- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 1833/1833] kernel/sched/bpf_sched.c:211:32: error: 'struct cfs_rq' has no member named 'tg'
by kernel test robot 21 Jan '25

21 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 88ee450e4bfbe03d27189e9a1a794f610ad57ae5 commit: 6f06e093b3708dcee5b7e4f0478e0206bc601da1 [1833/1833] sched/ebpf: Support task selection programmable config: arm64-randconfig-r061-20250121 (https://download.01.org/0day-ci/archive/20250121/202501211149.c38cljuA-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250121/202501211149.c38cljuA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501211149.c38cljuA-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/build_utility.c:113: kernel/sched/bpf_sched.c:187:17: warning: no previous prototype for 'bpf_sched_entity_is_task' [-Wmissing-prototypes] 187 | __bpf_kfunc int bpf_sched_entity_is_task(struct sched_entity *se) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/bpf_sched.c:195:33: warning: no previous prototype for 'bpf_sched_entity_to_task' [-Wmissing-prototypes] 195 | __bpf_kfunc struct task_struct *bpf_sched_entity_to_task(struct sched_entity *se) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/bpf_sched.c:203:18: warning: no previous prototype for 'bpf_sched_tag_of_entity' [-Wmissing-prototypes] 203 | __bpf_kfunc long bpf_sched_tag_of_entity(struct sched_entity *se) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/bpf_sched.c: In function 'bpf_sched_tag_of_entity': >> kernel/sched/bpf_sched.c:211:32: error: 'struct cfs_rq' has no member named 'tg' 211 | return group_cfs_rq(se)->tg->tag; | ^~ vim +211 kernel/sched/bpf_sched.c 202 203 __bpf_kfunc long bpf_sched_tag_of_entity(struct sched_entity *se) 204 { 205 if (!se) 206 return -EINVAL; 207 208 if (entity_is_task(se)) 209 return task_of(se)->tag; 210 > 211 return group_cfs_rq(se)->tg->tag; 212 } 213 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 00/15] merge CVE patches into OLK-5.10
by Kaixiong Yu 21 Jan '25

21 Jan '25

CVE-2024-56715 CVE-2024-56746 CVE-2024-56704 CVE-2024-53198 CVE-2024-53183 CVE-2024-56539 CVE-2024-56571 CVE-2024-56610 CVE-2024-56611 CVE-2024-50280 CVE-2024-50194 CVE-2023-52913 Alex Zenla (1): 9p/xen: fix release of IRQ Alper Nebi Yasak (1): wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() Brett Creeley (1): ionic: Fix netdev notifier unregister on failure David Hildenbrand (1): mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM Marco Elver (1): kcsan: Turn report_filterlist_lock into a raw_spinlock Mark Rutland (1): arm64: probes: Fix uprobes for big-endian kernels Ming-Hung Tsai (1): dm cache: fix flushing uninitialized delayed_work on cache_ctr error Qiu-ji Chen (1): xen: Fix the issue of resource not being properly released in xenbus_dev_probe() Rob Clark (1): drm/i915: Fix potential context UAFs Thadeu Lima de Souza Cascardo (1): media: uvcvideo: Require entities to have a non-zero unique ID Thomas Zimmermann (1): fbdev/sh7760fb: Alloc DMA memory from hardware device Tiwei Bie (1): um: net: Do not use drvdata in release Zhen Lei (1): fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() junhua huang (2): arm64:uprobe fix the uprobe SWBP_INSN in big-endian arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning arch/arm64/include/asm/uprobes.h | 12 ++- arch/arm64/kernel/probes/uprobes.c | 4 +- arch/um/drivers/net_kern.c | 2 +- drivers/gpu/drm/i915/gem/i915_gem_context.c | 8 +- drivers/md/dm-cache-target.c | 24 +++--- drivers/media/usb/uvc/uvc_driver.c | 63 ++++++++++------ .../net/ethernet/pensando/ionic/ionic_lif.c | 3 +- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/video/fbdev/sh7760fb.c | 11 ++- drivers/xen/xenbus/xenbus_probe.c | 8 +- kernel/kcsan/debugfs.c | 74 +++++++++---------- mm/mempolicy.c | 4 + net/9p/trans_xen.c | 2 +- 13 files changed, 122 insertions(+), 95 deletions(-) -- 2.34.1

2 16

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 5089b89573d94320f21ed85996fa1a578d46d543
by kernel test robot 21 Jan '25

21 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 5089b89573d94320f21ed85996fa1a578d46d543 !14871 quota: flush quota_release_work upon quota writeback Error/Warning (recently discovered and may have been fixed): drivers/staging/gasket/.tmp_gasket_interrupt.o: warning: objtool: missing symbol for section .text drivers/staging/gasket/.tmp_gasket_ioctl.o: warning: objtool: missing symbol for section .text Unverified Error/Warning (likely false positive, kindly check if interested): drivers/scsi/ufs/.tmp_ufs-hisi.o: warning: objtool: missing symbol for section .init.text include/linux/list.h:65:19: warning: storing the address of local variable 'tmp' in '((struct list_head *)lip)[4].prev' [-Wdangling-pointer=] sound/isa/ad1816a/ad1816a.o: warning: objtool: missing symbol for section .init.text sound/isa/als100.o: warning: objtool: missing symbol for section .init.text sound/isa/azt2320.o: warning: objtool: missing symbol for section .init.text sound/isa/es1688/es1688.o: warning: objtool: missing symbol for section .init.text sound/isa/gus/interwave-stb.o: warning: objtool: missing symbol for section .init.text sound/isa/sb/emu8000_synth.o: warning: objtool: missing symbol for section .init.text sound/isa/sb/sbawe.o: warning: objtool: missing symbol for section .init.text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast |-- arm64-allnoconfig | `-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used |-- arm64-defconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast |-- arm64-randconfig-001-20250120 | `-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used |-- arm64-randconfig-002-20250120 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-tmp-in-((struct-list_head-)lip)-.prev | |-- include-linux-uaccess.h:warning:cap-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:entries-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ifreq-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ioc_data-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:mr-may-be-used-uninitialized |-- arm64-randconfig-003-20250120 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast |-- arm64-randconfig-004-20250120 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- include-linux-list.h:warning:array-subscript-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | `-- include-linux-plist.h:warning:array-subscript-is-outside-array-bounds-of-struct-plist_node |-- x86_64-alldefconfig | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used |-- x86_64-allmodconfig | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | `-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests |-- x86_64-allnoconfig | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions |-- x86_64-buildonly-randconfig-001-20250120 | |-- crypto-sm4_generic.o:warning:objtool:missing-symbol-for-section-.text | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250120 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | `-- crypto-sm4_generic.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-003-20250120 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- x86_64-buildonly-randconfig-004-20250120 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | `-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions |-- x86_64-buildonly-randconfig-005-20250116 | |-- drivers-scsi-ufs-.tmp_ufs-hisi.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-staging-gasket-.tmp_gasket_interrupt.o:warning:objtool:missing-symbol-for-section-.text | `-- drivers-staging-gasket-.tmp_gasket_ioctl.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-005-20250120 | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- crypto-sm4_generic.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-pci-hotplug-pciehp_core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pci-hotplug-pciehp_ctrl.o:warning:objtool:missing-symbol-for-section-.text | `-- fs-xfs-xfs_rtalloc.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-006-20250120 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- crypto-sm4_generic.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-iio-resolver-ad2s1200.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-ak7375.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-video-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-platform-qcom-camss-camss.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-xfs-xfs_bmap_util.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-xfs-xfs_symlink.o:warning:objtool:missing-symbol-for-section-.text | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- sound-isa-ad1816a-ad1816a.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-ad1848-ad1848.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-als100.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-azt2320.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-es1688-es1688.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-gus-interwave-stb.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-sb-emu8000_patch.o:warning:objtool:missing-symbol-for-section-.text | |-- sound-isa-sb-emu8000_synth.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-sb-jazz16.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-sb-sb8.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-sb-sbawe.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-sc6000.o:warning:objtool:missing-symbol-for-section-.init.text | `-- sound-isa-wavefront-wavefront_fx.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-defconfig | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast |-- x86_64-randconfig-161-20250121 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | `-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used `-- x86_64-randconfig-r051-20250121 |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration elapsed time: 724m configs tested: 17 configs skipped: 127 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250120 gcc-14.2.0 arm64 randconfig-002-20250120 gcc-14.2.0 arm64 randconfig-003-20250120 gcc-14.2.0 arm64 randconfig-004-20250120 gcc-14.2.0 x86_64 alldefconfig gcc-12 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250120 clang-19 x86_64 buildonly-randconfig-002-20250120 clang-19 x86_64 buildonly-randconfig-003-20250120 gcc-12 x86_64 buildonly-randconfig-004-20250120 clang-19 x86_64 buildonly-randconfig-005-20250120 clang-19 x86_64 buildonly-randconfig-006-20250120 gcc-11 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 88ee450e4bfbe03d27189e9a1a794f610ad57ae5
by kernel test robot 21 Jan '25

21 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 88ee450e4bfbe03d27189e9a1a794f610ad57ae5 !14904 net: renesas: rswitch: avoid use-after-put for a device tree node Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501210717.sGx6dRjf-lkp@intel.com mm/mem_reliable.c:345:9: error: implicit declaration of function 'mem_reliable_ctrl_bit_disable'; did you mean 'mem_reliable_ctrl_bit_disabled'? [-Wimplicit-function-declaration] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- arm64-randconfig-r061-20250121 | `-- mm-mem_reliable.c:error:implicit-declaration-of-function-mem_reliable_ctrl_bit_disable |-- loongarch-allmodconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allyesconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-001-20250120 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- x86_64-allnoconfig | |-- include-linux-sched-signal.h:linux-kabi.h-is-included-more-than-once. | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. `-- x86_64-allyesconfig |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put elapsed time: 721m configs tested: 19 configs skipped: 114 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250120 gcc-14.2.0 arm64 randconfig-002-20250120 clang-20 arm64 randconfig-003-20250120 clang-19 arm64 randconfig-004-20250120 clang-20 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250120 gcc-14.2.0 loongarch randconfig-002-20250120 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250120 clang-19 x86_64 buildonly-randconfig-002-20250120 clang-19 x86_64 buildonly-randconfig-003-20250120 gcc-12 x86_64 buildonly-randconfig-004-20250120 clang-19 x86_64 buildonly-randconfig-005-20250120 clang-19 x86_64 buildonly-randconfig-006-20250120 gcc-11 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1833/1833] mm/mem_reliable.c:345:9: error: implicit declaration of function 'mem_reliable_ctrl_bit_disable'; did you mean 'mem_reliable_ctrl_bit_disabled'?
by kernel test robot 21 Jan '25

21 Jan '25

Hi Ma, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 88ee450e4bfbe03d27189e9a1a794f610ad57ae5 commit: 425771499c0742a996ab28df143d7a5123102686 [1833/1833] mm: mem_reliable: Introduce proc interface to disable memory reliable features config: arm64-randconfig-r061-20250121 (https://download.01.org/0day-ci/archive/20250121/202501210717.sGx6dRjf-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250121/202501210717.sGx6dRjf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501210717.sGx6dRjf-lkp@intel.com/ All errors (new ones prefixed by >>): mm/mem_reliable.c: In function 'mem_reliable_feature_disable': >> mm/mem_reliable.c:345:9: error: implicit declaration of function 'mem_reliable_ctrl_bit_disable'; did you mean 'mem_reliable_ctrl_bit_disabled'? [-Wimplicit-function-declaration] 345 | mem_reliable_ctrl_bit_disable(idx); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | mem_reliable_ctrl_bit_disabled mm/mem_reliable.c: At top level: mm/mem_reliable.c:320:13: warning: 'mem_reliable_ctrl_bit_disabled' defined but not used [-Wunused-function] 320 | static void mem_reliable_ctrl_bit_disabled(int idx) {} | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +345 mm/mem_reliable.c 322 323 static void mem_reliable_feature_disable(int idx) 324 { 325 char *str = NULL; 326 327 switch (idx) { 328 case MEM_RELIABLE_FALLBACK: 329 reliable_allow_fallback = false; 330 str = "fallback"; 331 break; 332 case MEM_RELIABLE_SHMEM: 333 shmem_reliable = false; 334 str = "shmem"; 335 break; 336 case MEM_RELIABLE_PAGECACHE: 337 pagecache_reliable = false; 338 str = "pagecache"; 339 break; 340 default: 341 pr_err("unknown index: %d", idx); 342 return; 343 } 344 > 345 mem_reliable_ctrl_bit_disable(idx); 346 pr_info("%s is disabled\n", str); 347 } 348 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] CVE-2024-56641
by Wang Liang 20 Jan '25

20 Jan '25

D. Wythe (1): net/smc: refactoring initialization of smc sock Wen Gu (1): net/smc: initialize close_work early to avoid warning net/smc/af_smc.c | 90 ++++++++++++++++++++++++++---------------------- net/smc/smc.h | 5 +++ 2 files changed, 54 insertions(+), 41 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] net/smc: protect link down work from execute after lgr freed
by Wang Liang 20 Jan '25

20 Jan '25

From: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> stable inclusion from stable-v6.6.68 commit 2627c3e8646932dfc7b9722c88c2e1ffcf7a9fb2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEG41 CVE: CVE-2024-56718 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2b33eb8f1b3e8c2f87cfdbc8cc117f6bdfabc6ec ] link down work may be scheduled before lgr freed but execute after lgr freed, which may result in crash. So it is need to hold a reference before shedule link down work, and put the reference after work executed or canceled. The relevant crash call stack as follows: list_del corruption. prev->next should be ffffb638c9c0fe20, but was 0000000000000000 ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:51! invalid opcode: 0000 [#1] SMP NOPTI CPU: 6 PID: 978112 Comm: kworker/6:119 Kdump: loaded Tainted: G #1 Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 2221b89 04/01/2014 Workqueue: events smc_link_down_work [smc] RIP: 0010:__list_del_entry_valid.cold+0x31/0x47 RSP: 0018:ffffb638c9c0fdd8 EFLAGS: 00010086 RAX: 0000000000000054 RBX: ffff942fb75e5128 RCX: 0000000000000000 RDX: ffff943520930aa0 RSI: ffff94352091fc80 RDI: ffff94352091fc80 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffb638c9c0fc38 R10: ffffb638c9c0fc30 R11: ffffffffa015eb28 R12: 0000000000000002 R13: ffffb638c9c0fe20 R14: 0000000000000001 R15: ffff942f9cd051c0 FS: 0000000000000000(0000) GS:ffff943520900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4f25214000 CR3: 000000025fbae004 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: rwsem_down_write_slowpath+0x17e/0x470 smc_link_down_work+0x3c/0x60 [smc] process_one_work+0x1ac/0x350 worker_thread+0x49/0x2f0 ? rescuer_thread+0x360/0x360 kthread+0x118/0x140 ? __kthread_bind_mask+0x60/0x60 ret_from_fork+0x1f/0x30 Fixes: 541afa10c126 ("net/smc: add smcr_port_err() and smcr_link_down() processing") Signed-off-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Reviewed-by: Tony Lu <tonylu(a)linux.alibaba.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/smc/smc_core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c index acca3b1a068f..e38e29668a98 100644 --- a/net/smc/smc_core.c +++ b/net/smc/smc_core.c @@ -1773,7 +1773,9 @@ void smcr_link_down_cond_sched(struct smc_link *lnk) { if (smc_link_downing(&lnk->state)) { trace_smcr_link_down(lnk, __builtin_return_address(0)); - schedule_work(&lnk->link_down_wrk); + smcr_link_hold(lnk); /* smcr_link_put in link_down_wrk */ + if (!schedule_work(&lnk->link_down_wrk)) + smcr_link_put(lnk); } } @@ -1805,11 +1807,14 @@ static void smc_link_down_work(struct work_struct *work) struct smc_link_group *lgr = link->lgr; if (list_empty(&lgr->list)) - return; + goto out; wake_up_all(&lgr->llc_msg_waiter); down_write(&lgr->llc_conf_mutex); smcr_link_down(link); up_write(&lgr->llc_conf_mutex); + +out: + smcr_link_put(link); /* smcr_link_hold by schedulers of link_down_work */ } static int smc_vlan_by_tcpsk_walk(struct net_device *lower_dev, -- 2.34.1

2 1

[PATCH OLK-6.6] bnxt_en: Fix receive ring space parameters when XDP is active
by Wang Liang 20 Jan '25

20 Jan '25

From: Shravya KN <shravya.k-n(a)broadcom.com> mainline inclusion from mainline-v6.13-rc1 commit 3051a77a09dfe3022aa012071346937fdf059033 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAF9 CVE: CVE-2024-53209 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The MTU setting at the time an XDP multi-buffer is attached determines whether the aggregation ring will be used and the rx_skb_func handler. This is done in bnxt_set_rx_skb_mode(). If the MTU is later changed, the aggregation ring setting may need to be changed and it may become out-of-sync with the settings initially done in bnxt_set_rx_skb_mode(). This may result in random memory corruption and crashes as the HW may DMA data larger than the allocated buffer size, such as: BUG: kernel NULL pointer dereference, address: 00000000000003c0 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 17 PID: 0 Comm: swapper/17 Kdump: loaded Tainted: G S OE 6.1.0-226bf9805506 #1 Hardware name: Wiwynn Delta Lake PVT BZA.02601.0150/Delta Lake-Class1, BIOS F0E_3A12 08/26/2021 RIP: 0010:bnxt_rx_pkt+0xe97/0x1ae0 [bnxt_en] Code: 8b 95 70 ff ff ff 4c 8b 9d 48 ff ff ff 66 41 89 87 b4 00 00 00 e9 0b f7 ff ff 0f b7 43 0a 49 8b 95 a8 04 00 00 25 ff 0f 00 00 <0f> b7 14 42 48 c1 e2 06 49 03 95 a0 04 00 00 0f b6 42 33f RSP: 0018:ffffa19f40cc0d18 EFLAGS: 00010202 RAX: 00000000000001e0 RBX: ffff8e2c805c6100 RCX: 00000000000007ff RDX: 0000000000000000 RSI: ffff8e2c271ab990 RDI: ffff8e2c84f12380 RBP: ffffa19f40cc0e48 R08: 000000000001000d R09: 974ea2fcddfa4cbf R10: 0000000000000000 R11: ffffa19f40cc0ff8 R12: ffff8e2c94b58980 R13: ffff8e2c952d6600 R14: 0000000000000016 R15: ffff8e2c271ab990 FS: 0000000000000000(0000) GS:ffff8e3b3f840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000003c0 CR3: 0000000e8580a004 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> __bnxt_poll_work+0x1c2/0x3e0 [bnxt_en] To address the issue, we now call bnxt_set_rx_skb_mode() within bnxt_change_mtu() to properly set the AGG rings configuration and update rx_skb_func based on the new MTU value. Additionally, BNXT_FLAG_NO_AGG_RINGS is cleared at the beginning of bnxt_set_rx_skb_mode() to make sure it gets set or cleared based on the current MTU. Fixes: 08450ea98ae9 ("bnxt_en: Fix max_mtu setting for multi-buf XDP") Co-developed-by: Somnath Kotur <somnath.kotur(a)broadcom.com> Signed-off-by: Somnath Kotur <somnath.kotur(a)broadcom.com> Signed-off-by: Shravya KN <shravya.k-n(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: drivers/net/ethernet/broadcom/bnxt/bnxt.c [conflicts due to not mergered 1eb2cded45b3 ("net: annotate writes on dev->mtu from ndo_change_mtu()")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 58a7bb75506a..282a29b2cc36 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -3986,7 +3986,7 @@ int bnxt_set_rx_skb_mode(struct bnxt *bp, bool page_mode) struct net_device *dev = bp->dev; if (page_mode) { - bp->flags &= ~BNXT_FLAG_AGG_RINGS; + bp->flags &= ~(BNXT_FLAG_AGG_RINGS | BNXT_FLAG_NO_AGG_RINGS); bp->flags |= BNXT_FLAG_RX_PAGE_MODE; if (bp->xdp_prog->aux->xdp_has_frags) @@ -12795,6 +12795,14 @@ static int bnxt_change_mtu(struct net_device *dev, int new_mtu) bnxt_close_nic(bp, true, false); dev->mtu = new_mtu; + + /* MTU change may change the AGG ring settings if an XDP multi-buffer + * program is attached. We need to set the AGG rings settings and + * rx_skb_func accordingly. + */ + if (READ_ONCE(bp->xdp_prog)) + bnxt_set_rx_skb_mode(bp, true); + bnxt_set_ring_params(bp); if (netif_running(dev)) -- 2.34.1

2 1

[PATCH OLK-6.6] xsk: fix OOB map writes when deleting elements
by Wang Liang 20 Jan '25

