps3_pci_init'
by kernel test robot 01 Apr '25

01 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: af5900086b6f0256d261f2c36f7beca966875eb1 commit: 97a2bb6ece556f3882263ee8df2b77f10c511311 [2068/2068] SCSI: Linkdata: Supports Linkdata HBA/RAID Controllers config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20250401/202504012026.kzT6d2HZ-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250401/202504012026.kzT6d2HZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504012026.kzT6d2HZ-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/scsi/linkdata/ps3stor/ps3_ioc_manager.c:307:5: error: no previous prototype for 'ps3_hard_reset_to_ready' [-Werror=missing-prototypes] 307 | int ps3_hard_reset_to_ready(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:876:6: error: no previous prototype for 'ps3_set_task_manager_busy' [-Werror=missing-prototypes] 876 | void ps3_set_task_manager_busy(struct ps3_instance *instance, | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:1110:5: error: no previous prototype for 'ps3_wait_for_outstanding_complete' [-Werror=missing-prototypes] 1110 | int ps3_wait_for_outstanding_complete(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:131:6: error: no previous prototype for 'ps3_trigger_irq_poll' [-Werror=missing-prototypes] 131 | void ps3_trigger_irq_poll(struct ps3_irq *irq) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:243:5: error: no previous prototype for 'ps3_resp_status_convert' [-Werror=missing-prototypes] 243 | int ps3_resp_status_convert(unsigned int resp_status) | ^~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:211:1: error: no previous prototype for 'ps3_qos_cmd_waitq_get' [-Werror=missing-prototypes] 211 | ps3_qos_cmd_waitq_get(struct ps3_qos_tg_context *qos_tg_ctx, | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:335:15: error: no previous prototype for 'ps3_qos_vd_cmdword_get' [-Werror=missing-prototypes] 335 | unsigned char ps3_qos_vd_cmdword_get(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:351:15: error: no previous prototype for 'ps3_qos_exclusive_cmdword_get' [-Werror=missing-prototypes] 351 | unsigned char ps3_qos_exclusive_cmdword_get(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:363:15: error: no previous prototype for 'ps3_qos_tg_decision' [-Werror=missing-prototypes] 363 | unsigned char ps3_qos_tg_decision(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:749:15: error: no previous prototype for 'ps3_qos_all_pd_rc_get' [-Werror=missing-prototypes] 749 | unsigned char ps3_qos_all_pd_rc_get(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:876:6: error: no previous prototype for 'ps3_pd_quota_waitq_clear_all' [-Werror=missing-prototypes] 876 | void ps3_pd_quota_waitq_clear_all(struct ps3_qos_pd_mgr *qos_pd_mgr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:892:6: error: no previous prototype for 'ps3_pd_quota_waitq_clean' [-Werror=missing-prototypes] 892 | void ps3_pd_quota_waitq_clean(struct ps3_qos_pd_mgr *qos_pd_mgr, | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:1058:6: error: no previous prototype for 'ps3_qos_pd_waitq_ratio_update' [-Werror=missing-prototypes] 1058 | void ps3_qos_pd_waitq_ratio_update(struct ps3_qos_pd_mgr *qos_pd_mgr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2019:15: error: no previous prototype for 'ps3_hba_qos_decision' [-Werror=missing-prototypes] 2019 | unsigned char ps3_hba_qos_decision(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2040:6: error: no previous prototype for 'ps3_hba_qos_waitq_notify' [-Werror=missing-prototypes] 2040 | void ps3_hba_qos_waitq_notify(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2100:6: error: no previous prototype for 'ps3_cmd_waitq_abort' [-Werror=missing-prototypes] 2100 | bool ps3_cmd_waitq_abort(struct ps3_cmd *aborted_cmd) | ^~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2463:6: error: no previous prototype for 'ps3_hba_qos_waitq_clear_all' [-Werror=missing-prototypes] 2463 | void ps3_hba_qos_waitq_clear_all(struct ps3_instance *instance, int resp_status) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2827:6: error: no previous prototype for 'ps3_hba_qos_vd_init' [-Werror=missing-prototypes] 2827 | void ps3_hba_qos_vd_init(struct ps3_instance *instance, | ^~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2936:6: error: no previous prototype for 'ps3_hba_qos_vd_reset' [-Werror=missing-prototypes] 2936 | void ps3_hba_qos_vd_reset(struct ps3_instance *instance, unsigned short disk_id) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3023:6: error: no previous prototype for 'ps3_hba_qos_waitq_poll' [-Werror=missing-prototypes] 3023 | void ps3_hba_qos_waitq_poll(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3279:15: error: no previous prototype for 'ps3_raid_qos_decision' [-Werror=missing-prototypes] 3279 | unsigned char ps3_raid_qos_decision(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3334:6: error: no previous prototype for 'ps3_qos_mgrq_resend' [-Werror=missing-prototypes] 3334 | void ps3_qos_mgrq_resend(struct ps3_qos_softq_mgr *softq_mgr) | ^~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3478:6: error: no previous prototype for 'ps3_raid_qos_waitq_notify' [-Werror=missing-prototypes] 3478 | void ps3_raid_qos_waitq_notify(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3821:15: error: no previous prototype for 'ps3_raid_qos_waitq_abort' [-Werror=missing-prototypes] 3821 | unsigned char ps3_raid_qos_waitq_abort(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:4022:6: error: no previous prototype for 'ps3_raid_qos_waitq_clear_all' [-Werror=missing-prototypes] 4022 | void ps3_raid_qos_waitq_clear_all(struct ps3_instance *instance, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/linkdata/ps3stor/ps3_qos.c:4083:6: error: no previous prototype for 'ps3_raid_qos_waitq_poll' [-Werror=missing-prototypes] 4083 | void ps3_raid_qos_waitq_poll(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:85:6: error: no previous prototype for 'ps3_cmd_stat_content_clear' [-Werror=missing-prototypes] 85 | void ps3_cmd_stat_content_clear(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:403:6: error: no previous prototype for 'ps3_io_recv_ok_stat_inc' [-Werror=missing-prototypes] 403 | void ps3_io_recv_ok_stat_inc(struct ps3_instance *ins, | ^~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_ioctl.c:785:6: error: no previous prototype for 'ps3_clean_mgr_cmd' [-Werror=missing-prototypes] 785 | void ps3_clean_mgr_cmd(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:578:5: error: no previous prototype for 'ps3_r1x_hash_bit_check' [-Werror=missing-prototypes] 578 | int ps3_r1x_hash_bit_check(struct ps3_r1x_hash_bit_mgr *hash_mgr, | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:678:6: error: no previous prototype for 'ps3_r1x_conflict_queue_hash_bit_lock' [-Werror=missing-prototypes] 678 | void ps3_r1x_conflict_queue_hash_bit_lock(struct ps3_r1x_lock_mgr *mgr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:730:5: error: no previous prototype for 'ps3_r1x_hash_bit_lock' [-Werror=missing-prototypes] 730 | int ps3_r1x_hash_bit_lock(struct ps3_r1x_lock_mgr *mgr, struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:988:6: error: no previous prototype for 'ps3_r1x_hash_bit_unlock' [-Werror=missing-prototypes] 988 | void ps3_r1x_hash_bit_unlock(struct ps3_r1x_lock_mgr *mgr, struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1173:5: error: no previous prototype for 'ps3_range_check_and_insert' [-Werror=missing-prototypes] 1173 | int ps3_range_check_and_insert(struct ps3_range_tree_root *range_root, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1231:5: error: no previous prototype for 'ps3_r1x_hash_range_lock' [-Werror=missing-prototypes] 1231 | int ps3_r1x_hash_range_lock(struct ps3_r1x_lock_mgr *mgr, struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1312:6: error: no previous prototype for 'ps3_r1x_hash_range_unlock' [-Werror=missing-prototypes] 1312 | void ps3_r1x_hash_range_unlock(struct ps3_r1x_lock_mgr *mgr, | ^~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_debug.c:883:5: error: no previous prototype for 'ps3_dump_dir_length' [-Werror=missing-prototypes] 883 | int ps3_dump_dir_length(const char *buf, size_t count) | ^~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_module_para.c:609:14: error: no previous prototype for 'ps3_cli_ver_query' [-Werror=missing-prototypes] 609 | unsigned int ps3_cli_ver_query(void) | ^~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_rb_tree.c:154:6: error: no previous prototype for 'rbtDelNodeDo' [-Werror=missing-prototypes] 154 | void rbtDelNodeDo(struct Ps3RbRoot *pRoot, struct Ps3RbNode *pNode) | ^~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_device_manager.c:1581:5: error: no previous prototype for 'ps3_scsi_private_init_pd' [-Werror=missing-prototypes] 1581 | int ps3_scsi_private_init_pd(struct scsi_device *sdev) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_device_manager.c:1663:5: error: no previous prototype for 'ps3_scsi_private_init_vd' [-Werror=missing-prototypes] 1663 | int ps3_scsi_private_init_vd(struct scsi_device *sdev) | ^~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors .. vim +/ps3_pci_init +545 drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c 544 > 545 int ps3_pci_init(struct pci_dev *pdev, struct ps3_instance *instance) 546 { 547 resource_size_t base_addr = 0; 548 int ret = PS3_SUCCESS; 549 550 ret = pci_enable_device_mem(pdev); 551 if (ret != PS3_SUCCESS) { 552 LOG_ERROR("hno:%u pci id[%u] pci enable failed\n", 553 PS3_HOST(instance), pdev->dev.id); 554 goto l_pci_enable_device_mem_failed; 555 } 556 557 pci_set_master(pdev); 558 559 instance->reg_bar = PS3_REGISTER_BAR_INDEX; 560 ret = (pci_resource_flags(pdev, instance->reg_bar) & IORESOURCE_MEM); 561 if (!ret) { 562 LOG_ERROR("hno:%u Bar %lu isnot IORESOURCE_MEM\n", 563 PS3_HOST(instance), instance->reg_bar); 564 goto l_bar_check_failed; 565 } 566 ret = pci_request_selected_regions(pdev, 1 << instance->reg_bar, 567 "PS3 pci regions"); 568 if (ret != PS3_SUCCESS) { 569 LOG_ERROR("hno:%u IO memory region busy\n", PS3_HOST(instance)); 570 goto l_pci_request_selected_regions_failed; 571 } 572 #if defined(PS3_SUPPORT_PCIE_REPORT) 573 pci_enable_pcie_error_reporting(pdev); 574 #endif 575 if (instance->ioc_adpter->reg_set) { 576 instance->reg_set = 577 (struct Ps3Fifo __iomem *)instance->ioc_adpter->reg_set( 578 pdev, instance->reg_bar); 579 } else { 580 instance->reg_set = (struct Ps3Fifo __iomem *)ioremap( 581 pci_resource_start(pdev, instance->reg_bar), 582 PS3_REGISTER_SET_SIZE); 583 } 584 if (instance->reg_set == NULL) { 585 LOG_ERROR("hno:%u ioremap failed\n", PS3_HOST(instance)); 586 goto l_ioremap_failed; 587 } else { 588 pci_set_drvdata(pdev, instance); 589 } 590 591 ps3_atomic_set(&instance->watchdog_reg_read_fail_count, 0); 592 LOG_INFO( 593 "reg_bar_idx = %lu, bar_base_paddr = 0x%llx, reg_set_vaddr = 0x%p\n", 594 instance->reg_bar, (unsigned long long)base_addr, instance->reg_set); 595 596 return PS3_SUCCESS; 597 l_ioremap_failed: 598 pci_release_selected_regions(instance->pdev, 1 << instance->reg_bar); 599 #if defined(PS3_SUPPORT_PCIE_REPORT) 600 pci_disable_pcie_error_reporting(pdev); 601 #endif 602 l_pci_request_selected_regions_failed: 603 pci_disable_device(instance->pdev); 604 l_bar_check_failed: 605 l_pci_enable_device_mem_failed: 606 return -PS3_FAILED; 607 } 608 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS V1] drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
by Cheng Yu 01 Apr '25

01 Apr '25

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v4.19.247 commit 6ff986e057bf28e2f7690dad410768b2270f9453 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1K1 CVE: CVE-2022-49491 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8c242908ad15bbd604d3bcb54961b7d454c43f8 ] It will cause null-ptr-deref in resource_size(), if platform_get_resource() returns NULL, move calling resource_size() after devm_ioremap_resource() that will check 'res' to avoid null-ptr-deref. Fixes: 2048e3286f34 ("drm: rockchip: Add basic drm driver") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Heiko Stuebner <heiko(a)sntech.de> Link: https://patchwork.freedesktop.org/patch/msgid/20220422032854.2995175-1-yang… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c index 873624a11ce8..c0b647435974 100644 --- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c @@ -1595,10 +1595,10 @@ static int vop_bind(struct device *dev, struct device *master, void *data) vop_win_init(vop); res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - vop->len = resource_size(res); vop->regs = devm_ioremap_resource(dev, res); if (IS_ERR(vop->regs)) return PTR_ERR(vop->regs); + vop->len = resource_size(res); vop->regsbak = devm_kzalloc(dev, vop->len, GFP_KERNEL); if (!vop->regsbak) -- 2.25.1

2 1

[PATCH] perf/core: Fix pmus_lock vs. pmus_srcu ordering
by Luo Gengkun 01 Apr '25

01 Apr '25

From: Peter Zijlstra <peterz(a)infradead.org> stable inclusion from stable-v6.6.83 commit 7c823e4c30d6fdc16089e13924260086eaea76be category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBXQNU Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2565e42539b120b81a68a58da961ce5d1e34eac8 ] Commit a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") placed pmus_lock inside pmus_srcu, this makes perf_pmu_unregister() trip lockdep. Move the locking about such that only pmu_idr and pmus (list) are modified while holding pmus_lock. This avoids doing synchronize_srcu() while holding pmus_lock and all is well again. Fixes: a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20241104135517.679556858@infradead.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 0b9e703641d1..9b5d35c4a3ec 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -11670,6 +11670,8 @@ void perf_pmu_unregister(struct pmu *pmu) { mutex_lock(&pmus_lock); list_del_rcu(&pmu->entry); + idr_remove(&pmu_idr, pmu->type); + mutex_unlock(&pmus_lock); /* * We dereference the pmu list under both SRCU and regular RCU, so @@ -11679,7 +11681,6 @@ void perf_pmu_unregister(struct pmu *pmu) synchronize_rcu(); free_percpu(pmu->pmu_disable_count); - idr_remove(&pmu_idr, pmu->type); if (pmu_bus_running && pmu->dev && pmu->dev != PMU_NULL_DEV) { if (pmu->nr_addr_filters) device_remove_file(pmu->dev, &dev_attr_nr_addr_filters); @@ -11687,7 +11688,6 @@ void perf_pmu_unregister(struct pmu *pmu) put_device(pmu->dev); } free_pmu_context(pmu); - mutex_unlock(&pmus_lock); } EXPORT_SYMBOL_GPL(perf_pmu_unregister); -- 2.34.1

1 0

[PATCH OLK-6.6] ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
by Qi Xi 01 Apr '25

01 Apr '25

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> mainline inclusion from mainline-v6.14-rc1 commit 301c26a018acb94dd537a4418cefa0f654500c6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRED3 CVE: CVE-2024-58077 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc_pcm_ret(). It is used from many functions, ignoring -EINVAL is over-kill. The reason why -EINVAL was ignored was it really should only be used upon invalid parameters coming from userspace and in that case we don't want to log an error since we do not want to give userspace a way to do a denial-of-service attack on the syslog / diskspace. So don't use soc_pcm_ret() on .prepare callback is better idea. Link: https://lore.kernel.org/r/87v7vptzap.wl-kuninori.morimoto.gx@renesas.com Cc: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Link: https://patch.msgid.link/87bjxg8jju.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- sound/soc/soc-pcm.c | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 511446a30c05..60248a6820aa 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -38,7 +38,6 @@ static inline int _soc_pcm_ret(struct snd_soc_pcm_runtime *rtd, switch (ret) { case -EPROBE_DEFER: case -ENOTSUPP: - case -EINVAL: break; default: dev_err(rtd->dev, @@ -902,7 +901,13 @@ static int __soc_pcm_prepare(struct snd_soc_pcm_runtime *rtd, } out: - return soc_pcm_ret(rtd, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } /* PCM prepare ops for non-DPCM streams */ @@ -914,6 +919,13 @@ static int soc_pcm_prepare(struct snd_pcm_substream *substream) snd_soc_dpcm_mutex_lock(rtd); ret = __soc_pcm_prepare(rtd, substream); snd_soc_dpcm_mutex_unlock(rtd); + + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ return ret; } @@ -2461,7 +2473,13 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) be->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE; } - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) @@ -2501,7 +2519,13 @@ static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO); snd_soc_dpcm_mutex_unlock(fe); - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_run_update_shutdown(struct snd_soc_pcm_runtime *fe, int stream) -- 2.33.0

2 1

[openeuler:openEuler-1.0-LTS 1544/1544] mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'?
by kernel test robot 01 Apr '25

01 Apr '25

Hi Ding, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 4a280fac30d27ae2aff096f9f99aa12d50f83426 [1544/1544] ascend: share_pool: support share pool features for ascend platform config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250401/202504011702.UDJZ2vxB-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250401/202504011702.UDJZ2vxB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504011702.UDJZ2vxB-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c:55:5: sparse: sparse: symbol 'enable_mdc_default_group' was not declared. Should it be static? mm/share_pool.c:172:6: sparse: sparse: symbol 'host_svm_sp_enable' was not declared. Should it be static? mm/share_pool.c:1542:21: sparse: sparse: undefined identifier 'huge_ptep_get' mm/share_pool.c:1542:34: sparse: sparse: invalid initializer mm/share_pool.c:2263:24: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c:236:28: sparse: sparse: context imbalance in 'spa_dec_usage' - unexpected unlock mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:1542:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 1542 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:1542:21: error: invalid initializer mm/share_pool.c: In function 'sp_alloc_pages': >> mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage >> mm/share_pool.c:2263:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:2263:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:2266:1: warning: control reaches end of non-void function [-Wreturn-type] 2266 | } | ^ cc1: some warnings being treated as errors sparse warnings: (new ones prefixed by >>) mm/share_pool.c:55:5: sparse: sparse: symbol 'enable_mdc_default_group' was not declared. Should it be static? mm/share_pool.c:172:6: sparse: sparse: symbol 'host_svm_sp_enable' was not declared. Should it be static? mm/share_pool.c:1542:21: sparse: sparse: undefined identifier 'huge_ptep_get' >> mm/share_pool.c:1542:34: sparse: sparse: invalid initializer mm/share_pool.c:2263:24: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c:236:28: sparse: sparse: context imbalance in 'spa_dec_usage' - unexpected unlock mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:1542:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 1542 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:1542:21: error: invalid initializer mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage mm/share_pool.c:2263:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:2263:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:2266:1: warning: control reaches end of non-void function [-Wreturn-type] 2266 | } | ^ cc1: some warnings being treated as errors vim +2263 mm/share_pool.c 2257 2258 2259 struct page *sp_alloc_pages(struct vm_struct *area, gfp_t mask, 2260 unsigned int page_order, int node) 2261 { 2262 if (area->flags & VM_HUGE_PAGES) > 2263 return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); 2264 else 2265 return alloc_pages_node(node, mask, page_order); 2266 } 2267 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/5] Some mainline patches merged into drivers/hwmon
by Lifeng Zheng 01 Apr '25

01 Apr '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some mainline patches merged into drivers/hwmon Huisong Li (4): hwmon: (acpi_power_meter) Fix fail to load module on platform without _PMD method hwmon: (acpi_power_meter) Fix uninitialized variables hwmon: (acpi_power_meter) Fix update the power trip points on failure hwmon: (acpi_power_meter) Fix the fake power alarm reporting Kazuhiro Abe (1): hwmon: (acpi_power_meter) Fix a check for the return value of read_domain_devices(). drivers/hwmon/acpi_power_meter.c | 46 +++++++++++++++++++++++++------- 1 file changed, 36 insertions(+), 10 deletions(-) -- 2.33.0

2 6

[openeuler:openEuler-1.0-LTS 1544/1544] block/blk-cgroup.c:478:19: sparse: sparse: incompatible types in comparison expression (different address spaces):
by kernel test robot 01 Apr '25

01 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9866a4dd6fd198f871f6c1692e61ce7d10c96836 commit: 725ee753b5064f03287858bc346d883b8f39319a [1544/1544] bdi: fix use-after-free for the bdi device config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250401/202504011531.jatxCuOT-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250401/202504011531.jatxCuOT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504011531.jatxCuOT-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> block/blk-cgroup.c:478:19: sparse: sparse: incompatible types in comparison expression (different address spaces): block/blk-cgroup.c:478:19: sparse: struct rcu_device [noderef] __rcu * block/blk-cgroup.c:478:19: sparse: struct rcu_device * block/blk-cgroup.c:816:5: sparse: sparse: context imbalance in 'blkg_conf_prep' - wrong count at exit block/blk-cgroup.c:1794: warning: Function parameter or member 'q' not described in 'blkcg_schedule_throttle' block/blk-cgroup.c:1794: warning: Function parameter or member 'use_memdelay' not described in 'blkcg_schedule_throttle' block/blk-cgroup.c:1819: warning: Function parameter or member 'blkg' not described in 'blkcg_add_delay' block/blk-cgroup.c:1819: warning: Function parameter or member 'now' not described in 'blkcg_add_delay' block/blk-cgroup.c:1819: warning: Function parameter or member 'delta' not described in 'blkcg_add_delay' vim +478 block/blk-cgroup.c 472 473 const char *blkg_dev_name(struct blkcg_gq *blkg) 474 { 475 /* some drivers (floppy) instantiate a queue w/o disk registered */ 476 struct rcu_device *rcu_dev; 477 > 478 rcu_dev = rcu_dereference(blkg->q->backing_dev_info->rcu_dev); 479 if (rcu_dev) 480 return dev_name(&rcu_dev->dev); 481 return NULL; 482 } 483 EXPORT_SYMBOL_GPL(blkg_dev_name); 484 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1544/1544] fs/proc/etmem_scan.c:1031: undefined reference to `proc_page_scan_operations'
by kernel test robot 01 Apr '25

01 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9866a4dd6fd198f871f6c1692e61ce7d10c96836 commit: bad4d8833739acc8eef306e7ad5c7877f9f4f0fb [1544/1544] etmem: add etmem-scan feature config: x86_64-randconfig-r113-20250401 (https://download.01.org/0day-ci/archive/20250401/202504011440.KymThb7O-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250401/202504011440.KymThb7O-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504011440.KymThb7O-lkp@intel.com/ All errors (new ones prefixed by >>): ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: .tmp_vmlinux1 has a LOAD segment with RWX permissions ld: fs/proc/etmem_scan.o: in function `page_scan_entry': >> fs/proc/etmem_scan.c:1031: undefined reference to `proc_page_scan_operations' >> ld: fs/proc/etmem_scan.c:1032: undefined reference to `proc_page_scan_operations' >> ld: fs/proc/etmem_scan.c:1031: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.c:1033: undefined reference to `proc_page_scan_operations' >> ld: fs/proc/etmem_scan.c:1032: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.o:fs/proc/etmem_scan.c:1034: more undefined references to `proc_page_scan_operations' follow vim +1031 fs/proc/etmem_scan.c 1028 1029 static int page_scan_entry(void) 1030 { > 1031 proc_page_scan_operations.owner = THIS_MODULE; > 1032 proc_page_scan_operations.read = page_scan_read; 1033 proc_page_scan_operations.open = page_scan_open; 1034 proc_page_scan_operations.release = page_scan_release; 1035 return 0; 1036 } 1037 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] tty: xilinx_uartps: split sysrq handling
by Yi Yang 01 Apr '25

