- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/4] CVE-2024-53173
by Li Lingfeng 31 Dec '24

31 Dec '24

Li Lingfeng (2): Revert "nfs: fix rpc_task use-after-free when open and close different files concurrently" Revert "NFSv4: release seqid when open failed for nfs4.0" Trond Myklebust (2): NFSv4.0: Fix the wake up of the next waiter in nfs_release_seqid() NFSv4.0: Fix a use-after-free problem in the asynchronous open() fs/nfs/nfs4_fs.h | 1 - fs/nfs/nfs4proc.c | 12 ++++++------ fs/nfs/nfs4state.c | 28 ++++------------------------ 3 files changed, 10 insertions(+), 31 deletions(-) -- 2.31.1

2 5

[PATCH OLK-5.10 0/4] CVE-2024-53173
by Li Lingfeng 31 Dec '24

31 Dec '24

Li Lingfeng (2): Revert "nfs: fix rpc_task use-after-free when open and close different files concurrently" Revert "NFSv4: release seqid when open failed for nfs4.0" Trond Myklebust (2): NFSv4.0: Fix the wake up of the next waiter in nfs_release_seqid() NFSv4.0: Fix a use-after-free problem in the asynchronous open() fs/nfs/nfs4_fs.h | 1 - fs/nfs/nfs4proc.c | 12 ++++++------ fs/nfs/nfs4state.c | 28 ++++------------------------ 3 files changed, 10 insertions(+), 31 deletions(-) -- 2.31.1

2 5

[PATCH OLK-6.6 0/2] LoongArch: compile loongson drm driver as module
by Hongchen Zhang 31 Dec '24

31 Dec '24

Hongchen Zhang (2): LoongArch: cleanup loongson3 defconfig drm/loongson: compile loongson drm driver as module arch/loongarch/configs/loongson3_defconfig | 13 ++++++------- drivers/gpu/drm/Makefile | 2 +- 2 files changed, 7 insertions(+), 8 deletions(-) -- 2.33.0

2 3

[openeuler:OLK-5.10 2610/2610] mm/vmscan.c:3467: undefined reference to `kernel_swap_enabled'
by kernel test robot 31 Dec '24

31 Dec '24

Hi liubo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8bba4b17284e774544bd01d9ea5190546e93a849 commit: 79c68ab3280fab8ace1b10bf8eadce508ee89c3c [2610/2610] etmem: add original kernel swap enabled options config: x86_64-randconfig-161-20241231 (https://download.01.org/0day-ci/archive/20241231/202412310947.msuqFyrV-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241231/202412310947.msuqFyrV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412310947.msuqFyrV-lkp@intel.com/ All errors (new ones prefixed by >>): ld: warning: arch/x86/lib/retpoline.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: arch/x86/lib/retpoline.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: .tmp_vmlinux.kallsyms1 has a LOAD segment with RWX permissions ld: mm/vmscan.o: in function `kernel_swap_check': >> mm/vmscan.c:3467: undefined reference to `kernel_swap_enabled' >> ld: mm/vmscan.c:3467: undefined reference to `kernel_swap_enabled' Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] vim +3467 mm/vmscan.c 3459 3460 #ifdef CONFIG_ETMEM 3461 /* 3462 * Check if original kernel swap is enabled 3463 * turn off kernel swap,but leave page cache reclaim on 3464 */ 3465 static inline void kernel_swap_check(struct scan_control *sc) 3466 { > 3467 if (sc != NULL && !kernel_swap_enabled()) 3468 sc->may_swap = 0; 3469 } 3470 #endif 3471 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2024-53197
by Tengda Wu 31 Dec '24

31 Dec '24

Fix CVE-2024-53197. Benoît Sevens (1): ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices Dan Carpenter (1): ALSA: usb-audio: Fix a DMA to stack memory bug sound/usb/quirks.c | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2024-53197
by Tengda Wu 31 Dec '24

31 Dec '24

Fix CVE-2024-53197. Benoît Sevens (1): ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices Dan Carpenter (1): ALSA: usb-audio: Fix a DMA to stack memory bug sound/usb/quirks.c | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-) -- 2.34.1

1 0

[openeuler:openEuler-1.0-LTS 1359/1359] drivers/crypto/zhaoxin-sha.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 31 Dec '24

31 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4dc4cec05b40921a3db85d24f97f1142272e4abf commit: 0f74c26725b8cd5e9b968081850c0303a9fc9137 [1359/1359] crypto: Add Zhaoxin ACE driver config: x86_64-buildonly-randconfig-004-20241231 (https://download.01.org/0day-ci/archive/20241231/202412310854.WcNZPiL8-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241231/202412310854.WcNZPiL8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412310854.WcNZPiL8-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/zhaoxin-sha.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1359/1359] block/blk-io-hierarchy/debugfs.c:63:2: error: implicit declaration of function 'hierarchy_show_slow_io'
by kernel test robot 31 Dec '24

31 Dec '24

Hi Yu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4dc4cec05b40921a3db85d24f97f1142272e4abf commit: b2f723aef027af0f194ff0c9f53f8ae6a7cb7de3 [1359/1359] blk-io-hierarchy: support to recored the number of slow IO config: x86_64-buildonly-randconfig-001-20241231 (https://download.01.org/0day-ci/archive/20241231/202412310605.VXvJcPMm-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241231/202412310605.VXvJcPMm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412310605.VXvJcPMm-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from block/blk-io-hierarchy/debugfs.c:15: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> block/blk-io-hierarchy/debugfs.c:63:2: error: implicit declaration of function 'hierarchy_show_slow_io' [-Werror,-Wimplicit-function-declaration] 63 | hierarchy_show_slow_io(hstats_data, m); | ^ block/blk-io-hierarchy/debugfs.c:63:2: note: did you mean 'hierarchy_account_slow_io'? block/blk-io-hierarchy/iodump.h:85:1: note: 'hierarchy_account_slow_io' declared here 85 | hierarchy_account_slow_io(struct hierarchy_stage *hstage, | ^ 1 warning and 1 error generated. vim +/hierarchy_show_slow_io +63 block/blk-io-hierarchy/debugfs.c 28 29 static int __hierarchy_stats_show(struct hierarchy_stats_data *hstats_data, 30 struct seq_file *m, enum stage_group stage) 31 { 32 u64 dispatched[NR_NEW_STAT_GROUPS] = {0}; 33 u64 completed[NR_NEW_STAT_GROUPS] = {0}; 34 u64 latency[NR_NEW_STAT_GROUPS] = {0}; 35 int cpu; 36 int i; 37 38 for_each_possible_cpu(cpu) { 39 struct hierarchy_stats *stat = 40 per_cpu_ptr(hstats_data->hstats, cpu); 41 42 for (i = 0; i < NR_NEW_STAT_GROUPS; ++i) { 43 dispatched[i] += stat->dispatched[i]; 44 completed[i] += stat->completed[i]; 45 latency[i] += stage_is_rq(stage) ? 46 stat->jiffies[i] : stat->nsecs[i]; 47 } 48 } 49 50 if (stage_is_rq(stage)) 51 for (i = 0; i < NR_NEW_STAT_GROUPS; ++i) 52 latency[i] = 53 jiffies_to_msecs(latency[i]) * NSEC_PER_MSEC; 54 55 seq_printf(m, "%llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu", 56 dispatched[STAT_READ], completed[STAT_READ], 57 latency[STAT_READ], dispatched[STAT_WRITE], 58 completed[STAT_WRITE], latency[STAT_WRITE], 59 dispatched[STAT_DISCARD], completed[STAT_DISCARD], 60 latency[STAT_DISCARD], dispatched[STAT_FLUSH], 61 completed[STAT_FLUSH], latency[STAT_FLUSH]); 62 > 63 hierarchy_show_slow_io(hstats_data, m); 64 seq_putc(m, '\n'); 65 return 0; 66 } 67 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2610/2610] fs/cachefiles/xattr.c:221:5: warning: no previous prototype for 'cachefiles_check_old_object_xattr'
by kernel test robot 31 Dec '24

31 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8bba4b17284e774544bd01d9ea5190546e93a849 commit: 62cbbf255badab153207e0a54d04da8c345ae307 [2610/2610] cachefiles: use mainline xattr in ondemand mode config: arm64-randconfig-004-20241230 (https://download.01.org/0day-ci/archive/20241231/202412310612.ETObn9wZ-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241231/202412310612.ETObn9wZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412310612.ETObn9wZ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/cachefiles/xattr.c:221:5: warning: no previous prototype for 'cachefiles_check_old_object_xattr' [-Wmissing-prototypes] 221 | int cachefiles_check_old_object_xattr(struct cachefiles_object *object, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/cachefiles_check_old_object_xattr +221 fs/cachefiles/xattr.c 220 > 221 int cachefiles_check_old_object_xattr(struct cachefiles_object *object, 222 struct cachefiles_xattr *auxdata) 223 { 224 struct cachefiles_xattr *auxbuf; 225 unsigned int len = sizeof(struct cachefiles_xattr) + 512; 226 struct dentry *dentry = object->dentry; 227 int ret; 228 229 auxbuf = kmalloc(len, cachefiles_gfp); 230 if (!auxbuf) 231 return -ENOMEM; 232 233 /* read the current type label */ 234 ret = vfs_getxattr(dentry, cachefiles_xattr_cache, 235 &auxbuf->type, 512 + 1); 236 if (ret < 0) 237 goto error; 238 239 /* check the on-disk object */ 240 if (ret < 1) { 241 pr_err("Cache object %lu xattr length incorrect\n", 242 d_backing_inode(dentry)->i_ino); 243 goto stale; 244 } 245 246 if (auxbuf->type != auxdata->type) 247 goto stale; 248 249 auxbuf->len = ret; 250 251 /* consult the netfs */ 252 if (object->fscache.cookie->def->check_aux) { 253 enum fscache_checkaux result; 254 unsigned int dlen; 255 256 dlen = auxbuf->len - 1; 257 258 _debug("checkaux %s #%u", 259 object->fscache.cookie->def->name, dlen); 260 261 result = fscache_check_aux(&object->fscache, 262 &auxbuf->data, dlen, 263 i_size_read(d_backing_inode(dentry))); 264 265 switch (result) { 266 /* entry okay as is */ 267 case FSCACHE_CHECKAUX_OKAY: 268 goto okay; 269 270 /* entry requires update */ 271 case FSCACHE_CHECKAUX_NEEDS_UPDATE: 272 break; 273 274 /* entry requires deletion */ 275 case FSCACHE_CHECKAUX_OBSOLETE: 276 goto stale; 277 278 default: 279 BUG(); 280 } 281 282 /* update the current label */ 283 ret = vfs_setxattr(dentry, cachefiles_xattr_cache, 284 &auxdata->type, auxdata->len, 285 XATTR_REPLACE); 286 if (ret < 0) { 287 cachefiles_io_error_obj(object, 288 "Can't update xattr on %lu" 289 " (error %d)", 290 d_backing_inode(dentry)->i_ino, -ret); 291 goto error; 292 } 293 } 294 295 okay: 296 ret = 0; 297 298 error: 299 kfree(auxbuf); 300 return ret; 301 302 stale: 303 ret = -ESTALE; 304 goto error; 305 } 306 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2610/2610] fs/cachefiles/xattr.c:221:5: warning: no previous prototype for function 'cachefiles_check_old_object_xattr'
by kernel test robot 31 Dec '24

31 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8bba4b17284e774544bd01d9ea5190546e93a849 commit: 62cbbf255badab153207e0a54d04da8c345ae307 [2610/2610] cachefiles: use mainline xattr in ondemand mode config: x86_64-buildonly-randconfig-001-20241230 (https://download.01.org/0day-ci/archive/20241231/202412310541.8ZI8Il3W-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241231/202412310541.8ZI8Il3W-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412310541.8ZI8Il3W-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from fs/cachefiles/xattr.c:12: In file included from include/linux/fsnotify.h:16: In file included from include/linux/audit.h:13: In file included from include/linux/ptrace.h:10: In file included from include/linux/pid_namespace.h:7: In file included from include/linux/mm.h:1587: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> fs/cachefiles/xattr.c:221:5: warning: no previous prototype for function 'cachefiles_check_old_object_xattr' [-Wmissing-prototypes] 221 | int cachefiles_check_old_object_xattr(struct cachefiles_object *object, | ^ fs/cachefiles/xattr.c:221:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 221 | int cachefiles_check_old_object_xattr(struct cachefiles_object *object, | ^ | static 2 warnings generated. vim +/cachefiles_check_old_object_xattr +221 fs/cachefiles/xattr.c 220 > 221 int cachefiles_check_old_object_xattr(struct cachefiles_object *object, 222 struct cachefiles_xattr *auxdata) 223 { 224 struct cachefiles_xattr *auxbuf; 225 unsigned int len = sizeof(struct cachefiles_xattr) + 512; 226 struct dentry *dentry = object->dentry; 227 int ret; 228 229 auxbuf = kmalloc(len, cachefiles_gfp); 230 if (!auxbuf) 231 return -ENOMEM; 232 233 /* read the current type label */ 234 ret = vfs_getxattr(dentry, cachefiles_xattr_cache, 235 &auxbuf->type, 512 + 1); 236 if (ret < 0) 237 goto error; 238 239 /* check the on-disk object */ 240 if (ret < 1) { 241 pr_err("Cache object %lu xattr length incorrect\n", 242 d_backing_inode(dentry)->i_ino); 243 goto stale; 244 } 245 246 if (auxbuf->type != auxdata->type) 247 goto stale; 248 249 auxbuf->len = ret; 250 251 /* consult the netfs */ 252 if (object->fscache.cookie->def->check_aux) { 253 enum fscache_checkaux result; 254 unsigned int dlen; 255 256 dlen = auxbuf->len - 1; 257 258 _debug("checkaux %s #%u", 259 object->fscache.cookie->def->name, dlen); 260 261 result = fscache_check_aux(&object->fscache, 262 &auxbuf->data, dlen, 263 i_size_read(d_backing_inode(dentry))); 264 265 switch (result) { 266 /* entry okay as is */ 267 case FSCACHE_CHECKAUX_OKAY: 268 goto okay; 269 270 /* entry requires update */ 271 case FSCACHE_CHECKAUX_NEEDS_UPDATE: 272 break; 273 274 /* entry requires deletion */ 275 case FSCACHE_CHECKAUX_OBSOLETE: 276 goto stale; 277 278 default: 279 BUG(); 280 } 281 282 /* update the current label */ 283 ret = vfs_setxattr(dentry, cachefiles_xattr_cache, 284 &auxdata->type, auxdata->len, 285 XATTR_REPLACE); 286 if (ret < 0) { 287 cachefiles_io_error_obj(object, 288 "Can't update xattr on %lu" 289 " (error %d)", 290 d_backing_inode(dentry)->i_ino, -ret); 291 goto error; 292 } 293 } 294 295 okay: 296 ret = 0; 297 298 error: 299 kfree(auxbuf); 300 return ret; 301 302 stale: 303 ret = -ESTALE; 304 goto error; 305 } 306 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1359/1359] drivers/char/hw_random/phytium-rng.c:137:34: warning: unused variable 'phytium_rng_dt_ids'
by kernel test robot 31 Dec '24

31 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4dc4cec05b40921a3db85d24f97f1142272e4abf commit: 6e2d2a4f494efda1e565c42a8eb2be504e6d45f0 [1359/1359] hwrng: Add support for Phytium SoC RNG config: x86_64-buildonly-randconfig-001-20241231 (https://download.01.org/0day-ci/archive/20241231/202412310450.eTlMnKbi-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241231/202412310450.eTlMnKbi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412310450.eTlMnKbi-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/char/hw_random/phytium-rng.c:137:34: warning: unused variable 'phytium_rng_dt_ids' [-Wunused-const-variable] 137 | static const struct of_device_id phytium_rng_dt_ids[] = { | ^~~~~~~~~~~~~~~~~~ 1 warning generated. vim +/phytium_rng_dt_ids +137 drivers/char/hw_random/phytium-rng.c 136 > 137 static const struct of_device_id phytium_rng_dt_ids[] = { 138 { .compatible = "phytium,rng" }, 139 { } 140 }; 141 MODULE_DEVICE_TABLE(of, phytium_rng_dt_ids); 142 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2610/2610] fs/cachefiles/rdwr.c:860:6: warning: no previous prototype for 'cachefiles_readpages_work_func'
by kernel test robot 31 Dec '24

31 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8bba4b17284e774544bd01d9ea5190546e93a849 commit: 33ba25cc4869bab81ad31784e7bbb25e5da2a2ad [2610/2610] anolis: fscache,cachefiles: add fscache_prepare_read() helper config: arm64-randconfig-004-20241230 (https://download.01.org/0day-ci/archive/20241231/202412310433.hkwF4RYM-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241231/202412310433.hkwF4RYM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412310433.hkwF4RYM-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/cachefiles/rdwr.c:860:6: warning: no previous prototype for 'cachefiles_readpages_work_func' [-Wmissing-prototypes] 860 | void cachefiles_readpages_work_func(struct work_struct *work) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/cachefiles_readpages_work_func +860 fs/cachefiles/rdwr.c 859 > 860 void cachefiles_readpages_work_func(struct work_struct *work) 861 { 862 struct cachefiles_kiocb *ki = container_of(work, struct cachefiles_kiocb, work); 863 int ret; 864 865 ret = vfs_iocb_iter_read(ki->iocb.ki_filp, &ki->iocb, &ki->iter); 866 /* complete the request if there's any progress or error occurred */ 867 if (ret != -EIOCBQUEUED) { 868 struct fscache_retrieval *op = ki->op; 869 unsigned int nr_pages = atomic_read(&op->n_pages); 870 unsigned int done_pages = 0; 871 int i, error; 872 873 if (ret > 0) 874 done_pages = ret / PAGE_SIZE; 875 876 for (i = 0; i < nr_pages; i++) { 877 error = i < done_pages ? 0 : -EIO; 878 fscache_end_io(op, ki->bvs[i].bv_page, error); 879 } 880 881 fscache_retrieval_complete(op, nr_pages); 882 fscache_put_retrieval(op); 883 kfree(ki); 884 } 885 } 886 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1356/1356] ERROR: "netlink_kernel_release" [fs/ext4/ext4.ko] undefined!
by kernel test robot 31 Dec '24

31 Dec '24

Hi Zhao, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4dc4cec05b40921a3db85d24f97f1142272e4abf commit: 6636f4434a9c5c9c645694db206188ee5a6626dd [1356/1356] ext4: report error to userspace by netlink config: x86_64-buildonly-randconfig-003-20241228 (https://download.01.org/0day-ci/archive/20241231/202412310428.apoNWdMg-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241231/202412310428.apoNWdMg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412310428.apoNWdMg-lkp@intel.com/ All errors (new ones prefixed by >>): >> ERROR: "netlink_kernel_release" [fs/ext4/ext4.ko] undefined! >> ERROR: "init_net" [fs/ext4/ext4.ko] undefined! >> ERROR: "__alloc_skb" [fs/ext4/ext4.ko] undefined! >> ERROR: "netlink_broadcast" [fs/ext4/ext4.ko] undefined! >> ERROR: "kfree_skb" [fs/ext4/ext4.ko] undefined! >> ERROR: "__netlink_kernel_create" [fs/ext4/ext4.ko] undefined! >> ERROR: "__nlmsg_put" [fs/ext4/ext4.ko] undefined! -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2610/2610] fs/cachefiles/rdwr.c:860:6: warning: no previous prototype for function 'cachefiles_readpages_work_func'
by kernel test robot 31 Dec '24

31 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8bba4b17284e774544bd01d9ea5190546e93a849 commit: 33ba25cc4869bab81ad31784e7bbb25e5da2a2ad [2610/2610] anolis: fscache,cachefiles: add fscache_prepare_read() helper config: x86_64-buildonly-randconfig-001-20241230 (https://download.01.org/0day-ci/archive/20241231/202412310255.QS4rGSOC-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241231/202412310255.QS4rGSOC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412310255.QS4rGSOC-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from fs/cachefiles/rdwr.c:11: In file included from include/linux/swap.h:10: In file included from include/linux/memcontrol.h:13: In file included from include/linux/cgroup.h:28: In file included from include/linux/cgroup-defs.h:22: In file included from include/linux/bpf-cgroup.h:5: In file included from include/linux/bpf.h:21: In file included from include/linux/kallsyms.h:12: In file included from include/linux/mm.h:1587: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> fs/cachefiles/rdwr.c:860:6: warning: no previous prototype for function 'cachefiles_readpages_work_func' [-Wmissing-prototypes] 860 | void cachefiles_readpages_work_func(struct work_struct *work) | ^ fs/cachefiles/rdwr.c:860:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 860 | void cachefiles_readpages_work_func(struct work_struct *work) | ^ | static 2 warnings generated. vim +/cachefiles_readpages_work_func +860 fs/cachefiles/rdwr.c 859 > 860 void cachefiles_readpages_work_func(struct work_struct *work) 861 { 862 struct cachefiles_kiocb *ki = container_of(work, struct cachefiles_kiocb, work); 863 int ret; 864 865 ret = vfs_iocb_iter_read(ki->iocb.ki_filp, &ki->iocb, &ki->iter); 866 /* complete the request if there's any progress or error occurred */ 867 if (ret != -EIOCBQUEUED) { 868 struct fscache_retrieval *op = ki->op; 869 unsigned int nr_pages = atomic_read(&op->n_pages); 870 unsigned int done_pages = 0; 871 int i, error; 872 873 if (ret > 0) 874 done_pages = ret / PAGE_SIZE; 875 876 for (i = 0; i < nr_pages; i++) { 877 error = i < done_pages ? 0 : -EIO; 878 fscache_end_io(op, ki->bvs[i].bv_page, error); 879 } 880 881 fscache_retrieval_complete(op, nr_pages); 882 fscache_put_retrieval(op); 883 kfree(ki); 884 } 885 } 886 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2610/2610] fs/cachefiles/ondemand.c:23:25: warning: implicit conversion from 'enum cachefiles_obj_ref_trace' to 'enum fscache_obj_ref_trace'
by kernel test robot 31 Dec '24

31 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8bba4b17284e774544bd01d9ea5190546e93a849 commit: 2937cd5f8c58bd8e7895f6b2698057721442248e [2610/2610] cachefiles: notify the user daemon when looking up cookie config: arm64-randconfig-004-20241230 (https://download.01.org/0day-ci/archive/20241231/202412310256.l8FuLcbO-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241231/202412310256.l8FuLcbO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412310256.l8FuLcbO-lkp@intel.com/ All warnings (new ones prefixed by >>): fs/cachefiles/ondemand.c: In function 'cachefiles_ondemand_fd_release': >> fs/cachefiles/ondemand.c:23:25: warning: implicit conversion from 'enum cachefiles_obj_ref_trace' to 'enum fscache_obj_ref_trace' [-Wenum-conversion] 23 | cachefiles_obj_put_ondemand_fd); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/cachefiles/ondemand.c: In function 'cachefiles_ondemand_get_fd': fs/cachefiles/ondemand.c:145:25: warning: implicit conversion from 'enum cachefiles_obj_ref_trace' to 'enum fscache_obj_ref_trace' [-Wenum-conversion] 145 | cachefiles_obj_get_ondemand_fd) ? 0 : -EAGAIN; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/cachefiles/ondemand.c:191:25: warning: implicit conversion from 'enum cachefiles_obj_ref_trace' to 'enum fscache_obj_ref_trace' [-Wenum-conversion] 191 | cachefiles_obj_put_ondemand_fd); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +23 fs/cachefiles/ondemand.c 7 8 static int cachefiles_ondemand_fd_release(struct inode *inode, 9 struct file *file) 10 { 11 struct cachefiles_object *object = file->private_data; 12 int object_id = object->ondemand_id; 13 struct cachefiles_cache *cache; 14 15 cache = container_of(object->fscache.cache, 16 struct cachefiles_cache, cache); 17 18 object->ondemand_id = CACHEFILES_ONDEMAND_ID_CLOSED; 19 xa_lock(&cache->ondemand_ids.idr_rt); 20 idr_remove(&cache->ondemand_ids, object_id); 21 xa_unlock(&cache->ondemand_ids.idr_rt); 22 object->fscache.cache->ops->put_object(&object->fscache, > 23 cachefiles_obj_put_ondemand_fd); 24 return 0; 25 } 26 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1673/1673] arch/x86/kvm/svm/csv.c:129:52: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 31 Dec '24

31 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 5672a2cb8a45de45872d2dd25d3dd94348c070eb commit: 07a18fb6c71ef75cc1205999cd2493b567649466 [1673/1673] KVM: SVM: Prepare memory pool to allocate buffers for KVM_CSV_COMMAND_BATCH config: x86_64-randconfig-121-20241230 (https://download.01.org/0day-ci/archive/20241231/202412310023.KFzowK2B-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241231/202412310023.KFzowK2B-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412310023.KFzowK2B-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/x86/kvm/svm/csv.c:53:5: sparse: sparse: symbol 'csv_vm_attestation' was not declared. Should it be static? >> arch/x86/kvm/svm/csv.c:129:52: sparse: sparse: Using plain integer as NULL pointer >> arch/x86/kvm/svm/csv.c:129:6: sparse: sparse: symbol 'g_trans_mempool' was not declared. Should it be static? vim +129 arch/x86/kvm/svm/csv.c 127 128 static size_t g_mempool_offset; > 129 void *g_trans_mempool[TRANS_MEMPOOL_BLOCK_NUM] = { 0, }; 130 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1673/1673] arch/x86/kvm/svm/csv.c:30:5: sparse: sparse: symbol 'csv_vm_attestation' was not declared. Should it be static?
by kernel test robot 30 Dec '24

30 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 8fc6624288123b0750ac5164020e637b70f1de2b commit: 0f13b8634792cff1f2fb18bf35e5a24d7a8cbf8e [1673/1673] KVM: x86: Support VM_ATTESTATION hypercall config: x86_64-randconfig-121-20241230 (https://download.01.org/0day-ci/archive/20241230/202412302222.H5YbllyE-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241230/202412302222.H5YbllyE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412302222.H5YbllyE-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/x86/kvm/svm/csv.c:30:5: sparse: sparse: symbol 'csv_vm_attestation' was not declared. Should it be static? vim +/csv_vm_attestation +30 arch/x86/kvm/svm/csv.c 29 > 30 int csv_vm_attestation(struct kvm *kvm, unsigned long gpa, unsigned long len) 31 { 32 struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info; 33 struct sev_data_attestation_report *data = NULL; 34 struct page **pages; 35 unsigned long guest_uaddr, n; 36 int ret = 0, offset, error; 37 38 if (!sev_guest(kvm) || !hygon_kvm_hooks.sev_hooks_installed) 39 return -ENOTTY; 40 41 /* 42 * The physical address of guest must valid and page aligned, and 43 * the length of guest memory region must be page size aligned. 44 */ 45 if (!gpa || (gpa & ~PAGE_MASK) || (len & ~PAGE_MASK)) { 46 pr_err("invalid guest address or length\n"); 47 return -EFAULT; 48 } 49 50 guest_uaddr = gfn_to_hva(kvm, gpa_to_gfn(gpa)); 51 pages = hygon_kvm_hooks.sev_pin_memory(kvm, guest_uaddr, len, &n, 1); 52 if (IS_ERR(pages)) 53 return PTR_ERR(pages); 54 55 /* 56 * The attestation report must be copied into contiguous memory region, 57 * lets verify that userspace memory pages are contiguous before we 58 * issue commmand. 59 */ 60 if (hygon_kvm_hooks.get_num_contig_pages(0, pages, n) != n) { 61 ret = -EINVAL; 62 goto e_unpin_memory; 63 } 64 65 ret = -ENOMEM; 66 data = kzalloc(sizeof(*data), GFP_KERNEL); 67 if (!data) 68 goto e_unpin_memory; 69 70 /* csv_vm_mnonce indicates attestation request from guest */ 71 if (sizeof(csv_vm_mnonce) >= sizeof(data->mnonce)) { 72 ret = -EINVAL; 73 goto e_free; 74 } 75 76 memcpy(data->mnonce, csv_vm_mnonce, sizeof(csv_vm_mnonce)); 77 78 offset = guest_uaddr & (PAGE_SIZE - 1); 79 data->address = __sme_page_pa(pages[0]) + offset; 80 data->len = len; 81 82 data->handle = sev->handle; 83 ret = hygon_kvm_hooks.sev_issue_cmd(kvm, SEV_CMD_ATTESTATION_REPORT, 84 data, &error); 85 86 if (ret) 87 pr_err("vm attestation ret %#x, error %#x\n", ret, error); 88 89 e_free: 90 kfree(data); 91 e_unpin_memory: 92 hygon_kvm_hooks.sev_unpin_memory(kvm, pages, n); 93 return ret; 94 } 95 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] media: imx-jpeg: Ensure power suppliers be suspended before detach them
by Li Huafei 30 Dec '24

30 Dec '24

From: Ming Qian <ming.qian(a)nxp.com> stable inclusion from stable-v6.6.64 commit b7a830bbc25da0f641e3ef2bac3b1766b2777a8b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANC CVE: CVE-2024-56575 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fd0af4cd35da0eb550ef682b71cda70a4e36f6b9 upstream. The power suppliers are always requested to suspend asynchronously, dev_pm_domain_detach() requires the caller to ensure proper synchronization of this function with power management callbacks. otherwise the detach may led to kernel panic, like below: [ 1457.107934] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000040 [ 1457.116777] Mem abort info: [ 1457.119589] ESR = 0x0000000096000004 [ 1457.123358] EC = 0x25: DABT (current EL), IL = 32 bits [ 1457.128692] SET = 0, FnV = 0 [ 1457.131764] EA = 0, S1PTW = 0 [ 1457.134920] FSC = 0x04: level 0 translation fault [ 1457.139812] Data abort info: [ 1457.142707] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 1457.148196] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 1457.153256] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1457.158563] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001138b6000 [ 1457.165000] [0000000000000040] pgd=0000000000000000, p4d=0000000000000000 [ 1457.171792] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 1457.178045] Modules linked in: v4l2_jpeg wave6_vpu_ctrl(-) [last unloaded: mxc_jpeg_encdec] [ 1457.186383] CPU: 0 PID: 51938 Comm: kworker/0:3 Not tainted 6.6.36-gd23d64eea511 #66 [ 1457.194112] Hardware name: NXP i.MX95 19X19 board (DT) [ 1457.199236] Workqueue: pm pm_runtime_work [ 1457.203247] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1457.210188] pc : genpd_runtime_suspend+0x20/0x290 [ 1457.214886] lr : __rpm_callback+0x48/0x1d8 [ 1457.218968] sp : ffff80008250bc50 [ 1457.222270] x29: ffff80008250bc50 x28: 0000000000000000 x27: 0000000000000000 [ 1457.229394] x26: 0000000000000000 x25: 0000000000000008 x24: 00000000000f4240 [ 1457.236518] x23: 0000000000000000 x22: ffff00008590f0e4 x21: 0000000000000008 [ 1457.243642] x20: ffff80008099c434 x19: ffff00008590f000 x18: ffffffffffffffff [ 1457.250766] x17: 5300326563697665 x16: 645f676e696c6f6f x15: 63343a6d726f6674 [ 1457.257890] x14: 0000000000000004 x13: 00000000000003a4 x12: 0000000000000002 [ 1457.265014] x11: 0000000000000000 x10: 0000000000000a60 x9 : ffff80008250bbb0 [ 1457.272138] x8 : ffff000092937200 x7 : ffff0003fdf6af80 x6 : 0000000000000000 [ 1457.279262] x5 : 00000000410fd050 x4 : 0000000000200000 x3 : 0000000000000000 [ 1457.286386] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00008590f000 [ 1457.293510] Call trace: [ 1457.295946] genpd_runtime_suspend+0x20/0x290 [ 1457.300296] __rpm_callback+0x48/0x1d8 [ 1457.304038] rpm_callback+0x6c/0x78 [ 1457.307515] rpm_suspend+0x10c/0x570 [ 1457.311077] pm_runtime_work+0xc4/0xc8 [ 1457.314813] process_one_work+0x138/0x248 [ 1457.318816] worker_thread+0x320/0x438 [ 1457.322552] kthread+0x110/0x114 [ 1457.325767] ret_from_fork+0x10/0x20 Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder") Cc: <stable(a)vger.kernel.org> Signed-off-by: Ming Qian <ming.qian(a)nxp.com> Reviewed-by: TaoJiang <tao.jiang_2(a)nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c index 2007152cd7a4..f6fcee52d138 100644 --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c @@ -2674,6 +2674,8 @@ static void mxc_jpeg_detach_pm_domains(struct mxc_jpeg_dev *jpeg) int i; for (i = 0; i < jpeg->num_domains; i++) { + if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i])) + pm_runtime_force_suspend(jpeg->pd_dev[i]); if (jpeg->pd_link[i] && !IS_ERR(jpeg->pd_link[i])) device_link_del(jpeg->pd_link[i]); if (jpeg->pd_dev[i] && !IS_ERR(jpeg->pd_dev[i])) -- 2.25.1