20 Jan '25

From: Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> stable inclusion from stable-v6.6.66 commit f8abd03f83d5fe81e76eb93e2c4373eb9f75fd8a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPK CVE: CVE-2024-56614 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 32cd3db7de97c0c7a018756ce66244342fd583f0 upstream. Jordy says: " In the xsk_map_delete_elem function an unsigned integer (map->max_entries) is compared with a user-controlled signed integer (k). Due to implicit type conversion, a large unsigned value for map->max_entries can bypass the intended bounds check: if (k >= map->max_entries) return -EINVAL; This allows k to hold a negative value (between -2147483648 and -2), which is then used as an array index in m->xsk_map[k], which results in an out-of-bounds access. spin_lock_bh(&m->lock); map_entry = &m->xsk_map[k]; // Out-of-bounds map_entry old_xs = unrcu_pointer(xchg(map_entry, NULL)); // Oob write if (old_xs) xsk_map_sock_delete(old_xs, map_entry); spin_unlock_bh(&m->lock); The xchg operation can then be used to cause an out-of-bounds write. Moreover, the invalid map_entry passed to xsk_map_sock_delete can lead to further memory corruption. " It indeed results in following splat: [76612.897343] BUG: unable to handle page fault for address: ffffc8fc2e461108 [76612.904330] #PF: supervisor write access in kernel mode [76612.909639] #PF: error_code(0x0002) - not-present page [76612.914855] PGD 0 P4D 0 [76612.917431] Oops: Oops: 0002 [#1] PREEMPT SMP [76612.921859] CPU: 11 UID: 0 PID: 10318 Comm: a.out Not tainted 6.12.0-rc1+ #470 [76612.929189] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [76612.939781] RIP: 0010:xsk_map_delete_elem+0x2d/0x60 [76612.944738] Code: 00 00 41 54 55 53 48 63 2e 3b 6f 24 73 38 4c 8d a7 f8 00 00 00 48 89 fb 4c 89 e7 e8 2d bf 05 00 48 8d b4 eb 00 01 00 00 31 ff <48> 87 3e 48 85 ff 74 05 e8 16 ff ff ff 4c 89 e7 e8 3e bc 05 00 31 [76612.963774] RSP: 0018:ffffc9002e407df8 EFLAGS: 00010246 [76612.969079] RAX: 0000000000000000 RBX: ffffc9002e461000 RCX: 0000000000000000 [76612.976323] RDX: 0000000000000001 RSI: ffffc8fc2e461108 RDI: 0000000000000000 [76612.983569] RBP: ffffffff80000001 R08: 0000000000000000 R09: 0000000000000007 [76612.990812] R10: ffffc9002e407e18 R11: ffff888108a38858 R12: ffffc9002e4610f8 [76612.998060] R13: ffff888108a38858 R14: 00007ffd1ae0ac78 R15: ffffc9002e4610c0 [76613.005303] FS: 00007f80b6f59740(0000) GS:ffff8897e0ec0000(0000) knlGS:0000000000000000 [76613.013517] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [76613.019349] CR2: ffffc8fc2e461108 CR3: 000000011e3ef001 CR4: 00000000007726f0 [76613.026595] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [76613.033841] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [76613.041086] PKRU: 55555554 [76613.043842] Call Trace: [76613.046331] <TASK> [76613.048468] ? __die+0x20/0x60 [76613.051581] ? page_fault_oops+0x15a/0x450 [76613.055747] ? search_extable+0x22/0x30 [76613.059649] ? search_bpf_extables+0x5f/0x80 [76613.063988] ? exc_page_fault+0xa9/0x140 [76613.067975] ? asm_exc_page_fault+0x22/0x30 [76613.072229] ? xsk_map_delete_elem+0x2d/0x60 [76613.076573] ? xsk_map_delete_elem+0x23/0x60 [76613.080914] __sys_bpf+0x19b7/0x23c0 [76613.084555] __x64_sys_bpf+0x1a/0x20 [76613.088194] do_syscall_64+0x37/0xb0 [76613.091832] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [76613.096962] RIP: 0033:0x7f80b6d1e88d [76613.100592] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [76613.119631] RSP: 002b:00007ffd1ae0ac68 EFLAGS: 00000206 ORIG_RAX: 0000000000000141 [76613.131330] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f80b6d1e88d [76613.142632] RDX: 0000000000000098 RSI: 00007ffd1ae0ad20 RDI: 0000000000000003 [76613.153967] RBP: 00007ffd1ae0adc0 R08: 0000000000000000 R09: 0000000000000000 [76613.166030] R10: 00007f80b6f77040 R11: 0000000000000206 R12: 00007ffd1ae0aed8 [76613.177130] R13: 000055ddf42ce1e9 R14: 000055ddf42d0d98 R15: 00007f80b6fab040 [76613.188129] </TASK> Fix this by simply changing key type from int to u32. Fixes: fbfc504a24f5 ("bpf: introduce new bpf AF_XDP map type BPF_MAP_TYPE_XSKMAP") CC: stable(a)vger.kernel.org Reported-by: Jordy Zomer <jordyzomer(a)google.com> Suggested-by: Jordy Zomer <jordyzomer(a)google.com> Reviewed-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Acked-by: John Fastabend <john.fastabend(a)gmail.com> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> Link: https://lore.kernel.org/r/20241122121030.716788-2-maciej.fijalkowski@intel.… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/xdp/xskmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/xdp/xskmap.c b/net/xdp/xskmap.c index e1c526f97ce3..afa457506274 100644 --- a/net/xdp/xskmap.c +++ b/net/xdp/xskmap.c @@ -224,7 +224,7 @@ static long xsk_map_delete_elem(struct bpf_map *map, void *key) struct xsk_map *m = container_of(map, struct xsk_map, map); struct xdp_sock __rcu **map_entry; struct xdp_sock *old_xs; - int k = *(u32 *)key; + u32 k = *(u32 *)key; if (k >= map->max_entries) return -EINVAL; -- 2.34.1

2 1

[PATCH OLK-6.6] net: fix data-races around sk->sk_forward_alloc
by Wang Liang 20 Jan '25

20 Jan '25

mainline inclusion from mainline-v6.12 commit 073d89808c065ac4c672c0a613a71b27a80691cb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB8IUP CVE: CVE-2024-53124 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzkaller reported this warning: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x1c5/0x1e0 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.12.0-rc5 #26 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:inet_sock_destruct+0x1c5/0x1e0 Code: 24 12 4c 89 e2 5b 48 c7 c7 98 ec bb 82 41 5c e9 d1 18 17 ff 4c 89 e6 5b 48 c7 c7 d0 ec bb 82 41 5c e9 bf 18 17 ff 0f 0b eb 83 <0f> 0b eb 97 0f 0b eb 87 0f 0b e9 68 ff ff ff 66 66 2e 0f 1f 84 00 RSP: 0018:ffffc9000008bd90 EFLAGS: 00010206 RAX: 0000000000000300 RBX: ffff88810b172a90 RCX: 0000000000000007 RDX: 0000000000000002 RSI: 0000000000000300 RDI: ffff88810b172a00 RBP: ffff88810b172a00 R08: ffff888104273c00 R09: 0000000000100007 R10: 0000000000020000 R11: 0000000000000006 R12: ffff88810b172a00 R13: 0000000000000004 R14: 0000000000000000 R15: ffff888237c31f78 FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc63fecac8 CR3: 000000000342e000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __warn+0x88/0x130 ? inet_sock_destruct+0x1c5/0x1e0 ? report_bug+0x18e/0x1a0 ? handle_bug+0x53/0x90 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? inet_sock_destruct+0x1c5/0x1e0 __sk_destruct+0x2a/0x200 rcu_do_batch+0x1aa/0x530 ? rcu_do_batch+0x13b/0x530 rcu_core+0x159/0x2f0 handle_softirqs+0xd3/0x2b0 ? __pfx_smpboot_thread_fn+0x10/0x10 run_ksoftirqd+0x25/0x30 smpboot_thread_fn+0xdd/0x1d0 kthread+0xd3/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]--- Its possible that two threads call tcp_v6_do_rcv()/sk_forward_alloc_add() concurrently when sk->sk_state == TCP_LISTEN with sk->sk_lock unlocked, which triggers a data-race around sk->sk_forward_alloc: tcp_v6_rcv tcp_v6_do_rcv skb_clone_and_charge_r sk_rmem_schedule __sk_mem_schedule sk_forward_alloc_add() skb_set_owner_r sk_mem_charge sk_forward_alloc_add() __kfree_skb skb_release_all skb_release_head_state sock_rfree sk_mem_uncharge sk_forward_alloc_add() sk_mem_reclaim // set local var reclaimable __sk_mem_reclaim sk_forward_alloc_add() In this syzkaller testcase, two threads call tcp_v6_do_rcv() with skb->truesize=768, the sk_forward_alloc changes like this: (cpu 1) | (cpu 2) | sk_forward_alloc ... | ... | 0 __sk_mem_schedule() | | +4096 = 4096 | __sk_mem_schedule() | +4096 = 8192 sk_mem_charge() | | -768 = 7424 | sk_mem_charge() | -768 = 6656 ... | ... | sk_mem_uncharge() | | +768 = 7424 reclaimable=7424 | | | sk_mem_uncharge() | +768 = 8192 | reclaimable=8192 | __sk_mem_reclaim() | | -4096 = 4096 | __sk_mem_reclaim() | -8192 = -4096 != 0 The skb_clone_and_charge_r() should not be called in tcp_v6_do_rcv() when sk->sk_state is TCP_LISTEN, it happens later in tcp_v6_syn_recv_sock(). Fix the same issue in dccp_v6_do_rcv(). Suggested-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets") Signed-off-by: Wang Liang <wangliang74(a)huawei.com> Link: https://patch.msgid.link/20241107023405.889239-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/tcp_ipv6.c [conflicts due to not mergered ee01defe25ba ("tcp: make dropreason in tcp_child_process() work")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/dccp/ipv6.c | 2 +- net/ipv6/tcp_ipv6.c | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c index d25e962b18a5..2839ca8053ba 100644 --- a/net/dccp/ipv6.c +++ b/net/dccp/ipv6.c @@ -616,7 +616,7 @@ static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) by tcp. Feel free to propose better solution. --ANK (980728) */ - if (np->rxopt.all) + if (np->rxopt.all && sk->sk_state != DCCP_LISTEN) opt_skb = skb_clone_and_charge_r(skb, sk); if (sk->sk_state == DCCP_OPEN) { /* Fast path */ diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 83b48dc2b3ee..29749d51d54b 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -1458,7 +1458,7 @@ int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) by tcp. Feel free to propose better solution. --ANK (980728) */ - if (np->rxopt.all) + if (np->rxopt.all && sk->sk_state != TCP_LISTEN) opt_skb = skb_clone_and_charge_r(skb, sk); reason = SKB_DROP_REASON_NOT_SPECIFIED; @@ -1497,8 +1497,6 @@ int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) if (nsk != sk) { if (tcp_child_process(sk, nsk, skb)) goto reset; - if (opt_skb) - __kfree_skb(opt_skb); return 0; } } else -- 2.34.1

2 1

[PATCH OLK-6.6] net/smc: fix LGR and link use-after-free issue
by Wang Liang 20 Jan '25

20 Jan '25

From: Wen Gu <guwen(a)linux.alibaba.com> stable inclusion from stable-v6.6.66 commit 673d606683ac70bc074ca6676b938bff18635226 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP5 CVE: CVE-2024-56640 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2c7f14ed9c19ec0f149479d1c2842ec1f9bf76d7 ] We encountered a LGR/link use-after-free issue, which manifested as the LGR/link refcnt reaching 0 early and entering the clear process, making resource access unsafe. refcount_t: addition on 0; use-after-free. WARNING: CPU: 14 PID: 107447 at lib/refcount.c:25 refcount_warn_saturate+0x9c/0x140 Workqueue: events smc_lgr_terminate_work [smc] Call trace: refcount_warn_saturate+0x9c/0x140 __smc_lgr_terminate.part.45+0x2a8/0x370 [smc] smc_lgr_terminate_work+0x28/0x30 [smc] process_one_work+0x1b8/0x420 worker_thread+0x158/0x510 kthread+0x114/0x118 or refcount_t: underflow; use-after-free. WARNING: CPU: 6 PID: 93140 at lib/refcount.c:28 refcount_warn_saturate+0xf0/0x140 Workqueue: smc_hs_wq smc_listen_work [smc] Call trace: refcount_warn_saturate+0xf0/0x140 smcr_link_put+0x1cc/0x1d8 [smc] smc_conn_free+0x110/0x1b0 [smc] smc_conn_abort+0x50/0x60 [smc] smc_listen_find_device+0x75c/0x790 [smc] smc_listen_work+0x368/0x8a0 [smc] process_one_work+0x1b8/0x420 worker_thread+0x158/0x510 kthread+0x114/0x118 It is caused by repeated release of LGR/link refcnt. One suspect is that smc_conn_free() is called repeatedly because some smc_conn_free() from server listening path are not protected by sock lock. e.g. Calls under socklock | smc_listen_work ------------------------------------------------------- lock_sock(sk) | smc_conn_abort smc_conn_free | \- smc_conn_free \- smcr_link_put | \- smcr_link_put (duplicated) release_sock(sk) So here add sock lock protection in smc_listen_work() path, making it exclusive with other connection operations. Fixes: 3b2dec2603d5 ("net/smc: restructure client and server code in af_smc") Co-developed-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Signed-off-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Co-developed-by: Kai <KaiShen(a)linux.alibaba.com> Signed-off-by: Kai <KaiShen(a)linux.alibaba.com> Signed-off-by: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: Wenjia Zhang <wenjia(a)linux.ibm.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/smc/af_smc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 2d8ba8847c0f..968396a11d17 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -1901,6 +1901,7 @@ static void smc_listen_out(struct smc_sock *new_smc) if (tcp_sk(new_smc->clcsock->sk)->syn_smc) atomic_dec(&lsmc->queued_smc_hs); + release_sock(newsmcsk); /* lock in smc_listen_work() */ if (lsmc->sk.sk_state == SMC_LISTEN) { lock_sock_nested(&lsmc->sk, SINGLE_DEPTH_NESTING); smc_accept_enqueue(&lsmc->sk, newsmcsk); @@ -2422,6 +2423,7 @@ static void smc_listen_work(struct work_struct *work) u8 accept_version; int rc = 0; + lock_sock(&new_smc->sk); /* release in smc_listen_out() */ if (new_smc->listen_smc->sk.sk_state != SMC_LISTEN) return smc_listen_out_err(new_smc); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] merge CVE-patch into OLK-6.6
by Kaixiong Yu 20 Jan '25

20 Jan '25

CVE-2024-53198 CVE-2024-47732 Dan Carpenter (1): crypto: iaa - Fix potential use after free bug Qiu-ji Chen (1): xen: Fix the issue of resource not being properly released in xenbus_dev_probe() drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 ++-- drivers/xen/xenbus/xenbus_probe.c | 8 +++++++- 2 files changed, 9 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] net: dsa: improve shutdown sequence
by Wang Liang 20 Jan '25

20 Jan '25

From: Vladimir Oltean <vladimir.oltean(a)nxp.com> mainline inclusion from mainline-v6.12-rc2 commit 6c24a03a61a245fe34d47582898331fa034b6ccd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAR CVE: CVE-2024-49998 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Alexander Sverdlin presents 2 problems during shutdown with the lan9303 driver. One is specific to lan9303 and the other just happens to reproduce there. The first problem is that lan9303 is unique among DSA drivers in that it calls dev_get_drvdata() at "arbitrary runtime" (not probe, not shutdown, not remove): phy_state_machine() -> ... -> dsa_user_phy_read() -> ds->ops->phy_read() -> lan9303_phy_read() -> chip->ops->phy_read() -> lan9303_mdio_phy_read() -> dev_get_drvdata() But we never stop the phy_state_machine(), so it may continue to run after dsa_switch_shutdown(). Our common pattern in all DSA drivers is to set drvdata to NULL to suppress the remove() method that may come afterwards. But in this case it will result in an NPD. The second problem is that the way in which we set dp->conduit->dsa_ptr = NULL; is concurrent with receive packet processing. dsa_switch_rcv() checks once whether dev->dsa_ptr is NULL, but afterwards, rather than continuing to use that non-NULL value, dev->dsa_ptr is dereferenced again and again without NULL checks: dsa_conduit_find_user() and many other places. In between dereferences, there is no locking to ensure that what was valid once continues to be valid. Both problems have the common aspect that closing the conduit interface solves them. In the first case, dev_close(conduit) triggers the NETDEV_GOING_DOWN event in dsa_user_netdevice_event() which closes user ports as well. dsa_port_disable_rt() calls phylink_stop(), which synchronously stops the phylink state machine, and ds->ops->phy_read() will thus no longer call into the driver after this point. In the second case, dev_close(conduit) should do this, as per Documentation/networking/driver.rst: | Quiescence | ---------- | | After the ndo_stop routine has been called, the hardware must | not receive or transmit any data. All in flight packets must | be aborted. If necessary, poll or wait for completion of | any reset commands. So it should be sufficient to ensure that later, when we zeroize conduit->dsa_ptr, there will be no concurrent dsa_switch_rcv() call on this conduit. The addition of the netif_device_detach() function is to ensure that ioctls, rtnetlinks and ethtool requests on the user ports no longer propagate down to the driver - we're no longer prepared to handle them. The race condition actually did not exist when commit 0650bf52b31f ("net: dsa: be compatible with masters which unregister on shutdown") first introduced dsa_switch_shutdown(). It was created later, when we stopped unregistering the user interfaces from a bad spot, and we just replaced that sequence with a racy zeroization of conduit->dsa_ptr (one which doesn't ensure that the interfaces aren't up). Reported-by: Alexander Sverdlin <alexander.sverdlin(a)siemens.com> Closes: https://lore.kernel.org/netdev/2d2e3bba17203c14a5ffdabc174e3b6bbb9ad438.cam… Closes: https://lore.kernel.org/netdev/c1bf4de54e829111e0e4a70e7bd1cf523c9550ff.cam… Fixes: ee534378f005 ("net: dsa: fix panic when DSA master device unbinds on shutdown") Reviewed-by: Alexander Sverdlin <alexander.sverdlin(a)siemens.com> Tested-by: Alexander Sverdlin <alexander.sverdlin(a)siemens.com> Signed-off-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Link: https://patch.msgid.link/20240913203549.3081071-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/dsa/dsa.c [conflicts due to not mergered 6ca80638b90c ("net: dsa: Use conduit and user terms")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/dsa/dsa.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c index ccbdb98109f8..21f8a4ff939a 100644 --- a/net/dsa/dsa.c +++ b/net/dsa/dsa.c @@ -1574,6 +1574,7 @@ EXPORT_SYMBOL_GPL(dsa_unregister_switch); void dsa_switch_shutdown(struct dsa_switch *ds) { struct net_device *master, *slave_dev; + LIST_HEAD(close_list); struct dsa_port *dp; mutex_lock(&dsa2_mutex); @@ -1583,10 +1584,16 @@ void dsa_switch_shutdown(struct dsa_switch *ds) rtnl_lock(); + dsa_switch_for_each_cpu_port(dp, ds) + list_add(&dp->master->close_list, &close_list); + + dev_close_many(&close_list, true); + dsa_switch_for_each_user_port(dp, ds) { master = dsa_port_to_master(dp); slave_dev = dp->slave; + netif_device_detach(slave_dev); netdev_upper_dev_unlink(master, slave_dev); } -- 2.34.1

2 1

[PATCH OLK-6.6] ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
by Wang Liang 20 Jan '25

20 Jan '25

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.12-rc6 commit 90e0569dd3d32f4f4d2ca691d3fa5a8a14a13c12 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQ5 CVE: CVE-2024-50304 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The per-netns IP tunnel hash table is protected by the RTNL mutex and ip_tunnel_find() is only called from the control path where the mutex is taken. Add a lockdep expression to hlist_for_each_entry_rcu() in ip_tunnel_find() in order to validate that the mutex is held and to silence the suspicious RCU usage warning [1]. [1] WARNING: suspicious RCU usage 6.12.0-rc3-custom-gd95d9a31aceb #139 Not tainted ----------------------------- net/ipv4/ip_tunnel.c:221 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by ip/362: #0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60 stack backtrace: CPU: 12 UID: 0 PID: 362 Comm: ip Not tainted 6.12.0-rc3-custom-gd95d9a31aceb #139 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0xba/0x110 lockdep_rcu_suspicious.cold+0x4f/0xd6 ip_tunnel_find+0x435/0x4d0 ip_tunnel_newlink+0x517/0x7a0 ipgre_newlink+0x14c/0x170 __rtnl_newlink+0x1173/0x19c0 rtnl_newlink+0x6c/0xa0 rtnetlink_rcv_msg+0x3cc/0xf60 netlink_rcv_skb+0x171/0x450 netlink_unicast+0x539/0x7f0 netlink_sendmsg+0x8c1/0xd80 ____sys_sendmsg+0x8f9/0xc20 ___sys_sendmsg+0x197/0x1e0 __sys_sendmsg+0x122/0x1f0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241023123009.749764-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/ip_tunnel.c [conflicts due to not mergered 5832c4a77d69 ("ip_tunnel: convert __be16 tunnel flags to bitmaps")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv4/ip_tunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c index acf93f34a821..2081b073bcd7 100644 --- a/net/ipv4/ip_tunnel.c +++ b/net/ipv4/ip_tunnel.c @@ -218,7 +218,7 @@ static struct ip_tunnel *ip_tunnel_find(struct ip_tunnel_net *itn, struct ip_tunnel *t = NULL; struct hlist_head *head = ip_bucket(itn, parms); - hlist_for_each_entry_rcu(t, head, hash_node) { + hlist_for_each_entry_rcu(t, head, hash_node, lockdep_rtnl_is_held()) { if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr && link == t->parms.link && -- 2.34.1

2 1

[PATCH OLK-6.6] net: renesas: rswitch: avoid use-after-put for a device tree node
by Bowen You 20 Jan '25

20 Jan '25

From: Nikita Yushchenko <nikita.yoush(a)cogentembedded.com> stable inclusion from stable-v6.6.67 commit bf8c6755f02029d1eddc3ff19b870240f054afc7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIO14 CVE: CVE-2024-55639 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 66b7e9f85b8459c823b11e9af69dbf4be5eb6be8 ] The device tree node saved in the rswitch_device structure is used at several driver locations. So passing this node to of_node_put() after the first use is wrong. Move of_node_put() for this node to exit paths. Fixes: b46f1e579329 ("net: renesas: rswitch: Simplify struct phy * handling") Signed-off-by: Nikita Yushchenko <nikita.yoush(a)cogentembedded.com> Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> Link: https://patch.msgid.link/20241208095004.69468-5-nikita.yoush@cogentembedded… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/net/ethernet/renesas/rswitch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index ae9d8722b76f..5e3c0e24a1bc 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1741,7 +1741,6 @@ static int rswitch_device_alloc(struct rswitch_private *priv, int index) rdev->np_port = rswitch_get_port_node(rdev); rdev->disabled = !rdev->np_port; err = of_get_ethdev_address(rdev->np_port, ndev); - of_node_put(rdev->np_port); if (err) { if (is_valid_ether_addr(rdev->etha->mac_addr)) eth_hw_addr_set(ndev, rdev->etha->mac_addr); @@ -1771,6 +1770,7 @@ static int rswitch_device_alloc(struct rswitch_private *priv, int index) out_rxdmac: out_get_params: + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); @@ -1784,6 +1784,7 @@ static void rswitch_device_free(struct rswitch_private *priv, int index) rswitch_txdmac_free(ndev); rswitch_rxdmac_free(ndev); + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); } -- 2.34.1

2 1

[PATCH OLK-6.6] wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
by Wang Wensheng 20 Jan '25

20 Jan '25

From: Ping-Ke Shih <pkshih(a)realtek.com> stable inclusion from stable-v6.6.66 commit 1a0f54cb3fea5d087440b2bae03202c445156a8d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBI835 CVE: CVE-2024-48873 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 630d5d8f2bf6b340202b6bc2c05d794bbd8e4c1c ] The return value of ieee80211_probereq_get() might be NULL, so check it before using to avoid NULL pointer access. Addresses-Coverity-ID: 1529805 ("Dereference null return value") Signed-off-by: Ping-Ke Shih <pkshih(a)realtek.com> Link: https://patch.msgid.link/20240919081216.28505-2-pkshih@realtek.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/net/wireless/realtek/rtw89/fw.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c index 468cfa43ec04..a8e2efae6e52 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.c +++ b/drivers/net/wireless/realtek/rtw89/fw.c @@ -3662,6 +3662,9 @@ static int rtw89_update_6ghz_rnr_chan(struct rtw89_dev *rtwdev, skb = ieee80211_probereq_get(rtwdev->hw, rtwvif->mac_addr, NULL, 0, req->ie_len); + if (!skb) + return -ENOMEM; + skb_put_data(skb, ies->ies[NL80211_BAND_6GHZ], ies->len[NL80211_BAND_6GHZ]); skb_put_data(skb, ies->common_ies, ies->common_ie_len); hdr = (struct ieee80211_hdr *)skb->data; -- 2.22.0