01 Apr '25

From: Sean Anderson <sean.anderson(a)linux.dev> stable inclusion from stable-v6.6.78 commit 8ea0e7b3d7b8f2f0fc9db491ff22a0abe120801c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLKD CVE: CVE-2025-21820 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b06f388994500297bb91be60ffaf6825ecfd2afe upstream. lockdep detects the following circular locking dependency: CPU 0 CPU 1 ========================== ============================ cdns_uart_isr() printk() uart_port_lock(port) console_lock() cdns_uart_console_write() if (!port->sysrq) uart_port_lock(port) uart_handle_break() port->sysrq = ... uart_handle_sysrq_char() printk() console_lock() The fixed commit attempts to avoid this situation by only taking the port lock in cdns_uart_console_write if port->sysrq unset. However, if (as shown above) cdns_uart_console_write runs before port->sysrq is set, then it will try to take the port lock anyway. This may result in a deadlock. Fix this by splitting sysrq handling into two parts. We use the prepare helper under the port lock and defer handling until we release the lock. Fixes: 74ea66d4ca06 ("tty: xuartps: Improve sysrq handling") Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Cc: stable(a)vger.kernel.org # c980248179d: serial: xilinx_uartps: Use port lock wrappers Acked-by: John Ogness <john.ogness(a)linutronix.de> Link: https://lore.kernel.org/r/20250110213822.2107462-1-sean.anderson@linux.dev Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/serial/xilinx_uartps.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c index 2e5e86a00a77..7f83d2780017 100644 --- a/drivers/tty/serial/xilinx_uartps.c +++ b/drivers/tty/serial/xilinx_uartps.c @@ -268,7 +268,7 @@ static void cdns_uart_handle_rx(void *dev_id, unsigned int isrstatus) continue; } - if (uart_handle_sysrq_char(port, data)) + if (uart_prepare_sysrq_char(port, data)) continue; if (is_rxbs_support) { @@ -369,7 +369,7 @@ static irqreturn_t cdns_uart_isr(int irq, void *dev_id) !(readl(port->membase + CDNS_UART_CR) & CDNS_UART_CR_RX_DIS)) cdns_uart_handle_rx(dev_id, isrstatus); - spin_unlock(&port->lock); + uart_unlock_and_check_sysrq(port); return IRQ_HANDLED; } @@ -1229,10 +1229,8 @@ static void cdns_uart_console_write(struct console *co, const char *s, unsigned int imr, ctrl; int locked = 1; - if (port->sysrq) - locked = 0; - else if (oops_in_progress) - locked = spin_trylock_irqsave(&port->lock, flags); + if (oops_in_progress) + locked = uart_port_trylock_irqsave(port, &flags); else spin_lock_irqsave(&port->lock, flags); -- 2.25.1

2 1

[PATCH OLK-6.6] can: etas_es58x: fix potential NULL pointer dereference on udev->serial
by Yi Yang 01 Apr '25

01 Apr '25

From: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> stable inclusion from stable-v6.6.79 commit 1590667a60753ee5a54871f2840ceefd4a7831fa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8Y CVE: CVE-2025-21773 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a1ad2109ce41c9e3912dadd07ad8a9c640064ffb upstream. The driver assumed that es58x_dev->udev->serial could never be NULL. While this is true on commercially available devices, an attacker could spoof the device identity providing a NULL USB serial number. That would trigger a NULL pointer dereference. Add a check on es58x_dev->udev->serial before accessing it. Reported-by: yan kang <kangyan91(a)outlook.com> Reported-by: yue sun <samsun1006219(a)gmail.com> Closes: https://lore.kernel.org/linux-can/SY8P300MB0421E0013C0EBD2AA46BA709A1F42@SY… Fixes: 9f06631c3f1f ("can: etas_es58x: export product information through devlink_ops::info_get()") Signed-off-by: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> Link: https://patch.msgid.link/20250204154859.9797-2-mailhol.vincent@wanadoo.fr Cc: stable(a)vger.kernel.org Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/net/can/usb/etas_es58x/es58x_devlink.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/usb/etas_es58x/es58x_devlink.c b/drivers/net/can/usb/etas_es58x/es58x_devlink.c index 635edeb8f68c..e763a9904bed 100644 --- a/drivers/net/can/usb/etas_es58x/es58x_devlink.c +++ b/drivers/net/can/usb/etas_es58x/es58x_devlink.c @@ -248,7 +248,11 @@ static int es58x_devlink_info_get(struct devlink *devlink, return ret; } - return devlink_info_serial_number_put(req, es58x_dev->udev->serial); + if (es58x_dev->udev->serial) + ret = devlink_info_serial_number_put(req, + es58x_dev->udev->serial); + + return ret; } const struct devlink_ops es58x_dl_ops = { -- 2.25.1

2 1

[PATCH] perf/core: Fix pmus_lock vs. pmus_srcu ordering
by Luo Gengkun 01 Apr '25

01 Apr '25

From: Peter Zijlstra <peterz(a)infradead.org> stable inclusion from stable-v6.6.83 commit 7c823e4c30d6fdc16089e13924260086eaea76be category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBXQNU Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2565e42539b120b81a68a58da961ce5d1e34eac8 ] Commit a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") placed pmus_lock inside pmus_srcu, this makes perf_pmu_unregister() trip lockdep. Move the locking about such that only pmu_idr and pmus (list) are modified while holding pmus_lock. This avoids doing synchronize_srcu() while holding pmus_lock and all is well again. Fixes: a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20241104135517.679556858@infradead.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 0b9e703641d1..9b5d35c4a3ec 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -11670,6 +11670,8 @@ void perf_pmu_unregister(struct pmu *pmu) { mutex_lock(&pmus_lock); list_del_rcu(&pmu->entry); + idr_remove(&pmu_idr, pmu->type); + mutex_unlock(&pmus_lock); /* * We dereference the pmu list under both SRCU and regular RCU, so @@ -11679,7 +11681,6 @@ void perf_pmu_unregister(struct pmu *pmu) synchronize_rcu(); free_percpu(pmu->pmu_disable_count); - idr_remove(&pmu_idr, pmu->type); if (pmu_bus_running && pmu->dev && pmu->dev != PMU_NULL_DEV) { if (pmu->nr_addr_filters) device_remove_file(pmu->dev, &dev_attr_nr_addr_filters); @@ -11687,7 +11688,6 @@ void perf_pmu_unregister(struct pmu *pmu) put_device(pmu->dev); } free_pmu_context(pmu); - mutex_unlock(&pmus_lock); } EXPORT_SYMBOL_GPL(perf_pmu_unregister); -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] ext4: avoid updating the superblock on a r/o mount if not needed
by Yongjian Sun 01 Apr '25

01 Apr '25

From: Theodore Ts'o <tytso(a)mit.edu> mainline inclusion from mainline-v6.5-rc1 commit 2ef6c32a914b85217b44a0a2418e830e520b085e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBXUAV CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ This was noticed by a user who noticied that the mtime of a file backing a loopback device was getting bumped when the loopback device is mounted read/only. Note: This doesn't show up when doing a loopback mount of a file directly, via "mount -o ro /tmp/foo.img /mnt", since the loop device is set read-only when mount automatically creates loop device. However, this is noticeable for a LUKS loop device like this: % cryptsetup luksOpen /tmp/foo.img test % mount -o ro /dev/loop0 /mnt ; umount /mnt or, if LUKS is not in use, if the user manually creates the loop device like this: % losetup /dev/loop0 /tmp/foo.img % mount -o ro /dev/loop0 /mnt ; umount /mnt The modified mtime causes rsync to do a rolling checksum scan of the file on the local and remote side, incrementally increasing the time to rsync the not-modified-but-touched image file. Fixes: eee00237fa5e ("ext4: commit super block if fs record error when journal record without error") Cc: stable(a)kernel.org Link: https://lore.kernel.org/r/ZIauBR7YiV3rVAHL@glitch Reported-by: Sean Greenslade <sean(a)seangreenslade.com> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/super.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 8761fe5037a6..db47f5acf629 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5160,19 +5160,27 @@ static int ext4_load_journal(struct super_block *sb, err = jbd2_journal_wipe(journal, !really_read_only); if (!err) { char *save = kmalloc(EXT4_S_ERR_LEN, GFP_KERNEL); + __le16 orig_state; + bool changed = false; if (save) memcpy(save, ((char *) es) + EXT4_S_ERR_START, EXT4_S_ERR_LEN); err = jbd2_journal_load(journal); - if (save) + if (save && memcmp(((char *) es) + EXT4_S_ERR_START, + save, EXT4_S_ERR_LEN)) { memcpy(((char *) es) + EXT4_S_ERR_START, save, EXT4_S_ERR_LEN); + changed = true; + } kfree(save); + orig_state = es->s_state; es->s_state |= cpu_to_le16(EXT4_SB(sb)->s_mount_state & EXT4_ERROR_FS); + if (orig_state != es->s_state) + changed = true; /* Write out restored error information to the superblock */ - if (!bdev_read_only(sb->s_bdev)) { + if (changed && !really_read_only) { int err2; err2 = ext4_commit_super(sb); err = err ? : err2; -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] Merge March mainline patch
by Luo Gengkun 01 Apr '25

01 Apr '25

Breno Leitao (1): perf/core: Add RCU read lock protection to perf_iterate_ctx() Peter Zijlstra (1): perf/core: Fix pmus_lock vs. pmus_srcu ordering kernel/events/core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/3] *** CVE-2025-21823 ***
by Zicheng Qu 01 Apr '25

01 Apr '25

*** BLURB HERE *** Andy Strohman (1): batman-adv: fix panic during interface removal Sven Eckelmann (2): batman-adv: Ignore neighbor throughput metrics in error case batman-adv: Drop unmanaged ELP metric worker net/batman-adv/bat_v.c | 2 - net/batman-adv/bat_v_elp.c | 122 ++++++++++++++++++++++++++----------- net/batman-adv/bat_v_elp.h | 2 - net/batman-adv/types.h | 3 - 4 files changed, 86 insertions(+), 43 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/5] *** CVE-2025-21823 ***
by Zicheng Qu 01 Apr '25

01 Apr '25

*** BLURB HERE *** Andy Strohman (1): batman-adv: fix panic during interface removal Sven Eckelmann (4): batman-adv: Add new include for min/max helpers batman-adv: Drop initialization of flexible ethtool_link_ksettings batman-adv: Ignore neighbor throughput metrics in error case batman-adv: Drop unmanaged ELP metric worker net/batman-adv/bat_v.c | 3 +- net/batman-adv/bat_v_elp.c | 124 ++++++++++++++++++++++---------- net/batman-adv/bat_v_elp.h | 2 - net/batman-adv/bat_v_ogm.c | 1 + net/batman-adv/fragmentation.c | 2 +- net/batman-adv/hard-interface.c | 1 + net/batman-adv/icmp_socket.c | 1 + net/batman-adv/main.c | 1 + net/batman-adv/netlink.c | 1 + net/batman-adv/tp_meter.c | 1 + net/batman-adv/types.h | 3 - 11 files changed, 95 insertions(+), 45 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6 0/9] CVE-2024-50102
by Qi Xi 01 Apr '25

01 Apr '25

David Gow (1): x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit David Laight (1): x86: fix off-by-one in access_ok() Linus Torvalds (5): runtime constants: deal with old decrepit linkers runtime constants: add x86 architecture support x86: fix whitespace in runtime-const assembler output x86/uaccess: Improve the 8-byte getuser() case x86: fix user address masking non-canonical speculation issue Stephen Brennan (1): dcache: keep dentry_hashtable or d_hash_shift even when not used Thomas Gleixner (1): x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() arch/x86/include/asm/runtime-const.h | 61 +++++++++++++++++++++ arch/x86/include/asm/uaccess_64.h | 49 ++++++++++------- arch/x86/kernel/cpu/common.c | 10 ++++ arch/x86/kernel/vmlinux.lds.S | 4 ++ arch/x86/lib/getuser.S | 80 ++++++++++------------------ fs/dcache.c | 9 +++- include/asm-generic/vmlinux.lds.h | 7 +++ 7 files changed, 149 insertions(+), 71 deletions(-) create mode 100644 arch/x86/include/asm/runtime-const.h -- 2.33.0

2 10

[PATCH OLK-6.6 v3 0/8] Add support for IPIv
by Jinqian Yang 01 Apr '25

01 Apr '25

Patch#1 Allocate VM table and save vpeid in it Patch#2 avoid sending multi-SGIs in IPIV Patch#3 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#4 Register ipiv exception interrupt Patch#5 Add interface KVM_CAP_ARM_IPIV_MODE Patch#6 Probe and configure IPIV capacity on HIP12 Patch#7 Pre-allocate vpe id for direct mode Patch#8 Add support for ipiv direct mode Jinqian Yang (1): KVM: arm64: avoid sending multi-SGIs in IPIV Xiang Chen (7): kvm: hisi_virt: Allocate VM table and save vpeid in it irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Register ipiv exception interrupt kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 kvm: hisi_virt: Pre-allocate vpe id for direct mode kvm: hisi_virt: Add support for ipiv direct mode .../admin-guide/kernel-parameters.txt | 8 ++ arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kvm/arm.c | 21 ++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 42 +++++++ arch/arm64/kvm/hisilicon/hisi_virt.h | 11 ++ arch/arm64/kvm/sys_regs.c | 44 +++++-- arch/arm64/kvm/vgic/vgic-init.c | 84 ++++++++++++- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 + drivers/irqchip/irq-gic-v3-its.c | 114 ++++++++++++++++-- drivers/irqchip/irq-gic-v3.c | 42 +++++++ include/kvm/arm_vgic.h | 2 + include/linux/irqchip/arm-gic-v3.h | 24 ++++ include/linux/irqchip/arm-gic-v4.h | 3 + include/uapi/linux/kvm.h | 2 + 14 files changed, 380 insertions(+), 20 deletions(-) -- 2.33.0

2 9

[PATCH OLK-6.6 0/5] Some mainline patches merged into drivers/hwmon
by Lifeng Zheng 01 Apr '25

01 Apr '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some mainline patches merged into drivers/hwmon Huisong Li (4): hwmon: (acpi_power_meter) Fix fail to load module on platform without _PMD method hwmon: (acpi_power_meter) Fix uninitialized variables hwmon: (acpi_power_meter) Fix update the power trip points on failure hwmon: (acpi_power_meter) Fix the fake power alarm reporting Kazuhiro Abe (1): hwmon: (acpi_power_meter) Fix a check for the return value of read_domain_devices(). drivers/hwmon/acpi_power_meter.c | 46 +++++++++++++++++++++++++------- 1 file changed, 36 insertions(+), 10 deletions(-) -- 2.33.0

2 6

[PATCH OLK-6.6 0/2] CVE-2024-52560
by Yongjian Sun 31 Mar '25

31 Mar '25

Konstantin Komarov (2): [Backport] fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr() [Backport] fs/ntfs3: Unify inode corruption marking with _ntfs_bad_inode() fs/ntfs3/attrib.c | 13 ++++---- fs/ntfs3/dir.c | 2 +- fs/ntfs3/frecord.c | 71 +++++++++++++++++++++++-------------------- fs/ntfs3/fsntfs.c | 6 +++- fs/ntfs3/index.c | 6 ++-- fs/ntfs3/inode.c | 3 ++ fs/ntfs3/ntfs_fs.h | 21 ++++++------- fs/ntfs3/record.c | 75 ++++++++++++++++++++++++---------------------- 8 files changed, 107 insertions(+), 90 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] phy: qcom-qmp: fix reset-controller leak on probe errors
by Ye Bin 31 Mar '25

31 Mar '25

From: Johan Hovold <johan+linaro(a)kernel.org> stable inclusion from stable-v4.19.247 commit a39d9eccb333b8c07c43ebea1c6dfda122378a0f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP74Q CVE: CVE-2022-49396 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------- commit 4d2900f20edfe541f75756a00deeb2ffe7c66bc1 upstream. Make sure to release the lane reset controller in case of a late probe error (e.g. probe deferral). Note that due to the reset controller being defined in devicetree in "lane" child nodes, devm_reset_control_get_exclusive() cannot be used directly. Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets") Cc: stable(a)vger.kernel.org # 4.12 Cc: Vivek Gautam <vivek.gautam(a)codeaurora.org> Reviewed-by: Philipp Zabel <p.zabel(a)pengutronix.de> Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org> Reviewed-by: Bjorn Andersson <bjorn.andersson(a)linaro.org> Link: https://lore.kernel.org/r/20220427063243.32576-3-johan+linaro@kernel.org Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/phy/qualcomm/phy-qcom-qmp.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/phy/qualcomm/phy-qcom-qmp.c b/drivers/phy/qualcomm/phy-qcom-qmp.c index 4c470104a0d6..ae1b2847b52d 100644 --- a/drivers/phy/qualcomm/phy-qcom-qmp.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp.c @@ -1424,6 +1424,11 @@ static const struct phy_ops qcom_qmp_phy_gen_ops = { .owner = THIS_MODULE, }; +static void qcom_qmp_reset_control_put(void *data) +{ + reset_control_put(data); +} + static int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id) { @@ -1488,6 +1493,10 @@ int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id) dev_err(dev, "failed to get lane%d reset\n", id); return PTR_ERR(qphy->lane_rst); } + ret = devm_add_action_or_reset(dev, qcom_qmp_reset_control_put, + qphy->lane_rst); + if (ret) + return ret; } generic_phy = devm_phy_create(dev, np, &qcom_qmp_phy_gen_ops); -- 2.34.1

2 1

[PATCH OLK-6.6 v2 0/8] Add support for IPIv
by Jinqian Yang 31 Mar '25

31 Mar '25

Patch#1 Allocate VM table and save vpeid in it Patch#2 avoid sending multi-SGIs in IPIV Patch#3 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#4 Register ipiv exception interrupt Patch#5 Add interface KVM_CAP_ARM_IPIV_MODE Patch#6 Probe and configure IPIV capacity on HIP12 Patch#7 Pre-allocate vpe id for direct mode Patch#8 Add support for ipiv direct mode Xiang Chen (7): kvm: hisi_virt: Allocate VM table and save vpeid in it irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Register ipiv exception interrupt kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 kvm: hisi_virt: Pre-allocate vpe id for direct mode kvm: hisi_virt: Add support for ipiv direct mode yangjinqian (1): KVM: arm64: avoid sending multi-SGIs in IPIV .../admin-guide/kernel-parameters.txt | 8 ++ arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kvm/arm.c | 21 ++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 42 +++++++ arch/arm64/kvm/hisilicon/hisi_virt.h | 11 ++ arch/arm64/kvm/sys_regs.c | 44 +++++-- arch/arm64/kvm/vgic/vgic-init.c | 84 ++++++++++++- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 + drivers/irqchip/irq-gic-v3-its.c | 114 ++++++++++++++++-- drivers/irqchip/irq-gic-v3.c | 42 +++++++ include/kvm/arm_vgic.h | 2 + include/linux/irqchip/arm-gic-v3.h | 24 ++++ include/linux/irqchip/arm-gic-v4.h | 3 + include/uapi/linux/kvm.h | 2 + 14 files changed, 380 insertions(+), 20 deletions(-) -- 2.33.0

2 9

[PATCH openEuler-testcase] TEST: add Dynamic Memory Bandwidth Regulator and Tracer
by Zeng Heng 31 Mar '25