2 1

[PATCH OLK-6.6] virtiofs: use pages instead of pointer for kernel direct IO
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Hou Tao <houtao1(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit 41748675c0bf252b3c5f600a95830f0936d366c1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAGA CVE: CVE-2024-53219 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When trying to insert a 10MB kernel module kept in a virtio-fs with cache disabled, the following warning was reported: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 404 at mm/page_alloc.c:4551 ...... Modules linked in: CPU: 1 PID: 404 Comm: insmod Not tainted 6.9.0-rc5+ #123 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:__alloc_pages+0x2bf/0x380 ...... Call Trace: <TASK> ? __warn+0x8e/0x150 ? __alloc_pages+0x2bf/0x380 __kmalloc_large_node+0x86/0x160 __kmalloc+0x33c/0x480 virtio_fs_enqueue_req+0x240/0x6d0 virtio_fs_wake_pending_and_unlock+0x7f/0x190 queue_request_and_unlock+0x55/0x60 fuse_simple_request+0x152/0x2b0 fuse_direct_io+0x5d2/0x8c0 fuse_file_read_iter+0x121/0x160 __kernel_read+0x151/0x2d0 kernel_read+0x45/0x50 kernel_read_file+0x1a9/0x2a0 init_module_from_file+0x6a/0xe0 idempotent_init_module+0x175/0x230 __x64_sys_finit_module+0x5d/0xb0 x64_sys_call+0x1c3/0x9e0 do_syscall_64+0x3d/0xc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ...... </TASK> ---[ end trace 0000000000000000 ]--- The warning is triggered as follows: 1) syscall finit_module() handles the module insertion and it invokes kernel_read_file() to read the content of the module first. 2) kernel_read_file() allocates a 10MB buffer by using vmalloc() and passes it to kernel_read(). kernel_read() constructs a kvec iter by using iov_iter_kvec() and passes it to fuse_file_read_iter(). 3) virtio-fs disables the cache, so fuse_file_read_iter() invokes fuse_direct_io(). As for now, the maximal read size for kvec iter is only limited by fc->max_read. For virtio-fs, max_read is UINT_MAX, so fuse_direct_io() doesn't split the 10MB buffer. It saves the address and the size of the 10MB-sized buffer in out_args[0] of a fuse request and passes the fuse request to virtio_fs_wake_pending_and_unlock(). 4) virtio_fs_wake_pending_and_unlock() uses virtio_fs_enqueue_req() to queue the request. Because virtiofs need DMA-able address, so virtio_fs_enqueue_req() uses kmalloc() to allocate a bounce buffer for all fuse args, copies these args into the bounce buffer and passed the physical address of the bounce buffer to virtiofsd. The total length of these fuse args for the passed fuse request is about 10MB, so copy_args_to_argbuf() invokes kmalloc() with a 10MB size parameter and it triggers the warning in __alloc_pages(): if (WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp)) return NULL; 5) virtio_fs_enqueue_req() will retry the memory allocation in a kworker, but it won't help, because kmalloc() will always return NULL due to the abnormal size and finit_module() will hang forever. A feasible solution is to limit the value of max_read for virtio-fs, so the length passed to kmalloc() will be limited. However it will affect the maximal read size for normal read. And for virtio-fs write initiated from kernel, it has the similar problem but now there is no way to limit fc->max_write in kernel. So instead of limiting both the values of max_read and max_write in kernel, introducing use_pages_for_kvec_io in fuse_conn and setting it as true in virtiofs. When use_pages_for_kvec_io is enabled, fuse will use pages instead of pointer to pass the KVEC_IO data. After switching to pages for KVEC_IO data, these pages will be used for DMA through virtio-fs. If these pages are backed by vmalloc(), {flush|invalidate}_kernel_vmap_range() are necessary to flush or invalidate the cache before the DMA operation. So add two new fields in fuse_args_pages to record the base address of vmalloc area and the condition indicating whether invalidation is needed. Perform the flush in fuse_get_user_pages() for write operations and the invalidation in fuse_release_user_pages() for read operations. It may seem necessary to introduce another field in fuse_conn to indicate that these KVEC_IO pages are used for DMA, However, considering that virtio-fs is currently the only user of use_pages_for_kvec_io, just reuse use_pages_for_kvec_io to indicate that these pages will be used for DMA. Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem") Signed-off-by: Hou Tao <houtao1(a)huawei.com> Tested-by: Jingbo Xu <jefflexu(a)linux.alibaba.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/fuse/fuse_i.h | 6 +++++ fs/fuse/file.c | 62 +++++++++++++++++++++++++++++++-------------- fs/fuse/virtio_fs.c | 1 + 3 files changed, 50 insertions(+), 19 deletions(-) diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index 3d5734ed99cf..1bb136bcbe9e 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -286,9 +286,12 @@ struct fuse_args { bool page_replace:1; bool may_block:1; bool is_ext:1; + bool invalidate_vmap:1; struct fuse_in_arg in_args[3]; struct fuse_arg out_args[2]; void (*end)(struct fuse_mount *fm, struct fuse_args *args, int error); + /* Used for kvec iter backed by vmalloc address */ + void *vmap_base; }; struct fuse_args_pages { @@ -823,6 +826,9 @@ struct fuse_conn { /* Is statx not implemented by fs? */ unsigned int no_statx:1; + /* Use pages instead of pointer for kernel I/O */ + unsigned int use_pages_for_kvec_io:1; + /** The number of requests waiting for completion */ atomic_t num_waiting; diff --git a/fs/fuse/file.c b/fs/fuse/file.c index ceb9f7d23038..fca2be898336 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -625,7 +625,7 @@ void fuse_read_args_fill(struct fuse_io_args *ia, struct file *file, loff_t pos, args->out_args[0].size = count; } -static void fuse_release_user_pages(struct fuse_args_pages *ap, +static void fuse_release_user_pages(struct fuse_args_pages *ap, ssize_t nres, bool should_dirty) { unsigned int i; @@ -635,6 +635,9 @@ static void fuse_release_user_pages(struct fuse_args_pages *ap, set_page_dirty_lock(ap->pages[i]); put_page(ap->pages[i]); } + + if (nres > 0 && ap->args.invalidate_vmap) + invalidate_kernel_vmap_range(ap->args.vmap_base, nres); } static void fuse_io_release(struct kref *kref) @@ -733,25 +736,29 @@ static void fuse_aio_complete_req(struct fuse_mount *fm, struct fuse_args *args, struct fuse_io_args *ia = container_of(args, typeof(*ia), ap.args); struct fuse_io_priv *io = ia->io; ssize_t pos = -1; - - fuse_release_user_pages(&ia->ap, io->should_dirty); + size_t nres; if (err) { /* Nothing */ } else if (io->write) { if (ia->write.out.size > ia->write.in.size) { err = -EIO; - } else if (ia->write.in.size != ia->write.out.size) { - pos = ia->write.in.offset - io->offset + - ia->write.out.size; + } else { + nres = ia->write.out.size; + if (ia->write.in.size != ia->write.out.size) + pos = ia->write.in.offset - io->offset + + ia->write.out.size; } } else { u32 outsize = args->out_args[0].size; + nres = outsize; if (ia->read.in.size != outsize) pos = ia->read.in.offset - io->offset + outsize; } + fuse_release_user_pages(&ia->ap, err ?: nres, io->should_dirty); + fuse_aio_complete(io, err, pos); fuse_io_free(ia); } @@ -1368,24 +1375,37 @@ static inline size_t fuse_get_frag_size(const struct iov_iter *ii, static int fuse_get_user_pages(struct fuse_args_pages *ap, struct iov_iter *ii, size_t *nbytesp, int write, - unsigned int max_pages) + unsigned int max_pages, + bool use_pages_for_kvec_io) { + bool flush_or_invalidate = false; size_t nbytes = 0; /* # bytes already packed in req */ ssize_t ret = 0; - /* Special case for kernel I/O: can copy directly into the buffer */ + /* Special case for kernel I/O: can copy directly into the buffer. + * However if the implementation of fuse_conn requires pages instead of + * pointer (e.g., virtio-fs), use iov_iter_extract_pages() instead. + */ if (iov_iter_is_kvec(ii)) { - unsigned long user_addr = fuse_get_user_addr(ii); - size_t frag_size = fuse_get_frag_size(ii, *nbytesp); + void *user_addr = (void *)fuse_get_user_addr(ii); - if (write) - ap->args.in_args[1].value = (void *) user_addr; - else - ap->args.out_args[0].value = (void *) user_addr; + if (!use_pages_for_kvec_io) { + size_t frag_size = fuse_get_frag_size(ii, *nbytesp); - iov_iter_advance(ii, frag_size); - *nbytesp = frag_size; - return 0; + if (write) + ap->args.in_args[1].value = user_addr; + else + ap->args.out_args[0].value = user_addr; + + iov_iter_advance(ii, frag_size); + *nbytesp = frag_size; + return 0; + } + + if (is_vmalloc_addr(user_addr)) { + ap->args.vmap_base = user_addr; + flush_or_invalidate = true; + } } while (nbytes < *nbytesp && ap->num_pages < max_pages) { @@ -1411,6 +1431,10 @@ static int fuse_get_user_pages(struct fuse_args_pages *ap, struct iov_iter *ii, (PAGE_SIZE - ret) & (PAGE_SIZE - 1); } + if (write && flush_or_invalidate) + flush_kernel_vmap_range(ap->args.vmap_base, nbytes); + + ap->args.invalidate_vmap = !write && flush_or_invalidate; ap->args.user_pages = true; if (write) ap->args.in_pages = true; @@ -1478,7 +1502,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, size_t nbytes = min(count, nmax); err = fuse_get_user_pages(&ia->ap, iter, &nbytes, write, - max_pages); + max_pages, fc->use_pages_for_kvec_io); if (err && !nbytes) break; @@ -1492,7 +1516,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, } if (!io->async || nres < 0) { - fuse_release_user_pages(&ia->ap, io->should_dirty); + fuse_release_user_pages(&ia->ap, nres, io->should_dirty); fuse_io_free(ia); } ia = NULL; diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c index d84dacbdce2c..5779c7ba1e3d 100644 --- a/fs/fuse/virtio_fs.c +++ b/fs/fuse/virtio_fs.c @@ -1458,6 +1458,7 @@ static int virtio_fs_get_tree(struct fs_context *fsc) fc->delete_stale = true; fc->auto_submounts = true; fc->sync_fs = true; + fc->use_pages_for_kvec_io = true; /* Tell FUSE to split requests that exceed the virtqueue's size */ fc->max_pages_limit = min_t(unsigned int, fc->max_pages_limit, -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] io_uring: check if iowq is killed before queuing
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v6.6.68 commit 2ca94c8de36091067b9ce7527ae8db3812d38781 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEG43 CVE: CVE-2024-56709 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dbd2ca9367eb19bc5e269b8c58b0b1514ada9156 upstream. task work can be executed after the task has gone through io_uring termination, whether it's the final task_work run or the fallback path. In this case, task work will find ->io_wq being already killed and null'ed, which is a problem if it then tries to forward the request to io_queue_iowq(). Make io_queue_iowq() fail requests in this case. Note that it also checks PF_KTHREAD, because the user can first close a DEFER_TASKRUN ring and shortly after kill the task, in which case ->iowq check would race. Cc: stable(a)vger.kernel.org Fixes: 50c52250e2d74 ("block: implement async io_uring discard cmd") Fixes: 773af69121ecc ("io_uring: always reissue from task_work context") Reported-by: Will <willsroot(a)protonmail.com> Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/63312b4a2c2bb67ad67b857d17a300e1d3b078e8.17346379… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- io_uring/io_uring.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 4d69fb4cf803..bb37e8f08ae5 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -1090,6 +1090,7 @@ static struct file *io_file_get(struct io_ring_ctx *ctx, unsigned int issue_flags); static void __io_queue_sqe(struct io_kiocb *req); static void io_rsrc_put_work(struct work_struct *work); +static void io_req_task_queue_fail(struct io_kiocb *req, int ret); static void io_req_task_queue(struct io_kiocb *req); static void io_submit_flush_completions(struct io_ring_ctx *ctx); @@ -1459,7 +1460,11 @@ static void io_queue_async_work(struct io_kiocb *req, bool *locked) locked = NULL; BUG_ON(!tctx); - BUG_ON(!tctx->io_wq); + + if ((current->flags & PF_KTHREAD) || !tctx->io_wq) { + io_req_task_queue_fail(req, -ECANCELED); + return; + } /* init ->work of the whole link before punting */ io_prep_async_link(req); -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] virtiofs: use pages instead of pointer for kernel direct IO
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Hou Tao <houtao1(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit 41748675c0bf252b3c5f600a95830f0936d366c1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAGA CVE: CVE-2024-53219 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When trying to insert a 10MB kernel module kept in a virtio-fs with cache disabled, the following warning was reported: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 404 at mm/page_alloc.c:4551 ...... Modules linked in: CPU: 1 PID: 404 Comm: insmod Not tainted 6.9.0-rc5+ #123 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:__alloc_pages+0x2bf/0x380 ...... Call Trace: <TASK> ? __warn+0x8e/0x150 ? __alloc_pages+0x2bf/0x380 __kmalloc_large_node+0x86/0x160 __kmalloc+0x33c/0x480 virtio_fs_enqueue_req+0x240/0x6d0 virtio_fs_wake_pending_and_unlock+0x7f/0x190 queue_request_and_unlock+0x55/0x60 fuse_simple_request+0x152/0x2b0 fuse_direct_io+0x5d2/0x8c0 fuse_file_read_iter+0x121/0x160 __kernel_read+0x151/0x2d0 kernel_read+0x45/0x50 kernel_read_file+0x1a9/0x2a0 init_module_from_file+0x6a/0xe0 idempotent_init_module+0x175/0x230 __x64_sys_finit_module+0x5d/0xb0 x64_sys_call+0x1c3/0x9e0 do_syscall_64+0x3d/0xc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ...... </TASK> ---[ end trace 0000000000000000 ]--- The warning is triggered as follows: 1) syscall finit_module() handles the module insertion and it invokes kernel_read_file() to read the content of the module first. 2) kernel_read_file() allocates a 10MB buffer by using vmalloc() and passes it to kernel_read(). kernel_read() constructs a kvec iter by using iov_iter_kvec() and passes it to fuse_file_read_iter(). 3) virtio-fs disables the cache, so fuse_file_read_iter() invokes fuse_direct_io(). As for now, the maximal read size for kvec iter is only limited by fc->max_read. For virtio-fs, max_read is UINT_MAX, so fuse_direct_io() doesn't split the 10MB buffer. It saves the address and the size of the 10MB-sized buffer in out_args[0] of a fuse request and passes the fuse request to virtio_fs_wake_pending_and_unlock(). 4) virtio_fs_wake_pending_and_unlock() uses virtio_fs_enqueue_req() to queue the request. Because virtiofs need DMA-able address, so virtio_fs_enqueue_req() uses kmalloc() to allocate a bounce buffer for all fuse args, copies these args into the bounce buffer and passed the physical address of the bounce buffer to virtiofsd. The total length of these fuse args for the passed fuse request is about 10MB, so copy_args_to_argbuf() invokes kmalloc() with a 10MB size parameter and it triggers the warning in __alloc_pages(): if (WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp)) return NULL; 5) virtio_fs_enqueue_req() will retry the memory allocation in a kworker, but it won't help, because kmalloc() will always return NULL due to the abnormal size and finit_module() will hang forever. A feasible solution is to limit the value of max_read for virtio-fs, so the length passed to kmalloc() will be limited. However it will affect the maximal read size for normal read. And for virtio-fs write initiated from kernel, it has the similar problem but now there is no way to limit fc->max_write in kernel. So instead of limiting both the values of max_read and max_write in kernel, introducing use_pages_for_kvec_io in fuse_conn and setting it as true in virtiofs. When use_pages_for_kvec_io is enabled, fuse will use pages instead of pointer to pass the KVEC_IO data. After switching to pages for KVEC_IO data, these pages will be used for DMA through virtio-fs. If these pages are backed by vmalloc(), {flush|invalidate}_kernel_vmap_range() are necessary to flush or invalidate the cache before the DMA operation. So add two new fields in fuse_args_pages to record the base address of vmalloc area and the condition indicating whether invalidation is needed. Perform the flush in fuse_get_user_pages() for write operations and the invalidation in fuse_release_user_pages() for read operations. It may seem necessary to introduce another field in fuse_conn to indicate that these KVEC_IO pages are used for DMA, However, considering that virtio-fs is currently the only user of use_pages_for_kvec_io, just reuse use_pages_for_kvec_io to indicate that these pages will be used for DMA. Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem") Signed-off-by: Hou Tao <houtao1(a)huawei.com> Tested-by: Jingbo Xu <jefflexu(a)linux.alibaba.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/fuse/fuse_i.h | 6 +++++ fs/fuse/file.c | 62 +++++++++++++++++++++++++++++++-------------- fs/fuse/virtio_fs.c | 1 + 3 files changed, 50 insertions(+), 19 deletions(-) diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index 029f8e382c97..4ad05b0c72b7 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -273,9 +273,12 @@ struct fuse_args { #ifndef __GENKSYMS__ bool user_pages:1; #endif + bool invalidate_vmap:1; struct fuse_in_arg in_args[3]; struct fuse_arg out_args[2]; void (*end)(struct fuse_mount *fm, struct fuse_args *args, int error); + /* Used for kvec iter backed by vmalloc address */ + void *vmap_base; }; struct fuse_args_pages { @@ -763,6 +766,9 @@ struct fuse_conn { /* Auto-mount submounts announced by the server */ unsigned int auto_submounts:1; + /* Use pages instead of pointer for kernel I/O */ + unsigned int use_pages_for_kvec_io:1; + /** The number of requests waiting for completion */ atomic_t num_waiting; diff --git a/fs/fuse/file.c b/fs/fuse/file.c index 86f2e1c2ad0f..da6d8e241e8f 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -610,7 +610,7 @@ void fuse_read_args_fill(struct fuse_io_args *ia, struct file *file, loff_t pos, args->out_args[0].size = count; } -static void fuse_release_user_pages(struct fuse_args_pages *ap, +static void fuse_release_user_pages(struct fuse_args_pages *ap, ssize_t nres, bool should_dirty) { unsigned int i; @@ -620,6 +620,9 @@ static void fuse_release_user_pages(struct fuse_args_pages *ap, set_page_dirty_lock(ap->pages[i]); put_page(ap->pages[i]); } + + if (nres > 0 && ap->args.invalidate_vmap) + invalidate_kernel_vmap_range(ap->args.vmap_base, nres); } static void fuse_io_release(struct kref *kref) @@ -718,25 +721,29 @@ static void fuse_aio_complete_req(struct fuse_mount *fm, struct fuse_args *args, struct fuse_io_args *ia = container_of(args, typeof(*ia), ap.args); struct fuse_io_priv *io = ia->io; ssize_t pos = -1; - - fuse_release_user_pages(&ia->ap, io->should_dirty); + size_t nres; if (err) { /* Nothing */ } else if (io->write) { if (ia->write.out.size > ia->write.in.size) { err = -EIO; - } else if (ia->write.in.size != ia->write.out.size) { - pos = ia->write.in.offset - io->offset + - ia->write.out.size; + } else { + nres = ia->write.out.size; + if (ia->write.in.size != ia->write.out.size) + pos = ia->write.in.offset - io->offset + + ia->write.out.size; } } else { u32 outsize = args->out_args[0].size; + nres = outsize; if (ia->read.in.size != outsize) pos = ia->read.in.offset - io->offset + outsize; } + fuse_release_user_pages(&ia->ap, err ?: nres, io->should_dirty); + fuse_aio_complete(io, err, pos); fuse_io_free(ia); } @@ -1389,24 +1396,37 @@ static inline size_t fuse_get_frag_size(const struct iov_iter *ii, static int fuse_get_user_pages(struct fuse_args_pages *ap, struct iov_iter *ii, size_t *nbytesp, int write, - unsigned int max_pages) + unsigned int max_pages, + bool use_pages_for_kvec_io) { + bool flush_or_invalidate = false; size_t nbytes = 0; /* # bytes already packed in req */ ssize_t ret = 0; - /* Special case for kernel I/O: can copy directly into the buffer */ + /* Special case for kernel I/O: can copy directly into the buffer. + * However if the implementation of fuse_conn requires pages instead of + * pointer (e.g., virtio-fs), use iov_iter_extract_pages() instead. + */ if (iov_iter_is_kvec(ii)) { - unsigned long user_addr = fuse_get_user_addr(ii); - size_t frag_size = fuse_get_frag_size(ii, *nbytesp); + void *user_addr = (void *)fuse_get_user_addr(ii); - if (write) - ap->args.in_args[1].value = (void *) user_addr; - else - ap->args.out_args[0].value = (void *) user_addr; + if (!use_pages_for_kvec_io) { + size_t frag_size = fuse_get_frag_size(ii, *nbytesp); - iov_iter_advance(ii, frag_size); - *nbytesp = frag_size; - return 0; + if (write) + ap->args.in_args[1].value = user_addr; + else + ap->args.out_args[0].value = user_addr; + + iov_iter_advance(ii, frag_size); + *nbytesp = frag_size; + return 0; + } + + if (is_vmalloc_addr(user_addr)) { + ap->args.vmap_base = user_addr; + flush_or_invalidate = true; + } } while (nbytes < *nbytesp && ap->num_pages < max_pages) { @@ -1433,6 +1453,10 @@ static int fuse_get_user_pages(struct fuse_args_pages *ap, struct iov_iter *ii, (PAGE_SIZE - ret) & (PAGE_SIZE - 1); } + if (write && flush_or_invalidate) + flush_kernel_vmap_range(ap->args.vmap_base, nbytes); + + ap->args.invalidate_vmap = !write && flush_or_invalidate; ap->args.user_pages = true; if (write) ap->args.in_pages = true; @@ -1484,7 +1508,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, size_t nbytes = min(count, nmax); err = fuse_get_user_pages(&ia->ap, iter, &nbytes, write, - max_pages); + max_pages, fc->use_pages_for_kvec_io); if (err && !nbytes) break; @@ -1498,7 +1522,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, } if (!io->async || nres < 0) { - fuse_release_user_pages(&ia->ap, io->should_dirty); + fuse_release_user_pages(&ia->ap, nres, io->should_dirty); fuse_io_free(ia); } ia = NULL; diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c index 77338f139cb2..da5e1d1826ff 100644 --- a/fs/fuse/virtio_fs.c +++ b/fs/fuse/virtio_fs.c @@ -1461,6 +1461,7 @@ static int virtio_fs_get_tree(struct fs_context *fsc) fc->release = fuse_free_conn; fc->delete_stale = true; fc->auto_submounts = true; + fc->use_pages_for_kvec_io = true; fsc->s_fs_info = fm; sb = sget_fc(fsc, virtio_fs_test_super, virtio_fs_set_super); -- 2.39.2

2 1

[PATCH OLK-5.10] virtiofs: use pages instead of pointer for kernel direct IO
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Hou Tao <houtao1(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit 41748675c0bf252b3c5f600a95830f0936d366c1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAGA CVE: CVE-2024-53219 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When trying to insert a 10MB kernel module kept in a virtio-fs with cache disabled, the following warning was reported: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 404 at mm/page_alloc.c:4551 ...... Modules linked in: CPU: 1 PID: 404 Comm: insmod Not tainted 6.9.0-rc5+ #123 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:__alloc_pages+0x2bf/0x380 ...... Call Trace: <TASK> ? __warn+0x8e/0x150 ? __alloc_pages+0x2bf/0x380 __kmalloc_large_node+0x86/0x160 __kmalloc+0x33c/0x480 virtio_fs_enqueue_req+0x240/0x6d0 virtio_fs_wake_pending_and_unlock+0x7f/0x190 queue_request_and_unlock+0x55/0x60 fuse_simple_request+0x152/0x2b0 fuse_direct_io+0x5d2/0x8c0 fuse_file_read_iter+0x121/0x160 __kernel_read+0x151/0x2d0 kernel_read+0x45/0x50 kernel_read_file+0x1a9/0x2a0 init_module_from_file+0x6a/0xe0 idempotent_init_module+0x175/0x230 __x64_sys_finit_module+0x5d/0xb0 x64_sys_call+0x1c3/0x9e0 do_syscall_64+0x3d/0xc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ...... </TASK> ---[ end trace 0000000000000000 ]--- The warning is triggered as follows: 1) syscall finit_module() handles the module insertion and it invokes kernel_read_file() to read the content of the module first. 2) kernel_read_file() allocates a 10MB buffer by using vmalloc() and passes it to kernel_read(). kernel_read() constructs a kvec iter by using iov_iter_kvec() and passes it to fuse_file_read_iter(). 3) virtio-fs disables the cache, so fuse_file_read_iter() invokes fuse_direct_io(). As for now, the maximal read size for kvec iter is only limited by fc->max_read. For virtio-fs, max_read is UINT_MAX, so fuse_direct_io() doesn't split the 10MB buffer. It saves the address and the size of the 10MB-sized buffer in out_args[0] of a fuse request and passes the fuse request to virtio_fs_wake_pending_and_unlock(). 4) virtio_fs_wake_pending_and_unlock() uses virtio_fs_enqueue_req() to queue the request. Because virtiofs need DMA-able address, so virtio_fs_enqueue_req() uses kmalloc() to allocate a bounce buffer for all fuse args, copies these args into the bounce buffer and passed the physical address of the bounce buffer to virtiofsd. The total length of these fuse args for the passed fuse request is about 10MB, so copy_args_to_argbuf() invokes kmalloc() with a 10MB size parameter and it triggers the warning in __alloc_pages(): if (WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp)) return NULL; 5) virtio_fs_enqueue_req() will retry the memory allocation in a kworker, but it won't help, because kmalloc() will always return NULL due to the abnormal size and finit_module() will hang forever. A feasible solution is to limit the value of max_read for virtio-fs, so the length passed to kmalloc() will be limited. However it will affect the maximal read size for normal read. And for virtio-fs write initiated from kernel, it has the similar problem but now there is no way to limit fc->max_write in kernel. So instead of limiting both the values of max_read and max_write in kernel, introducing use_pages_for_kvec_io in fuse_conn and setting it as true in virtiofs. When use_pages_for_kvec_io is enabled, fuse will use pages instead of pointer to pass the KVEC_IO data. After switching to pages for KVEC_IO data, these pages will be used for DMA through virtio-fs. If these pages are backed by vmalloc(), {flush|invalidate}_kernel_vmap_range() are necessary to flush or invalidate the cache before the DMA operation. So add two new fields in fuse_args_pages to record the base address of vmalloc area and the condition indicating whether invalidation is needed. Perform the flush in fuse_get_user_pages() for write operations and the invalidation in fuse_release_user_pages() for read operations. It may seem necessary to introduce another field in fuse_conn to indicate that these KVEC_IO pages are used for DMA, However, considering that virtio-fs is currently the only user of use_pages_for_kvec_io, just reuse use_pages_for_kvec_io to indicate that these pages will be used for DMA. Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem") Signed-off-by: Hou Tao <houtao1(a)huawei.com> Tested-by: Jingbo Xu <jefflexu(a)linux.alibaba.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/fuse/fuse_i.h | 6 +++++ fs/fuse/file.c | 62 +++++++++++++++++++++++++++++++-------------- fs/fuse/virtio_fs.c | 1 + 3 files changed, 50 insertions(+), 19 deletions(-) diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index 11cc437fe078..749003487776 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -273,9 +273,12 @@ struct fuse_args { #ifndef __GENKSYMS__ bool user_pages:1; #endif + bool invalidate_vmap:1; struct fuse_in_arg in_args[3]; struct fuse_arg out_args[2]; void (*end)(struct fuse_mount *fm, struct fuse_args *args, int error); + /* Used for kvec iter backed by vmalloc address */ + void *vmap_base; }; struct fuse_args_pages { @@ -766,6 +769,9 @@ struct fuse_conn { /* Auto-mount submounts announced by the server */ unsigned int auto_submounts:1; + /* Use pages instead of pointer for kernel I/O */ + unsigned int use_pages_for_kvec_io:1; + /** The number of requests waiting for completion */ atomic_t num_waiting; diff --git a/fs/fuse/file.c b/fs/fuse/file.c index d3e798b5a560..e0aac6019cdb 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -615,7 +615,7 @@ void fuse_read_args_fill(struct fuse_io_args *ia, struct file *file, loff_t pos, args->out_args[0].size = count; } -static void fuse_release_user_pages(struct fuse_args_pages *ap, +static void fuse_release_user_pages(struct fuse_args_pages *ap, ssize_t nres, bool should_dirty) { unsigned int i; @@ -625,6 +625,9 @@ static void fuse_release_user_pages(struct fuse_args_pages *ap, set_page_dirty_lock(ap->pages[i]); put_page(ap->pages[i]); } + + if (nres > 0 && ap->args.invalidate_vmap) + invalidate_kernel_vmap_range(ap->args.vmap_base, nres); } static void fuse_io_release(struct kref *kref) @@ -723,25 +726,29 @@ static void fuse_aio_complete_req(struct fuse_mount *fm, struct fuse_args *args, struct fuse_io_args *ia = container_of(args, typeof(*ia), ap.args); struct fuse_io_priv *io = ia->io; ssize_t pos = -1; - - fuse_release_user_pages(&ia->ap, io->should_dirty); + size_t nres; if (err) { /* Nothing */ } else if (io->write) { if (ia->write.out.size > ia->write.in.size) { err = -EIO; - } else if (ia->write.in.size != ia->write.out.size) { - pos = ia->write.in.offset - io->offset + - ia->write.out.size; + } else { + nres = ia->write.out.size; + if (ia->write.in.size != ia->write.out.size) + pos = ia->write.in.offset - io->offset + + ia->write.out.size; } } else { u32 outsize = args->out_args[0].size; + nres = outsize; if (ia->read.in.size != outsize) pos = ia->read.in.offset - io->offset + outsize; } + fuse_release_user_pages(&ia->ap, err ?: nres, io->should_dirty); + fuse_aio_complete(io, err, pos); fuse_io_free(ia); } @@ -1394,24 +1401,37 @@ static inline size_t fuse_get_frag_size(const struct iov_iter *ii, static int fuse_get_user_pages(struct fuse_args_pages *ap, struct iov_iter *ii, size_t *nbytesp, int write, - unsigned int max_pages) + unsigned int max_pages, + bool use_pages_for_kvec_io) { + bool flush_or_invalidate = false; size_t nbytes = 0; /* # bytes already packed in req */ ssize_t ret = 0; - /* Special case for kernel I/O: can copy directly into the buffer */ + /* Special case for kernel I/O: can copy directly into the buffer. + * However if the implementation of fuse_conn requires pages instead of + * pointer (e.g., virtio-fs), use iov_iter_extract_pages() instead. + */ if (iov_iter_is_kvec(ii)) { - unsigned long user_addr = fuse_get_user_addr(ii); - size_t frag_size = fuse_get_frag_size(ii, *nbytesp); + void *user_addr = (void *)fuse_get_user_addr(ii); - if (write) - ap->args.in_args[1].value = (void *) user_addr; - else - ap->args.out_args[0].value = (void *) user_addr; + if (!use_pages_for_kvec_io) { + size_t frag_size = fuse_get_frag_size(ii, *nbytesp); - iov_iter_advance(ii, frag_size); - *nbytesp = frag_size; - return 0; + if (write) + ap->args.in_args[1].value = user_addr; + else + ap->args.out_args[0].value = user_addr; + + iov_iter_advance(ii, frag_size); + *nbytesp = frag_size; + return 0; + } + + if (is_vmalloc_addr(user_addr)) { + ap->args.vmap_base = user_addr; + flush_or_invalidate = true; + } } while (nbytes < *nbytesp && ap->num_pages < max_pages) { @@ -1438,6 +1458,10 @@ static int fuse_get_user_pages(struct fuse_args_pages *ap, struct iov_iter *ii, (PAGE_SIZE - ret) & (PAGE_SIZE - 1); } + if (write && flush_or_invalidate) + flush_kernel_vmap_range(ap->args.vmap_base, nbytes); + + ap->args.invalidate_vmap = !write && flush_or_invalidate; ap->args.user_pages = true; if (write) ap->args.in_pages = true; @@ -1489,7 +1513,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, size_t nbytes = min(count, nmax); err = fuse_get_user_pages(&ia->ap, iter, &nbytes, write, - max_pages); + max_pages, fc->use_pages_for_kvec_io); if (err && !nbytes) break; @@ -1503,7 +1527,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, } if (!io->async || nres < 0) { - fuse_release_user_pages(&ia->ap, io->should_dirty); + fuse_release_user_pages(&ia->ap, nres, io->should_dirty); fuse_io_free(ia); } ia = NULL; diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c index 17d30577340a..4ef123691a83 100644 --- a/fs/fuse/virtio_fs.c +++ b/fs/fuse/virtio_fs.c @@ -1464,6 +1464,7 @@ static int virtio_fs_get_tree(struct fs_context *fsc) fc->release = fuse_free_conn; fc->delete_stale = true; fc->auto_submounts = true; + fc->use_pages_for_kvec_io = true; /* Tell FUSE to split requests that exceed the virtqueue's size */ fc->max_pages_limit = min_t(unsigned int, fc->max_pages_limit, -- 2.39.2

2 1

[PATCH OLK-5.10] io_uring: check if iowq is killed before queuing
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v6.6.68 commit 2ca94c8de36091067b9ce7527ae8db3812d38781 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEG43 CVE: CVE-2024-56709 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dbd2ca9367eb19bc5e269b8c58b0b1514ada9156 upstream. task work can be executed after the task has gone through io_uring termination, whether it's the final task_work run or the fallback path. In this case, task work will find ->io_wq being already killed and null'ed, which is a problem if it then tries to forward the request to io_queue_iowq(). Make io_queue_iowq() fail requests in this case. Note that it also checks PF_KTHREAD, because the user can first close a DEFER_TASKRUN ring and shortly after kill the task, in which case ->iowq check would race. Cc: stable(a)vger.kernel.org Fixes: 50c52250e2d74 ("block: implement async io_uring discard cmd") Fixes: 773af69121ecc ("io_uring: always reissue from task_work context") Reported-by: Will <willsroot(a)protonmail.com> Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/63312b4a2c2bb67ad67b857d17a300e1d3b078e8.17346379… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- io_uring/io_uring.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 6e5e00a7692c..3a1eee5bac77 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -1096,6 +1096,7 @@ static struct file *io_file_get(struct io_ring_ctx *ctx, unsigned int issue_flags); static void __io_queue_sqe(struct io_kiocb *req); static void io_rsrc_put_work(struct work_struct *work); +static void io_req_task_queue_fail(struct io_kiocb *req, int ret); static void io_req_task_queue(struct io_kiocb *req); static void io_submit_flush_completions(struct io_ring_ctx *ctx); @@ -1465,7 +1466,11 @@ static void io_queue_async_work(struct io_kiocb *req, bool *locked) locked = NULL; BUG_ON(!tctx); - BUG_ON(!tctx->io_wq); + + if ((current->flags & PF_KTHREAD) || !tctx->io_wq) { + io_req_task_queue_fail(req, -ECANCELED); + return; + } /* init ->work of the whole link before punting */ io_prep_async_link(req); -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] ftrace: Fix regression with module command in stack_trace_filter
by Luo Gengkun 30 Dec '24

30 Dec '24

From: guoweikang <guoweikang.kernel(a)gmail.com> stable inclusion from stable-v5.10.231 commit 5dabb7af57bc72308a6e2e81a5dd756eef283803 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMJ CVE: CVE-2024-56569 Reference: https://git.kernel.org/stable/c/5dabb7af57bc72308a6e2e81a5dd756eef283803 -------------------------------- commit 45af52e7d3b8560f21d139b3759735eead8b1653 upstream. When executing the following command: # echo "write*:mod:ext3" > /sys/kernel/tracing/stack_trace_filter The current mod command causes a null pointer dereference. While commit 0f17976568b3f ("ftrace: Fix regression with module command in stack_trace_filter") has addressed part of the issue, it left a corner case unhandled, which still results in a kernel crash. Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20241120052750.275463-1-guoweikang.kernel@gmail.com Fixes: 04ec7bb642b77 ("tracing: Have the trace_array hold the list of registered func probes"); Signed-off-by: guoweikang <guoweikang.kernel(a)gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/trace/ftrace.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 9631df0bbbae..b06d8905b15e 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -4297,6 +4297,9 @@ ftrace_mod_callback(struct trace_array *tr, struct ftrace_hash *hash, char *func; int ret; + if (!tr) + return -ENODEV; + /* match_records() modifies func, and we need the original */ func = kstrdup(func_orig, GFP_KERNEL); if (!func) -- 2.34.1

2 1

[PATCH OLK-5.10] ftrace: Fix regression with module command in stack_trace_filter
by Luo Gengkun 30 Dec '24

30 Dec '24

From: guoweikang <guoweikang.kernel(a)gmail.com> stable inclusion from stable-v5.10.231 commit 5dabb7af57bc72308a6e2e81a5dd756eef283803 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMJ CVE: CVE-2024-56569 Reference: https://git.kernel.org/stable/c/5dabb7af57bc72308a6e2e81a5dd756eef283803 -------------------------------- commit 45af52e7d3b8560f21d139b3759735eead8b1653 upstream. When executing the following command: # echo "write*:mod:ext3" > /sys/kernel/tracing/stack_trace_filter The current mod command causes a null pointer dereference. While commit 0f17976568b3f ("ftrace: Fix regression with module command in stack_trace_filter") has addressed part of the issue, it left a corner case unhandled, which still results in a kernel crash. Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20241120052750.275463-1-guoweikang.kernel@gmail.com Fixes: 04ec7bb642b77 ("tracing: Have the trace_array hold the list of registered func probes"); Signed-off-by: guoweikang <guoweikang.kernel(a)gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/trace/ftrace.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 6b7deaaecc51..923d78cc130c 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -4312,6 +4312,9 @@ ftrace_mod_callback(struct trace_array *tr, struct ftrace_hash *hash, char *func; int ret; + if (!tr) + return -ENODEV; + /* match_records() modifies func, and we need the original */ func = kstrdup(func_orig, GFP_KERNEL); if (!func) -- 2.34.1

2 1

[PATCH OLK-6.6] ftrace: Fix regression with module command in stack_trace_filter
by Luo Gengkun 30 Dec '24

30 Dec '24

From: guoweikang <guoweikang.kernel(a)gmail.com> stable inclusion from stable-v6.6.64 commit 8a92dc4df89c50bdb26667419ea70e0abbce456e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMJ CVE: CVE-2024-56569 Reference: https://git.kernel.org/stable/c/8a92dc4df89c50bdb26667419ea70e0abbce456e -------------------------------- commit 45af52e7d3b8560f21d139b3759735eead8b1653 upstream. When executing the following command: # echo "write*:mod:ext3" > /sys/kernel/tracing/stack_trace_filter The current mod command causes a null pointer dereference. While commit 0f17976568b3f ("ftrace: Fix regression with module command in stack_trace_filter") has addressed part of the issue, it left a corner case unhandled, which still results in a kernel crash. Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20241120052750.275463-1-guoweikang.kernel@gmail.com Fixes: 04ec7bb642b77 ("tracing: Have the trace_array hold the list of registered func probes"); Signed-off-by: guoweikang <guoweikang.kernel(a)gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/trace/ftrace.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 175eba24f562..1043936b352d 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -4562,6 +4562,9 @@ ftrace_mod_callback(struct trace_array *tr, struct ftrace_hash *hash, char *func; int ret; + if (!tr) + return -ENODEV; + /* match_records() modifies func, and we need the original */ func = kstrdup(func_orig, GFP_KERNEL); if (!func) -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] fix CVE-2024-53197
by Tengda Wu 30 Dec '24

30 Dec '24

Fix CVE-2024-53197. Benoît Sevens (1): ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices Dan Carpenter (1): ALSA: usb-audio: Fix a DMA to stack memory bug sound/usb/quirks.c | 39 +++++++++++++++++++++++++++++++++------ 1 file changed, 33 insertions(+), 6 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/2] fix CVE-2024-53197
by Tengda Wu 30 Dec '24

30 Dec '24

Fix CVE-2024-53197. Benoît Sevens (1): ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices Dan Carpenter (1): ALSA: usb-audio: Fix a DMA to stack memory bug sound/usb/quirks.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] fix CVE-2024-53197
by Tengda Wu 30 Dec '24

30 Dec '24

Fix CVE-2024-53197. Benoît Sevens (1): ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices Dan Carpenter (1): ALSA: usb-audio: Fix a DMA to stack memory bug sound/usb/quirks.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] LoongArch: compile loongson drm driver as module
by Hongchen Zhang 30 Dec '24

30 Dec '24

Hongchen Zhang (2): LoongArch: cleanup loongson3 defconfig drm/loongson: compile loongson drm driver as module arch/loongarch/configs/loongson3_defconfig | 13 ++++++------- drivers/gpu/drm/Makefile | 2 +- 2 files changed, 7 insertions(+), 8 deletions(-) -- 2.33.0

2 7

[PATCH OLK-5.10] io_uring: check if iowq is killed before queuing
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v6.6.68 commit 2ca94c8de36091067b9ce7527ae8db3812d38781 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEG43 CVE: CVE-2024-56709 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dbd2ca9367eb19bc5e269b8c58b0b1514ada9156 upstream. task work can be executed after the task has gone through io_uring termination, whether it's the final task_work run or the fallback path. In this case, task work will find ->io_wq being already killed and null'ed, which is a problem if it then tries to forward the request to io_queue_iowq(). Make io_queue_iowq() fail requests in this case. Note that it also checks PF_KTHREAD, because the user can first close a DEFER_TASKRUN ring and shortly after kill the task, in which case ->iowq check would race. Cc: stable(a)vger.kernel.org Fixes: 50c52250e2d74 ("block: implement async io_uring discard cmd") Fixes: 773af69121ecc ("io_uring: always reissue from task_work context") Reported-by: Will <willsroot(a)protonmail.com> Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/63312b4a2c2bb67ad67b857d17a300e1d3b078e8.17346379… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- io_uring/io_uring.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 6e5e00a7692c..3a1eee5bac77 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -1096,6 +1096,7 @@ static struct file *io_file_get(struct io_ring_ctx *ctx, unsigned int issue_flags); static void __io_queue_sqe(struct io_kiocb *req); static void io_rsrc_put_work(struct work_struct *work); +static void io_req_task_queue_fail(struct io_kiocb *req, int ret); static void io_req_task_queue(struct io_kiocb *req); static void io_submit_flush_completions(struct io_ring_ctx *ctx); @@ -1465,7 +1466,11 @@ static void io_queue_async_work(struct io_kiocb *req, bool *locked) locked = NULL; BUG_ON(!tctx); - BUG_ON(!tctx->io_wq); + + if ((current->flags & PF_KTHREAD) || !tctx->io_wq) { + io_req_task_queue_fail(req, -ECANCELED); + return; + } /* init ->work of the whole link before punting */ io_prep_async_link(req); -- 2.39.2