2 1

[PATCH OLK-6.6 0/2] merge CVE-patch into OLK-6.6
by Kaixiong Yu 20 Jan '25

20 Jan '25

CVE-2024-53198 CVE-2024-47732 Dan Carpenter (1): crypto: iaa - Fix potential use after free bug Qiu-ji Chen (1): xen: Fix the issue of resource not being properly released in xenbus_dev_probe() drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 ++-- drivers/xen/xenbus/xenbus_probe.c | 8 +++++++- 2 files changed, 9 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/4] Fix CVE-2024-47794
by Tengda Wu 20 Jan '25

20 Jan '25

Fix CVE-2024-47794. Leon Hwang (3): bpf: Prevent tailcall infinite loop caused by freplace selftests/bpf: Add testcase for updating attached freplace prog to prog_array map selftests/bpf: Add test to verify tailcall and freplace restrictions Tengda Wu (1): bpf: Fix kabi breakage in struct bpf_prog_aux include/linux/bpf.h | 21 ++- kernel/bpf/arraymap.c | 26 ++- kernel/bpf/core.c | 1 + kernel/bpf/syscall.c | 7 +- kernel/bpf/trampoline.c | 47 +++++- .../selftests/bpf/prog_tests/tailcalls.c | 156 ++++++++++++++++++ .../selftests/bpf/progs/tailcall_freplace.c | 23 +++ .../testing/selftests/bpf/progs/tc_bpf2bpf.c | 23 +++ 8 files changed, 286 insertions(+), 18 deletions(-) create mode 100644 tools/testing/selftests/bpf/progs/tailcall_freplace.c create mode 100644 tools/testing/selftests/bpf/progs/tc_bpf2bpf.c -- 2.34.1

2 5

[PATCH OLK-6.6] LeapIOraid: update leapioraid driver version
by haodongdong 20 Jan '25

20 Jan '25

LeapIO inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBITP1 ------------------------------------------ update leapioraid driver version Signed-off-by: haodongdong <doubled(a)leap-io.com> --- drivers/scsi/leapioraid/leapioraid_func.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/leapioraid/leapioraid_func.h b/drivers/scsi/leapioraid/leapioraid_func.h index 8ca8fc0a6f262..76babcb40766c 100644 --- a/drivers/scsi/leapioraid/leapioraid_func.h +++ b/drivers/scsi/leapioraid/leapioraid_func.h @@ -67,10 +67,10 @@ #define LEAPIORAID_DRIVER_NAME "LeapIoRaid" #define LEAPIORAID_AUTHOR "LeapIO Inc." #define LEAPIORAID_DESCRIPTION "LEAPIO RAID Driver" -#define LEAPIORAID_DRIVER_VERSION "1.00.00.00" +#define LEAPIORAID_DRIVER_VERSION "1.02.02.00" #define LEAPIORAID_MAJOR_VERSION (1) -#define LEAPIORAID_MINOR_VERSION (00) -#define LEAPIORAID_BUILD_VERSION (00) +#define LEAPIORAID_MINOR_VERSION (02) +#define LEAPIORAID_BUILD_VERSION (02) #define LEAPIORAID_RELEASE_VERSION (00) #define LEAPIORAID_VENDOR_ID (0xD405) -- 2.25.1

2 1

[PATCH OLK-6.6] LeapIOraid: update leapioraid driver version
by haodongdong 20 Jan '25

20 Jan '25

LeapIO inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBITP1 ------------------------------------------ update leapioraid driver version Signed-off-by: haodongdong <doubled(a)leap-io.com> --- drivers/scsi/leapioraid/leapioraid_func.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/leapioraid/leapioraid_func.h b/drivers/scsi/leapioraid/leapioraid_func.h index 8ca8fc0a6f262..39230bb11732b 100644 --- a/drivers/scsi/leapioraid/leapioraid_func.h +++ b/drivers/scsi/leapioraid/leapioraid_func.h @@ -68,9 +68,10 @@ #define LEAPIORAID_AUTHOR "LeapIO Inc." #define LEAPIORAID_DESCRIPTION "LEAPIO RAID Driver" #define LEAPIORAID_DRIVER_VERSION "1.00.00.00" +#define LEAPIORAID_DRIVER_VERSION "1.02.02.00" #define LEAPIORAID_MAJOR_VERSION (1) -#define LEAPIORAID_MINOR_VERSION (00) -#define LEAPIORAID_BUILD_VERSION (00) +#define LEAPIORAID_MINOR_VERSION (02) +#define LEAPIORAID_BUILD_VERSION (02) #define LEAPIORAID_RELEASE_VERSION (00) #define LEAPIORAID_VENDOR_ID (0xD405) -- 2.25.1

2 1

[PATCH OLK-6.6] Revert "Revert "driver core: Fix uevent_show() vs driver detach race""
by Zhang Zekun 20 Jan '25

20 Jan '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBH7EF -------------------------------------- This reverts commit 5e125aaa84dc006a227fb39f838b3a2e0a27c72f. This patch will reintroduce device_lock in uevent_show(), which has already cause deadlock in practice. Fixes: 5e125aaa84dc ("Revert "driver core: Fix uevent_show() vs driver detach race"") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/base/core.c | 13 ++++++++----- drivers/base/module.c | 4 ++++ 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/base/core.c b/drivers/base/core.c index 560a124eeb8d..0b2cf93d8e01 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -25,6 +25,7 @@ #include <linux/mutex.h> #include <linux/pm_runtime.h> #include <linux/netdevice.h> +#include <linux/rcupdate.h> #include <linux/sched/signal.h> #include <linux/sched/mm.h> #include <linux/string_helpers.h> @@ -2566,6 +2567,7 @@ static const char *dev_uevent_name(const struct kobject *kobj) static int dev_uevent(const struct kobject *kobj, struct kobj_uevent_env *env) { const struct device *dev = kobj_to_dev(kobj); + struct device_driver *driver; int retval = 0; /* add device node properties if present */ @@ -2594,8 +2596,12 @@ static int dev_uevent(const struct kobject *kobj, struct kobj_uevent_env *env) if (dev->type && dev->type->name) add_uevent_var(env, "DEVTYPE=%s", dev->type->name); - if (dev->driver) - add_uevent_var(env, "DRIVER=%s", dev->driver->name); + /* Synchronize with module_remove_driver() */ + rcu_read_lock(); + driver = READ_ONCE(dev->driver); + if (driver) + add_uevent_var(env, "DRIVER=%s", driver->name); + rcu_read_unlock(); /* Add common DT information about the device */ of_device_uevent(dev, env); @@ -2665,11 +2671,8 @@ static ssize_t uevent_show(struct device *dev, struct device_attribute *attr, if (!env) return -ENOMEM; - /* Synchronize with really_probe() */ - device_lock(dev); /* let the kset specific function add its keys */ retval = kset->uevent_ops->uevent(&dev->kobj, env); - device_unlock(dev); if (retval) goto out; diff --git a/drivers/base/module.c b/drivers/base/module.c index a33663d92256..0d5c5da367f7 100644 --- a/drivers/base/module.c +++ b/drivers/base/module.c @@ -7,6 +7,7 @@ #include <linux/errno.h> #include <linux/slab.h> #include <linux/string.h> +#include <linux/rcupdate.h> #include "base.h" static char *make_driver_name(struct device_driver *drv) @@ -101,6 +102,9 @@ void module_remove_driver(struct device_driver *drv) if (!drv) return; + /* Synchronize with dev_uevent() */ + synchronize_rcu(); + sysfs_remove_link(&drv->p->kobj, "module"); if (drv->owner) -- 2.22.0

2 1

[PATCH OLK-6.6] perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG
by Luo Gengkun 20 Jan '25

20 Jan '25

From: Kan Liang <kan.liang(a)linux.intel.com> stable inclusion from stable-v6.6.67 commit 0252305d296431f4c328acb008429fb6d595fc16 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBIHJJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9f3de72a0c37005f897d69e4bdd59c25b8898447 upstream. The PEBS kernel warnings can still be observed with the below case. when the below commands are running in parallel for a while. while true; do perf record --no-buildid -a --intr-regs=AX \ -e cpu/event=0xd0,umask=0x81/pp \ -c 10003 -o /dev/null ./triad; done & while true; do perf record -e 'cpu/mem-loads,ldlat=3/uP' -W -d -- ./dtlb done The commit b752ea0c28e3 ("perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG") intends to flush the entire PEBS buffer before the hardware is reprogrammed. However, it fails in the above case. The first perf command utilizes the large PEBS, while the second perf command only utilizes a single PEBS. When the second perf event is added, only the n_pebs++. The intel_pmu_pebs_enable() is invoked after intel_pmu_pebs_add(). So the cpuc->n_pebs == cpuc->n_large_pebs check in the intel_pmu_drain_large_pebs() fails. The PEBS DS is not flushed. The new PEBS event should not be taken into account when flushing the existing PEBS DS. The check is unnecessary here. Before the hardware is reprogrammed, all the stale records must be drained unconditionally. For single PEBS or PEBS-vi-pt, the DS must be empty. The drain_pebs() can handle the empty case. There is no harm to unconditionally drain the PEBS DS. Fixes: b752ea0c28e3 ("perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG") Signed-off-by: Kan Liang <kan.liang(a)linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20241119135504.1463839-2-kan.liang@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/intel/ds.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c index 14b11d607f47..c165c8202ad0 100644 --- a/arch/x86/events/intel/ds.c +++ b/arch/x86/events/intel/ds.c @@ -1354,7 +1354,7 @@ void intel_pmu_pebs_enable(struct perf_event *event) * hence we need to drain when changing said * size. */ - intel_pmu_drain_large_pebs(cpuc); + intel_pmu_drain_pebs_buffer(); adaptive_pebs_record_size_update(); wrmsrl(MSR_PEBS_DATA_CFG, pebs_data_cfg); cpuc->active_pebs_data_cfg = pebs_data_cfg; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1407/1407] drivers/mux/adgs1408.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 20 Jan '25

20 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 8b9ce6954c05e3e4115f54444c7eaf2aa2dd5e65 [1407/1407] mux: adgs1408: new driver for Analog Devices ADGS1408/1409 mux config: x86_64-buildonly-randconfig-001-20250116 (https://download.01.org/0day-ci/archive/20250120/202501200708.2Pf7Ia63-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250120/202501200708.2Pf7Ia63-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501200708.2Pf7Ia63-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/mux/adgs1408.c:9: include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'adgs1408_driver_exit': 'cold' [-Wmissing-attributes] 138 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ include/linux/device.h:1562:1: note: in expansion of macro 'module_exit' 1562 | module_exit(__driver##_exit); | ^~~~~~~~~~~ include/linux/spi/spi.h:293:9: note: in expansion of macro 'module_driver' 293 | module_driver(__spi_driver, spi_register_driver, \ | ^~~~~~~~~~~~~ drivers/mux/adgs1408.c:127:1: note: in expansion of macro 'module_spi_driver' 127 | module_spi_driver(adgs1408_driver); | ^~~~~~~~~~~~~~~~~ In file included from include/linux/mux/driver.h:14, from drivers/mux/adgs1408.c:10: drivers/mux/adgs1408.c:127:19: note: 'cleanup_module' target declared here 127 | module_spi_driver(adgs1408_driver); | ^~~~~~~~~~~~~~~ include/linux/device.h:1558:20: note: in definition of macro 'module_driver' 1558 | static void __exit __driver##_exit(void) \ | ^~~~~~~~ drivers/mux/adgs1408.c:127:1: note: in expansion of macro 'module_spi_driver' 127 | module_spi_driver(adgs1408_driver); | ^~~~~~~~~~~~~~~~~ include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'adgs1408_driver_init': 'cold' [-Wmissing-attributes] 132 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/device.h:1557:1: note: in expansion of macro 'module_init' 1557 | module_init(__driver##_init); \ | ^~~~~~~~~~~ include/linux/spi/spi.h:293:9: note: in expansion of macro 'module_driver' 293 | module_driver(__spi_driver, spi_register_driver, \ | ^~~~~~~~~~~~~ drivers/mux/adgs1408.c:127:1: note: in expansion of macro 'module_spi_driver' 127 | module_spi_driver(adgs1408_driver); | ^~~~~~~~~~~~~~~~~ drivers/mux/adgs1408.c:127:19: note: 'init_module' target declared here 127 | module_spi_driver(adgs1408_driver); | ^~~~~~~~~~~~~~~ include/linux/device.h:1553:19: note: in definition of macro 'module_driver' 1553 | static int __init __driver##_init(void) \ | ^~~~~~~~ drivers/mux/adgs1408.c:127:1: note: in expansion of macro 'module_spi_driver' 127 | module_spi_driver(adgs1408_driver); | ^~~~~~~~~~~~~~~~~ >> drivers/mux/adgs1408.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 19 Jan '25

19 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250119/202501192215.87TCB3P8-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501192215.87TCB3P8-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1334/1334] kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace'
by kernel test robot 19 Jan '25

19 Jan '25

Hi Guilherme, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 190aae97bcddbed131a203f829257b168f5058ce [1334/1334] kernel/hung_task.c: introduce sysctl to print all traces when a hung task is detected config: x86_64-randconfig-103-20241218 (https://download.01.org/0day-ci/archive/20250119/202501191953.ABToUtr4-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250119/202501191953.ABToUtr4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501191953.ABToUtr4-lkp@intel.com/ All errors (new ones prefixed by >>): >> kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace' 148 | if (sysctl_hung_task_all_cpu_backtrace) | ^ kernel/hung_task.c:235:5: warning: no previous prototype for function 'proc_dohung_task_timeout_secs' [-Wmissing-prototypes] 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ kernel/hung_task.c:235:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ | static 1 warning and 1 error generated. vim +/sysctl_hung_task_all_cpu_backtrace +148 kernel/hung_task.c 94 95 static void check_hung_task(struct task_struct *t, unsigned long timeout) 96 { 97 unsigned long switch_count = t->nvcsw + t->nivcsw; 98 99 /* 100 * Ensure the task is not frozen. 101 * Also, skip vfork and any other user process that freezer should skip. 102 */ 103 if (unlikely(t->flags & (PF_FROZEN | PF_FREEZER_SKIP))) 104 return; 105 106 /* 107 * When a freshly created task is scheduled once, changes its state to 108 * TASK_UNINTERRUPTIBLE without having ever been switched out once, it 109 * musn't be checked. 110 */ 111 if (unlikely(!switch_count)) 112 return; 113 114 if (switch_count != t->last_switch_count) { 115 t->last_switch_count = switch_count; 116 t->last_switch_time = jiffies; 117 return; 118 } 119 if (time_is_after_jiffies(t->last_switch_time + timeout * HZ)) 120 return; 121 122 trace_sched_process_hang(t); 123 124 if (sysctl_hung_task_panic) { 125 console_verbose(); 126 hung_task_show_lock = true; 127 hung_task_call_panic = true; 128 } 129 130 /* 131 * Ok, the task did not get scheduled for more than 2 minutes, 132 * complain: 133 */ 134 if (sysctl_hung_task_warnings) { 135 if (sysctl_hung_task_warnings > 0) 136 sysctl_hung_task_warnings--; 137 pr_err("INFO: task %s:%d blocked for more than %ld seconds.\n", 138 t->comm, t->pid, timeout); 139 pr_err(" %s %s %.*s\n", 140 print_tainted(), init_utsname()->release, 141 (int)strcspn(init_utsname()->version, " "), 142 init_utsname()->version); 143 pr_err("\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\"" 144 " disables this message.\n"); 145 sched_show_task(t); 146 hung_task_show_lock = true; 147 > 148 if (sysctl_hung_task_all_cpu_backtrace) 149 hung_task_show_all_bt = true; 150 } 151 152 touch_nmi_watchdog(); 153 } 154 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1327/1327] mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled'
by kernel test robot 19 Jan '25

19 Jan '25

Hi liubo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 44983705e56ab22fda801d66e2a6bd0d1be7ca0b [1327/1327] etmem: add original kernel swap enabled options config: x86_64-buildonly-randconfig-005-20241216 (https://download.01.org/0day-ci/archive/20250119/202501191820.CX3a1XfY-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250119/202501191820.CX3a1XfY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501191820.CX3a1XfY-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from mm/vmscan.c:23: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/vmscan.c:33: include/linux/mm_inline.h:32:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 32 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:34:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/vmscan.c:350:64: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 350 | lru_size = node_page_state(lruvec_pgdat(lruvec), NR_LRU_BASE + lru); | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:240:60: note: expanded from macro 'node_page_state' 240 | #define node_page_state(node, item) global_node_page_state(item) | ^~~~ mm/vmscan.c:363:29: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 363 | NR_ZONE_LRU_BASE + lru); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/vmscan.c:1776:4: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 1776 | __count_zid_vm_events(PGSCAN_SKIP, zid, nr_skipped[zid]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:127:34: note: expanded from macro '__count_zid_vm_events' 127 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/vmscan.c:2734:17: warning: variable 'node_lru_pages' set but not used [-Wunused-but-set-variable] 2734 | unsigned long node_lru_pages = 0; | ^ mm/vmscan.c:3066:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3066 | __count_zid_vm_events(ALLOCSTALL, sc->reclaim_idx, 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:127:34: note: expanded from macro '__count_zid_vm_events' 127 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ >> mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] 3257 | if (sc != NULL && !kernel_swap_enabled()) | ^ mm/vmscan.c:3257:21: note: did you mean 'kernfs_ns_enabled'? include/linux/kernfs.h:309:20: note: 'kernfs_ns_enabled' declared here 309 | static inline bool kernfs_ns_enabled(struct kernfs_node *kn) | ^ 8 warnings and 1 error generated. vim +/kernel_swap_enabled +3257 mm/vmscan.c 3250 3251 /* 3252 * Check if original kernel swap is enabled 3253 * turn off kernel swap,but leave page cache reclaim on 3254 */ 3255 static inline void kernel_swap_check(struct scan_control *sc) 3256 { > 3257 if (sc != NULL && !kernel_swap_enabled()) 3258 sc->may_swap = 0; 3259 } 3260 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1407/1407] hifc_lld.c:undefined reference to `rtc_time64_to_tm'
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 7fc993d55d1b54ae40e29dfac825a18d04d644c6 [1407/1407] scsi/hifc: add hifc driver FC service module config: arm64-randconfig-003-20250116 (https://download.01.org/0day-ci/archive/20250118/202501182334.LzPZxncS-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250118/202501182334.LzPZxncS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501182334.LzPZxncS-lkp@intel.com/ All errors (new ones prefixed by >>): aarch64-linux-ld: warning: -z norelro ignored aarch64-linux-ld: warning: .tmp_vmlinux1 has a LOAD segment with RWX permissions aarch64-linux-ld: drivers/scsi/huawei/hifc/hifc_lld.o: in function `hifc_sync_time_to_fmw': >> hifc_lld.c:(.text+0x4d4): undefined reference to `rtc_time64_to_tm' aarch64-linux-ld: drivers/scsi/huawei/hifc/hifc_dbgtool_knl.o: in function `ffm_intr_msg_record': >> hifc_dbgtool_knl.c:(.text+0x268): undefined reference to `rtc_time64_to_tm' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1826/1826] include/linux/sched/signal.h: linux/kabi.h is included more than once.
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a5cbe5b715d9cac271b2c6175e728f0c4167f675 commit: b53643e68c841ccb6f05f90601ea30b1afeb0a2b [1826/1826] !3695 x86: Add x86 related kabi reservations compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501181428.cSbIc8DR-lkp@intel.com/ includecheck warnings: (new ones prefixed by >>) >> include/linux/sched/signal.h: linux/kabi.h is included more than once. vim +15 include/linux/sched/signal.h 4 5 #include <linux/rculist.h> 6 #include <linux/signal.h> 7 #include <linux/sched.h> 8 #include <linux/sched/jobctl.h> 9 #include <linux/sched/task.h> 10 #include <linux/cred.h> 11 #include <linux/refcount.h> 12 #include <linux/posix-timers.h> 13 #include <linux/mm_types.h> 14 #include <asm/ptrace.h> > 15 #include <linux/kabi.h> 16 > 17 #include <linux/kabi.h> 18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] mm/slub: Reduce memory consumption in extreme scenarios
by Kaixiong Yu 18 Jan '25

18 Jan '25

From: Chen Jun <chenjun102(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit 9198ffbd2b494daae3a67cac1d59c3a2754e64cd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBH72Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When kmalloc_node() is called without __GFP_THISNODE and the target node lacks sufficient memory, SLUB allocates a folio from a different node other than the requested node, instead of taking a partial slab from it. However, since the allocated folio does not belong to the requested node, on the following allocation it is deactivated and added to the partial slab list of the node it belongs to. This behavior can result in excessive memory usage when the requested node has insufficient memory, as SLUB will repeatedly allocate folios from other nodes without reusing the previously allocated ones. To prevent memory wastage, when a preferred node is indicated (not NUMA_NO_NODE) but without a prior __GFP_THISNODE constraint: 1) try to get a partial slab from target node only by having __GFP_THISNODE in pc.flags for get_partial() 2) if 1) failed, try to allocate a new slab from target node with GFP_NOWAIT | __GFP_THISNODE opportunistically. 3) if 2) failed, retry with original gfpflags which will allow get_partial() try partial lists of other nodes before potentially allocating new page from other nodes Without a preferred node, or with __GFP_THISNODE constraint, the behavior remains unchanged. On qemu with 4 numa nodes and each numa has 1G memory. Write a test ko to call kmalloc_node(196, GFP_KERNEL, 3) for (4 * 1024 + 4) * 1024 times. cat /proc/slabinfo shows: kmalloc-256 4200530 13519712 256 32 2 : tunables.. after this patch, cat /proc/slabinfo shows: kmalloc-256 4200558 4200768 256 32 2 : tunables.. Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> Conflicts: mm/slub.c [The conflict is large. Because OLK-5.10 does not merge mainline patch 53a0de06e50acb372c75d87fcc72ddfdf4a060ee ("mm, slub: dissolve new_slab_objects() into ___slab_alloc()")] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/slub.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index 9dd4cc478ec3..de7edd49dcd9 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -2105,7 +2105,7 @@ static void *get_partial(struct kmem_cache *s, gfp_t flags, int node, searchnode = numa_mem_id(); object = get_partial_node(s, get_node(s, searchnode), c, flags); - if (object || node != NUMA_NO_NODE) + if (object || (node != NUMA_NO_NODE && (flags & __GFP_THISNODE))) return object; return get_any_partial(s, flags, c); @@ -2687,6 +2687,8 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, { void *freelist; struct page *page; + bool try_thisnode = true; + gfp_t thisnode_gfpflags; stat(s, ALLOC_SLOWPATH); @@ -2764,9 +2766,33 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, goto redo; } - freelist = new_slab_objects(s, gfpflags, node, &c); +new_objects: + + thisnode_gfpflags = gfpflags; + /* + * When a preferred node is indicated but no __GFP_THISNODE + * + * 1) try to get a partial slab from target node only by having + * __GFP_THISNODE in thisnode_gfpflags for new_slab_objects() + * 2) if 1) failed, try to allocate a new slab from target node with + * GPF_NOWAIT | __GFP_THISNODE opportunistically + * 3) if 2) failed, retry with original gfpflags which will allow + * new_slab_objects() try partial lists of other nodes before potentially + * allocating new page from other nodes + */ + if (unlikely(node != NUMA_NO_NODE && !(gfpflags & __GFP_THISNODE) + && try_thisnode)) + thisnode_gfpflags = GFP_NOWAIT | __GFP_THISNODE; + + freelist = new_slab_objects(s, thisnode_gfpflags, node, &c); if (unlikely(!freelist)) { + if (node != NUMA_NO_NODE && !(gfpflags & __GFP_THISNODE) + && try_thisnode) { + try_thisnode = false; + goto new_objects; + } + slab_out_of_memory(s, gfpflags, node); return NULL; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ceph: prevent use-after-free in encode_cap_msg()
by Long Li 18 Jan '25