31 Mar '25

Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- bw_dynamic.py | 184 ++++++++++++++++++++++++++++++++++++++++++++++ calc_cpu_usage.py | 27 +++++++ draw_bw.py | 105 ++++++++++++++++++++++++++ draw_cpu.py | 34 +++++++++ draw_llc.py | 66 +++++++++++++++++ pidcontroller.py | 35 +++++++++ 6 files changed, 451 insertions(+) create mode 100644 bw_dynamic.py create mode 100644 calc_cpu_usage.py create mode 100644 draw_bw.py create mode 100644 draw_cpu.py create mode 100644 draw_llc.py create mode 100644 pidcontroller.py diff --git a/bw_dynamic.py b/bw_dynamic.py new file mode 100644 index 000000000000..51509928aef0 --- /dev/null +++ b/bw_dynamic.py @@ -0,0 +1,184 @@ +import os, time, signal, json, sys +from pidcontroller import PIDController +from calc_cpu_usage import read_cpu_times, calculate_cpu_utilization + +numa_bw_limit = 80000 +lc_grp = "." +be_grp = "p1" + +bw_list = [] +llc_list = [] +set_list = [] +cpu_list = [] + +def read_bw(grp): + resctrl_mon_data_dir = '/sys/fs/resctrl/%s/mon_data/' % grp + mon_data_dirs = os.listdir(resctrl_mon_data_dir) + mon_MB_dirs = [dir for dir in mon_data_dirs if dir.startswith('mon_MB_')] + + vals = [] + for mb_dir in mon_MB_dirs: + with open(resctrl_mon_data_dir + mb_dir + '/mbm_total_bytes', 'r') as f: + line = f.readline() + vals.append(int(line.strip())) + + return vals + +def increase_bw(i, percent): + print("increase NUMA%d %d%%" % (i, percent)) + + resctrl_par_dir = '/sys/fs/resctrl/%s/schemata' % be_grp + with open(resctrl_par_dir, 'r') as f: + lines = f.readlines() + + for line in lines: + if "MB:" in line: + config = line.split(":") + config = config[1].split(";") + origin_p = int(config[i].split("=")[1]) + + new_p = (origin_p + percent) + if new_p > 100: + new_p = 100 + elif new_p < 8: + new_p = 8 + + # if percent < 0: + # cnt = "MBHDL:%d=1\n" % i + # with open(resctrl_par_dir, 'w+') as f: + # f.write(cnt) + + cnt = "MB:%d=%d" % (i, new_p) + print("%s<=%d" % (cnt, origin_p)) + if new_p == origin_p: + return origin_p + + with open(resctrl_par_dir, 'w+') as f: + f.write("%s\n" % cnt) + + return origin_p + +def gain_numa_bw(pid_ctl, adjust_enable, target_percent): + lc_val = read_bw(lc_grp) + be_val = read_bw(be_grp) + + numa_bw_state = [] + numa_set = [] + + for i in range(len(lc_val)): + bw_state = {"total_bw": {}, "lc_bw": {}, "be_bw": {}} + + bw_sum = lc_val[i] + be_val[i] + + bw_state["total_bw"] = bw_sum + bw_state["lc_bw"] = lc_val[i] + bw_state["be_bw"] = be_val[i] + numa_bw_state.append(bw_state) + + set_state = {"setting": {}, "delta": {}} + + if adjust_enable == True: + if bw_state["lc_bw"] < (0.04 * numa_bw_limit): + # enlarge BE load + diff = 5 + elif bw_state["lc_bw"] > (target_percent / 100 * numa_bw_limit): + # shutdown BE load + diff = -100 + else: + diff = pid_ctl[i].update(bw_sum * 100 // numa_bw_limit , 1) + else: + diff = 0 + + curr = increase_bw(i, diff) + set_state['setting'] = curr + set_state['delta'] = diff + + numa_set.append(set_state) + + bw_list.append(numa_bw_state) + set_list.append(numa_set) + return + +def read_llc(grp): + resctrl_mon_data_dir = '/sys/fs/resctrl/%s/mon_data/' % grp + mon_data_dirs = os.listdir(resctrl_mon_data_dir) + mon_MB_dirs = [dir for dir in mon_data_dirs if dir.startswith('mon_L3_')] + + vals = [] + for mb_dir in mon_MB_dirs: + with open(resctrl_mon_data_dir + mb_dir + '/llc_occupancy', 'r') as f: + line = f.readline() + vals.append(int(line.strip())) + + return vals + +def gain_numa_llc(): + lc_llc = read_llc(lc_grp) + be_llc = read_llc(be_grp) + + numa_llc_state = [] + + for i in range(len(lc_llc)): + llc_state = {"total_llc": {}, "lc_llc": {}, "be_llc": {}} + + total_llc = lc_llc[i] + be_llc[i] + llc_state["total_llc"] = total_llc + + llc_state["lc_llc"] = lc_llc[i] + llc_state["be_llc"] = be_llc[i] + numa_llc_state.append(llc_state) + + llc_list.append(numa_llc_state) + return + +def gain_cpu(time1, time2): + usage = calculate_cpu_utilization(time1, time2) + print(f"CPU usage: {usage:.2f}%") + cpu_list.append(usage) + return + +def save_file(sig, frame): + with open(f"ctrlgrp_bw.data", 'w') as fl: + json.dump(bw_list, fl) + + with open(f"schemata_set.data", 'w') as fl: + json.dump(set_list, fl) + + with open(f"ctrlgrp_llc.data", 'w') as fl: + json.dump(llc_list, fl) + + with open(f"cpu_usage.data", 'w') as fl: + json.dump(cpu_list, fl) + + exit(0) + +if __name__ == "__main__": + signal.signal(signal.SIGINT, save_file) + + enable = True + target_percent = 60 + + num_args = len(sys.argv) - 1 + if num_args == 1 and sys.argv[1].isdigit(): + target_percent = int(sys.argv[1]) + else: + enable = False + + pid_ctl = [] + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + + time1 = read_cpu_times() + + while True: + gain_numa_bw(pid_ctl, enable, target_percent) + gain_numa_llc() + + time2 = read_cpu_times() + gain_cpu(time1, time2) + time1 = time2 + + print("..........................") + time.sleep(1) diff --git a/calc_cpu_usage.py b/calc_cpu_usage.py new file mode 100644 index 000000000000..98fef7a2c1f5 --- /dev/null +++ b/calc_cpu_usage.py @@ -0,0 +1,27 @@ +import time + +def read_cpu_times(): + with open('/proc/stat', 'r') as f: + line = f.readline() + parts = line.split() + return list(map(int, parts[1:])) + +def calculate_cpu_utilization(times1, times2): + total1 = sum(times1) + idle1 = times1[3] + total2 = sum(times2) + idle2 = times2[3] + total_diff = total2 - total1 + idle_diff = idle2 - idle1 + return (total_diff - idle_diff) / total_diff * 100 + +# def gain_cpu(time1, time2): +# usage = calculate_cpu_utilization(time1, time2) +# print(f"CPU usage: {usage:.2f}%") +# return time2 + +# time1 = read_cpu_times() +# while True: +# time.sleep(1) +# time2 = read_cpu_times() +# time1 = gain_cpu(time1, time2) diff --git a/draw_bw.py b/draw_bw.py new file mode 100644 index 000000000000..17f28842cbcc --- /dev/null +++ b/draw_bw.py @@ -0,0 +1,105 @@ +import json +import matplotlib.pyplot as plt + +target_percent = 60 / 100 +bw_limit = target_percent * 80000 + +def get_all_bw(data_list, idx): + total = [] + lc = [] + be = [] + + for data in data_list: + total.append(data[idx]['total_bw']) + lc.append(data[idx]['lc_bw']) + be.append(data[idx]['be_bw']) + + return total, lc, be + +def get_all_set(set_list, idx): + setting = [] + delta = [] + + for data in set_list: + setting.append(data[idx]['setting']) + delta.append(data[idx]['delta']) + + return setting, delta + +def draw_data(bw_list, set_list, cpu_list): + fig = plt.figure() + x_arr = list(range(len(bw_list))) + + # numa_cnt = len(bw_list[0]) + # only draw numa1 + numa_cnt_display = 1 + numa_th = 1 + for cnt in range(numa_cnt_display): + ax1 = fig.add_subplot(numa_cnt_display * 2 + 1, 1, cnt * 2 + 1) + # total, lc, be = get_all_bw(bw_list, cnt) + total, lc, be = get_all_bw(bw_list, numa_th) + ref = [bw_limit] * len(bw_list) + + ax1.plot(x_arr, total, label='total bw') + ax1.plot(x_arr, lc, label='lc bw') + ax1.plot(x_arr, be, label='be bw') + ax1.plot(x_arr, ref, label='reference') + ax1.legend() + + ax2 = fig.add_subplot(numa_cnt_display * 2 + 1, 1, cnt * 2 + 2) + # setting, delta = get_all_set(set_list, cnt) + setting, delta = get_all_set(set_list, numa_th) + + ref = [0] * len(bw_list) + ax2.plot(x_arr, setting, label='setting') + ax2.plot(x_arr, delta, label='delta') + ax2.plot(x_arr, ref, label='reference') + ax2.legend() + + # ax3 = fig.add_subplot(5, 1, 3) + # total, lc, be = get_all_bw(bw_list, 1) + + # ax3.plot(x_arr, total, label='total bw') + # ax3.plot(x_arr, lc, label='lc bw') + # ax3.plot(x_arr, be, label='be bw') + # ax3.plot(x_arr, ref, label='reference') + # ax3.legend() + + # ax4 = fig.add_subplot(5, 1, 4) + # setting, delta = get_all_set(set_list, 1) + + # ax4.plot(x_arr, setting, label='setting') + # ax4.plot(x_arr, delta, label='delta') + # ax4.legend() + + ax5 = fig.add_subplot(numa_cnt_display * 2 + 1, 1, numa_cnt_display * 2 + 1) + + ax5.plot(x_arr, cpu_list, label='CPU usage') + ax5.legend() + + plt.tight_layout() + plt.show() + + return + +def get_data(file): + try: + with open(file, 'r') as f: + data_list = json.load(f) + except FileNotFoundError: + return None + + return data_list + +if __name__ == '__main__': + filename = 'ctrlgrp_bw.data' + bw_list = get_data(filename) + filename = 'schemata_set.data' + set_list = get_data(filename) + filename = 'cpu_usage.data' + cpu_list = get_data(filename) + + if bw_list and set_list: + draw_data(bw_list, set_list, cpu_list) + else: + print('FileNotFound') diff --git a/draw_cpu.py b/draw_cpu.py new file mode 100644 index 000000000000..02e5b0e48376 --- /dev/null +++ b/draw_cpu.py @@ -0,0 +1,34 @@ +import json +import matplotlib.pyplot as plt + +def draw_data(cpu_list): + fig = plt.figure() + x_arr = list(range(len(cpu_list))) + + ax1 = fig.add_subplot(1, 1, 1) + + ax1.plot(x_arr, cpu_list, label='CPU usage') + ax1.legend() + + plt.tight_layout() + plt.show() + + return + +def get_data(file): + try: + with open(file, 'r') as f: + cpu_list = json.load(f) + except FileNotFoundError: + return None + + return cpu_list + +if __name__ == '__main__': + filename = 'cpu_usage.data' + cpu_list = get_data(filename) + + if cpu_list: + draw_data(cpu_list) + else: + print('FileNotFound') diff --git a/draw_llc.py b/draw_llc.py new file mode 100644 index 000000000000..7538eac3925d --- /dev/null +++ b/draw_llc.py @@ -0,0 +1,66 @@ +import json +import matplotlib.pyplot as plt + +def get_all_llc(data_list, idx): + total = [] + lc = [] + be = [] + + for data in data_list: + total.append(data[idx]['total_llc'] / 1000) + lc.append(data[idx]['lc_llc'] / 1000) + be.append(data[idx]['be_llc'] / 1000) + + return total, lc, be + +def draw_data(llc_list, cpu_list): + fig = plt.figure() + x_arr = list(range(len(llc_list))) + + # only draw numa1 + numa_cnt_display = 1 + numa_th = 0 + for cnt in range(numa_cnt_display): + ax1 = fig.add_subplot(numa_cnt_display + 1, 1, cnt + 1) + total, lc, be = get_all_llc(llc_list, numa_th) + + ax1.plot(x_arr, total, label='total llc') + ax1.plot(x_arr, lc, label='lc llc') + ax1.plot(x_arr, be, label='be llc') + + ax1.set_ylabel(f"L3 Cache (kB)") + ax1.set_xlabel(f"Time (s)") + ax1.legend() + + ax2 = fig.add_subplot(numa_cnt_display + 1, 1, numa_cnt_display + 1) + ax2.plot(x_arr, cpu_list, label='CPU usage') + + ax2.set_ylabel(f"CPU Load (%)") + ax2.set_xlabel(f"Time (s)") + + ax2.legend() + + plt.tight_layout() + plt.show() + + return + +def get_data(file): + try: + with open(file, 'r') as f: + data_list = json.load(f) + except FileNotFoundError: + return None + + return data_list + +if __name__ == '__main__': + filename = 'ctrlgrp_llc.data' + llc_list = get_data(filename) + filename = 'cpu_usage.data' + cpu_list = get_data(filename) + + if llc_list: + draw_data(llc_list, cpu_list) + else: + print('FileNotFound') diff --git a/pidcontroller.py b/pidcontroller.py new file mode 100644 index 000000000000..4d03d2f28aa1 --- /dev/null +++ b/pidcontroller.py @@ -0,0 +1,35 @@ +class PIDController: + def __init__(self, kp, ki, kd, set_point): + self.kp = kp # 比例增益 + self.ki = ki # 积分增益 + self.kd = kd # 微分增益 + self.set_point = set_point # 设定值 + self.last_error = 0 # 上一次的误差 + self.integral = 0 # 积分项 + + self.max_output = 5 # 缓升 + self.min_output = -100 # 快降 + + def update(self, current_value, dt): + """ + 更新PID控制器的输出 + :param current_value: 当前系统的输出值 + :param dt: 时间间隔 + :return: 控制器的输出 + """ + error = self.set_point - current_value # 计算当前误差 + self.integral += error * dt # 更新积分项 + derivative = (error - self.last_error) / dt # 计算微分项 + + # 计算PID控制器的输出 + output = (self.kp * error) + (self.ki * self.integral) + (self.kd * derivative) + + self.last_error = error # 更新上一次的误差 + + # 限制输出范围 + if output > self.max_output: + output = self.max_output + elif output < self.min_output: + output = self.min_output + + return output -- 2.25.1

1 0

[openeuler:openEuler-1.0-LTS 1541/1541] kernel/trace/.tmp_trace_output.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 31 Mar '25

31 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c09d565ea3e651c408ca3d0e0c2499e5e90a77ae commit: 31bf327231bb582ec7dca0490cc90c364b36e095 [1541/1541] tracing: Make sure trace_printk() can output as soon as it can be used config: x86_64-buildonly-randconfig-003-20250331 (https://download.01.org/0day-ci/archive/20250331/202503312102.s1xJYVFA-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503312102.s1xJYVFA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503312102.s1xJYVFA-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/trace/.tmp_trace_output.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-testcase] TEST: add Dynamic Memory Bandwidth Regulator and Tracer
by Zeng Heng 31 Mar '25

31 Mar '25

Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- bw_dynamic.py | 184 ++++++++++++++++++++++++++++++++++++++++++++++ calc_cpu_usage.py | 27 +++++++ draw_bw.py | 105 ++++++++++++++++++++++++++ draw_cpu.py | 34 +++++++++ pidcontroller.py | 35 +++++++++ 5 files changed, 385 insertions(+) create mode 100644 bw_dynamic.py create mode 100644 calc_cpu_usage.py create mode 100644 draw_bw.py create mode 100644 draw_cpu.py create mode 100644 pidcontroller.py diff --git a/bw_dynamic.py b/bw_dynamic.py new file mode 100644 index 000000000000..fff0a389094a --- /dev/null +++ b/bw_dynamic.py @@ -0,0 +1,184 @@ +import os, time, signal, json, sys +from pidcontroller import PIDController +from calc_cpu_usage import read_cpu_times, calculate_cpu_utilization + +numa_bw_limit = 80000 +lc_grp = "." +be_grp = "p1" + +bw_list = [] +llc_list = [] +set_list = [] +cpu_list = [] + +def read_bw(grp): + resctrl_mon_data_dir = '/sys/fs/resctrl/%s/mon_data/' % grp + mon_data_dirs = os.listdir(resctrl_mon_data_dir) + mon_MB_dirs = [dir for dir in mon_data_dirs if dir.startswith('mon_MB_')] + + vals = [] + for mb_dir in mon_MB_dirs: + with open(resctrl_mon_data_dir + mb_dir + '/mbm_total_bytes', 'r') as f: + line = f.readline() + vals.append(int(line.strip())) + + return vals + +def increase_bw(i, percent): + print("increase NUMA%d %d%%" % (i, percent)) + + resctrl_par_dir = '/sys/fs/resctrl/%s/schemata' % be_grp + with open(resctrl_par_dir, 'r') as f: + lines = f.readlines() + + for line in lines: + if "MB:" in line: + config = line.split(":") + config = config[1].split(";") + origin_p = int(config[i].split("=")[1]) + + new_p = (origin_p + percent) + if new_p > 100: + new_p = 100 + elif new_p < 8: + new_p = 8 + + # if percent < 0: + # cnt = "MBHDL:%d=1\n" % i + # with open(resctrl_par_dir, 'w+') as f: + # f.write(cnt) + + cnt = "MB:%d=%d" % (i, new_p) + print("%s<=%d" % (cnt, origin_p)) + if new_p == origin_p: + return origin_p + + with open(resctrl_par_dir, 'w+') as f: + f.write("%s\n" % cnt) + + return origin_p + +def gain_numa_bw(pid_ctl, adjust_enable, target_percent): + lc_val = read_bw(lc_grp) + be_val = read_bw(be_grp) + + numa_bw_state = [] + numa_set = [] + + for i in range(len(lc_val)): + bw_state = {"total_bw": {}, "lc_bw": {}, "be_bw": {}} + + bw_sum = lc_val[i] + be_val[i] + + bw_state["total_bw"] = bw_sum + bw_state["lc_bw"] = lc_val[i] + bw_state["be_bw"] = be_val[i] + numa_bw_state.append(bw_state) + + set_state = {"setting": {}, "delta": {}} + + if adjust_enable == True: + if bw_state["lc_bw"] < (0.04 * numa_bw_limit): + # enlarge BE load + diff = 5 + elif bw_state["lc_bw"] > (target_percent / 100 * numa_bw_limit): + # shutdown BE load + diff = -100 + else: + diff = pid_ctl[i].update(bw_sum * 100 // numa_bw_limit , 1) + else: + diff = 0 + + curr = increase_bw(i, diff) + set_state['setting'] = curr + set_state['delta'] = diff + + numa_set.append(set_state) + + bw_list.append(numa_bw_state) + set_list.append(numa_set) + return + +def read_llc(grp): + resctrl_mon_data_dir = '/sys/fs/resctrl/%s/mon_data/' % grp + mon_data_dirs = os.listdir(resctrl_mon_data_dir) + mon_MB_dirs = [dir for dir in mon_data_dirs if dir.startswith('mon_L3_')] + + vals = [] + for mb_dir in mon_MB_dirs: + with open(resctrl_mon_data_dir + mb_dir + '/llc_occupancy', 'r') as f: + line = f.readline() + vals.append(int(line.strip())) + + return vals + +def gain_numa_llc(): + lc_llc = read_llc(lc_grp) + be_llc = read_llc(be_grp) + + numa_llc_state = [] + + for i in range(len(lc_llc)): + llc_state = {"total_llc": {}, "lc_llc": {}, "be_llc": {}} + + total_llc = lc_llc[i] + be_llc[i] + llc_state["total_llc"] = total_llc + + llc_state["lc_llc"] = lc_llc[i] + llc_state["be_llc"] = be_llc[i] + numa_llc_state.append(llc_state) + + llc_list.append(numa_llc_state) + return + +def gain_cpu(time1, time2): + usage = calculate_cpu_utilization(time1, time2) + print(f"CPU usage: {usage:.2f}%") + cpu_list.append(usage) + return + +def save_file(sig, frame): + with open(f"ctrlgrp_bw.data", 'w') as fl: + json.dump(bw_list, fl) + + with open(f"schemata_set.data", 'w') as fl: + json.dump(set_list, fl) + + with open(f"ctrlgrp_llc.data", 'w') as fl: + json.dump(llc_list, fl) + + with open(f"cpu_usage.data", 'w') as fl: + json.dump(cpu_list, fl) + + exit(0) + +if __name__ == "__main__": + signal.signal(signal.SIGINT, save_file) + + enable = True + target_percent = 60 + + num_args = len(sys.argv) - 1 + if num_args == 1 and sys.argv[1].isdigit(): + target_percent = int(sys.argv[1]) + else: + enable = False + + pid_ctl = [] + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + + time1 = read_cpu_times() + + while True: + gain_numa_bw(pid_ctl, enable, target_percent) + gain_numa_llc() + + time2 = read_cpu_times() + gain_cpu(time1, time2) + time1 = time2 + + print("..........................") + time.sleep(1) diff --git a/calc_cpu_usage.py b/calc_cpu_usage.py new file mode 100644 index 000000000000..98fef7a2c1f5 --- /dev/null +++ b/calc_cpu_usage.py @@ -0,0 +1,27 @@ +import time + +def read_cpu_times(): + with open('/proc/stat', 'r') as f: + line = f.readline() + parts = line.split() + return list(map(int, parts[1:])) + +def calculate_cpu_utilization(times1, times2): + total1 = sum(times1) + idle1 = times1[3] + total2 = sum(times2) + idle2 = times2[3] + total_diff = total2 - total1 + idle_diff = idle2 - idle1 + return (total_diff - idle_diff) / total_diff * 100 + +# def gain_cpu(time1, time2): +# usage = calculate_cpu_utilization(time1, time2) +# print(f"CPU usage: {usage:.2f}%") +# return time2 + +# time1 = read_cpu_times() +# while True: +# time.sleep(1) +# time2 = read_cpu_times() +# time1 = gain_cpu(time1, time2) diff --git a/draw_bw.py b/draw_bw.py new file mode 100644 index 000000000000..c2c309ea1fd9 --- /dev/null +++ b/draw_bw.py @@ -0,0 +1,105 @@ +import json +import matplotlib.pyplot as plt + +target_percent = 60 / 100 +bw_limit = target_percent * 80000 + +def get_all_bw(data_list, idx): + total = [] + lc = [] + be = [] + + for data in data_list: + total.append(data[idx]['total_bw']) + lc.append(data[idx]['lc_bw']) + be.append(data[idx]['be_bw']) + + return total, lc, be + +def get_all_set(set_list, idx): + setting = [] + delta = [] + + for data in set_list: + setting.append(data[idx]['setting']) + delta.append(data[idx]['delta']) + + return setting, delta + +def draw_data(bw_list, set_list, cpu_list): + fig = plt.figure() + x_arr = list(range(len(bw_list))) + + # numa_cnt = len(bw_list[0]) + # only draw numa1 + numa_cnt_display = 1 + numa_th = 1 + for cnt in range(numa_cnt_display): + ax1 = fig.add_subplot(numa_cnt_display * 2 + 1, 1, cnt * 2 + 1) + # total, lc, be = get_all_bw(bw_list, cnt) + total, lc, be = get_all_bw(bw_list, numa_th) + ref = [bw_limit] * len(bw_list) + + ax1.plot(x_arr, total, label='total bw') + ax1.plot(x_arr, lc, label='lc bw') + ax1.plot(x_arr, be, label='be bw') + ax1.plot(x_arr, ref, label='reference') + ax1.legend() + + ax2 = fig.add_subplot(numa_cnt_display * 2 + 1, 1, cnt * 2 + 2) + # setting, delta = get_all_set(set_list, cnt) + setting, delta = get_all_set(set_list, numa_th) + + ref = [0] * len(bw_list) + ax2.plot(x_arr, setting, label='setting') + ax2.plot(x_arr, delta, label='delta') + ax2.plot(x_arr, ref, label='reference') + ax2.legend() + + # ax3 = fig.add_subplot(5, 1, 3) + # total, lc, be = get_all_bw(bw_list, 1) + + # ax3.plot(x_arr, total, label='total bw') + # ax3.plot(x_arr, lc, label='lc bw') + # ax3.plot(x_arr, be, label='be bw') + # ax3.plot(x_arr, ref, label='reference') + # ax3.legend() + + # ax4 = fig.add_subplot(5, 1, 4) + # setting, delta = get_all_set(set_list, 1) + + # ax4.plot(x_arr, setting, label='setting') + # ax4.plot(x_arr, delta, label='delta') + # ax4.legend() + + ax5 = fig.add_subplot(numa_cnt_display * 2 + 1, 1, numa_cnt_display * 2 + 1) + + ax5.plot(x_arr, cpu_list, label='CPU usage') + ax5.legend() + + plt.tight_layout() + plt.show() + + return + +def get_data(file): + try: + with open(file, 'r') as f: + data_list = json.load(f) + except FileNotFoundError: + return None + + return data_list + +if __name__ == '__main__': + filename = 'ctrlgrp_bw.data' + bw_list = get_data(filename) + filename = 'schemata_set.data' + set_list = get_data(filename) + filename = 'cpu_usage.data' + cpu_list = get_data(filename) + + if bw_list and set_list: + draw_data(bw_list, set_list, cpu_list) + else: + print('FileNotFound') diff --git a/draw_cpu.py b/draw_cpu.py new file mode 100644 index 000000000000..e69cf24b6b08 --- /dev/null +++ b/draw_cpu.py @@ -0,0 +1,34 @@ +import json +import matplotlib.pyplot as plt + +def draw_data(cpu_list): + fig = plt.figure() + x_arr = list(range(len(cpu_list))) + + ax1 = fig.add_subplot(1, 1, 1) + + ax1.plot(x_arr, cpu_list, label='CPU usage') + ax1.legend() + + plt.tight_layout() + plt.show() + + return + +def get_data(file): + try: + with open(file, 'r') as f: + cpu_list = json.load(f) + except FileNotFoundError: + return None + + return cpu_list + +if __name__ == '__main__': + filename = 'cpu_usage.data' + cpu_list = get_data(filename) + + if cpu_list: + draw_data(cpu_list) + else: + print('FileNotFound') diff --git a/pidcontroller.py b/pidcontroller.py new file mode 100644 index 000000000000..d67f9d2ad10c --- /dev/null +++ b/pidcontroller.py @@ -0,0 +1,35 @@ +class PIDController: + def __init__(self, kp, ki, kd, set_point): + self.kp = kp # 比例增益 + self.ki = ki # 积分增益 + self.kd = kd # 微分增益 + self.set_point = set_point # 设定值 + self.last_error = 0 # 上一次的误差 + self.integral = 0 # 积分项 + + self.max_output = 5 # 缓升 + self.min_output = -100 # 快降 + + def update(self, current_value, dt): + """ + 更新PID控制器的输出 + :param current_value: 当前系统的输出值 + :param dt: 时间间隔 + :return: 控制器的输出 + """ + error = self.set_point - current_value # 计算当前误差 + self.integral += error * dt # 更新积分项 + derivative = (error - self.last_error) / dt # 计算微分项 + + # 计算PID控制器的输出 + output = (self.kp * error) + (self.ki * self.integral) + (self.kd * derivative) + + self.last_error = error # 更新上一次的误差 + + # 限制输出范围 + if output > self.max_output: + output = self.max_output + elif output < self.min_output: + output = self.min_output + + return output -- 2.25.1

1 0

[PATCH OLK-6.6] vhost/vdpa: Add support to bind, unbind, attach and detach iommufd
by frenkjason 31 Mar '25