2 5

[PATCH OLK-5.10] virtiofs: use pages instead of pointer for kernel direct IO
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Hou Tao <houtao1(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit 41748675c0bf252b3c5f600a95830f0936d366c1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAGA CVE: CVE-2024-53219 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When trying to insert a 10MB kernel module kept in a virtio-fs with cache disabled, the following warning was reported: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 404 at mm/page_alloc.c:4551 ...... Modules linked in: CPU: 1 PID: 404 Comm: insmod Not tainted 6.9.0-rc5+ #123 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:__alloc_pages+0x2bf/0x380 ...... Call Trace: <TASK> ? __warn+0x8e/0x150 ? __alloc_pages+0x2bf/0x380 __kmalloc_large_node+0x86/0x160 __kmalloc+0x33c/0x480 virtio_fs_enqueue_req+0x240/0x6d0 virtio_fs_wake_pending_and_unlock+0x7f/0x190 queue_request_and_unlock+0x55/0x60 fuse_simple_request+0x152/0x2b0 fuse_direct_io+0x5d2/0x8c0 fuse_file_read_iter+0x121/0x160 __kernel_read+0x151/0x2d0 kernel_read+0x45/0x50 kernel_read_file+0x1a9/0x2a0 init_module_from_file+0x6a/0xe0 idempotent_init_module+0x175/0x230 __x64_sys_finit_module+0x5d/0xb0 x64_sys_call+0x1c3/0x9e0 do_syscall_64+0x3d/0xc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ...... </TASK> ---[ end trace 0000000000000000 ]--- The warning is triggered as follows: 1) syscall finit_module() handles the module insertion and it invokes kernel_read_file() to read the content of the module first. 2) kernel_read_file() allocates a 10MB buffer by using vmalloc() and passes it to kernel_read(). kernel_read() constructs a kvec iter by using iov_iter_kvec() and passes it to fuse_file_read_iter(). 3) virtio-fs disables the cache, so fuse_file_read_iter() invokes fuse_direct_io(). As for now, the maximal read size for kvec iter is only limited by fc->max_read. For virtio-fs, max_read is UINT_MAX, so fuse_direct_io() doesn't split the 10MB buffer. It saves the address and the size of the 10MB-sized buffer in out_args[0] of a fuse request and passes the fuse request to virtio_fs_wake_pending_and_unlock(). 4) virtio_fs_wake_pending_and_unlock() uses virtio_fs_enqueue_req() to queue the request. Because virtiofs need DMA-able address, so virtio_fs_enqueue_req() uses kmalloc() to allocate a bounce buffer for all fuse args, copies these args into the bounce buffer and passed the physical address of the bounce buffer to virtiofsd. The total length of these fuse args for the passed fuse request is about 10MB, so copy_args_to_argbuf() invokes kmalloc() with a 10MB size parameter and it triggers the warning in __alloc_pages(): if (WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp)) return NULL; 5) virtio_fs_enqueue_req() will retry the memory allocation in a kworker, but it won't help, because kmalloc() will always return NULL due to the abnormal size and finit_module() will hang forever. A feasible solution is to limit the value of max_read for virtio-fs, so the length passed to kmalloc() will be limited. However it will affect the maximal read size for normal read. And for virtio-fs write initiated from kernel, it has the similar problem but now there is no way to limit fc->max_write in kernel. So instead of limiting both the values of max_read and max_write in kernel, introducing use_pages_for_kvec_io in fuse_conn and setting it as true in virtiofs. When use_pages_for_kvec_io is enabled, fuse will use pages instead of pointer to pass the KVEC_IO data. After switching to pages for KVEC_IO data, these pages will be used for DMA through virtio-fs. If these pages are backed by vmalloc(), {flush|invalidate}_kernel_vmap_range() are necessary to flush or invalidate the cache before the DMA operation. So add two new fields in fuse_args_pages to record the base address of vmalloc area and the condition indicating whether invalidation is needed. Perform the flush in fuse_get_user_pages() for write operations and the invalidation in fuse_release_user_pages() for read operations. It may seem necessary to introduce another field in fuse_conn to indicate that these KVEC_IO pages are used for DMA, However, considering that virtio-fs is currently the only user of use_pages_for_kvec_io, just reuse use_pages_for_kvec_io to indicate that these pages will be used for DMA. Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem") Signed-off-by: Hou Tao <houtao1(a)huawei.com> Tested-by: Jingbo Xu <jefflexu(a)linux.alibaba.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/fuse/fuse_i.h | 6 +++++ fs/fuse/file.c | 62 +++++++++++++++++++++++++++++++-------------- fs/fuse/virtio_fs.c | 1 + 3 files changed, 50 insertions(+), 19 deletions(-) diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index 11cc437fe078..749003487776 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -273,9 +273,12 @@ struct fuse_args { #ifndef __GENKSYMS__ bool user_pages:1; #endif + bool invalidate_vmap:1; struct fuse_in_arg in_args[3]; struct fuse_arg out_args[2]; void (*end)(struct fuse_mount *fm, struct fuse_args *args, int error); + /* Used for kvec iter backed by vmalloc address */ + void *vmap_base; }; struct fuse_args_pages { @@ -766,6 +769,9 @@ struct fuse_conn { /* Auto-mount submounts announced by the server */ unsigned int auto_submounts:1; + /* Use pages instead of pointer for kernel I/O */ + unsigned int use_pages_for_kvec_io:1; + /** The number of requests waiting for completion */ atomic_t num_waiting; diff --git a/fs/fuse/file.c b/fs/fuse/file.c index d3e798b5a560..e0aac6019cdb 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -615,7 +615,7 @@ void fuse_read_args_fill(struct fuse_io_args *ia, struct file *file, loff_t pos, args->out_args[0].size = count; } -static void fuse_release_user_pages(struct fuse_args_pages *ap, +static void fuse_release_user_pages(struct fuse_args_pages *ap, ssize_t nres, bool should_dirty) { unsigned int i; @@ -625,6 +625,9 @@ static void fuse_release_user_pages(struct fuse_args_pages *ap, set_page_dirty_lock(ap->pages[i]); put_page(ap->pages[i]); } + + if (nres > 0 && ap->args.invalidate_vmap) + invalidate_kernel_vmap_range(ap->args.vmap_base, nres); } static void fuse_io_release(struct kref *kref) @@ -723,25 +726,29 @@ static void fuse_aio_complete_req(struct fuse_mount *fm, struct fuse_args *args, struct fuse_io_args *ia = container_of(args, typeof(*ia), ap.args); struct fuse_io_priv *io = ia->io; ssize_t pos = -1; - - fuse_release_user_pages(&ia->ap, io->should_dirty); + size_t nres; if (err) { /* Nothing */ } else if (io->write) { if (ia->write.out.size > ia->write.in.size) { err = -EIO; - } else if (ia->write.in.size != ia->write.out.size) { - pos = ia->write.in.offset - io->offset + - ia->write.out.size; + } else { + nres = ia->write.out.size; + if (ia->write.in.size != ia->write.out.size) + pos = ia->write.in.offset - io->offset + + ia->write.out.size; } } else { u32 outsize = args->out_args[0].size; + nres = outsize; if (ia->read.in.size != outsize) pos = ia->read.in.offset - io->offset + outsize; } + fuse_release_user_pages(&ia->ap, err ?: nres, io->should_dirty); + fuse_aio_complete(io, err, pos); fuse_io_free(ia); } @@ -1394,24 +1401,37 @@ static inline size_t fuse_get_frag_size(const struct iov_iter *ii, static int fuse_get_user_pages(struct fuse_args_pages *ap, struct iov_iter *ii, size_t *nbytesp, int write, - unsigned int max_pages) + unsigned int max_pages, + bool use_pages_for_kvec_io) { + bool flush_or_invalidate = false; size_t nbytes = 0; /* # bytes already packed in req */ ssize_t ret = 0; - /* Special case for kernel I/O: can copy directly into the buffer */ + /* Special case for kernel I/O: can copy directly into the buffer. + * However if the implementation of fuse_conn requires pages instead of + * pointer (e.g., virtio-fs), use iov_iter_extract_pages() instead. + */ if (iov_iter_is_kvec(ii)) { - unsigned long user_addr = fuse_get_user_addr(ii); - size_t frag_size = fuse_get_frag_size(ii, *nbytesp); + void *user_addr = (void *)fuse_get_user_addr(ii); - if (write) - ap->args.in_args[1].value = (void *) user_addr; - else - ap->args.out_args[0].value = (void *) user_addr; + if (!use_pages_for_kvec_io) { + size_t frag_size = fuse_get_frag_size(ii, *nbytesp); - iov_iter_advance(ii, frag_size); - *nbytesp = frag_size; - return 0; + if (write) + ap->args.in_args[1].value = user_addr; + else + ap->args.out_args[0].value = user_addr; + + iov_iter_advance(ii, frag_size); + *nbytesp = frag_size; + return 0; + } + + if (is_vmalloc_addr(user_addr)) { + ap->args.vmap_base = user_addr; + flush_or_invalidate = true; + } } while (nbytes < *nbytesp && ap->num_pages < max_pages) { @@ -1438,6 +1458,10 @@ static int fuse_get_user_pages(struct fuse_args_pages *ap, struct iov_iter *ii, (PAGE_SIZE - ret) & (PAGE_SIZE - 1); } + if (write && flush_or_invalidate) + flush_kernel_vmap_range(ap->args.vmap_base, nbytes); + + ap->args.invalidate_vmap = !write && flush_or_invalidate; ap->args.user_pages = true; if (write) ap->args.in_pages = true; @@ -1489,7 +1513,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, size_t nbytes = min(count, nmax); err = fuse_get_user_pages(&ia->ap, iter, &nbytes, write, - max_pages); + max_pages, fc->use_pages_for_kvec_io); if (err && !nbytes) break; @@ -1503,7 +1527,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, } if (!io->async || nres < 0) { - fuse_release_user_pages(&ia->ap, io->should_dirty); + fuse_release_user_pages(&ia->ap, nres, io->should_dirty); fuse_io_free(ia); } ia = NULL; diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c index 17d30577340a..4ef123691a83 100644 --- a/fs/fuse/virtio_fs.c +++ b/fs/fuse/virtio_fs.c @@ -1464,6 +1464,7 @@ static int virtio_fs_get_tree(struct fs_context *fsc) fc->release = fuse_free_conn; fc->delete_stale = true; fc->auto_submounts = true; + fc->use_pages_for_kvec_io = true; /* Tell FUSE to split requests that exceed the virtqueue's size */ fc->max_pages_limit = min_t(unsigned int, fc->max_pages_limit, -- 2.39.2

2 5

[PATCH OLK-6.6] virtiofs: use pages instead of pointer for kernel direct IO
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Hou Tao <houtao1(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit 41748675c0bf252b3c5f600a95830f0936d366c1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAGA CVE: CVE-2024-53219 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When trying to insert a 10MB kernel module kept in a virtio-fs with cache disabled, the following warning was reported: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 404 at mm/page_alloc.c:4551 ...... Modules linked in: CPU: 1 PID: 404 Comm: insmod Not tainted 6.9.0-rc5+ #123 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:__alloc_pages+0x2bf/0x380 ...... Call Trace: <TASK> ? __warn+0x8e/0x150 ? __alloc_pages+0x2bf/0x380 __kmalloc_large_node+0x86/0x160 __kmalloc+0x33c/0x480 virtio_fs_enqueue_req+0x240/0x6d0 virtio_fs_wake_pending_and_unlock+0x7f/0x190 queue_request_and_unlock+0x55/0x60 fuse_simple_request+0x152/0x2b0 fuse_direct_io+0x5d2/0x8c0 fuse_file_read_iter+0x121/0x160 __kernel_read+0x151/0x2d0 kernel_read+0x45/0x50 kernel_read_file+0x1a9/0x2a0 init_module_from_file+0x6a/0xe0 idempotent_init_module+0x175/0x230 __x64_sys_finit_module+0x5d/0xb0 x64_sys_call+0x1c3/0x9e0 do_syscall_64+0x3d/0xc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ...... </TASK> ---[ end trace 0000000000000000 ]--- The warning is triggered as follows: 1) syscall finit_module() handles the module insertion and it invokes kernel_read_file() to read the content of the module first. 2) kernel_read_file() allocates a 10MB buffer by using vmalloc() and passes it to kernel_read(). kernel_read() constructs a kvec iter by using iov_iter_kvec() and passes it to fuse_file_read_iter(). 3) virtio-fs disables the cache, so fuse_file_read_iter() invokes fuse_direct_io(). As for now, the maximal read size for kvec iter is only limited by fc->max_read. For virtio-fs, max_read is UINT_MAX, so fuse_direct_io() doesn't split the 10MB buffer. It saves the address and the size of the 10MB-sized buffer in out_args[0] of a fuse request and passes the fuse request to virtio_fs_wake_pending_and_unlock(). 4) virtio_fs_wake_pending_and_unlock() uses virtio_fs_enqueue_req() to queue the request. Because virtiofs need DMA-able address, so virtio_fs_enqueue_req() uses kmalloc() to allocate a bounce buffer for all fuse args, copies these args into the bounce buffer and passed the physical address of the bounce buffer to virtiofsd. The total length of these fuse args for the passed fuse request is about 10MB, so copy_args_to_argbuf() invokes kmalloc() with a 10MB size parameter and it triggers the warning in __alloc_pages(): if (WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp)) return NULL; 5) virtio_fs_enqueue_req() will retry the memory allocation in a kworker, but it won't help, because kmalloc() will always return NULL due to the abnormal size and finit_module() will hang forever. A feasible solution is to limit the value of max_read for virtio-fs, so the length passed to kmalloc() will be limited. However it will affect the maximal read size for normal read. And for virtio-fs write initiated from kernel, it has the similar problem but now there is no way to limit fc->max_write in kernel. So instead of limiting both the values of max_read and max_write in kernel, introducing use_pages_for_kvec_io in fuse_conn and setting it as true in virtiofs. When use_pages_for_kvec_io is enabled, fuse will use pages instead of pointer to pass the KVEC_IO data. After switching to pages for KVEC_IO data, these pages will be used for DMA through virtio-fs. If these pages are backed by vmalloc(), {flush|invalidate}_kernel_vmap_range() are necessary to flush or invalidate the cache before the DMA operation. So add two new fields in fuse_args_pages to record the base address of vmalloc area and the condition indicating whether invalidation is needed. Perform the flush in fuse_get_user_pages() for write operations and the invalidation in fuse_release_user_pages() for read operations. It may seem necessary to introduce another field in fuse_conn to indicate that these KVEC_IO pages are used for DMA, However, considering that virtio-fs is currently the only user of use_pages_for_kvec_io, just reuse use_pages_for_kvec_io to indicate that these pages will be used for DMA. Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem") Signed-off-by: Hou Tao <houtao1(a)huawei.com> Tested-by: Jingbo Xu <jefflexu(a)linux.alibaba.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/fuse/fuse_i.h | 6 +++++ fs/fuse/file.c | 62 +++++++++++++++++++++++++++++++-------------- fs/fuse/virtio_fs.c | 1 + 3 files changed, 50 insertions(+), 19 deletions(-) diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index 3d5734ed99cf..1bb136bcbe9e 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -286,9 +286,12 @@ struct fuse_args { bool page_replace:1; bool may_block:1; bool is_ext:1; + bool invalidate_vmap:1; struct fuse_in_arg in_args[3]; struct fuse_arg out_args[2]; void (*end)(struct fuse_mount *fm, struct fuse_args *args, int error); + /* Used for kvec iter backed by vmalloc address */ + void *vmap_base; }; struct fuse_args_pages { @@ -823,6 +826,9 @@ struct fuse_conn { /* Is statx not implemented by fs? */ unsigned int no_statx:1; + /* Use pages instead of pointer for kernel I/O */ + unsigned int use_pages_for_kvec_io:1; + /** The number of requests waiting for completion */ atomic_t num_waiting; diff --git a/fs/fuse/file.c b/fs/fuse/file.c index ceb9f7d23038..fca2be898336 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -625,7 +625,7 @@ void fuse_read_args_fill(struct fuse_io_args *ia, struct file *file, loff_t pos, args->out_args[0].size = count; } -static void fuse_release_user_pages(struct fuse_args_pages *ap, +static void fuse_release_user_pages(struct fuse_args_pages *ap, ssize_t nres, bool should_dirty) { unsigned int i; @@ -635,6 +635,9 @@ static void fuse_release_user_pages(struct fuse_args_pages *ap, set_page_dirty_lock(ap->pages[i]); put_page(ap->pages[i]); } + + if (nres > 0 && ap->args.invalidate_vmap) + invalidate_kernel_vmap_range(ap->args.vmap_base, nres); } static void fuse_io_release(struct kref *kref) @@ -733,25 +736,29 @@ static void fuse_aio_complete_req(struct fuse_mount *fm, struct fuse_args *args, struct fuse_io_args *ia = container_of(args, typeof(*ia), ap.args); struct fuse_io_priv *io = ia->io; ssize_t pos = -1; - - fuse_release_user_pages(&ia->ap, io->should_dirty); + size_t nres; if (err) { /* Nothing */ } else if (io->write) { if (ia->write.out.size > ia->write.in.size) { err = -EIO; - } else if (ia->write.in.size != ia->write.out.size) { - pos = ia->write.in.offset - io->offset + - ia->write.out.size; + } else { + nres = ia->write.out.size; + if (ia->write.in.size != ia->write.out.size) + pos = ia->write.in.offset - io->offset + + ia->write.out.size; } } else { u32 outsize = args->out_args[0].size; + nres = outsize; if (ia->read.in.size != outsize) pos = ia->read.in.offset - io->offset + outsize; } + fuse_release_user_pages(&ia->ap, err ?: nres, io->should_dirty); + fuse_aio_complete(io, err, pos); fuse_io_free(ia); } @@ -1368,24 +1375,37 @@ static inline size_t fuse_get_frag_size(const struct iov_iter *ii, static int fuse_get_user_pages(struct fuse_args_pages *ap, struct iov_iter *ii, size_t *nbytesp, int write, - unsigned int max_pages) + unsigned int max_pages, + bool use_pages_for_kvec_io) { + bool flush_or_invalidate = false; size_t nbytes = 0; /* # bytes already packed in req */ ssize_t ret = 0; - /* Special case for kernel I/O: can copy directly into the buffer */ + /* Special case for kernel I/O: can copy directly into the buffer. + * However if the implementation of fuse_conn requires pages instead of + * pointer (e.g., virtio-fs), use iov_iter_extract_pages() instead. + */ if (iov_iter_is_kvec(ii)) { - unsigned long user_addr = fuse_get_user_addr(ii); - size_t frag_size = fuse_get_frag_size(ii, *nbytesp); + void *user_addr = (void *)fuse_get_user_addr(ii); - if (write) - ap->args.in_args[1].value = (void *) user_addr; - else - ap->args.out_args[0].value = (void *) user_addr; + if (!use_pages_for_kvec_io) { + size_t frag_size = fuse_get_frag_size(ii, *nbytesp); - iov_iter_advance(ii, frag_size); - *nbytesp = frag_size; - return 0; + if (write) + ap->args.in_args[1].value = user_addr; + else + ap->args.out_args[0].value = user_addr; + + iov_iter_advance(ii, frag_size); + *nbytesp = frag_size; + return 0; + } + + if (is_vmalloc_addr(user_addr)) { + ap->args.vmap_base = user_addr; + flush_or_invalidate = true; + } } while (nbytes < *nbytesp && ap->num_pages < max_pages) { @@ -1411,6 +1431,10 @@ static int fuse_get_user_pages(struct fuse_args_pages *ap, struct iov_iter *ii, (PAGE_SIZE - ret) & (PAGE_SIZE - 1); } + if (write && flush_or_invalidate) + flush_kernel_vmap_range(ap->args.vmap_base, nbytes); + + ap->args.invalidate_vmap = !write && flush_or_invalidate; ap->args.user_pages = true; if (write) ap->args.in_pages = true; @@ -1478,7 +1502,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, size_t nbytes = min(count, nmax); err = fuse_get_user_pages(&ia->ap, iter, &nbytes, write, - max_pages); + max_pages, fc->use_pages_for_kvec_io); if (err && !nbytes) break; @@ -1492,7 +1516,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, } if (!io->async || nres < 0) { - fuse_release_user_pages(&ia->ap, io->should_dirty); + fuse_release_user_pages(&ia->ap, nres, io->should_dirty); fuse_io_free(ia); } ia = NULL; diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c index d84dacbdce2c..5779c7ba1e3d 100644 --- a/fs/fuse/virtio_fs.c +++ b/fs/fuse/virtio_fs.c @@ -1458,6 +1458,7 @@ static int virtio_fs_get_tree(struct fs_context *fsc) fc->delete_stale = true; fc->auto_submounts = true; fc->sync_fs = true; + fc->use_pages_for_kvec_io = true; /* Tell FUSE to split requests that exceed the virtqueue's size */ fc->max_pages_limit = min_t(unsigned int, fc->max_pages_limit, -- 2.39.2

2 5

[PATCH OLK-5.10] arm64: stacktrace: Handle 'lr' in interrupt context
by Zheng Yejian 30 Dec '24

30 Dec '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBEMJK CVE: NA -------------------------------- Suppose existing call chain: P() -> A() -> B(), B() don't construct stack frame in which fp and lr are saved for call stack unwinding, then if task1 is interrupted as running at address 'B2' and then preempted by task2, and task2 unwind the call stack of task1, it expect to see P->A->B, but actually P->B, A disappeared! A(): A1: stp fp, lr, ... <-- suppose fp_P and lr_P saved A2: mov fp, sp <-- suppose fp_A saved in 'fp' register A3: bl B <-- call to B() A4: mov ... <-- 'A4' saved in 'lr' register B(): B1: mov ... B2: mov ... <-- interrupt comes, then run into el1_irq() B3: mov ... <-- 'B3' is saved in 'elr_el1' register el1_irq(): ... <-- save registers then construct stack frame Cm: bl arm64_preempt_schedule_irq <-- Can be preempted here Cn: ... In this case, at the time interrupt comes, the address 'A4' will be saved In 'lr' register, then in interrupt entry, 'lr' register will be saved in Stack memory as struct pt_regs. See following stack memory layout, as call stack unwinding, if address 'Cn' is found , we know that fp_C is point to pt_regs.stackframe[0], then we can found the 'A4' in pt_regs.regs[30], then we can know that B() is currently called by A(). Stack memory (High address downto Low address): <High address> |-----------------| | lr_P | |-----------------| | fp_P | -> |-----------------| | | ... | | |-----------------| | | B3 | | |-----------------| -- | fp_A | -> |-----------------| <-- pt_regs.stackframe[0] | | | | | X0... fp lr(A4) | <-- pt_regs.regs[] | |-----------------| | | ... | | |-----------------| | | Cn | <-- 'Cn' is return address of | |-----------------| arm64_preempt_schedule_irq() -- | fp_C | |-----------------| <Low address> Fixes: e429c61d12bf ("livepatch/arm64: Support livepatch without ftrace") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- arch/arm64/include/asm/stacktrace.h | 3 ++ arch/arm64/kernel/entry.S | 2 + arch/arm64/kernel/stacktrace.c | 66 +++++++++++++++++++++++++++++ 3 files changed, 71 insertions(+) diff --git a/arch/arm64/include/asm/stacktrace.h b/arch/arm64/include/asm/stacktrace.h index eb29b1fe8255..dda36f917263 100644 --- a/arch/arm64/include/asm/stacktrace.h +++ b/arch/arm64/include/asm/stacktrace.h @@ -171,4 +171,7 @@ static inline void start_backtrace(struct stackframe *frame, frame->prev_type = STACK_TYPE_UNKNOWN; } +#ifdef CONFIG_PREEMPTION +extern void preempt_schedule_irq_ret_addr(void); +#endif #endif /* __ASM_STACKTRACE_H */ diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S index eb4ba8308397..1290f36c8371 100644 --- a/arch/arm64/kernel/entry.S +++ b/arch/arm64/kernel/entry.S @@ -523,6 +523,8 @@ alternative_else_nop_endif #endif cbnz x24, 1f // preempt count != 0 || NMI return path bl arm64_preempt_schedule_irq // irq en/disable is done inside +.global preempt_schedule_irq_ret_addr +preempt_schedule_irq_ret_addr: 1: #endif diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c index 2073a3a7fe75..93ac3c74fb41 100644 --- a/arch/arm64/kernel/stacktrace.c +++ b/arch/arm64/kernel/stacktrace.c @@ -129,6 +129,72 @@ void notrace walk_stackframe(struct task_struct *tsk, struct stackframe *frame, if (!fn(data, frame->pc)) break; +#ifdef CONFIG_PREEMPTION + /* + * Suppose existing call chain: P() -> A() -> B(), B() don't construct stack + * frame in which fp and lr are saved for call stack unwinding, then if task1 + * is interrupted as running at address 'B2' and then preempted by task2, + * and task2 unwind the call stack of task1, it expect to see P->A->B, but + * actually P->B, A disappeared! + * + * A(): + * A1: stp fp, lr, ... <-- suppose fp_P and lr_P saved + * A2: mov fp, sp <-- suppose fp_A saved in 'fp' register + * A3: bl B <-- call to B() + * A4: mov ... <-- 'A4' saved in 'lr' register + * + * B(): + * B1: mov ... + * B2: mov ... <-- interrupt comes, then run into el1_irq() + * B3: mov ... <-- 'B3' is saved in 'elr_el1' register + * + * el1_irq(): + * ... <-- save registers then construct stack frame + * Cm: bl arm64_preempt_schedule_irq <-- Can be preempted here + * Cn: ... + * + * In this case, at the time interrupt comes, the address 'A4' will be saved + * In 'lr' register, then in interrupt entry, 'lr' register will be saved in + * Stack memory as struct pt_regs. + * + * See following stack memory layout, as call stack unwinding, if address + * 'Cn' is found , we know that fp_C is point to pt_regs.stackframe[0], + * then we can found the 'A4' in pt_regs.regs[30], then we can know that + * B() is currently called by A(). + * + * Stack memory (High address downto Low address): + * + * <High address> + * |-----------------| + * | lr_P | + * |-----------------| + * | fp_P | + * -> |-----------------| + * | | ... | + * | |-----------------| + * | | B3 | + * | |-----------------| + * -- | fp_A | + * -> |-----------------| <-- pt_regs.stackframe[0] + * | | | + * | | X0... fp lr(A4) | <-- pt_regs.regs[] + * | |-----------------| + * | | ... | + * | |-----------------| + * | | Cn | <-- 'Cn' is return address of + * | |-----------------| arm64_preempt_schedule_irq() + * -- | fp_C | + * |-----------------| + * <Low address> + */ + if (frame->pc == (unsigned long)preempt_schedule_irq_ret_addr) { + struct pt_regs *reg = container_of((u64 *)frame->fp, + struct pt_regs, stackframe[0]); + + if (!fn(data, reg->regs[30])) + break; + } +#endif ret = unwind_frame(tsk, frame); if (ret < 0) break; -- 2.25.1

2 5

[PATCH openEuler-1.0-LTS] printk: Skip log flush in NMI context when logbuf_lock is held
by Xiaomeng Zhang 30 Dec '24

30 Dec '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB963V CVE: NA -------------------------------- In nmi_trigger_cpumask_backtrace(), printk_safe_flush() is called after sending NMI to flush the logs. When logbuf_lock is already held and the current CPU is in printk-safe context (e.g., NMI context), attempting to acquire the lock again can lead to deadlock. Modify the function to return early when detecting logbuf_lock is held and current CPU is in printk-safe context. This prevents deadlock scenarios where CPU0 holds the lock while other CPUs try to acquire it in NMI context. Fixes: 099f1c84c005 ("printk: introduce per-cpu safe_print seq buffer") Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/printk/printk_safe.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/printk/printk_safe.c b/kernel/printk/printk_safe.c index 809f92492ec7..c97845688fe1 100644 --- a/kernel/printk/printk_safe.c +++ b/kernel/printk/printk_safe.c @@ -256,6 +256,10 @@ void printk_safe_flush(void) { int cpu; + if (raw_spin_is_locked(&logbuf_lock) && + (this_cpu_read(printk_context) & PRINTK_SAFE_CONTEXT_MASK)) + return; + for_each_possible_cpu(cpu) { #ifdef CONFIG_PRINTK_NMI __printk_safe_flush(&per_cpu(nmi_print_seq, cpu).work); -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] printk: Skip log flush in NMI context when logbuf_lock is held
by Xiaomeng Zhang 30 Dec '24

30 Dec '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB963V CVE: NA -------------------------------- In nmi_trigger_cpumask_backtrace(), printk_safe_flush() is called after sending NMI to flush the logs. When logbuf_lock is already held and the current CPU is in printk-safe context (e.g., NMI context), attempting to acquire the lock again can lead to deadlock. Modify the function to return early when detecting logbuf_lock is held and current CPU is in printk-safe context. This prevents deadlock scenarios where CPU0 holds the lock while other CPUs try to acquire it in NMI context. Fixes: 099f1c84c005 ("printk: introduce per-cpu safe_print seq buffer") Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/printk/printk_safe.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/printk/printk_safe.c b/kernel/printk/printk_safe.c index 809f92492ec7..c97845688fe1 100644 --- a/kernel/printk/printk_safe.c +++ b/kernel/printk/printk_safe.c @@ -256,6 +256,10 @@ void printk_safe_flush(void) { int cpu; + if (raw_spin_is_locked(&logbuf_lock) && + (this_cpu_read(printk_context) & PRINTK_SAFE_CONTEXT_MASK)) + return; + for_each_possible_cpu(cpu) { #ifdef CONFIG_PRINTK_NMI __printk_safe_flush(&per_cpu(nmi_print_seq, cpu).work); -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1] io_uring: check if iowq is killed before queuing
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v6.6.68 commit 2ca94c8de36091067b9ce7527ae8db3812d38781 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEG43 CVE: CVE-2024-56709 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dbd2ca9367eb19bc5e269b8c58b0b1514ada9156 upstream. task work can be executed after the task has gone through io_uring termination, whether it's the final task_work run or the fallback path. In this case, task work will find ->io_wq being already killed and null'ed, which is a problem if it then tries to forward the request to io_queue_iowq(). Make io_queue_iowq() fail requests in this case. Note that it also checks PF_KTHREAD, because the user can first close a DEFER_TASKRUN ring and shortly after kill the task, in which case ->iowq check would race. Cc: stable(a)vger.kernel.org Fixes: 50c52250e2d74 ("block: implement async io_uring discard cmd") Fixes: 773af69121ecc ("io_uring: always reissue from task_work context") Reported-by: Will <willsroot(a)protonmail.com> Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/63312b4a2c2bb67ad67b857d17a300e1d3b078e8.17346379… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- io_uring/io_uring.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 4d69fb4cf803..bb37e8f08ae5 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -1090,6 +1090,7 @@ static struct file *io_file_get(struct io_ring_ctx *ctx, unsigned int issue_flags); static void __io_queue_sqe(struct io_kiocb *req); static void io_rsrc_put_work(struct work_struct *work); +static void io_req_task_queue_fail(struct io_kiocb *req, int ret); static void io_req_task_queue(struct io_kiocb *req); static void io_submit_flush_completions(struct io_ring_ctx *ctx); @@ -1459,7 +1460,11 @@ static void io_queue_async_work(struct io_kiocb *req, bool *locked) locked = NULL; BUG_ON(!tctx); - BUG_ON(!tctx->io_wq); + + if ((current->flags & PF_KTHREAD) || !tctx->io_wq) { + io_req_task_queue_fail(req, -ECANCELED); + return; + } /* init ->work of the whole link before punting */ io_prep_async_link(req); -- 2.39.2

2 5

[PATCH OLK-5.10] io_uring: check if iowq is killed before queuing
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v6.6.68 commit 2ca94c8de36091067b9ce7527ae8db3812d38781 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEG43 CVE: CVE-2024-56709 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dbd2ca9367eb19bc5e269b8c58b0b1514ada9156 upstream. task work can be executed after the task has gone through io_uring termination, whether it's the final task_work run or the fallback path. In this case, task work will find ->io_wq being already killed and null'ed, which is a problem if it then tries to forward the request to io_queue_iowq(). Make io_queue_iowq() fail requests in this case. Note that it also checks PF_KTHREAD, because the user can first close a DEFER_TASKRUN ring and shortly after kill the task, in which case ->iowq check would race. Cc: stable(a)vger.kernel.org Fixes: 50c52250e2d74 ("block: implement async io_uring discard cmd") Fixes: 773af69121ecc ("io_uring: always reissue from task_work context") Reported-by: Will <willsroot(a)protonmail.com> Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/63312b4a2c2bb67ad67b857d17a300e1d3b078e8.17346379… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- io_uring/io_uring.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 6e5e00a7692c..3a1eee5bac77 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -1096,6 +1096,7 @@ static struct file *io_file_get(struct io_ring_ctx *ctx, unsigned int issue_flags); static void __io_queue_sqe(struct io_kiocb *req); static void io_rsrc_put_work(struct work_struct *work); +static void io_req_task_queue_fail(struct io_kiocb *req, int ret); static void io_req_task_queue(struct io_kiocb *req); static void io_submit_flush_completions(struct io_ring_ctx *ctx); @@ -1465,7 +1466,11 @@ static void io_queue_async_work(struct io_kiocb *req, bool *locked) locked = NULL; BUG_ON(!tctx); - BUG_ON(!tctx->io_wq); + + if ((current->flags & PF_KTHREAD) || !tctx->io_wq) { + io_req_task_queue_fail(req, -ECANCELED); + return; + } /* init ->work of the whole link before punting */ io_prep_async_link(req); -- 2.39.2

2 5

[PATCH OLK-6.6] drm/loongson: compile loongson drm driver as module
by Hongchen Zhang 30 Dec '24

30 Dec '24

LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB8U6Q CVE: NA -------------------------------- loongson drm driver will not be used in the future, use loongson drm dkms package instead. Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/configs/loongson3_defconfig | 4 ++-- drivers/gpu/drm/Makefile | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/loongarch/configs/loongson3_defconfig b/arch/loongarch/configs/loongson3_defconfig index d39551df782b..0b8f8b23b7de 100644 --- a/arch/loongarch/configs/loongson3_defconfig +++ b/arch/loongarch/configs/loongson3_defconfig @@ -1471,11 +1471,11 @@ CONFIG_DRM_AMDGPU_USERPTR=y CONFIG_DRM_NOUVEAU=m CONFIG_DRM_VKMS=m CONFIG_DRM_UDL=m -CONFIG_DRM_AST_LOONGSON=y CONFIG_DRM_MGAG200=m CONFIG_DRM_QXL=m CONFIG_DRM_VIRTIO_GPU=m -CONFIG_DRM_LOONGSON=y +CONFIG_DRM_LOONGSON=m +CONFIG_DRM_AST_LOONGSON=y CONFIG_DRM_BOCHS=m CONFIG_DRM_CIRRUS_QEMU=m CONFIG_FB=y diff --git a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile index b120267fbe40..7ba2ec90c3f7 100644 --- a/drivers/gpu/drm/Makefile +++ b/drivers/gpu/drm/Makefile @@ -197,6 +197,6 @@ obj-y += gud/ obj-$(CONFIG_DRM_HYPERV) += hyperv/ obj-y += solomon/ obj-$(CONFIG_DRM_SPRD) += sprd/ -obj-$(CONFIG_DRM_LOONGSON) += loongson/ +obj-y += loongson/ obj-$(CONFIG_DRM_PHYTIUM) += phytium/ obj-$(CONFIG_HYDCU_FIXUP_HEADER) += hygon/hydcu-fixup-header/ -- 2.33.0

2 5

[PATCH OLK-6.6] LoongArch: Add CPU HWMon platform driver
by Hongchen Zhang 30 Dec '24

30 Dec '24

From: gaojuxin <gaojuxin(a)loongson.cn> LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBEN7V CVE: NA -------------------------------- This add CPU HWMon (temperature sensor) platform driver for Loongson-3. Change-Id: I1d4c0e0a305f25f2b1ddfe27f371b40fa1689f9e Tested-by: Xi Ruoyao <xry111(a)xry111.site> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Kexy Biscuit <kexybiscuit(a)aosc.io> Signed-off-by: gaojuxin <gaojuxin(a)loongson.cn> --- drivers/platform/loongarch/Kconfig | 8 + drivers/platform/loongarch/Makefile | 1 + drivers/platform/loongarch/cpu_hwmon.c | 194 +++++++++++++++++++++++++ 3 files changed, 203 insertions(+) create mode 100644 drivers/platform/loongarch/cpu_hwmon.c diff --git a/drivers/platform/loongarch/Kconfig b/drivers/platform/loongarch/Kconfig index 5633e4d73991..9ec1a86ef7fa 100644 --- a/drivers/platform/loongarch/Kconfig +++ b/drivers/platform/loongarch/Kconfig @@ -16,6 +16,14 @@ menuconfig LOONGARCH_PLATFORM_DEVICES if LOONGARCH_PLATFORM_DEVICES +config CPU_HWMON + bool "Loongson CPU HWMon Driver" + depends on MACH_LOONGSON64 + select HWMON + default y + help + Loongson-3A/3B/3C CPU HWMon (temperature sensor) driver. + config LOONGSON_LAPTOP tristate "Generic Loongson-3 Laptop Driver" depends on ACPI diff --git a/drivers/platform/loongarch/Makefile b/drivers/platform/loongarch/Makefile index f43ab03db1a2..695688bed423 100644 --- a/drivers/platform/loongarch/Makefile +++ b/drivers/platform/loongarch/Makefile @@ -1 +1,2 @@ obj-$(CONFIG_LOONGSON_LAPTOP) += loongson-laptop.o +obj-$(CONFIG_CPU_HWMON) += cpu_hwmon.o diff --git a/drivers/platform/loongarch/cpu_hwmon.c b/drivers/platform/loongarch/cpu_hwmon.c new file mode 100644 index 000000000000..93a05993745a --- /dev/null +++ b/drivers/platform/loongarch/cpu_hwmon.c @@ -0,0 +1,194 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2022 Loongson Technology Corporation Limited + */ +#include <linux/module.h> +#include <linux/reboot.h> +#include <linux/jiffies.h> +#include <linux/hwmon.h> +#include <linux/hwmon-sysfs.h> + +#include <asm/loongson.h> + +static int nr_packages; +static struct device *cpu_hwmon_dev; + +static int loongson3_cpu_temp(int cpu) +{ + u32 reg; + + reg = iocsr_read32(LOONGARCH_IOCSR_CPUTEMP) & 0xff; + + return (int)((s8)reg) * 1000; +} + +static ssize_t cpu_temp_label(struct device *dev, + struct device_attribute *attr, char *buf) +{ + int id = (to_sensor_dev_attr(attr))->index - 1; + return sprintf(buf, "CPU %d Temperature\n", id); +} + +static ssize_t get_cpu_temp(struct device *dev, + struct device_attribute *attr, char *buf) +{ + int id = (to_sensor_dev_attr(attr))->index - 1; + int value = loongson3_cpu_temp(id); + return sprintf(buf, "%d\n", value); +} + +static SENSOR_DEVICE_ATTR(temp1_input, 0444, get_cpu_temp, NULL, 1); +static SENSOR_DEVICE_ATTR(temp1_label, 0444, cpu_temp_label, NULL, 1); +static SENSOR_DEVICE_ATTR(temp2_input, 0444, get_cpu_temp, NULL, 2); +static SENSOR_DEVICE_ATTR(temp2_label, 0444, cpu_temp_label, NULL, 2); +static SENSOR_DEVICE_ATTR(temp3_input, 0444, get_cpu_temp, NULL, 3); +static SENSOR_DEVICE_ATTR(temp3_label, 0444, cpu_temp_label, NULL, 3); +static SENSOR_DEVICE_ATTR(temp4_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp4_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp5_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp5_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp6_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp6_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp7_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp7_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp8_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp8_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp9_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp9_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp10_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp10_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp11_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp11_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp12_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp12_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp13_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp13_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp14_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp14_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp15_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp15_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp16_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp16_label, 0444, cpu_temp_label, NULL, 4); + +static struct attribute *cpu_hwmon_attributes[] = { + &sensor_dev_attr_temp1_input.dev_attr.attr, + &sensor_dev_attr_temp1_label.dev_attr.attr, + &sensor_dev_attr_temp2_input.dev_attr.attr, + &sensor_dev_attr_temp2_label.dev_attr.attr, + &sensor_dev_attr_temp3_input.dev_attr.attr, + &sensor_dev_attr_temp3_label.dev_attr.attr, + &sensor_dev_attr_temp4_input.dev_attr.attr, + &sensor_dev_attr_temp4_label.dev_attr.attr, + &sensor_dev_attr_temp5_input.dev_attr.attr, + &sensor_dev_attr_temp5_label.dev_attr.attr, + &sensor_dev_attr_temp6_input.dev_attr.attr, + &sensor_dev_attr_temp6_label.dev_attr.attr, + &sensor_dev_attr_temp7_input.dev_attr.attr, + &sensor_dev_attr_temp7_label.dev_attr.attr, + &sensor_dev_attr_temp8_input.dev_attr.attr, + &sensor_dev_attr_temp8_label.dev_attr.attr, + &sensor_dev_attr_temp9_input.dev_attr.attr, + &sensor_dev_attr_temp9_label.dev_attr.attr, + &sensor_dev_attr_temp10_input.dev_attr.attr, + &sensor_dev_attr_temp10_label.dev_attr.attr, + &sensor_dev_attr_temp11_input.dev_attr.attr, + &sensor_dev_attr_temp11_label.dev_attr.attr, + &sensor_dev_attr_temp12_input.dev_attr.attr, + &sensor_dev_attr_temp12_label.dev_attr.attr, + &sensor_dev_attr_temp13_input.dev_attr.attr, + &sensor_dev_attr_temp13_label.dev_attr.attr, + &sensor_dev_attr_temp14_input.dev_attr.attr, + &sensor_dev_attr_temp14_label.dev_attr.attr, + &sensor_dev_attr_temp15_input.dev_attr.attr, + &sensor_dev_attr_temp15_label.dev_attr.attr, + &sensor_dev_attr_temp16_input.dev_attr.attr, + &sensor_dev_attr_temp16_label.dev_attr.attr, + NULL +}; +static umode_t cpu_hwmon_is_visible(struct kobject *kobj, + struct attribute *attr, int i) +{ + int id = i / 2; + + if (id < nr_packages) + return attr->mode; + return 0; +} + +static struct attribute_group cpu_hwmon_group = { + .attrs = cpu_hwmon_attributes, + .is_visible = cpu_hwmon_is_visible, +}; + +static const struct attribute_group *cpu_hwmon_groups[] = { + &cpu_hwmon_group, + NULL +}; + +static int cpu_initial_threshold = 72000; +static int cpu_thermal_threshold = 96000; +module_param(cpu_thermal_threshold, int, 0644); +MODULE_PARM_DESC(cpu_thermal_threshold, "cpu thermal threshold (96000 (default))"); + +static struct delayed_work thermal_work; + +static void do_thermal_timer(struct work_struct *work) +{ + int i, value, temp_max = 0; + + for (i=0; i<nr_packages; i++) { + value = loongson3_cpu_temp(i); + if (value > temp_max) + temp_max = value; + } + + if (temp_max <= cpu_thermal_threshold) + schedule_delayed_work(&thermal_work, msecs_to_jiffies(5000)); + else + orderly_poweroff(true); +} + +static int __init loongson_hwmon_init(void) +{ + int i, value, temp_max = 0; + + pr_info("Loongson Hwmon Enter...\n"); + + nr_packages = loongson_sysconf.nr_cpus / + loongson_sysconf.cores_per_package; + + cpu_hwmon_dev = hwmon_device_register_with_groups(NULL, "cpu_hwmon", + NULL, cpu_hwmon_groups); + if (IS_ERR(cpu_hwmon_dev)) { + pr_err("Hwmon register fail with %ld!\n", PTR_ERR(cpu_hwmon_dev)); + return PTR_ERR(cpu_hwmon_dev); + } + + for (i = 0; i < nr_packages; i++) { + value = loongson3_cpu_temp(i); + if (value > temp_max) + temp_max = value; + } + + pr_info("Initial CPU temperature is %d (highest).\n", temp_max); + if (temp_max > cpu_initial_threshold) + cpu_thermal_threshold += temp_max - cpu_initial_threshold; + + INIT_DEFERRABLE_WORK(&thermal_work, do_thermal_timer); + schedule_delayed_work(&thermal_work, msecs_to_jiffies(20000)); + + return 0; +} + +static void __exit loongson_hwmon_exit(void) +{ + cancel_delayed_work_sync(&thermal_work); + hwmon_device_unregister(cpu_hwmon_dev); +} + +module_init(loongson_hwmon_init); +module_exit(loongson_hwmon_exit); + +MODULE_AUTHOR("Huacai Chen <chenhuacai(a)loongson.cn>"); +MODULE_DESCRIPTION("Loongson CPU Hwmon driver"); +MODULE_LICENSE("GPL"); -- 2.33.0

2 1

[openeuler:openEuler-1.0-LTS 1356/1356] drivers/mfd/rohm-bd718x7.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 30 Dec '24