18 Jan '25

From: Rishabh Dave <ridave(a)redhat.com> stable inclusion from stable-v5.15.148 commit 70e329b440762390258a6fe8c0de93c9fdd56c77 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GN CVE: CVE-2024-26689 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit cda4672da1c26835dcbd7aec2bfed954eda9b5ef upstream. In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This implies before the refcount could be increment here, it was freed. In same file, in "handle_cap_grant()" refcount is decremented by this line - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race occurred and resource was freed by the latter line before the former line could increment it. encode_cap_msg() is called by __send_cap() and __send_cap() is called by ceph_check_caps() after calling __prep_cap(). __prep_cap() is where arg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot where the refcount must be increased to prevent "use after free" error. Cc: stable(a)vger.kernel.org Link: https://tracker.ceph.com/issues/59259 Signed-off-by: Rishabh Dave <ridave(a)redhat.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Reviewed-by: Xiubo Li <xiubli(a)redhat.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/ceph/caps.c [__send_cap() has been refacaored] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ceph/caps.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 1cc433de4200..b631719941c2 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -1347,7 +1347,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap, if (flushing & CEPH_CAP_XATTR_EXCL) { old_blob = __ceph_build_xattrs_blob(ci); arg.xattr_version = ci->i_xattrs.version; - arg.xattr_buf = ci->i_xattrs.blob; + arg.xattr_buf = ceph_buffer_get(ci->i_xattrs.blob); } else { arg.xattr_buf = NULL; } @@ -1387,6 +1387,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap, dout("error sending cap msg, must requeue %p\n", inode); delayed = 1; } + ceph_buffer_put(arg.xattr_buf); if (wake) wake_up_all(&ci->i_cap_wq); -- 2.39.2

2 1

[PATCH OLK-5.10] [Backport] btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
by Yongjian Sun 18 Jan '25

18 Jan '25

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.12-rc3 commit f10bef73fb355e3fc85e63a50386798be68ff486 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIAEJ CVE: CVE-2024-57896 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- During the unmount path, at close_ctree(), we first stop the cleaner kthread, using kthread_stop() which frees the associated task_struct, and then stop and destroy all the work queues. However after we stopped the cleaner we may still have a worker from the delalloc_workers queue running inode.c:submit_compressed_extents(), which calls btrfs_add_delayed_iput(), which in turn tries to wake up the cleaner kthread - which was already destroyed before, resulting in a use-after-free on the task_struct. Syzbot reported this with the following stack traces: BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 Read of size 8 at addr ffff8880259d2818 by task kworker/u8:3/52 CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: btrfs-delalloc btrfs_work_helper Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline] try_to_wake_up+0xc2/0x1470 kernel/sched/core.c:4205 submit_compressed_extents+0xdf/0x16e0 fs/btrfs/inode.c:1615 run_ordered_work fs/btrfs/async-thread.c:288 [inline] btrfs_work_helper+0x96f/0xc40 fs/btrfs/async-thread.c:324 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 2: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4104 [inline] slab_alloc_node mm/slub.c:4153 [inline] kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4205 alloc_task_struct_node kernel/fork.c:180 [inline] dup_task_struct+0x57/0x8c0 kernel/fork.c:1113 copy_process+0x5d1/0x3d50 kernel/fork.c:2225 kernel_clone+0x223/0x870 kernel/fork.c:2807 kernel_thread+0x1bc/0x240 kernel/fork.c:2869 create_kthread kernel/kthread.c:412 [inline] kthreadd+0x60d/0x810 kernel/kthread.c:767 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 24: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338 [inline] slab_free mm/slub.c:4598 [inline] kmem_cache_free+0x195/0x410 mm/slub.c:4700 put_task_struct include/linux/sched/task.h:144 [inline] delayed_put_task_struct+0x125/0x300 kernel/exit.c:227 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:943 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544 __call_rcu_common kernel/rcu/tree.c:3086 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3190 context_switch kernel/sched/core.c:5372 [inline] __schedule+0x1803/0x4be0 kernel/sched/core.c:6756 __schedule_loop kernel/sched/core.c:6833 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6848 schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 kthread_stop+0x19e/0x640 kernel/kthread.c:712 close_ctree+0x524/0xd60 fs/btrfs/disk-io.c:4328 generic_shutdown_super+0x139/0x2d0 fs/super.c:642 kill_anon_super+0x3b/0x70 fs/super.c:1237 btrfs_kill_super+0x41/0x50 fs/btrfs/super.c:2112 deactivate_locked_super+0xc4/0x130 fs/super.c:473 cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373 task_work_run+0x24f/0x310 kernel/task_work.c:239 ptrace_notify+0x2d2/0x380 kernel/signal.c:2503 ptrace_report_syscall include/linux/ptrace.h:415 [inline] ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline] syscall_exit_work+0xc7/0x1d0 kernel/entry/common.c:173 syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline] syscall_exit_to_user_mode+0x24a/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff8880259d1e00 which belongs to the cache task_struct of size 7424 The buggy address is located 2584 bytes inside of freed 7424-byte region [ffff8880259d1e00, ffff8880259d3b00) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x259d0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff88802f4b56c1 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801bafe500 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000040004 00000001f5000000 ffff88802f4b56c1 head: 00fff00000000040 ffff88801bafe500 dead000000000100 dead000000000122 head: 0000000000000000 0000000000040004 00000001f5000000 ffff88802f4b56c1 head: 00fff00000000003 ffffea0000967401 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 12, tgid 12 (kworker/u8:1), ts 7328037942, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2408 allocate_slab+0x5a/0x2f0 mm/slub.c:2574 new_slab mm/slub.c:2627 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3815 __slab_alloc+0x58/0xa0 mm/slub.c:3905 __slab_alloc_node mm/slub.c:3980 [inline] slab_alloc_node mm/slub.c:4141 [inline] kmem_cache_alloc_node_noprof+0x269/0x380 mm/slub.c:4205 alloc_task_struct_node kernel/fork.c:180 [inline] dup_task_struct+0x57/0x8c0 kernel/fork.c:1113 copy_process+0x5d1/0x3d50 kernel/fork.c:2225 kernel_clone+0x223/0x870 kernel/fork.c:2807 user_mode_thread+0x132/0x1a0 kernel/fork.c:2885 call_usermodehelper_exec_work+0x5c/0x230 kernel/umh.c:171 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 page_owner free stack trace missing Memory state around the buggy address: ffff8880259d2700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880259d2780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880259d2800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880259d2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880259d2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fix this by flushing the delalloc workers queue before stopping the cleaner kthread. Reported-by: syzbot+b7cf50a0c173770dcb14(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/674ed7e8.050a0220.48a03.0031.GAE@google… Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/btrfs/disk-io.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c index 5e42f339fa83..b364fa3806ec 100644 --- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -4151,6 +4151,15 @@ void __cold close_ctree(struct btrfs_fs_info *fs_info) * already the cleaner, but below we run all pending delayed iputs. */ btrfs_flush_workqueue(fs_info->fixup_workers); + /* + * Similar case here, we have to wait for delalloc workers before we + * proceed below and stop the cleaner kthread, otherwise we trigger a + * use-after-tree on the cleaner kthread task_struct when a delalloc + * worker running submit_compressed_extents() adds a delayed iput, which + * does a wake up on the cleaner kthread, which was already freed below + * when we call kthread_stop(). + */ + btrfs_flush_workqueue(fs_info->delalloc_workers); /* * After we parked the cleaner kthread, ordered extents may have -- 2.39.2

2 1

[openeuler:OLK-6.6 1826/1826] drivers/irqchip/irq-gic-v3.c:1036:23: error: call to undeclared function 'pde_data'; ISO C99 and later do not support implicit function declarations
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a5cbe5b715d9cac271b2c6175e728f0c4167f675 commit: 3053668e6b211924bb67c19d791a5a532eca2ad8 [1826/1826] arm64: Introduce Xint software solution config: arm64-randconfig-r123-20250118 (https://download.01.org/0day-ci/archive/20250118/202501180931.eG4TBbkV-lkp@…) compiler: clang version 15.0.7 (https://github.com/llvm/llvm-project 8dfdcc7b7bf66834a761bd8de445840ef68e4d1a) reproduce: (https://download.01.org/0day-ci/archive/20250118/202501180931.eG4TBbkV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180931.eG4TBbkV-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/irqchip/irq-gic-v3.c:1036:23: error: call to undeclared function 'pde_data'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] int irq = (int)(long)pde_data(file_inode(file)); ^ drivers/irqchip/irq-gic-v3.c:1074:2: error: call to undeclared function 'seq_printf'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] seq_printf(m, "%d\n", xint_transform((long)m->private, XINT_SET_CHECK)); ^ drivers/irqchip/irq-gic-v3.c:1074:46: error: incomplete definition of type 'struct seq_file' seq_printf(m, "%d\n", xint_transform((long)m->private, XINT_SET_CHECK)); ~^ arch/arm64/include/asm/smp.h:56:8: note: forward declaration of 'struct seq_file' struct seq_file; ^ drivers/irqchip/irq-gic-v3.c:1080:9: error: call to undeclared function 'single_open'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] return single_open(file, xint_proc_show, pde_data(inode)); ^ drivers/irqchip/irq-gic-v3.c:1080:9: note: did you mean 'simple_open'? include/linux/fs.h:3226:12: note: 'simple_open' declared here extern int simple_open(struct inode *inode, struct file *file); ^ drivers/irqchip/irq-gic-v3.c:1080:43: error: call to undeclared function 'pde_data'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] return single_open(file, xint_proc_show, pde_data(inode)); ^ drivers/irqchip/irq-gic-v3.c:1085:15: error: use of undeclared identifier 'seq_read' .proc_read = seq_read, ^ drivers/irqchip/irq-gic-v3.c:1086:16: error: use of undeclared identifier 'seq_lseek' .proc_lseek = seq_lseek, ^ drivers/irqchip/irq-gic-v3.c:1087:18: error: use of undeclared identifier 'single_release' .proc_release = single_release, ^ drivers/irqchip/irq-gic-v3.c:1083:30: error: variable has incomplete type 'const struct proc_ops' static const struct proc_ops xint_proc_ops = { ^ drivers/irqchip/irq-gic-v3.c:1083:21: note: forward declaration of 'struct proc_ops' static const struct proc_ops xint_proc_ops = { ^ >> drivers/irqchip/irq-gic-v3.c:1097:2: error: call to undeclared function 'proc_create_data'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] proc_create_data("xint", 0644, desc->dir, &xint_proc_ops, irqp); ^ >> drivers/irqchip/irq-gic-v3.c:1105:2: error: call to undeclared function 'remove_proc_entry'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] remove_proc_entry("xint", desc->dir); ^ 11 errors generated. vim +/pde_data +1036 drivers/irqchip/irq-gic-v3.c 1032 1033 static ssize_t xint_proc_write(struct file *file, 1034 const char __user *buffer, size_t count, loff_t *pos) 1035 { > 1036 int irq = (int)(long)pde_data(file_inode(file)); 1037 bool xint_state = false; 1038 unsigned long val; 1039 char *buf = NULL; 1040 1041 if (!xint_transform(irq, XINT_RANGE_CHECK)) 1042 return -EPERM; 1043 1044 buf = memdup_user_nul(buffer, count); 1045 if (IS_ERR(buf)) 1046 return PTR_ERR(buf); 1047 1048 if (kstrtoul(buf, 0, &val) || (val != 0 && val != 1)) { 1049 kfree(buf); 1050 return -EINVAL; 1051 } 1052 1053 xint_state = xint_transform(irq, XINT_SET_CHECK); 1054 if (xint_state == val) { 1055 kfree(buf); 1056 return -EBUSY; 1057 } 1058 1059 local_irq_disable(); 1060 disable_irq(irq); 1061 1062 xint_transform(irq, xint_state ? XINT_TO_IRQ : IRQ_TO_XINT); 1063 1064 enable_irq(irq); 1065 local_irq_enable(); 1066 1067 kfree(buf); 1068 1069 return count; 1070 } 1071 1072 static int xint_proc_show(struct seq_file *m, void *v) 1073 { 1074 seq_printf(m, "%d\n", xint_transform((long)m->private, XINT_SET_CHECK)); 1075 return 0; 1076 } 1077 1078 static int xint_proc_open(struct inode *inode, struct file *file) 1079 { 1080 return single_open(file, xint_proc_show, pde_data(inode)); 1081 } 1082 > 1083 static const struct proc_ops xint_proc_ops = { 1084 .proc_open = xint_proc_open, 1085 .proc_read = seq_read, 1086 .proc_lseek = seq_lseek, > 1087 .proc_release = single_release, 1088 .proc_write = xint_proc_write, 1089 }; 1090 1091 void register_irqchip_proc(struct irq_desc *desc, void *irqp) 1092 { 1093 if (!is_xint_support) 1094 return; 1095 1096 /* create /proc/irq/<irq>/xint */ > 1097 proc_create_data("xint", 0644, desc->dir, &xint_proc_ops, irqp); 1098 } 1099 1100 void unregister_irqchip_proc(struct irq_desc *desc) 1101 { 1102 if (!is_xint_support) 1103 return; 1104 > 1105 remove_proc_entry("xint", desc->dir); 1106 } 1107 #endif /* CONFIG_FAST_IRQ */ 1108 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1826/1826] mm/page_alloc.c:4110:9: error: call to undeclared function 'dynamic_pool_should_alloc'; ISO C99 and later do not support implicit function declarations
by kernel test robot 18 Jan '25

18 Jan '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a5cbe5b715d9cac271b2c6175e728f0c4167f675 commit: fd855715f24e3eeadaa56de5fde21c55a14aeea0 [1826/1826] mm/mem_reliable: Fallback to dpool if reliable memory is not enough config: arm64-randconfig-r123-20250118 (https://download.01.org/0day-ci/archive/20250118/202501180715.zDIl6KOU-lkp@…) compiler: clang version 15.0.7 (https://github.com/llvm/llvm-project 8dfdcc7b7bf66834a761bd8de445840ef68e4d1a) reproduce: (https://download.01.org/0day-ci/archive/20250118/202501180715.zDIl6KOU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180715.zDIl6KOU-lkp@intel.com/ All errors (new ones prefixed by >>): >> mm/page_alloc.c:4110:9: error: call to undeclared function 'dynamic_pool_should_alloc'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); ^ 1 error generated. vim +/dynamic_pool_should_alloc +4110 mm/page_alloc.c 4101 4102 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4103 { 4104 if (!reliable_allow_fb_enabled()) 4105 return false; 4106 4107 if (!(gfp_mask & GFP_RELIABLE)) 4108 return false; 4109 > 4110 return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); 4111 } 4112 #else 4113 static inline struct zone *mem_reliable_fallback_zone(gfp_t gfp_mask, 4114 struct alloc_context *ac) 4115 { 4116 return NULL; 4117 } 4118 static inline void mem_reliable_fallback_slowpath(gfp_t gfp_mask, 4119 struct alloc_context *ac) {} 4120 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4121 { 4122 return false; 4123 } 4124 #endif 4125 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1407/1407] include/linux/kernel.h:851:43: warning: comparison of distinct pointer types lacks a cast
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 7ad207616673722d5cf52c18d9464e0d3184ffc9 [1407/1407] arp: Prevent overflow in arp_req_get(). config: x86_64-defconfig (https://download.01.org/0day-ci/archive/20250118/202501180701.f6sYgGum-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250118/202501180701.f6sYgGum-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180701.f6sYgGum-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/list.h:9, from include/linux/module.h:10, from net/ipv4/arp.c:78: net/ipv4/arp.c: In function 'arp_req_get': >> include/linux/kernel.h:851:43: warning: comparison of distinct pointer types lacks a cast 851 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ^~ include/linux/kernel.h:865:18: note: in expansion of macro '__typecheck' 865 | (__typecheck(x, y) && __no_side_effects(x, y)) | ^~~~~~~~~~~ include/linux/kernel.h:875:31: note: in expansion of macro '__safe_cmp' 875 | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~ include/linux/kernel.h:884:25: note: in expansion of macro '__careful_cmp' 884 | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~ net/ipv4/arp.c:1106:33: note: in expansion of macro 'min' 1106 | min(dev->addr_len, sizeof(r->arp_ha.sa_data))); | ^~~ net/ipv4/arp.o: warning: objtool: missing symbol for section .init.text vim +851 include/linux/kernel.h 526211bc58c4b3 Ingo Molnar 2009-03-05 837 ^1da177e4c3f41 Linus Torvalds 2005-04-16 838 /* 3c8ba0d61d04ce Kees Cook 2018-03-30 839 * min()/max()/clamp() macros must accomplish three things: 3c8ba0d61d04ce Kees Cook 2018-03-30 840 * 3c8ba0d61d04ce Kees Cook 2018-03-30 841 * - avoid multiple evaluations of the arguments (so side-effects like 3c8ba0d61d04ce Kees Cook 2018-03-30 842 * "x++" happen only once) when non-constant. 3c8ba0d61d04ce Kees Cook 2018-03-30 843 * - perform strict type-checking (to generate warnings instead of 3c8ba0d61d04ce Kees Cook 2018-03-30 844 * nasty runtime surprises). See the "unnecessary" pointer comparison 3c8ba0d61d04ce Kees Cook 2018-03-30 845 * in __typecheck(). 3c8ba0d61d04ce Kees Cook 2018-03-30 846 * - retain result as a constant expressions when called with only 3c8ba0d61d04ce Kees Cook 2018-03-30 847 * constant expressions (to avoid tripping VLA warnings in stack 3c8ba0d61d04ce Kees Cook 2018-03-30 848 * allocation usage). 3c8ba0d61d04ce Kees Cook 2018-03-30 849 */ 3c8ba0d61d04ce Kees Cook 2018-03-30 850 #define __typecheck(x, y) \ 3c8ba0d61d04ce Kees Cook 2018-03-30 @851 (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) 3c8ba0d61d04ce Kees Cook 2018-03-30 852 :::::: The code at line 851 was first introduced by commit :::::: 3c8ba0d61d04ced9f8d9ff93977995a9e4e96e91 kernel.h: Retain constant expression output for max()/min() :::::: TO: Kees Cook <keescook(a)chromium.org> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1826/1826] mm/mem_reliable.c:131:52: sparse: sparse: incorrect type in argument 3 (different address spaces)
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a5cbe5b715d9cac271b2c6175e728f0c4167f675 commit: 200321e8a69ef82350d070de35ac4a666ab79ba6 [1826/1826] mm: mem_reliable: Add limiting the usage of reliable memory config: arm64-randconfig-r123-20250118 (https://download.01.org/0day-ci/archive/20250118/202501180645.GOqTUifa-lkp@…) compiler: clang version 15.0.7 (https://github.com/llvm/llvm-project 8dfdcc7b7bf66834a761bd8de445840ef68e4d1a) reproduce: (https://download.01.org/0day-ci/archive/20250118/202501180645.GOqTUifa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180645.GOqTUifa-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/mem_reliable.c:131:52: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/mem_reliable.c:131:52: sparse: expected void * mm/mem_reliable.c:131:52: sparse: got void [noderef] __user *buffer mm/mem_reliable.c:150:52: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/mem_reliable.c:150:52: sparse: expected void * mm/mem_reliable.c:150:52: sparse: got void [noderef] __user *buffer mm/mem_reliable.c:172:52: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/mem_reliable.c:172:52: sparse: expected void * mm/mem_reliable.c:172:52: sparse: got void [noderef] __user *buffer >> mm/mem_reliable.c:190:33: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/mem_reliable.c:190:33: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/mem_reliable.c:190:33: sparse: got int ( * )( ... ) mm/mem_reliable.c:197:33: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/mem_reliable.c:197:33: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/mem_reliable.c:197:33: sparse: got int ( * )( ... ) mm/mem_reliable.c:205:33: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/mem_reliable.c:205:33: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/mem_reliable.c:205:33: sparse: got int ( * )( ... ) vim +131 mm/mem_reliable.c 123 124 static int reliable_pagecache_max_bytes_write(struct ctl_table *table, 125 int write, void __user *buffer, 126 size_t *length, loff_t *ppos) 127 { 128 unsigned long old_value = pagecache_reliable_limit; 129 int ret; 130 > 131 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 132 if (!ret && write) { 133 if (pagecache_reliable_limit > 134 PAGES_TO_B(total_reliable_pages())) { 135 pagecache_reliable_limit = old_value; 136 return -EINVAL; 137 } 138 } 139 140 return ret; 141 } 142 143 static int reliable_limit_handler(struct ctl_table *table, int write, 144 void __user *buffer, size_t *length, 145 loff_t *ppos) 146 { 147 unsigned long old = task_reliable_limit; 148 int ret; 149 150 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 151 if (!ret && write) { 152 if (task_reliable_limit > PAGES_TO_B(total_reliable_pages()) || 153 task_reliable_limit < 154 (task_reliable_used_pages() << PAGE_SHIFT)) { 155 task_reliable_limit = old; 156 return -EINVAL; 157 } 158 } 159 160 return ret; 161 } 162 163 #ifdef CONFIG_SHMEM 164 static int reliable_shmem_bytes_limit_handler(struct ctl_table *table, 165 int write, void __user *buffer, 166 size_t *length, loff_t *ppos) 167 { 168 unsigned long *data_ptr = (unsigned long *)(table->data); 169 unsigned long old = *data_ptr; 170 int ret; 171 172 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 173 if (!ret && write) { 174 if (*data_ptr > PAGES_TO_B(total_reliable_pages())) { 175 *data_ptr = old; 176 return -EINVAL; 177 } 178 } 179 180 return ret; 181 } 182 #endif 183 184 static struct ctl_table reliable_ctl_table[] = { 185 { 186 .procname = "reliable_pagecache_max_bytes", 187 .data = &pagecache_reliable_limit, 188 .maxlen = sizeof(pagecache_reliable_limit), 189 .mode = 0644, > 190 .proc_handler = reliable_pagecache_max_bytes_write, 191 }, 192 { 193 .procname = "task_reliable_limit", 194 .data = &task_reliable_limit, 195 .maxlen = sizeof(task_reliable_limit), 196 .mode = 0644, 197 .proc_handler = reliable_limit_handler, 198 }, 199 #ifdef CONFIG_SHMEM 200 { 201 .procname = "shmem_reliable_bytes_limit", 202 .data = &shmem_reliable_limit, 203 .maxlen = sizeof(shmem_reliable_limit), 204 .mode = 0644, 205 .proc_handler = reliable_shmem_bytes_limit_handler, 206 }, 207 #endif 208 {} 209 }; 210 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1826/1826] kernel/sched/fair.c:146:12: warning: 'hundred_thousand' defined but not used
by kernel test robot 18 Jan '25