31 Mar '25

From: frankyj915 <yangjieyj.yang(a)huawei.com> VHOST_VDPA_BIND_IOMMUFD, VHOST_VDPA_UNBIND_IOMMUFD, VHOST_VDPA_ATTACH_IOMMUFD_PT and VHOST_VDPA_DETACH_IOMMUFD_PT are introduced. Signed-off-by: frankyj915 <yangjieyj.yang(a)huawei.com> --- drivers/vhost/vdpa.c | 105 +++++++++++++++++++++++++++++++ include/uapi/linux/vhost.h | 28 +++++++++ include/uapi/linux/vhost_types.h | 5 ++ tools/include/uapi/linux/vhost.h | 28 +++++++++ 4 files changed, 166 insertions(+) diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index ef7009a9d5ec..6d18e8cca2f0 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -22,9 +22,12 @@ #include <linux/vdpa.h> #include <linux/nospec.h> #include <linux/vhost.h> +#include <linux/iommufd.h> #include "vhost.h" +MODULE_IMPORT_NS(IOMMUFD); + enum { VHOST_VDPA_BACKEND_FEATURES = (1ULL << VHOST_BACKEND_F_IOTLB_MSG_V2) | @@ -60,6 +63,8 @@ struct vhost_vdpa { int in_batch; struct vdpa_iova_range range; u32 batch_asid; + struct iommufd_device *iommufd_dev; + bool iommufd_attached; }; static DEFINE_IDA(vhost_vdpa_ida); @@ -569,6 +574,89 @@ static long vhost_vdpa_resume(struct vhost_vdpa *v) return ops->resume(vdpa); } +static long vhost_vdpa_bind_iommufd(struct vhost_vdpa *v, int __user *argp) +{ + struct vhost_vdpa_bind_iommufd bind; + struct iommufd_ctx *iommufd_ctx; + struct iommufd_device *idev; + struct device *dma_dev = vdpa_get_dma_dev(v->vdpa); + struct iommu_group *iommu_group = iommu_group_get(dma_dev); + int ret; + + if (copy_from_user(&bind, argp, sizeof(bind))) + return -EFAULT; + + iommufd_ctx = iommufd_ctx_from_fd(bind.iommufd); + if (IS_ERR(iommufd_ctx)) + return PTR_ERR(iommufd_ctx); + + if (v->domain) { + iommu_detach_device(v->domain, dma_dev); + iommu_domain_free(v->domain); + v->domain = NULL; + } + + // Default iommu domain is created when vdpa device driver probes. + // Unuse default domain first to avoid failure when claiming dma owner. + if (dma_dev->bus && dma_dev->bus->dma_cleanup) + dma_dev->bus->dma_cleanup(dma_dev); + ret = iommu_group_claim_dma_owner(iommu_group, iommufd_ctx); + if (ret) + return ret; + + idev = iommufd_device_bind(iommufd_ctx, dma_dev, &bind.out_devid); + if (IS_ERR(idev)) + return PTR_ERR(idev); + v->iommufd_dev = idev; + + if (copy_to_user(argp, &bind, sizeof(bind))) + return -EFAULT; + return 0; +} + +static long vhost_vdpa_attach_iommufd_pt(struct vhost_vdpa *v, u32 __user *argp) +{ + u32 pt_id = 0; + int ret; + + if (copy_from_user(&pt_id, argp, sizeof(pt_id))) + return -EFAULT; + + ret = iommufd_device_attach(v->iommufd_dev, &pt_id); + if (ret) + return ret; + v->iommufd_attached = true; + + if (copy_to_user(argp, &pt_id, sizeof(pt_id))) + return -EFAULT; + return 0; +} + +static void vhost_vdpa_detach_iommufd_pt(struct vhost_vdpa *v) +{ + if (WARN_ON(!v->iommufd_dev) || !v->iommufd_attached) + return; + + iommufd_device_detach(v->iommufd_dev); + v->iommufd_attached = false; +} + +static void vhost_vdpa_unbind_iommufd(struct vhost_vdpa *v) +{ + struct device *dma_dev = vdpa_get_dma_dev(v->vdpa); + struct iommu_group *iommu_group = iommu_group_get(dma_dev); + + if (!v->iommufd_dev) + return; + + vhost_vdpa_detach_iommufd_pt(v); + iommufd_device_unbind(v->iommufd_dev); + v->iommufd_dev = NULL; + iommu_group_release_dma_owner(iommu_group); + if (dma_dev->bus && dma_dev->bus->dma_configure) + dma_dev->bus->dma_configure(dma_dev); +} + #ifdef CONFIG_VHOST_VDPA_MIGRATION static int vhost_vdpa_get_dev_buffer_size(struct vhost_vdpa *v, uint32_t __user *argp) @@ -916,6 +1004,18 @@ static long vhost_vdpa_unlocked_ioctl(struct file *filep, case VHOST_VDPA_RESUME: r = vhost_vdpa_resume(v); break; + case VHOST_VDPA_BIND_IOMMUFD: + r = vhost_vdpa_bind_iommufd(v, argp); + break; + case VHOST_VDPA_UNBIND_IOMMUFD: + vhost_vdpa_unbind_iommufd(v); + break; + case VHOST_VDPA_ATTACH_IOMMUFD_PT: + r = vhost_vdpa_attach_iommufd_pt(v, argp); + break; + case VHOST_VDPA_DETACH_IOMMUFD_PT: + vhost_vdpa_detach_iommufd_pt(v); + break; #ifdef CONFIG_VHOST_VDPA_MIGRATION case VHOST_GET_DEV_BUFFER_SIZE: r = vhost_vdpa_get_dev_buffer_size(v, argp); @@ -1556,6 +1656,8 @@ static int vhost_vdpa_release(struct inode *inode, struct file *filep) struct vhost_vdpa *v = filep->private_data; struct vhost_dev *d = &v->vdev; + vhost_vdpa_unbind_iommufd(v); + mutex_lock(&d->mutex); filep->private_data = NULL; vhost_vdpa_clean_irq(v); @@ -1709,6 +1811,9 @@ static int vhost_vdpa_probe(struct vdpa_device *vdpa) for (i = 0; i < VHOST_VDPA_IOTLB_BUCKETS; i++) INIT_HLIST_HEAD(&v->as[i]); + v->iommufd_dev = NULL; + v->iommufd_attached = false; + return 0; err: diff --git a/include/uapi/linux/vhost.h b/include/uapi/linux/vhost.h index a54098c7b0bc..898cde933168 100644 --- a/include/uapi/linux/vhost.h +++ b/include/uapi/linux/vhost.h @@ -223,6 +223,34 @@ */ #define VHOST_VDPA_RESUME _IO(VHOST_VIRTIO, 0x7E) +/* Bind a vDPA device to the specified iommufd + * + * After the return of this ioctl the vDPA device is binded to the specified + * iommufd, and the device id is also returned. + */ +#define VHOST_VDPA_BIND_IOMMUFD _IO(VHOST_VIRTIO, 0x90) + +/* Unbind a vDPA device from the specified iommufd + * + * After the return of this ioctl the vDPA device is unbinded from the specified + * iommufd. + */ +#define VHOST_VDPA_UNBIND_IOMMUFD _IO(VHOST_VIRTIO, 0x91) + +/* Associate the vDPA device with an address space within the bound iommufd. + * + * After the return of this ioctl the vDPA device is attached to the bound + * iommufd. + */ +#define VHOST_VDPA_ATTACH_IOMMUFD_PT _IO(VHOST_VIRTIO, 0x92) + +/* Detach the vDPA device from an address space within the bound iommufd. + * + * After the return of this ioctl the vDPA device is detached from the address + * space within the bound iommufd. + */ +#define VHOST_VDPA_DETACH_IOMMUFD_PT _IO(VHOST_VIRTIO, 0x93) + /* set and get device buffer */ #define VHOST_GET_DEV_BUFFER _IOR(VHOST_VIRTIO, 0xb0, struct vhost_vdpa_config) #define VHOST_SET_DEV_BUFFER _IOW(VHOST_VIRTIO, 0xb1, struct vhost_vdpa_config) diff --git a/include/uapi/linux/vhost_types.h b/include/uapi/linux/vhost_types.h index c7f25b0f7645..450214d2ada5 100644 --- a/include/uapi/linux/vhost_types.h +++ b/include/uapi/linux/vhost_types.h @@ -163,6 +163,11 @@ struct vhost_vdpa_iova_range { __u64 last; }; +struct vhost_vdpa_bind_iommufd { + __s32 iommufd; + __u32 out_devid; +}; + /* vhost vdpa device migration statue */ enum { VHOST_VDPA_DEVICE_START, diff --git a/tools/include/uapi/linux/vhost.h b/tools/include/uapi/linux/vhost.h index f5c48b61ab62..679c7b137f75 100644 --- a/tools/include/uapi/linux/vhost.h +++ b/tools/include/uapi/linux/vhost.h @@ -219,4 +219,32 @@ */ #define VHOST_VDPA_RESUME _IO(VHOST_VIRTIO, 0x7E) +/* Bind a vDPA device to the specified iommufd + * + * After the return of this ioctl the vDPA device is binded to the specified + * iommufd, and the device id is also returned. + */ +#define VHOST_VDPA_BIND_IOMMUFD _IO(VHOST_VIRTIO, 0x90) + +/* Unbind a vDPA device from the specified iommufd + * + * After the return of this ioctl the vDPA device is unbinded from the specified + * iommufd. + */ +#define VHOST_VDPA_UNBIND_IOMMUFD _IO(VHOST_VIRTIO, 0x91) + +/* Associate the vDPA device with an address space within the bound iommufd. + * + * After the return of this ioctl the vDPA device is attached to the bound + * iommufd. + */ +#define VHOST_VDPA_ATTACH_IOMMUFD_PT _IO(VHOST_VIRTIO, 0x92) + +/* Detach the vDPA device from an address space within the bound iommufd. + * + * After the return of this ioctl the vDPA device is detached from the address + * space within the bound iommufd. + */ +#define VHOST_VDPA_DETACH_IOMMUFD_PT _IO(VHOST_VIRTIO, 0x93) + #endif -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS] nfc: nci: add flush_workqueue to prevent uaf
by Ye Bin 31 Mar '25

31 Mar '25

From: Lin Ma <linma(a)zju.edu.cn> stable inclusion from stable-v4.19.239 commit 1a1748d0dd0f0a98535c6baeef671c8722107639 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1G8 CVE: CVE-2022-49059 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ef27324e2cb7bb24542d6cb2571740eefe6b00dc ] Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism (timer and workqueue). The race can be demonstrated below: Thread-1 Thread-2 | nci_dev_up() | nci_open_device() | __nci_request(nci_reset_req) | nci_send_cmd | queue_work(cmd_work) nci_unregister_device() | nci_close_device() | ... del_timer_sync(cmd_timer)[1] | ... | Worker nci_free_device() | nci_cmd_work() kfree(ndev)[3] | mod_timer(cmd_timer)[2] In short, the cleanup routine thought that the cmd_timer has already been detached by [1] but the mod_timer can re-attach the timer [2], even it is already released [3], resulting in UAF. This UAF is easy to trigger, crash trace by POC is like below [ 66.703713] ================================================================== [ 66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490 [ 66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33 [ 66.703974] [ 66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5 [ 66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work [ 66.703974] Call Trace: [ 66.703974] <TASK> [ 66.703974] dump_stack_lvl+0x57/0x7d [ 66.703974] print_report.cold+0x5e/0x5db [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] kasan_report+0xbe/0x1c0 [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] enqueue_timer+0x448/0x490 [ 66.703974] __mod_timer+0x5e6/0xb80 [ 66.703974] ? mark_held_locks+0x9e/0xe0 [ 66.703974] ? try_to_del_timer_sync+0xf0/0xf0 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x17b/0x410 [ 66.703974] ? queue_work_on+0x61/0x80 [ 66.703974] ? lockdep_hardirqs_on+0xbf/0x130 [ 66.703974] process_one_work+0x8bb/0x1510 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 66.703974] ? pwq_dec_nr_in_flight+0x230/0x230 [ 66.703974] ? rwlock_bug.part.0+0x90/0x90 [ 66.703974] ? _raw_spin_lock_irq+0x41/0x50 [ 66.703974] worker_thread+0x575/0x1190 [ 66.703974] ? process_one_work+0x1510/0x1510 [ 66.703974] kthread+0x2a0/0x340 [ 66.703974] ? kthread_complete_and_exit+0x20/0x20 [ 66.703974] ret_from_fork+0x22/0x30 [ 66.703974] </TASK> [ 66.703974] [ 66.703974] Allocated by task 267: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] __kasan_kmalloc+0x81/0xa0 [ 66.703974] nci_allocate_device+0xd3/0x390 [ 66.703974] nfcmrvl_nci_register_dev+0x183/0x2c0 [ 66.703974] nfcmrvl_nci_uart_open+0xf2/0x1dd [ 66.703974] nci_uart_tty_ioctl+0x2c3/0x4a0 [ 66.703974] tty_ioctl+0x764/0x1310 [ 66.703974] __x64_sys_ioctl+0x122/0x190 [ 66.703974] do_syscall_64+0x3b/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 66.703974] [ 66.703974] Freed by task 406: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] kasan_set_track+0x21/0x30 [ 66.703974] kasan_set_free_info+0x20/0x30 [ 66.703974] __kasan_slab_free+0x108/0x170 [ 66.703974] kfree+0xb0/0x330 [ 66.703974] nfcmrvl_nci_unregister_dev+0x90/0xd0 [ 66.703974] nci_uart_tty_close+0xdf/0x180 [ 66.703974] tty_ldisc_kill+0x73/0x110 [ 66.703974] tty_ldisc_hangup+0x281/0x5b0 [ 66.703974] __tty_hangup.part.0+0x431/0x890 [ 66.703974] tty_release+0x3a8/0xc80 [ 66.703974] __fput+0x1f0/0x8c0 [ 66.703974] task_work_run+0xc9/0x170 [ 66.703974] exit_to_user_mode_prepare+0x194/0x1a0 [ 66.703974] syscall_exit_to_user_mode+0x19/0x50 [ 66.703974] do_syscall_64+0x48/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae To fix the UAF, this patch adds flush_workqueue() to ensure the nci_cmd_work is finished before the following del_timer_sync. This combination will promise the timer is actually detached. Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Signed-off-by: Lin Ma <linma(a)zju.edu.cn> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- net/nfc/nci/core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index e6f1530f64f9..dad961aaeb83 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -560,6 +560,10 @@ static int nci_close_device(struct nci_dev *ndev) mutex_lock(&ndev->req_lock); if (!test_and_clear_bit(NCI_UP, &ndev->flags)) { + /* Need to flush the cmd wq in case + * there is a queued/running cmd_work + */ + flush_workqueue(ndev->cmd_wq); del_timer_sync(&ndev->cmd_timer); del_timer_sync(&ndev->data_timer); mutex_unlock(&ndev->req_lock); -- 2.34.1

2 1

[openeuler:OLK-5.10 2829/2829] drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6057:62: sparse: sparse: incorrect type in argument 4 (different base types)
by kernel test robot 31 Mar '25

31 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 2d7a642a3b89c993676c887941944d0f932d2052 commit: abd5078bcd21063944ed133282ee3fafdc92092c [2829/2829] net: wangxun: fix resolving ipv6 pakets extension header errors config: x86_64-randconfig-122-20250330 (https://download.01.org/0day-ci/archive/20250331/202503311730.Gkig2fxG-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503311730.Gkig2fxG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503311730.Gkig2fxG-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:177:6: sparse: sparse: symbol 'txgbe_service_event_schedule' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:940:40: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __be16 [usertype] vlan_proto @@ got unsigned short [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:940:40: sparse: expected restricted __be16 [usertype] vlan_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:940:40: sparse: got unsigned short [usertype] drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2647:6: sparse: sparse: symbol 'txgbe_disable_tx_queue' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2807:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2807:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2807:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2811:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2811:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2811:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2873:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2873:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2873:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2928:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2928:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2928:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3336:5: sparse: sparse: symbol 'txgbe_add_cloud_switcher' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3351:5: sparse: sparse: symbol 'txgbe_del_cloud_switcher' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3671:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3671:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3671:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3701:6: sparse: sparse: symbol 'txgbe_configure_isb' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3715:6: sparse: sparse: symbol 'txgbe_configure_port' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3964:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3964:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3964:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4291:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4291:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4291:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4368:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4368:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4368:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4386:5: sparse: sparse: symbol 'txgbe_init_shared_code' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4476:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4476:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4476:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4905:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4905:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4905:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5037:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5037:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5037:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6047:40: sparse: sparse: restricted __be16 degrades to integer >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6057:62: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6057:62: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6057:62: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6075:36: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6079:67: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6089:32: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6090:36: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6094:67: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6108:37: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6119:61: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6119:61: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6119:61: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6136:40: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6148:61: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6148:61: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6148:61: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6292:62: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6292:62: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6292:62: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6388:70: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6388:70: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6388:70: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6448:61: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6448:61: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6448:61: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6774:33: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6774:33: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6774:33: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6776:33: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6776:33: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6776:33: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6778:38: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6779:25: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6779:25: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6779:25: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6783:27: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6783:27: sparse: left side has type unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6783:27: sparse: right side has type restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6793:27: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6793:27: sparse: left side has type unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6793:27: sparse: right side has type restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6813:5: sparse: sparse: symbol 'txgbe_skb_pad_nonzero' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6855:30: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] protocol @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6855:30: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6855:30: sparse: got restricted __be16 [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6902:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6902:26: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6902:26: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6903:29: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6915:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6915:26: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6915:26: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6948:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] h_vlan_TCI @@ got unsigned short [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6948:42: sparse: expected restricted __be16 [usertype] h_vlan_TCI drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6948:42: sparse: got unsigned short [usertype] drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7327:23: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7393:46: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7395:37: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7403:47: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7405:37: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7497:26: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] type @@ got restricted __be16 [usertype] protocol @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7497:26: sparse: expected unsigned short [usertype] type drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7497:26: sparse: got restricted __be16 [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7513:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] type @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7513:22: sparse: expected unsigned short [usertype] type drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7513:22: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7540:35: sparse: sparse: incorrect type in initializer (incompatible argument 2 (different base types)) @@ expected int ( *ndo_vlan_rx_add_vid )( ... ) @@ got int ( * )( ... ) @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7540:35: sparse: expected int ( *ndo_vlan_rx_add_vid )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7540:35: sparse: got int ( * )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7541:35: sparse: sparse: incorrect type in initializer (incompatible argument 2 (different base types)) @@ expected int ( *ndo_vlan_rx_kill_vid )( ... ) @@ got int ( * )( ... ) @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7541:35: sparse: expected int ( *ndo_vlan_rx_kill_vid )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7541:35: sparse: got int ( * )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7698:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7698:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7698:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7901:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7901:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7901:17: sparse: int vim +6057 drivers/net/ethernet/netswift/txgbe/txgbe_main.c 6030 6031 static txgbe_dptype encode_tx_desc_ptype(const struct txgbe_tx_buffer *first) 6032 { 6033 struct sk_buff *skb = first->skb; 6034 u8 tun_prot = 0; 6035 u8 l4_prot = 0; 6036 u8 ptype = 0; 6037 unsigned char *exthdr; 6038 unsigned char *l4_hdr; 6039 __be16 frag_off; 6040 6041 if (skb->encapsulation) { 6042 union network_header hdr; 6043 6044 switch (first->protocol) { 6045 case __constant_htons(ETH_P_IP): 6046 tun_prot = ip_hdr(skb)->protocol; 6047 if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) 6048 goto encap_frag; 6049 ptype = TXGBE_PTYPE_TUN_IPV4; 6050 break; 6051 case __constant_htons(ETH_P_IPV6): 6052 l4_hdr = skb_transport_header(skb); 6053 exthdr = skb_network_header(skb) + sizeof(struct ipv6hdr); 6054 tun_prot = ipv6_hdr(skb)->nexthdr; 6055 if (l4_hdr != exthdr) 6056 ipv6_skip_exthdr(skb, exthdr - skb->data, > 6057 &tun_prot, &frag_off); 6058 if (tun_prot == NEXTHDR_FRAGMENT) 6059 goto encap_frag; 6060 ptype = TXGBE_PTYPE_TUN_IPV6; 6061 break; 6062 default: 6063 goto exit; 6064 } 6065 6066 if (tun_prot == IPPROTO_IPIP || 6067 tun_prot == IPPROTO_IPV6) { 6068 hdr.raw = (void *)inner_ip_hdr(skb); 6069 ptype |= TXGBE_PTYPE_PKT_IPIP; 6070 } else if (tun_prot == IPPROTO_UDP) { 6071 hdr.raw = (void *)inner_ip_hdr(skb); 6072 /* fixme: VXLAN-GPE neither ETHER nor IP */ 6073 6074 if (skb->inner_protocol_type != ENCAP_TYPE_ETHER || 6075 skb->inner_protocol != htons(ETH_P_TEB)) { 6076 ptype |= TXGBE_PTYPE_PKT_IG; 6077 } else { 6078 if (((struct ethhdr *) 6079 skb_inner_mac_header(skb))->h_proto 6080 == htons(ETH_P_8021Q)) { 6081 ptype |= TXGBE_PTYPE_PKT_IGMV; 6082 } else { 6083 ptype |= TXGBE_PTYPE_PKT_IGM; 6084 } 6085 } 6086 6087 } else if (tun_prot == IPPROTO_GRE) { 6088 hdr.raw = (void *)inner_ip_hdr(skb); 6089 if (skb->inner_protocol == htons(ETH_P_IP) || 6090 skb->inner_protocol == htons(ETH_P_IPV6)) { 6091 ptype |= TXGBE_PTYPE_PKT_IG; 6092 } else { 6093 if (((struct ethhdr *) 6094 skb_inner_mac_header(skb))->h_proto 6095 == htons(ETH_P_8021Q)) { 6096 ptype |= TXGBE_PTYPE_PKT_IGMV; 6097 } else { 6098 ptype |= TXGBE_PTYPE_PKT_IGM; 6099 } 6100 } 6101 } else { 6102 goto exit; 6103 } 6104 6105 switch (hdr.ipv4->version) { 6106 case IPVERSION: 6107 l4_prot = hdr.ipv4->protocol; 6108 if (hdr.ipv4->frag_off & htons(IP_MF | IP_OFFSET)) { 6109 ptype |= TXGBE_PTYPE_TYP_IPFRAG; 6110 goto exit; 6111 } 6112 break; 6113 case 6: 6114 l4_hdr = skb_inner_transport_header(skb); 6115 exthdr = skb_inner_network_header(skb) + sizeof(struct ipv6hdr); 6116 l4_prot = inner_ipv6_hdr(skb)->nexthdr; 6117 if (l4_hdr != exthdr) 6118 ipv6_skip_exthdr(skb, exthdr - skb->data, 6119 &l4_prot, &frag_off); 6120 ptype |= TXGBE_PTYPE_PKT_IPV6; 6121 if (l4_prot == NEXTHDR_FRAGMENT) { 6122 ptype |= TXGBE_PTYPE_TYP_IPFRAG; 6123 goto exit; 6124 } 6125 break; 6126 default: 6127 goto exit; 6128 } 6129 } else { 6130 encap_frag: 6131 6132 switch (first->protocol) { 6133 case __constant_htons(ETH_P_IP): 6134 l4_prot = ip_hdr(skb)->protocol; 6135 ptype = TXGBE_PTYPE_PKT_IP; 6136 if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) { 6137 ptype |= TXGBE_PTYPE_TYP_IPFRAG; 6138 goto exit; 6139 } 6140 break; 6141 #ifdef NETIF_F_IPV6_CSUM 6142 case __constant_htons(ETH_P_IPV6): 6143 l4_hdr = skb_transport_header(skb); 6144 exthdr = skb_network_header(skb) + sizeof(struct ipv6hdr); 6145 l4_prot = ipv6_hdr(skb)->nexthdr; 6146 if (l4_hdr != exthdr) 6147 ipv6_skip_exthdr(skb, exthdr - skb->data, 6148 &l4_prot, &frag_off); 6149 6150 ptype = TXGBE_PTYPE_PKT_IP | TXGBE_PTYPE_PKT_IPV6; 6151 if (l4_prot == NEXTHDR_FRAGMENT) { 6152 ptype |= TXGBE_PTYPE_TYP_IPFRAG; 6153 goto exit; 6154 } 6155 break; 6156 #endif /* NETIF_F_IPV6_CSUM */ 6157 case __constant_htons(ETH_P_1588): 6158 ptype = TXGBE_PTYPE_L2_TS; 6159 goto exit; 6160 case __constant_htons(ETH_P_FIP): 6161 ptype = TXGBE_PTYPE_L2_FIP; 6162 goto exit; 6163 case __constant_htons(TXGBE_ETH_P_LLDP): 6164 ptype = TXGBE_PTYPE_L2_LLDP; 6165 goto exit; 6166 case __constant_htons(TXGBE_ETH_P_CNM): 6167 ptype = TXGBE_PTYPE_L2_CNM; 6168 goto exit; 6169 case __constant_htons(ETH_P_PAE): 6170 ptype = TXGBE_PTYPE_L2_EAPOL; 6171 goto exit; 6172 case __constant_htons(ETH_P_ARP): 6173 ptype = TXGBE_PTYPE_L2_ARP; 6174 goto exit; 6175 default: 6176 ptype = TXGBE_PTYPE_L2_MAC; 6177 goto exit; 6178 } 6179 6180 } 6181 6182 switch (l4_prot) { 6183 case IPPROTO_TCP: 6184 ptype |= TXGBE_PTYPE_TYP_TCP; 6185 break; 6186 case IPPROTO_UDP: 6187 ptype |= TXGBE_PTYPE_TYP_UDP; 6188 break; 6189 case IPPROTO_SCTP: 6190 ptype |= TXGBE_PTYPE_TYP_SCTP; 6191 break; 6192 default: 6193 ptype |= TXGBE_PTYPE_TYP_IP; 6194 break; 6195 } 6196 6197 exit: 6198 return txgbe_decode_ptype(ptype); 6199 } 6200 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] media: uvcvideo: Fix double free in error path
by Gu Bowen 31 Mar '25

31 Mar '25

From: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> stable inclusion from stable-v6.6.76 commit 6c36dcd662ec5276782838660f8533a7cb26be49 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBDI CVE: CVE-2024-57980 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c6ef3a7fa97ec823a1e1af9085cf13db9f7b3bac upstream. If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. This results in the kfree() call in uvc_status_cleanup() trying to double-free the memory. Fix it by resetting the dev->status pointer to NULL after freeing it. Fixes: a31a4055473b ("V4L/DVB:usbvideo:don't use part of buffer for USB transfer #4") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20241107235130.31372-1-laurent.pinchart@ideasonbo… Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Reviewed by: Ricardo Ribalda <ribalda(a)chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/media/usb/uvc/uvc_status.c [Context conflicts due to commit adfd3910c27fb ("media: uvcvideo: Remove void casting for the status endpoint") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/media/usb/uvc/uvc_status.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/usb/uvc/uvc_status.c b/drivers/media/usb/uvc/uvc_status.c index 73725051cc16..6edf491dd873 100644 --- a/drivers/media/usb/uvc/uvc_status.c +++ b/drivers/media/usb/uvc/uvc_status.c @@ -269,6 +269,7 @@ int uvc_status_init(struct uvc_device *dev) dev->int_urb = usb_alloc_urb(0, GFP_KERNEL); if (dev->int_urb == NULL) { kfree(dev->status); + dev->status = NULL; return -ENOMEM; } -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] CVE-2022-49513
by Zhang Kunbo 31 Mar '25

31 Mar '25

*** BLURB HERE *** Kevin Hao (2): cpufreq: Move to_gov_attr_set() to cpufreq.h cpufreq: governor: Use kobject release() method to free dbs_data drivers/cpufreq/cpufreq_governor.c | 20 +++++++++++++------- drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cpufreq/cpufreq_governor_attr_set.c | 5 ----- include/linux/cpufreq.h | 5 +++++ 4 files changed, 19 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2022-49513
by Zhang Kunbo 31 Mar '25