30 Dec '24

Hi Matti, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 30107fa6908b6c2747ee9100b40af813f99483c3 [1356/1356] mfd: bd71837: Core driver for ROHM BD71837 PMIC config: x86_64-buildonly-randconfig-003-20241228 (https://download.01.org/0day-ci/archive/20241230/202412301525.GctcPXAM-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241230/202412301525.GctcPXAM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412301525.GctcPXAM-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/mfd/rohm-bd718x7.c:15: include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'bd71837_i2c_exit': 'cold' [-Wmissing-attributes] 138 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ drivers/mfd/rohm-bd718x7.c:207:1: note: in expansion of macro 'module_exit' 207 | module_exit(bd71837_i2c_exit); | ^~~~~~~~~~~ drivers/mfd/rohm-bd718x7.c:203:20: note: 'cleanup_module' target declared here 203 | static void __exit bd71837_i2c_exit(void) | ^~~~~~~~~~~~~~~~ include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'bd71837_i2c_init': 'cold' [-Wmissing-attributes] 132 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/module.h:115:41: note: in expansion of macro 'module_init' 115 | #define subsys_initcall(fn) module_init(fn) | ^~~~~~~~~~~ drivers/mfd/rohm-bd718x7.c:201:1: note: in expansion of macro 'subsys_initcall' 201 | subsys_initcall(bd71837_i2c_init); | ^~~~~~~~~~~~~~~ drivers/mfd/rohm-bd718x7.c:195:19: note: 'init_module' target declared here 195 | static int __init bd71837_i2c_init(void) | ^~~~~~~~~~~~~~~~ >> drivers/mfd/rohm-bd718x7.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] printk: Skip log flush in NMI context when logbuf_lock is held
by Xiaomeng Zhang 30 Dec '24

30 Dec '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB963V CVE: NA -------------------------------- In nmi_trigger_cpumask_backtrace(), printk_safe_flush() is called after sending NMI to flush the logs. When logbuf_lock is already held and the current CPU is in printk-safe context (e.g., NMI context), attempting to acquire the lock again can lead to deadlock. Modify the function to return early when detecting logbuf_lock is held and current CPU is in printk-safe context. This prevents deadlock scenarios where CPU0 holds the lock while other CPUs try to acquire it in NMI context. Fixes: 099f1c84c005 ("printk: introduce per-cpu safe_print seq buffer") Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/printk/printk_safe.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/printk/printk_safe.c b/kernel/printk/printk_safe.c index 809f92492ec7..c97845688fe1 100644 --- a/kernel/printk/printk_safe.c +++ b/kernel/printk/printk_safe.c @@ -256,6 +256,10 @@ void printk_safe_flush(void) { int cpu; + if (raw_spin_is_locked(&logbuf_lock) && + (this_cpu_read(printk_context) & PRINTK_SAFE_CONTEXT_MASK)) + return; + for_each_possible_cpu(cpu) { #ifdef CONFIG_PRINTK_NMI __printk_safe_flush(&per_cpu(nmi_print_seq, cpu).work); -- 2.34.1

2 5

[PATCH OLK-6.6] crypto: qat/qat_420xx - fix off by one in uof_get_name()
by Ye Bin 30 Dec '24

30 Dec '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.13-rc1 commit 93a11608fb3720e1bc2b19a2649ac2b49cca1921 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGV CVE: CVE-2024-53163 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- This is called from uof_get_name_420xx() where "num_objs" is the ARRAY_SIZE() of fw_objs[]. The > needs to be >= to prevent an out of bounds access. Fixes: fcf60f4bcf54 ("crypto: qat - add support for 420xx devices") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Acked-by: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c b/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c index 78f0ea49254d..9faef33e54bd 100644 --- a/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c +++ b/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c @@ -375,7 +375,7 @@ static const char *uof_get_name(struct adf_accel_dev *accel_dev, u32 obj_num, else id = -EINVAL; - if (id < 0 || id > num_objs) + if (id < 0 || id >= num_objs) return NULL; return fw_objs[id]; -- 2.34.1

2 1

[PATCH OLK-6.6] EDAC/igen6: Avoid segmentation fault on module unload
by Ye Bin 30 Dec '24

30 Dec '24

From: Orange Kao <orange(a)aiven.io> stable inclusion from stable-v6.6.64 commit 830cabb61113d92a425dd3038ccedbdfb3c8d079 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBEDPH CVE: CVE-2024-56708 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fefaae90398d38a1100ccd73b46ab55ff4610fba ] The segmentation fault happens because: During modprobe: 1. In igen6_probe(), igen6_pvt will be allocated with kzalloc() 2. In igen6_register_mci(), mci->pvt_info will point to &igen6_pvt->imc[mc] During rmmod: 1. In mci_release() in edac_mc.c, it will kfree(mci->pvt_info) 2. In igen6_remove(), it will kfree(igen6_pvt); Fix this issue by setting mci->pvt_info to NULL to avoid the double kfree. Fixes: 10590a9d4f23 ("EDAC/igen6: Add EDAC driver for Intel client SoCs using IBECC") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219360 Signed-off-by: Orange Kao <orange(a)aiven.io> Signed-off-by: Tony Luck <tony.luck(a)intel.com> Link: https://lore.kernel.org/r/20241104124237.124109-2-orange@aiven.io Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/edac/igen6_edac.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c index a0edb61a5a01..0b408299699a 100644 --- a/drivers/edac/igen6_edac.c +++ b/drivers/edac/igen6_edac.c @@ -1075,6 +1075,7 @@ static int igen6_register_mci(int mc, u64 mchbar, struct pci_dev *pdev) imc->mci = mci; return 0; fail3: + mci->pvt_info = NULL; kfree(mci->ctl_name); fail2: edac_mc_free(mci); @@ -1099,6 +1100,7 @@ static void igen6_unregister_mcis(void) edac_mc_del_mc(mci->pdev); kfree(mci->ctl_name); + mci->pvt_info = NULL; edac_mc_free(mci); iounmap(imc->window); } -- 2.34.1

2 1

[PATCH OLK-6.6] io_uring: check if iowq is killed before queuing
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v6.6.68 commit 2ca94c8de36091067b9ce7527ae8db3812d38781 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEG43 CVE: CVE-2024-56709 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dbd2ca9367eb19bc5e269b8c58b0b1514ada9156 upstream. task work can be executed after the task has gone through io_uring termination, whether it's the final task_work run or the fallback path. In this case, task work will find ->io_wq being already killed and null'ed, which is a problem if it then tries to forward the request to io_queue_iowq(). Make io_queue_iowq() fail requests in this case. Note that it also checks PF_KTHREAD, because the user can first close a DEFER_TASKRUN ring and shortly after kill the task, in which case ->iowq check would race. Cc: stable(a)vger.kernel.org Fixes: 50c52250e2d74 ("block: implement async io_uring discard cmd") Fixes: 773af69121ecc ("io_uring: always reissue from task_work context") Reported-by: Will <willsroot(a)protonmail.com> Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/63312b4a2c2bb67ad67b857d17a300e1d3b078e8.17346379… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- io_uring/io_uring.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 69f5b73a609e..65dc2e344004 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -498,7 +498,11 @@ void io_queue_iowq(struct io_kiocb *req, struct io_tw_state *ts_dont_use) struct io_uring_task *tctx = req->task->io_uring; BUG_ON(!tctx); - BUG_ON(!tctx->io_wq); + + if ((current->flags & PF_KTHREAD) || !tctx->io_wq) { + io_req_task_queue_fail(req, -ECANCELED); + return; + } /* init ->work of the whole link before punting */ io_prep_async_link(req); -- 2.39.2

2 1

[PATCH OLK-5.10] EDAC/bluefield: Fix potential integer overflow
by liukai 30 Dec '24

30 Dec '24

From: David Thompson <davthompson(a)nvidia.com> stable inclusion from stable-v5.10.231 commit e0269ea7a628fdeddd65b92fe29c09655dbb80b9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGU CVE: CVE-2024-53161 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 1fe774a93b46bb029b8f6fa9d1f25affa53f06c6 ] The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as 32-bits wide the left-shift operation truncates the upper 16 bits of information during the calculation of the SMC argument. The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits. Fixes: 82413e562ea6 ("EDAC, mellanox: Add ECC support for BlueField DDR4") Signed-off-by: David Thompson <davthompson(a)nvidia.com> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Shravan Kumar Ramani <shravankr(a)nvidia.com> Link: https://lore.kernel.org/r/20240930151056.10158-1-davthompson@nvidia.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/edac/bluefield_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/edac/bluefield_edac.c b/drivers/edac/bluefield_edac.c index e4736eb37bfb..0ef048982768 100644 --- a/drivers/edac/bluefield_edac.c +++ b/drivers/edac/bluefield_edac.c @@ -180,7 +180,7 @@ static void bluefield_edac_check(struct mem_ctl_info *mci) static void bluefield_edac_init_dimms(struct mem_ctl_info *mci) { struct bluefield_edac_priv *priv = mci->pvt_info; - int mem_ctrl_idx = mci->mc_idx; + u64 mem_ctrl_idx = mci->mc_idx; struct dimm_info *dimm; u64 smc_info, smc_arg; int is_empty = 1, i; -- 2.34.1

2 1

[PATCH OLK-6.6] EDAC/bluefield: Fix potential integer overflow
by liukai 30 Dec '24

30 Dec '24

From: David Thompson <davthompson(a)nvidia.com> stable inclusion from stable-v6.6.64 commit ac6ebb9edcdb7077e841862c402697c4c48a7c0a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGU CVE: CVE-2024-53161 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 1fe774a93b46bb029b8f6fa9d1f25affa53f06c6 ] The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as 32-bits wide the left-shift operation truncates the upper 16 bits of information during the calculation of the SMC argument. The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits. Fixes: 82413e562ea6 ("EDAC, mellanox: Add ECC support for BlueField DDR4") Signed-off-by: David Thompson <davthompson(a)nvidia.com> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Shravan Kumar Ramani <shravankr(a)nvidia.com> Link: https://lore.kernel.org/r/20240930151056.10158-1-davthompson@nvidia.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/edac/bluefield_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/edac/bluefield_edac.c b/drivers/edac/bluefield_edac.c index e4736eb37bfb..0ef048982768 100644 --- a/drivers/edac/bluefield_edac.c +++ b/drivers/edac/bluefield_edac.c @@ -180,7 +180,7 @@ static void bluefield_edac_check(struct mem_ctl_info *mci) static void bluefield_edac_init_dimms(struct mem_ctl_info *mci) { struct bluefield_edac_priv *priv = mci->pvt_info; - int mem_ctrl_idx = mci->mc_idx; + u64 mem_ctrl_idx = mci->mc_idx; struct dimm_info *dimm; u64 smc_info, smc_arg; int is_empty = 1, i; -- 2.34.1

2 1

[PATCH OLK-6.6] clk: clk-apple-nco: Add NULL check in applnco_probe
by liukai 30 Dec '24

30 Dec '24

From: Charles Han <hanchunchao(a)inspur.com> stable inclusion from stable-v6.6.64 commit 72ea9a7e9e260aa39f9d1c9254cf92adfb05c4f5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGX CVE: CVE-2024-53154 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 969c765e2b508cca9099d246c010a1e48dcfd089 ] Add NULL check in applnco_probe, to handle kernel NULL pointer dereference error. Fixes: 6641057d5dba ("clk: clk-apple-nco: Add driver for Apple NCO") Signed-off-by: Charles Han <hanchunchao(a)inspur.com> Link: https://lore.kernel.org/r/20241114072820.3071-1-hanchunchao@inspur.com Reviewed-by: Martin Povišer <povik+lin(a)cutebit.org> Signed-off-by: Stephen Boyd <sboyd(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed—off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/clk/clk-apple-nco.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/clk/clk-apple-nco.c b/drivers/clk/clk-apple-nco.c index 39472a51530a..457a48d48941 100644 --- a/drivers/clk/clk-apple-nco.c +++ b/drivers/clk/clk-apple-nco.c @@ -297,6 +297,9 @@ static int applnco_probe(struct platform_device *pdev) memset(&init, 0, sizeof(init)); init.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s-%d", np->name, i); + if (!init.name) + return -ENOMEM; + init.ops = &applnco_ops; init.parent_data = &pdata; init.num_parents = 1; -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-53217
by Li Lingfeng 30 Dec '24

30 Dec '24

Chuck Lever (1): NFSD: Prevent NULL dereference in nfsd4_process_cb_update() NeilBrown (1): nfsd: restore callback functionality for NFSv4.0 fs/nfsd/nfs4callback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.31.1

2 3

[PATCH OLK-6.6 0/2] CVE-2024-53217
by Li Lingfeng 30 Dec '24

30 Dec '24

Chuck Lever (1): NFSD: Prevent NULL dereference in nfsd4_process_cb_update() NeilBrown (1): nfsd: restore callback functionality for NFSv4.0 fs/nfsd/nfs4callback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.31.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-53217
by Li Lingfeng 30 Dec '24

30 Dec '24

Chuck Lever (1): NFSD: Prevent NULL dereference in nfsd4_process_cb_update() NeilBrown (1): nfsd: restore callback functionality for NFSv4.0 fs/nfsd/nfs4callback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.31.1

2 3

[PATCH openEuler-1.0-LTS] nfs: nfs4_callback_compound should put client with async mode
by Li Lingfeng 30 Dec '24

30 Dec '24

From: Yang Erkun <yangerkun(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB4H3O CVE: NA -------------------------------- Our syztester report hungtask as below: INFO: task NFSv4 callback:93188 blocked for more than 1310 seconds. Not tainted 5.10.0-00574-gc310db27923f-dirty #16 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:NFSv4 callback state:D stack: 0 pid:93188 ppid: 2 flags:0x00000208 Call trace: __switch_to+0x98/0xdc arch/arm64/kernel/process.c:639 context_switch kernel/sched/core.c:4055 [inline] __schedule+0x690/0xf0c kernel/sched/core.c:5003 schedule+0xd8/0x220 kernel/sched/core.c:5139 schedule_timeout+0x390/0x42c kernel/time/timer.c:2126 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common+0x148/0x240 kernel/sched/completion.c:117 wait_for_completion+0x20/0x30 kernel/sched/completion.c:138 kthread_stop+0xf8/0x39c kernel/kthread.c:671 svc_stop_kthreads+0x138/0x260 net/sunrpc/svc.c:797 svc_set_num_threads+0xc8/0xe4 net/sunrpc/svc.c:818 nfs_callback_down+0x120/0x200 fs/nfs/callback.c:325 nfs4_destroy_callback fs/nfs/nfs4client.c:279 [inline] nfs4_shutdown_client+0x138/0x150 fs/nfs/nfs4client.c:287 nfs4_free_client+0x20/0x40 fs/nfs/nfs4client.c:303 nfs_put_client+0x238/0x340 fs/nfs/client.c:273 nfs4_callback_compound+0x2cc/0x630 fs/nfs/callback_xdr.c:981 nfs_callback_dispatch+0x44/0x6c fs/nfs/callback_xdr.c:995 svc_process_common+0x9a0/0xdf0 net/sunrpc/svc.c:1400 svc_process+0x138/0x1c4 net/sunrpc/svc.c:1542 nfs4_callback_svc+0x58/0x90 fs/nfs/callback.c:89 kthread+0x1e0/0x220 kernel/kthread.c:328 ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:1727 When cl_count for nfs_client down to zero, nfs_put_client will trigger nfs4_free_client, then svc_set_num_threads in nfs_callback_down will signal all callback threads and wait until they success exist. So if the last cl_count was put from nfs4_callback_compound, we will deadlock. Fix it using async mode to do this. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> Conflicts: fs/nfs/callback_xdr.c fs/nfs/internal.h [Commit 2bb50aabb6f3("NFS4: Report callback authentication errors") separates the judgment of cps.clp and check_gss_callback_principal; commit 10b7a70cbb81("NFS: Cleanup - add nfs_clients_exit to mirror nfs_clients_init") remove nfs_cleanup_cb_ident_idr from fs/nfs/internal.h.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/nfs/callback_xdr.c | 6 +++--- fs/nfs/client.c | 33 +++++++++++++++++++++++++++++++++ fs/nfs/internal.h | 1 + include/linux/nfs_fs_sb.h | 1 + 4 files changed, 38 insertions(+), 3 deletions(-) diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c index 2f84c612838c..2d7dd9b65a8c 100644 --- a/fs/nfs/callback_xdr.c +++ b/fs/nfs/callback_xdr.c @@ -952,7 +952,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp) cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident); if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) { if (cps.clp) - nfs_put_client(cps.clp); + nfs_async_put_client(cps.clp); goto out_invalidcred; } } @@ -962,7 +962,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp) hdr_res.tag = hdr_arg.tag; if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) { if (cps.clp) - nfs_put_client(cps.clp); + nfs_async_put_client(cps.clp); return rpc_system_err; } while (status == 0 && nops != hdr_arg.nops) { @@ -982,7 +982,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp) *hdr_res.status = status; *hdr_res.nops = htonl(nops); nfs4_cb_free_slot(&cps); - nfs_put_client(cps.clp); + nfs_async_put_client(cps.clp); return rpc_success; out_invalidcred: diff --git a/fs/nfs/client.c b/fs/nfs/client.c index 7d02dc52209d..a05ee74d6443 100644 --- a/fs/nfs/client.c +++ b/fs/nfs/client.c @@ -283,6 +283,39 @@ void nfs_put_client(struct nfs_client *clp) } EXPORT_SYMBOL_GPL(nfs_put_client); +static void nfs_free_client_work(struct work_struct *work) +{ + struct nfs_client *clp = + container_of(work, struct nfs_client, free_work); + + clp->rpc_ops->free_client(clp); +} + +/* + * Similar to nfs_put_client, but call free_client with async mode + */ +void nfs_async_put_client(struct nfs_client *clp) +{ + struct nfs_net *nn; + + if (!clp) + return; + + nn = net_generic(clp->cl_net, nfs_net_id); + + if (refcount_dec_and_lock(&clp->cl_count, &nn->nfs_client_lock)) { + list_del(&clp->cl_share_link); + nfs_cb_idr_remove_locked(clp); + spin_unlock(&nn->nfs_client_lock); + + WARN_ON_ONCE(!list_empty(&clp->cl_superblocks)); + + INIT_WORK(&clp->free_work, nfs_free_client_work); + queue_work(nfsiod_workqueue, &clp->free_work); + } +} +EXPORT_SYMBOL_GPL(nfs_async_put_client); + /* * Find an nfs_client on the list that matches the initialisation data * that is supplied. diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h index ad938771813c..44ca5300e6e2 100644 --- a/fs/nfs/internal.h +++ b/fs/nfs/internal.h @@ -180,6 +180,7 @@ void nfs_server_copy_userdata(struct nfs_server *, struct nfs_server *); extern void nfs_cleanup_cb_ident_idr(struct net *); extern void nfs_put_client(struct nfs_client *); +extern void nfs_async_put_client(struct nfs_client *clp); extern void nfs_free_client(struct nfs_client *); extern struct nfs_client *nfs4_find_client_ident(struct net *, int); extern struct nfs_client * diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h index 7023ae64e3d7..14a40789be5d 100644 --- a/include/linux/nfs_fs_sb.h +++ b/include/linux/nfs_fs_sb.h @@ -52,6 +52,7 @@ struct nfs_client { char * cl_acceptor; /* GSSAPI acceptor name */ struct list_head cl_share_link; /* link in global client list */ struct list_head cl_superblocks; /* List of nfs_server structs */ + struct work_struct free_work; struct rpc_clnt * cl_rpcclient; const struct nfs_rpc_ops *rpc_ops; /* NFS protocol vector */ -- 2.31.1

2 1

[openEuler-22.03-LTS-SP1] EDAC/bluefield: Fix potential integer overflow
by liukai 30 Dec '24

30 Dec '24

From: David Thompson <davthompson(a)nvidia.com> stable inclusion from stable-v5.10.231 commit e0269ea7a628fdeddd65b92fe29c09655dbb80b9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGU CVE: CVE-2024-53161 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 1fe774a93b46bb029b8f6fa9d1f25affa53f06c6 ] The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as 32-bits wide the left-shift operation truncates the upper 16 bits of information during the calculation of the SMC argument. The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits. Fixes: 82413e562ea6 ("EDAC, mellanox: Add ECC support for BlueField DDR4") Signed-off-by: David Thompson <davthompson(a)nvidia.com> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Shravan Kumar Ramani <shravankr(a)nvidia.com> Link: https://lore.kernel.org/r/20240930151056.10158-1-davthompson@nvidia.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/edac/bluefield_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/edac/bluefield_edac.c b/drivers/edac/bluefield_edac.c index e4736eb37bfb..0ef048982768 100644 --- a/drivers/edac/bluefield_edac.c +++ b/drivers/edac/bluefield_edac.c @@ -180,7 +180,7 @@ static void bluefield_edac_check(struct mem_ctl_info *mci) static void bluefield_edac_init_dimms(struct mem_ctl_info *mci) { struct bluefield_edac_priv *priv = mci->pvt_info; - int mem_ctrl_idx = mci->mc_idx; + u64 mem_ctrl_idx = mci->mc_idx; struct dimm_info *dimm; u64 smc_info, smc_arg; int is_empty = 1, i; -- 2.34.1

1 0

[PATCH OLK-5.10] dm cache: fix flushing uninitialized delayed_work on cache_ctr error
by Kaixiong Yu 30 Dec '24

30 Dec '24

From: Ming-Hung Tsai <mtsai(a)redhat.com> stable inclusion from stable-v6.6.61 commit 8cc12dab635333c4ea28e72d7b947be7d0543c2c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVP CVE: CVE-2024-50280 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 135496c208ba26fd68cdef10b64ed7a91ac9a7ff upstream. An unexpected WARN_ON from flush_work() may occur when cache creation fails, caused by destroying the uninitialized delayed_work waker in the error path of cache_create(). For example, the warning appears on the superblock checksum error. Reproduce steps: dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/urandom of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" Kernel logs: (snip) WARNING: CPU: 0 PID: 84 at kernel/workqueue.c:4178 __flush_work+0x5d4/0x890 Fix by pulling out the cancel_delayed_work_sync() from the constructor's error path. This patch doesn't affect the use-after-free fix for concurrent dm_resume and dm_destroy (commit 6a459d8edbdb ("dm cache: Fix UAF in destroy()")) as cache_dtr is not changed. Signed-off-by: Ming-Hung Tsai <mtsai(a)redhat.com> Fixes: 6a459d8edbdb ("dm cache: Fix UAF in destroy()") Cc: stable(a)vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Acked-by: Joe Thornber <thornber(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/md/dm-cache-target.c [Because HULK-5.10 don't merge mainline patch 86a3238c7b9b759cb864f4f768ab2e24687dc0e6("dm: change "unsigned" to "unsigned int" ")] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/md/dm-cache-target.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c index e94409aa2f40..d3821837641b 100644 --- a/drivers/md/dm-cache-target.c +++ b/drivers/md/dm-cache-target.c @@ -1960,16 +1960,13 @@ static void check_migrations(struct work_struct *ws) * This function gets called on the error paths of the constructor, so we * have to cope with a partially initialised struct. */ -static void destroy(struct cache *cache) +static void __destroy(struct cache *cache) { - unsigned i; - mempool_exit(&cache->migration_pool); if (cache->prison) dm_bio_prison_destroy_v2(cache->prison); - cancel_delayed_work_sync(&cache->waker); if (cache->wq) destroy_workqueue(cache->wq); @@ -1997,13 +1994,22 @@ static void destroy(struct cache *cache) if (cache->policy) dm_cache_policy_destroy(cache->policy); + bioset_exit(&cache->bs); + + kfree(cache); +} + +static void destroy(struct cache *cache) +{ + unsigned int i; + + cancel_delayed_work_sync(&cache->waker); + for (i = 0; i < cache->nr_ctr_args ; i++) kfree(cache->ctr_args[i]); kfree(cache->ctr_args); - bioset_exit(&cache->bs); - - kfree(cache); + __destroy(cache); } static void cache_dtr(struct dm_target *ti) @@ -2616,7 +2622,7 @@ static int cache_create(struct cache_args *ca, struct cache **result) *result = cache; return 0; bad: - destroy(cache); + __destroy(cache); return r; } @@ -2667,7 +2673,7 @@ static int cache_ctr(struct dm_target *ti, unsigned argc, char **argv) r = copy_ctr_args(cache, argc - 3, (const char **)argv + 3); if (r) { - destroy(cache); + __destroy(cache); goto out; } -- 2.34.1

2 1

[PATCH OLK-6.6] firmware_loader: Fix possible resource leak in fw_log_firmware_info()
by dinglongwei 30 Dec '24

30 Dec '24

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> stable inclusion from stable-v6.6.64 commit 789a72498d32f88d24371c10985aceb46397056c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFY CVE: CVE-2024-53202 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- firmware_loader: Fix possible resource leak in fw_log_firmware_info() [ Upstream commit 369a9c046c2fdfe037f05b43b84c386bdbccc103 ] The alg instance should be released under the exception path, otherwise there may be resource leak here. To mitigate this, free the alg instance with crypto_free_shash when kmalloc fails. Fixes: 02fe26f25325 ("firmware_loader: Add debug message with checksum for FW file") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> Reviewed-by: Russ Weight <russ.weight(a)linux.dev> Link: https://lore.kernel.org/r/20241016110335.3677924-1-cuigaosheng1@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/base/firmware_loader/main.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c index 0b18c6b46e65..f3133ba831c5 100644 --- a/drivers/base/firmware_loader/main.c +++ b/drivers/base/firmware_loader/main.c @@ -824,19 +824,18 @@ static void fw_log_firmware_info(const struct firmware *fw, const char *name, st shash->tfm = alg; if (crypto_shash_digest(shash, fw->data, fw->size, sha256buf) < 0) - goto out_shash; + goto out_free; for (int i = 0; i < SHA256_DIGEST_SIZE; i++) sprintf(&outbuf[i * 2], "%02x", sha256buf[i]); outbuf[SHA256_BLOCK_SIZE] = 0; dev_dbg(device, "Loaded FW: %s, sha256: %s\n", name, outbuf); -out_shash: - crypto_free_shash(alg); out_free: kfree(shash); kfree(outbuf); kfree(sha256buf); + crypto_free_shash(alg); } #else static void fw_log_firmware_info(const struct firmware *fw, const char *name, -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
by Zhang Zekun 30 Dec '24

30 Dec '24

From: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> stable inclusion from stable-v4.19.323 commit 4afab2197e530b480c4cc099255d12a08c6a1f93 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBBN6V Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------------------- commit 599f6899051cb70c4e0aa9fd591b9ee220cb6f14 upstream. The cec_msg_set_reply_to() helper function never zeroed the struct cec_msg flags field, this can cause unexpected behavior if flags was uninitialized to begin with. Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Fixes: 0dbacebede1e ("[media] cec: move the CEC framework out of staging and to media") Cc: <stable(a)vger.kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- include/uapi/linux/cec.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/include/uapi/linux/cec.h b/include/uapi/linux/cec.h index d6ba68880cef..8b7085c7577d 100644 --- a/include/uapi/linux/cec.h +++ b/include/uapi/linux/cec.h @@ -132,6 +132,8 @@ static inline void cec_msg_init(struct cec_msg *msg, * Set the msg destination to the orig initiator and the msg initiator to the * orig destination. Note that msg and orig may be the same pointer, in which * case the change is done in place. + * + * It also zeroes the reply, timeout and flags fields. */ static inline void cec_msg_set_reply_to(struct cec_msg *msg, struct cec_msg *orig) @@ -139,7 +141,9 @@ static inline void cec_msg_set_reply_to(struct cec_msg *msg, /* The destination becomes the initiator and vice versa */ msg->msg[0] = (cec_msg_destination(orig) << 4) | cec_msg_initiator(orig); - msg->reply = msg->timeout = 0; + msg->reply = 0; + msg->timeout = 0; + msg->flags = 0; } /* cec_msg flags field */ -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] btrfs: ref-verify: fix use-after-free after invalid ref action
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.13-rc2 commit 7c4e39f9d2af4abaf82ca0e315d1fd340456620f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOH CVE: CVE-2024-56581 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry's rbtree (local variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn't remove it from the rbtree before freeing it in the error path at btrfs_ref_tree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it. Syzbot report this with the following stack traces: BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314 btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline] btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23 btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482 btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293 vfs_unlink+0x365/0x650 fs/namei.c:4469 do_unlinkat+0x4ae/0x830 fs/namei.c:4533 __do_sys_unlinkat fs/namei.c:4576 [inline] __se_sys_unlinkat fs/namei.c:4569 [inline] __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f BTRFS error (device loop0 state EA): Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1 __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521 update_ref_for_cow+0x96a/0x11f0 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 ================================================================== BUG: KASAN: slab-use-after-free in rb_first+0x69/0x70 lib/rbtree.c:473 Read of size 8 at addr ffff888042d1af38 by task syz.0.0/5329 CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted 6.12.0-rc7-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 rb_first+0x69/0x70 lib/rbtree.c:473 free_block_entry+0x78/0x230 fs/btrfs/ref-verify.c:248 btrfs_free_ref_cache+0xa3/0x100 fs/btrfs/ref-verify.c:917 btrfs_ref_tree_mod+0x139f/0x15e0 fs/btrfs/ref-verify.c:898 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f996df7e719 RSP: 002b:00007f996ede7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f996e135f80 RCX: 00007f996df7e719 RDX: 0000000020000180 RSI: 00000000c4009420 RDI: 0000000000000004 RBP: 00007f996dff139e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f996e135f80 R15: 00007fff79f32e68 </TASK> Allocated by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] btrfs_ref_tree_mod+0x264/0x15e0 fs/btrfs/ref-verify.c:701 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x1a0/0x440 mm/slub.c:4727 btrfs_ref_tree_mod+0x136c/0x15e0 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888042d1af00 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 56 bytes inside of freed 64-byte region [ffff888042d1af00, ffff888042d1af40) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42d1a anon flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 04fff00000000000 ffff88801ac418c0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000200020 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5055, tgid 5055 (dhcpcd-run-hook), ts 40377240074, free_ts 40376848335 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1541 prep_new_page mm/page_alloc.c:1549 [inline] get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3459 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4735 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2412 allocate_slab+0x5a/0x2f0 mm/slub.c:2578 new_slab mm/slub.c:2631 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818 __slab_alloc+0x58/0xa0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __do_kmalloc_node mm/slub.c:4263 [inline] __kmalloc_noprof+0x25a/0x400 mm/slub.c:4276 kmalloc_noprof include/linux/slab.h:882 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] tomoyo_encode2 security/tomoyo/realpath.c:45 [inline] tomoyo_encode+0x26f/0x540 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x59e/0x5e0 security/tomoyo/realpath.c:283 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x255/0x500 security/tomoyo/file.c:771 security_file_open+0x777/0x990 security/security.c:3109 do_dentry_open+0x369/0x1460 fs/open.c:945 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 page last free pid 5055 tgid 5055 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1112 [inline] free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2642 free_pipe_info+0x300/0x390 fs/pipe.c:860 put_pipe_info fs/pipe.c:719 [inline] pipe_release+0x245/0x320 fs/pipe.c:742 __fput+0x23f/0x880 fs/file_table.c:431 __do_sys_close fs/open.c:1567 [inline] __se_sys_close fs/open.c:1552 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1552 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888042d1ae00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff888042d1ae80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff888042d1af00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff888042d1af80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ffff888042d1b000: 00 00 00 00 00 fc fc 00 00 00 00 00 fc fc 00 00 Reported-by: syzbot+7325f164162e200000c1(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/673723eb.050a0220.1324f8.00a8.GAE@googl… Fixes: fd708b81d972 ("Btrfs: add a extent ref verify tool") CC: stable(a)vger.kernel.org # 4.19+ Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ref-verify.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c index cd2a5864e103..440236f44636 100644 --- a/fs/btrfs/ref-verify.c +++ b/fs/btrfs/ref-verify.c @@ -822,6 +822,7 @@ int btrfs_ref_tree_mod(struct btrfs_root *root, u64 bytenr, u64 num_bytes, "dropping a ref for a existing root that doesn't have a ref on the block"); dump_block_entry(fs_info, be); dump_ref_action(fs_info, ra); + rb_erase(&ref->node, &be->refs); kfree(ra); goto out_unlock; } -- 2.39.2

2 1

[PATCH OLK-6.6] btrfs: ref-verify: fix use-after-free after invalid ref action
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.13-rc2 commit 7c4e39f9d2af4abaf82ca0e315d1fd340456620f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOH CVE: CVE-2024-56581 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry's rbtree (local variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn't remove it from the rbtree before freeing it in the error path at btrfs_ref_tree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it. Syzbot report this with the following stack traces: BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314 btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline] btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23 btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482 btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293 vfs_unlink+0x365/0x650 fs/namei.c:4469 do_unlinkat+0x4ae/0x830 fs/namei.c:4533 __do_sys_unlinkat fs/namei.c:4576 [inline] __se_sys_unlinkat fs/namei.c:4569 [inline] __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f BTRFS error (device loop0 state EA): Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1 __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521 update_ref_for_cow+0x96a/0x11f0 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 ================================================================== BUG: KASAN: slab-use-after-free in rb_first+0x69/0x70 lib/rbtree.c:473 Read of size 8 at addr ffff888042d1af38 by task syz.0.0/5329 CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted 6.12.0-rc7-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 rb_first+0x69/0x70 lib/rbtree.c:473 free_block_entry+0x78/0x230 fs/btrfs/ref-verify.c:248 btrfs_free_ref_cache+0xa3/0x100 fs/btrfs/ref-verify.c:917 btrfs_ref_tree_mod+0x139f/0x15e0 fs/btrfs/ref-verify.c:898 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f996df7e719 RSP: 002b:00007f996ede7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f996e135f80 RCX: 00007f996df7e719 RDX: 0000000020000180 RSI: 00000000c4009420 RDI: 0000000000000004 RBP: 00007f996dff139e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f996e135f80 R15: 00007fff79f32e68 </TASK> Allocated by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] btrfs_ref_tree_mod+0x264/0x15e0 fs/btrfs/ref-verify.c:701 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x1a0/0x440 mm/slub.c:4727 btrfs_ref_tree_mod+0x136c/0x15e0 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888042d1af00 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 56 bytes inside of freed 64-byte region [ffff888042d1af00, ffff888042d1af40) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42d1a anon flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 04fff00000000000 ffff88801ac418c0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000200020 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5055, tgid 5055 (dhcpcd-run-hook), ts 40377240074, free_ts 40376848335 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1541 prep_new_page mm/page_alloc.c:1549 [inline] get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3459 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4735 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2412 allocate_slab+0x5a/0x2f0 mm/slub.c:2578 new_slab mm/slub.c:2631 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818 __slab_alloc+0x58/0xa0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __do_kmalloc_node mm/slub.c:4263 [inline] __kmalloc_noprof+0x25a/0x400 mm/slub.c:4276 kmalloc_noprof include/linux/slab.h:882 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] tomoyo_encode2 security/tomoyo/realpath.c:45 [inline] tomoyo_encode+0x26f/0x540 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x59e/0x5e0 security/tomoyo/realpath.c:283 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x255/0x500 security/tomoyo/file.c:771 security_file_open+0x777/0x990 security/security.c:3109 do_dentry_open+0x369/0x1460 fs/open.c:945 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 page last free pid 5055 tgid 5055 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1112 [inline] free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2642 free_pipe_info+0x300/0x390 fs/pipe.c:860 put_pipe_info fs/pipe.c:719 [inline] pipe_release+0x245/0x320 fs/pipe.c:742 __fput+0x23f/0x880 fs/file_table.c:431 __do_sys_close fs/open.c:1567 [inline] __se_sys_close fs/open.c:1552 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1552 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888042d1ae00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff888042d1ae80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff888042d1af00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff888042d1af80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ffff888042d1b000: 00 00 00 00 00 fc fc 00 00 00 00 00 fc fc 00 00 Reported-by: syzbot+7325f164162e200000c1(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/673723eb.050a0220.1324f8.00a8.GAE@googl… Fixes: fd708b81d972 ("Btrfs: add a extent ref verify tool") CC: stable(a)vger.kernel.org # 4.19+ Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ref-verify.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c index 1ea5bfb8876e..28ac7995716e 100644 --- a/fs/btrfs/ref-verify.c +++ b/fs/btrfs/ref-verify.c @@ -849,6 +849,7 @@ int btrfs_ref_tree_mod(struct btrfs_fs_info *fs_info, "dropping a ref for a root that doesn't have a ref on the block"); dump_block_entry(fs_info, be); dump_ref_action(fs_info, ra); + rb_erase(&ref->node, &be->refs); kfree(ref); kfree(ra); goto out_unlock; -- 2.39.2