18 Jan '25

Hi Zhang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a5cbe5b715d9cac271b2c6175e728f0c4167f675 commit: a3c9f2da0a35df4e41751556be4308f57bdaf3d6 [1826/1826] sched: Introduce handle priority reversion mechanism config: loongarch-randconfig-r063-20250118 (https://download.01.org/0day-ci/archive/20250118/202501180452.dWoRzgYk-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250118/202501180452.dWoRzgYk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180452.dWoRzgYk-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/sched/fair.c:146:12: warning: 'hundred_thousand' defined but not used [-Wunused-variable] 146 | static int hundred_thousand = 100000; | ^~~~~~~~~~~~~~~~ >> kernel/sched/fair.c:145:12: warning: 'one_thousand' defined but not used [-Wunused-variable] 145 | static int one_thousand = 1000; | ^~~~~~~~~~~~ vim +/hundred_thousand +146 kernel/sched/fair.c 139 140 static DEFINE_PER_CPU_SHARED_ALIGNED(struct list_head, qos_throttled_cfs_rq); 141 static DEFINE_PER_CPU_SHARED_ALIGNED(struct hrtimer, qos_overload_timer); 142 static DEFINE_PER_CPU(int, qos_cpu_overload); 143 unsigned int sysctl_overload_detect_period = 5000; /* in ms */ 144 unsigned int sysctl_offline_wait_interval = 100; /* in ms */ > 145 static int one_thousand = 1000; > 146 static int hundred_thousand = 100000; 147 static int unthrottle_qos_cfs_rqs(int cpu); 148 #endif 149 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1826/1826] arch/arm64/kernel/ipi_nmi.c:39:2: error: call to undeclared function '__printk_safe_enter'; ISO C99 and later do not support implicit function declarations
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a5cbe5b715d9cac271b2c6175e728f0c4167f675 commit: 5e3e94b1477ca3f6cb47ae8137a4a99fe0ef6147 [1826/1826] arm64: Add non nmi ipi backtrace support config: arm64-randconfig-r123-20250118 (https://download.01.org/0day-ci/archive/20250118/202501180414.2c8NAnVD-lkp@…) compiler: clang version 15.0.7 (https://github.com/llvm/llvm-project 8dfdcc7b7bf66834a761bd8de445840ef68e4d1a) reproduce: (https://download.01.org/0day-ci/archive/20250118/202501180414.2c8NAnVD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180414.2c8NAnVD-lkp@intel.com/ All errors (new ones prefixed by >>): >> arch/arm64/kernel/ipi_nmi.c:39:2: error: call to undeclared function '__printk_safe_enter'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] __printk_safe_enter(); ^ >> arch/arm64/kernel/ipi_nmi.c:41:2: error: call to undeclared function '__printk_safe_exit'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] __printk_safe_exit(); ^ 2 errors generated. vim +/__printk_safe_enter +39 arch/arm64/kernel/ipi_nmi.c 35 36 #ifdef CONFIG_NON_NMI_IPI_BACKTRACE 37 static void ipi_cpu_backtrace(void *info) 38 { > 39 __printk_safe_enter(); 40 nmi_cpu_backtrace(get_irq_regs()); > 41 __printk_safe_exit(); 42 } 43 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION a5cbe5b715d9cac271b2c6175e728f0c4167f675
by kernel test robot 18 Jan '25

18 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: a5cbe5b715d9cac271b2c6175e728f0c4167f675 !14873 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.62-6.6.63 LTS Patches Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- arm64-randconfig-r061-20250118 | `-- kernel-cgroup-cgroup.c:error:use-of-undeclared-identifier-cgroup_psi_stat_show |-- loongarch-allmodconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allyesconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-001-20250117 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-002-20250117 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-r063-20250118 | |-- arch-loongarch-kernel-smp.c:WARNING:Unsigned-expression-compared-with-zero:cpu | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- x86_64-allnoconfig | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put `-- x86_64-randconfig-r062-20250118 |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-get_nt_block_copy_mini_len |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-set_c86_features_para_invalid `-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-get_fpustate_free_space elapsed time: 918m configs tested: 19 configs skipped: 121 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250117 gcc-14.2.0 arm64 randconfig-002-20250117 clang-18 arm64 randconfig-003-20250117 clang-20 arm64 randconfig-004-20250117 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250117 gcc-14.2.0 loongarch randconfig-002-20250117 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250117 gcc-12 x86_64 buildonly-randconfig-002-20250117 gcc-12 x86_64 buildonly-randconfig-003-20250117 gcc-12 x86_64 buildonly-randconfig-004-20250117 gcc-12 x86_64 buildonly-randconfig-005-20250117 gcc-12 x86_64 buildonly-randconfig-006-20250117 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2709/2709] include/linux/blk_types.h: linux/kabi.h is included more than once.
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 08e54ea5e4a4948874ca30d91be3e5cca4ecbeec commit: dde4fe567523327d09054824030fb2d22e5009c7 [2709/2709] kabi: Add kabi reservation for storage module compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180245.jJrp2ix8-lkp@intel.com/ includecheck warnings: (new ones prefixed by >>) >> include/linux/blk_types.h: linux/kabi.h is included more than once. -- >> include/linux/cred.h: linux/kabi.h is included more than once. -- >> include/linux/mm.h: linux/kabi.h is included more than once. -- >> include/linux/device/class.h: linux/kabi.h is included more than once. -- >> include/linux/ioport.h: linux/kabi.h is included more than once. -- >> include/linux/swap.h: linux/kabi.h is included more than once. -- >> include/linux/device.h: linux/kabi.h is included more than once. vim +9 include/linux/blk_types.h 8 > 9 #include <linux/kabi.h> 10 #include <linux/types.h> 11 #include <linux/bvec.h> 12 #include <linux/ktime.h> > 13 #include <linux/kabi.h> 14 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8
by kernel test robot 18 Jan '25

18 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 !9360 Add support for Hygon model 10h processors Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501171519.TpEUKk9L-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202501172158.pLxZDrP8-lkp@intel.com drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:844:41: warning: writing 8 bytes into a region of size 0 [-Wstringop-overflow=] drivers/staging/rtl8723bs/os_dep/ioctl_linux.c:3787:41: warning: writing 8 bytes into a region of size 0 [-Wstringop-overflow=] include/linux/list.h:583:14: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] include/linux/plist.h:137:9: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] include/linux/uaccess.h:115:17: warning: 'bytes' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'data_arg' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'rep' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'rq' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'rsv' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'version' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'zrange' may be used uninitialized [-Wmaybe-uninitialized] Unverified Error/Warning (likely false positive, kindly check if interested): crypto/sm4_generic.o: warning: objtool: missing symbol for section .text drivers/staging/media/zoran/videocodec.o: warning: objtool: missing symbol for section .text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- arm64-allnoconfig | `-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used |-- arm64-randconfig-001-20250117 | |-- drivers-staging-rtl8723bs-os_dep-ioctl_cfg80211.c:warning:writing-bytes-into-a-region-of-size | `-- drivers-staging-rtl8723bs-os_dep-ioctl_linux.c:warning:writing-bytes-into-a-region-of-size |-- arm64-randconfig-002-20250117 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- arm64-randconfig-003-20250117 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- arm64-randconfig-004-20250117 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- include-linux-list.h:warning:array-subscript-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-plist.h:warning:array-subscript-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-uaccess.h:warning:acc-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:bytes-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data_arg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rep-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rq-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rsv-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:version-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:zrange-may-be-used-uninitialized |-- x86_64-allmodconfig | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | `-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests |-- x86_64-allyesconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions |-- x86_64-buildonly-randconfig-001-20250117 | |-- arch-x86-kernel-hpet.o:warning:objtool:missing-symbol-for-section-.text.unlikely | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- x86_64-buildonly-randconfig-002-20250117 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- x86_64-buildonly-randconfig-003-20250117 | |-- crypto-sm4_generic.o:warning:objtool:missing-symbol-for-section-.text | `-- net-ipv4-bpfilter-sockopt.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-004-20250117 | |-- drivers-pci-pcie-dpc.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-staging-media-zoran-videocodec.o:warning:objtool:missing-symbol-for-section-.text | |-- sound-drivers-vx-vx_core.o:warning:objtool:missing-symbol-for-section-.text | `-- sound-isa-wavefront-wavefront_fx.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-005-20250117 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- x86_64-buildonly-randconfig-006-20250117 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions `-- x86_64-defconfig |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions elapsed time: 875m configs tested: 15 configs skipped: 115 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250117 gcc-14.2.0 arm64 randconfig-002-20250117 gcc-14.2.0 arm64 randconfig-003-20250117 gcc-14.2.0 arm64 randconfig-004-20250117 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250117 gcc-12 x86_64 buildonly-randconfig-002-20250117 gcc-12 x86_64 buildonly-randconfig-003-20250117 gcc-12 x86_64 buildonly-randconfig-004-20250117 gcc-12 x86_64 buildonly-randconfig-005-20250117 gcc-12 x86_64 buildonly-randconfig-006-20250117 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2709/2709] kernel/rcu/tree.o: warning: objtool: __call_rcu_nocb_wake()+0x75f: unreachable instruction
by kernel test robot 17 Jan '25

17 Jan '25

Hi Steven, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 08e54ea5e4a4948874ca30d91be3e5cca4ecbeec commit: f2c902d8c653f8021f9761092a27f7b9db42b662 [2709/2709] tracing: Make tracepoint lockdep check actually test something config: x86_64-randconfig-161-20250117 (https://download.01.org/0day-ci/archive/20250117/202501172116.SQgEKk8j-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250117/202501172116.SQgEKk8j-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501172116.SQgEKk8j-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/rcu/tree.o: warning: objtool: __call_rcu_nocb_wake()+0x75f: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1407/1407] include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used
by kernel test robot 17 Jan '25

17 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 1811840c2cdebd0820818392a8217ffbd1be5c67 [1407/1407] mm/sharepool: Fix sharepool node id invalid when using sp_alloc config: arm64-allnoconfig (https://download.01.org/0day-ci/archive/20250117/202501172158.pLxZDrP8-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250117/202501172158.pLxZDrP8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501172158.pLxZDrP8-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/fork.c:741:20: warning: no previous prototype for 'arch_task_cache_init' [-Wmissing-prototypes] 741 | void __init __weak arch_task_cache_init(void) { } | ^~~~~~~~~~~~~~~~~~~~ kernel/fork.c:826:12: warning: no previous prototype for 'arch_dup_task_struct' [-Wmissing-prototypes] 826 | int __weak arch_dup_task_struct(struct task_struct *dst, | ^~~~~~~~~~~~~~~~~~~~ kernel/fork.c: In function 'dup_task_struct': kernel/fork.c:845:27: warning: variable 'stack_vm_area' set but not used [-Wunused-but-set-variable] 845 | struct vm_struct *stack_vm_area; | ^~~~~~~~~~~~~ In file included from include/linux/sched/signal.h:7, from include/linux/sched/cputime.h:5, from kernel/fork.c:23: include/linux/signal.h: In function 'sigemptyset': include/linux/signal.h:180:29: warning: this statement may fall through [-Wimplicit-fallthrough=] 180 | case 2: set->sig[1] = 0; | ~~~~~~~~~~~~^~~ include/linux/signal.h:181:9: note: here 181 | case 1: set->sig[0] = 0; | ^~~~ In file included from kernel/fork.c:31: include/linux/mempolicy.h: At top level: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ In file included from arch/arm64/include/asm/atomic.h:36, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from include/asm-generic/bug.h:18, from arch/arm64/include/asm/bug.h:37, from include/linux/bug.h:5, from include/linux/mmdebug.h:5, from include/linux/gfp.h:5, from include/linux/slab.h:15, from kernel/fork.c:14: In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from '__mmput' at kernel/fork.c:1074:3, inlined from 'mmput_async_fn' at kernel/fork.c:1104:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ In file included from include/linux/spinlock.h:82, from include/linux/mmzone.h:9, from include/linux/gfp.h:6: kernel/fork.c: In function 'mmput_async_fn': kernel/fork.c:939:44: note: object 'mmlist_lock' of size 4 939 | __cacheline_aligned_in_smp DEFINE_SPINLOCK(mmlist_lock); | ^~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from '__mmput' at kernel/fork.c:1074:3, inlined from 'mmput_async_fn' at kernel/fork.c:1104:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/fork.c: In function 'mmput_async_fn': kernel/fork.c:939:44: note: object 'mmlist_lock' of size 4 939 | __cacheline_aligned_in_smp DEFINE_SPINLOCK(mmlist_lock); | ^~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from '__mmput' at kernel/fork.c:1074:3, inlined from 'mmput' at kernel/fork.c:1094:3, inlined from 'mmput' at kernel/fork.c:1086:6: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/fork.c: In function 'mmput': kernel/fork.c:939:44: note: object 'mmlist_lock' of size 4 939 | __cacheline_aligned_in_smp DEFINE_SPINLOCK(mmlist_lock); | ^~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from '__mmput' at kernel/fork.c:1074:3, inlined from 'mmput' at kernel/fork.c:1094:3, inlined from 'mmput' at kernel/fork.c:1086:6: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/fork.c: In function 'mmput': kernel/fork.c:939:44: note: object 'mmlist_lock' of size 4 939 | __cacheline_aligned_in_smp DEFINE_SPINLOCK(mmlist_lock); -- kernel/exit.c:1677:13: warning: no previous prototype for 'abort' [-Wmissing-prototypes] 1677 | __weak void abort(void) | ^~~~~ In file included from kernel/exit.c:37: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ -- In file included from include/linux/shmem_fs.h:7, from kernel/umh.c:29: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ In file included from arch/arm64/include/asm/atomic.h:36, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from include/linux/list.h:9, from include/linux/module.h:10, from kernel/umh.c:4: In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'proc_cap_handler' at kernel/umh.c:668:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ In file included from include/linux/spinlock.h:82, from include/linux/seqlock.h:36, from include/linux/time.h:6, from include/linux/stat.h:19, from include/linux/module.h:11: kernel/umh.c: In function 'proc_cap_handler': kernel/umh.c:41:24: note: object 'umh_sysctl_lock' of size 4 41 | static DEFINE_SPINLOCK(umh_sysctl_lock); | ^~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'proc_cap_handler' at kernel/umh.c:668:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/umh.c: In function 'proc_cap_handler': kernel/umh.c:41:24: note: object 'umh_sysctl_lock' of size 4 41 | static DEFINE_SPINLOCK(umh_sysctl_lock); | ^~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'proc_cap_handler' at kernel/umh.c:701:3: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/umh.c: In function 'proc_cap_handler': kernel/umh.c:41:24: note: object 'umh_sysctl_lock' of size 4 41 | static DEFINE_SPINLOCK(umh_sysctl_lock); | ^~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'proc_cap_handler' at kernel/umh.c:701:3: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/umh.c: In function 'proc_cap_handler': kernel/umh.c:41:24: note: object 'umh_sysctl_lock' of size 4 41 | static DEFINE_SPINLOCK(umh_sysctl_lock); | ^~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, -- In file included from kernel/workqueue.c:39: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ In file included from arch/arm64/include/asm/atomic.h:36, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from kernel/workqueue.c:28: In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'pool_mayday_timeout' at kernel/workqueue.c:2003:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ In file included from include/linux/spinlock.h:82, from include/linux/ipc.h:5, from include/uapi/linux/sem.h:5, from include/linux/sem.h:5, from include/linux/sched.h:15, from kernel/workqueue.c:29: kernel/workqueue.c: In function 'pool_mayday_timeout': kernel/workqueue.c:302:24: note: object 'wq_mayday_lock' of size 4 302 | static DEFINE_SPINLOCK(wq_mayday_lock); /* protects wq->maydays list */ | ^~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'pool_mayday_timeout' at kernel/workqueue.c:2003:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/workqueue.c: In function 'pool_mayday_timeout': kernel/workqueue.c:302:24: note: object 'wq_mayday_lock' of size 4 302 | static DEFINE_SPINLOCK(wq_mayday_lock); /* protects wq->maydays list */ | ^~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ kernel/workqueue.c: In function 'create_worker': kernel/workqueue.c:1887:54: warning: '%d' directive output may be truncated writing between 1 and 10 bytes into a region of size between 5 and 14 [-Wformat-truncation=] 1887 | snprintf(id_buf, sizeof(id_buf), "%d:%d%s", pool->cpu, id, | ^~ kernel/workqueue.c:1887:50: note: directive argument in the range [0, 2147483647] 1887 | snprintf(id_buf, sizeof(id_buf), "%d:%d%s", pool->cpu, id, | ^~~~~~~~~ kernel/workqueue.c:1887:17: note: 'snprintf' output between 4 and 23 bytes into a destination of size 16 1887 | snprintf(id_buf, sizeof(id_buf), "%d:%d%s", pool->cpu, id, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1888 | pool->attrs->nice < 0 ? "H" : ""); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock_irq' at include/linux/spinlock_api_smp.h:129:2, inlined from 'spin_lock_irq' at include/linux/spinlock.h:354:2, inlined from 'rescuer_thread' at kernel/workqueue.c:2461:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/workqueue.c: In function 'rescuer_thread': kernel/workqueue.c:302:24: note: object 'wq_mayday_lock' of size 4 302 | static DEFINE_SPINLOCK(wq_mayday_lock); /* protects wq->maydays list */ | ^~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock_irq' at include/linux/spinlock_api_smp.h:129:2, inlined from 'spin_lock_irq' at include/linux/spinlock.h:354:2, inlined from 'rescuer_thread' at kernel/workqueue.c:2461:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ .. vim +/__do_mbind +329 include/linux/mempolicy.h 328 > 329 static long __do_mbind(unsigned long start, unsigned long len, -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] [Backport] btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
by Yongjian Sun 17 Jan '25

17 Jan '25

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.12-rc3 commit f10bef73fb355e3fc85e63a50386798be68ff486 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIAEJ CVE: CVE-2024-57896 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- During the unmount path, at close_ctree(), we first stop the cleaner kthread, using kthread_stop() which frees the associated task_struct, and then stop and destroy all the work queues. However after we stopped the cleaner we may still have a worker from the delalloc_workers queue running inode.c:submit_compressed_extents(), which calls btrfs_add_delayed_iput(), which in turn tries to wake up the cleaner kthread - which was already destroyed before, resulting in a use-after-free on the task_struct. Syzbot reported this with the following stack traces: BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 Read of size 8 at addr ffff8880259d2818 by task kworker/u8:3/52 CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: btrfs-delalloc btrfs_work_helper Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline] try_to_wake_up+0xc2/0x1470 kernel/sched/core.c:4205 submit_compressed_extents+0xdf/0x16e0 fs/btrfs/inode.c:1615 run_ordered_work fs/btrfs/async-thread.c:288 [inline] btrfs_work_helper+0x96f/0xc40 fs/btrfs/async-thread.c:324 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 2: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4104 [inline] slab_alloc_node mm/slub.c:4153 [inline] kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4205 alloc_task_struct_node kernel/fork.c:180 [inline] dup_task_struct+0x57/0x8c0 kernel/fork.c:1113 copy_process+0x5d1/0x3d50 kernel/fork.c:2225 kernel_clone+0x223/0x870 kernel/fork.c:2807 kernel_thread+0x1bc/0x240 kernel/fork.c:2869 create_kthread kernel/kthread.c:412 [inline] kthreadd+0x60d/0x810 kernel/kthread.c:767 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 24: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338 [inline] slab_free mm/slub.c:4598 [inline] kmem_cache_free+0x195/0x410 mm/slub.c:4700 put_task_struct include/linux/sched/task.h:144 [inline] delayed_put_task_struct+0x125/0x300 kernel/exit.c:227 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:943 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544 __call_rcu_common kernel/rcu/tree.c:3086 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3190 context_switch kernel/sched/core.c:5372 [inline] __schedule+0x1803/0x4be0 kernel/sched/core.c:6756 __schedule_loop kernel/sched/core.c:6833 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6848 schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 kthread_stop+0x19e/0x640 kernel/kthread.c:712 close_ctree+0x524/0xd60 fs/btrfs/disk-io.c:4328 generic_shutdown_super+0x139/0x2d0 fs/super.c:642 kill_anon_super+0x3b/0x70 fs/super.c:1237 btrfs_kill_super+0x41/0x50 fs/btrfs/super.c:2112 deactivate_locked_super+0xc4/0x130 fs/super.c:473 cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373 task_work_run+0x24f/0x310 kernel/task_work.c:239 ptrace_notify+0x2d2/0x380 kernel/signal.c:2503 ptrace_report_syscall include/linux/ptrace.h:415 [inline] ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline] syscall_exit_work+0xc7/0x1d0 kernel/entry/common.c:173 syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline] syscall_exit_to_user_mode+0x24a/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff8880259d1e00 which belongs to the cache task_struct of size 7424 The buggy address is located 2584 bytes inside of freed 7424-byte region [ffff8880259d1e00, ffff8880259d3b00) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x259d0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff88802f4b56c1 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801bafe500 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000040004 00000001f5000000 ffff88802f4b56c1 head: 00fff00000000040 ffff88801bafe500 dead000000000100 dead000000000122 head: 0000000000000000 0000000000040004 00000001f5000000 ffff88802f4b56c1 head: 00fff00000000003 ffffea0000967401 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 12, tgid 12 (kworker/u8:1), ts 7328037942, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2408 allocate_slab+0x5a/0x2f0 mm/slub.c:2574 new_slab mm/slub.c:2627 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3815 __slab_alloc+0x58/0xa0 mm/slub.c:3905 __slab_alloc_node mm/slub.c:3980 [inline] slab_alloc_node mm/slub.c:4141 [inline] kmem_cache_alloc_node_noprof+0x269/0x380 mm/slub.c:4205 alloc_task_struct_node kernel/fork.c:180 [inline] dup_task_struct+0x57/0x8c0 kernel/fork.c:1113 copy_process+0x5d1/0x3d50 kernel/fork.c:2225 kernel_clone+0x223/0x870 kernel/fork.c:2807 user_mode_thread+0x132/0x1a0 kernel/fork.c:2885 call_usermodehelper_exec_work+0x5c/0x230 kernel/umh.c:171 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 page_owner free stack trace missing Memory state around the buggy address: ffff8880259d2700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880259d2780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880259d2800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880259d2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880259d2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fix this by flushing the delalloc workers queue before stopping the cleaner kthread. Reported-by: syzbot+b7cf50a0c173770dcb14(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/674ed7e8.050a0220.48a03.0031.GAE@google… Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/btrfs/disk-io.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c index 8ec411eb9c9b..967c6b5dd0a4 100644 --- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -4323,6 +4323,15 @@ void __cold close_ctree(struct btrfs_fs_info *fs_info) * already the cleaner, but below we run all pending delayed iputs. */ btrfs_flush_workqueue(fs_info->fixup_workers); + /* + * Similar case here, we have to wait for delalloc workers before we + * proceed below and stop the cleaner kthread, otherwise we trigger a + * use-after-tree on the cleaner kthread task_struct when a delalloc + * worker running submit_compressed_extents() adds a delayed iput, which + * does a wake up on the cleaner kthread, which was already freed below + * when we call kthread_stop(). + */ + btrfs_flush_workqueue(fs_info->delalloc_workers); /* * After we parked the cleaner kthread, ordered extents may have -- 2.39.2