31 Mar '25

*** BLURB HERE *** Kevin Hao (2): cpufreq: Move to_gov_attr_set() to cpufreq.h cpufreq: governor: Use kobject release() method to free dbs_data drivers/cpufreq/cpufreq_governor.c | 20 +++++++++++++------- drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cpufreq/cpufreq_governor_attr_set.c | 5 ----- include/linux/cpufreq.h | 5 +++++ 4 files changed, 19 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49370
by Xia Fukun 31 Mar '25

31 Mar '25

Fix CVE-2022-49370. Chen Zhongjin (1): firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle Miaoqian Lin (1): firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle drivers/firmware/dmi-sysfs.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 1424/1424] mm/page_alloc.c:1645:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type
by kernel test robot 31 Mar '25

31 Mar '25

Hi Daniel, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: eb761d6521c32c006a4987260394a61c6684fb35 [1424/1424] mm: parallelize deferred struct page initialization within each node config: x86_64-buildonly-randconfig-003-20250217 (https://download.01.org/0day-ci/archive/20250331/202503311145.7abslQzz-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503311145.7abslQzz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503311145.7abslQzz-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/page_alloc.c:1412:6: warning: no previous prototype for function 'set_zone_contiguous' [-Wmissing-prototypes] 1412 | void set_zone_contiguous(struct zone *zone) | ^ mm/page_alloc.c:1412:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1412 | void set_zone_contiguous(struct zone *zone) | ^ | static mm/page_alloc.c:1433:6: warning: no previous prototype for function 'clear_zone_contiguous' [-Wmissing-prototypes] 1433 | void clear_zone_contiguous(struct zone *zone) | ^ mm/page_alloc.c:1433:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1433 | void clear_zone_contiguous(struct zone *zone) | ^ | static >> mm/page_alloc.c:1645:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-mismatch] 1645 | DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1646 | KTASK_PTE_MINCHUNK); | ~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:139:3: note: expanded from macro 'DEFINE_KTASK_CTL' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: note: expanded from macro 'KTASK_CTL_INITIALIZER' 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1661:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-mismatch] 1661 | DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1662 | KTASK_PTE_MINCHUNK); | ~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:139:3: note: expanded from macro 'DEFINE_KTASK_CTL' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: note: expanded from macro 'KTASK_CTL_INITIALIZER' 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 4 warnings generated. vim +1645 mm/page_alloc.c 1587 1588 /* Initialise remaining memory on a node */ 1589 static int __init deferred_init_memmap(void *data) 1590 { 1591 pg_data_t *pgdat = data; 1592 int nid = pgdat->node_id; 1593 unsigned long start = jiffies; 1594 unsigned long nr_init = 0, nr_free = 0; 1595 unsigned long spfn, epfn, first_init_pfn, flags; 1596 phys_addr_t spa, epa; 1597 int zid; 1598 struct zone *zone; 1599 const struct cpumask *cpumask = cpumask_of_node(pgdat->node_id); 1600 u64 i; 1601 unsigned long nr_node_cpus; 1602 struct ktask_node kn; 1603 1604 /* Bind memory initialisation thread to a local node if possible */ 1605 if (!cpumask_empty(cpumask)) 1606 set_cpus_allowed_ptr(current, cpumask); 1607 1608 pgdat_resize_lock(pgdat, &flags); 1609 first_init_pfn = pgdat->first_deferred_pfn; 1610 if (first_init_pfn == ULONG_MAX) { 1611 pgdat_resize_unlock(pgdat, &flags); 1612 pgdat_init_report_one_done(); 1613 return 0; 1614 } 1615 1616 /* 1617 * We'd like to know the memory bandwidth of the chip to calculate the 1618 * most efficient number of threads to start, but we can't. In 1619 * testing, a good value for a variety of systems was a quarter of the 1620 * CPUs on the node. 1621 */ 1622 nr_node_cpus = DIV_ROUND_UP(cpumask_weight(cpumask), 4); 1623 1624 /* Sanity check boundaries */ 1625 BUG_ON(pgdat->first_deferred_pfn < pgdat->node_start_pfn); 1626 BUG_ON(pgdat->first_deferred_pfn > pgdat_end_pfn(pgdat)); 1627 pgdat->first_deferred_pfn = ULONG_MAX; 1628 1629 /* Only the highest zone is deferred so find it */ 1630 for (zid = 0; zid < MAX_NR_ZONES; zid++) { 1631 zone = pgdat->node_zones + zid; 1632 if (first_init_pfn < zone_end_pfn(zone)) 1633 break; 1634 } 1635 first_init_pfn = max(zone->zone_start_pfn, first_init_pfn); 1636 1637 /* 1638 * Initialize and free pages. We do it in two loops: first we initialize 1639 * struct page, than free to buddy allocator, because while we are 1640 * freeing pages we can access pages that are ahead (computing buddy 1641 * page in __free_one_page()). 1642 */ 1643 for_each_free_mem_range(i, nid, MEMBLOCK_NONE, &spa, &epa, NULL) { 1644 struct deferred_args args = { nid, zid, ATOMIC64_INIT(0) }; > 1645 DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, 1646 KTASK_PTE_MINCHUNK); 1647 ktask_ctl_set_max_threads(&ctl, nr_node_cpus); 1648 1649 spfn = max_t(unsigned long, first_init_pfn, PFN_UP(spa)); 1650 epfn = min_t(unsigned long, zone_end_pfn(zone), PFN_DOWN(epa)); 1651 1652 kn.kn_start = (void *)spfn; 1653 kn.kn_task_size = (spfn < epfn) ? epfn - spfn : 0; 1654 kn.kn_nid = nid; 1655 (void) ktask_run_numa(&kn, 1, &ctl); 1656 1657 nr_init += atomic64_read(&args.nr_pages); 1658 } 1659 for_each_free_mem_range(i, nid, MEMBLOCK_NONE, &spa, &epa, NULL) { 1660 struct deferred_args args = { nid, zid, ATOMIC64_INIT(0) }; 1661 DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, 1662 KTASK_PTE_MINCHUNK); 1663 ktask_ctl_set_max_threads(&ctl, nr_node_cpus); 1664 1665 spfn = max_t(unsigned long, first_init_pfn, PFN_UP(spa)); 1666 epfn = min_t(unsigned long, zone_end_pfn(zone), PFN_DOWN(epa)); 1667 1668 kn.kn_start = (void *)spfn; 1669 kn.kn_task_size = (spfn < epfn) ? epfn - spfn : 0; 1670 kn.kn_nid = nid; 1671 (void) ktask_run_numa(&kn, 1, &ctl); 1672 1673 nr_free += atomic64_read(&args.nr_pages); 1674 } 1675 pgdat_resize_unlock(pgdat, &flags); 1676 1677 /* Sanity check that the next zone really is unpopulated */ 1678 WARN_ON(++zid < MAX_NR_ZONES && populated_zone(++zone)); 1679 VM_BUG_ON(nr_init != nr_free); 1680 1681 zone->managed_pages += nr_free; 1682 1683 pr_info("node %d initialised, %lu pages in %ums\n", nid, nr_free, 1684 jiffies_to_msecs(jiffies - start)); 1685 1686 pgdat_init_report_one_done(); 1687 return 0; 1688 } 1689 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] drbd: Fix five use after free bugs in get_initial_state
by Xiaomeng Zhang 31 Mar '25

31 Mar '25

From: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> stable inclusion from stable-v5.10.111 commit 594205b4936771a250f9d141e7e0fff21c3dd2d9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6VU CVE: CVE-2022-49085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aadb22ba2f656581b2f733deb3a467c48cc618f6 ] In get_initial_state, it calls notify_initial_state_done(skb,..) if cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_done(), the skb will be freed by nlmsg_free(skb). Then get_initial_state will goto out and the freed skb will be used by return value skb->len, which is a uaf bug. What's worse, the same problem goes even further: skb can also be freed in the notify_*_state_change -> notify_*_state calls below. Thus 4 additional uaf bugs happened. My patch lets the problem callee functions: notify_initial_state_done and notify_*_state_change return an error code if errors happen. So that the error codes could be propagated and the uaf bugs can be avoid. v2 reports a compilation warning. This v3 fixed this warning and built successfully in my local environment with no additional warnings. v2: https://lore.kernel.org/patchwork/patch/1435218/ Fixes: a29728463b254 ("drbd: Backport the "events2" command") Signed-off-by: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder(a)linbit.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/block/drbd/drbd_int.h | 8 ++--- drivers/block/drbd/drbd_nl.c | 41 ++++++++++++++++---------- drivers/block/drbd/drbd_state.c | 18 +++++------ drivers/block/drbd/drbd_state_change.h | 8 ++--- 4 files changed, 42 insertions(+), 33 deletions(-) diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h index e35a234b0a8f..4f66cf6879fd 100644 --- a/drivers/block/drbd/drbd_int.h +++ b/drivers/block/drbd/drbd_int.h @@ -1688,22 +1688,22 @@ struct sib_info { }; void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib); -extern void notify_resource_state(struct sk_buff *, +extern int notify_resource_state(struct sk_buff *, unsigned int, struct drbd_resource *, struct resource_info *, enum drbd_notification_type); -extern void notify_device_state(struct sk_buff *, +extern int notify_device_state(struct sk_buff *, unsigned int, struct drbd_device *, struct device_info *, enum drbd_notification_type); -extern void notify_connection_state(struct sk_buff *, +extern int notify_connection_state(struct sk_buff *, unsigned int, struct drbd_connection *, struct connection_info *, enum drbd_notification_type); -extern void notify_peer_device_state(struct sk_buff *, +extern int notify_peer_device_state(struct sk_buff *, unsigned int, struct drbd_peer_device *, struct peer_device_info *, diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c index 5b15ffd0c7f5..5a80453be553 100644 --- a/drivers/block/drbd/drbd_nl.c +++ b/drivers/block/drbd/drbd_nl.c @@ -4598,7 +4598,7 @@ static int nla_put_notification_header(struct sk_buff *msg, return drbd_notification_header_to_skb(msg, &nh, true); } -void notify_resource_state(struct sk_buff *skb, +int notify_resource_state(struct sk_buff *skb, unsigned int seq, struct drbd_resource *resource, struct resource_info *resource_info, @@ -4640,16 +4640,17 @@ void notify_resource_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_device_state(struct sk_buff *skb, +int notify_device_state(struct sk_buff *skb, unsigned int seq, struct drbd_device *device, struct device_info *device_info, @@ -4689,16 +4690,17 @@ void notify_device_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_connection_state(struct sk_buff *skb, +int notify_connection_state(struct sk_buff *skb, unsigned int seq, struct drbd_connection *connection, struct connection_info *connection_info, @@ -4738,16 +4740,17 @@ void notify_connection_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_peer_device_state(struct sk_buff *skb, +int notify_peer_device_state(struct sk_buff *skb, unsigned int seq, struct drbd_peer_device *peer_device, struct peer_device_info *peer_device_info, @@ -4788,13 +4791,14 @@ void notify_peer_device_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } void notify_helper(enum drbd_notification_type type, @@ -4845,7 +4849,7 @@ void notify_helper(enum drbd_notification_type type, err, seq); } -static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) +static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq) { struct drbd_genlmsghdr *dh; int err; @@ -4859,11 +4863,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) if (nla_put_notification_header(skb, NOTIFY_EXISTS)) goto nla_put_failure; genlmsg_end(skb, dh); - return; + return 0; nla_put_failure: nlmsg_free(skb); pr_err("Error %d sending event. Event seq:%u\n", err, seq); + return err; } static void free_state_changes(struct list_head *list) @@ -4890,6 +4895,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) unsigned int seq = cb->args[2]; unsigned int n; enum drbd_notification_type flags = 0; + int err = 0; /* There is no need for taking notification_mutex here: it doesn't matter if the initial state events mix with later state chage @@ -4898,32 +4904,32 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) cb->args[5]--; if (cb->args[5] == 1) { - notify_initial_state_done(skb, seq); + err = notify_initial_state_done(skb, seq); goto out; } n = cb->args[4]++; if (cb->args[4] < cb->args[3]) flags |= NOTIFY_CONTINUES; if (n < 1) { - notify_resource_state_change(skb, seq, state_change->resource, + err = notify_resource_state_change(skb, seq, state_change->resource, NOTIFY_EXISTS | flags); goto next; } n--; if (n < state_change->n_connections) { - notify_connection_state_change(skb, seq, &state_change->connections[n], + err = notify_connection_state_change(skb, seq, &state_change->connections[n], NOTIFY_EXISTS | flags); goto next; } n -= state_change->n_connections; if (n < state_change->n_devices) { - notify_device_state_change(skb, seq, &state_change->devices[n], + err = notify_device_state_change(skb, seq, &state_change->devices[n], NOTIFY_EXISTS | flags); goto next; } n -= state_change->n_devices; if (n < state_change->n_devices * state_change->n_connections) { - notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], + err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], NOTIFY_EXISTS | flags); goto next; } @@ -4938,7 +4944,10 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) cb->args[4] = 0; } out: - return skb->len; + if (err) + return err; + else + return skb->len; } int drbd_adm_get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c index b452359b6aae..1474250f9440 100644 --- a/drivers/block/drbd/drbd_state.c +++ b/drivers/block/drbd/drbd_state.c @@ -1549,7 +1549,7 @@ int drbd_bitmap_io_from_worker(struct drbd_device *device, return rv; } -void notify_resource_state_change(struct sk_buff *skb, +int notify_resource_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_resource_state_change *resource_state_change, enum drbd_notification_type type) @@ -1562,10 +1562,10 @@ void notify_resource_state_change(struct sk_buff *skb, .res_susp_fen = resource_state_change->susp_fen[NEW], }; - notify_resource_state(skb, seq, resource, &resource_info, type); + return notify_resource_state(skb, seq, resource, &resource_info, type); } -void notify_connection_state_change(struct sk_buff *skb, +int notify_connection_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_connection_state_change *connection_state_change, enum drbd_notification_type type) @@ -1576,10 +1576,10 @@ void notify_connection_state_change(struct sk_buff *skb, .conn_role = connection_state_change->peer_role[NEW], }; - notify_connection_state(skb, seq, connection, &connection_info, type); + return notify_connection_state(skb, seq, connection, &connection_info, type); } -void notify_device_state_change(struct sk_buff *skb, +int notify_device_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_device_state_change *device_state_change, enum drbd_notification_type type) @@ -1589,10 +1589,10 @@ void notify_device_state_change(struct sk_buff *skb, .dev_disk_state = device_state_change->disk_state[NEW], }; - notify_device_state(skb, seq, device, &device_info, type); + return notify_device_state(skb, seq, device, &device_info, type); } -void notify_peer_device_state_change(struct sk_buff *skb, +int notify_peer_device_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_peer_device_state_change *p, enum drbd_notification_type type) @@ -1606,7 +1606,7 @@ void notify_peer_device_state_change(struct sk_buff *skb, .peer_resync_susp_dependency = p->resync_susp_dependency[NEW], }; - notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); + return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); } static void broadcast_state_change(struct drbd_state_change *state_change) @@ -1614,7 +1614,7 @@ static void broadcast_state_change(struct drbd_state_change *state_change) struct drbd_resource_state_change *resource_state_change = &state_change->resource[0]; bool resource_state_has_changed; unsigned int n_device, n_connection, n_peer_device, n_peer_devices; - void (*last_func)(struct sk_buff *, unsigned int, void *, + int (*last_func)(struct sk_buff *, unsigned int, void *, enum drbd_notification_type) = NULL; void *uninitialized_var(last_arg); diff --git a/drivers/block/drbd/drbd_state_change.h b/drivers/block/drbd/drbd_state_change.h index ba80f612d6ab..d5b0479bc9a6 100644 --- a/drivers/block/drbd/drbd_state_change.h +++ b/drivers/block/drbd/drbd_state_change.h @@ -44,19 +44,19 @@ extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_ extern void copy_old_to_new_state_change(struct drbd_state_change *); extern void forget_state_change(struct drbd_state_change *); -extern void notify_resource_state_change(struct sk_buff *, +extern int notify_resource_state_change(struct sk_buff *, unsigned int, struct drbd_resource_state_change *, enum drbd_notification_type type); -extern void notify_connection_state_change(struct sk_buff *, +extern int notify_connection_state_change(struct sk_buff *, unsigned int, struct drbd_connection_state_change *, enum drbd_notification_type type); -extern void notify_device_state_change(struct sk_buff *, +extern int notify_device_state_change(struct sk_buff *, unsigned int, struct drbd_device_state_change *, enum drbd_notification_type type); -extern void notify_peer_device_state_change(struct sk_buff *, +extern int notify_peer_device_state_change(struct sk_buff *, unsigned int, struct drbd_peer_device_state_change *, enum drbd_notification_type type); -- 2.34.1

2 1

[PATCH OLK-6.6 0/9] Some bug fix patches for RDMA/hns to olk-6.6
by Junxian Huang 31 Mar '25

31 Mar '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some bug fix patches for RDMA/hns to olk-6.6 Chengchang Tang (1): RDMA/hns: Fix a meaningless loop in free_buffer_pages_proc() Junxian Huang (7): RDMA/hns: Change mtr member to pointer in hns QP/CQ/MR/SRQ/EQ struct RDMA/hns: Move mtr_node into the mtr struct RDMA/hns: Fix delayed destruction of db not taking effect RDMA/hns: Fix delay-destruction mechanism not processing kernel db RDMA/hns: Fix mismatched kzalloc vs kvfree RDMA/hns: Fix DCA error path in alloc_wqe_buf() RDMA/hns: Reorder uctx deallocation Yuyu Li (1): RDMA/hns: Fix remove debugfs after device has been unregistered drivers/infiniband/hw/hns/hns_roce_bond.c | 2 +- drivers/infiniband/hw/hns/hns_roce_cq.c | 35 ++--- drivers/infiniband/hw/hns/hns_roce_db.c | 81 ++++++---- drivers/infiniband/hw/hns/hns_roce_dca.c | 8 +- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 10 +- drivers/infiniband/hw/hns/hns_roce_debugfs.h | 3 +- drivers/infiniband/hw/hns/hns_roce_device.h | 69 ++++----- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 81 +++++----- drivers/infiniband/hw/hns/hns_roce_main.c | 23 ++- drivers/infiniband/hw/hns/hns_roce_mr.c | 145 ++++++++---------- drivers/infiniband/hw/hns/hns_roce_qp.c | 40 ++--- drivers/infiniband/hw/hns/hns_roce_restrack.c | 4 +- drivers/infiniband/hw/hns/hns_roce_srq.c | 63 +++----- 13 files changed, 269 insertions(+), 295 deletions(-) -- 2.33.0

2 10

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 31 Mar '25

31 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250331/202503311140.R7DpzkNH-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503311140.R7DpzkNH-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v3 00/28] Add support for heterogeneous live migration
by Jinqian Yang 31 Mar '25

31 Mar '25

Patch#1 Allow userspace to get the writable masks for feature ID registers Patch#2 Document KVM_ARM_GET_REG_WRITABLE_MASKS Patch#3 Use guest ID register values for the sake of emulation Patch#4 Advertise selected DebugVer in DBGDIDR.Version Patch#5 Reject attempts to set invalid debug arch version Patch#6 Bump up the default KVM sanitised debug version to v8p8 Patch#7 Allow userspace to change ID_AA64ISAR{0-2}_EL1 Patch#8 Allow userspace to change ID_AA64MMFR{0-2}_EL1 Patch#9 Allow userspace to change ID_AA64PFR0_EL1 Patch#10 Allow userspace to change ID_AA64ZFR0_EL1 Patch#11 Document vCPU feature selection UAPIs Patch#12 Make the exposed feature bits in AA64DFR0_EL1 writable from userspace Patch#13 Disable MPAM visibility by default and ignore VMM writes Patch#14 Rename is_id_reg() to imply VM scope Patch#15 Reset VM feature ID regs from kvm_reset_sys_regs() Patch#16 Only reset vCPU-scoped feature ID regs once Patch#17 Use read-only helper for reading VM ID registers Patch#18 Add helper for writing ID regs Patch#19 Treat CTR_EL0 as a VM feature ID register Patch#20 Rename functions for invariant sys regs Patch#21 Make the L1Ip feature bits in CTR_EL0 writable from userspace Patch#22 Show writable masks for feature registers Patch#23 Make HCX writable from userspace Patch#24 Remove duplicated AA64MMFR1_EL1 XNX Patch#25 Add support for HIP09 Spectre-BHB mitigation Patch#26 add cnp verification on Hisilicon erratum 162100125 Patch#27 use KABI_EXTEND to revert struct kvm kabi change Patch#28 Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden James Morse (1): KVM: arm64: Disable MPAM visibility by default and ignore VMM writes Jing Zhang (5): KVM: arm64: Allow userspace to get the writable masks for feature ID registers KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS KVM: arm64: Use guest ID register values for the sake of emulation KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Marc Zyngier (1): KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden Oliver Upton (11): KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version KVM: arm64: Reject attempts to set invalid debug arch version KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 KVM: arm64: Document vCPU feature selection UAPIs KVM: arm64: Rename is_id_reg() to imply VM scope KVM: arm64: Reset VM feature ID regs from kvm_reset_sys_regs() KVM: arm64: Only reset vCPU-scoped feature ID regs once KVM: arm64: Use read-only helper for reading VM ID registers KVM: arm64: Add helper for writing ID regs Russell King (1): KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX Sebastian Ott (3): KVM: arm64: Treat CTR_EL0 as a VM feature ID register KVM: arm64: rename functions for invariant sys regs KVM: arm64: show writable masks for feature registers Shameer Kolothum (2): KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace yangjinqian (4): KVM: arm64: Make HCX writable from userspace arm64: Add support for HIP09 Spectre-BHB mitigation arm64: add cnp verification on Hisilicon erratum 162100125 KVM: arm64: use KABI_EXTEND to revert struct kvm kabi change Documentation/virt/kvm/api.rst | 52 +++ Documentation/virt/kvm/arm/index.rst | 1 + Documentation/virt/kvm/arm/vcpu-features.rst | 48 +++ arch/arm64/include/asm/cpufeature.h | 14 + arch/arm64/include/asm/kvm_emulate.h | 3 +- arch/arm64/include/asm/kvm_host.h | 24 ++ arch/arm64/include/uapi/asm/kvm.h | 32 ++ arch/arm64/kernel/cpu_errata.c | 13 +- arch/arm64/kernel/proton-pack.c | 1 + arch/arm64/kvm/arm.c | 15 +- arch/arm64/kvm/pmu-emul.c | 2 +- arch/arm64/kvm/sys_regs.c | 351 +++++++++++++++---- include/uapi/linux/kvm.h | 2 + 13 files changed, 475 insertions(+), 83 deletions(-) create mode 100644 Documentation/virt/kvm/arm/vcpu-features.rst -- 2.33.0

2 29

[openeuler:openEuler-1.0-LTS 1425/1425] kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats'
by kernel test robot 31 Mar '25