2 1

[PATCH OLK-5.10] btrfs: ref-verify: fix use-after-free after invalid ref action
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.13-rc2 commit 7c4e39f9d2af4abaf82ca0e315d1fd340456620f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOH CVE: CVE-2024-56581 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry's rbtree (local variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn't remove it from the rbtree before freeing it in the error path at btrfs_ref_tree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it. Syzbot report this with the following stack traces: BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314 btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline] btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23 btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482 btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293 vfs_unlink+0x365/0x650 fs/namei.c:4469 do_unlinkat+0x4ae/0x830 fs/namei.c:4533 __do_sys_unlinkat fs/namei.c:4576 [inline] __se_sys_unlinkat fs/namei.c:4569 [inline] __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f BTRFS error (device loop0 state EA): Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1 __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521 update_ref_for_cow+0x96a/0x11f0 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 ================================================================== BUG: KASAN: slab-use-after-free in rb_first+0x69/0x70 lib/rbtree.c:473 Read of size 8 at addr ffff888042d1af38 by task syz.0.0/5329 CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted 6.12.0-rc7-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 rb_first+0x69/0x70 lib/rbtree.c:473 free_block_entry+0x78/0x230 fs/btrfs/ref-verify.c:248 btrfs_free_ref_cache+0xa3/0x100 fs/btrfs/ref-verify.c:917 btrfs_ref_tree_mod+0x139f/0x15e0 fs/btrfs/ref-verify.c:898 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f996df7e719 RSP: 002b:00007f996ede7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f996e135f80 RCX: 00007f996df7e719 RDX: 0000000020000180 RSI: 00000000c4009420 RDI: 0000000000000004 RBP: 00007f996dff139e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f996e135f80 R15: 00007fff79f32e68 </TASK> Allocated by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] btrfs_ref_tree_mod+0x264/0x15e0 fs/btrfs/ref-verify.c:701 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x1a0/0x440 mm/slub.c:4727 btrfs_ref_tree_mod+0x136c/0x15e0 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888042d1af00 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 56 bytes inside of freed 64-byte region [ffff888042d1af00, ffff888042d1af40) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42d1a anon flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 04fff00000000000 ffff88801ac418c0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000200020 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5055, tgid 5055 (dhcpcd-run-hook), ts 40377240074, free_ts 40376848335 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1541 prep_new_page mm/page_alloc.c:1549 [inline] get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3459 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4735 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2412 allocate_slab+0x5a/0x2f0 mm/slub.c:2578 new_slab mm/slub.c:2631 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818 __slab_alloc+0x58/0xa0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __do_kmalloc_node mm/slub.c:4263 [inline] __kmalloc_noprof+0x25a/0x400 mm/slub.c:4276 kmalloc_noprof include/linux/slab.h:882 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] tomoyo_encode2 security/tomoyo/realpath.c:45 [inline] tomoyo_encode+0x26f/0x540 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x59e/0x5e0 security/tomoyo/realpath.c:283 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x255/0x500 security/tomoyo/file.c:771 security_file_open+0x777/0x990 security/security.c:3109 do_dentry_open+0x369/0x1460 fs/open.c:945 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 page last free pid 5055 tgid 5055 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1112 [inline] free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2642 free_pipe_info+0x300/0x390 fs/pipe.c:860 put_pipe_info fs/pipe.c:719 [inline] pipe_release+0x245/0x320 fs/pipe.c:742 __fput+0x23f/0x880 fs/file_table.c:431 __do_sys_close fs/open.c:1567 [inline] __se_sys_close fs/open.c:1552 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1552 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888042d1ae00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff888042d1ae80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff888042d1af00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff888042d1af80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ffff888042d1b000: 00 00 00 00 00 fc fc 00 00 00 00 00 fc fc 00 00 Reported-by: syzbot+7325f164162e200000c1(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/673723eb.050a0220.1324f8.00a8.GAE@googl… Fixes: fd708b81d972 ("Btrfs: add a extent ref verify tool") CC: stable(a)vger.kernel.org # 4.19+ Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ref-verify.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c index c3711598a9be..38e1ed4dc2a9 100644 --- a/fs/btrfs/ref-verify.c +++ b/fs/btrfs/ref-verify.c @@ -862,6 +862,7 @@ int btrfs_ref_tree_mod(struct btrfs_fs_info *fs_info, "dropping a ref for a root that doesn't have a ref on the block"); dump_block_entry(fs_info, be); dump_ref_action(fs_info, ra); + rb_erase(&ref->node, &be->refs); kfree(ref); kfree(ra); goto out_unlock; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] btrfs: ref-verify: fix use-after-free after invalid ref action
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.13-rc2 commit 7c4e39f9d2af4abaf82ca0e315d1fd340456620f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOH CVE: CVE-2024-56581 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry's rbtree (local variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn't remove it from the rbtree before freeing it in the error path at btrfs_ref_tree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it. Syzbot report this with the following stack traces: BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314 btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline] btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23 btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482 btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293 vfs_unlink+0x365/0x650 fs/namei.c:4469 do_unlinkat+0x4ae/0x830 fs/namei.c:4533 __do_sys_unlinkat fs/namei.c:4576 [inline] __se_sys_unlinkat fs/namei.c:4569 [inline] __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f BTRFS error (device loop0 state EA): Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1 __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521 update_ref_for_cow+0x96a/0x11f0 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 ================================================================== BUG: KASAN: slab-use-after-free in rb_first+0x69/0x70 lib/rbtree.c:473 Read of size 8 at addr ffff888042d1af38 by task syz.0.0/5329 CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted 6.12.0-rc7-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 rb_first+0x69/0x70 lib/rbtree.c:473 free_block_entry+0x78/0x230 fs/btrfs/ref-verify.c:248 btrfs_free_ref_cache+0xa3/0x100 fs/btrfs/ref-verify.c:917 btrfs_ref_tree_mod+0x139f/0x15e0 fs/btrfs/ref-verify.c:898 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f996df7e719 RSP: 002b:00007f996ede7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f996e135f80 RCX: 00007f996df7e719 RDX: 0000000020000180 RSI: 00000000c4009420 RDI: 0000000000000004 RBP: 00007f996dff139e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f996e135f80 R15: 00007fff79f32e68 </TASK> Allocated by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] btrfs_ref_tree_mod+0x264/0x15e0 fs/btrfs/ref-verify.c:701 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x1a0/0x440 mm/slub.c:4727 btrfs_ref_tree_mod+0x136c/0x15e0 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888042d1af00 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 56 bytes inside of freed 64-byte region [ffff888042d1af00, ffff888042d1af40) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42d1a anon flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 04fff00000000000 ffff88801ac418c0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000200020 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5055, tgid 5055 (dhcpcd-run-hook), ts 40377240074, free_ts 40376848335 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1541 prep_new_page mm/page_alloc.c:1549 [inline] get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3459 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4735 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2412 allocate_slab+0x5a/0x2f0 mm/slub.c:2578 new_slab mm/slub.c:2631 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818 __slab_alloc+0x58/0xa0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __do_kmalloc_node mm/slub.c:4263 [inline] __kmalloc_noprof+0x25a/0x400 mm/slub.c:4276 kmalloc_noprof include/linux/slab.h:882 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] tomoyo_encode2 security/tomoyo/realpath.c:45 [inline] tomoyo_encode+0x26f/0x540 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x59e/0x5e0 security/tomoyo/realpath.c:283 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x255/0x500 security/tomoyo/file.c:771 security_file_open+0x777/0x990 security/security.c:3109 do_dentry_open+0x369/0x1460 fs/open.c:945 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 page last free pid 5055 tgid 5055 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1112 [inline] free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2642 free_pipe_info+0x300/0x390 fs/pipe.c:860 put_pipe_info fs/pipe.c:719 [inline] pipe_release+0x245/0x320 fs/pipe.c:742 __fput+0x23f/0x880 fs/file_table.c:431 __do_sys_close fs/open.c:1567 [inline] __se_sys_close fs/open.c:1552 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1552 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888042d1ae00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff888042d1ae80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff888042d1af00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff888042d1af80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ffff888042d1b000: 00 00 00 00 00 fc fc 00 00 00 00 00 fc fc 00 00 Reported-by: syzbot+7325f164162e200000c1(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/673723eb.050a0220.1324f8.00a8.GAE@googl… Fixes: fd708b81d972 ("Btrfs: add a extent ref verify tool") CC: stable(a)vger.kernel.org # 4.19+ Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ref-verify.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c index 78693d3dd15b..b623df5eb579 100644 --- a/fs/btrfs/ref-verify.c +++ b/fs/btrfs/ref-verify.c @@ -860,6 +860,7 @@ int btrfs_ref_tree_mod(struct btrfs_fs_info *fs_info, "dropping a ref for a root that doesn't have a ref on the block"); dump_block_entry(fs_info, be); dump_ref_action(fs_info, ra); + rb_erase(&ref->node, &be->refs); kfree(ref); kfree(ra); goto out_unlock; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] jfs: array-index-out-of-bounds fix in dtReadFirst
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> mainline inclusion from mainline-v6.13-rc1 commit ca84a2c9be482836b86d780244f0357e5a778c46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP0 CVE: CVE-2024-56598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case. Reported-by: syzbot+65fa06e29859e41a83f3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=65fa06e29859e41a83f3 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/jfs/jfs_dtree.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index defa82acb432..6bc8011b1c9a 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -3384,6 +3384,13 @@ static int dtReadFirst(struct inode *ip, struct btstack * btstack) /* get the leftmost entry */ stbl = DT_GETSTBL(p); + + if (stbl[0] < 0 || stbl[0] > 127) { + DT_PUTPAGE(mp); + jfs_error(ip->i_sb, "stbl[0] out of bound\n"); + return -EIO; + } + xd = (pxd_t *) & p->slot[stbl[0]]; /* get the child page block address */ -- 2.39.2

2 1

[PATCH OLK-5.10] jfs: array-index-out-of-bounds fix in dtReadFirst
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> mainline inclusion from mainline-v6.13-rc1 commit ca84a2c9be482836b86d780244f0357e5a778c46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP0 CVE: CVE-2024-56598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case. Reported-by: syzbot+65fa06e29859e41a83f3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=65fa06e29859e41a83f3 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/jfs/jfs_dtree.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index defa82acb432..6bc8011b1c9a 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -3384,6 +3384,13 @@ static int dtReadFirst(struct inode *ip, struct btstack * btstack) /* get the leftmost entry */ stbl = DT_GETSTBL(p); + + if (stbl[0] < 0 || stbl[0] > 127) { + DT_PUTPAGE(mp); + jfs_error(ip->i_sb, "stbl[0] out of bound\n"); + return -EIO; + } + xd = (pxd_t *) & p->slot[stbl[0]]; /* get the child page block address */ -- 2.39.2

2 1

[PATCH OLK-6.6] jfs: array-index-out-of-bounds fix in dtReadFirst
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> mainline inclusion from mainline-v6.13-rc1 commit ca84a2c9be482836b86d780244f0357e5a778c46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP0 CVE: CVE-2024-56598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case. Reported-by: syzbot+65fa06e29859e41a83f3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=65fa06e29859e41a83f3 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/jfs/jfs_dtree.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 5d3127ca68a4..69fd936fbdb3 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -3086,6 +3086,13 @@ static int dtReadFirst(struct inode *ip, struct btstack * btstack) /* get the leftmost entry */ stbl = DT_GETSTBL(p); + + if (stbl[0] < 0 || stbl[0] > 127) { + DT_PUTPAGE(mp); + jfs_error(ip->i_sb, "stbl[0] out of bound\n"); + return -EIO; + } + xd = (pxd_t *) & p->slot[stbl[0]]; /* get the child page block address */ -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] jfs: array-index-out-of-bounds fix in dtReadFirst
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> mainline inclusion from mainline-v6.13-rc1 commit ca84a2c9be482836b86d780244f0357e5a778c46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP0 CVE: CVE-2024-56598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case. Reported-by: syzbot+65fa06e29859e41a83f3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=65fa06e29859e41a83f3 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/jfs/jfs_dtree.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index ea2c8f0fe832..a2186b6f274a 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -3395,6 +3395,13 @@ static int dtReadFirst(struct inode *ip, struct btstack * btstack) /* get the leftmost entry */ stbl = DT_GETSTBL(p); + + if (stbl[0] < 0 || stbl[0] > 127) { + DT_PUTPAGE(mp); + jfs_error(ip->i_sb, "stbl[0] out of bound\n"); + return -EIO; + } + xd = (pxd_t *) & p->slot[stbl[0]]; /* get the child page block address */ -- 2.39.2

2 1

[PATCH OLK-6.6] ksmbd: fix use-after-free in SMB request handling
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Yunseong Kim <yskelg(a)gmail.com> mainline inclusion from mainline-v6.13-rc1 commit 9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAF6 CVE: CVE-2024-53186 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A race condition exists between SMB request handling in `ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the workqueue handler `handle_ksmbd_work()`. This leads to a UAF. - KASAN: slab-use-after-free Read in handle_ksmbd_work - KASAN: slab-use-after-free in rtlock_slowlock_locked This race condition arises as follows: - `ksmbd_conn_handler_loop()` waits for `conn->r_count` to reach zero: `wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0);` - Meanwhile, `handle_ksmbd_work()` decrements `conn->r_count` using `atomic_dec_return(&conn->r_count)`, and if it reaches zero, calls `ksmbd_conn_free()`, which frees `conn`. - However, after `handle_ksmbd_work()` decrements `conn->r_count`, it may still access `conn->r_count_q` in the following line: `waitqueue_active(&conn->r_count_q)` or `wake_up(&conn->r_count_q)` This results in a UAF, as `conn` has already been freed. The discovery of this UAF can be referenced in the following PR for syzkaller's support for SMB requests. Link: https://github.com/google/syzkaller/pull/5524 Fixes: ee426bfb9d09 ("ksmbd: add refcnt to ksmbd_conn struct") Cc: linux-cifs(a)vger.kernel.org Cc: stable(a)vger.kernel.org # v6.6.55+, v6.10.14+, v6.11.3+ Cc: syzkaller(a)googlegroups.com Signed-off-by: Yunseong Kim <yskelg(a)gmail.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/server/server.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c index b6e0b71c281d..1450e007ac70 100644 --- a/fs/smb/server/server.c +++ b/fs/smb/server/server.c @@ -276,8 +276,12 @@ static void handle_ksmbd_work(struct work_struct *wk) * disconnection. waitqueue_active is safe because it * uses atomic operation for condition. */ + atomic_inc(&conn->refcnt); if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q)) wake_up(&conn->r_count_q); + + if (atomic_dec_and_test(&conn->refcnt)) + kfree(conn); } /** -- 2.39.2

2 1

[PATCH OLK-6.6] drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new()
by Ye Bin 30 Dec '24

30 Dec '24

From: Li Huafei <lihuafei1(a)huawei.com> stable inclusion from stable-v6.6.64 commit 237f2dbfa00576bb1aa8dc2dce403c64e53270e6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBEGFJ CVE: CVE-2024-56752 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a2f599046c671d6b46d93aed95b37241ce4504cf ] When the call to gf100_grctx_generate() fails, unlock gr->fecs.mutex before returning the error. Fixes smatch warning: drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c:480 gf100_gr_chan_new() warn: inconsistent returns '&gr->fecs.mutex'. Fixes: ca081fff6ecc ("drm/nouveau/gr/gf100-: generate golden context during first object alloc") Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> Reviewed-by: Lyude Paul <lyude(a)redhat.com> Signed-off-by: Lyude Paul <lyude(a)redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20241026173844.2392679-1-lihu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c index 3648868bb9fc..cd533d16b966 100644 --- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c +++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c @@ -443,6 +443,7 @@ gf100_gr_chan_new(struct nvkm_gr *base, struct nvkm_chan *fifoch, ret = gf100_grctx_generate(gr, chan, fifoch->inst); if (ret) { nvkm_error(&base->engine.subdev, "failed to construct context\n"); + mutex_unlock(&gr->fecs.mutex); return ret; } } -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
by Bowen You 30 Dec '24

30 Dec '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit 63de35a8fcfca59ae8750d469a7eb220c7557baf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOC CVE: CVE-2024-56608 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- An issue was identified in the dcn21_link_encoder_create function where an out-of-bounds access could occur when the hpd_source index was used to reference the link_enc_hpd_regs array. This array has a fixed size and the index was not being checked against the array's bounds before accessing it. This fix adds a conditional check to ensure that the hpd_source index is within the valid range of the link_enc_hpd_regs array. If the index is out of bounds, the function now returns NULL to prevent undefined behavior. References: [ 65.920507] ------------[ cut here ]------------ [ 65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29 [ 65.920519] index 7 is out of range for type 'dcn10_link_enc_hpd_registers [5]' [ 65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G OE 6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13 [ 65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020 [ 65.920527] Call Trace: [ 65.920529] <TASK> [ 65.920532] dump_stack_lvl+0x48/0x70 [ 65.920541] dump_stack+0x10/0x20 [ 65.920543] __ubsan_handle_out_of_bounds+0xa2/0xe0 [ 65.920549] dcn21_link_encoder_create+0xd9/0x140 [amdgpu] [ 65.921009] link_create+0x6d3/0xed0 [amdgpu] [ 65.921355] create_links+0x18a/0x4e0 [amdgpu] [ 65.921679] dc_create+0x360/0x720 [amdgpu] [ 65.921999] ? dmi_matches+0xa0/0x220 [ 65.922004] amdgpu_dm_init+0x2b6/0x2c90 [amdgpu] [ 65.922342] ? console_unlock+0x77/0x120 [ 65.922348] ? dev_printk_emit+0x86/0xb0 [ 65.922354] dm_hw_init+0x15/0x40 [amdgpu] [ 65.922686] amdgpu_device_init+0x26a8/0x33a0 [amdgpu] [ 65.922921] amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu] [ 65.923087] amdgpu_pci_probe+0x1b7/0x630 [amdgpu] [ 65.923087] local_pci_probe+0x4b/0xb0 [ 65.923087] pci_device_probe+0xc8/0x280 [ 65.923087] really_probe+0x187/0x300 [ 65.923087] __driver_probe_device+0x85/0x130 [ 65.923087] driver_probe_device+0x24/0x110 [ 65.923087] __driver_attach+0xac/0x1d0 [ 65.923087] ? __pfx___driver_attach+0x10/0x10 [ 65.923087] bus_for_each_dev+0x7d/0xd0 [ 65.923087] driver_attach+0x1e/0x30 [ 65.923087] bus_add_driver+0xf2/0x200 [ 65.923087] driver_register+0x64/0x130 [ 65.923087] ? __pfx_amdgpu_init+0x10/0x10 [amdgpu] [ 65.923087] __pci_register_driver+0x61/0x70 [ 65.923087] amdgpu_init+0x7d/0xff0 [amdgpu] [ 65.923087] do_one_initcall+0x49/0x310 [ 65.923087] ? kmalloc_trace+0x136/0x360 [ 65.923087] do_init_module+0x6a/0x270 [ 65.923087] load_module+0x1fce/0x23a0 [ 65.923087] init_module_from_file+0x9c/0xe0 [ 65.923087] ? init_module_from_file+0x9c/0xe0 [ 65.923087] idempotent_init_module+0x179/0x230 [ 65.923087] __x64_sys_finit_module+0x5d/0xa0 [ 65.923087] do_syscall_64+0x76/0x120 [ 65.923087] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 65.923087] RIP: 0033:0x7f2d80f1e88d [ 65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [ 65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d [ 65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f [ 65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002 [ 65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480 [ 65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0 [ 65.923087] </TASK> [ 65.923927] ---[ end trace ]--- Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Roman Li <roman.li(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c [file moved in commit 8b8eed05a1c6 drm/amd/display: Refactor resource into component directory] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c index c1a1ca755f26..24105a5b9f2a 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c @@ -1316,7 +1316,7 @@ static struct link_encoder *dcn21_link_encoder_create( kzalloc(sizeof(struct dcn21_link_encoder), GFP_KERNEL); int link_regs_id; - if (!enc21) + if (!enc21 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) return NULL; link_regs_id = -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
by Bowen You 30 Dec '24

30 Dec '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit 63de35a8fcfca59ae8750d469a7eb220c7557baf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOC CVE: CVE-2024-56608 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- An issue was identified in the dcn21_link_encoder_create function where an out-of-bounds access could occur when the hpd_source index was used to reference the link_enc_hpd_regs array. This array has a fixed size and the index was not being checked against the array's bounds before accessing it. This fix adds a conditional check to ensure that the hpd_source index is within the valid range of the link_enc_hpd_regs array. If the index is out of bounds, the function now returns NULL to prevent undefined behavior. References: [ 65.920507] ------------[ cut here ]------------ [ 65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29 [ 65.920519] index 7 is out of range for type 'dcn10_link_enc_hpd_registers [5]' [ 65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G OE 6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13 [ 65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020 [ 65.920527] Call Trace: [ 65.920529] <TASK> [ 65.920532] dump_stack_lvl+0x48/0x70 [ 65.920541] dump_stack+0x10/0x20 [ 65.920543] __ubsan_handle_out_of_bounds+0xa2/0xe0 [ 65.920549] dcn21_link_encoder_create+0xd9/0x140 [amdgpu] [ 65.921009] link_create+0x6d3/0xed0 [amdgpu] [ 65.921355] create_links+0x18a/0x4e0 [amdgpu] [ 65.921679] dc_create+0x360/0x720 [amdgpu] [ 65.921999] ? dmi_matches+0xa0/0x220 [ 65.922004] amdgpu_dm_init+0x2b6/0x2c90 [amdgpu] [ 65.922342] ? console_unlock+0x77/0x120 [ 65.922348] ? dev_printk_emit+0x86/0xb0 [ 65.922354] dm_hw_init+0x15/0x40 [amdgpu] [ 65.922686] amdgpu_device_init+0x26a8/0x33a0 [amdgpu] [ 65.922921] amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu] [ 65.923087] amdgpu_pci_probe+0x1b7/0x630 [amdgpu] [ 65.923087] local_pci_probe+0x4b/0xb0 [ 65.923087] pci_device_probe+0xc8/0x280 [ 65.923087] really_probe+0x187/0x300 [ 65.923087] __driver_probe_device+0x85/0x130 [ 65.923087] driver_probe_device+0x24/0x110 [ 65.923087] __driver_attach+0xac/0x1d0 [ 65.923087] ? __pfx___driver_attach+0x10/0x10 [ 65.923087] bus_for_each_dev+0x7d/0xd0 [ 65.923087] driver_attach+0x1e/0x30 [ 65.923087] bus_add_driver+0xf2/0x200 [ 65.923087] driver_register+0x64/0x130 [ 65.923087] ? __pfx_amdgpu_init+0x10/0x10 [amdgpu] [ 65.923087] __pci_register_driver+0x61/0x70 [ 65.923087] amdgpu_init+0x7d/0xff0 [amdgpu] [ 65.923087] do_one_initcall+0x49/0x310 [ 65.923087] ? kmalloc_trace+0x136/0x360 [ 65.923087] do_init_module+0x6a/0x270 [ 65.923087] load_module+0x1fce/0x23a0 [ 65.923087] init_module_from_file+0x9c/0xe0 [ 65.923087] ? init_module_from_file+0x9c/0xe0 [ 65.923087] idempotent_init_module+0x179/0x230 [ 65.923087] __x64_sys_finit_module+0x5d/0xa0 [ 65.923087] do_syscall_64+0x76/0x120 [ 65.923087] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 65.923087] RIP: 0033:0x7f2d80f1e88d [ 65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [ 65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d [ 65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f [ 65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002 [ 65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480 [ 65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0 [ 65.923087] </TASK> [ 65.923927] ---[ end trace ]--- Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Roman Li <roman.li(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c [file moved in commit 8b8eed05a1c6 drm/amd/display: Refactor resource into component directory] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c index 01c4e8753294..f02305089b56 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c @@ -1698,7 +1698,7 @@ static struct link_encoder *dcn21_link_encoder_create( kzalloc(sizeof(struct dcn21_link_encoder), GFP_KERNEL); int link_regs_id; - if (!enc21) + if (!enc21 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) return NULL; link_regs_id = -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
by Bowen You 30 Dec '24

30 Dec '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit 63de35a8fcfca59ae8750d469a7eb220c7557baf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOC CVE: CVE-2024-56608 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- An issue was identified in the dcn21_link_encoder_create function where an out-of-bounds access could occur when the hpd_source index was used to reference the link_enc_hpd_regs array. This array has a fixed size and the index was not being checked against the array's bounds before accessing it. This fix adds a conditional check to ensure that the hpd_source index is within the valid range of the link_enc_hpd_regs array. If the index is out of bounds, the function now returns NULL to prevent undefined behavior. References: [ 65.920507] ------------[ cut here ]------------ [ 65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29 [ 65.920519] index 7 is out of range for type 'dcn10_link_enc_hpd_registers [5]' [ 65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G OE 6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13 [ 65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020 [ 65.920527] Call Trace: [ 65.920529] <TASK> [ 65.920532] dump_stack_lvl+0x48/0x70 [ 65.920541] dump_stack+0x10/0x20 [ 65.920543] __ubsan_handle_out_of_bounds+0xa2/0xe0 [ 65.920549] dcn21_link_encoder_create+0xd9/0x140 [amdgpu] [ 65.921009] link_create+0x6d3/0xed0 [amdgpu] [ 65.921355] create_links+0x18a/0x4e0 [amdgpu] [ 65.921679] dc_create+0x360/0x720 [amdgpu] [ 65.921999] ? dmi_matches+0xa0/0x220 [ 65.922004] amdgpu_dm_init+0x2b6/0x2c90 [amdgpu] [ 65.922342] ? console_unlock+0x77/0x120 [ 65.922348] ? dev_printk_emit+0x86/0xb0 [ 65.922354] dm_hw_init+0x15/0x40 [amdgpu] [ 65.922686] amdgpu_device_init+0x26a8/0x33a0 [amdgpu] [ 65.922921] amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu] [ 65.923087] amdgpu_pci_probe+0x1b7/0x630 [amdgpu] [ 65.923087] local_pci_probe+0x4b/0xb0 [ 65.923087] pci_device_probe+0xc8/0x280 [ 65.923087] really_probe+0x187/0x300 [ 65.923087] __driver_probe_device+0x85/0x130 [ 65.923087] driver_probe_device+0x24/0x110 [ 65.923087] __driver_attach+0xac/0x1d0 [ 65.923087] ? __pfx___driver_attach+0x10/0x10 [ 65.923087] bus_for_each_dev+0x7d/0xd0 [ 65.923087] driver_attach+0x1e/0x30 [ 65.923087] bus_add_driver+0xf2/0x200 [ 65.923087] driver_register+0x64/0x130 [ 65.923087] ? __pfx_amdgpu_init+0x10/0x10 [amdgpu] [ 65.923087] __pci_register_driver+0x61/0x70 [ 65.923087] amdgpu_init+0x7d/0xff0 [amdgpu] [ 65.923087] do_one_initcall+0x49/0x310 [ 65.923087] ? kmalloc_trace+0x136/0x360 [ 65.923087] do_init_module+0x6a/0x270 [ 65.923087] load_module+0x1fce/0x23a0 [ 65.923087] init_module_from_file+0x9c/0xe0 [ 65.923087] ? init_module_from_file+0x9c/0xe0 [ 65.923087] idempotent_init_module+0x179/0x230 [ 65.923087] __x64_sys_finit_module+0x5d/0xa0 [ 65.923087] do_syscall_64+0x76/0x120 [ 65.923087] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 65.923087] RIP: 0033:0x7f2d80f1e88d [ 65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [ 65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d [ 65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f [ 65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002 [ 65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480 [ 65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0 [ 65.923087] </TASK> [ 65.923927] ---[ end trace ]--- Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Roman Li <roman.li(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c [file moved in commit 8b8eed05a1c6 drm/amd/display: Refactor resource into component directory] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c index 01c4e8753294..f02305089b56 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c @@ -1698,7 +1698,7 @@ static struct link_encoder *dcn21_link_encoder_create( kzalloc(sizeof(struct dcn21_link_encoder), GFP_KERNEL); int link_regs_id; - if (!enc21) + if (!enc21 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) return NULL; link_regs_id = -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/4] CVE merge openEuler-22.03-LTS-SP1
by Kaixiong Yu 30 Dec '24

30 Dec '24

the patches' CVE number as listed: CVE-2024-50272 CVE-2024-50187 CVE-2024-50116 CVE-2024-49991 Maíra Canal (1): drm/vc4: Stop the active perfmon before being destroyed Philip Yang (1): drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer Ryusuke Konishi (1): nilfs2: fix kernel bug due to missing clearing of buffer delay flag Trond Myklebust (1): filemap: Fix bounds checking in filemap_read() drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 14 +++++++------- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 4 ++-- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 2 +- drivers/gpu/drm/vc4/vc4_drv.h | 2 ++ drivers/gpu/drm/vc4/vc4_perfmon.c | 7 ++++++- fs/nilfs2/page.c | 6 ++++-- mm/filemap.c | 2 +- mm/shmem.c | 2 ++ 10 files changed, 27 insertions(+), 16 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 1/2] dm cache: fix flushing uninitialized delayed_work on cache_ctr error
by Kaixiong Yu 30 Dec '24

30 Dec '24

From: Ming-Hung Tsai <mtsai(a)redhat.com> stable inclusion from stable-v6.6.61 commit 8cc12dab635333c4ea28e72d7b947be7d0543c2c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVP CVE: CVE-2024-50280 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 135496c208ba26fd68cdef10b64ed7a91ac9a7ff upstream. An unexpected WARN_ON from flush_work() may occur when cache creation fails, caused by destroying the uninitialized delayed_work waker in the error path of cache_create(). For example, the warning appears on the superblock checksum error. Reproduce steps: dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/urandom of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" Kernel logs: (snip) WARNING: CPU: 0 PID: 84 at kernel/workqueue.c:4178 __flush_work+0x5d4/0x890 Fix by pulling out the cancel_delayed_work_sync() from the constructor's error path. This patch doesn't affect the use-after-free fix for concurrent dm_resume and dm_destroy (commit 6a459d8edbdb ("dm cache: Fix UAF in destroy()")) as cache_dtr is not changed. Signed-off-by: Ming-Hung Tsai <mtsai(a)redhat.com> Fixes: 6a459d8edbdb ("dm cache: Fix UAF in destroy()") Cc: stable(a)vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Acked-by: Joe Thornber <thornber(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/md/dm-cache-target.c [Because HULK-5.10 don't merge mainline patch 86a3238c7b9b759cb864f4f768ab2e24687dc0e6("dm: change "unsigned" to "unsigned int" ")] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/md/dm-cache-target.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c index e94409aa2f40..d3821837641b 100644 --- a/drivers/md/dm-cache-target.c +++ b/drivers/md/dm-cache-target.c @@ -1960,16 +1960,13 @@ static void check_migrations(struct work_struct *ws) * This function gets called on the error paths of the constructor, so we * have to cope with a partially initialised struct. */ -static void destroy(struct cache *cache) +static void __destroy(struct cache *cache) { - unsigned i; - mempool_exit(&cache->migration_pool); if (cache->prison) dm_bio_prison_destroy_v2(cache->prison); - cancel_delayed_work_sync(&cache->waker); if (cache->wq) destroy_workqueue(cache->wq); @@ -1997,13 +1994,22 @@ static void destroy(struct cache *cache) if (cache->policy) dm_cache_policy_destroy(cache->policy); + bioset_exit(&cache->bs); + + kfree(cache); +} + +static void destroy(struct cache *cache) +{ + unsigned int i; + + cancel_delayed_work_sync(&cache->waker); + for (i = 0; i < cache->nr_ctr_args ; i++) kfree(cache->ctr_args[i]); kfree(cache->ctr_args); - bioset_exit(&cache->bs); - - kfree(cache); + __destroy(cache); } static void cache_dtr(struct dm_target *ti) @@ -2616,7 +2622,7 @@ static int cache_create(struct cache_args *ca, struct cache **result) *result = cache; return 0; bad: - destroy(cache); + __destroy(cache); return r; } @@ -2667,7 +2673,7 @@ static int cache_ctr(struct dm_target *ti, unsigned argc, char **argv) r = copy_ctr_args(cache, argc - 3, (const char **)argv + 3); if (r) { - destroy(cache); + __destroy(cache); goto out; } -- 2.34.1

1 0

[openeuler:openEuler-1.0-LTS 1356/1356] drivers/spi/spi-uniphier.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 29 Dec '24

29 Dec '24

Hi Mark, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: c1acb21b32a3bb601453764c9eac9fc8fbb3a81d [1356/1356] Merge branch 'spi-4.19' into spi-next config: x86_64-buildonly-randconfig-003-20241228 (https://download.01.org/0day-ci/archive/20241229/202412292119.3SvvfIct-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412292119.3SvvfIct-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412292119.3SvvfIct-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/spi/spi-uniphier.c:12: include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'uniphier_spi_driver_exit': 'cold' [-Wmissing-attributes] 138 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ include/linux/device.h:1558:1: note: in expansion of macro 'module_exit' 1558 | module_exit(__driver##_exit); | ^~~~~~~~~~~ include/linux/platform_device.h:228:9: note: in expansion of macro 'module_driver' 228 | module_driver(__platform_driver, platform_driver_register, \ | ^~~~~~~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/platform_device.h:14, from drivers/spi/spi-uniphier.c:13: drivers/spi/spi-uniphier.c:518:24: note: 'cleanup_module' target declared here 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~ include/linux/device.h:1554:20: note: in definition of macro 'module_driver' 1554 | static void __exit __driver##_exit(void) \ | ^~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'uniphier_spi_driver_init': 'cold' [-Wmissing-attributes] 132 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/device.h:1553:1: note: in expansion of macro 'module_init' 1553 | module_init(__driver##_init); \ | ^~~~~~~~~~~ include/linux/platform_device.h:228:9: note: in expansion of macro 'module_driver' 228 | module_driver(__platform_driver, platform_driver_register, \ | ^~~~~~~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ drivers/spi/spi-uniphier.c:518:24: note: 'init_module' target declared here 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~ include/linux/device.h:1549:19: note: in definition of macro 'module_driver' 1549 | static int __init __driver##_init(void) \ | ^~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/spi/spi-uniphier.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1356/1356] kernel/seccomp.o: warning: objtool: __secure_computing()+0x164: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: e5d58f5ee731b2ff4e5c801cb875c804c63593e4 [1356/1356] seccomp: Invalidate seccomp mode to catch death failures config: x86_64-buildonly-randconfig-002-20241228 (https://download.01.org/0day-ci/archive/20241229/202412292126.8dsmJnAO-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412292126.8dsmJnAO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412292126.8dsmJnAO-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/seccomp.c:190: warning: Function parameter or member 'ret' not described in 'ACTION_ONLY' kernel/seccomp.c:190: warning: Excess function parameter 'sd' description in 'ACTION_ONLY' kernel/seccomp.c:190: warning: Excess function parameter 'match' description in 'ACTION_ONLY' kernel/seccomp.c:320: warning: Function parameter or member 'flags' not described in 'seccomp_sync_threads' >> kernel/seccomp.o: warning: objtool: __secure_computing()+0x164: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1356/1356] mm/vmalloc.o: warning: objtool: vmap_range_noflush()+0x822: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 2facb5901ceebe6736c0d192ca50be5d26c70ad9 [1356/1356] ascend: vmalloc: export new function for share pool config: x86_64-buildonly-randconfig-002-20241228 (https://download.01.org/0day-ci/archive/20241229/202412291858.fE0rwXZl-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412291858.fE0rwXZl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412291858.fE0rwXZl-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/vmalloc.c:43: In file included from mm/internal.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/vmalloc.c:231:16: warning: variable 'start' set but not used [-Wunused-but-set-variable] 231 | unsigned long start; | ^ mm/vmalloc.c:628:14: warning: no previous prototype for function 'vmalloc_to_hugepage' [-Wmissing-prototypes] 628 | struct page *vmalloc_to_hugepage(const void *vmalloc_addr) | ^ mm/vmalloc.c:628:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 628 | struct page *vmalloc_to_hugepage(const void *vmalloc_addr) | ^ | static 3 warnings generated. mm/vmalloc.c:3504: warning: Function parameter or member 'align' not described in 'pvm_determine_end_from_reverse' >> mm/vmalloc.o: warning: objtool: vmap_range_noflush()+0x822: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] lib/sbitmap.o: warning: objtool: sbitmap_get()+0xa4: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4848f81edc2027721953fee5ded81f909a833e26 commit: e798f29c1c5233281940f742f29e4fad5d30fa80 [2589/2589] scsi: sbitmap: Move allocation hint into sbitmap config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241229/202412291800.CLkIl8Wr-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412291800.CLkIl8Wr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412291800.CLkIl8Wr-lkp@intel.com/ All warnings (new ones prefixed by >>): >> lib/sbitmap.o: warning: objtool: sbitmap_get()+0xa4: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1356/1356] drivers/cpuidle/cpuidle.o: warning: objtool: cpuidle_enter_s2idle()+0x2ce: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: c6c4145900fc6828c25ccce943ac3a7ae5de2739 [1356/1356] cpuidle: Fixup IRQ state config: x86_64-buildonly-randconfig-002-20241228 (https://download.01.org/0day-ci/archive/20241229/202412291655.V0U37u8Q-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412291655.V0U37u8Q-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412291655.V0U37u8Q-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/cpuidle/cpuidle.o: warning: objtool: cpuidle_enter_s2idle()+0x2ce: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] drivers/gpu/drm/drm_mipi_dsi.o: warning: objtool: mipi_dsi_detach()+0x7b: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4848f81edc2027721953fee5ded81f909a833e26 commit: 98a38084c13000416219d8b38fb60f874185f79c [2589/2589] drm/mipi-dsi: Fix detach call without attach config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241229/202412291615.DMQ4kEKA-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412291615.DMQ4kEKA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412291615.DMQ4kEKA-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/gpu/drm/drm_mipi_dsi.o: warning: objtool: mipi_dsi_detach()+0x7b: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] fs/dcache.o: warning: objtool: dput()+0x7fe: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4848f81edc2027721953fee5ded81f909a833e26 commit: 54abad829e47a4429c491486bb2d8da79de8f5b9 [2589/2589] fast_dput(): handle underflows gracefully config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241229/202412291332.ZZ1UpSAJ-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412291332.ZZ1UpSAJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412291332.ZZ1UpSAJ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/dcache.o: warning: objtool: dput()+0x7fe: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1356/1356] mm/memory_hotplug.o: warning: objtool: __remove_pages()+0x149: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: b9f9a54ea6ea41d0e00c19fadf6ff3f42ba32a86 [1356/1356] mm/memory_hotplug: make __remove_section() never fail config: x86_64-buildonly-randconfig-002-20241228 (https://download.01.org/0day-ci/archive/20241229/202412291322.70sEUMki-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412291322.70sEUMki-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412291322.70sEUMki-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/memory_hotplug.c:12: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/memory_hotplug.c:31: include/linux/mm_inline.h:32:43: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 32 | __mod_node_page_state(pgdat, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:34:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ 3 warnings generated. >> mm/memory_hotplug.o: warning: objtool: __remove_pages()+0x149: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] fs/ext4/xattr.o: warning: objtool: ext4_xattr_inode_lookup_create()+0x3f1: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4848f81edc2027721953fee5ded81f909a833e26 commit: b54fa08a1495ec807a8fa5a4bcab38baf536ec65 [2589/2589] ext4: do not create EA inode under buffer lock config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241229/202412291044.42VlRDrU-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412291044.42VlRDrU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412291044.42VlRDrU-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/ext4/xattr.o: warning: objtool: ext4_xattr_inode_lookup_create()+0x3f1: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1356/1356] kernel/trace/trace_events.o: warning: objtool: trace_add_event_call_nolock()+0x20d: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 474685382aab1e2263cb1a6161623cd8cbf758ed [1356/1356] tracing: Lock event_mutex before synth_event_mutex config: x86_64-buildonly-randconfig-002-20241228 (https://download.01.org/0day-ci/archive/20241229/202412290943.ju9ShqOs-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412290943.ju9ShqOs-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290943.ju9ShqOs-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/trace/trace_events.o: warning: objtool: trace_add_event_call_nolock()+0x20d: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] fs/iomap/direct-io.o: warning: objtool: iomap_dio_actor()+0xde: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4848f81edc2027721953fee5ded81f909a833e26 commit: adad6411399ac34c26ff8a07233e0ecd8cbb86f7 [2589/2589] iomap: pass a flags argument to iomap_dio_rw config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241229/202412290825.A4xfCPjV-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412290825.A4xfCPjV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290825.A4xfCPjV-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/iomap/direct-io.o: warning: objtool: iomap_dio_actor()+0xde: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1358/1358] drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2567:5: sparse: sparse: symbol 'ngbe_flash_write_cab' was not declared. Should it be static?
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 206f9c11a8c8b0197da5a26859d96d2ed65f5757 [1358/1358] net: ngbe: Add Netswift Giga NIC driver config: x86_64-randconfig-r113-20241228 (https://download.01.org/0day-ci/archive/20241229/202412290834.rDSvv47F-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412290834.rDSvv47F-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290834.rDSvv47F-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:438:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:438:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:438:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:816:6: sparse: sparse: symbol 'ngbe_add_uc_addr' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:960:6: sparse: sparse: symbol 'ngbe_set_mta' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2082:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2082:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2082:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2236:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2236:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2236:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2344:5: sparse: sparse: symbol 'ngbe_setup_mac_link_hostif' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2382:5: sparse: sparse: symbol 'ngbe_crc16_ccitt' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2542:5: sparse: sparse: symbol 'flash_read_dword' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2567:5: sparse: sparse: symbol 'ngbe_flash_write_cab' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2593:5: sparse: sparse: symbol 'ngbe_flash_read_cab' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2628:5: sparse: sparse: symbol 'ngbe_flash_write_unlock' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2651:5: sparse: sparse: symbol 'ngbe_flash_write_lock' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3107:13: sparse: sparse: symbol 'ngbe_ptype_lookup' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3498:5: sparse: sparse: symbol 'ngbe_get_copper_link_capabilities' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3647:5: sparse: sparse: symbol 'ngbe_reset_misc' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3957:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3957:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3957:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3959:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3959:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3959:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4124:5: sparse: sparse: symbol 'ngbe_read_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4240:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4240:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4240:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4324:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4324:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4324:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4339:5: sparse: sparse: symbol 'ngbe_read_ee_hostif_data32' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4387:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4387:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4387:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4405:5: sparse: sparse: symbol 'ngbe_write_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4448:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4448:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4448:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4466:5: sparse: sparse: symbol 'ngbe_write_ee_hostif_data32' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4508:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4508:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4508:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4554:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4554:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4554:9: sparse: int In file included from include/linux/sctp.h:57, from drivers/net/ethernet/netswift/ngbe/ngbe.h:28, from drivers/net/ethernet/netswift/ngbe/ngbe_phy.h:22, from drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:22: include/uapi/linux/sctp.h:390:1: warning: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Wpacked-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:719:1: warning: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Wpacked-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:718:33: warning: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Wpacked-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ include/uapi/linux/sctp.h:732:1: warning: alignment 4 of 'struct sctp_prim' is less than 8 [-Wpacked-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:731:33: warning: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Wpacked-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ include/uapi/linux/sctp.h:783:1: warning: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Wpacked-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:775:33: warning: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Wpacked-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ include/uapi/linux/sctp.h:896:1: warning: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Wpacked-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:890:33: warning: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Wpacked-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe.h: In function 'ngbe_misc_isb': drivers/net/ethernet/netswift/ngbe/ngbe.h:764:13: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 764 | u32 cur_diff = 0; | ^~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c: At top level: drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:816:6: warning: no previous prototype for 'ngbe_add_uc_addr' [-Wmissing-prototypes] 816 | void ngbe_add_uc_addr(struct ngbe_hw *hw, u8 *addr, u32 vmdq) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:960:6: warning: no previous prototype for 'ngbe_set_mta' [-Wmissing-prototypes] 960 | void ngbe_set_mta(struct ngbe_hw *hw, u8 *mc_addr) | ^~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2032:5: warning: no previous prototype for 'ngbe_host_interface_pass_command' [-Wmissing-prototypes] 2032 | s32 ngbe_host_interface_pass_command(struct ngbe_hw *hw, u32 *buffer, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2344:5: warning: no previous prototype for 'ngbe_setup_mac_link_hostif' [-Wmissing-prototypes] 2344 | s32 ngbe_setup_mac_link_hostif(struct ngbe_hw *hw, u32 speed) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2382:5: warning: no previous prototype for 'ngbe_crc16_ccitt' [-Wmissing-prototypes] 2382 | u16 ngbe_crc16_ccitt(const u8 *buf, int size) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2499:4: warning: no previous prototype for 'fmgr_cmd_op' [-Wmissing-prototypes] 2499 | u8 fmgr_cmd_op(struct ngbe_hw *hw, u32 cmd, u32 cmd_addr) | ^~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2520:4: warning: no previous prototype for 'fmgr_usr_cmd_op' [-Wmissing-prototypes] 2520 | u8 fmgr_usr_cmd_op(struct ngbe_hw *hw, u32 usr_cmd) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2530:4: warning: no previous prototype for 'flash_erase_chip' [-Wmissing-prototypes] 2530 | u8 flash_erase_chip(struct ngbe_hw *hw) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2536:4: warning: no previous prototype for 'flash_erase_sector' [-Wmissing-prototypes] 2536 | u8 flash_erase_sector(struct ngbe_hw *hw, u32 sec_addr) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2542:5: warning: no previous prototype for 'flash_read_dword' [-Wmissing-prototypes] 2542 | u32 flash_read_dword(struct ngbe_hw *hw, u32 addr) | ^~~~~~~~~~~~~~~~ vim +/ngbe_flash_write_cab +2567 drivers/net/ethernet/netswift/ngbe/ngbe_hw.c 2566 > 2567 int ngbe_flash_write_cab(struct ngbe_hw *hw, u32 addr, u32 value, u16 lan_id) 2568 { 2569 int status; 2570 struct ngbe_hic_read_cab buffer; 2571 2572 buffer.hdr.req.cmd = 0xE2; 2573 buffer.hdr.req.buf_lenh = 0x6; 2574 buffer.hdr.req.buf_lenl = 0x0; 2575 buffer.hdr.req.checksum = 0xFF; 2576 2577 /* convert offset from words to bytes */ 2578 buffer.dbuf.d16[0] = cpu_to_le16(lan_id); 2579 /* one word */ 2580 buffer.dbuf.d32[0] = htonl(addr); 2581 buffer.dbuf.d32[1] = htonl(value); 2582 2583 status = ngbe_host_interface_command(hw, (u32 *)&buffer, 2584 sizeof(buffer), 5000, true); 2585 printk("0x1e100 :%08x\n", rd32(hw, 0x1e100)); 2586 printk("0x1e104 :%08x\n", rd32(hw, 0x1e104)); 2587 printk("0x1e108 :%08x\n", rd32(hw, 0x1e108)); 2588 printk("0x1e10c :%08x\n", rd32(hw, 0x1e10c)); 2589 2590 return status; 2591 } 2592 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 4848f81edc2027721953fee5ded81f909a833e26
by kernel test robot 29 Dec '24