2 1

[openeuler:OLK-5.10 2707/2707] include/linux/lsm_hook_defs.h:162:18: warning: 'file_ioctl_compat_default' defined but not used
by kernel test robot 17 Jan '25

17 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 08e54ea5e4a4948874ca30d91be3e5cca4ecbeec commit: 294c837d37ed484f656397130bb059ee741a4ca4 [2707/2707] lsm: new security_file_ioctl_compat() hook config: x86_64-defconfig (https://download.01.org/0day-ci/archive/20250117/202501172051.HxlkrA5w-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250117/202501172051.HxlkrA5w-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501172051.HxlkrA5w-lkp@intel.com/ All warnings (new ones prefixed by >>): | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:177:1: note: in expansion of macro 'LSM_HOOK' 177 | LSM_HOOK(int, 0, task_alloc, struct task_struct *task, | ^~~~~~~~ include/linux/lsm_hook_defs.h:176:18: warning: 'file_open_default' defined but not used [-Wunused-const-variable=] 176 | LSM_HOOK(int, 0, file_open, struct file *file) | ^~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:176:1: note: in expansion of macro 'LSM_HOOK' 176 | LSM_HOOK(int, 0, file_open, struct file *file) | ^~~~~~~~ include/linux/lsm_hook_defs.h:175:18: warning: 'file_receive_default' defined but not used [-Wunused-const-variable=] 175 | LSM_HOOK(int, 0, file_receive, struct file *file) | ^~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:175:1: note: in expansion of macro 'LSM_HOOK' 175 | LSM_HOOK(int, 0, file_receive, struct file *file) | ^~~~~~~~ include/linux/lsm_hook_defs.h:173:18: warning: 'file_send_sigiotask_default' defined but not used [-Wunused-const-variable=] 173 | LSM_HOOK(int, 0, file_send_sigiotask, struct task_struct *tsk, | ^~~~~~~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:173:1: note: in expansion of macro 'LSM_HOOK' 173 | LSM_HOOK(int, 0, file_send_sigiotask, struct task_struct *tsk, | ^~~~~~~~ include/linux/lsm_hook_defs.h:170:18: warning: 'file_fcntl_default' defined but not used [-Wunused-const-variable=] 170 | LSM_HOOK(int, 0, file_fcntl, struct file *file, unsigned int cmd, | ^~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:170:1: note: in expansion of macro 'LSM_HOOK' 170 | LSM_HOOK(int, 0, file_fcntl, struct file *file, unsigned int cmd, | ^~~~~~~~ include/linux/lsm_hook_defs.h:169:18: warning: 'file_lock_default' defined but not used [-Wunused-const-variable=] 169 | LSM_HOOK(int, 0, file_lock, struct file *file, unsigned int cmd) | ^~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:169:1: note: in expansion of macro 'LSM_HOOK' 169 | LSM_HOOK(int, 0, file_lock, struct file *file, unsigned int cmd) | ^~~~~~~~ include/linux/lsm_hook_defs.h:167:18: warning: 'file_mprotect_default' defined but not used [-Wunused-const-variable=] 167 | LSM_HOOK(int, 0, file_mprotect, struct vm_area_struct *vma, | ^~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:167:1: note: in expansion of macro 'LSM_HOOK' 167 | LSM_HOOK(int, 0, file_mprotect, struct vm_area_struct *vma, | ^~~~~~~~ include/linux/lsm_hook_defs.h:165:18: warning: 'mmap_file_default' defined but not used [-Wunused-const-variable=] 165 | LSM_HOOK(int, 0, mmap_file, struct file *file, unsigned long reqprot, | ^~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:165:1: note: in expansion of macro 'LSM_HOOK' 165 | LSM_HOOK(int, 0, mmap_file, struct file *file, unsigned long reqprot, | ^~~~~~~~ include/linux/lsm_hook_defs.h:164:18: warning: 'mmap_addr_default' defined but not used [-Wunused-const-variable=] 164 | LSM_HOOK(int, 0, mmap_addr, unsigned long addr) | ^~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:164:1: note: in expansion of macro 'LSM_HOOK' 164 | LSM_HOOK(int, 0, mmap_addr, unsigned long addr) | ^~~~~~~~ >> include/linux/lsm_hook_defs.h:162:18: warning: 'file_ioctl_compat_default' defined but not used [-Wunused-const-variable=] 162 | LSM_HOOK(int, 0, file_ioctl_compat, struct file *file, unsigned int cmd, | ^~~~~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:162:1: note: in expansion of macro 'LSM_HOOK' 162 | LSM_HOOK(int, 0, file_ioctl_compat, struct file *file, unsigned int cmd, | ^~~~~~~~ include/linux/lsm_hook_defs.h:160:18: warning: 'file_ioctl_default' defined but not used [-Wunused-const-variable=] 160 | LSM_HOOK(int, 0, file_ioctl, struct file *file, unsigned int cmd, | ^~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:160:1: note: in expansion of macro 'LSM_HOOK' 160 | LSM_HOOK(int, 0, file_ioctl, struct file *file, unsigned int cmd, | ^~~~~~~~ include/linux/lsm_hook_defs.h:158:18: warning: 'file_alloc_security_default' defined but not used [-Wunused-const-variable=] 158 | LSM_HOOK(int, 0, file_alloc_security, struct file *file) | ^~~~~~~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:158:1: note: in expansion of macro 'LSM_HOOK' 158 | LSM_HOOK(int, 0, file_alloc_security, struct file *file) | ^~~~~~~~ include/linux/lsm_hook_defs.h:157:18: warning: 'file_permission_default' defined but not used [-Wunused-const-variable=] 157 | LSM_HOOK(int, 0, file_permission, struct file *file, int mask) | ^~~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:157:1: note: in expansion of macro 'LSM_HOOK' 157 | LSM_HOOK(int, 0, file_permission, struct file *file, int mask) | ^~~~~~~~ include/linux/lsm_hook_defs.h:155:18: warning: 'kernfs_init_security_default' defined but not used [-Wunused-const-variable=] 155 | LSM_HOOK(int, 0, kernfs_init_security, struct kernfs_node *kn_dir, | ^~~~~~~~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:155:1: note: in expansion of macro 'LSM_HOOK' 155 | LSM_HOOK(int, 0, kernfs_init_security, struct kernfs_node *kn_dir, | ^~~~~~~~ include/linux/lsm_hook_defs.h:153:18: warning: 'inode_copy_up_default' defined but not used [-Wunused-const-variable=] 153 | LSM_HOOK(int, 0, inode_copy_up, struct dentry *src, struct cred **new) | ^~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:153:1: note: in expansion of macro 'LSM_HOOK' 153 | LSM_HOOK(int, 0, inode_copy_up, struct dentry *src, struct cred **new) | ^~~~~~~~ include/linux/lsm_hook_defs.h:150:18: warning: 'inode_listsecurity_default' defined but not used [-Wunused-const-variable=] 150 | LSM_HOOK(int, 0, inode_listsecurity, struct inode *inode, char *buffer, | ^~~~~~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:150:1: note: in expansion of macro 'LSM_HOOK' 150 | LSM_HOOK(int, 0, inode_listsecurity, struct inode *inode, char *buffer, | ^~~~~~~~ include/linux/lsm_hook_defs.h:145:18: warning: 'inode_killpriv_default' defined but not used [-Wunused-const-variable=] 145 | LSM_HOOK(int, 0, inode_killpriv, struct dentry *dentry) | ^~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:145:1: note: in expansion of macro 'LSM_HOOK' 145 | LSM_HOOK(int, 0, inode_killpriv, struct dentry *dentry) | ^~~~~~~~ include/linux/lsm_hook_defs.h:144:18: warning: 'inode_need_killpriv_default' defined but not used [-Wunused-const-variable=] 144 | LSM_HOOK(int, 0, inode_need_killpriv, struct dentry *dentry) | ^~~~~~~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) vim +/file_ioctl_compat_default +162 include/linux/lsm_hook_defs.h 108 109 /* Needed for inode based security check */ 110 LSM_HOOK(int, 0, path_notify, const struct path *path, u64 mask, 111 unsigned int obj_type) 112 LSM_HOOK(int, 0, inode_alloc_security, struct inode *inode) 113 LSM_HOOK(void, LSM_RET_VOID, inode_free_security, struct inode *inode) 114 LSM_HOOK(int, 0, inode_init_security, struct inode *inode, 115 struct inode *dir, const struct qstr *qstr, const char **name, 116 void **value, size_t *len) 117 LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry, 118 umode_t mode) 119 LSM_HOOK(int, 0, inode_link, struct dentry *old_dentry, struct inode *dir, 120 struct dentry *new_dentry) 121 LSM_HOOK(int, 0, inode_unlink, struct inode *dir, struct dentry *dentry) 122 LSM_HOOK(int, 0, inode_symlink, struct inode *dir, struct dentry *dentry, 123 const char *old_name) 124 LSM_HOOK(int, 0, inode_mkdir, struct inode *dir, struct dentry *dentry, 125 umode_t mode) 126 LSM_HOOK(int, 0, inode_rmdir, struct inode *dir, struct dentry *dentry) 127 LSM_HOOK(int, 0, inode_mknod, struct inode *dir, struct dentry *dentry, 128 umode_t mode, dev_t dev) 129 LSM_HOOK(int, 0, inode_rename, struct inode *old_dir, struct dentry *old_dentry, 130 struct inode *new_dir, struct dentry *new_dentry) 131 LSM_HOOK(int, 0, inode_readlink, struct dentry *dentry) 132 LSM_HOOK(int, 0, inode_follow_link, struct dentry *dentry, struct inode *inode, 133 bool rcu) 134 LSM_HOOK(int, 0, inode_permission, struct inode *inode, int mask) 135 LSM_HOOK(int, 0, inode_setattr, struct dentry *dentry, struct iattr *attr) 136 LSM_HOOK(int, 0, inode_getattr, const struct path *path) 137 LSM_HOOK(int, 0, inode_setxattr, struct dentry *dentry, const char *name, 138 const void *value, size_t size, int flags) 139 LSM_HOOK(void, LSM_RET_VOID, inode_post_setxattr, struct dentry *dentry, 140 const char *name, const void *value, size_t size, int flags) 141 LSM_HOOK(int, 0, inode_getxattr, struct dentry *dentry, const char *name) 142 LSM_HOOK(int, 0, inode_listxattr, struct dentry *dentry) 143 LSM_HOOK(int, 0, inode_removexattr, struct dentry *dentry, const char *name) 144 LSM_HOOK(int, 0, inode_need_killpriv, struct dentry *dentry) 145 LSM_HOOK(int, 0, inode_killpriv, struct dentry *dentry) 146 LSM_HOOK(int, -EOPNOTSUPP, inode_getsecurity, struct inode *inode, 147 const char *name, void **buffer, bool alloc) 148 LSM_HOOK(int, -EOPNOTSUPP, inode_setsecurity, struct inode *inode, 149 const char *name, const void *value, size_t size, int flags) 150 LSM_HOOK(int, 0, inode_listsecurity, struct inode *inode, char *buffer, 151 size_t buffer_size) 152 LSM_HOOK(void, LSM_RET_VOID, inode_getsecid, struct inode *inode, u32 *secid) 153 LSM_HOOK(int, 0, inode_copy_up, struct dentry *src, struct cred **new) 154 LSM_HOOK(int, -EOPNOTSUPP, inode_copy_up_xattr, const char *name) 155 LSM_HOOK(int, 0, kernfs_init_security, struct kernfs_node *kn_dir, 156 struct kernfs_node *kn) 157 LSM_HOOK(int, 0, file_permission, struct file *file, int mask) 158 LSM_HOOK(int, 0, file_alloc_security, struct file *file) 159 LSM_HOOK(void, LSM_RET_VOID, file_free_security, struct file *file) 160 LSM_HOOK(int, 0, file_ioctl, struct file *file, unsigned int cmd, 161 unsigned long arg) > 162 LSM_HOOK(int, 0, file_ioctl_compat, struct file *file, unsigned int cmd, 163 unsigned long arg) 164 LSM_HOOK(int, 0, mmap_addr, unsigned long addr) 165 LSM_HOOK(int, 0, mmap_file, struct file *file, unsigned long reqprot, 166 unsigned long prot, unsigned long flags) 167 LSM_HOOK(int, 0, file_mprotect, struct vm_area_struct *vma, 168 unsigned long reqprot, unsigned long prot) 169 LSM_HOOK(int, 0, file_lock, struct file *file, unsigned int cmd) 170 LSM_HOOK(int, 0, file_fcntl, struct file *file, unsigned int cmd, 171 unsigned long arg) 172 LSM_HOOK(void, LSM_RET_VOID, file_set_fowner, struct file *file) 173 LSM_HOOK(int, 0, file_send_sigiotask, struct task_struct *tsk, 174 struct fown_struct *fown, int sig) 175 LSM_HOOK(int, 0, file_receive, struct file *file) 176 LSM_HOOK(int, 0, file_open, struct file *file) 177 LSM_HOOK(int, 0, task_alloc, struct task_struct *task, 178 unsigned long clone_flags) 179 LSM_HOOK(void, LSM_RET_VOID, task_free, struct task_struct *task) 180 LSM_HOOK(int, 0, cred_alloc_blank, struct cred *cred, gfp_t gfp) 181 LSM_HOOK(void, LSM_RET_VOID, cred_free, struct cred *cred) 182 LSM_HOOK(int, 0, cred_prepare, struct cred *new, const struct cred *old, 183 gfp_t gfp) 184 LSM_HOOK(void, LSM_RET_VOID, cred_transfer, struct cred *new, 185 const struct cred *old) 186 LSM_HOOK(void, LSM_RET_VOID, cred_getsecid, const struct cred *c, u32 *secid) 187 LSM_HOOK(int, 0, kernel_act_as, struct cred *new, u32 secid) 188 LSM_HOOK(int, 0, kernel_create_files_as, struct cred *new, struct inode *inode) 189 LSM_HOOK(int, 0, kernel_module_request, char *kmod_name) 190 LSM_HOOK(int, 0, kernel_load_data, enum kernel_load_data_id id, bool contents) 191 LSM_HOOK(int, 0, kernel_post_load_data, char *buf, loff_t size, 192 enum kernel_load_data_id id, char *description) 193 LSM_HOOK(int, 0, kernel_read_file, struct file *file, 194 enum kernel_read_file_id id, bool contents) 195 LSM_HOOK(int, 0, kernel_post_read_file, struct file *file, char *buf, 196 loff_t size, enum kernel_read_file_id id) 197 LSM_HOOK(int, 0, task_fix_setuid, struct cred *new, const struct cred *old, 198 int flags) 199 LSM_HOOK(int, 0, task_fix_setgid, struct cred *new, const struct cred * old, 200 int flags) 201 LSM_HOOK(int, 0, task_setpgid, struct task_struct *p, pid_t pgid) 202 LSM_HOOK(int, 0, task_getpgid, struct task_struct *p) 203 LSM_HOOK(int, 0, task_getsid, struct task_struct *p) 204 LSM_HOOK(void, LSM_RET_VOID, task_getsecid, struct task_struct *p, u32 *secid) 205 LSM_HOOK(int, 0, task_setnice, struct task_struct *p, int nice) 206 LSM_HOOK(int, 0, task_setioprio, struct task_struct *p, int ioprio) 207 LSM_HOOK(int, 0, task_getioprio, struct task_struct *p) 208 LSM_HOOK(int, 0, task_prlimit, const struct cred *cred, 209 const struct cred *tcred, unsigned int flags) 210 LSM_HOOK(int, 0, task_setrlimit, struct task_struct *p, unsigned int resource, 211 struct rlimit *new_rlim) 212 LSM_HOOK(int, 0, task_setscheduler, struct task_struct *p) 213 LSM_HOOK(int, 0, task_getscheduler, struct task_struct *p) 214 LSM_HOOK(int, 0, task_movememory, struct task_struct *p) 215 LSM_HOOK(int, 0, task_kill, struct task_struct *p, struct kernel_siginfo *info, 216 int sig, const struct cred *cred) 217 LSM_HOOK(int, -ENOSYS, task_prctl, int option, unsigned long arg2, 218 unsigned long arg3, unsigned long arg4, unsigned long arg5) 219 LSM_HOOK(void, LSM_RET_VOID, task_to_inode, struct task_struct *p, 220 struct inode *inode) 221 LSM_HOOK(int, 0, ipc_permission, struct kern_ipc_perm *ipcp, short flag) 222 LSM_HOOK(void, LSM_RET_VOID, ipc_getsecid, struct kern_ipc_perm *ipcp, 223 u32 *secid) 224 LSM_HOOK(int, 0, msg_msg_alloc_security, struct msg_msg *msg) 225 LSM_HOOK(void, LSM_RET_VOID, msg_msg_free_security, struct msg_msg *msg) 226 LSM_HOOK(int, 0, msg_queue_alloc_security, struct kern_ipc_perm *perm) 227 LSM_HOOK(void, LSM_RET_VOID, msg_queue_free_security, 228 struct kern_ipc_perm *perm) 229 LSM_HOOK(int, 0, msg_queue_associate, struct kern_ipc_perm *perm, int msqflg) 230 LSM_HOOK(int, 0, msg_queue_msgctl, struct kern_ipc_perm *perm, int cmd) 231 LSM_HOOK(int, 0, msg_queue_msgsnd, struct kern_ipc_perm *perm, 232 struct msg_msg *msg, int msqflg) 233 LSM_HOOK(int, 0, msg_queue_msgrcv, struct kern_ipc_perm *perm, 234 struct msg_msg *msg, struct task_struct *target, long type, int mode) 235 LSM_HOOK(int, 0, shm_alloc_security, struct kern_ipc_perm *perm) 236 LSM_HOOK(void, LSM_RET_VOID, shm_free_security, struct kern_ipc_perm *perm) 237 LSM_HOOK(int, 0, shm_associate, struct kern_ipc_perm *perm, int shmflg) 238 LSM_HOOK(int, 0, shm_shmctl, struct kern_ipc_perm *perm, int cmd) 239 LSM_HOOK(int, 0, shm_shmat, struct kern_ipc_perm *perm, char __user *shmaddr, 240 int shmflg) 241 LSM_HOOK(int, 0, sem_alloc_security, struct kern_ipc_perm *perm) 242 LSM_HOOK(void, LSM_RET_VOID, sem_free_security, struct kern_ipc_perm *perm) 243 LSM_HOOK(int, 0, sem_associate, struct kern_ipc_perm *perm, int semflg) 244 LSM_HOOK(int, 0, sem_semctl, struct kern_ipc_perm *perm, int cmd) 245 LSM_HOOK(int, 0, sem_semop, struct kern_ipc_perm *perm, struct sembuf *sops, 246 unsigned nsops, int alter) 247 LSM_HOOK(int, 0, netlink_send, struct sock *sk, struct sk_buff *skb) 248 LSM_HOOK(void, LSM_RET_VOID, d_instantiate, struct dentry *dentry, 249 struct inode *inode) 250 LSM_HOOK(int, -EINVAL, getprocattr, struct task_struct *p, char *name, 251 char **value) 252 LSM_HOOK(int, -EINVAL, setprocattr, const char *name, void *value, size_t size) 253 LSM_HOOK(int, 0, ismaclabel, const char *name) 254 LSM_HOOK(int, -EOPNOTSUPP, secid_to_secctx, u32 secid, char **secdata, 255 u32 *seclen) 256 LSM_HOOK(int, 0, secctx_to_secid, const char *secdata, u32 seclen, u32 *secid) 257 LSM_HOOK(void, LSM_RET_VOID, release_secctx, char *secdata, u32 seclen) 258 LSM_HOOK(void, LSM_RET_VOID, inode_invalidate_secctx, struct inode *inode) 259 LSM_HOOK(int, 0, inode_notifysecctx, struct inode *inode, void *ctx, u32 ctxlen) 260 LSM_HOOK(int, 0, inode_setsecctx, struct dentry *dentry, void *ctx, u32 ctxlen) 261 LSM_HOOK(int, -EOPNOTSUPP, inode_getsecctx, struct inode *inode, void **ctx, 262 u32 *ctxlen) 263 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] s390/cpum_sf: Handle CPU hotplug remove during sampling
by Heyuan Wang 17 Jan '25