31 Mar '25

Hi Hui, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: ebca52abe099caa97d7669d0acc71209ea80cfec [1425/1425] sched: Add statistics for scheduler dynamic affinity config: x86_64-randconfig-103-20250219 (https://download.01.org/0day-ci/archive/20250331/202503310934.WNROVBec-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503310934.WNROVBec-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503310934.WNROVBec-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/sched/debug.c:815:6: warning: no previous prototype for function 'sysrq_sched_debug_tidy' [-Wmissing-prototypes] 815 | void sysrq_sched_debug_tidy(void) | ^ kernel/sched/debug.c:815:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 815 | void sysrq_sched_debug_tidy(void) | ^ | static >> kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:21:17: note: expanded from macro 'SEQ_printf' 21 | seq_printf(m, x); \ | ^ >> kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:23:11: note: expanded from macro 'SEQ_printf' 23 | pr_cont(x); \ | ^ include/linux/printk.h:362:26: note: expanded from macro 'pr_cont' 362 | printk(KERN_CONT fmt, ##__VA_ARGS__) | ^~~~~~~~~~~ >> kernel/sched/debug.c:991:17: error: no member named 'nr_wakeups_force_preferred_cpus' in 'struct dyn_affinity_stats' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:21:17: note: expanded from macro 'SEQ_printf' 21 | seq_printf(m, x); \ | ^ >> kernel/sched/debug.c:991:17: error: no member named 'nr_wakeups_force_preferred_cpus' in 'struct dyn_affinity_stats' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:23:11: note: expanded from macro 'SEQ_printf' 23 | pr_cont(x); \ | ^ include/linux/printk.h:362:26: note: expanded from macro 'pr_cont' 362 | printk(KERN_CONT fmt, ##__VA_ARGS__) | ^~~~~~~~~~~ 1 warning and 4 errors generated. vim +990 kernel/sched/debug.c 814 > 815 void sysrq_sched_debug_tidy(void) 816 { 817 int cpu; 818 819 SEQ_printf(NULL, "Sched Debug Version: v0.11, %s %.*s\n", 820 init_utsname()->release, 821 (int)strcspn(init_utsname()->version, " "), 822 init_utsname()->version); 823 824 for_each_online_cpu(cpu) 825 print_cpu_tidy(NULL, cpu); 826 } 827 828 /* 829 * This itererator needs some explanation. 830 * It returns 1 for the header position. 831 * This means 2 is CPU 0. 832 * In a hotplugged system some CPUs, including CPU 0, may be missing so we have 833 * to use cpumask_* to iterate over the CPUs. 834 */ 835 static void *sched_debug_start(struct seq_file *file, loff_t *offset) 836 { 837 unsigned long n = *offset; 838 839 if (n == 0) 840 return (void *) 1; 841 842 n--; 843 844 if (n > 0) 845 n = cpumask_next(n - 1, cpu_online_mask); 846 else 847 n = cpumask_first(cpu_online_mask); 848 849 *offset = n + 1; 850 851 if (n < nr_cpu_ids) 852 return (void *)(unsigned long)(n + 2); 853 854 return NULL; 855 } 856 857 static void *sched_debug_next(struct seq_file *file, void *data, loff_t *offset) 858 { 859 (*offset)++; 860 return sched_debug_start(file, offset); 861 } 862 863 static void sched_debug_stop(struct seq_file *file, void *data) 864 { 865 } 866 867 static const struct seq_operations sched_debug_sops = { 868 .start = sched_debug_start, 869 .next = sched_debug_next, 870 .stop = sched_debug_stop, 871 .show = sched_debug_show, 872 }; 873 874 static int __init init_sched_debug_procfs(void) 875 { 876 if (!proc_create_seq("sched_debug", 0444, NULL, &sched_debug_sops)) 877 return -ENOMEM; 878 return 0; 879 } 880 881 __initcall(init_sched_debug_procfs); 882 883 #define __P(F) SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) 884 #define P(F) SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)p->F) 885 #define __PN(F) SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)F)) 886 #define PN(F) SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)p->F)) 887 888 889 #ifdef CONFIG_NUMA_BALANCING 890 void print_numa_stats(struct seq_file *m, int node, unsigned long tsf, 891 unsigned long tpf, unsigned long gsf, unsigned long gpf) 892 { 893 SEQ_printf(m, "numa_faults node=%d ", node); 894 SEQ_printf(m, "task_private=%lu task_shared=%lu ", tpf, tsf); 895 SEQ_printf(m, "group_private=%lu group_shared=%lu\n", gpf, gsf); 896 } 897 #endif 898 899 900 static void sched_show_numa(struct task_struct *p, struct seq_file *m) 901 { 902 #ifdef CONFIG_NUMA_BALANCING 903 struct mempolicy *pol; 904 905 if (p->mm) 906 P(mm->numa_scan_seq); 907 908 task_lock(p); 909 pol = p->mempolicy; 910 if (pol && !(pol->flags & MPOL_F_MORON)) 911 pol = NULL; 912 mpol_get(pol); 913 task_unlock(p); 914 915 P(numa_pages_migrated); 916 P(numa_preferred_nid); 917 P(total_numa_faults); 918 SEQ_printf(m, "current_node=%d, numa_group_id=%d\n", 919 task_node(p), task_numa_group_id(p)); 920 show_numa_stats(p, m); 921 mpol_put(pol); 922 #endif 923 } 924 925 void proc_sched_show_task(struct task_struct *p, struct pid_namespace *ns, 926 struct seq_file *m) 927 { 928 #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY 929 struct dyn_affinity_stats *dyn_affi = p->se.dyn_affi_stats; 930 #endif 931 unsigned long nr_switches; 932 933 SEQ_printf(m, "%s (%d, #threads: %d)\n", p->comm, task_pid_nr_ns(p, ns), 934 get_nr_threads(p)); 935 SEQ_printf(m, 936 "---------------------------------------------------------" 937 "----------\n"); 938 #define __P(F) \ > 939 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) 940 #define P(F) \ 941 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)p->F) 942 #define P_SCHEDSTAT(F) \ 943 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)schedstat_val(p->F)) 944 #define __PN(F) \ 945 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)F)) 946 #define PN(F) \ 947 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)p->F)) 948 #define PN_SCHEDSTAT(F) \ 949 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)schedstat_val(p->F))) 950 951 PN(se.exec_start); 952 PN(se.vruntime); 953 PN(se.sum_exec_runtime); 954 955 nr_switches = p->nvcsw + p->nivcsw; 956 957 P(se.nr_migrations); 958 959 if (schedstat_enabled()) { 960 u64 avg_atom, avg_per_cpu; 961 962 PN_SCHEDSTAT(se.statistics.sum_sleep_runtime); 963 PN_SCHEDSTAT(se.statistics.wait_start); 964 PN_SCHEDSTAT(se.statistics.sleep_start); 965 PN_SCHEDSTAT(se.statistics.block_start); 966 PN_SCHEDSTAT(se.statistics.sleep_max); 967 PN_SCHEDSTAT(se.statistics.block_max); 968 PN_SCHEDSTAT(se.statistics.exec_max); 969 PN_SCHEDSTAT(se.statistics.slice_max); 970 PN_SCHEDSTAT(se.statistics.wait_max); 971 PN_SCHEDSTAT(se.statistics.wait_sum); 972 P_SCHEDSTAT(se.statistics.wait_count); 973 PN_SCHEDSTAT(se.statistics.iowait_sum); 974 P_SCHEDSTAT(se.statistics.iowait_count); 975 P_SCHEDSTAT(se.statistics.nr_migrations_cold); 976 P_SCHEDSTAT(se.statistics.nr_failed_migrations_affine); 977 P_SCHEDSTAT(se.statistics.nr_failed_migrations_running); 978 P_SCHEDSTAT(se.statistics.nr_failed_migrations_hot); 979 P_SCHEDSTAT(se.statistics.nr_forced_migrations); 980 P_SCHEDSTAT(se.statistics.nr_wakeups); 981 P_SCHEDSTAT(se.statistics.nr_wakeups_sync); 982 P_SCHEDSTAT(se.statistics.nr_wakeups_migrate); 983 P_SCHEDSTAT(se.statistics.nr_wakeups_local); 984 P_SCHEDSTAT(se.statistics.nr_wakeups_remote); 985 P_SCHEDSTAT(se.statistics.nr_wakeups_affine); 986 P_SCHEDSTAT(se.statistics.nr_wakeups_affine_attempts); 987 P_SCHEDSTAT(se.statistics.nr_wakeups_passive); 988 P_SCHEDSTAT(se.statistics.nr_wakeups_idle); 989 #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY > 990 __P(dyn_affi->nr_wakeups_preferred_cpus); > 991 __P(dyn_affi->nr_wakeups_force_preferred_cpus); 992 #endif 993 994 avg_atom = p->se.sum_exec_runtime; 995 if (nr_switches) 996 avg_atom = div64_ul(avg_atom, nr_switches); 997 else 998 avg_atom = -1LL; 999 1000 avg_per_cpu = p->se.sum_exec_runtime; 1001 if (p->se.nr_migrations) { 1002 avg_per_cpu = div64_u64(avg_per_cpu, 1003 p->se.nr_migrations); 1004 } else { 1005 avg_per_cpu = -1LL; 1006 } 1007 1008 __PN(avg_atom); 1009 __PN(avg_per_cpu); 1010 } 1011 1012 __P(nr_switches); 1013 SEQ_printf(m, "%-45s:%21Ld\n", 1014 "nr_voluntary_switches", (long long)p->nvcsw); 1015 SEQ_printf(m, "%-45s:%21Ld\n", 1016 "nr_involuntary_switches", (long long)p->nivcsw); 1017 1018 P(se.load.weight); 1019 P(se.runnable_weight); 1020 #ifdef CONFIG_SMP 1021 P(se.avg.load_sum); 1022 P(se.avg.runnable_load_sum); 1023 P(se.avg.util_sum); 1024 P(se.avg.load_avg); 1025 P(se.avg.runnable_load_avg); 1026 P(se.avg.util_avg); 1027 P(se.avg.last_update_time); 1028 P(se.avg.util_est.ewma); 1029 P(se.avg.util_est.enqueued); 1030 #endif 1031 P(policy); 1032 P(prio); 1033 if (task_has_dl_policy(p)) { 1034 P(dl.runtime); 1035 P(dl.deadline); 1036 } 1037 #undef PN_SCHEDSTAT 1038 #undef PN 1039 #undef __PN 1040 #undef P_SCHEDSTAT 1041 #undef P 1042 #undef __P 1043 1044 { 1045 unsigned int this_cpu = raw_smp_processor_id(); 1046 u64 t0, t1; 1047 1048 t0 = cpu_clock(this_cpu); 1049 t1 = cpu_clock(this_cpu); 1050 SEQ_printf(m, "%-45s:%21Ld\n", 1051 "clock-delta", (long long)(t1-t0)); 1052 } 1053 1054 sched_show_numa(p, m); 1055 } 1056 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] f2fs: fix dereference of stale list iterator after loop body
by Wupeng Ma 31 Mar '25

31 Mar '25

From: Jakob Koschel <jakobkoschel(a)gmail.com> stable inclusion from stable-v4.19.247 commit 385edd3ce5b4b1e9d31f474a5e35a39779ec1110 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBP3SH CVE: CVE-2022-49425 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2aaf51dd39afb6d01d13f1e6fe20b684733b37d5 ] The list iterator variable will be a bogus pointer if no break was hit. Dereferencing it (cur->page in this case) could load an out-of-bounds/undefined value making it unsafe to use that in the comparision to determine if the specific element was found. Since 'cur->page' *can* be out-ouf-bounds it cannot be guaranteed that by chance (or intention of an attacker) it matches the value of 'page' even though the correct element was not found. This is fixed by using a separate list iterator variable for the loop and only setting the original variable if a suitable element was found. Then determing if the element was found is simply checking if the variable is set. Fixes: 8c242db9b8c0 ("f2fs: fix stale ATOMIC_WRITTEN_PAGE private pointer") Signed-off-by: Jakob Koschel <jakobkoschel(a)gmail.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- fs/f2fs/segment.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c index 0e3e590a250f..6fbf0471323e 100644 --- a/fs/f2fs/segment.c +++ b/fs/f2fs/segment.c @@ -354,16 +354,19 @@ void f2fs_drop_inmem_page(struct inode *inode, struct page *page) struct f2fs_sb_info *sbi = F2FS_I_SB(inode); struct list_head *head = &fi->inmem_pages; struct inmem_pages *cur = NULL; + struct inmem_pages *tmp; f2fs_bug_on(sbi, !IS_ATOMIC_WRITTEN_PAGE(page)); mutex_lock(&fi->inmem_lock); - list_for_each_entry(cur, head, list) { - if (cur->page == page) + list_for_each_entry(tmp, head, list) { + if (tmp->page == page) { + cur = tmp; break; + } } - f2fs_bug_on(sbi, list_empty(head) || cur->page != page); + f2fs_bug_on(sbi, !cur); list_del(&cur->list); mutex_unlock(&fi->inmem_lock); -- 2.43.0

2 1

[openeuler:OLK-5.10 2829/2829] drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2340: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2854: first defined here
by kernel test robot 31 Mar '25

31 Mar '25

Hi DuanqiangWen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0e7e8faca7062a439fd0a56574c2c3860ceb2088 commit: 3ddd74dceeba1f4ea8b20db59276ea3c6eded3d5 [2829/2829] openeuler: net: txgbe: Fix some known bugs, merge net-swift txgbe-1.2.3 out-of-tree config: x86_64-randconfig-122-20250330 (https://download.01.org/0day-ci/archive/20250331/202503310959.wgczfMA5-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503310959.wgczfMA5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503310959.wgczfMA5-lkp@intel.com/ All errors (new ones prefixed by >>): ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `fmgr_cmd_op': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2340: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2854: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `fmgr_usr_cmd_op': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2361: multiple definition of `fmgr_usr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2875: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_erase_chip': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2371: multiple definition of `flash_erase_chip'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2885: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_erase_sector': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2377: multiple definition of `flash_erase_sector'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2891: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_write_dword': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2393: multiple definition of `flash_write_dword'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2908: first defined here sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:625:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:625:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:625:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:1004:6: sparse: sparse: symbol 'txgbe_add_uc_addr' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:1138:6: sparse: sparse: symbol 'txgbe_set_mta' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2604:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2604:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2604:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2707:5: sparse: sparse: symbol 'txgbe_setup_mac_link_hostif' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2744:5: sparse: sparse: symbol 'txgbe_crc16_ccitt' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2897:5: sparse: sparse: symbol 'flash_read_dword' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2922:5: sparse: sparse: symbol 'txgbe_flash_write_cab' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2944:5: sparse: sparse: symbol 'txgbe_flash_read_cab' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2975:5: sparse: sparse: symbol 'txgbe_flash_write_unlock' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2998:5: sparse: sparse: symbol 'txgbe_flash_write_lock' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3451:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3451:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3451:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3496:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3496:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3496:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4396:5: sparse: sparse: symbol 'txgbe_enable_rx_adapter' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4417:5: sparse: sparse: symbol 'txgbe_set_sgmii_an37_ability' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4972:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4972:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4972:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:5345:5: sparse: sparse: symbol 'txgbe_reset_misc' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6426:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6426:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6426:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6428:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6428:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6428:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6593:5: sparse: sparse: symbol 'txgbe_read_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6642:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6642:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6642:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6724:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6724:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6724:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6737:5: sparse: sparse: symbol 'txgbe_write_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6847:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6847:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6847:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6890:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6890:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6890:9: sparse: int -- drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:132:5: sparse: sparse: symbol 'txgbe_poll_for_msg' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:162:5: sparse: sparse: symbol 'txgbe_poll_for_ack' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:263:5: sparse: sparse: symbol 'txgbe_read_v2p_mailbox' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:284:5: sparse: sparse: symbol 'txgbe_check_for_bit_vf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:300:5: sparse: sparse: symbol 'txgbe_check_for_msg_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:320:5: sparse: sparse: symbol 'txgbe_check_for_ack_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:340:5: sparse: sparse: symbol 'txgbe_check_for_rst_vf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:359:5: sparse: sparse: symbol 'txgbe_obtain_mbx_lock_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:387:5: sparse: sparse: symbol 'txgbe_write_mbx_vf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:425:5: sparse: sparse: symbol 'txgbe_read_mbx_vf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:483:5: sparse: sparse: symbol 'txgbe_check_for_bit_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:503:5: sparse: sparse: symbol 'txgbe_check_for_msg_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:525:5: sparse: sparse: symbol 'txgbe_check_for_ack_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:547:5: sparse: sparse: symbol 'txgbe_check_for_rst_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:572:5: sparse: sparse: symbol 'txgbe_obtain_mbx_lock_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:601:5: sparse: sparse: symbol 'txgbe_write_mbx_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:644:5: sparse: sparse: symbol 'txgbe_read_mbx_pf' was not declared. Should it be static? vim +2340 drivers/net/ethernet/netswift/ngbe/ngbe_hw.c a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2333 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2334 /** a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2335 * cmd_addr is used for some special command: a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2336 * 1. to be sector address, when implemented erase sector command a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2337 * 2. to be flash address when implemented read, write flash address a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2338 **/ a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2339 u8 fmgr_cmd_op(struct ngbe_hw *hw, u32 cmd, u32 cmd_addr) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2340 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2341 u32 cmd_val = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2342 u32 time_out = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2343 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2344 cmd_val = (cmd << SPI_CLK_CMD_OFFSET) | (SPI_CLK_DIV << SPI_CLK_DIV_OFFSET) | cmd_addr; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2345 wr32(hw, SPI_H_CMD_REG_ADDR, cmd_val); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2346 while (1) { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2347 if (rd32(hw, SPI_H_STA_REG_ADDR) & 0x1) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2348 break; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2349 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2350 if (time_out == SPI_TIME_OUT_VALUE) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2351 return 1; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2352 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2353 time_out = time_out + 1; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2354 udelay(10); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2355 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2356 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2357 return 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2358 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2359 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2360 u8 fmgr_usr_cmd_op(struct ngbe_hw *hw, u32 usr_cmd) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2361 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2362 u8 status = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2363 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2364 wr32(hw, SPI_H_USR_CMD_REG_ADDR, usr_cmd); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2365 status = fmgr_cmd_op(hw, SPI_CMD_USER_CMD, 0); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2366 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2367 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2368 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2369 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2370 u8 flash_erase_chip(struct ngbe_hw *hw) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2371 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2372 u8 status = fmgr_cmd_op(hw, SPI_CMD_ERASE_CHIP, 0); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2373 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2374 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2375 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2376 u8 flash_erase_sector(struct ngbe_hw *hw, u32 sec_addr) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2377 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2378 u8 status = fmgr_cmd_op(hw, SPI_CMD_ERASE_SECTOR, sec_addr); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2379 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2380 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2381 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2382 u32 ngbe_flash_read_dword(struct ngbe_hw *hw, u32 addr) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2383 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2384 u8 status = fmgr_cmd_op(hw, SPI_CMD_READ_DWORD, addr); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2385 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2386 if (status) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2387 return (u32)status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2388 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2389 return rd32(hw, SPI_H_DAT_REG_ADDR); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2390 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2391 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2392 u8 flash_write_dword(struct ngbe_hw *hw, u32 addr, u32 dword) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2393 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2394 u8 status = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2395 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2396 wr32(hw, SPI_H_DAT_REG_ADDR, dword); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2397 status = fmgr_cmd_op(hw, SPI_CMD_WRITE_DWORD, addr); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2398 if (status) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2399 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2400 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2401 if (dword != ngbe_flash_read_dword(hw, addr)) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2402 return 1; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2403 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2404 return 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2405 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2406 :::::: The code at line 2340 was first introduced by commit :::::: a5961b4bc6ce09a70902686ecc848a47493a9251 openeuler: net: ngbe: add ngbe module support :::::: TO: Duanqiang Wen <duanqiangwen(a)net-swift.com> :::::: CC: Duanqiang Wen <duanqiangwen(a)net-swift.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1327/1327] mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled'
by kernel test robot 31 Mar '25