29 Dec '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 4848f81edc2027721953fee5ded81f909a833e26 !14333 ALSA: usb-audio: Fix out of bounds reads when finding clock sources Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202412282222.K2wXdQAA-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202412290220.89K1KTZx-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202412290447.CV8oCAhR-lkp@intel.com fs/dirty_pages.o: warning: objtool: seq_read_dirty()+0x112: unreachable instruction kernel/futex/core.o: warning: objtool: futex_lock_pi()+0x6ec: unreachable instruction kernel/rcu/tree.o: warning: objtool: call_rcu()+0x105: unreachable instruction lib/crypto/curve25519.o: warning: objtool: mod_init()+0x32: unreachable instruction net/bridge/br_vlan_options.o: warning: objtool: br_vlan_process_options()+0x301: unreachable instruction net/sched/sch_qfq.o: warning: objtool: qfq_graft_class()+0xbd: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-defconfig | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_supports_pmu | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_supports_sve | |-- arch-arm64-kvm-hyp-nvhe-..-aarch32.c:warning:Function-parameter-or-member-is_wide_instr-not-described-in-kvm_skip_instr32 | |-- arch-arm64-kvm-hyp-vhe-..-aarch32.c:warning:Function-parameter-or-member-is_wide_instr-not-described-in-kvm_skip_instr32 | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-cpu-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_sel | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_epp | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-cpunum-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-epp_val-not-described-in-cppc_set_epp | |-- drivers-crypto-hisilicon-qm.c:warning:strncpy-specified-bound-depends-on-the-length-of-the-source-argument | |-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:warning:label-err_init_guid_fail-defined-but-not-used | `-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:warning:label-out_dbg_init-defined-but-not-used |-- arm64-randconfig-002-20241228 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-003-20241228 | |-- arch-arm64-kvm-hyp-nvhe-..-aarch32.c:warning:Function-parameter-or-member-is_wide_instr-not-described-in-kvm_skip_instr32 | |-- arch-arm64-kvm-hyp-vhe-..-aarch32.c:warning:Function-parameter-or-member-is_wide_instr-not-described-in-kvm_skip_instr32 | |-- drivers-misc-virt_plat_dev.c:warning:initialization-of-struct-irq_domain-from-int-makes-pointer-from-integer-without-a-cast | `-- security-integrity-ima-ima_main.c:error:too-few-arguments-to-function-ima_appraise_measurement |-- arm64-randconfig-r062-20241228 | |-- lib-..-mm-kasan-kasan.h:warning:return-with-a-value-in-function-returning-void | |-- mm-kasan-common.c:error:void-value-not-ignored-as-it-ought-to-be | |-- mm-kasan-common.c:warning:control-reaches-end-of-non-void-function | `-- mm-kasan-kasan.h:warning:return-with-a-value-in-function-returning-void |-- arm64-randconfig-r122-20241228 | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-randconfig-r123-20241228 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-x16-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-cpu-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_sel | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_epp | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-cpunum-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-epp_val-not-described-in-cppc_set_epp | |-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-skb-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-type_cs_vlan_tso-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_unic_guid.c:warning:no-previous-prototype-for-function-hclge_unic_del_mc_guid_common | |-- drivers-net-ethernet-huawei-hinic-hinic_hwdev.c:warning:address-of-array-chip_node-rt_cmd-will-always-evaluate-to-true | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_mac-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_trans-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-headroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-tailroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-data-not-described-in-rnp_reg_test | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-type_tucmd-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-v_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-crc_pad-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-ignore_vlan-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_acquire_msix_vectors | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_print_ring_info | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-data-description-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-ent-description-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-hw-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-link_speed-description-in-rnp_watchdog_update_link | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-maxrate-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-queue-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-skb-description-in-rnp_is_non_eop | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_rx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_tx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-id-not-described-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnp_clean_tx_irq | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_msix_vector-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_queue-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-t-not-described-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnp_tx_timeout | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_can_rpu_start | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_clear_udp_tunnel_port | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_config_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_delete_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_do_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_task | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_setup_tc_cls_u32 | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_unmap_and_free_tx_resource | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_write_eitr_rx | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-rxctrl-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Excess-function-parameter-rnp_info-description-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-adv-not-described-in-rnp_mbx_phy_link_set | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-info-not-described-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-pfvfnum-not-described-in-rnp_fw_get_macaddr | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value-not-described-in-rnp_mbx_reg_writev | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value0-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value1-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value2-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value3-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_fw_reg_read | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-value-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Excess-function-parameter-hw-description-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-hw-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-mac-not-described-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:equality-comparison-with-extraneous-parentheses | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_get_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_set_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_addr_list_itr | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_check_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_clean_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_device_supports_autoneg_fc | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_mc_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tcp_sync_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_mc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_table_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_permtion_mac_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_thermal_sensor_data_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_thermal_sensor_thresh_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_layer2_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_set_mac_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_nway_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_read_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_write_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_reset_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_ethtool_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_vf_vlan_mode_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_setup_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_start_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_tcam_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-autoneg_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-dma_ch-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-duplex_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-idx-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:no-previous-prototype-for-function-rnp_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:variable-ts_event_en-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-check_ari_mode | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-rnp_msg_post_status_signle_link | |-- drivers-net-ethernet-mucse-rnp-rnp_sysfs.c:warning:no-previous-prototype-for-function-rnp_mbx_get_pn_sn | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-hashlen_t-is-a-C11-feature | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-page_info_t-is-a-C11-feature | `-- fs-eulerfs-namei.c:warning:variable-de-is-uninitialized-when-used-here |-- x86_64-buildonly-randconfig-001-20241228 | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- drivers-gpu-drm-loongson-lsdc_plane.o:warning:objtool:lsdc_plane_init-falls-through-to-next-function-lsdc_plane_reset() | `-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union |-- x86_64-buildonly-randconfig-002-20241218 | |-- fs-dirty_pages.o:warning:objtool:seq_read_dirty:unreachable-instruction | |-- kernel-futex-core.o:warning:objtool:futex_lock_pi:unreachable-instruction | `-- net-sched-sch_qfq.o:warning:objtool:qfq_graft_class:unreachable-instruction |-- x86_64-buildonly-randconfig-002-20241228 | |-- arch-x86-kernel-fpu-xstate.o:warning:objtool:get_xsave_addr:unreachable-instruction | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-cpu-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_sel | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_epp | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-cpunum-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-epp_val-not-described-in-cppc_set_epp | |-- drivers-gpu-drm-bridge-cadence-cdns-mhdp8546-core.o:warning:objtool:cdns_mhdp_bandwidth_ok:unreachable-instruction | |-- drivers-media-cec-core-cec-core.o:warning:objtool:cec_allocate_adapter:unreachable-instruction | |-- drivers-of-unittest.o:warning:objtool:of_unittest_destroy_tracked_overlays:unreachable-instruction | |-- kernel-rcu-tree.o:warning:objtool:call_rcu:unreachable-instruction | |-- kernel-time-timer.o:warning:objtool:mod_timer_pending:unreachable-instruction | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- lib-bootconfig.o:warning:objtool:xbc_node_get_data:unreachable-instruction | |-- lib-crypto-curve25519.o:warning:objtool:mod_init:unreachable-instruction | |-- lib-iov_iter.o:warning:objtool:_copy_from_iter:unreachable-instruction | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-page_alloc.o:warning:objtool:__drain_all_pages:unreachable-instruction | |-- mm-page_counter.o:warning:objtool:page_counter_cancel:unreachable-instruction | |-- net-bluetooth-l2cap_core.o:warning:objtool:l2cap_chan_send:unreachable-instruction | `-- net-bridge-br_vlan_options.o:warning:objtool:br_vlan_process_options:unreachable-instruction |-- x86_64-buildonly-randconfig-004-20241228 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-005-20241228 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-006-20241228 | `-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) |-- x86_64-defconfig | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-cpu-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_sel | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_epp | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-cpunum-not-described-in-cppc_get_auto_act_window | `-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-epp_val-not-described-in-cppc_set_epp |-- x86_64-randconfig-101-20241228 | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:the-comparison-will-always-evaluate-as-false-for-the-address-of-head-will-never-be-NULL | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-ubcore_destroy_upi_list | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_poll_jfc | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_post_jetty_recv_wr | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_post_jetty_send_wr | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_post_jfr_wr | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_post_jfs_wr | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_rearm_jfc | |-- drivers-ub-urma-ubcore-ubcore_main.c:warning:no-previous-prototype-for-ubcore_open | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_add_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_check_port_state | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_del_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_lookup_sip_idx | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_notify_uvs_add_sip | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_notify_uvs_del_sip | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_put_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_set_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_idx_alloc | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_idx_free | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_table_init | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_table_uninit | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-ubcore_get_mtu | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:the-comparison-will-always-evaluate-as-false-for-the-address-of-head-will-never-be-NULL | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_release | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:the-comparison-will-always-evaluate-as-false-for-the-address-of-head-will-never-be-NULL | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-ubcore_hash_table_rmv_vtpn | `-- kernel-stackleak.c:opportunity-for-str_enabled_disabled(state) |-- x86_64-randconfig-102-20241228 | |-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-103-20241228 | |-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-121-20241228 | |-- drivers-vdpa-vdpa.c:sparse:sparse:cast-from-restricted-__virtio16 | |-- drivers-vdpa-vdpa.c:sparse:sparse:cast-to-restricted-__le16 | `-- net-smc-smc_core.c:sparse:sparse:symbol-__smcr_link_clear-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-122-20241228 | |-- fs-xfs-libxfs-xfs_alloc.c:sparse:sparse:symbol-xfs_ag_fixup_aside-was-not-declared.-Should-it-be-static | |-- fs-xfs-xfs_iomap.c:sparse:sparse:symbol-xfs_iomap_page_ops-was-not-declared.-Should-it-be-static | `-- kernel-watchdog_hld.c:sparse:sparse:symbol-__hardlockup_detector_perf_init-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20241228 | |-- drivers-md-md.c:sparse:sparse:dereference-of-noderef-expression | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:cast-to-restricted-__be64 | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-flag-got-restricted-gfp_t | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-desc-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-hw_cmd_paddr-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-hw_wb_resp_paddr-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-next_cell_paddr-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_chipitf.c:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- drivers-scsi-huawei-hifc-hifc_chipitf.c:sparse:sparse:symbol-hifc_get_red_info_by_rw_type-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_chipitf.c:sparse:sparse:symbol-hifc_initial_dynamic_info-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:cast-to-restricted-__be64 | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-addressable-usertype-db_info-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:symbol-hifc_set_cmdq_ctxts-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-__cqm_bitmap_init-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-__cqm_object_table_init-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_bat_fill_cla_std_entry-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_cla_entry_init_tbl-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_cla_get-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_static_qpc_cla_get-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:cast-to-restricted-__be64 | |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-desc-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:mixing-different-enum-types: | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_assign_probe_index-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_config_get_op-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_config_set_op-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_flush_root_ctx-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_flush_srq_ctx-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_fun_op-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_release_probe_index-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-service_cqm_temp-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-dev_cmd_handler-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_get_phy_init_status-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_hw_rx_buf_size-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_msg_to_mgmt_no_ack-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_ppf_ht_gpa_deinit-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_ppf_ht_gpa_init-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_read_reg-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_set_vport_enable-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-val-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-dif_protect_op_code-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-dif_sect_size-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_build_sql_by_local_sge_num-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_check_fcp_rsp_iu-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_conf_dual_sgl_info-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_dif_action_delete-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_dif_action_forward-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_get_com_err_code-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_get_dif_info_l1-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_get_dma_direction_by_fcp_cmnd-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_process_ini_fail_io-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-no_dif_sect_size-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-ref_tag_mod-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-manufacture_id-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-reason_code-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-resp_code-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:symbol-hifc_event_process-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:symbol-hifc_get_ppf_hwdev_by_pdev-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:cast-to-restricted-__be64 | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-aeq_err_type-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-com_up_err_event_type-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-err_event_type-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-hifc_dfx_get_rxtx_error_state-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-hifc_diag_op-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-hifc_port_info-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-scq_err_type-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:cast-to-restricted-__be16 | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:cast-to-restricted-__be64 | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-addressable-assigned-usertype-dw0-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-next_page_addr_hi-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-next_page_addr_lo-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-ctrl_ch_val-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-per_xmit_data_size-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-scq_num_rcv_cmd-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-val_wd0-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-val_wd1-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-aeq_info-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-doorbell_record-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-conn_id-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-oqid_rd-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-oqid_wr-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_alloc_parent_sq-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_check_all_parent_queue_free-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_clear_els_srq-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_disable_queues_dispatch-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_find_parent_queue_info_by_id-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_init_parent_ctx-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_invalid_parent_sq-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_map_shared_queue_qid-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_pop_delay_sqe-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_root_rq_irq-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_root_rqe_analysis-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_root_sq_irq-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_scq_irq-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_set_scq_irq_cfg-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_update_root_rq_info-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_all_parent_queue_free-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_all_queues_empty-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_queue_set_flush_done-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_root_sq_empty-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-cid-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-e_d_tov_timer_val-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-mfs_unaligned_bytes-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-tx_mfs-got-restricted-__be16 | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-tx_mfs-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-els_pld_table_map-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_get_gs_req_and_rsp_pld_len-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_rcv_abts_marker_sts-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_rcv_tmf_marker_sts-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_scqe_error_pre_process-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-scqe_handler_table-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-addressable-assigned-usertype-val32-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_rd32_clear-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_wr32-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_wr64-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_wr64_pair-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_tool_hw.c:sparse:sparse:symbol-hifc_clp_to_mgmt-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_tool_hw.c:sparse:sparse:symbol-hifc_is_in_host-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_tool_hw.c:sparse:sparse:symbol-hifc_physical_port_id-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_utils.c:sparse:sparse:cast-to-restricted-__be64 | |-- drivers-scsi-huawei-hifc-hifc_utils.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_wq.c:sparse:sparse:cast-to-restricted-__be64 | |-- drivers-scsi-huawei-hifc-hifc_wq.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-flag-got-restricted-gfp_t | |-- drivers-scsi-huawei-hifc-hifc_wq.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-unf_common.h:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-unf_common.h:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-unf_common.h:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-tmp-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_end-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_gid_ft_wait-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_gid_pt_wait-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_start-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_get_free_rscn_node-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_check_event_mgr_status-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_get_free_event_node-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_init_event_msg-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_init_event_node-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_post_event-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_release_event-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_release_global_event-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_wait_event_mgr_complete-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_exchg.c:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-cm_low_levle_handle-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-event_thread_exit-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-fc_event_handle_thd_comp-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-unf_event_process-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-unf_free_port_feature_pool-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_io.c:sparse:sparse:symbol-ini_error_handler_table-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_io.c:sparse:sparse:symbol-unf_prefer_to_send_scsi_cmnd-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_io_abnormal.c:sparse:sparse:symbol-unf_send_scsi_mgmt_cmnd-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_get_port_params-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_lport_enter_sns_logo-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_lport_name_server_register-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_lport_retry_flogi-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_alloc_vp_index-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_check_vport_pool_status-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_free_vp_index-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_get_free_vport-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_init_vport_from_lport-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_process_vports_linkup-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_abort_all_exch-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_abort_all_sfs_exch-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_abort_ini_io_exch-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_back_to_pool-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_deinit-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_init-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_wait_all_exch_removed-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_wait_rports_removed-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_check_sfp_tx_fault-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_cm_get_port_info-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_get_link_lose_tmo_from_up-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_is_vport_valid-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_lport_deinit-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_port_start_work-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_root_lport_ref_dec-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_set_link_lose_tmo_to_up-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_set_port_bbscn-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_rport.c:sparse:sparse:symbol-unf_get_rport_by_wwn-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_rport.c:sparse:sparse:symbol-unf_init_rport_params-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-assigned-transfer_len-got-restricted-__le32-usertype | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-start_lba-got-restricted-__le32-usertype | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-function_template-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-function_template_v-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-ini_err_code_table_cnt1-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-unf_host_init_attr_setting-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-unf_scsi_create_vport-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-unf_scsi_delete_vport-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-els_handle-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_check_plogi_params-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_lport_enter_msn_plogi-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_prli_handler_com_process-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_process_logo_in_fabric-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_rport_relogin-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_flogi_acc-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_logo_acc-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_logo_by_did-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_pdisc_acc-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_plogi_acc-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_prli_acc-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_prlo-was-not-declared.-Should-it-be-static | |-- drivers-scsi-mpt3sas-mpt3sas_base.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- drivers-vdpa-vdpa.c:sparse:sparse:cast-from-restricted-__virtio16 | |-- drivers-vdpa-vdpa.c:sparse:sparse:cast-to-restricted-__le16 | |-- fs-xfs-libxfs-xfs_alloc.c:sparse:sparse:symbol-xfs_ag_fixup_aside-was-not-declared.-Should-it-be-static | |-- fs-xfs-xfs_iomap.c:sparse:sparse:symbol-xfs_iomap_page_ops-was-not-declared.-Should-it-be-static | |-- security-integrity-ima-ima_main.c:error:too-few-arguments-to-function-ima_appraise_measurement | |-- security-integrity-ima-ima_template_lib.c:sparse:sparse:cast-to-restricted-__le16 | |-- security-integrity-ima-ima_template_lib.c:sparse:sparse:cast-to-restricted-__le64 | |-- security-integrity-ima-ima_template_lib.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-assigned-id-got-restricted-__le16-usertype | `-- security-integrity-ima-ima_template_lib.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-assigned-id-got-restricted-__le32-usertype |-- x86_64-randconfig-161-20241228 | |-- drivers-block-null_blk-main.c-null_add_dev()-warn:missing-error-code-rv | |-- drivers-leds-leds-aw2013.c-aw2013_probe()-warn:inconsistent-returns-chip-mutex-. | |-- drivers-vfio-vfio_iommu_type1.c-vfio_iommu_bind_group()-error:uninitialized-symbol-ret-. | |-- fs-udf-file.c-udf_file_write_iter()-warn:inconsistent-returns-iinfo-i_data_sem-. | |-- fs-zonefs-super.c-zonefs_file_dio_append()-error:uninitialized-symbol-size-. | `-- kernel-sched-fair.c-select_idle_cpu()-error:uninitialized-symbol-time-. `-- x86_64-randconfig-r113-20241228 |-- drivers-md-md.c:sparse:sparse:dereference-of-noderef-expression |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-flag-got-restricted-gfp_t |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-desc-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-hw_cmd_paddr-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-hw_wb_resp_paddr-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-next_cell_paddr-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_chipitf.c:sparse:sparse:Using-plain-integer-as-NULL-pointer |-- drivers-scsi-huawei-hifc-hifc_chipitf.c:sparse:sparse:symbol-hifc_get_red_info_by_rw_type-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_chipitf.c:sparse:sparse:symbol-hifc_initial_dynamic_info-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-addressable-usertype-db_info-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:symbol-hifc_set_cmdq_ctxts-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-__cqm_bitmap_init-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-__cqm_object_table_init-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_bat_fill_cla_std_entry-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_cla_entry_init_tbl-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_cla_get-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_static_qpc_cla_get-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-desc-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:mixing-different-enum-types: |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_assign_probe_index-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_config_get_op-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_config_set_op-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_flush_root_ctx-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_flush_srq_ctx-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_fun_op-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_release_probe_index-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-service_cqm_temp-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-dev_cmd_handler-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_get_phy_init_status-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_hw_rx_buf_size-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_msg_to_mgmt_no_ack-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_ppf_ht_gpa_deinit-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_ppf_ht_gpa_init-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_read_reg-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_set_vport_enable-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-val-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-dif_protect_op_code-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-dif_sect_size-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_build_sql_by_local_sge_num-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_check_fcp_rsp_iu-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_conf_dual_sgl_info-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_dif_action_delete-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_dif_action_forward-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_get_com_err_code-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_get_dif_info_l1-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_get_dma_direction_by_fcp_cmnd-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_process_ini_fail_io-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-no_dif_sect_size-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-ref_tag_mod-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-manufacture_id-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-reason_code-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-resp_code-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:symbol-hifc_event_process-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:symbol-hifc_get_ppf_hwdev_by_pdev-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:Using-plain-integer-as-NULL-pointer |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-aeq_err_type-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-com_up_err_event_type-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-err_event_type-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-hifc_dfx_get_rxtx_error_state-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-hifc_diag_op-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-hifc_port_info-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-scq_err_type-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:cast-to-restricted-__be16 |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-addressable-assigned-usertype-dw0-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-next_page_addr_hi-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-next_page_addr_lo-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-ctrl_ch_val-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-per_xmit_data_size-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-scq_num_rcv_cmd-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-val_wd0-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-val_wd1-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-aeq_info-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-doorbell_record-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-conn_id-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-oqid_rd-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-oqid_wr-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_alloc_parent_sq-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_check_all_parent_queue_free-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_clear_els_srq-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_disable_queues_dispatch-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_find_parent_queue_info_by_id-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_init_parent_ctx-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_invalid_parent_sq-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_map_shared_queue_qid-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_pop_delay_sqe-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_root_rq_irq-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_root_rqe_analysis-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_root_sq_irq-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_scq_irq-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_set_scq_irq_cfg-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_update_root_rq_info-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_all_parent_queue_free-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_all_queues_empty-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_queue_set_flush_done-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_root_sq_empty-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-cid-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-e_d_tov_timer_val-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-mfs_unaligned_bytes-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-tx_mfs-got-restricted-__be16 |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-tx_mfs-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-els_pld_table_map-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_get_gs_req_and_rsp_pld_len-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_rcv_abts_marker_sts-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_rcv_tmf_marker_sts-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_scqe_error_pre_process-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-scqe_handler_table-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-addressable-assigned-usertype-val32-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_rd32_clear-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_wr32-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_wr64-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_wr64_pair-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_tool_hw.c:sparse:sparse:symbol-hifc_clp_to_mgmt-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_tool_hw.c:sparse:sparse:symbol-hifc_is_in_host-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_tool_hw.c:sparse:sparse:symbol-hifc_physical_port_id-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_utils.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-scsi-huawei-hifc-hifc_utils.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_wq.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-scsi-huawei-hifc-hifc_wq.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-flag-got-restricted-gfp_t |-- drivers-scsi-huawei-hifc-hifc_wq.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-unf_common.h:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-unf_common.h:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-unf_common.h:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-tmp-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_end-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_gid_ft_wait-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_gid_pt_wait-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_start-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_get_free_rscn_node-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_check_event_mgr_status-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_get_free_event_node-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_init_event_msg-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_init_event_node-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_post_event-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_release_event-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_release_global_event-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_wait_event_mgr_complete-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_exchg.c:sparse:sparse:Using-plain-integer-as-NULL-pointer |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-cm_low_levle_handle-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-event_thread_exit-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-fc_event_handle_thd_comp-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-unf_event_process-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-unf_free_port_feature_pool-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_io.c:sparse:sparse:symbol-ini_error_handler_table-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_io.c:sparse:sparse:symbol-unf_prefer_to_send_scsi_cmnd-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_io_abnormal.c:sparse:sparse:symbol-unf_send_scsi_mgmt_cmnd-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_get_port_params-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_lport_enter_sns_logo-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_lport_name_server_register-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_lport_retry_flogi-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_alloc_vp_index-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_check_vport_pool_status-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_free_vp_index-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_get_free_vport-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_init_vport_from_lport-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_process_vports_linkup-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_abort_all_exch-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_abort_all_sfs_exch-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_abort_ini_io_exch-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_back_to_pool-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_deinit-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_init-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_wait_all_exch_removed-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_wait_rports_removed-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_check_sfp_tx_fault-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_cm_get_port_info-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_get_link_lose_tmo_from_up-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_is_vport_valid-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_lport_deinit-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_port_start_work-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_root_lport_ref_dec-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_set_link_lose_tmo_to_up-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_set_port_bbscn-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_rport.c:sparse:sparse:symbol-unf_get_rport_by_wwn-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_rport.c:sparse:sparse:symbol-unf_init_rport_params-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-assigned-transfer_len-got-restricted-__le32-usertype |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-start_lba-got-restricted-__le32-usertype |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-function_template-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-function_template_v-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-ini_err_code_table_cnt1-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-unf_host_init_attr_setting-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-unf_scsi_create_vport-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-unf_scsi_delete_vport-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-els_handle-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_check_plogi_params-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_lport_enter_msn_plogi-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_prli_handler_com_process-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_process_logo_in_fabric-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_rport_relogin-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_flogi_acc-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_logo_acc-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_logo_by_did-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_pdisc_acc-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_plogi_acc-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_prli_acc-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_prlo-was-not-declared.-Should-it-be-static |-- drivers-scsi-megaraid-megaraid_sas_base.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__user-ptr-got-unsigned-int-usertype-sense_cioc_ptr |-- drivers-scsi-megaraid-megaraid_sas_base.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__user-ptr-got-void-noderef-__user-sense_ioc_ptr |-- drivers-scsi-megaraid-megaraid_sas_base.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-noderef-__user-got-void-noderef-__user-sense_ioc_ptr |-- drivers-scsi-mpt3sas-mpt3sas_base.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu |-- drivers-vdpa-vdpa.c:sparse:sparse:cast-from-restricted-__virtio16 |-- drivers-vdpa-vdpa.c:sparse:sparse:cast-to-restricted-__le16 `-- kernel-watchdog_hld.c:sparse:sparse:symbol-__hardlockup_detector_perf_init-was-not-declared.-Should-it-be-static elapsed time: 726m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20241228 gcc-14.2.0 arm64 randconfig-002-20241228 clang-15 arm64 randconfig-003-20241228 gcc-14.2.0 arm64 randconfig-004-20241228 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241228 clang-19 x86_64 buildonly-randconfig-002-20241228 clang-19 x86_64 buildonly-randconfig-003-20241228 gcc-12 x86_64 buildonly-randconfig-004-20241228 clang-19 x86_64 buildonly-randconfig-005-20241228 clang-19 x86_64 buildonly-randconfig-006-20241228 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1358/1358] fs/select.o: warning: objtool: poll_select_finish()+0x246: can't find switch jump table
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 44ae3d3e5f1f99c0fd5f040e4da88b0c5b3ec76b [1358/1358] select: shift restore_saved_sigmask_unless() into poll_select_copy_remaining() config: x86_64-randconfig-102-20241228 (https://download.01.org/0day-ci/archive/20241229/202412290510.qDzEXEra-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412290510.qDzEXEra-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290510.qDzEXEra-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/select.o: warning: objtool: poll_select_finish()+0x246: can't find switch jump table -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1358/1358] drivers/edac/i10nm_base.c:135:19: sparse: sparse: cast removes address space '__iomem' of expression
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 3b7ad71a0a415eb51fb41ddc01ef538a7e163de4 [1358/1358] Intel: EDAC, i10nm: Add a driver for Intel 10nm server processors config: x86_64-randconfig-121-20241228 (https://download.01.org/0day-ci/archive/20241229/202412290441.n0ZIl7ko-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412290441.n0ZIl7ko-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290441.n0ZIl7ko-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/edac/i10nm_base.c:135:19: sparse: sparse: cast removes address space '__iomem' of expression drivers/edac/i10nm_base.c:157:31: sparse: sparse: cast removes address space '__iomem' of expression drivers/edac/i10nm_base.c:158:37: sparse: sparse: cast removes address space '__iomem' of expression vim +/__iomem +135 drivers/edac/i10nm_base.c 130 131 static bool i10nm_check_ecc(struct skx_imc *imc, int chan) 132 { 133 u32 mcmtr; 134 > 135 mcmtr = *(u32 *)(imc->mbase + 0x20ef8 + chan * 0x4000); 136 edac_dbg(1, "ch%d mcmtr reg %x\n", chan, mcmtr); 137 138 return !!GET_BITFIELD(mcmtr, 2, 2); 139 } 140 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] fs/dirty_pages.o: warning: objtool: seq_read_dirty()+0x112: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4848f81edc2027721953fee5ded81f909a833e26 commit: 5a1ee7023c691ec9881a70d8d0c00f6f018a7b05 [2589/2589] fs/dirty_pages: fix some errors in seq_read_dirty() config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241229/202412290447.CV8oCAhR-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412290447.CV8oCAhR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290447.CV8oCAhR-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/dirty_pages.o: warning: objtool: seq_read_dirty()+0x112: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1358/1358] drivers/staging/gmjstcm/tcm_tis_spi.c:727:33: sparse: sparse: incorrect type in argument 2 (different address spaces)
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 5ebbfc8c29eb5eb6dfdab853bdb2a622e0533d7e [1358/1358] staging: TCM: add GMJS(Nationz Tech) TCM driver. config: arm64-randconfig-r123-20241228 (https://download.01.org/0day-ci/archive/20241229/202412290404.3HbuWdrq-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241229/202412290404.3HbuWdrq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290404.3HbuWdrq-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/staging/gmjstcm/tcm_tis_spi.c:125:32: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void *static [noderef] [toplevel] __iomem gpio1_a5 @@ drivers/staging/gmjstcm/tcm_tis_spi.c:125:32: sparse: expected void volatile [noderef] __iomem *addr drivers/staging/gmjstcm/tcm_tis_spi.c:125:32: sparse: got void *static [noderef] [toplevel] __iomem gpio1_a5 drivers/staging/gmjstcm/tcm_tis_spi.c:178:33: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void *static [noderef] [toplevel] __iomem gpio1_a5 @@ drivers/staging/gmjstcm/tcm_tis_spi.c:178:33: sparse: expected void volatile [noderef] __iomem *addr drivers/staging/gmjstcm/tcm_tis_spi.c:178:33: sparse: got void *static [noderef] [toplevel] __iomem gpio1_a5 drivers/staging/gmjstcm/tcm_tis_spi.c:109:5: sparse: sparse: symbol 'tcm_tis_spi_transfer' was not declared. Should it be static? drivers/staging/gmjstcm/tcm_tis_spi.c:710:32: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *static [noderef] [toplevel] __iomem reuse_conf_reg @@ got void [noderef] __iomem * @@ drivers/staging/gmjstcm/tcm_tis_spi.c:710:32: sparse: expected void *static [noderef] [toplevel] __iomem reuse_conf_reg drivers/staging/gmjstcm/tcm_tis_spi.c:710:32: sparse: got void [noderef] __iomem * drivers/staging/gmjstcm/tcm_tis_spi.c:718:26: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *static [noderef] [toplevel] __iomem gpio1_a5 @@ got void [noderef] __iomem * @@ drivers/staging/gmjstcm/tcm_tis_spi.c:718:26: sparse: expected void *static [noderef] [toplevel] __iomem gpio1_a5 drivers/staging/gmjstcm/tcm_tis_spi.c:718:26: sparse: got void [noderef] __iomem * drivers/staging/gmjstcm/tcm_tis_spi.c:726:37: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void *static [noderef] [toplevel] __iomem reuse_conf_reg @@ drivers/staging/gmjstcm/tcm_tis_spi.c:726:37: sparse: expected void const volatile [noderef] __iomem *addr drivers/staging/gmjstcm/tcm_tis_spi.c:726:37: sparse: got void *static [noderef] [toplevel] __iomem reuse_conf_reg >> drivers/staging/gmjstcm/tcm_tis_spi.c:727:33: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void *static [noderef] [toplevel] __iomem reuse_conf_reg @@ drivers/staging/gmjstcm/tcm_tis_spi.c:727:33: sparse: expected void volatile [noderef] __iomem *addr drivers/staging/gmjstcm/tcm_tis_spi.c:727:33: sparse: got void *static [noderef] [toplevel] __iomem reuse_conf_reg drivers/staging/gmjstcm/tcm_tis_spi.c:729:42: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/staging/gmjstcm/tcm_tis_spi.c:729:42: sparse: expected void volatile [noderef] __iomem *addr drivers/staging/gmjstcm/tcm_tis_spi.c:729:42: sparse: got void * drivers/staging/gmjstcm/tcm_tis_spi.c:790:33: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void *static [noderef] [toplevel] __iomem reuse_conf_reg @@ drivers/staging/gmjstcm/tcm_tis_spi.c:790:33: sparse: expected void volatile [noderef] __iomem *addr drivers/staging/gmjstcm/tcm_tis_spi.c:790:33: sparse: got void *static [noderef] [toplevel] __iomem reuse_conf_reg drivers/staging/gmjstcm/tcm_tis_spi.c:792:33: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void *static [noderef] [toplevel] __iomem gpio1_a5 @@ drivers/staging/gmjstcm/tcm_tis_spi.c:792:33: sparse: expected void volatile [noderef] __iomem *addr drivers/staging/gmjstcm/tcm_tis_spi.c:792:33: sparse: got void *static [noderef] [toplevel] __iomem gpio1_a5 drivers/staging/gmjstcm/tcm_tis_spi.c:805:33: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void *static [noderef] [toplevel] __iomem reuse_conf_reg @@ drivers/staging/gmjstcm/tcm_tis_spi.c:805:33: sparse: expected void volatile [noderef] __iomem *addr drivers/staging/gmjstcm/tcm_tis_spi.c:805:33: sparse: got void *static [noderef] [toplevel] __iomem reuse_conf_reg drivers/staging/gmjstcm/tcm_tis_spi.c:807:33: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void *static [noderef] [toplevel] __iomem gpio1_a5 @@ drivers/staging/gmjstcm/tcm_tis_spi.c:807:33: sparse: expected void volatile [noderef] __iomem *addr drivers/staging/gmjstcm/tcm_tis_spi.c:807:33: sparse: got void *static [noderef] [toplevel] __iomem gpio1_a5 drivers/staging/gmjstcm/tcm_tis_spi.c:125:32: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:125:32: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:178:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:178:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:234:13: sparse: sparse: context imbalance in 'cleanup_tis' - wrong count at exit drivers/staging/gmjstcm/tcm_tis_spi.c:711:22: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:719:22: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:726:37: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:726:37: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:727:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:726:37: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:727:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:729:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:729:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:789:21: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:790:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:791:21: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:792:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:804:21: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:805:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:806:21: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:807:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:109:5: warning: no previous prototype for 'tcm_tis_spi_transfer' [-Wmissing-prototypes] 109 | int tcm_tis_spi_transfer(struct device *dev, u32 addr, u16 len, | ^~~~~~~~~~~~~~~~~~~~ drivers/staging/gmjstcm/tcm_tis_spi.c: In function 'recv_data': drivers/staging/gmjstcm/tcm_tis_spi.c:423:13: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 423 | int ret; | ^~~ drivers/staging/gmjstcm/tcm_tis_spi.c: In function 'cleanup_tis': drivers/staging/gmjstcm/tcm_tis_spi.c:249:17: warning: 'inten' may be used uninitialized [-Wmaybe-uninitialized] 249 | tcm_tis_writel(chip->dev, TCM_INT_ENABLE(chip->vendor.locality), | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 250 | ~TCM_GLOBAL_INT_ENABLE & inten); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/staging/gmjstcm/tcm_tis_spi.c:237:13: note: 'inten' was declared here 237 | u32 inten; | ^~~~~ drivers/staging/gmjstcm/tcm_tis_spi.c: In function 'tcm_tis_spi_probe': drivers/staging/gmjstcm/tcm_tis_spi.c:740:21: warning: 'vendor' may be used uninitialized [-Wmaybe-uninitialized] 740 | if ((vendor & 0xffff) != 0x19f5 && (vendor & 0xffff) != 0x1B4E) { | ~~~~~~~~^~~~~~~~~ drivers/staging/gmjstcm/tcm_tis_spi.c:658:13: note: 'vendor' was declared here 658 | u32 vendor, intfcaps; | ^~~~~~ vim +727 drivers/staging/gmjstcm/tcm_tis_spi.c 652 653 static struct tcm_chip *chip; 654 static int tcm_tis_spi_probe(struct spi_device *spi) 655 { 656 int ret; 657 u8 revid; 658 u32 vendor, intfcaps; 659 struct tcm_tis_spi_phy *phy; 660 struct chip_data *spi_chip; 661 662 pr_info("TCM(ky): __func__(v=%d) ..\n", 663 10); 664 665 tcm_dbg("TCM-dbg: %s/%d, enter\n", __func__, __LINE__); 666 phy = devm_kzalloc(&spi->dev, sizeof(struct tcm_tis_spi_phy), 667 GFP_KERNEL); 668 if (!phy) 669 return -ENOMEM; 670 671 phy->iobuf = devm_kmalloc(&spi->dev, MAX_SPI_FRAMESIZE, GFP_KERNEL); 672 if (!phy->iobuf) 673 return -ENOMEM; 674 675 phy->spi_device = spi; 676 init_completion(&phy->ready); 677 678 tcm_dbg("TCM-dbg: %s/%d\n", __func__, __LINE__); 679 /* init spi dev */ 680 spi->chip_select = 0; /* cs0 */ 681 spi->mode = SPI_MODE_0; 682 spi->bits_per_word = 8; 683 spi->max_speed_hz = spi->max_speed_hz ? : 24000000; 684 spi_setup(spi); 685 686 spi_chip = spi_get_ctldata(spi); 687 if (!spi_chip) { 688 pr_err("There was wrong in spi master\n"); 689 return -ENODEV; 690 } 691 /* tcm does not support interrupt mode, we use poll mode instead. */ 692 spi_chip->poll_mode = 1; 693 694 tcm_dbg("TCM-dbg: %s/%d\n", __func__, __LINE__); 695 /* regiter tcm hw */ 696 chip = tcm_register_hardware(&spi->dev, &tcm_tis); 697 if (!chip) { 698 dev_err(chip->dev, "tcm register hardware err\n"); 699 return -ENODEV; 700 } 701 702 dev_set_drvdata(chip->dev, phy); 703 704 /** 705 * phytium2000a4 spi controller's clk clk level is unstable, 706 * so it is solved by using the low level of gpio output. 707 **/ 708 if (is_ft_all() && (spi->chip_select == 0)) { 709 /* reuse conf reg base */ 710 reuse_conf_reg = ioremap(REUSE_CONF_REG_BASE, 0x10); 711 if (!reuse_conf_reg) { 712 dev_err(&spi->dev, "Failed to ioremap reuse conf reg\n"); 713 ret = -ENOMEM; 714 goto out_err; 715 } 716 717 /* gpio1 a5 base addr */ 718 gpio1_a5 = ioremap(REUSE_GPIO1_A5_BASE, 0x10); 719 if (!gpio1_a5) { 720 dev_err(&spi->dev, "Failed to ioremap gpio1 a5\n"); 721 ret = -ENOMEM; 722 goto out_err; 723 } 724 725 /* reuse cs0 to gpio1_a5 */ 726 iowrite32((ioread32(reuse_conf_reg) | 0xFFFF0) & 0xFFF9004F, > 727 reuse_conf_reg); 728 /* set gpio1 a5 to output */ 729 iowrite32(0x20, gpio1_a5 + 0x4); 730 } 731 732 tcm_dbg("TCM-dbg: %s/%d\n", 733 __func__, __LINE__); 734 ret = tcm_tis_readl(chip->dev, TCM_DID_VID(0), &vendor); 735 if (ret < 0) 736 goto out_err; 737 738 tcm_dbg("TCM-dbg: %s/%d, vendor: 0x%x\n", 739 __func__, __LINE__, vendor); 740 if ((vendor & 0xffff) != 0x19f5 && (vendor & 0xffff) != 0x1B4E) { 741 dev_err(chip->dev, "there is no Nationz TCM on you computer\n"); 742 goto out_err; 743 } 744 745 ret = tcm_tis_readb(chip->dev, TCM_RID(0), &revid); 746 tcm_dbg("TCM-dbg: %s/%d, revid: 0x%x\n", 747 __func__, __LINE__, revid); 748 if (ret < 0) 749 goto out_err; 750 dev_info(chip->dev, "kylin: 2019-09-21 1.2 TCM " 751 "(device-id 0x%X, rev-id %d)\n", 752 vendor >> 16, revid); 753 754 /* Default timeouts */ 755 chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT); 756 chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT); 757 chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT); 758 chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT); 759 760 tcm_dbg("TCM-dbg: %s/%d\n", 761 __func__, __LINE__); 762 /* Figure out the capabilities */ 763 ret = tcm_tis_readl(chip->dev, 764 TCM_INTF_CAPS(chip->vendor.locality), &intfcaps); 765 if (ret < 0) 766 goto out_err; 767 768 tcm_dbg("TCM-dbg: %s/%d, intfcaps: 0x%x\n", 769 __func__, __LINE__, intfcaps); 770 if (request_locality(chip, 0) != 0) { 771 dev_err(chip->dev, "tcm request_locality err\n"); 772 ret = -ENODEV; 773 goto out_err; 774 } 775 776 INIT_LIST_HEAD(&chip->vendor.list); 777 spin_lock(&tis_lock); 778 list_add(&chip->vendor.list, &tis_chips); 779 spin_unlock(&tis_lock); 780 781 tcm_get_timeouts(chip); 782 tcm_startup(chip); 783 784 tcm_dbg("TCM-dbg: %s/%d, exit\n", __func__, __LINE__); 785 return 0; 786 787 out_err: 788 if (is_ft_all()) { 789 if (reuse_conf_reg) 790 iounmap(reuse_conf_reg); 791 if (gpio1_a5) 792 iounmap(gpio1_a5); 793 } 794 tcm_dbg("TCM-dbg: %s/%d, error\n", __func__, __LINE__); 795 dev_set_drvdata(chip->dev, chip); 796 tcm_remove_hardware(chip->dev); 797 798 return ret; 799 } 800 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 3567c3eb83b7211f9f906a3daa22470dd5649b94
by kernel test robot 29 Dec '24