17 Jan '25

From: Thomas Richter <tmricht(a)linux.ibm.com> stable inclusion from stable-v6.6.66 commit a69752f1e5de817941a2ea0609254f6f25acd274 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBI7GX CVE: CVE-2024-57849 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a0bd7dacbd51c632b8e2c0500b479af564afadf3 ] CPU hotplug remove handling triggers the following function call sequence: CPUHP_AP_PERF_S390_SF_ONLINE --> s390_pmu_sf_offline_cpu() ... CPUHP_AP_PERF_ONLINE --> perf_event_exit_cpu() The s390 CPUMF sampling CPU hotplug handler invokes: s390_pmu_sf_offline_cpu() +--> cpusf_pmu_setup() +--> setup_pmc_cpu() +--> deallocate_buffers() This function de-allocates all sampling data buffers (SDBs) allocated for that CPU at event initialization. It also clears the PMU_F_RESERVED bit. The CPU is gone and can not be sampled. With the event still being active on the removed CPU, the CPU event hotplug support in kernel performance subsystem triggers the following function calls on the removed CPU: perf_event_exit_cpu() +--> perf_event_exit_cpu_context() +--> __perf_event_exit_context() +--> __perf_remove_from_context() +--> event_sched_out() +--> cpumsf_pmu_del() +--> cpumsf_pmu_stop() +--> hw_perf_event_update() to stop and remove the event. During removal of the event, the sampling device driver tries to read out the remaining samples from the sample data buffers (SDBs). But they have already been freed (and may have been re-assigned). This may lead to a use after free situation in which case the samples are most likely invalid. In the best case the memory has not been reassigned and still contains valid data. Remedy this situation and check if the CPU is still in reserved state (bit PMU_F_RESERVED set). In this case the SDBs have not been released an contain valid data. This is always the case when the event is removed (and no CPU hotplug off occured). If the PMU_F_RESERVED bit is not set, the SDB buffers are gone. Signed-off-by: Thomas Richter <tmricht(a)linux.ibm.com> Reviewed-by: Hendrik Brueckner <brueckner(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- arch/s390/kernel/perf_cpum_sf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c index a3169193775f..e52c89739bc9 100644 --- a/arch/s390/kernel/perf_cpum_sf.c +++ b/arch/s390/kernel/perf_cpum_sf.c @@ -1922,7 +1922,9 @@ static void cpumsf_pmu_stop(struct perf_event *event, int flags) event->hw.state |= PERF_HES_STOPPED; if ((flags & PERF_EF_UPDATE) && !(event->hw.state & PERF_HES_UPTODATE)) { - hw_perf_event_update(event, 1); + /* CPU hotplug off removes SDBs. No samples to extract. */ + if (cpuhw->flags & PMU_F_RESERVED) + hw_perf_event_update(event, 1); event->hw.state |= PERF_HES_UPTODATE; } perf_pmu_enable(event->pmu); -- 2.25.1

2 1

[PATCH OLK-5.10] s390/cpum_sf: Handle CPU hotplug remove during sampling
by Heyuan Wang 17 Jan '25

17 Jan '25

From: Thomas Richter <tmricht(a)linux.ibm.com> stable inclusion from stable-v5.10.231 commit 99192c735ed4bfdff0d215ec85c8a87a677cb898 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBI7GX CVE: CVE-2024-57849 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a0bd7dacbd51c632b8e2c0500b479af564afadf3 ] CPU hotplug remove handling triggers the following function call sequence: CPUHP_AP_PERF_S390_SF_ONLINE --> s390_pmu_sf_offline_cpu() ... CPUHP_AP_PERF_ONLINE --> perf_event_exit_cpu() The s390 CPUMF sampling CPU hotplug handler invokes: s390_pmu_sf_offline_cpu() +--> cpusf_pmu_setup() +--> setup_pmc_cpu() +--> deallocate_buffers() This function de-allocates all sampling data buffers (SDBs) allocated for that CPU at event initialization. It also clears the PMU_F_RESERVED bit. The CPU is gone and can not be sampled. With the event still being active on the removed CPU, the CPU event hotplug support in kernel performance subsystem triggers the following function calls on the removed CPU: perf_event_exit_cpu() +--> perf_event_exit_cpu_context() +--> __perf_event_exit_context() +--> __perf_remove_from_context() +--> event_sched_out() +--> cpumsf_pmu_del() +--> cpumsf_pmu_stop() +--> hw_perf_event_update() to stop and remove the event. During removal of the event, the sampling device driver tries to read out the remaining samples from the sample data buffers (SDBs). But they have already been freed (and may have been re-assigned). This may lead to a use after free situation in which case the samples are most likely invalid. In the best case the memory has not been reassigned and still contains valid data. Remedy this situation and check if the CPU is still in reserved state (bit PMU_F_RESERVED set). In this case the SDBs have not been released an contain valid data. This is always the case when the event is removed (and no CPU hotplug off occured). If the PMU_F_RESERVED bit is not set, the SDB buffers are gone. Signed-off-by: Thomas Richter <tmricht(a)linux.ibm.com> Reviewed-by: Hendrik Brueckner <brueckner(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- arch/s390/kernel/perf_cpum_sf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c index bcd31e0b4edb..af41550d34b9 100644 --- a/arch/s390/kernel/perf_cpum_sf.c +++ b/arch/s390/kernel/perf_cpum_sf.c @@ -1900,7 +1900,9 @@ static void cpumsf_pmu_stop(struct perf_event *event, int flags) event->hw.state |= PERF_HES_STOPPED; if ((flags & PERF_EF_UPDATE) && !(event->hw.state & PERF_HES_UPTODATE)) { - hw_perf_event_update(event, 1); + /* CPU hotplug off removes SDBs. No samples to extract. */ + if (cpuhw->flags & PMU_F_RESERVED) + hw_perf_event_update(event, 1); event->hw.state |= PERF_HES_UPTODATE; } perf_pmu_enable(event->pmu); -- 2.25.1

2 1

[openeuler:OLK-5.10 2709/2709] fs/buffer.o: warning: objtool: __breadahead_gfp()+0x9b: unreachable instruction
by kernel test robot 17 Jan '25

17 Jan '25

Hi Zhang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 08e54ea5e4a4948874ca30d91be3e5cca4ecbeec commit: 1ee722823d036ae6478e6bdb1afb12abff10a907 [2709/2709] fs/buffer: replace ll_rw_block() config: x86_64-randconfig-161-20250117 (https://download.01.org/0day-ci/archive/20250117/202501171739.hW4TwhmP-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250117/202501171739.hW4TwhmP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501171739.hW4TwhmP-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/buffer.o: warning: objtool: __breadahead_gfp()+0x9b: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
by Liu Jian 17 Jan '25

17 Jan '25

From: Jinghao Jia <jinghao7(a)illinois.edu> stable inclusion from stable-v6.6.66 commit 124834133b32f9386bb2d8581d9ab92f65e951e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBICKD CVE: CVE-2024-53680 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 146b6f1112eb30a19776d6c323c994e9d67790db ] Under certain kernel configurations when building with Clang/LLVM, the compiler does not generate a return or jump as the terminator instruction for ip_vs_protocol_init(), triggering the following objtool warning during build time: vmlinux.o: warning: objtool: ip_vs_protocol_init() falls through to next function __initstub__kmod_ip_vs_rr__935_123_ip_vs_rr_init6() At runtime, this either causes an oops when trying to load the ipvs module or a boot-time panic if ipvs is built-in. This same issue has been reported by the Intel kernel test robot previously. Digging deeper into both LLVM and the kernel code reveals this to be a undefined behavior problem. ip_vs_protocol_init() uses a on-stack buffer of 64 chars to store the registered protocol names and leaves it uninitialized after definition. The function calls strnlen() when concatenating protocol names into the buffer. With CONFIG_FORTIFY_SOURCE strnlen() performs an extra step to check whether the last byte of the input char buffer is a null character (commit 3009f891bb9f ("fortify: Allow strlen() and strnlen() to pass compile-time known lengths")). This, together with possibly other configurations, cause the following IR to be generated: define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #5 section ".init.text" align 16 !kcfi_type !29 { %1 = alloca [64 x i8], align 16 ... 14: ; preds = %11 %15 = getelementptr inbounds i8, ptr %1, i64 63 %16 = load i8, ptr %15, align 1 %17 = tail call i1 @llvm.is.constant.i8(i8 %16) %18 = icmp eq i8 %16, 0 %19 = select i1 %17, i1 %18, i1 false br i1 %19, label %20, label %23 20: ; preds = %14 %21 = call i64 @strlen(ptr noundef nonnull dereferenceable(1) %1) #23 ... 23: ; preds = %14, %11, %20 %24 = call i64 @strnlen(ptr noundef nonnull dereferenceable(1) %1, i64 noundef 64) #24 ... } The above code calculates the address of the last char in the buffer (value %15) and then loads from it (value %16). Because the buffer is never initialized, the LLVM GVN pass marks value %16 as undefined: %13 = getelementptr inbounds i8, ptr %1, i64 63 br i1 undef, label %14, label %17 This gives later passes (SCCP, in particular) more DCE opportunities by propagating the undef value further, and eventually removes everything after the load on the uninitialized stack location: define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #0 section ".init.text" align 16 !kcfi_type !11 { %1 = alloca [64 x i8], align 16 ... 12: ; preds = %11 %13 = getelementptr inbounds i8, ptr %1, i64 63 unreachable } In this way, the generated native code will just fall through to the next function, as LLVM does not generate any code for the unreachable IR instruction and leaves the function without a terminator. Zero the on-stack buffer to avoid this possible UB. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202402100205.PWXIz1ZK-lkp@intel.com/ Co-developed-by: Ruowen Qin <ruqin(a)redhat.com> Signed-off-by: Ruowen Qin <ruqin(a)redhat.com> Signed-off-by: Jinghao Jia <jinghao7(a)illinois.edu> Acked-by: Julian Anastasov <ja(a)ssi.bg> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/netfilter/ipvs/ip_vs_proto.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_proto.c b/net/netfilter/ipvs/ip_vs_proto.c index f100da4ba3bc..a9fd1d3fc2cb 100644 --- a/net/netfilter/ipvs/ip_vs_proto.c +++ b/net/netfilter/ipvs/ip_vs_proto.c @@ -340,7 +340,7 @@ void __net_exit ip_vs_protocol_net_cleanup(struct netns_ipvs *ipvs) int __init ip_vs_protocol_init(void) { - char protocols[64]; + char protocols[64] = { 0 }; #define REGISTER_PROTOCOL(p) \ do { \ register_ip_vs_protocol(p); \ @@ -348,8 +348,6 @@ int __init ip_vs_protocol_init(void) strcat(protocols, (p)->name); \ } while (0) - protocols[0] = '\0'; - protocols[2] = '\0'; #ifdef CONFIG_IP_VS_PROTO_TCP REGISTER_PROTOCOL(&ip_vs_protocol_tcp); #endif -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] clk: ralink: mtmips: clock fixes for Ralink SoCs
by Tirui Yin 17 Jan '25

17 Jan '25

The following series contains two patches that address clock-related issues in the Ralink SoC family: - The first patch introduces a missing 'periph' clock to the RT3883 SoC's clock plan. This corrects issues with peripherals such as UART, I2C, I2S, and UARTlite, which previously relied on an undefined 'periph' clock. - The second patch ensures proper probe order of base clocks for older Ralink SoCs (RT2880, RT305x, and RT3883) by defining the 'xtal' clock first. This eliminates boot warnings and ensures that dependent clocks are set up correctly from the start. Sergio Paracuellos (2): clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883 clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs drivers/clk/ralink/clk-mtmips.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) -- 2.22.0

2 3

[PATCH OLK-6.6 1/2] clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883
by Tirui Yin 17 Jan '25

17 Jan '25

From: Sergio Paracuellos <sergio.paracuellos(a)gmail.com> stable inclusion from stable-v6.6.64 commit f85a1d06afbcc57ac44176db8f9d7a934979952c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEQ CVE: CVE-2024-53223 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 33239152305567b3e9bf052f71fd4baecd626341 ] Clock plan for Ralink SoC RT3883 needs an extra 'periph' clock to properly set some peripherals that has this clock as their parent. When this driver was mainlined we could not find any active users of this SoC so we cannot perform any real tests for it. Now, one user of a Belkin f9k1109 version 1 device which uses this SoC appear and reported some issues in openWRT: - https://github.com/openwrt/openwrt/issues/16054 The peripherals that are wrong are 'uart', 'i2c', 'i2s' and 'uartlite' which has a not defined 'periph' clock as parent. Hence, introduce it to have a properly working clock plan for this SoC. Fixes: 6f3b15586eef ("clk: ralink: add clock and reset driver for MTMIPS SoCs") Signed-off-by: Sergio Paracuellos <sergio.paracuellos(a)gmail.com> Link: https://lore.kernel.org/r/20240910044024.120009-2-sergio.paracuellos@gmail.… Signed-off-by: Stephen Boyd <sboyd(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/clk/ralink/clk-mtmips.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/clk/ralink/clk-mtmips.c b/drivers/clk/ralink/clk-mtmips.c index 50a443bf79ec..62f9801ecd3a 100644 --- a/drivers/clk/ralink/clk-mtmips.c +++ b/drivers/clk/ralink/clk-mtmips.c @@ -267,6 +267,11 @@ static struct mtmips_clk_fixed rt305x_fixed_clocks[] = { CLK_FIXED("xtal", NULL, 40000000) }; +static struct mtmips_clk_fixed rt3883_fixed_clocks[] = { + CLK_FIXED("xtal", NULL, 40000000), + CLK_FIXED("periph", "xtal", 40000000) +}; + static struct mtmips_clk_fixed rt3352_fixed_clocks[] = { CLK_FIXED("periph", "xtal", 40000000) }; @@ -779,8 +784,8 @@ static const struct mtmips_clk_data rt3352_clk_data = { static const struct mtmips_clk_data rt3883_clk_data = { .clk_base = rt3883_clks_base, .num_clk_base = ARRAY_SIZE(rt3883_clks_base), - .clk_fixed = rt305x_fixed_clocks, - .num_clk_fixed = ARRAY_SIZE(rt305x_fixed_clocks), + .clk_fixed = rt3883_fixed_clocks, + .num_clk_fixed = ARRAY_SIZE(rt3883_fixed_clocks), .clk_factor = NULL, .num_clk_factor = 0, .clk_periph = rt5350_pherip_clks, -- 2.22.0

2 3

[openeuler:openEuler-1.0-LTS 1408/1408] include/linux/list.h:583:14: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]'
by kernel test robot 17 Jan '25