31 Mar '25

Hi liubo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: 44983705e56ab22fda801d66e2a6bd0d1be7ca0b [1327/1327] etmem: add original kernel swap enabled options config: x86_64-buildonly-randconfig-005-20241216 (https://download.01.org/0day-ci/archive/20250331/202503310818.VmXexZb9-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503310818.VmXexZb9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503310818.VmXexZb9-lkp@intel.com/ All errors (new ones prefixed by >>): mm/vmscan.c:2734:17: warning: variable 'node_lru_pages' set but not used [-Wunused-but-set-variable] 2734 | unsigned long node_lru_pages = 0; | ^ >> mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] 3257 | if (sc != NULL && !kernel_swap_enabled()) | ^ mm/vmscan.c:3257:21: note: did you mean 'kernfs_ns_enabled'? include/linux/kernfs.h:309:20: note: 'kernfs_ns_enabled' declared here 309 | static inline bool kernfs_ns_enabled(struct kernfs_node *kn) | ^ 1 warning and 1 error generated. vim +/kernel_swap_enabled +3257 mm/vmscan.c 3250 3251 /* 3252 * Check if original kernel swap is enabled 3253 * turn off kernel swap,but leave page cache reclaim on 3254 */ 3255 static inline void kernel_swap_check(struct scan_control *sc) 3256 { > 3257 if (sc != NULL && !kernel_swap_enabled()) 3258 sc->may_swap = 0; 3259 } 3260 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2829/2829] drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:177:5: sparse: sparse: symbol 'txgbe_get_link_ksettings' was not declared. Should it be static?
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0e7e8faca7062a439fd0a56574c2c3860ceb2088 commit: 96c897d3a6cb76928d7981f60f832afba1bcc01b [2829/2829] openeuler: configs: delete txgbe/Kconfig, add txgbe_config to netswift/Kconfig config: x86_64-randconfig-122-20250330 (https://download.01.org/0day-ci/archive/20250330/202503302242.szHIIxdv-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503302242.szHIIxdv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503302242.szHIIxdv-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:177:5: sparse: sparse: symbol 'txgbe_get_link_ksettings' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:447:33: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:447:33: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:447:33: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1674:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1674:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1674:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1696:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1696:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1696:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1732:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1732:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1732:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1736:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1736:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1736:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2089:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2089:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2089:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2424:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] psrc @@ got unsigned short [usertype] src_port @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2424:36: sparse: expected restricted __be16 [usertype] psrc drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2424:36: sparse: got unsigned short [usertype] src_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2425:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] psrc @@ got unsigned short [usertype] src_port @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2425:36: sparse: expected restricted __be16 [usertype] psrc drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2425:36: sparse: got unsigned short [usertype] src_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2426:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] pdst @@ got unsigned short [usertype] dst_port @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2426:36: sparse: expected restricted __be16 [usertype] pdst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2426:36: sparse: got unsigned short [usertype] dst_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2427:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] pdst @@ got unsigned short [usertype] dst_port @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2427:36: sparse: expected restricted __be16 [usertype] pdst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2427:36: sparse: got unsigned short [usertype] dst_port >> drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2428:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] ip4src @@ got unsigned int @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2428:38: sparse: expected restricted __be32 [usertype] ip4src drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2428:38: sparse: got unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2429:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] ip4src @@ got unsigned int @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2429:38: sparse: expected restricted __be32 [usertype] ip4src drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2429:38: sparse: got unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2430:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] ip4dst @@ got unsigned int @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2430:38: sparse: expected restricted __be32 [usertype] ip4dst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2430:38: sparse: got unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2431:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] ip4dst @@ got unsigned int @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2431:38: sparse: expected restricted __be32 [usertype] ip4dst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2431:38: sparse: got unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2432:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] vlan_etype @@ got unsigned short [usertype] flex_bytes @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2432:31: sparse: expected restricted __be16 [usertype] vlan_etype drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2432:31: sparse: got unsigned short [usertype] flex_bytes drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2433:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] vlan_etype @@ got unsigned short [usertype] flex_bytes @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2433:31: sparse: expected restricted __be16 [usertype] vlan_etype drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2433:31: sparse: got unsigned short [usertype] flex_bytes drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2434:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2434:28: sparse: expected restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2434:28: sparse: got unsigned int [usertype] drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2435:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2435:28: sparse: expected restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2435:28: sparse: got unsigned int [usertype] >> drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2703:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __be32 [usertype] ip4src @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2703:43: sparse: expected unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2703:43: sparse: got restricted __be32 [usertype] ip4src drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2704:34: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __be32 [usertype] ip4src @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2704:34: sparse: expected unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2704:34: sparse: got restricted __be32 [usertype] ip4src >> drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2705:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __be32 [usertype] ip4dst @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2705:43: sparse: expected unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2705:43: sparse: got restricted __be32 [usertype] ip4dst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2706:34: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __be32 [usertype] ip4dst @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2706:34: sparse: expected unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2706:34: sparse: got restricted __be32 [usertype] ip4dst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2707:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] src_port @@ got restricted __be16 [usertype] psrc @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2707:42: sparse: expected unsigned short [usertype] src_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2707:42: sparse: got restricted __be16 [usertype] psrc drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2708:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [addressable] [assigned] [usertype] src_port @@ got restricted __be16 [usertype] psrc @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2708:33: sparse: expected unsigned short [addressable] [assigned] [usertype] src_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2708:33: sparse: got restricted __be16 [usertype] psrc >> drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2709:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] dst_port @@ got restricted __be16 [usertype] pdst @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2709:42: sparse: expected unsigned short [usertype] dst_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2709:42: sparse: got restricted __be16 [usertype] pdst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2710:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [addressable] [assigned] [usertype] dst_port @@ got restricted __be16 [usertype] pdst @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2710:33: sparse: expected unsigned short [addressable] [assigned] [usertype] dst_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2710:33: sparse: got restricted __be16 [usertype] pdst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2714:48: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2716:48: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2717:52: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] flex_bytes @@ got restricted __be16 [usertype] vlan_etype @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2717:52: sparse: expected unsigned short [usertype] flex_bytes drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2717:52: sparse: got restricted __be16 [usertype] vlan_etype drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2719:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [addressable] [assigned] [usertype] flex_bytes @@ got restricted __be16 [usertype] vlan_etype @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2719:43: sparse: expected unsigned short [addressable] [assigned] [usertype] flex_bytes drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2719:43: sparse: got restricted __be16 [usertype] vlan_etype -- drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:132:5: sparse: sparse: symbol 'txgbe_poll_for_msg' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:162:5: sparse: sparse: symbol 'txgbe_poll_for_ack' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:185:5: sparse: sparse: symbol 'txgbe_check_for_bit_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:205:5: sparse: sparse: symbol 'txgbe_check_for_msg_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:227:5: sparse: sparse: symbol 'txgbe_check_for_ack_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:249:5: sparse: sparse: symbol 'txgbe_check_for_rst_pf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:274:5: sparse: sparse: symbol 'txgbe_obtain_mbx_lock_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:303:5: sparse: sparse: symbol 'txgbe_write_mbx_pf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:346:5: sparse: sparse: symbol 'txgbe_read_mbx_pf' was not declared. Should it be static? -- drivers/net/ethernet/netswift/txgbe/txgbe_main.c:170:6: sparse: sparse: symbol 'txgbe_service_event_schedule' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:930:40: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __be16 [usertype] vlan_proto @@ got unsigned short [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:930:40: sparse: expected restricted __be16 [usertype] vlan_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:930:40: sparse: got unsigned short [usertype] drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2632:6: sparse: sparse: symbol 'txgbe_disable_tx_queue' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2777:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2777:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2777:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2781:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2781:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2781:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2858:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2858:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2858:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2913:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2913:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2913:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3297:5: sparse: sparse: symbol 'txgbe_add_cloud_switcher' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3312:5: sparse: sparse: symbol 'txgbe_del_cloud_switcher' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3632:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3632:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3632:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3662:6: sparse: sparse: symbol 'txgbe_configure_isb' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3672:6: sparse: sparse: symbol 'txgbe_configure_port' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3921:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3921:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3921:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4227:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4227:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4227:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4292:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4292:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4292:17: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4310:5: sparse: sparse: symbol 'txgbe_init_shared_code' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4392:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4392:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4392:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4821:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4821:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4821:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4953:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4953:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4953:17: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5952:40: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5974:36: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5978:67: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5988:32: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5989:36: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5993:67: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6007:37: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6031:40: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6643:33: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6643:33: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6643:33: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6645:33: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6645:33: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6645:33: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6647:38: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6648:25: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6648:25: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6648:25: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6652:27: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6652:27: sparse: left side has type unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6652:27: sparse: right side has type restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6662:27: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6662:27: sparse: left side has type unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6662:27: sparse: right side has type restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6682:5: sparse: sparse: symbol 'txgbe_skb_pad_nonzero' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6724:30: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] protocol @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6724:30: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6724:30: sparse: got restricted __be16 [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6770:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6770:26: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6770:26: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6771:29: sparse: sparse: cast from restricted __be16 >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6804:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] h_vlan_TCI @@ got unsigned short [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6804:42: sparse: expected restricted __be16 [usertype] h_vlan_TCI drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6804:42: sparse: got unsigned short [usertype] drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7209:25: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] port @@ got restricted __be16 [usertype] port @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7209:25: sparse: expected unsigned short [usertype] port drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7209:25: sparse: got restricted __be16 [usertype] port drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7275:46: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7277:37: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7285:47: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7287:37: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7379:26: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] type @@ got restricted __be16 [usertype] protocol @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7379:26: sparse: expected unsigned short [usertype] type drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7379:26: sparse: got restricted __be16 [usertype] protocol >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7395:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] type @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7395:22: sparse: expected unsigned short [usertype] type drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7395:22: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7422:35: sparse: sparse: incorrect type in initializer (incompatible argument 2 (different base types)) @@ expected int ( *ndo_vlan_rx_add_vid )( ... ) @@ got int ( * )( ... ) @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7422:35: sparse: expected int ( *ndo_vlan_rx_add_vid )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7422:35: sparse: got int ( * )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7423:35: sparse: sparse: incorrect type in initializer (incompatible argument 2 (different base types)) @@ expected int ( *ndo_vlan_rx_kill_vid )( ... ) @@ got int ( * )( ... ) @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7423:35: sparse: expected int ( *ndo_vlan_rx_kill_vid )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7423:35: sparse: got int ( * )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7583:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7583:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7583:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7786:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7786:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7786:17: sparse: int -- drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:645:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:645:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:645:9: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:1042:6: sparse: sparse: symbol 'txgbe_add_uc_addr' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:1186:6: sparse: sparse: symbol 'txgbe_set_mta' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2699:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2699:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2699:9: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2806:5: sparse: sparse: symbol 'txgbe_setup_mac_link_hostif' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2845:5: sparse: sparse: symbol 'txgbe_crc16_ccitt' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3297:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3297:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3297:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3342:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3342:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3342:17: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4238:5: sparse: sparse: symbol 'txgbe_enable_rx_adapter' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4259:5: sparse: sparse: symbol 'txgbe_set_sgmii_an37_ability' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4833:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4833:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4833:9: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:5239:5: sparse: sparse: symbol 'txgbe_reset_misc' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6345:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6345:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6345:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6347:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6347:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6347:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6520:5: sparse: sparse: symbol 'txgbe_read_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6572:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6572:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6572:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6656:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6656:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6656:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6669:5: sparse: sparse: symbol 'txgbe_write_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6712:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6712:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6712:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6757:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6757:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6757:9: sparse: int vim +/txgbe_get_link_ksettings +177 drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c a493f74ade8fe6 zhenpengzheng 2021-07-13 176 a493f74ade8fe6 zhenpengzheng 2021-07-13 @177 int txgbe_get_link_ksettings(struct net_device *netdev, a493f74ade8fe6 zhenpengzheng 2021-07-13 178 struct ethtool_link_ksettings *cmd) a493f74ade8fe6 zhenpengzheng 2021-07-13 179 { a493f74ade8fe6 zhenpengzheng 2021-07-13 180 struct txgbe_adapter *adapter = netdev_priv(netdev); a493f74ade8fe6 zhenpengzheng 2021-07-13 181 struct txgbe_hw *hw = &adapter->hw; a493f74ade8fe6 zhenpengzheng 2021-07-13 182 u32 supported_link; a493f74ade8fe6 zhenpengzheng 2021-07-13 183 u32 link_speed = 0; a493f74ade8fe6 zhenpengzheng 2021-07-13 184 bool autoneg = false; a493f74ade8fe6 zhenpengzheng 2021-07-13 185 u32 supported, advertising; a493f74ade8fe6 zhenpengzheng 2021-07-13 186 bool link_up; a493f74ade8fe6 zhenpengzheng 2021-07-13 187 a493f74ade8fe6 zhenpengzheng 2021-07-13 188 ethtool_convert_link_mode_to_legacy_u32(&supported, a493f74ade8fe6 zhenpengzheng 2021-07-13 189 cmd->link_modes.supported); a493f74ade8fe6 zhenpengzheng 2021-07-13 190 a493f74ade8fe6 zhenpengzheng 2021-07-13 191 TCALL(hw, mac.ops.get_link_capabilities, &supported_link, &autoneg); a493f74ade8fe6 zhenpengzheng 2021-07-13 192 a493f74ade8fe6 zhenpengzheng 2021-07-13 193 if ((hw->subsystem_device_id & 0xF0) == TXGBE_ID_KR_KX_KX4) a493f74ade8fe6 zhenpengzheng 2021-07-13 194 autoneg = adapter->backplane_an ? 1:0; a493f74ade8fe6 zhenpengzheng 2021-07-13 195 else if ((hw->subsystem_device_id & 0xF0) == TXGBE_ID_MAC_SGMII) a493f74ade8fe6 zhenpengzheng 2021-07-13 196 autoneg = adapter->an37?1:0; a493f74ade8fe6 zhenpengzheng 2021-07-13 197 a493f74ade8fe6 zhenpengzheng 2021-07-13 198 /* set the supported link speeds */ a493f74ade8fe6 zhenpengzheng 2021-07-13 199 if (supported_link & TXGBE_LINK_SPEED_10GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 200 supported |= (txgbe_isbackplane(hw->phy.media_type)) ? a493f74ade8fe6 zhenpengzheng 2021-07-13 201 txgbe_backplane_type(hw) : SUPPORTED_10000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 202 if (supported_link & TXGBE_LINK_SPEED_1GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 203 supported |= (txgbe_isbackplane(hw->phy.media_type)) ? a493f74ade8fe6 zhenpengzheng 2021-07-13 204 SUPPORTED_1000baseKX_Full : SUPPORTED_1000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 205 if (supported_link & TXGBE_LINK_SPEED_100_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 206 supported |= SUPPORTED_100baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 207 if (supported_link & TXGBE_LINK_SPEED_10_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 208 supported |= SUPPORTED_10baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 209 a493f74ade8fe6 zhenpengzheng 2021-07-13 210 /* default advertised speed if phy.autoneg_advertised isn't set */ a493f74ade8fe6 zhenpengzheng 2021-07-13 211 advertising = supported; a493f74ade8fe6 zhenpengzheng 2021-07-13 212 a493f74ade8fe6 zhenpengzheng 2021-07-13 213 /* set the advertised speeds */ a493f74ade8fe6 zhenpengzheng 2021-07-13 214 if (hw->phy.autoneg_advertised) { a493f74ade8fe6 zhenpengzheng 2021-07-13 215 if (hw->phy.autoneg_advertised & TXGBE_LINK_SPEED_100_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 216 advertising |= ADVERTISED_100baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 217 if (hw->phy.autoneg_advertised & TXGBE_LINK_SPEED_10GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 218 advertising |= (supported & ADVERTISED_MASK_10G); a493f74ade8fe6 zhenpengzheng 2021-07-13 219 if (hw->phy.autoneg_advertised & TXGBE_LINK_SPEED_1GB_FULL) { a493f74ade8fe6 zhenpengzheng 2021-07-13 220 if (supported & SUPPORTED_1000baseKX_Full) a493f74ade8fe6 zhenpengzheng 2021-07-13 221 advertising |= ADVERTISED_1000baseKX_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 222 else a493f74ade8fe6 zhenpengzheng 2021-07-13 223 advertising |= ADVERTISED_1000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 224 } a493f74ade8fe6 zhenpengzheng 2021-07-13 225 if (hw->phy.autoneg_advertised & TXGBE_LINK_SPEED_10_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 226 advertising |= ADVERTISED_10baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 227 } else { a493f74ade8fe6 zhenpengzheng 2021-07-13 228 /* default modes in case phy.autoneg_advertised isn't set */ a493f74ade8fe6 zhenpengzheng 2021-07-13 229 if (supported_link & TXGBE_LINK_SPEED_10GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 230 advertising |= ADVERTISED_10000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 231 if (supported_link & TXGBE_LINK_SPEED_1GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 232 advertising |= ADVERTISED_1000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 233 if (supported_link & TXGBE_LINK_SPEED_100_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 234 advertising |= ADVERTISED_100baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 235 if (hw->phy.multispeed_fiber && !autoneg) { a493f74ade8fe6 zhenpengzheng 2021-07-13 236 if (supported_link & TXGBE_LINK_SPEED_10GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 237 advertising = ADVERTISED_10000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 238 } a493f74ade8fe6 zhenpengzheng 2021-07-13 239 if (supported_link & TXGBE_LINK_SPEED_10_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 240 advertising |= ADVERTISED_10baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 241 } a493f74ade8fe6 zhenpengzheng 2021-07-13 242 a493f74ade8fe6 zhenpengzheng 2021-07-13 243 if (autoneg) { a493f74ade8fe6 zhenpengzheng 2021-07-13 244 supported |= SUPPORTED_Autoneg; a493f74ade8fe6 zhenpengzheng 2021-07-13 245 advertising |= ADVERTISED_Autoneg; a493f74ade8fe6 zhenpengzheng 2021-07-13 246 cmd->base.autoneg = AUTONEG_ENABLE; a493f74ade8fe6 zhenpengzheng 2021-07-13 247 } else a493f74ade8fe6 zhenpengzheng 2021-07-13 248 cmd->base.autoneg = AUTONEG_DISABLE; a493f74ade8fe6 zhenpengzheng 2021-07-13 249 a493f74ade8fe6 zhenpengzheng 2021-07-13 250 /* Determine the remaining settings based on the PHY type. */ a493f74ade8fe6 zhenpengzheng 2021-07-13 251 switch (adapter->hw.phy.type) { a493f74ade8fe6 zhenpengzheng 2021-07-13 252 case txgbe_phy_tn: a493f74ade8fe6 zhenpengzheng 2021-07-13 253 case txgbe_phy_aq: a493f74ade8fe6 zhenpengzheng 2021-07-13 254 case txgbe_phy_cu_unknown: a493f74ade8fe6 zhenpengzheng 2021-07-13 255 supported |= SUPPORTED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 256 advertising |= ADVERTISED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 257 cmd->base.port = PORT_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 258 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 259 case txgbe_phy_qt: a493f74ade8fe6 zhenpengzheng 2021-07-13 260 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 261 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 262 cmd->base.port = PORT_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 263 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 264 case txgbe_phy_nl: a493f74ade8fe6 zhenpengzheng 2021-07-13 265 case txgbe_phy_sfp_passive_tyco: a493f74ade8fe6 zhenpengzheng 2021-07-13 266 case txgbe_phy_sfp_passive_unknown: a493f74ade8fe6 zhenpengzheng 2021-07-13 267 case txgbe_phy_sfp_ftl: a493f74ade8fe6 zhenpengzheng 2021-07-13 268 case txgbe_phy_sfp_avago: a493f74ade8fe6 zhenpengzheng 2021-07-13 269 case txgbe_phy_sfp_intel: a493f74ade8fe6 zhenpengzheng 2021-07-13 270 case txgbe_phy_sfp_unknown: a493f74ade8fe6 zhenpengzheng 2021-07-13 271 switch (adapter->hw.phy.sfp_type) { a493f74ade8fe6 zhenpengzheng 2021-07-13 272 /* SFP+ devices, further checking needed */ a493f74ade8fe6 zhenpengzheng 2021-07-13 273 case txgbe_sfp_type_da_cu: a493f74ade8fe6 zhenpengzheng 2021-07-13 274 case txgbe_sfp_type_da_cu_core0: a493f74ade8fe6 zhenpengzheng 2021-07-13 275 case txgbe_sfp_type_da_cu_core1: a493f74ade8fe6 zhenpengzheng 2021-07-13 276 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 277 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 278 cmd->base.port = PORT_DA; a493f74ade8fe6 zhenpengzheng 2021-07-13 279 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 280 case txgbe_sfp_type_sr: a493f74ade8fe6 zhenpengzheng 2021-07-13 281 case txgbe_sfp_type_lr: a493f74ade8fe6 zhenpengzheng 2021-07-13 282 case txgbe_sfp_type_srlr_core0: a493f74ade8fe6 zhenpengzheng 2021-07-13 283 case txgbe_sfp_type_srlr_core1: a493f74ade8fe6 zhenpengzheng 2021-07-13 284 case txgbe_sfp_type_1g_sx_core0: a493f74ade8fe6 zhenpengzheng 2021-07-13 285 case txgbe_sfp_type_1g_sx_core1: a493f74ade8fe6 zhenpengzheng 2021-07-13 286 case txgbe_sfp_type_1g_lx_core0: a493f74ade8fe6 zhenpengzheng 2021-07-13 287 case txgbe_sfp_type_1g_lx_core1: a493f74ade8fe6 zhenpengzheng 2021-07-13 288 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 289 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 290 cmd->base.port = PORT_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 291 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 292 case txgbe_sfp_type_not_present: a493f74ade8fe6 zhenpengzheng 2021-07-13 293 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 294 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 295 cmd->base.port = PORT_NONE; a493f74ade8fe6 zhenpengzheng 2021-07-13 296 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 297 case txgbe_sfp_type_1g_cu_core0: a493f74ade8fe6 zhenpengzheng 2021-07-13 298 case txgbe_sfp_type_1g_cu_core1: a493f74ade8fe6 zhenpengzheng 2021-07-13 299 supported |= SUPPORTED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 300 advertising |= ADVERTISED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 301 cmd->base.port = PORT_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 302 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 303 case txgbe_sfp_type_unknown: a493f74ade8fe6 zhenpengzheng 2021-07-13 304 default: a493f74ade8fe6 zhenpengzheng 2021-07-13 305 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 306 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 307 cmd->base.port = PORT_OTHER; a493f74ade8fe6 zhenpengzheng 2021-07-13 308 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 309 } a493f74ade8fe6 zhenpengzheng 2021-07-13 310 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 311 case txgbe_phy_xaui: a493f74ade8fe6 zhenpengzheng 2021-07-13 312 supported |= SUPPORTED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 313 advertising |= ADVERTISED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 314 cmd->base.port = PORT_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 315 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 316 case txgbe_phy_unknown: a493f74ade8fe6 zhenpengzheng 2021-07-13 317 case txgbe_phy_generic: a493f74ade8fe6 zhenpengzheng 2021-07-13 318 case txgbe_phy_sfp_unsupported: a493f74ade8fe6 zhenpengzheng 2021-07-13 319 default: a493f74ade8fe6 zhenpengzheng 2021-07-13 320 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 321 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 322 cmd->base.port = PORT_OTHER; a493f74ade8fe6 zhenpengzheng 2021-07-13 323 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 324 } a493f74ade8fe6 zhenpengzheng 2021-07-13 325 a493f74ade8fe6 zhenpengzheng 2021-07-13 326 if (!in_interrupt()) { a493f74ade8fe6 zhenpengzheng 2021-07-13 327 TCALL(hw, mac.ops.check_link, &link_speed, &link_up, false); a493f74ade8fe6 zhenpengzheng 2021-07-13 328 } else { a493f74ade8fe6 zhenpengzheng 2021-07-13 329 /* a493f74ade8fe6 zhenpengzheng 2021-07-13 330 * this case is a special workaround for RHEL5 bonding a493f74ade8fe6 zhenpengzheng 2021-07-13 331 * that calls this routine from interrupt context a493f74ade8fe6 zhenpengzheng 2021-07-13 332 */ a493f74ade8fe6 zhenpengzheng 2021-07-13 333 link_speed = adapter->link_speed; a493f74ade8fe6 zhenpengzheng 2021-07-13 334 link_up = adapter->link_up; a493f74ade8fe6 zhenpengzheng 2021-07-13 335 } a493f74ade8fe6 zhenpengzheng 2021-07-13 336 a493f74ade8fe6 zhenpengzheng 2021-07-13 337 supported |= SUPPORTED_Pause; a493f74ade8fe6 zhenpengzheng 2021-07-13 338 a493f74ade8fe6 zhenpengzheng 2021-07-13 339 switch (hw->fc.requested_mode) { a493f74ade8fe6 zhenpengzheng 2021-07-13 340 case txgbe_fc_full: a493f74ade8fe6 zhenpengzheng 2021-07-13 341 advertising |= ADVERTISED_Pause; a493f74ade8fe6 zhenpengzheng 2021-07-13 342 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 343 case txgbe_fc_rx_pause: a493f74ade8fe6 zhenpengzheng 2021-07-13 344 advertising |= ADVERTISED_Pause | a493f74ade8fe6 zhenpengzheng 2021-07-13 345 ADVERTISED_Asym_Pause; a493f74ade8fe6 zhenpengzheng 2021-07-13 346 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 347 case txgbe_fc_tx_pause: a493f74ade8fe6 zhenpengzheng 2021-07-13 348 advertising |= ADVERTISED_Asym_Pause; a493f74ade8fe6 zhenpengzheng 2021-07-13 349 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 350 default: a493f74ade8fe6 zhenpengzheng 2021-07-13 351 advertising &= ~(ADVERTISED_Pause | a493f74ade8fe6 zhenpengzheng 2021-07-13 352 ADVERTISED_Asym_Pause); a493f74ade8fe6 zhenpengzheng 2021-07-13 353 } a493f74ade8fe6 zhenpengzheng 2021-07-13 354 a493f74ade8fe6 zhenpengzheng 2021-07-13 355 if (link_up) { a493f74ade8fe6 zhenpengzheng 2021-07-13 356 switch (link_speed) { a493f74ade8fe6 zhenpengzheng 2021-07-13 357 case TXGBE_LINK_SPEED_10GB_FULL: a493f74ade8fe6 zhenpengzheng 2021-07-13 358 cmd->base.speed = SPEED_10000; a493f74ade8fe6 zhenpengzheng 2021-07-13 359 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 360 case TXGBE_LINK_SPEED_1GB_FULL: a493f74ade8fe6 zhenpengzheng 2021-07-13 361 cmd->base.speed = SPEED_1000; a493f74ade8fe6 zhenpengzheng 2021-07-13 362 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 363 case TXGBE_LINK_SPEED_100_FULL: a493f74ade8fe6 zhenpengzheng 2021-07-13 364 cmd->base.speed = SPEED_100; a493f74ade8fe6 zhenpengzheng 2021-07-13 365 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 366 case TXGBE_LINK_SPEED_10_FULL: a493f74ade8fe6 zhenpengzheng 2021-07-13 367 cmd->base.speed = SPEED_10; a493f74ade8fe6 zhenpengzheng 2021-07-13 368 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 369 default: a493f74ade8fe6 zhenpengzheng 2021-07-13 370 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 371 } a493f74ade8fe6 zhenpengzheng 2021-07-13 372 cmd->base.duplex = DUPLEX_FULL; a493f74ade8fe6 zhenpengzheng 2021-07-13 373 } else { a493f74ade8fe6 zhenpengzheng 2021-07-13 374 cmd->base.speed = -1; a493f74ade8fe6 zhenpengzheng 2021-07-13 375 cmd->base.duplex = -1; a493f74ade8fe6 zhenpengzheng 2021-07-13 376 } a493f74ade8fe6 zhenpengzheng 2021-07-13 377 a493f74ade8fe6 zhenpengzheng 2021-07-13 378 ethtool_convert_legacy_u32_to_link_mode(cmd->link_modes.supported, a493f74ade8fe6 zhenpengzheng 2021-07-13 379 supported); a493f74ade8fe6 zhenpengzheng 2021-07-13 380 ethtool_convert_legacy_u32_to_link_mode(cmd->link_modes.advertising, a493f74ade8fe6 zhenpengzheng 2021-07-13 381 advertising); a493f74ade8fe6 zhenpengzheng 2021-07-13 382 return 0; a493f74ade8fe6 zhenpengzheng 2021-07-13 383 } a493f74ade8fe6 zhenpengzheng 2021-07-13 384 :::::: The code at line 177 was first introduced by commit :::::: a493f74ade8fe69f3446a65ddf7627fdf34c183c net: txgbe: Add support for Netswift 10G NIC :::::: TO: zhenpengzheng <zhenpengzheng(a)net-swift.com> :::::: CC: Zheng Zengkai <zhengzengkai(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] mm/swapfile.o: warning: objtool: free_swap_and_cache()+0x10f: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: 9b3ba7800bc02ca4f0e62d79b32edc22e24ca926 [1531/1531] mm: swap: fix race between free_swap_and_cache() and swapoff() config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503301931.DQUjzVBe-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301931.DQUjzVBe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301931.DQUjzVBe-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/swapfile.c:11: In file included from include/linux/hugetlb.h:45: include/linux/mempolicy.h:329:13: warning: unused function '__do_mbind' [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ 1 warning generated. >> mm/swapfile.o: warning: objtool: free_swap_and_cache()+0x10f: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] drivers/md/dm.o: warning: objtool: dm_process_bio()+0x2ec: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: 3830dbeebc54a74b56b8253c33857b38fae427fb [1531/1531] dm: revert partial fix for redundant bio-based IO accounting config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503301828.H3xVCQ5Q-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301828.H3xVCQ5Q-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301828.H3xVCQ5Q-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/md/dm.o: warning: objtool: dm_process_bio()+0x2ec: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 5b56c883c34a890a3f9ca7baa8aea426538c88a8
by kernel test robot 30 Mar '25