29 Dec '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 3567c3eb83b7211f9f906a3daa22470dd5649b94 !14336 mm: Backport mainline patch Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- drivers-ata-libahci.c:warning:no-previous-prototype-for-function-get_ahci_em_messages | |-- instantiation:error:expected-absolute-expression | |-- kernel-sched-bpf_sched.c:warning:no-previous-prototype-for-function-bpf_sched_entity_is_task | |-- kernel-sched-bpf_sched.c:warning:no-previous-prototype-for-function-bpf_sched_entity_to_task | `-- kernel-sched-bpf_sched.c:warning:no-previous-prototype-for-function-bpf_sched_tag_of_entity |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_DRBG_CTR-when-selected-by-CRYPTO_DEV_HISI_TRNG | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 |-- arm64-randconfig-002-20241228 | `-- instantiation:error:expected-absolute-expression |-- loongarch-allmodconfig | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:la_iommu_setup-defined-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:mq-poll-directive-output-may-be-truncated-writing-bytes-into-a-region-of-size-between-and | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | |-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc | |-- kernel-sched-bpf_sched.c:warning:no-previous-prototype-for-bpf_sched_entity_is_task | |-- kernel-sched-bpf_sched.c:warning:no-previous-prototype-for-bpf_sched_entity_to_task | `-- kernel-sched-bpf_sched.c:warning:no-previous-prototype-for-bpf_sched_tag_of_entity |-- loongarch-allnoconfig | |-- arch-loongarch-kernel-efi.c:error:implicit-declaration-of-function-pmd_mkhuge | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | |-- arch-loongarch-kernel-legacy_boot.c:error:implicit-declaration-of-function-nid_to_addrbase | |-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) | `-- include-linux-suspend.h:error:expected-)-before-numeric-constant |-- loongarch-allyesconfig | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:mq-poll-directive-output-may-be-truncated-writing-bytes-into-a-region-of-size-between-and | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | |-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc | |-- kernel-sched-bpf_sched.c:warning:no-previous-prototype-for-bpf_sched_entity_is_task | |-- kernel-sched-bpf_sched.c:warning:no-previous-prototype-for-bpf_sched_entity_to_task | |-- kernel-sched-bpf_sched.c:warning:no-previous-prototype-for-bpf_sched_tag_of_entity | |-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-comp_setup_strp | `-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-comp_stream_read |-- loongarch-defconfig | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:la_iommu_setup-defined-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | `-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid |-- loongarch-randconfig-002-20241228 | |-- arch-loongarch-kernel-efi.c:error:implicit-declaration-of-function-pmd_mkhuge | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | |-- arch-loongarch-kernel-legacy_boot.c:error:implicit-declaration-of-function-nid_to_addrbase | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- x86_64-allnoconfig | |-- drivers-char-lsse_sdf_cdev.c:linux-module.h-is-included-more-than-once. | |-- drivers-scsi-leapioraid-leapioraid_app.c:leapioraid_func.h-is-included-more-than-once. | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-VFIO_MDEV-when-selected-by-CRYPTO_DEV_HCT |-- x86_64-allyesconfig | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-sm3_generic_block_fn | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_finup | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_update | |-- arch-x86-crypto-sm4-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-gmi_sm4_set_key | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-function-get_nt_block_copy_mini_len | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-function-set_c86_features_para_invalid | |-- arch-x86-kernel-csv-shared.c:warning:no-previous-prototype-for-function-csv3_early_secure_call_ident_map | |-- arch-x86-kernel-csv-shared.c:warning:no-previous-prototype-for-function-csv3_scan_secure_call_pages | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpustate_free_space | |-- arch-x86-kvm-svm-csv.c:warning:no-previous-prototype-for-function-csv_vm_attestation | |-- arch-x86-kvm-svm-sev.c:warning:no-previous-prototype-for-function-sev_install_hooks | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-add_sgpio_zhaoxin | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_wait_em_reset | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio_gpmode | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-remove_sgpio_zhaoxin | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-set_em_messages | |-- drivers-ata-libahci.c:warning:no-previous-prototype-for-function-get_ahci_em_messages | |-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-calcs-dcn_calc_auto.c:warning:stack-frame-size-()-exceeds-limit-()-in-mode_support_and_system_configuration | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-dcn30-display_mode_vba_30.c:warning:stack-frame-size-()-exceeds-limit-()-in-dml30_ModeSupportAndSystemConfigurationFull | |-- kernel-sched-bpf_sched.c:warning:no-previous-prototype-for-function-bpf_sched_entity_is_task | |-- kernel-sched-bpf_sched.c:warning:no-previous-prototype-for-function-bpf_sched_entity_to_task | |-- kernel-sched-bpf_sched.c:warning:no-previous-prototype-for-function-bpf_sched_tag_of_entity | |-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-function-comp_setup_strp | `-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-function-comp_stream_read |-- x86_64-buildonly-randconfig-001-20241228 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-004-20241228 | `-- drivers-ata-libahci.c:warning:no-previous-prototype-for-function-get_ahci_em_messages |-- x86_64-buildonly-randconfig-005-20241228 | |-- drivers-ata-libahci.c:warning:no-previous-prototype-for-function-get_ahci_em_messages | |-- drivers-crypto-ccp-hygon-hct.c:error:no-member-named-numa_node-in-struct-device | `-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:error:use-of-undeclared-identifier-NR_syscalls |-- x86_64-buildonly-randconfig-006-20241228 | `-- drivers-crypto-ccp-hygon-hct.c:error:struct-device-has-no-member-named-numa_node |-- x86_64-randconfig-102-20241228 | |-- arch-x86-kernel-csv-shared.c:warning:no-previous-prototype-for-function-csv3_early_secure_call_ident_map | |-- arch-x86-kernel-csv-shared.c:warning:no-previous-prototype-for-function-csv3_scan_secure_call_pages | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-add_sgpio_zhaoxin | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_wait_em_reset | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio_gpmode | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-remove_sgpio_zhaoxin | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-set_em_messages | `-- drivers-ata-libahci.c:warning:no-previous-prototype-for-function-get_ahci_em_messages |-- x86_64-randconfig-103-20241228 | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-add_sgpio_zhaoxin | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_wait_em_reset | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio_gpmode | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-remove_sgpio_zhaoxin | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-set_em_messages | |-- drivers-ata-libahci.c:warning:no-previous-prototype-for-function-get_ahci_em_messages | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_dev_user.c:error:call-to-undeclared-function-eventfd_ctx_fileget-ISO-C99-and-later-do-not-support-implicit-function-declarations | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_dev_user.c:error:incompatible-integer-to-pointer-conversion-assigning-to-struct-eventfd_ctx-from-int |-- x86_64-randconfig-161-20241228 | |-- kernel-pid_sysctl.h-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:pid_ns_ctl_table_vm-proc_handler | `-- kernel-pid_sysctl.h-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:pid_ns_ctl_table_vm-procname `-- x86_64-randconfig-r051-20241228 |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-add_sgpio_zhaoxin |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_wait_em_reset |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio_gpmode |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-remove_sgpio_zhaoxin |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-set_em_messages |-- drivers-ata-libahci.c:warning:no-previous-prototype-for-function-get_ahci_em_messages `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.o:warning:objtool:.text.nbl_dev_start_user_dev:unexpected-end-of-section elapsed time: 724m configs tested: 21 configs skipped: 123 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20241228 gcc-14.2.0 arm64 randconfig-002-20241228 clang-15 arm64 randconfig-003-20241228 gcc-14.2.0 arm64 randconfig-004-20241228 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20241228 gcc-14.2.0 loongarch randconfig-002-20241228 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241228 clang-19 x86_64 buildonly-randconfig-002-20241228 clang-19 x86_64 buildonly-randconfig-003-20241228 gcc-12 x86_64 buildonly-randconfig-004-20241228 clang-19 x86_64 buildonly-randconfig-005-20241228 clang-19 x86_64 buildonly-randconfig-006-20241228 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 773f731853f1368508a0b112047bd9b5a4bb9a5e
by kernel test robot 29 Dec '24

29 Dec '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 773f731853f1368508a0b112047bd9b5a4bb9a5e !14326 mm: Backport mainline patch Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202412281637.7HUx9YuE-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202412281933.AtwopaHj-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202412282007.9AwBcoM1-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202412282259.rKjvWsmv-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202412290049.0DgodFXr-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202412290049.f0BfxWby-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202412290146.quOZpqaQ-lkp@intel.com drivers/block/.tmp_null_blk_zoned.o: warning: objtool: missing symbol for section .text drivers/net/ethernet/netswift/txgbe/txgbe_bp.o: warning: objtool: missing symbol for section .text drivers/net/ethernet/netswift/txgbe/txgbe_mtd.o: warning: objtool: missing symbol for section .text drivers/net/ethernet/netswift/txgbe/txgbe_phy.o: warning: objtool: missing symbol for section .text fs/xfs/xfs_rtalloc.o: warning: objtool: missing symbol for section .text include/linux/kern_levels.h:5:25: warning: format '%lu' expects argument of type 'long unsigned int', but argument 42 has type 'int' [-Wformat=] include/linux/kern_levels.h:5:25: warning: format '%p' expects argument of type 'void *', but argument 40 has type 'long unsigned int' [-Wformat=] kernel/sysctl.c:1817:36: error: 'ten_thousand' undeclared here (not in a function); did you mean 'one_thousand'? mm/.tmp_mmu_gather.o: warning: objtool: missing symbol for section .text net/sched/.tmp_sch_etf.o: warning: objtool: missing symbol for section .init.text Unverified Error/Warning (likely false positive, kindly check if interested): drivers/firmware/meson/meson_sm.c:169:17: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/firmware/meson/meson_sm.c:203:9: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/video/fbdev/sh_mobile_lcdcfb.c:1713:27: sparse: sparse: incorrect type in assignment (different address spaces) sound/isa/ad1848/ad1848.o: warning: objtool: missing symbol for section .init.text sound/isa/sb/jazz16.o: warning: objtool: missing symbol for section .init.text sound/isa/sb/sb16.o: warning: objtool: missing symbol for section .init.text sound/isa/sb/sb8.o: warning: objtool: missing symbol for section .init.text sound/isa/sc6000.o: warning: objtool: missing symbol for section .init.text sound/isa/sscape.o: warning: objtool: missing symbol for section .init.text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-defconfig | `-- net-ipv4-route.c:warning:array-subscript-is-outside-array-bounds-of-struct-fib_nh |-- arm64-randconfig-001-20241228 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20241228 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:tcm_tis_spi_acpi_match-defined-but-not-used | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-003-20241228 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa |-- arm64-randconfig-004-20241228 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa |-- arm64-randconfig-r062-20241228 | |-- drivers-dma-ti-edma.c:opportunity-for-str_yes_no(ecc-chmap_exist) | |-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:tcm_tis_spi_acpi_match-defined-but-not-used | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-r122-20241228 | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_issue-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_requeue-was-not-declared.-Should-it-be-static | |-- drivers-gpu-drm-msm-adreno-a6xx_gmu.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-noderef-pdc_mmio-got-void-noderef-__iomem | |-- drivers-gpu-drm-msm-disp-dpu1-dpu_crtc.c:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- drivers-gpu-drm-msm-disp-dpu1-dpu_plane.c:sparse:sparse:symbol-dpu_plane_danger_signal_ctrl-was-not-declared.-Should-it-be-static | |-- drivers-gpu-drm-nouveau-dispnv50-corec37d.c:sparse:sparse:symbol-corec37d_init-was-not-declared.-Should-it-be-static | |-- drivers-gpu-drm-nouveau-dispnv50-corec37d.c:sparse:sparse:symbol-corec37d_ntfy_wait_done-was-not-declared.-Should-it-be-static | |-- drivers-gpu-drm-nouveau-nvkm-engine-fifo-gpfifogv100.c:sparse:sparse:symbol-gv100_fifo_gpfifo_func-was-not-declared.-Should-it-be-static | |-- drivers-gpu-drm-nouveau-nvkm-subdev-mmu-vmmgv100.c:sparse:sparse:symbol-gv100_vmm_join-was-not-declared.-Should-it-be-static | |-- drivers-gpu-drm-sun4i-sun4i_tcon.c:sparse:sparse:symbol-sun4i_tcon_set_mux-was-not-declared.-Should-it-be-static | |-- drivers-iommu-iommu.c:sparse:sparse:dubious:x-y | |-- drivers-misc-aspeed-lpc-snoop.c:sparse:sparse:incorrect-type-in-initializer-(different-base-types)-expected-restricted-__poll_t-(-poll-)(-...-)-got-unsigned-int-(-)(-...-) | |-- kernel-cred.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-p-got-int-const-noderef-__rcu | |-- kernel-dma-coherent.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-addr-got-void-noderef-__iomem-mem_base | |-- kernel-dma-coherent.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-noderef-__iomem-mem_base-got-void | |-- kernel-dma-coherent.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-virt_base-got-void-noderef-__iomem-mem_base | |-- kernel-module.c:sparse:sparse:symbol-set_module_sig_enforced-was-not-declared.-Should-it-be-static | |-- kernel-time-time.c:sparse:sparse:symbol-__compat_get_timespec64-was-not-declared.-Should-it-be-static | |-- kernel-time-time.c:sparse:sparse:symbol-__compat_put_timespec64-was-not-declared.-Should-it-be-static | |-- lib-kobject.c:sparse:sparse:symbol-kset_get_ownership-was-not-declared.-Should-it-be-static | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa |-- arm64-randconfig-r123-20241228 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-firmware-meson-meson_sm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-got-void-noderef-__iomem-static-toplevel-sm_shmem_out_base | |-- drivers-firmware-meson-meson_sm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__iomem-static-toplevel-sm_shmem_in_base | |-- drivers-gpu-drm-msm-adreno-a6xx_gmu.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-noderef-pdc_mmio-got-void-noderef-__iomem | |-- drivers-gpu-drm-msm-disp-dpu1-dpu_crtc.c:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- drivers-gpu-drm-msm-disp-dpu1-dpu_plane.c:sparse:sparse:symbol-dpu_plane_danger_signal_ctrl-was-not-declared.-Should-it-be-static | |-- drivers-gpu-drm-sun4i-sun4i_tcon.c:sparse:sparse:symbol-sun4i_tcon_set_mux-was-not-declared.-Should-it-be-static | |-- drivers-misc-aspeed-lpc-snoop.c:sparse:sparse:incorrect-type-in-initializer-(different-base-types)-expected-restricted-__poll_t-(-poll-)(-...-)-got-unsigned-int-(-)(-...-) | |-- drivers-video-fbdev-sh_mobile_lcdcfb.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-char-noderef-__iomem-screen_base-got-void-fb_mem | |-- drivers-w1-slaves-w1_ds28e04.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-char-const-noderef-__user-got-char-const-buf | |-- drivers-w1-slaves-w1_ds28e04.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-char-noderef-__user-got-char-buf | |-- kernel-cred.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-p-got-int-const-noderef-__rcu | |-- kernel-dma-coherent.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-addr-got-void-noderef-__iomem-mem_base | |-- kernel-dma-coherent.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-noderef-__iomem-mem_base-got-void | |-- kernel-dma-coherent.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-virt_base-got-void-noderef-__iomem-mem_base | |-- kernel-module.c:sparse:sparse:symbol-set_module_sig_enforced-was-not-declared.-Should-it-be-static | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- kernel-time-time.c:sparse:sparse:symbol-__compat_get_timespec64-was-not-declared.-Should-it-be-static | |-- kernel-time-time.c:sparse:sparse:symbol-__compat_put_timespec64-was-not-declared.-Should-it-be-static | |-- lib-kobject.c:sparse:sparse:symbol-kset_get_ownership-was-not-declared.-Should-it-be-static | |-- mm-kmemleak.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__percpu-ptr-got-void-const-ptr | |-- mm-kmemleak.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-ptr-got-void-const-noderef-__percpu-ptr | |-- mm-kmemleak.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-__percpu-ptr-got-void-const-ptr | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled | `-- mm-vmstat.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-unsigned-short-noderef-usertype-__percpu-got-unsigned-short |-- arm64-randconfig-r133-20241227 | |-- include-linux-kern_levels.h:warning:format-lu-expects-argument-of-type-long-unsigned-int-but-argument-has-type-int | |-- include-linux-kern_levels.h:warning:format-p-expects-argument-of-type-void-but-argument-has-type-long-unsigned-int | |-- include-linux-share_pool.h:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-struct-task_struct-got-struct-task_struct-noderef-__rcu-owner | |-- kernel-sysctl.c:error:ten_thousand-undeclared-here-(not-in-a-function) | `-- mm-share_pool.c:sparse:sparse:incompatible-types-for-operation-(-): |-- x86_64-allnoconfig | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-net-ethernet-hisilicon-hns3-hns3_extension-hns3_enet_it.c:warning:no-previous-prototype-for-function-hns3_nic_select_queue_it | `-- samples-vfio-mdev-.tmp_mdpy-fb.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20241224 | |-- drivers-block-.tmp_null_blk_zoned.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-.tmp_mmu_gather.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-001-20241228 | |-- arch-x86-kernel-unwind_orc.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-dispnv50-base.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-dispnv50-core.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-dispnv50-core507d.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-dispnv50-curs.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-dispnv50-oimm.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-dispnv50-oimm507b.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-dispnv50-ovly.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-dispnv50-wimm.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-nvif-disp.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-nvif-fifo.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-nvif-user.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-nvkm-engine-disp-hdmigv100.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-nvkm-engine-gr-ctxgf117.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-xen-xen_drm_front_cfg.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-xen-xen_drm_front_gem.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-input-rmi4-rmi_2d_sensor.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-mtd-nand-core.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-pci-ats.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-pci-controller-dwc-pcie-designware.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-usb-dwc2-hcd_ddma.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-xen-mem-reservation.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration | |-- net-ipv4-metrics.o:warning:objtool:missing-symbol-for-section-.text | |-- net-ipv4-netlink.o:warning:objtool:missing-symbol-for-section-.text | |-- net-mac80211-vht.o:warning:objtool:missing-symbol-for-section-.text | |-- net-mac80211-wep.o:warning:objtool:missing-symbol-for-section-.text | `-- net-mac80211-wpa.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-002-20241228 | |-- mm-slab_common.o:warning:objtool:kmem_cache_create_usercopy:unreachable-instruction | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20241219 | |-- drivers-net-ethernet-netswift-txgbe-txgbe_bp.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-netswift-txgbe-txgbe_mtd.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-netswift-txgbe-txgbe_phy.o:warning:objtool:missing-symbol-for-section-.text | `-- fs-xfs-xfs_rtalloc.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-003-20241228 | |-- arch-x86-kernel-cpu-mce-genpool.o:warning:objtool:missing-symbol-for-section-.text | |-- arch-x86-xen-setup.o:warning:objtool:missing-symbol-for-section-.ref.text | |-- block-bfq-wf2q.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-char-tpm-eventlog-of.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-crypto-ccree-cc_debugfs.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-crypto-ccree-cc_hash.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-fpga-dfl-fme-main.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-xen-xen_drm_front_cfg.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-xen-xen_drm_front_gem.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-hid-i2c-hid-i2c-hid-core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-hwmon-mlxreg-fan.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-hwmon-raspberrypi-hwmon.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-hwtracing-intel_th-debug.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-usb-dwc2-hcd_ddma.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-usb-host-xhci-histb.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-video-backlight-otm3225a.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-autofs-init.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-udf-unicode.o:warning:objtool:missing-symbol-for-section-.text | |-- kernel-sched-core.o:warning:objtool:missing-symbol-for-section-.text.unlikely | |-- kernel-sched-pelt.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-memcontrol.o:warning:objtool:missing-symbol-for-section-.text.unlikely | |-- sound-core-seq-seq_midi_emul.o:warning:objtool:missing-symbol-for-section-.text | |-- sound-drivers-opl3-opl3_seq.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-firewire-dice-dice-alesis.o:warning:objtool:missing-symbol-for-section-.text | |-- sound-firewire-dice-dice-extension.o:warning:objtool:missing-symbol-for-section-.text | |-- sound-firewire-dice-dice-mytek.o:warning:objtool:missing-symbol-for-section-.text | |-- sound-firewire-dice-dice-tcelectronic.o:warning:objtool:missing-symbol-for-section-.text | |-- sound-isa-ad1848-ad1848.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-cmi8328.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-cs423x-cs4231.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-galaxy-azt1605.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-galaxy-azt2316.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-gus-gusclassic.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-gus-gusextreme.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-gus-gusmax.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-msnd-msnd_classic.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-sb-jazz16.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-sb-sb16.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-sb-sb8.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-sc6000.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-sscape.o:warning:objtool:missing-symbol-for-section-.init.text | `-- sound-xen-xen_snd_front.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-004-20241228 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20241228 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20241226 | `-- net-sched-.tmp_sch_etf.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20241228 | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-defconfig | |-- kernel-sched-pelt.o:warning:objtool:missing-symbol-for-section-.text | |-- net-ipv4-metrics.o:warning:objtool:missing-symbol-for-section-.text | `-- net-ipv4-netlink.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-randconfig-101-20241228 | |-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-randconfig-102-20241228 | |-- drivers-of-dynamic.o:warning:objtool:of_reconfig_get_state_change:can-t-find-switch-jump-table | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-103-20241228 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-104-20241228 | |-- kernel-hung_task.c:error:sysctl_hung_task_all_cpu_backtrace-undeclared-(first-use-in-this-function) | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-randconfig-121-20241228 | |-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init | |-- drivers-usb-musb-musb_core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-addr-got-void-const-noderef-__iomem-addr | |-- kernel-hung_task.c:error:sysctl_hung_task_all_cpu_backtrace-undeclared-(first-use-in-this-function) | |-- kernel-time-time.c:sparse:sparse:symbol-__compat_get_timespec64-was-not-declared.-Should-it-be-static | |-- kernel-time-time.c:sparse:sparse:symbol-__compat_put_timespec64-was-not-declared.-Should-it-be-static | |-- lib-kobject.c:sparse:sparse:symbol-kset_get_ownership-was-not-declared.-Should-it-be-static | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled | |-- net-core-sock.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-socket_wq-noderef-__rcu-sk_wq-got-struct-socket_wq-wq | `-- net-ipv4-route.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-restricted-__be16-usertype-len-got-unsigned-long |-- x86_64-randconfig-122-20241228 | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_issue-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_requeue-was-not-declared.-Should-it-be-static | |-- drivers-usb-musb-musb_core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-addr-got-void-const-noderef-__iomem-addr | |-- drivers-usb-typec-tcpm.c:sparse:sparse:restricted-__le16-degrades-to-integer | |-- fs-ext4-super.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-got-char-noderef-__rcu | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- kernel-time-time.c:sparse:sparse:symbol-__compat_get_timespec64-was-not-declared.-Should-it-be-static | |-- kernel-time-time.c:sparse:sparse:symbol-__compat_put_timespec64-was-not-declared.-Should-it-be-static | |-- lib-kobject.c:sparse:sparse:symbol-kset_get_ownership-was-not-declared.-Should-it-be-static | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled | |-- net-core-sock.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-socket_wq-noderef-__rcu-sk_wq-got-struct-socket_wq-wq | `-- net-ipv4-route.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-restricted-__be16-usertype-len-got-unsigned-long |-- x86_64-randconfig-123-20241228 | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_issue-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_requeue-was-not-declared.-Should-it-be-static | |-- kernel-hung_task.c:error:sysctl_hung_task_all_cpu_backtrace-undeclared-(first-use-in-this-function) | |-- kernel-time-time.c:sparse:sparse:symbol-__compat_get_timespec64-was-not-declared.-Should-it-be-static | |-- kernel-time-time.c:sparse:sparse:symbol-__compat_put_timespec64-was-not-declared.-Should-it-be-static | |-- lib-kobject.c:sparse:sparse:symbol-kset_get_ownership-was-not-declared.-Should-it-be-static | |-- net-core-sock.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-socket_wq-noderef-__rcu-sk_wq-got-struct-socket_wq-wq | |-- net-ipv4-route.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-restricted-__be16-usertype-len-got-unsigned-long | `-- net-mac80211-rx.c:sparse:sparse:dubious:x-y |-- x86_64-randconfig-161-20241228 | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled `-- x86_64-randconfig-r113-20241228 |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_issue-was-not-declared.-Should-it-be-static |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_requeue-was-not-declared.-Should-it-be-static |-- drivers-usb-typec-tcpm.c:sparse:sparse:restricted-__le16-degrades-to-integer |-- kernel-time-time.c:sparse:sparse:symbol-__compat_get_timespec64-was-not-declared.-Should-it-be-static |-- kernel-time-time.c:sparse:sparse:symbol-__compat_put_timespec64-was-not-declared.-Should-it-be-static |-- lib-kobject.c:sparse:sparse:symbol-kset_get_ownership-was-not-declared.-Should-it-be-static |-- net-core-sock.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-socket_wq-noderef-__rcu-sk_wq-got-struct-socket_wq-wq `-- net-ipv4-route.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-restricted-__be16-usertype-len-got-unsigned-long elapsed time: 721m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20241228 gcc-14.2.0 arm64 randconfig-002-20241228 gcc-14.2.0 arm64 randconfig-003-20241228 gcc-14.2.0 arm64 randconfig-004-20241228 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241228 clang-19 x86_64 buildonly-randconfig-002-20241228 clang-19 x86_64 buildonly-randconfig-003-20241228 gcc-12 x86_64 buildonly-randconfig-004-20241228 clang-19 x86_64 buildonly-randconfig-005-20241228 clang-19 x86_64 buildonly-randconfig-006-20241228 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] net/sched/sch_qfq.o: warning: objtool: qfq_graft_class()+0xbd: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4848f81edc2027721953fee5ded81f909a833e26 commit: 387687bb20f419c9cfb021a4e2c2a14935dd5c64 [2589/2589] net: sched: sch_qfq: Use non-work-conserving warning handler config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241229/202412290220.89K1KTZx-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412290220.89K1KTZx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290220.89K1KTZx-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/sched/sch_qfq.o: warning: objtool: qfq_graft_class()+0xbd: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1358/1358] fs/ext4/super.c:4550:38: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 15f255ec0f768bebebd8e3d9dfaad0afb9e78d4d [1358/1358] ext4: fix use-after-free race in ext4_remount()'s error path config: x86_64-randconfig-122-20241228 (https://download.01.org/0day-ci/archive/20241229/202412290146.quOZpqaQ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412290146.quOZpqaQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290146.quOZpqaQ-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> fs/ext4/super.c:4550:38: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const * @@ got char [noderef] __rcu * @@ fs/ext4/super.c:4550:38: sparse: expected void const * fs/ext4/super.c:4550:38: sparse: got char [noderef] __rcu * vim +4550 fs/ext4/super.c 9b2ff35753c051 Jan Kara 2013-03-02 4449 617ba13b31fbf5 Mingming Cao 2006-10-11 4450 EXT4_SB(sb)->s_mount_state |= EXT4_ORPHAN_FS; 617ba13b31fbf5 Mingming Cao 2006-10-11 4451 ext4_orphan_cleanup(sb, es); 617ba13b31fbf5 Mingming Cao 2006-10-11 4452 EXT4_SB(sb)->s_mount_state &= ~EXT4_ORPHAN_FS; 0390131ba84fd3 Frank Mayhar 2009-01-07 4453 if (needs_recovery) { b31e15527a9bb7 Eric Sandeen 2009-06-04 4454 ext4_msg(sb, KERN_INFO, "recovery complete"); 617ba13b31fbf5 Mingming Cao 2006-10-11 4455 ext4_mark_recovery_complete(sb, es); 0390131ba84fd3 Frank Mayhar 2009-01-07 4456 } 0390131ba84fd3 Frank Mayhar 2009-01-07 4457 if (EXT4_SB(sb)->s_journal) { 0390131ba84fd3 Frank Mayhar 2009-01-07 4458 if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) 0390131ba84fd3 Frank Mayhar 2009-01-07 4459 descr = " journalled data mode"; 0390131ba84fd3 Frank Mayhar 2009-01-07 4460 else if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_ORDERED_DATA) 0390131ba84fd3 Frank Mayhar 2009-01-07 4461 descr = " ordered data mode"; 0390131ba84fd3 Frank Mayhar 2009-01-07 4462 else 0390131ba84fd3 Frank Mayhar 2009-01-07 4463 descr = " writeback data mode"; 0390131ba84fd3 Frank Mayhar 2009-01-07 4464 } else 0390131ba84fd3 Frank Mayhar 2009-01-07 4465 descr = "out journal"; 0390131ba84fd3 Frank Mayhar 2009-01-07 4466 79add3a3f795e6 Lukas Czerner 2012-11-08 4467 if (test_opt(sb, DISCARD)) { 79add3a3f795e6 Lukas Czerner 2012-11-08 4468 struct request_queue *q = bdev_get_queue(sb->s_bdev); 79add3a3f795e6 Lukas Czerner 2012-11-08 4469 if (!blk_queue_discard(q)) 79add3a3f795e6 Lukas Czerner 2012-11-08 4470 ext4_msg(sb, KERN_WARNING, 79add3a3f795e6 Lukas Czerner 2012-11-08 4471 "mounting with \"discard\" option, but " 79add3a3f795e6 Lukas Czerner 2012-11-08 4472 "the device does not support discard"); 79add3a3f795e6 Lukas Czerner 2012-11-08 4473 } 79add3a3f795e6 Lukas Czerner 2012-11-08 4474 e294a5371b2e0b Theodore Ts'o 2015-08-15 4475 if (___ratelimit(&ext4_mount_msg_ratelimit, "EXT4-fs mount")) d4c402d9fd97a5 Curt Wohlgemuth 2010-05-16 4476 ext4_msg(sb, KERN_INFO, "mounted filesystem with%s. " 5aee0f8a3f42c9 Theodore Ts'o 2016-11-18 4477 "Opts: %.*s%s%s", descr, 5aee0f8a3f42c9 Theodore Ts'o 2016-11-18 4478 (int) sizeof(sbi->s_es->s_mount_opts), 5aee0f8a3f42c9 Theodore Ts'o 2016-11-18 4479 sbi->s_es->s_mount_opts, 8b67f04ab9de5d Theodore Ts'o 2010-08-01 4480 *sbi->s_es->s_mount_opts ? "; " : "", orig_data); ac27a0ec112a08 Dave Kleikamp 2006-10-11 4481 66e61a9e9504f6 Theodore Ts'o 2010-07-27 4482 if (es->s_error_count) 66e61a9e9504f6 Theodore Ts'o 2010-07-27 4483 mod_timer(&sbi->s_err_report, jiffies + 300*HZ); /* 5 minutes */ ac27a0ec112a08 Dave Kleikamp 2006-10-11 4484 efbed4dc5857f8 Theodore Ts'o 2013-10-17 4485 /* Enable message ratelimiting. Default is 10 messages per 5 secs. */ efbed4dc5857f8 Theodore Ts'o 2013-10-17 4486 ratelimit_state_init(&sbi->s_err_ratelimit_state, 5 * HZ, 10); efbed4dc5857f8 Theodore Ts'o 2013-10-17 4487 ratelimit_state_init(&sbi->s_warning_ratelimit_state, 5 * HZ, 10); efbed4dc5857f8 Theodore Ts'o 2013-10-17 4488 ratelimit_state_init(&sbi->s_msg_ratelimit_state, 5 * HZ, 10); efbed4dc5857f8 Theodore Ts'o 2013-10-17 4489 d4c402d9fd97a5 Curt Wohlgemuth 2010-05-16 4490 kfree(orig_data); ac27a0ec112a08 Dave Kleikamp 2006-10-11 4491 return 0; ac27a0ec112a08 Dave Kleikamp 2006-10-11 4492 617ba13b31fbf5 Mingming Cao 2006-10-11 4493 cantfind_ext4: ac27a0ec112a08 Dave Kleikamp 2006-10-11 4494 if (!silent) b31e15527a9bb7 Eric Sandeen 2009-06-04 4495 ext4_msg(sb, KERN_ERR, "VFS: Can't find ext4 filesystem"); ac27a0ec112a08 Dave Kleikamp 2006-10-11 4496 goto failed_mount; ac27a0ec112a08 Dave Kleikamp 2006-10-11 4497 72ba74508b2857 Theodore Ts'o 2013-01-24 4498 #ifdef CONFIG_QUOTA 72ba74508b2857 Theodore Ts'o 2013-01-24 4499 failed_mount8: ebd173beb8db5b Theodore Ts'o 2015-09-23 4500 ext4_unregister_sysfs(sb); 72ba74508b2857 Theodore Ts'o 2013-01-24 4501 #endif dcf2d804ed6ffe Tao Ma 2011-10-06 4502 failed_mount7: dcf2d804ed6ffe Tao Ma 2011-10-06 4503 ext4_unregister_li_request(sb); dcf2d804ed6ffe Tao Ma 2011-10-06 4504 failed_mount6: f9ae9cf5d72b39 Theodore Ts'o 2014-07-11 4505 ext4_mb_release(sb); d5e03cbb0c88cd Theodore Ts'o 2014-07-15 4506 if (sbi->s_flex_groups) b93b41d4c7338d Al Viro 2014-11-20 4507 kvfree(sbi->s_flex_groups); d5e03cbb0c88cd Theodore Ts'o 2014-07-15 4508 percpu_counter_destroy(&sbi->s_freeclusters_counter); d5e03cbb0c88cd Theodore Ts'o 2014-07-15 4509 percpu_counter_destroy(&sbi->s_freeinodes_counter); d5e03cbb0c88cd Theodore Ts'o 2014-07-15 4510 percpu_counter_destroy(&sbi->s_dirs_counter); d5e03cbb0c88cd Theodore Ts'o 2014-07-15 4511 percpu_counter_destroy(&sbi->s_dirtyclusters_counter); 007649375f6af2 Azat Khuzhin 2014-04-07 4512 failed_mount5: f9ae9cf5d72b39 Theodore Ts'o 2014-07-11 4513 ext4_ext_release(sb); f9ae9cf5d72b39 Theodore Ts'o 2014-07-11 4514 ext4_release_system_zone(sb); f9ae9cf5d72b39 Theodore Ts'o 2014-07-11 4515 failed_mount4a: 94bf608a18fa44 Al Viro 2012-01-09 4516 dput(sb->s_root); 32a9bb57d7c1fd Manish Katiyar 2011-02-27 4517 sb->s_root = NULL; 94bf608a18fa44 Al Viro 2012-01-09 4518 failed_mount4: b31e15527a9bb7 Eric Sandeen 2009-06-04 4519 ext4_msg(sb, KERN_ERR, "mount failed"); 2e8fa54e3b48e4 Jan Kara 2013-06-04 4520 if (EXT4_SB(sb)->rsv_conversion_wq) 2e8fa54e3b48e4 Jan Kara 2013-06-04 4521 destroy_workqueue(EXT4_SB(sb)->rsv_conversion_wq); 4c0425ff68b1b8 Mingming Cao 2009-09-28 4522 failed_mount_wq: dec214d00e0d78 Tahsin Erdogan 2017-06-22 4523 if (sbi->s_ea_inode_cache) { dec214d00e0d78 Tahsin Erdogan 2017-06-22 4524 ext4_xattr_destroy_cache(sbi->s_ea_inode_cache); dec214d00e0d78 Tahsin Erdogan 2017-06-22 4525 sbi->s_ea_inode_cache = NULL; dec214d00e0d78 Tahsin Erdogan 2017-06-22 4526 } 47387409ee2e09 Tahsin Erdogan 2017-06-22 4527 if (sbi->s_ea_block_cache) { 47387409ee2e09 Tahsin Erdogan 2017-06-22 4528 ext4_xattr_destroy_cache(sbi->s_ea_block_cache); 47387409ee2e09 Tahsin Erdogan 2017-06-22 4529 sbi->s_ea_block_cache = NULL; 82939d7999dfc1 Jan Kara 2016-02-22 4530 } 0390131ba84fd3 Frank Mayhar 2009-01-07 4531 if (sbi->s_journal) { dab291af8d6307 Mingming Cao 2006-10-11 4532 jbd2_journal_destroy(sbi->s_journal); 47b4a50bebfd34 Jan Kara 2008-07-11 4533 sbi->s_journal = NULL; 0390131ba84fd3 Frank Mayhar 2009-01-07 4534 } 50460fe8c6d1d9 Darrick J. Wong 2014-10-30 4535 failed_mount3a: d3922a777f9b4c Zheng Liu 2013-07-01 4536 ext4_es_unregister_shrinker(sbi); eb68d0e2fc5a4e Zheng Liu 2014-09-01 4537 failed_mount3: 9105bb149bbbc5 Al Viro 2013-12-08 4538 del_timer_sync(&sbi->s_err_report); c5e06d101aaf72 Johann Lombardi 2011-05-24 4539 if (sbi->s_mmp_tsk) c5e06d101aaf72 Johann Lombardi 2011-05-24 4540 kthread_stop(sbi->s_mmp_tsk); ac27a0ec112a08 Dave Kleikamp 2006-10-11 4541 failed_mount2: ac27a0ec112a08 Dave Kleikamp 2006-10-11 4542 for (i = 0; i < db_count; i++) ac27a0ec112a08 Dave Kleikamp 2006-10-11 4543 brelse(sbi->s_group_desc[i]); b93b41d4c7338d Al Viro 2014-11-20 4544 kvfree(sbi->s_group_desc); ac27a0ec112a08 Dave Kleikamp 2006-10-11 4545 failed_mount: 0441984a339897 Darrick J. Wong 2012-04-29 4546 if (sbi->s_chksum_driver) 0441984a339897 Darrick J. Wong 2012-04-29 4547 crypto_free_shash(sbi->s_chksum_driver); ac27a0ec112a08 Dave Kleikamp 2006-10-11 4548 #ifdef CONFIG_QUOTA a2d4a646e61954 Jan Kara 2014-09-11 4549 for (i = 0; i < EXT4_MAXQUOTAS; i++) ac27a0ec112a08 Dave Kleikamp 2006-10-11 @4550 kfree(sbi->s_qf_names[i]); ac27a0ec112a08 Dave Kleikamp 2006-10-11 4551 #endif 617ba13b31fbf5 Mingming Cao 2006-10-11 4552 ext4_blkdev_remove(sbi); ac27a0ec112a08 Dave Kleikamp 2006-10-11 4553 brelse(bh); ac27a0ec112a08 Dave Kleikamp 2006-10-11 4554 out_fail: ac27a0ec112a08 Dave Kleikamp 2006-10-11 4555 sb->s_fs_info = NULL; f68301656b5f5d Manish Katiyar 2009-05-17 4556 kfree(sbi->s_blockgroup_lock); 5aee0f8a3f42c9 Theodore Ts'o 2016-11-18 4557 out_free_base: ac27a0ec112a08 Dave Kleikamp 2006-10-11 4558 kfree(sbi); d4c402d9fd97a5 Curt Wohlgemuth 2010-05-16 4559 kfree(orig_data); 5e405595e5bf4c Dan Williams 2017-08-24 4560 fs_put_dax(dax_dev); 07aa2ea13814ea Lukas Czerner 2012-11-08 4561 return err ? err : ret; ac27a0ec112a08 Dave Kleikamp 2006-10-11 4562 } ac27a0ec112a08 Dave Kleikamp 2006-10-11 4563 :::::: The code at line 4550 was first introduced by commit :::::: ac27a0ec112a089f1a5102bc8dffc79c8c815571 [PATCH] ext4: initial copy of files from ext3 :::::: TO: Dave Kleikamp <shaggy(a)austin.ibm.com> :::::: CC: Linus Torvalds <torvalds(a)g5.osdl.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1336/1336] drivers/net/ethernet/netswift/txgbe/txgbe_mtd.o: warning: objtool: missing symbol for section .text
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: e9f0b33ca1fa178f87823d17762a4d2f9296efd1 [1336/1336] net: txgbe: Add support for Netswift 10G NIC config: x86_64-buildonly-randconfig-003-20241219 (https://download.01.org/0day-ci/archive/20241229/202412290049.f0BfxWby-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412290049.f0BfxWby-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290049.f0BfxWby-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c:19: drivers/net/ethernet/netswift/txgbe/txgbe.h:871:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 871 | u32 cur_diff = 0; | ^ drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c:178:12: warning: no previous prototype for function 'mtdCheckDeviceCapabilities' [-Wmissing-prototypes] 178 | MTD_STATUS mtdCheckDeviceCapabilities( | ^ drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c:178:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 178 | MTD_STATUS mtdCheckDeviceCapabilities( | ^ | static drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c:290:12: warning: no previous prototype for function 'mtdIsPhyReadyAfterReset' [-Wmissing-prototypes] 290 | MTD_STATUS mtdIsPhyReadyAfterReset( | ^ drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c:290:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 290 | MTD_STATUS mtdIsPhyReadyAfterReset( | ^ | static drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c:342:12: warning: no previous prototype for function 'mtdIsPhyReadyAfterHardwareReset' [-Wmissing-prototypes] 342 | MTD_STATUS mtdIsPhyReadyAfterHardwareReset( | ^ drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c:342:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 342 | MTD_STATUS mtdIsPhyReadyAfterHardwareReset( | ^ | static drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c:829:12: warning: no previous prototype for function 'mtdAutonegIsCompleted' [-Wmissing-prototypes] 829 | MTD_STATUS mtdAutonegIsCompleted( | ^ drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c:829:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 829 | MTD_STATUS mtdAutonegIsCompleted( | ^ | static drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c:1119:12: warning: no previous prototype for function 'mtdCunitSwReset' [-Wmissing-prototypes] 1119 | MTD_STATUS mtdCunitSwReset( | ^ drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c:1119:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1119 | MTD_STATUS mtdCunitSwReset( | ^ | static drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c:1127:12: warning: no previous prototype for function 'mtdRerunSerdesAutoInitializationUseAutoMode' [-Wmissing-prototypes] 1127 | MTD_STATUS mtdRerunSerdesAutoInitializationUseAutoMode( | ^ drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c:1127:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1127 | MTD_STATUS mtdRerunSerdesAutoInitializationUseAutoMode( | ^ | static drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c:1275:9: warning: no previous prototype for function 'mtdSemCreate' [-Wmissing-prototypes] 1275 | MTD_SEM mtdSemCreate( | ^ drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c:1275:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1275 | MTD_SEM mtdSemCreate( | ^ | static 8 warnings generated. >> drivers/net/ethernet/netswift/txgbe/txgbe_mtd.o: warning: objtool: missing symbol for section .text -- In file included from drivers/net/ethernet/netswift/txgbe/txgbe_bp.c:19: In file included from drivers/net/ethernet/netswift/txgbe/txgbe_bp.h:22: drivers/net/ethernet/netswift/txgbe/txgbe.h:871:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 871 | u32 cur_diff = 0; | ^ drivers/net/ethernet/netswift/txgbe/txgbe_bp.c:582:5: warning: no previous prototype for function 'ReadPhyLaneTxEq' [-Wmissing-prototypes] 582 | int ReadPhyLaneTxEq(unsigned short lane, struct txgbe_adapter *adapter, int post_t, int mode) | ^ drivers/net/ethernet/netswift/txgbe/txgbe_bp.c:582:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 582 | int ReadPhyLaneTxEq(unsigned short lane, struct txgbe_adapter *adapter, int post_t, int mode) | ^ | static drivers/net/ethernet/netswift/txgbe/txgbe_bp.c:645:5: warning: no previous prototype for function 'EnableCl72KrTr' [-Wmissing-prototypes] 645 | int EnableCl72KrTr(unsigned int enable, struct txgbe_adapter *adapter) | ^ drivers/net/ethernet/netswift/txgbe/txgbe_bp.c:645:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 645 | int EnableCl72KrTr(unsigned int enable, struct txgbe_adapter *adapter) | ^ | static drivers/net/ethernet/netswift/txgbe/txgbe_bp.c:699:5: warning: no previous prototype for function 'CheckCl72KrTrStatus' [-Wmissing-prototypes] 699 | int CheckCl72KrTrStatus(struct txgbe_adapter *adapter) | ^ drivers/net/ethernet/netswift/txgbe/txgbe_bp.c:699:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 699 | int CheckCl72KrTrStatus(struct txgbe_adapter *adapter) | ^ | static 4 warnings generated. >> drivers/net/ethernet/netswift/txgbe/txgbe_bp.o: warning: objtool: missing symbol for section .text -- In file included from drivers/net/ethernet/netswift/txgbe/txgbe_phy.c:24: In file included from drivers/net/ethernet/netswift/txgbe/txgbe_phy.h:28: drivers/net/ethernet/netswift/txgbe/txgbe.h:871:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 871 | u32 cur_diff = 0; | ^ 1 warning generated. drivers/net/ethernet/netswift/txgbe/txgbe_phy.c:95: warning: Function parameter or member 'hw' not described in 'txgbe_get_phy_type_from_id' drivers/net/ethernet/netswift/txgbe/txgbe_phy.c:95: warning: Excess function parameter 'phy_id' description in 'txgbe_get_phy_type_from_id' drivers/net/ethernet/netswift/txgbe/txgbe_phy.c:169: warning: Function parameter or member 'device_type' not described in 'txgbe_read_phy_reg_mdi' drivers/net/ethernet/netswift/txgbe/txgbe_phy.c:207: warning: Function parameter or member 'device_type' not described in 'txgbe_read_phy_reg' drivers/net/ethernet/netswift/txgbe/txgbe_phy.c:324: warning: Function parameter or member 'speed_set' not described in 'txgbe_setup_phy_link' drivers/net/ethernet/netswift/txgbe/txgbe_phy.c:324: warning: Function parameter or member 'autoneg_wait_to_complete' not described in 'txgbe_setup_phy_link' drivers/net/ethernet/netswift/txgbe/txgbe_phy.c:376: warning: Function parameter or member 'autoneg_wait_to_complete' not described in 'txgbe_setup_phy_link_speed' drivers/net/ethernet/netswift/txgbe/txgbe_phy.c:774: warning: Function parameter or member 'sff8472_data' not described in 'txgbe_read_i2c_sff8472' drivers/net/ethernet/netswift/txgbe/txgbe_phy.c:774: warning: Excess function parameter 'eeprom_data' description in 'txgbe_read_i2c_sff8472' drivers/net/ethernet/netswift/txgbe/txgbe_phy.c:810: warning: Function parameter or member 'dev_addr' not described in 'txgbe_read_i2c_byte_int' drivers/net/ethernet/netswift/txgbe/txgbe_phy.c:872: warning: Function parameter or member 'dev_addr' not described in 'txgbe_read_i2c_byte' drivers/net/ethernet/netswift/txgbe/txgbe_phy.c:891: warning: Function parameter or member 'dev_addr' not described in 'txgbe_write_i2c_byte_int' drivers/net/ethernet/netswift/txgbe/txgbe_phy.c:935: warning: Function parameter or member 'dev_addr' not described in 'txgbe_write_i2c_byte' >> drivers/net/ethernet/netswift/txgbe/txgbe_phy.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1345/1345] mm/.tmp_mmu_gather.o: warning: objtool: missing symbol for section .text
by kernel test robot 29 Dec '24

29 Dec '24

Hi Peter, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 1f7b24152a85bec4ea4f5a6219b4702853ffd3e6 [1345/1345] mm/memory: Move mmu_gather and TLB invalidation code into its own file config: x86_64-buildonly-randconfig-001-20241224 (https://download.01.org/0day-ci/archive/20241229/202412290049.0DgodFXr-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412290049.0DgodFXr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290049.0DgodFXr-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/mmu_gather.c:6: include/linux/pagemap.h:401:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 401 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. >> mm/.tmp_mmu_gather.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] kernel/futex/core.o: warning: objtool: futex_lock_pi()+0x6ec: unreachable instruction
by kernel test robot 28 Dec '24

28 Dec '24

Hi Peter, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4848f81edc2027721953fee5ded81f909a833e26 commit: f552f518f86f4489577e296625e624271e2f76b2 [2589/2589] futex: Move to kernel/futex/ config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241228/202412282222.K2wXdQAA-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241228/202412282222.K2wXdQAA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412282222.K2wXdQAA-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/futex/core.o: warning: objtool: futex_lock_pi()+0x6ec: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1355/1355] kernel/sysctl.c:1817:36: error: 'ten_thousand' undeclared here (not in a function); did you mean 'one_thousand'?
by kernel test robot 28 Dec '24

28 Dec '24

Hi Tang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 5a2c074184137763d604ffb3f0178da26bee5260 [1355/1355] share_pool: Add sp_alloc trace config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241228/202412282259.rKjvWsmv-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241228/202412282259.rKjvWsmv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412282259.rKjvWsmv-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/sysctl.c:1817:36: sparse: sparse: undefined identifier 'ten_thousand' kernel/sysctl.c:2246:66: sparse: sparse: self-comparison always evaluates to false >> kernel/sysctl.c:1817:36: error: 'ten_thousand' undeclared here (not in a function); did you mean 'one_thousand'? 1817 | .extra2 = &ten_thousand, | ^~~~~~~~~~~~ | one_thousand -- >> kernel/sysctl.c:1817:36: error: 'ten_thousand' undeclared here (not in a function); did you mean 'one_thousand'? 1817 | .extra2 = &ten_thousand, | ^~~~~~~~~~~~ | one_thousand vim +1817 kernel/sysctl.c 1274 1275 static struct ctl_table vm_table[] = { 1276 { 1277 .procname = "overcommit_memory", 1278 .data = &sysctl_overcommit_memory, 1279 .maxlen = sizeof(sysctl_overcommit_memory), 1280 .mode = 0644, 1281 .proc_handler = proc_dointvec_minmax, 1282 .extra1 = &zero, 1283 .extra2 = &two, 1284 }, 1285 { 1286 .procname = "panic_on_oom", 1287 .data = &sysctl_panic_on_oom, 1288 .maxlen = sizeof(sysctl_panic_on_oom), 1289 .mode = 0644, 1290 .proc_handler = proc_dointvec_minmax, 1291 .extra1 = &zero, 1292 .extra2 = &two, 1293 }, 1294 #ifdef CONFIG_ASCEND_OOM 1295 { 1296 /* 0: diasable, 1: enable, 2: disable and panic on oom */ 1297 .procname = "enable_oom_killer", 1298 .data = &sysctl_enable_oom_killer, 1299 .maxlen = sizeof(sysctl_enable_oom_killer), 1300 .mode = 0644, 1301 .proc_handler = proc_dointvec_minmax, 1302 .extra1 = &zero, 1303 .extra2 = &two, 1304 }, 1305 #endif 1306 { 1307 .procname = "oom_kill_allocating_task", 1308 .data = &sysctl_oom_kill_allocating_task, 1309 .maxlen = sizeof(sysctl_oom_kill_allocating_task), 1310 .mode = 0644, 1311 .proc_handler = proc_dointvec, 1312 }, 1313 { 1314 .procname = "oom_dump_tasks", 1315 .data = &sysctl_oom_dump_tasks, 1316 .maxlen = sizeof(sysctl_oom_dump_tasks), 1317 .mode = 0644, 1318 .proc_handler = proc_dointvec, 1319 }, 1320 { 1321 .procname = "overcommit_ratio", 1322 .data = &sysctl_overcommit_ratio, 1323 .maxlen = sizeof(sysctl_overcommit_ratio), 1324 .mode = 0644, 1325 .proc_handler = overcommit_ratio_handler, 1326 }, 1327 { 1328 .procname = "overcommit_kbytes", 1329 .data = &sysctl_overcommit_kbytes, 1330 .maxlen = sizeof(sysctl_overcommit_kbytes), 1331 .mode = 0644, 1332 .proc_handler = overcommit_kbytes_handler, 1333 }, 1334 { 1335 .procname = "page-cluster", 1336 .data = &page_cluster, 1337 .maxlen = sizeof(int), 1338 .mode = 0644, 1339 .proc_handler = proc_dointvec_minmax, 1340 .extra1 = &zero, 1341 }, 1342 { 1343 .procname = "dirty_background_ratio", 1344 .data = &dirty_background_ratio, 1345 .maxlen = sizeof(dirty_background_ratio), 1346 .mode = 0644, 1347 .proc_handler = dirty_background_ratio_handler, 1348 .extra1 = &zero, 1349 .extra2 = &one_hundred, 1350 }, 1351 { 1352 .procname = "dirty_background_bytes", 1353 .data = &dirty_background_bytes, 1354 .maxlen = sizeof(dirty_background_bytes), 1355 .mode = 0644, 1356 .proc_handler = dirty_background_bytes_handler, 1357 .extra1 = &one_ul, 1358 }, 1359 { 1360 .procname = "dirty_ratio", 1361 .data = &vm_dirty_ratio, 1362 .maxlen = sizeof(vm_dirty_ratio), 1363 .mode = 0644, 1364 .proc_handler = dirty_ratio_handler, 1365 .extra1 = &zero, 1366 .extra2 = &one_hundred, 1367 }, 1368 { 1369 .procname = "dirty_bytes", 1370 .data = &vm_dirty_bytes, 1371 .maxlen = sizeof(vm_dirty_bytes), 1372 .mode = 0644, 1373 .proc_handler = dirty_bytes_handler, 1374 .extra1 = &dirty_bytes_min, 1375 }, 1376 { 1377 .procname = "dirty_writeback_centisecs", 1378 .data = &dirty_writeback_interval, 1379 .maxlen = sizeof(dirty_writeback_interval), 1380 .mode = 0644, 1381 .proc_handler = dirty_writeback_centisecs_handler, 1382 }, 1383 { 1384 .procname = "dirty_expire_centisecs", 1385 .data = &dirty_expire_interval, 1386 .maxlen = sizeof(dirty_expire_interval), 1387 .mode = 0644, 1388 .proc_handler = proc_dointvec_minmax, 1389 .extra1 = &zero, 1390 }, 1391 { 1392 .procname = "dirtytime_expire_seconds", 1393 .data = &dirtytime_expire_interval, 1394 .maxlen = sizeof(dirtytime_expire_interval), 1395 .mode = 0644, 1396 .proc_handler = dirtytime_interval_handler, 1397 .extra1 = &zero, 1398 }, 1399 { 1400 .procname = "swappiness", 1401 .data = &vm_swappiness, 1402 .maxlen = sizeof(vm_swappiness), 1403 .mode = 0644, 1404 .proc_handler = proc_dointvec_minmax, 1405 .extra1 = &zero, 1406 .extra2 = &one_hundred, 1407 }, 1408 #ifdef CONFIG_SHRINK_PAGECACHE 1409 { 1410 .procname = "cache_reclaim_s", 1411 .data = &vm_cache_reclaim_s, 1412 .maxlen = sizeof(vm_cache_reclaim_s), 1413 .mode = 0644, 1414 .proc_handler = cache_reclaim_sysctl_handler, 1415 .extra1 = &vm_cache_reclaim_s_min, 1416 .extra2 = &vm_cache_reclaim_s_max, 1417 }, 1418 { 1419 .procname = "cache_reclaim_weight", 1420 .data = &vm_cache_reclaim_weight, 1421 .maxlen = sizeof(vm_cache_reclaim_weight), 1422 .mode = 0644, 1423 .proc_handler = proc_dointvec_minmax, 1424 .extra1 = &vm_cache_reclaim_weight_min, 1425 .extra2 = &vm_cache_reclaim_weight_max, 1426 }, 1427 { 1428 .procname = "cache_reclaim_enable", 1429 .data = &vm_cache_reclaim_enable, 1430 .maxlen = sizeof(vm_cache_reclaim_enable), 1431 .mode = 0644, 1432 .proc_handler = cache_reclaim_enable_handler, 1433 .extra1 = &zero, 1434 .extra2 = &one, 1435 }, 1436 #endif 1437 #ifdef CONFIG_HUGETLB_PAGE 1438 { 1439 .procname = "nr_hugepages", 1440 .data = NULL, 1441 .maxlen = sizeof(unsigned long), 1442 .mode = 0644, 1443 .proc_handler = hugetlb_sysctl_handler, 1444 }, 1445 #ifdef CONFIG_NUMA 1446 { 1447 .procname = "nr_hugepages_mempolicy", 1448 .data = NULL, 1449 .maxlen = sizeof(unsigned long), 1450 .mode = 0644, 1451 .proc_handler = &hugetlb_mempolicy_sysctl_handler, 1452 }, 1453 { 1454 .procname = "numa_stat", 1455 .data = &sysctl_vm_numa_stat, 1456 .maxlen = sizeof(int), 1457 .mode = 0644, 1458 .proc_handler = sysctl_vm_numa_stat_handler, 1459 .extra1 = &zero, 1460 .extra2 = &one, 1461 }, 1462 #endif 1463 { 1464 .procname = "hugetlb_shm_group", 1465 .data = &sysctl_hugetlb_shm_group, 1466 .maxlen = sizeof(gid_t), 1467 .mode = 0644, 1468 .proc_handler = proc_dointvec, 1469 }, 1470 { 1471 .procname = "nr_overcommit_hugepages", 1472 .data = NULL, 1473 .maxlen = sizeof(unsigned long), 1474 .mode = 0644, 1475 .proc_handler = hugetlb_overcommit_handler, 1476 }, 1477 #endif 1478 #ifdef CONFIG_MEMCG_QOS 1479 { 1480 .procname = "memcg_qos_enable", 1481 .data = &sysctl_memcg_qos_stat, 1482 .maxlen = sizeof(int), 1483 .mode = 0644, 1484 .proc_handler = sysctl_memcg_qos_handler, 1485 .extra1 = &zero, 1486 .extra2 = &one, 1487 }, 1488 #endif 1489 { 1490 .procname = "lowmem_reserve_ratio", 1491 .data = &sysctl_lowmem_reserve_ratio, 1492 .maxlen = sizeof(sysctl_lowmem_reserve_ratio), 1493 .mode = 0644, 1494 .proc_handler = lowmem_reserve_ratio_sysctl_handler, 1495 }, 1496 { 1497 .procname = "drop_caches", 1498 .data = &sysctl_drop_caches, 1499 .maxlen = sizeof(int), 1500 .mode = 0200, 1501 .proc_handler = drop_caches_sysctl_handler, 1502 .extra1 = &one, 1503 .extra2 = &four, 1504 }, 1505 { 1506 .procname = "drop_caches_loop_limit", 1507 .data = &drop_caches_loop_limit, 1508 .maxlen = sizeof(unsigned int), 1509 .mode = 0644, 1510 .proc_handler = proc_douintvec, 1511 }, 1512 1513 #ifdef CONFIG_COMPACTION 1514 { 1515 .procname = "compact_memory", 1516 .data = &sysctl_compact_memory, 1517 .maxlen = sizeof(int), 1518 .mode = 0200, 1519 .proc_handler = sysctl_compaction_handler, 1520 }, 1521 { 1522 .procname = "extfrag_threshold", 1523 .data = &sysctl_extfrag_threshold, 1524 .maxlen = sizeof(int), 1525 .mode = 0644, 1526 .proc_handler = sysctl_extfrag_handler, 1527 .extra1 = &min_extfrag_threshold, 1528 .extra2 = &max_extfrag_threshold, 1529 }, 1530 { 1531 .procname = "compact_unevictable_allowed", 1532 .data = &sysctl_compact_unevictable_allowed, 1533 .maxlen = sizeof(int), 1534 .mode = 0644, 1535 .proc_handler = proc_dointvec, 1536 .extra1 = &zero, 1537 .extra2 = &one, 1538 }, 1539 1540 #endif /* CONFIG_COMPACTION */ 1541 { 1542 .procname = "min_free_kbytes", 1543 .data = &min_free_kbytes, 1544 .maxlen = sizeof(min_free_kbytes), 1545 .mode = 0644, 1546 .proc_handler = min_free_kbytes_sysctl_handler, 1547 .extra1 = &zero, 1548 }, 1549 { 1550 .procname = "watermark_scale_factor", 1551 .data = &watermark_scale_factor, 1552 .maxlen = sizeof(watermark_scale_factor), 1553 .mode = 0644, 1554 .proc_handler = watermark_scale_factor_sysctl_handler, 1555 .extra1 = &one, 1556 .extra2 = &one_thousand, 1557 }, 1558 { 1559 .procname = "percpu_pagelist_fraction", 1560 .data = &percpu_pagelist_fraction, 1561 .maxlen = sizeof(percpu_pagelist_fraction), 1562 .mode = 0644, 1563 .proc_handler = percpu_pagelist_fraction_sysctl_handler, 1564 .extra1 = &zero, 1565 }, 1566 #ifdef CONFIG_MMU 1567 { 1568 .procname = "max_map_count", 1569 .data = &sysctl_max_map_count, 1570 .maxlen = sizeof(sysctl_max_map_count), 1571 .mode = 0644, 1572 .proc_handler = proc_dointvec_minmax, 1573 .extra1 = &zero, 1574 }, 1575 #else 1576 { 1577 .procname = "nr_trim_pages", 1578 .data = &sysctl_nr_trim_pages, 1579 .maxlen = sizeof(sysctl_nr_trim_pages), 1580 .mode = 0644, 1581 .proc_handler = proc_dointvec_minmax, 1582 .extra1 = &zero, 1583 }, 1584 #endif 1585 { 1586 .procname = "laptop_mode", 1587 .data = &laptop_mode, 1588 .maxlen = sizeof(laptop_mode), 1589 .mode = 0644, 1590 .proc_handler = proc_dointvec_jiffies, 1591 }, 1592 { 1593 .procname = "block_dump", 1594 .data = &block_dump, 1595 .maxlen = sizeof(block_dump), 1596 .mode = 0644, 1597 .proc_handler = proc_dointvec, 1598 .extra1 = &zero, 1599 }, 1600 { 1601 .procname = "vfs_cache_pressure", 1602 .data = &sysctl_vfs_cache_pressure, 1603 .maxlen = sizeof(sysctl_vfs_cache_pressure), 1604 .mode = 0644, 1605 .proc_handler = proc_dointvec, 1606 .extra1 = &zero, 1607 }, 1608 #ifdef HAVE_ARCH_PICK_MMAP_LAYOUT 1609 { 1610 .procname = "legacy_va_layout", 1611 .data = &sysctl_legacy_va_layout, 1612 .maxlen = sizeof(sysctl_legacy_va_layout), 1613 .mode = 0644, 1614 .proc_handler = proc_dointvec, 1615 .extra1 = &zero, 1616 }, 1617 #endif 1618 #ifdef CONFIG_NUMA 1619 { 1620 .procname = "zone_reclaim_mode", 1621 .data = &node_reclaim_mode, 1622 .maxlen = sizeof(node_reclaim_mode), 1623 .mode = 0644, 1624 .proc_handler = proc_dointvec, 1625 .extra1 = &zero, 1626 }, 1627 { 1628 .procname = "min_unmapped_ratio", 1629 .data = &sysctl_min_unmapped_ratio, 1630 .maxlen = sizeof(sysctl_min_unmapped_ratio), 1631 .mode = 0644, 1632 .proc_handler = sysctl_min_unmapped_ratio_sysctl_handler, 1633 .extra1 = &zero, 1634 .extra2 = &one_hundred, 1635 }, 1636 { 1637 .procname = "min_slab_ratio", 1638 .data = &sysctl_min_slab_ratio, 1639 .maxlen = sizeof(sysctl_min_slab_ratio), 1640 .mode = 0644, 1641 .proc_handler = sysctl_min_slab_ratio_sysctl_handler, 1642 .extra1 = &zero, 1643 .extra2 = &one_hundred, 1644 }, 1645 #endif 1646 #ifdef CONFIG_SMP 1647 { 1648 .procname = "stat_interval", 1649 .data = &sysctl_stat_interval, 1650 .maxlen = sizeof(sysctl_stat_interval), 1651 .mode = 0644, 1652 .proc_handler = proc_dointvec_jiffies, 1653 }, 1654 { 1655 .procname = "stat_refresh", 1656 .data = NULL, 1657 .maxlen = 0, 1658 .mode = 0600, 1659 .proc_handler = vmstat_refresh, 1660 }, 1661 #endif 1662 #ifdef CONFIG_MMU 1663 { 1664 .procname = "mmap_min_addr", 1665 .data = &dac_mmap_min_addr, 1666 .maxlen = sizeof(unsigned long), 1667 .mode = 0644, 1668 .proc_handler = mmap_min_addr_handler, 1669 }, 1670 #endif 1671 #ifdef CONFIG_NUMA 1672 { 1673 .procname = "numa_zonelist_order", 1674 .data = &numa_zonelist_order, 1675 .maxlen = NUMA_ZONELIST_ORDER_LEN, 1676 .mode = 0644, 1677 .proc_handler = numa_zonelist_order_handler, 1678 }, 1679 #endif 1680 #if (defined(CONFIG_X86_32) && !defined(CONFIG_UML))|| \ 1681 (defined(CONFIG_SUPERH) && defined(CONFIG_VSYSCALL)) 1682 { 1683 .procname = "vdso_enabled", 1684 #ifdef CONFIG_X86_32 1685 .data = &vdso32_enabled, 1686 .maxlen = sizeof(vdso32_enabled), 1687 #else 1688 .data = &vdso_enabled, 1689 .maxlen = sizeof(vdso_enabled), 1690 #endif 1691 .mode = 0644, 1692 .proc_handler = proc_dointvec, 1693 .extra1 = &zero, 1694 }, 1695 #endif 1696 #ifdef CONFIG_HIGHMEM 1697 { 1698 .procname = "highmem_is_dirtyable", 1699 .data = &vm_highmem_is_dirtyable, 1700 .maxlen = sizeof(vm_highmem_is_dirtyable), 1701 .mode = 0644, 1702 .proc_handler = proc_dointvec_minmax, 1703 .extra1 = &zero, 1704 .extra2 = &one, 1705 }, 1706 #endif 1707 #ifdef CONFIG_MEMORY_FAILURE 1708 { 1709 .procname = "memory_failure_early_kill", 1710 .data = &sysctl_memory_failure_early_kill, 1711 .maxlen = sizeof(sysctl_memory_failure_early_kill), 1712 .mode = 0644, 1713 .proc_handler = proc_dointvec_minmax, 1714 .extra1 = &zero, 1715 .extra2 = &one, 1716 }, 1717 { 1718 .procname = "memory_failure_recovery", 1719 .data = &sysctl_memory_failure_recovery, 1720 .maxlen = sizeof(sysctl_memory_failure_recovery), 1721 .mode = 0644, 1722 .proc_handler = proc_dointvec_minmax, 1723 .extra1 = &zero, 1724 .extra2 = &one, 1725 }, 1726 #endif 1727 { 1728 .procname = "user_reserve_kbytes", 1729 .data = &sysctl_user_reserve_kbytes, 1730 .maxlen = sizeof(sysctl_user_reserve_kbytes), 1731 .mode = 0644, 1732 .proc_handler = proc_doulongvec_minmax, 1733 }, 1734 { 1735 .procname = "admin_reserve_kbytes", 1736 .data = &sysctl_admin_reserve_kbytes, 1737 .maxlen = sizeof(sysctl_admin_reserve_kbytes), 1738 .mode = 0644, 1739 .proc_handler = proc_doulongvec_minmax, 1740 }, 1741 #ifdef CONFIG_HAVE_ARCH_MMAP_RND_BITS 1742 { 1743 .procname = "mmap_rnd_bits", 1744 .data = &mmap_rnd_bits, 1745 .maxlen = sizeof(mmap_rnd_bits), 1746 .mode = 0600, 1747 .proc_handler = proc_dointvec_minmax, 1748 .extra1 = (void *)&mmap_rnd_bits_min, 1749 .extra2 = (void *)&mmap_rnd_bits_max, 1750 }, 1751 #endif 1752 #ifdef CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS 1753 { 1754 .procname = "mmap_rnd_compat_bits", 1755 .data = &mmap_rnd_compat_bits, 1756 .maxlen = sizeof(mmap_rnd_compat_bits), 1757 .mode = 0600, 1758 .proc_handler = proc_dointvec_minmax, 1759 .extra1 = (void *)&mmap_rnd_compat_bits_min, 1760 .extra2 = (void *)&mmap_rnd_compat_bits_max, 1761 }, 1762 #endif 1763 #ifdef CONFIG_ASCEND_SHARE_POOL 1764 { 1765 .procname = "sharepool_ac_mode", 1766 .data = &sysctl_ac_mode, 1767 .maxlen = sizeof(sysctl_ac_mode), 1768 .mode = 0600, 1769 .proc_handler = proc_dointvec_minmax, 1770 .extra1 = &zero, 1771 .extra2 = &one, 1772 }, 1773 { 1774 .procname = "sharepool_debug_mode", 1775 .data = &sysctl_sp_debug_mode, 1776 .maxlen = sizeof(sysctl_sp_debug_mode), 1777 .mode = 0600, 1778 .proc_handler = proc_dointvec_minmax, 1779 .extra1 = &zero, 1780 .extra2 = &one, 1781 }, 1782 { 1783 /* 0: map_unlock, 1: map_lock */ 1784 .procname = "share_pool_map_lock_enable", 1785 .data = &sysctl_share_pool_map_lock_enable, 1786 .maxlen = sizeof(int), 1787 .mode = 0644, 1788 .proc_handler = proc_dointvec_minmax, 1789 .extra1 = &zero, 1790 .extra2 = &one, 1791 }, 1792 { 1793 .procname = "sharepool_compact_enable", 1794 .data = &sysctl_sp_compact_enable, 1795 .maxlen = sizeof(sysctl_sp_compact_enable), 1796 .mode = 0600, 1797 .proc_handler = proc_dointvec_minmax, 1798 .extra1 = &zero, 1799 .extra2 = &one, 1800 }, 1801 { 1802 .procname = "sharepool_compact_interval", 1803 .data = &sysctl_sp_compact_interval, 1804 .maxlen = sizeof(sysctl_sp_compact_interval), 1805 .mode = 0600, 1806 .proc_handler = proc_doulongvec_minmax, 1807 .extra1 = &zero_ul, 1808 .extra2 = &sysctl_sp_compact_interval_max, 1809 }, 1810 { 1811 .procname = "sharepool_perf_alloc", 1812 .data = &sysctl_sp_perf_alloc, 1813 .maxlen = sizeof(sysctl_sp_perf_alloc), 1814 .mode = 0600, 1815 .proc_handler = proc_dointvec_minmax, 1816 .extra1 = &zero, > 1817 .extra2 = &ten_thousand, 1818 }, 1819 #endif 1820 { } 1821 }; 1822 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1355/1355] mm/share_pool.c:837:29: sparse: sparse: incompatible types for operation (<=):
by kernel test robot 28 Dec '24

28 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 0f0c3021514f52310056c32406b4b760fc9a7e6e [1355/1355] share_pool: Apply sp_group_id_by_pid() to multi-group-mode config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241228/202412282007.9AwBcoM1-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241228/202412282007.9AwBcoM1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412282007.9AwBcoM1-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/share_pool.c:837:29: sparse: sparse: incompatible types for operation (<=): mm/share_pool.c:837:29: sparse: int *num mm/share_pool.c:837:29: sparse: int mm/share_pool.c: In function 'sp_group_id_by_pid': mm/share_pool.c:837:29: warning: ordered comparison of pointer with integer zero [-Wextra] 837 | if (!spg_ids || num <= 0) | ^~ In function 'vmalloc_area_clr_flag', inlined from 'sp_make_share_k2u' at mm/share_pool.c:2550:8: mm/share_pool.c:2396:18: warning: 'spa' may be used uninitialized [-Wmaybe-uninitialized] 2396 | spa->kva = 0; | ~~~~~~~~~^~~ mm/share_pool.c: In function 'sp_make_share_k2u': mm/share_pool.c:2429:25: note: 'spa' was declared here 2429 | struct sp_area *spa; | ^~~ mm/share_pool.c:2562:16: warning: 'uva' may be used uninitialized [-Wmaybe-uninitialized] 2562 | return uva; | ^~~ mm/share_pool.c:2427:15: note: 'uva' was declared here 2427 | void *uva; | ^~~ mm/share_pool.c:829: warning: Function parameter or member 'spg_ids' not described in 'sp_group_id_by_pid' mm/share_pool.c:829: warning: Function parameter or member 'num' not described in 'sp_group_id_by_pid' mm/share_pool.c:2423: warning: duplicate section name 'Return' vim +837 mm/share_pool.c 815 816 /** 817 * sp_group_id_by_pid() - Get the sp_group ID array of a process. 818 * @pid: pid of target process. 819 * @spg_ids point to an array to save the group ids the process belongs to 820 * @num input the spg_ids array size; output the spg number of the process 821 * 822 * Return: 823 * >0 - the sp_group ID. 824 * -ENODEV - target process doesn't belong to any sp_group. 825 * -EINVAL - spg_ids or num is NULL. 826 * -E2BIG - the num of groups process belongs to is larger than *num 827 */ 828 int sp_group_id_by_pid(int pid, int *spg_ids, int *num) 829 { 830 int ret = 0; 831 struct sp_group_node *node; 832 struct sp_group_master *master = NULL; 833 struct task_struct *tsk; 834 835 check_interrupt_context(); 836 > 837 if (!spg_ids || num <= 0) 838 return -EINVAL; 839 840 ret = get_task(pid, &tsk); 841 if (ret) 842 return ret; 843 844 down_read(&sp_group_sem); 845 task_lock(tsk); 846 if (tsk->mm) 847 master = tsk->mm->sp_group_master; 848 task_unlock(tsk); 849 850 if (!master) { 851 ret = -ENODEV; 852 goto out_up_read; 853 } 854 855 if (!master->count) { 856 ret = -ENODEV; 857 goto out_up_read; 858 } 859 if ((unsigned int)*num < master->count) { 860 ret = -E2BIG; 861 goto out_up_read; 862 } 863 *num = master->count; 864 865 list_for_each_entry(node, &master->node_list, group_node) 866 *(spg_ids++) = node->spg->id; 867 868 out_up_read: 869 up_read(&sp_group_sem); 870 put_task_struct(tsk); 871 return ret; 872 } 873 EXPORT_SYMBOL_GPL(sp_group_id_by_pid); 874 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1355/1355] include/linux/share_pool.h:150:26: sparse: sparse: incorrect type in return expression (different address spaces)
by kernel test robot 28 Dec '24

28 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 4a280fac30d27ae2aff096f9f99aa12d50f83426 [1355/1355] ascend: share_pool: support share pool features for ascend platform config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241228/202412281933.AtwopaHj-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241228/202412281933.AtwopaHj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412281933.AtwopaHj-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/gup.c: note: in included file: >> include/linux/share_pool.h:150:26: sparse: sparse: incorrect type in return expression (different address spaces) @@ expected struct task_struct * @@ got struct task_struct [noderef] __rcu *owner @@ include/linux/share_pool.h:150:26: sparse: expected struct task_struct * include/linux/share_pool.h:150:26: sparse: got struct task_struct [noderef] __rcu *owner mm/gup.c:1769:47: sparse: sparse: self-comparison always evaluates to false mm/gup.c:1794:47: sparse: sparse: self-comparison always evaluates to false mm/gup.c:1830:6: warning: no previous prototype for 'gup_fast_permitted' [-Wmissing-prototypes] 1830 | bool gup_fast_permitted(unsigned long start, int nr_pages, int write) | ^~~~~~~~~~~~~~~~~~ vim +150 include/linux/share_pool.h 2facb5901ceebe Ding Tianhong 2021-10-30 146 2facb5901ceebe Ding Tianhong 2021-10-30 147 static inline struct task_struct *sp_get_task(struct mm_struct *mm) 2facb5901ceebe Ding Tianhong 2021-10-30 148 { 2facb5901ceebe Ding Tianhong 2021-10-30 149 if (enable_ascend_share_pool) 2facb5901ceebe Ding Tianhong 2021-10-30 @150 return mm->owner; 2facb5901ceebe Ding Tianhong 2021-10-30 151 else 2facb5901ceebe Ding Tianhong 2021-10-30 152 return current; 2facb5901ceebe Ding Tianhong 2021-10-30 153 } 2facb5901ceebe Ding Tianhong 2021-10-30 154 :::::: The code at line 150 was first introduced by commit :::::: 2facb5901ceebe6736c0d192ca50be5d26c70ad9 ascend: vmalloc: export new function for share pool :::::: TO: Ding Tianhong <dingtianhong(a)huawei.com> :::::: CC: Yang Yingliang <yangyingliang(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2601/2601] net/smc/smc_core.c:770:6: sparse: sparse: symbol '__smcr_link_clear' was not declared. Should it be static?
by kernel test robot 28 Dec '24

28 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 053a6b6f8e4c86200cdb20bc80c063c3bb119859 commit: 7dad816cb1f8841fda526c0978c10a94793f1178 [2601/2601] anolis: net/smc: Resolve the race between SMC-R link access and clear config: x86_64-randconfig-121-20241228 (https://download.01.org/0day-ci/archive/20241228/202412281741.d8yDMbp6-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241228/202412281741.d8yDMbp6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412281741.d8yDMbp6-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> net/smc/smc_core.c:770:6: sparse: sparse: symbol '__smcr_link_clear' was not declared. Should it be static? vim +/__smcr_link_clear +770 net/smc/smc_core.c 769 > 770 void __smcr_link_clear(struct smc_link *lnk) 771 { 772 smc_wr_free_link_mem(lnk); 773 smc_lgr_put(lnk->lgr); /* lgr_hold in smcr_link_init() */ 774 memset(lnk, 0, sizeof(struct smc_link)); 775 lnk->state = SMC_LNK_UNUSED; 776 } 777 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] drivers/block/nbd.o: warning: objtool: nbd_alloc_and_init_config()+0x35: unreachable instruction
by kernel test robot 28 Dec '24

28 Dec '24

Hi Yu, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 053a6b6f8e4c86200cdb20bc80c063c3bb119859 commit: d2cdad29e00e63ab3a32f5f0d90acc757ff5653a [2589/2589] nbd: fold nbd config initialization into nbd_alloc_config() config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241228/202412281725.LnOuPqEI-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241228/202412281725.LnOuPqEI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412281725.LnOuPqEI-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/block/nbd.o: warning: objtool: nbd_alloc_and_init_config()+0x35: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0