30 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 !15508 scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503300608.WYcT007F-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503301024.26J3J3nq-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503301315.o2E2dF19-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503301602.HqBUoFWQ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503301705.3fAiYws1-lkp@intel.com block/blk-mq.o: warning: objtool: blk_mq_unfreeze_queue()+0x75: unreachable instruction drivers/dax/bus.o: warning: objtool: __dax_driver_register()+0xd5: unreachable instruction drivers/net/dsa/realtek-smi.c:465:34: warning: 'realtek_smi_of_match' defined but not used [-Wunused-const-variable=] drivers/nvdimm/claim.o: warning: objtool: nsio_rw_bytes()+0x368: unreachable instruction drivers/xen/events/events_base.o: warning: objtool: xen_test_irq_shared()+0xe1: unreachable instruction fs/btrfs/file.o: warning: objtool: btrfs_drop_extent_cache()+0x738: unreachable instruction kernel/trace/ring_buffer.o: warning: objtool: rb_get_reader_page()+0x4d2: unreachable instruction Unverified Error/Warning (likely false positive, kindly check if interested): 789 | eprintk("kgdbts: ERROR: beyond end of test on" 795 | eprintk("kgdbts: ERROR: put buffer overflow on" Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250329 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-tee-optee-core.c:warning:return-makes-integer-from-pointer-without-a-cast | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250329 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250329 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-004-20250329 | `-- init-Kconfig:syntax-error |-- x86_64-allnoconfig | |-- Makefile:include-config-auto.conf.cmd:No-such-file-or-directory | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-allyesconfig | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- crypto-aegis128.o:warning:objtool:missing-symbol-for-section-.init.text | |-- crypto-zstd.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-regulator-max8973-regulator.o:warning:objtool:max8973_probe:can-t-find-switch-jump-table | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- samples-vfio-mdev-mdpy-fb.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-002-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- eprintk(-kgdbts:ERROR:beyond-end-of-test-on | |-- eprintk(-kgdbts:ERROR:put-buffer-overflow-on | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_ext.o:warning:objtool:missing-symbol-for-section-.init.text | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_ext.o:warning:objtool:missing-symbol-for-section-.init.text | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-mq.o:warning:objtool:blk_mq_unfreeze_queue:unreachable-instruction | |-- drivers-dax-bus.o:warning:objtool:__dax_driver_register:unreachable-instruction | |-- drivers-fpga-dfl.o:warning:objtool:build_info_commit_dev:unreachable-instruction | |-- drivers-nvdimm-claim.o:warning:objtool:nsio_rw_bytes:unreachable-instruction | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-xen-events-events_base.o:warning:objtool:xen_test_irq_shared:unreachable-instruction | |-- fs-btrfs-file.o:warning:objtool:btrfs_drop_extent_cache:unreachable-instruction | |-- kernel-trace-ring_buffer.o:warning:objtool:rb_get_reader_page:unreachable-instruction | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-defconfig | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized-in-this-function | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-101-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-gpu-drm-i915-i915_gem.o:warning:objtool:i915_gem_fault-falls-through-to-next-function-i915_gem_object_ggtt_pin() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:_intel_adjust_tile_offset-falls-through-to-next-function-rcu_lock_acquire() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:_intel_compute_tile_offset-falls-through-to-next-function-skl_format_to_fourcc() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:skl_plane_stride-falls-through-to-next-function-skl_plane_ctl() | |-- drivers-gpu-drm-i915-vlv_dsi_pll.o:warning:objtool:bxt_dsi_pll_enable-falls-through-to-next-function-bxt_dsi_reset_clocks() | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-mmc-host-mtk-sd.o:warning:objtool:msdc_set_timeout-falls-through-to-next-function-get_best_delay() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-102-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-103-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-md-raid5.o:warning:objtool:raid5_compute_sector-falls-through-to-next-function-raid5_compute_blocknr() | |-- drivers-mmc-host-mtk-sd.o:warning:objtool:msdc_set_timeout-falls-through-to-next-function-get_best_delay() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-104-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- fs-debugfs-file.o:warning:objtool:full_proxy_open:unreachable-instruction | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-121-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-merge.c:sparse:sparse:symbol-blk_try_req_merge-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_issue-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_requeue-was-not-declared.-Should-it-be-static | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- include-linux-bpf-cgroup.h:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:invalid-assignment: | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-122-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-merge.c:sparse:sparse:symbol-blk_try_req_merge-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_issue-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_requeue-was-not-declared.-Should-it-be-static | |-- drivers-net-wireless-ath-ath9k-htc_drv_txrx.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-restricted-__be16-usertype-rs_datalen-got-unsigned-short-usertype | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- include-linux-bpf-cgroup.h:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:invalid-assignment: | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-123-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-firewire-core-topology.o:warning:objtool:fw_core_handle_bus_reset:can-t-find-switch-jump-table | |-- drivers-input-mouse-elantech.o:warning:objtool:elantech_process_byte:can-t-find-switch-jump-table | |-- drivers-leds-leds-lm355x.o:warning:objtool:lm355x_control:can-t-find-switch-jump-table | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- fs-ext4-mballoc.o:warning:objtool:ext4_mb_complex_scan_group:unreachable-instruction | |-- fs-gfs2-glock.o:warning:objtool:finish_xmote:can-t-find-switch-jump-table | |-- fs-xfs-libxfs-xfs_rmap.o:warning:objtool:xfs_rmap_convert_shared:can-t-find-switch-jump-table | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-161-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-media-tuners-fc2580.o:warning:objtool:fc2580_set_params-falls-through-to-next-function-fc2580_standby() | |-- drivers-mmc-host-mtk-sd.o:warning:objtool:msdc_set_timeout-falls-through-to-next-function-get_best_delay() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-r052-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- drivers-net-dsa-realtek-smi.c:warning:realtek_smi_of_match-defined-but-not-used | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used `-- x86_64-randconfig-r053-20250330 |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union |-- drivers-mmc-host-mtk-sd.o:warning:objtool:msdc_set_timeout-falls-through-to-next-function-get_best_delay() |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 1445m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250329 gcc-7.5.0 arm64 randconfig-002-20250329 gcc-9.5.0 arm64 randconfig-003-20250329 gcc-5.5.0 arm64 randconfig-004-20250329 gcc-5.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250329 clang-20 x86_64 buildonly-randconfig-002-20250329 gcc-12 x86_64 buildonly-randconfig-003-20250329 gcc-12 x86_64 buildonly-randconfig-004-20250329 clang-20 x86_64 buildonly-randconfig-005-20250329 clang-20 x86_64 buildonly-randconfig-006-20250329 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1536/1536] drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: c3088bd9bdf90fcfc8a69046692d75c2b04563ba [1536/1536] ath9k_htc: Discard undersized packets config: x86_64-randconfig-122-20250330 (https://download.01.org/0day-ci/archive/20250330/202503301705.3fAiYws1-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301705.3fAiYws1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301705.3fAiYws1-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] rs_datalen @@ got unsigned short [usertype] @@ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: expected restricted __be16 [usertype] rs_datalen drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: got unsigned short [usertype] drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:988:13: sparse: sparse: restricted __be16 degrades to integer drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:1001:13: sparse: sparse: restricted __be16 degrades to integer In file included from drivers/net/wireless/ath/ath9k/htc.h:23, from drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:17: In function '__skb_queue_before', inlined from '__skb_queue_tail' at include/linux/skbuff.h:1886:2, inlined from 'ath9k_htc_tx_cleanup_queue' at drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:741:4: include/linux/skbuff.h:1852:9: warning: array subscript 'struct sk_buff[0]' is partly outside array bounds of 'struct sk_buff_head[1]' [-Warray-bounds] 1852 | __skb_insert(newsk, next->prev, next, list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c: In function 'ath9k_htc_tx_cleanup_queue': drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:733:29: note: object 'queue' of size 80 733 | struct sk_buff_head queue; | ^~~~~ vim +987 drivers/net/wireless/ath/ath9k/htc_drv_txrx.c 962 963 static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, 964 struct ath9k_htc_rxbuf *rxbuf, 965 struct ieee80211_rx_status *rx_status) 966 967 { 968 struct ieee80211_hdr *hdr; 969 struct ieee80211_hw *hw = priv->hw; 970 struct sk_buff *skb = rxbuf->skb; 971 struct ath_common *common = ath9k_hw_common(priv->ah); 972 struct ath_hw *ah = common->ah; 973 struct ath_htc_rx_status *rxstatus; 974 struct ath_rx_status rx_stats; 975 bool decrypt_error = false; 976 __be16 rs_datalen; 977 bool is_phyerr; 978 979 if (skb->len < HTC_RX_FRAME_HEADER_SIZE) { 980 ath_err(common, "Corrupted RX frame, dropping (len: %d)\n", 981 skb->len); 982 goto rx_next; 983 } 984 985 rxstatus = (struct ath_htc_rx_status *)skb->data; 986 > 987 rs_datalen = be16_to_cpu(rxstatus->rs_datalen); 988 if (unlikely(rs_datalen - 989 (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0)) { 990 ath_err(common, 991 "Corrupted RX data len, dropping (dlen: %d, skblen: %d)\n", 992 rs_datalen, skb->len); 993 goto rx_next; 994 } 995 996 is_phyerr = rxstatus->rs_status & ATH9K_RXERR_PHY; 997 /* 998 * Discard zero-length packets and packets smaller than an ACK 999 * which are not PHY_ERROR (short radar pulses have a length of 3) 1000 */ 1001 if (unlikely(!rs_datalen || (rs_datalen < 10 && !is_phyerr))) { 1002 ath_warn(common, 1003 "Short RX data len, dropping (dlen: %d)\n", 1004 rs_datalen); 1005 goto rx_next; 1006 } 1007 1008 /* Get the RX status information */ 1009 1010 memset(rx_status, 0, sizeof(struct ieee80211_rx_status)); 1011 1012 /* Copy everything from ath_htc_rx_status (HTC_RX_FRAME_HEADER). 1013 * After this, we can drop this part of skb. */ 1014 rx_status_htc_to_ath(&rx_stats, rxstatus); 1015 ath9k_htc_err_stat_rx(priv, &rx_stats); 1016 rx_status->mactime = be64_to_cpu(rxstatus->rs_tstamp); 1017 skb_pull(skb, HTC_RX_FRAME_HEADER_SIZE); 1018 1019 /* 1020 * everything but the rate is checked here, the rate check is done 1021 * separately to avoid doing two lookups for a rate for each frame. 1022 */ 1023 hdr = (struct ieee80211_hdr *)skb->data; 1024 1025 /* 1026 * Process PHY errors and return so that the packet 1027 * can be dropped. 1028 */ 1029 if (unlikely(is_phyerr)) { 1030 /* TODO: Not using DFS processing now. */ 1031 if (ath_cmn_process_fft(&priv->spec_priv, hdr, 1032 &rx_stats, rx_status->mactime)) { 1033 /* TODO: Code to collect spectral scan statistics */ 1034 } 1035 goto rx_next; 1036 } 1037 1038 if (!ath9k_cmn_rx_accept(common, hdr, rx_status, &rx_stats, 1039 &decrypt_error, priv->rxfilter)) 1040 goto rx_next; 1041 1042 ath9k_cmn_rx_skb_postprocess(common, skb, &rx_stats, 1043 rx_status, decrypt_error); 1044 1045 if (ath9k_cmn_process_rate(common, hw, &rx_stats, rx_status)) 1046 goto rx_next; 1047 1048 rx_stats.is_mybeacon = ath_is_mybeacon(common, hdr); 1049 ath9k_cmn_process_rssi(common, hw, &rx_stats, rx_status); 1050 1051 rx_status->band = ah->curchan->chan->band; 1052 rx_status->freq = ah->curchan->chan->center_freq; 1053 rx_status->antenna = rx_stats.rs_antenna; 1054 rx_status->flag |= RX_FLAG_MACTIME_END; 1055 1056 return true; 1057 rx_next: 1058 return false; 1059 } 1060 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] loongarch/cpu: Switch to arch_cpu_finalize_init()
by Hongchen Zhang 30 Mar '25

30 Mar '25

From: Thomas Gleixner <tglx(a)linutronix.de> mainline inclusion from mainline-v6.5-rc1 commit 9841c423164787feb8f1442f922b7d80a70c82f1 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBXCSJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- check_bugs() is about to be phased out. Switch over to the new arch_cpu_finalize_init() implementation. No functional change. Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Link: https://lore.kernel.org/r/20230613224545.195288218@linutronix.de Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> Signed-off-by: Juxin Gao <gaojuxin(a)loongson.cn> --- arch/loongarch/Kconfig | 1 + arch/loongarch/include/asm/bugs.h | 15 --------------- arch/loongarch/kernel/setup.c | 4 ++-- 3 files changed, 3 insertions(+), 17 deletions(-) delete mode 100644 arch/loongarch/include/asm/bugs.h diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig index 0b608275b4bb..ad5a6365dccb 100644 --- a/arch/loongarch/Kconfig +++ b/arch/loongarch/Kconfig @@ -10,6 +10,7 @@ config LOONGARCH select ARCH_ENABLE_MEMORY_HOTPLUG select ARCH_ENABLE_MEMORY_HOTREMOVE select ARCH_HAS_ACPI_TABLE_UPGRADE if ACPI + select ARCH_HAS_CPU_FINALIZE_INIT select ARCH_HAS_PHYS_TO_DMA select ARCH_HAS_PTE_SPECIAL select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST diff --git a/arch/loongarch/include/asm/bugs.h b/arch/loongarch/include/asm/bugs.h deleted file mode 100644 index 98396535163b..000000000000 --- a/arch/loongarch/include/asm/bugs.h +++ /dev/null @@ -1,15 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* - * This is included by init/main.c to check for architecture-dependent bugs. - * - * Copyright (C) 2020-2022 Loongson Technology Corporation Limited - */ -#ifndef _ASM_BUGS_H -#define _ASM_BUGS_H - -#include <asm/cpu.h> -#include <asm/cpu-info.h> - -extern void check_bugs(void); - -#endif /* _ASM_BUGS_H */ diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c index 5b6408296786..234bcbec6883 100644 --- a/arch/loongarch/kernel/setup.c +++ b/arch/loongarch/kernel/setup.c @@ -12,6 +12,7 @@ */ #include <linux/init.h> #include <linux/acpi.h> +#include <linux/cpu.h> #include <linux/dmi.h> #include <linux/efi.h> #include <linux/export.h> @@ -34,7 +35,6 @@ #include <asm/addrspace.h> #include <asm/alternative.h> #include <asm/bootinfo.h> -#include <asm/bugs.h> #include <asm/cache.h> #include <asm/cpu.h> #include <asm/dma.h> @@ -87,7 +87,7 @@ const char *get_system_type(void) return "generic-loongson-machine"; } -void __init check_bugs(void) +void __init arch_cpu_finalize_init(void) { alternative_instructions(); } -- 2.43.0

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 0e7e8faca7062a439fd0a56574c2c3860ceb2088
by kernel test robot 30 Mar '25

30 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 0e7e8faca7062a439fd0a56574c2c3860ceb2088 !15630 Fix CVE-2022-49553 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503292344.LYgqFDQe-lkp@intel.com drivers/gpu/drm/drm_atomic_helper.o: warning: objtool: drm_atomic_helper_commit_planes_on_crtc()+0x28b: unreachable instruction fs/notify/fanotify/fanotify.o: warning: objtool: fanotify_encode_fh()+0x1d6: unreachable instruction kernel/time/clocksource.o: warning: objtool: __clocksource_register_scale()+0x1c0: unreachable instruction Unverified Error/Warning (likely false positive, kindly check if interested): drivers/mtd/devices/mtd_dataflash.o: warning: objtool: dataflash_write() falls through to next function asan.module_ctor() sound/soc/fsl/fsl_easrc.o: warning: objtool: fsl_easrc_runtime_resume() falls through to next function asan.module_ctor() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-001-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-002-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-003-20250329 | |-- lib-gcc-aarch64-linux-..-plugin-include-config-elfos.h:warning:invalid-suffix-on-literal-C-requires-a-space-between-literal-and-string-macro | |-- lib-gcc-aarch64-linux-..-plugin-include-defaults.h:warning:invalid-suffix-on-literal-C-requires-a-space-between-literal-and-string-macro | |-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:field-call_clobbered-has-incomplete-type-pt_solution | |-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:field-call_used-has-incomplete-type-pt_solution | |-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:gimple_call_addr_fndecl-was-not-declared-in-this-scope | `-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:is_gimple_reg-was-not-declared-in-this-scope |-- x86_64-allnoconfig | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_file_name-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_log-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_HDD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CLEAR_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_ENABLE_MSIX-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_MASK_DISABLE-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_STATUS_EXIST_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_SSD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_mgrq_resend-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_notify-Werror-Wmissing-prototypes | `-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:error:unused-function-ps3_scsih_dev_id_get-Werror-Wunused-function |-- x86_64-buildonly-randconfig-001-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-002-20250329 | |-- arch-x86-kernel-paravirt.c:error:control-reaches-end-of-non-void-function | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-003-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-004-20250329 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-005-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-gpu-drm-drm_atomic_helper.o:warning:objtool:drm_atomic_helper_commit_planes_on_crtc:unreachable-instruction | |-- drivers-scsi-ufs-ufshcd.o:warning:objtool:ufshcd_queue_tmf:unreachable-instruction | |-- fs-notify-fanotify-fanotify.o:warning:objtool:fanotify_encode_fh:unreachable-instruction | |-- kernel-time-clocksource.o:warning:objtool:__clocksource_register_scale:unreachable-instruction | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-006-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-101-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-vmscan.o:warning:objtool:do_shrink_slab-falls-through-to-next-function-allow_direct_reclaim() | `-- sound-soc-fsl-fsl_easrc.o:warning:objtool:fsl_easrc_runtime_resume-falls-through-to-next-function-asanmodule_ctor() |-- x86_64-randconfig-102-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-103-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-video-fbdev-hyperv_fb.o:warning:objtool:synthvid_deferred_io-falls-through-to-next-function-hvfb_pci_stub_probe() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:bitmap_clear_bits-falls-through-to-next-function-free_bitmap() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- mm-vmscan.o:warning:objtool:do_shrink_slab-falls-through-to-next-function-allow_direct_reclaim() |-- x86_64-randconfig-104-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_thread_vid_cap_tick-falls-through-to-next-function-plane_vaddr() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-121-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-memcontrol.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__user-buffer | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-122-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-memcontrol.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__user-buffer | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-mtd-devices-mtd_dataflash.o:warning:objtool:dataflash_write-falls-through-to-next-function-asanmodule_ctor() | |-- drivers-nvdimm-namespace_devs.o:warning:objtool:size_store-falls-through-to-next-function-nd_namespace_label_update() | |-- fs-ufs-balloc.o:warning:objtool:ufs_free_fragments-falls-through-to-next-function-ufs_clusteracct() | |-- fs-ufs-ialloc.o:warning:objtool:ufs_new_inode-falls-through-to-next-function-ufs2_init_inodes_chunk() | |-- fs-ufs-inode.o:warning:objtool:ufs_iget-falls-through-to-next-function-ufs_set_inode_ops() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- x86_64-randconfig-161-20250329 |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_thread_vid_cap_tick-falls-through-to-next-function-plane_vaddr() |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory elapsed time: 1445m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250329 gcc-7.5.0 arm64 randconfig-002-20250329 gcc-9.5.0 arm64 randconfig-003-20250329 gcc-5.5.0 arm64 randconfig-004-20250329 gcc-5.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250329 clang-20 x86_64 buildonly-randconfig-002-20250329 gcc-12 x86_64 buildonly-randconfig-003-20250329 gcc-12 x86_64 buildonly-randconfig-004-20250329 clang-20 x86_64 buildonly-randconfig-005-20250329 clang-20 x86_64 buildonly-randconfig-006-20250329 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] kernel/trace/ring_buffer.o: warning: objtool: rb_get_reader_page()+0x4d2: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: ac59b83e5b01ef06262e927dc7207adf8553c823 [1531/1531] ring-buffer: Fix race between reset page and reading page config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503301602.HqBUoFWQ-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301602.HqBUoFWQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301602.HqBUoFWQ-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/trace/ring_buffer.c:5013:6: warning: variable 'cnt' set but not used [-Wunused-but-set-variable] 5013 | int cnt; | ^ 1 warning generated. kernel/trace/ring_buffer.c:1116: warning: Function parameter or member 'cpu_buffer' not described in 'rb_check_list' kernel/trace/ring_buffer.c:1116: warning: Function parameter or member 'list' not described in 'rb_check_list' kernel/trace/ring_buffer.c:1356: warning: Function parameter or member 'key' not described in '__ring_buffer_alloc' kernel/trace/ring_buffer.c:2329: warning: Function parameter or member 'cpu_buffer' not described in 'rb_update_event' kernel/trace/ring_buffer.c:2329: warning: Function parameter or member 'info' not described in 'rb_update_event' kernel/trace/ring_buffer.c:2329: warning: Excess function parameter 'type' description in 'rb_update_event' kernel/trace/ring_buffer.c:2329: warning: Excess function parameter 'length' description in 'rb_update_event' kernel/trace/ring_buffer.c:4381: warning: Function parameter or member 'cpu' not described in 'ring_buffer_size' kernel/trace/ring_buffer.c:4560: warning: Function parameter or member 'cpu' not described in 'ring_buffer_swap_cpu' >> kernel/trace/ring_buffer.o: warning: objtool: rb_get_reader_page()+0x4d2: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION f030d5397b5940b1ca4edfc8a40b53c553814b40
by kernel test robot 30 Mar '25

30 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f030d5397b5940b1ca4edfc8a40b53c553814b40 !15686 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.76-6.6.78 LTS Patches Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-virtcca_get_tmi_version | |-- drivers-coda-coda_pci.c:warning:Excess-function-parameter-pdev-description-in-virtcca_pci_get_rom_size | |-- drivers-coda-coda_pci.c:warning:Function-parameter-or-member-p-not-described-in-virtcca_pci_get_rom_size | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_DRBG_CTR-when-selected-by-CRYPTO_DEV_HISI_TRNG | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-defconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-001-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-002-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allmodconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allnoconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allyesconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-defconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-001-20250329 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-002-20250329 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allyesconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250329 | |-- drivers-gpu-drm-sti-sti_dvo.c:error:implicit-declaration-of-function-devm_ioremap | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250329 | |-- drivers-gpu-drm-sti-sti_dvo.c:error:implicit-declaration-of-function-devm_ioremap | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size |-- x86_64-randconfig-101-20250330 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-102-20250330 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-103-20250330 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-104-20250330 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-121-20250330 | |-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:sparse:sparse:symbol-tdm_service_exit-was-not-declared.-Should-it-be-static | |-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:sparse:sparse:symbol-tdm_service_run-was-not-declared.-Should-it-be-static | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-122-20250330 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-123-20250330 | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used `-- x86_64-randconfig-161-20250329 |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used `-- mm-mm_init.c-deferred_init_mem_pfn_range_in_zone()-warn:iterator-j-not-incremented elapsed time: 1446m configs tested: 21 configs skipped: 124 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250329 gcc-7.5.0 arm64 randconfig-002-20250329 gcc-9.5.0 arm64 randconfig-003-20250329 gcc-5.5.0 arm64 randconfig-004-20250329 gcc-5.5.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250329 gcc-14.2.0 loongarch randconfig-002-20250329 gcc-14.2.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250329 clang-20 x86_64 buildonly-randconfig-002-20250329 gcc-12 x86_64 buildonly-randconfig-003-20250329 gcc-12 x86_64 buildonly-randconfig-004-20250329 clang-20 x86_64 buildonly-randconfig-005-20250329 clang-20 x86_64 buildonly-randconfig-006-20250329 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] drivers/dax/bus.o: warning: objtool: __dax_driver_register()+0xd5: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

Hi Dan, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: 9bb67bd58e6a7e3ef00793b4966be7bb0a346830 [1531/1531] Intel: device-dax: Add support for a dax override driver config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503301315.o2E2dF19-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301315.o2E2dF19-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301315.o2E2dF19-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/dax/bus.o: warning: objtool: __dax_driver_register()+0xd5: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] block/blk-mq.o: warning: objtool: blk_mq_unfreeze_queue()+0x75: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: cbd9fe6e727ed12c1e542f74514e6dd4419f1cf6 [1531/1531] blk-mq: fix hang caused by freeze/unfreeze sequence config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503301024.26J3J3nq-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301024.26J3J3nq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301024.26J3J3nq-lkp@intel.com/ All warnings (new ones prefixed by >>): block/blk-mq.c:600:44: warning: passing 8-byte aligned argument to 32-byte aligned parameter 2 of 'smp_call_function_single_async' may result in an unaligned pointer access [-Walign-mismatch] 600 | smp_call_function_single_async(ctx->cpu, &rq->csd); | ^ 1 warning generated. >> block/blk-mq.o: warning: objtool: blk_mq_unfreeze_queue()+0x75: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] drivers/xen/events/events_base.o: warning: objtool: xen_test_irq_shared()+0xe1: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: fc0f59c16e93291923fcebd942b78c9bddfecc56 [1531/1531] xen/events: avoid removing an event channel while handling it config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503300608.WYcT007F-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503300608.WYcT007F-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503300608.WYcT007F-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/xen/events/events_base.c:1697:6: warning: no previous prototype for function 'xen_callback_vector' [-Wmissing-prototypes] 1697 | void xen_callback_vector(void) {} | ^ drivers/xen/events/events_base.c:1697:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1697 | void xen_callback_vector(void) {} | ^ | static 1 warning generated. >> drivers/xen/events/events_base.o: warning: objtool: xen_test_irq_shared()+0xe1: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2827/2827] kernel/time/clocksource.o: warning: objtool: __clocksource_register_scale()+0x1c0: unreachable instruction
by kernel test robot 29 Mar '25

29 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0e7e8faca7062a439fd0a56574c2c3860ceb2088 commit: 3e04146d67272c65eef5abc5a60c04cf8529ec71 [2827/2827] time: Add mechanism to recognize clocksource in time_get_snapshot config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250329/202503292344.LYgqFDQe-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250329/202503292344.LYgqFDQe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503292344.LYgqFDQe-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/time/clocksource.o: warning: objtool: __clocksource_register_scale()+0x1c0: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0