17 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 08c9196f65d268e1f8dccde138d4644c427bde76 [1408/1408] mm/swap: use nr_node_ids for avail_lists in swap_info_struct config: arm64-randconfig-004-20250117 (https://download.01.org/0day-ci/archive/20250117/202501171519.TpEUKk9L-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250117/202501171519.TpEUKk9L-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501171519.TpEUKk9L-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/arm64/include/asm/bug.h:37, from include/linux/bug.h:5, from include/linux/mmdebug.h:5, from include/linux/mm.h:9, from mm/swapfile.c:8: In function 'add_to_avail_list', inlined from 'swap_range_free.constprop' at mm/swapfile.c:667:4: mm/swapfile.c:648:43: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 648 | WARN_ON(!plist_node_empty(&p->avail_lists[nid])); | ^~~~~~~~~~~~~~~~~~~~ include/asm-generic/bug.h:191:32: note: in definition of macro 'WARN_ON' 191 | int __ret_warn_on = !!(condition); \ | ^~~~~~~~~ In file included from mm/swapfile.c:15: include/linux/swap.h: In function 'swap_range_free.constprop': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c: In function '_enable_swap_info': mm/swapfile.c:2458:47: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2458 | p->avail_lists[i].prio = 1; | ~~~~~~~~~~~~~~^~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:2460:47: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2460 | p->avail_lists[i].prio = -p->prio; | ~~~~~~~~~~~~~~^~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:2455:39: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2455 | p->avail_lists[i].prio = -p->prio; | ~~~~~~~~~~~~~~^~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function 'add_to_avail_list', inlined from '_enable_swap_info' at mm/swapfile.c:2481:2: mm/swapfile.c:648:43: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 648 | WARN_ON(!plist_node_empty(&p->avail_lists[nid])); | ^~~~~~~~~~~~~~~~~~~~ include/asm-generic/bug.h:191:32: note: in definition of macro 'WARN_ON' 191 | int __ret_warn_on = !!(condition); \ | ^~~~~~~~~ include/linux/swap.h: In function '_enable_swap_info': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function '__del_from_avail_list', inlined from 'del_from_avail_list' at mm/swapfile.c:621:2, inlined from 'swap_range_alloc' at mm/swapfile.c:638:3, inlined from 'scan_swap_map_slots' at mm/swapfile.c:802:2: mm/swapfile.c:615:17: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 615 | plist_del(&p->avail_lists[nid], &swap_avail_heads[nid]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function 'scan_swap_map_slots': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In file included from include/asm-generic/bug.h:18: mm/swapfile.c: In function 'get_swap_pages': mm/swapfile.c:970:81: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { include/linux/kernel.h:996:33: note: in definition of macro 'container_of' 996 | void *__mptr = (void *)(ptr); \ | ^~~ include/linux/list.h:440:9: note: in expansion of macro 'list_entry' 440 | list_entry((pos)->member.next, typeof(*(pos)), member) | ^~~~~~~~~~ include/linux/list.h:582:21: note: in expansion of macro 'list_next_entry' 582 | n = list_next_entry(pos, member); \ | ^~~~~~~~~~~~~~~ include/linux/plist.h:206:9: note: in expansion of macro 'list_for_each_entry_safe' 206 | list_for_each_entry_safe(pos, n, &(head)->node_list, m.node_list) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/swapfile.c:970:9: note: in expansion of macro 'plist_for_each_entry_safe' 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In file included from include/linux/preempt.h:11, from include/linux/spinlock.h:51, from include/linux/mmzone.h:8, from include/linux/gfp.h:6, from include/linux/mm.h:10: >> include/linux/list.h:583:14: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 583 | &pos->member != (head); \ include/linux/plist.h:206:9: note: in expansion of macro 'list_for_each_entry_safe' 206 | list_for_each_entry_safe(pos, n, &(head)->node_list, m.node_list) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/swapfile.c:970:9: note: in expansion of macro 'plist_for_each_entry_safe' 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:972:17: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 972 | plist_requeue(&si->avail_lists[node], &swap_avail_heads[node]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:970:81: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { include/linux/kernel.h:996:33: note: in definition of macro 'container_of' 996 | void *__mptr = (void *)(ptr); \ | ^~~ include/linux/list.h:440:9: note: in expansion of macro 'list_entry' 440 | list_entry((pos)->member.next, typeof(*(pos)), member) | ^~~~~~~~~~ include/linux/list.h:584:27: note: in expansion of macro 'list_next_entry' 584 | pos = n, n = list_next_entry(n, member)) | ^~~~~~~~~~~~~~~ include/linux/plist.h:206:9: note: in expansion of macro 'list_for_each_entry_safe' 206 | list_for_each_entry_safe(pos, n, &(head)->node_list, m.node_list) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/swapfile.c:970:9: note: in expansion of macro 'plist_for_each_entry_safe' 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function '__del_from_avail_list', inlined from 'del_from_avail_list' at mm/swapfile.c:621:2, inlined from '__do_sys_swapoff' at mm/swapfile.c:2566:2, inlined from '__se_sys_swapoff' at mm/swapfile.c:2517:1: mm/swapfile.c:615:17: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 615 | plist_del(&p->avail_lists[nid], &swap_avail_heads[nid]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function '__se_sys_swapoff': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function '__do_sys_swapoff', inlined from '__se_sys_swapoff' at mm/swapfile.c:2517:1: mm/swapfile.c:2576:52: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2576 | if (si->avail_lists[nid].prio != 1) | ~~~~~~~~~~~~~~~^~~~~ include/linux/swap.h: In function '__se_sys_swapoff': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function '__do_sys_swapoff', inlined from '__se_sys_swapoff' at mm/swapfile.c:2517:1: mm/swapfile.c:2577:56: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2577 | si->avail_lists[nid].prio--; | ~~~~~~~~~~~~~~~^~~~~ include/linux/swap.h: In function '__se_sys_swapoff': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function 'alloc_swap_info', inlined from '__do_sys_swapon' at mm/swapfile.c:3125:6, inlined from '__se_sys_swapon' at mm/swapfile.c:3097:1: mm/swapfile.c:2860:17: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2860 | plist_node_init(&p->avail_lists[i], 0); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function '__se_sys_swapon': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function 'alloc_swap_info', inlined from '__do_sys_swapon' at mm/swapfile.c:3125:6, inlined from '__se_sys_swapon' at mm/swapfile.c:3097:1: mm/swapfile.c:2860:48: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2860 | plist_node_init(&p->avail_lists[i], 0); | ~~~~~~~~~~~~~~^~~ include/linux/swap.h: In function '__se_sys_swapon': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In file included from include/linux/sched.h:19, from arch/arm64/include/asm/pgtable.h:46, from include/linux/memremap.h:7, from include/linux/mm.h:27: In function 'plist_node_init', inlined from 'alloc_swap_info' at mm/swapfile.c:2860:3, inlined from '__do_sys_swapon' at mm/swapfile.c:3125:6, inlined from '__se_sys_swapon' at mm/swapfile.c:3097:1: >> include/linux/plist.h:137:9: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 137 | INIT_LIST_HEAD(&node->prio_list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function '__se_sys_swapon': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function 'plist_node_init', inlined from 'alloc_swap_info' at mm/swapfile.c:2860:3, inlined from '__do_sys_swapon' at mm/swapfile.c:3125:6, inlined from '__se_sys_swapon' at mm/swapfile.c:3097:1: include/linux/plist.h:138:9: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 138 | INIT_LIST_HEAD(&node->node_list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function '__se_sys_swapon': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ vim +583 include/linux/list.h 6d7581e62f8be4 Jiri Pirko 2013-05-29 433 008208c6b26f21 Oleg Nesterov 2013-11-12 434 /** 008208c6b26f21 Oleg Nesterov 2013-11-12 435 * list_next_entry - get the next element in list 008208c6b26f21 Oleg Nesterov 2013-11-12 436 * @pos: the type * to cursor 3943f42c11896c Andrey Utkin 2014-11-14 437 * @member: the name of the list_head within the struct. 008208c6b26f21 Oleg Nesterov 2013-11-12 438 */ 008208c6b26f21 Oleg Nesterov 2013-11-12 439 #define list_next_entry(pos, member) \ 008208c6b26f21 Oleg Nesterov 2013-11-12 440 list_entry((pos)->member.next, typeof(*(pos)), member) 008208c6b26f21 Oleg Nesterov 2013-11-12 441 008208c6b26f21 Oleg Nesterov 2013-11-12 442 /** 008208c6b26f21 Oleg Nesterov 2013-11-12 443 * list_prev_entry - get the prev element in list 008208c6b26f21 Oleg Nesterov 2013-11-12 444 * @pos: the type * to cursor 3943f42c11896c Andrey Utkin 2014-11-14 445 * @member: the name of the list_head within the struct. 008208c6b26f21 Oleg Nesterov 2013-11-12 446 */ 008208c6b26f21 Oleg Nesterov 2013-11-12 447 #define list_prev_entry(pos, member) \ 008208c6b26f21 Oleg Nesterov 2013-11-12 448 list_entry((pos)->member.prev, typeof(*(pos)), member) 008208c6b26f21 Oleg Nesterov 2013-11-12 449 ^1da177e4c3f41 Linus Torvalds 2005-04-16 450 /** ^1da177e4c3f41 Linus Torvalds 2005-04-16 451 * list_for_each - iterate over a list 8e3a67a99231f9 Randy Dunlap 2006-06-25 452 * @pos: the &struct list_head to use as a loop cursor. ^1da177e4c3f41 Linus Torvalds 2005-04-16 453 * @head: the head for your list. ^1da177e4c3f41 Linus Torvalds 2005-04-16 454 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 455 #define list_for_each(pos, head) \ e66eed651fd18a Linus Torvalds 2011-05-19 456 for (pos = (head)->next; pos != (head); pos = pos->next) ^1da177e4c3f41 Linus Torvalds 2005-04-16 457 ^1da177e4c3f41 Linus Torvalds 2005-04-16 458 /** ^1da177e4c3f41 Linus Torvalds 2005-04-16 459 * list_for_each_prev - iterate over a list backwards 8e3a67a99231f9 Randy Dunlap 2006-06-25 460 * @pos: the &struct list_head to use as a loop cursor. ^1da177e4c3f41 Linus Torvalds 2005-04-16 461 * @head: the head for your list. ^1da177e4c3f41 Linus Torvalds 2005-04-16 462 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 463 #define list_for_each_prev(pos, head) \ e66eed651fd18a Linus Torvalds 2011-05-19 464 for (pos = (head)->prev; pos != (head); pos = pos->prev) ^1da177e4c3f41 Linus Torvalds 2005-04-16 465 ^1da177e4c3f41 Linus Torvalds 2005-04-16 466 /** ^1da177e4c3f41 Linus Torvalds 2005-04-16 467 * list_for_each_safe - iterate over a list safe against removal of list entry 8e3a67a99231f9 Randy Dunlap 2006-06-25 468 * @pos: the &struct list_head to use as a loop cursor. ^1da177e4c3f41 Linus Torvalds 2005-04-16 469 * @n: another &struct list_head to use as temporary storage ^1da177e4c3f41 Linus Torvalds 2005-04-16 470 * @head: the head for your list. ^1da177e4c3f41 Linus Torvalds 2005-04-16 471 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 472 #define list_for_each_safe(pos, n, head) \ ^1da177e4c3f41 Linus Torvalds 2005-04-16 473 for (pos = (head)->next, n = pos->next; pos != (head); \ ^1da177e4c3f41 Linus Torvalds 2005-04-16 474 pos = n, n = pos->next) ^1da177e4c3f41 Linus Torvalds 2005-04-16 475 37c42524d60906 Denis V. Lunev 2007-10-16 476 /** 8f731f7d83d6c6 Randy Dunlap 2007-10-18 477 * list_for_each_prev_safe - iterate over a list backwards safe against removal of list entry 37c42524d60906 Denis V. Lunev 2007-10-16 478 * @pos: the &struct list_head to use as a loop cursor. 37c42524d60906 Denis V. Lunev 2007-10-16 479 * @n: another &struct list_head to use as temporary storage 37c42524d60906 Denis V. Lunev 2007-10-16 480 * @head: the head for your list. 37c42524d60906 Denis V. Lunev 2007-10-16 481 */ 37c42524d60906 Denis V. Lunev 2007-10-16 482 #define list_for_each_prev_safe(pos, n, head) \ 37c42524d60906 Denis V. Lunev 2007-10-16 483 for (pos = (head)->prev, n = pos->prev; \ e66eed651fd18a Linus Torvalds 2011-05-19 484 pos != (head); \ 37c42524d60906 Denis V. Lunev 2007-10-16 485 pos = n, n = pos->prev) 37c42524d60906 Denis V. Lunev 2007-10-16 486 ^1da177e4c3f41 Linus Torvalds 2005-04-16 487 /** ^1da177e4c3f41 Linus Torvalds 2005-04-16 488 * list_for_each_entry - iterate over list of given type 8e3a67a99231f9 Randy Dunlap 2006-06-25 489 * @pos: the type * to use as a loop cursor. ^1da177e4c3f41 Linus Torvalds 2005-04-16 490 * @head: the head for your list. 3943f42c11896c Andrey Utkin 2014-11-14 491 * @member: the name of the list_head within the struct. ^1da177e4c3f41 Linus Torvalds 2005-04-16 492 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 493 #define list_for_each_entry(pos, head, member) \ 93be3c2eb3371f Oleg Nesterov 2013-11-12 494 for (pos = list_first_entry(head, typeof(*pos), member); \ e66eed651fd18a Linus Torvalds 2011-05-19 495 &pos->member != (head); \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 496 pos = list_next_entry(pos, member)) ^1da177e4c3f41 Linus Torvalds 2005-04-16 497 ^1da177e4c3f41 Linus Torvalds 2005-04-16 498 /** ^1da177e4c3f41 Linus Torvalds 2005-04-16 499 * list_for_each_entry_reverse - iterate backwards over list of given type. 8e3a67a99231f9 Randy Dunlap 2006-06-25 500 * @pos: the type * to use as a loop cursor. ^1da177e4c3f41 Linus Torvalds 2005-04-16 501 * @head: the head for your list. 3943f42c11896c Andrey Utkin 2014-11-14 502 * @member: the name of the list_head within the struct. ^1da177e4c3f41 Linus Torvalds 2005-04-16 503 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 504 #define list_for_each_entry_reverse(pos, head, member) \ 93be3c2eb3371f Oleg Nesterov 2013-11-12 505 for (pos = list_last_entry(head, typeof(*pos), member); \ e66eed651fd18a Linus Torvalds 2011-05-19 506 &pos->member != (head); \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 507 pos = list_prev_entry(pos, member)) ^1da177e4c3f41 Linus Torvalds 2005-04-16 508 ^1da177e4c3f41 Linus Torvalds 2005-04-16 509 /** 72fd4a35a82433 Robert P. J. Day 2007-02-10 510 * list_prepare_entry - prepare a pos entry for use in list_for_each_entry_continue() ^1da177e4c3f41 Linus Torvalds 2005-04-16 511 * @pos: the type * to use as a start point ^1da177e4c3f41 Linus Torvalds 2005-04-16 512 * @head: the head of the list 3943f42c11896c Andrey Utkin 2014-11-14 513 * @member: the name of the list_head within the struct. fe96e57d77481c Randy Dunlap 2006-06-25 514 * 72fd4a35a82433 Robert P. J. Day 2007-02-10 515 * Prepares a pos entry for use as a start point in list_for_each_entry_continue(). ^1da177e4c3f41 Linus Torvalds 2005-04-16 516 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 517 #define list_prepare_entry(pos, head, member) \ ^1da177e4c3f41 Linus Torvalds 2005-04-16 518 ((pos) ? : list_entry(head, typeof(*pos), member)) ^1da177e4c3f41 Linus Torvalds 2005-04-16 519 ^1da177e4c3f41 Linus Torvalds 2005-04-16 520 /** fe96e57d77481c Randy Dunlap 2006-06-25 521 * list_for_each_entry_continue - continue iteration over list of given type 8e3a67a99231f9 Randy Dunlap 2006-06-25 522 * @pos: the type * to use as a loop cursor. ^1da177e4c3f41 Linus Torvalds 2005-04-16 523 * @head: the head for your list. 3943f42c11896c Andrey Utkin 2014-11-14 524 * @member: the name of the list_head within the struct. fe96e57d77481c Randy Dunlap 2006-06-25 525 * fe96e57d77481c Randy Dunlap 2006-06-25 526 * Continue to iterate over list of given type, continuing after fe96e57d77481c Randy Dunlap 2006-06-25 527 * the current position. ^1da177e4c3f41 Linus Torvalds 2005-04-16 528 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 529 #define list_for_each_entry_continue(pos, head, member) \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 530 for (pos = list_next_entry(pos, member); \ e66eed651fd18a Linus Torvalds 2011-05-19 531 &pos->member != (head); \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 532 pos = list_next_entry(pos, member)) ^1da177e4c3f41 Linus Torvalds 2005-04-16 533 768f3591e2b1cc Pavel Emelyanov 2007-09-18 534 /** 768f3591e2b1cc Pavel Emelyanov 2007-09-18 535 * list_for_each_entry_continue_reverse - iterate backwards from the given point 768f3591e2b1cc Pavel Emelyanov 2007-09-18 536 * @pos: the type * to use as a loop cursor. 768f3591e2b1cc Pavel Emelyanov 2007-09-18 537 * @head: the head for your list. 3943f42c11896c Andrey Utkin 2014-11-14 538 * @member: the name of the list_head within the struct. 768f3591e2b1cc Pavel Emelyanov 2007-09-18 539 * 768f3591e2b1cc Pavel Emelyanov 2007-09-18 540 * Start to iterate over list of given type backwards, continuing after 768f3591e2b1cc Pavel Emelyanov 2007-09-18 541 * the current position. 768f3591e2b1cc Pavel Emelyanov 2007-09-18 542 */ 768f3591e2b1cc Pavel Emelyanov 2007-09-18 543 #define list_for_each_entry_continue_reverse(pos, head, member) \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 544 for (pos = list_prev_entry(pos, member); \ e66eed651fd18a Linus Torvalds 2011-05-19 545 &pos->member != (head); \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 546 pos = list_prev_entry(pos, member)) 768f3591e2b1cc Pavel Emelyanov 2007-09-18 547 e229c2fb3370a0 Arnaldo Carvalho de Melo 2006-03-20 548 /** fe96e57d77481c Randy Dunlap 2006-06-25 549 * list_for_each_entry_from - iterate over list of given type from the current point 8e3a67a99231f9 Randy Dunlap 2006-06-25 550 * @pos: the type * to use as a loop cursor. e229c2fb3370a0 Arnaldo Carvalho de Melo 2006-03-20 551 * @head: the head for your list. 3943f42c11896c Andrey Utkin 2014-11-14 552 * @member: the name of the list_head within the struct. fe96e57d77481c Randy Dunlap 2006-06-25 553 * fe96e57d77481c Randy Dunlap 2006-06-25 554 * Iterate over list of given type, continuing from current position. e229c2fb3370a0 Arnaldo Carvalho de Melo 2006-03-20 555 */ e229c2fb3370a0 Arnaldo Carvalho de Melo 2006-03-20 556 #define list_for_each_entry_from(pos, head, member) \ e66eed651fd18a Linus Torvalds 2011-05-19 557 for (; &pos->member != (head); \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 558 pos = list_next_entry(pos, member)) e229c2fb3370a0 Arnaldo Carvalho de Melo 2006-03-20 559 b862815c3ee7b4 Jiri Pirko 2017-02-03 560 /** b862815c3ee7b4 Jiri Pirko 2017-02-03 561 * list_for_each_entry_from_reverse - iterate backwards over list of given type b862815c3ee7b4 Jiri Pirko 2017-02-03 562 * from the current point b862815c3ee7b4 Jiri Pirko 2017-02-03 563 * @pos: the type * to use as a loop cursor. b862815c3ee7b4 Jiri Pirko 2017-02-03 564 * @head: the head for your list. b862815c3ee7b4 Jiri Pirko 2017-02-03 565 * @member: the name of the list_head within the struct. b862815c3ee7b4 Jiri Pirko 2017-02-03 566 * b862815c3ee7b4 Jiri Pirko 2017-02-03 567 * Iterate backwards over list of given type, continuing from current position. b862815c3ee7b4 Jiri Pirko 2017-02-03 568 */ b862815c3ee7b4 Jiri Pirko 2017-02-03 569 #define list_for_each_entry_from_reverse(pos, head, member) \ b862815c3ee7b4 Jiri Pirko 2017-02-03 570 for (; &pos->member != (head); \ b862815c3ee7b4 Jiri Pirko 2017-02-03 571 pos = list_prev_entry(pos, member)) b862815c3ee7b4 Jiri Pirko 2017-02-03 572 ^1da177e4c3f41 Linus Torvalds 2005-04-16 573 /** ^1da177e4c3f41 Linus Torvalds 2005-04-16 574 * list_for_each_entry_safe - iterate over list of given type safe against removal of list entry 8e3a67a99231f9 Randy Dunlap 2006-06-25 575 * @pos: the type * to use as a loop cursor. ^1da177e4c3f41 Linus Torvalds 2005-04-16 576 * @n: another type * to use as temporary storage ^1da177e4c3f41 Linus Torvalds 2005-04-16 577 * @head: the head for your list. 3943f42c11896c Andrey Utkin 2014-11-14 578 * @member: the name of the list_head within the struct. ^1da177e4c3f41 Linus Torvalds 2005-04-16 579 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 580 #define list_for_each_entry_safe(pos, n, head, member) \ 93be3c2eb3371f Oleg Nesterov 2013-11-12 581 for (pos = list_first_entry(head, typeof(*pos), member), \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 582 n = list_next_entry(pos, member); \ ^1da177e4c3f41 Linus Torvalds 2005-04-16 @583 &pos->member != (head); \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 584 pos = n, n = list_next_entry(n, member)) ^1da177e4c3f41 Linus Torvalds 2005-04-16 585 :::::: The code at line 583 was first introduced by commit :::::: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Linux-2.6.12-rc2 :::::: TO: Linus Torvalds <torvalds(a)ppc970.osdl.org> :::::: CC: Linus Torvalds <torvalds(a)ppc970.osdl.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] usb: dwc3: gadget: Fix looping of queued SG entries
by Tirui Yin 17 Jan '25

17 Jan '25

From: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> stable inclusion from stable-v6.6.64 commit 1534f6f69393aac773465d80d31801b554352627 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDP9 CVE: CVE-2024-56698 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b7fc65f5141c24785dc8c19249ca4efcf71b3524 upstream. The dwc3_request->num_queued_sgs is decremented on completion. If a partially completed request is handled, then the dwc3_request->num_queued_sgs no longer reflects the total number of num_queued_sgs (it would be cleared). Correctly check the number of request SG entries remained to be prepare and queued. Failure to do this may cause null pointer dereference when accessing non-existent SG entry. Cc: stable(a)vger.kernel.org Fixes: c96e6725db9d ("usb: dwc3: gadget: Correct the logic for queuing sgs") Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Link: https://lore.kernel.org/r/d07a7c4aa0fcf746cdca0515150dbe5c52000af7.17315457… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/usb/dwc3/gadget.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 867000cdeb96..e7f6be12e401 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -1433,8 +1433,8 @@ static int dwc3_prepare_trbs_sg(struct dwc3_ep *dep, struct scatterlist *s; int i; unsigned int length = req->request.length; - unsigned int remaining = req->request.num_mapped_sgs - - req->num_queued_sgs; + unsigned int remaining = req->num_pending_sgs; + unsigned int num_queued_sgs = req->request.num_mapped_sgs - remaining; unsigned int num_trbs = req->num_trbs; bool needs_extra_trb = dwc3_needs_extra_trb(dep, req); @@ -1442,7 +1442,7 @@ static int dwc3_prepare_trbs_sg(struct dwc3_ep *dep, * If we resume preparing the request, then get the remaining length of * the request and resume where we left off. */ - for_each_sg(req->request.sg, s, req->num_queued_sgs, i) + for_each_sg(req->request.sg, s, num_queued_sgs, i) length -= sg_dma_len(s); for_each_sg(sg, s, remaining, i) { -- 2.22.0

2 1

[PATCH OLK-6.6] f2fs: fix to shrink read extent node in batches
by Yi Yang 17 Jan '25

17 Jan '25

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.6.66 commit 295b50e95e900da31ff237e46e04525fa799b2cf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHYTM CVE: CVE-2024-41935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3fc5d5a182f6a1f8bd4dc775feb54c369dd2c343 ] We use rwlock to protect core structure data of extent tree during its shrink, however, if there is a huge number of extent nodes in extent tree, during shrink of extent tree, it may hold rwlock for a very long time, which may trigger kernel hang issue. This patch fixes to shrink read extent node in batches, so that, critical region of the rwlock can be shrunk to avoid its extreme long time hold. Reported-by: Xiuhong Wang <xiuhong.wang(a)unisoc.com> Closes: https://lore.kernel.org/linux-f2fs-devel/20241112110627.1314632-1-xiuhong.w… Signed-off-by: Xiuhong Wang <xiuhong.wang(a)unisoc.com> Signed-off-by: Zhiguo Niu <zhiguo.niu(a)unisoc.com> Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- fs/f2fs/extent_cache.c | 69 +++++++++++++++++++++++++----------------- 1 file changed, 41 insertions(+), 28 deletions(-) diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c index d6fb053b6dfb..bfa2d89dc9ea 100644 --- a/fs/f2fs/extent_cache.c +++ b/fs/f2fs/extent_cache.c @@ -347,21 +347,22 @@ static struct extent_tree *__grab_extent_tree(struct inode *inode, } static unsigned int __free_extent_tree(struct f2fs_sb_info *sbi, - struct extent_tree *et) + struct extent_tree *et, unsigned int nr_shrink) { struct rb_node *node, *next; struct extent_node *en; - unsigned int count = atomic_read(&et->node_cnt); + unsigned int count; node = rb_first_cached(&et->root); - while (node) { + + for (count = 0; node && count < nr_shrink; count++) { next = rb_next(node); en = rb_entry(node, struct extent_node, rb_node); __release_extent_node(sbi, et, en); node = next; } - return count - atomic_read(&et->node_cnt); + return count; } static void __drop_largest_extent(struct extent_tree *et, @@ -580,6 +581,30 @@ static struct extent_node *__insert_extent_tree(struct f2fs_sb_info *sbi, return en; } +static unsigned int __destroy_extent_node(struct inode *inode, + enum extent_type type) +{ + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct extent_tree *et = F2FS_I(inode)->extent_tree[type]; + unsigned int nr_shrink = type == EX_READ ? + READ_EXTENT_CACHE_SHRINK_NUMBER : + AGE_EXTENT_CACHE_SHRINK_NUMBER; + unsigned int node_cnt = 0; + + if (!et || !atomic_read(&et->node_cnt)) + return 0; + + while (atomic_read(&et->node_cnt)) { + write_lock(&et->lock); + node_cnt += __free_extent_tree(sbi, et, nr_shrink); + write_unlock(&et->lock); + } + + f2fs_bug_on(sbi, atomic_read(&et->node_cnt)); + + return node_cnt; +} + static void __update_extent_tree_range(struct inode *inode, struct extent_info *tei, enum extent_type type) { @@ -718,9 +743,6 @@ static void __update_extent_tree_range(struct inode *inode, } } - if (is_inode_flag_set(inode, FI_NO_EXTENT)) - __free_extent_tree(sbi, et); - if (et->largest_updated) { et->largest_updated = false; updated = true; @@ -738,6 +760,9 @@ static void __update_extent_tree_range(struct inode *inode, out_read_extent_cache: write_unlock(&et->lock); + if (is_inode_flag_set(inode, FI_NO_EXTENT)) + __destroy_extent_node(inode, EX_READ); + if (updated) f2fs_mark_inode_dirty_sync(inode, true); } @@ -902,10 +927,14 @@ static unsigned int __shrink_extent_tree(struct f2fs_sb_info *sbi, int nr_shrink list_for_each_entry_safe(et, next, &eti->zombie_list, list) { if (atomic_read(&et->node_cnt)) { write_lock(&et->lock); - node_cnt += __free_extent_tree(sbi, et); + node_cnt += __free_extent_tree(sbi, et, + nr_shrink - node_cnt - tree_cnt); write_unlock(&et->lock); } - f2fs_bug_on(sbi, atomic_read(&et->node_cnt)); + + if (atomic_read(&et->node_cnt)) + goto unlock_out; + list_del_init(&et->list); radix_tree_delete(&eti->extent_tree_root, et->ino); kmem_cache_free(extent_tree_slab, et); @@ -1044,23 +1073,6 @@ unsigned int f2fs_shrink_age_extent_tree(struct f2fs_sb_info *sbi, int nr_shrink return __shrink_extent_tree(sbi, nr_shrink, EX_BLOCK_AGE); } -static unsigned int __destroy_extent_node(struct inode *inode, - enum extent_type type) -{ - struct f2fs_sb_info *sbi = F2FS_I_SB(inode); - struct extent_tree *et = F2FS_I(inode)->extent_tree[type]; - unsigned int node_cnt = 0; - - if (!et || !atomic_read(&et->node_cnt)) - return 0; - - write_lock(&et->lock); - node_cnt = __free_extent_tree(sbi, et); - write_unlock(&et->lock); - - return node_cnt; -} - void f2fs_destroy_extent_node(struct inode *inode) { __destroy_extent_node(inode, EX_READ); @@ -1069,7 +1081,6 @@ void f2fs_destroy_extent_node(struct inode *inode) static void __drop_extent_tree(struct inode *inode, enum extent_type type) { - struct f2fs_sb_info *sbi = F2FS_I_SB(inode); struct extent_tree *et = F2FS_I(inode)->extent_tree[type]; bool updated = false; @@ -1077,7 +1088,6 @@ static void __drop_extent_tree(struct inode *inode, enum extent_type type) return; write_lock(&et->lock); - __free_extent_tree(sbi, et); if (type == EX_READ) { set_inode_flag(inode, FI_NO_EXTENT); if (et->largest.len) { @@ -1086,6 +1096,9 @@ static void __drop_extent_tree(struct inode *inode, enum extent_type type) } } write_unlock(&et->lock); + + __destroy_extent_node(inode, type); + if (updated) f2fs_mark_inode_dirty_sync(inode, true); } -- 2.25.1

2 1

[PATCH OLK-6.6] Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
by Tirui Yin 17 Jan '25

17 Jan '25

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.6.66 commit 5e50d12cc6e95e1fde08f5db6992b616f714b0fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANH CVE: CVE-2024-56590 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3fe288a8214e7dd784d1f9b7c9e448244d316b47 ] This fixes not checking if skb really contains an ACL header otherwise the code may attempt to access some uninitilized/invalid memory past the valid skb->data. Reported-by: syzbot+6ea290ba76d8c1eb1ac2(a)syzkaller.appspotmail.com Tested-by: syzbot+6ea290ba76d8c1eb1ac2(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2 Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/bluetooth/hci_core.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index d4e607bf35ba..b04e70aa1a86 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3735,18 +3735,22 @@ static void hci_tx_work(struct work_struct *work) /* ACL data packet */ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) { - struct hci_acl_hdr *hdr = (void *) skb->data; + struct hci_acl_hdr *hdr; struct hci_conn *conn; __u16 handle, flags; - skb_pull(skb, HCI_ACL_HDR_SIZE); + hdr = skb_pull_data(skb, sizeof(*hdr)); + if (!hdr) { + bt_dev_err(hdev, "ACL packet too small"); + goto drop; + } handle = __le16_to_cpu(hdr->handle); flags = hci_flags(handle); handle = hci_handle(handle); - BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len, - handle, flags); + bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len, + handle, flags); hdev->stat.acl_rx++; @@ -3767,6 +3771,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) handle); } +drop: kfree_skb(skb); } -- 2.22.0

2 1

[PATCH OLK-5.10] um: Fix potential integer overflow during physmem setup
by Tirui Yin 17 Jan '25

17 Jan '25

From: Tiwei Bie <tiwei.btw(a)antgroup.com> stable inclusion from stable-v5.10.231 commit e6102b72edc4eb8c0858df00ba74b5ce579c8fa2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGO CVE: CVE-2024-53145 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a98b7761f697e590ed5d610d87fa12be66f23419 ] This issue happens when the real map size is greater than LONG_MAX, which can be easily triggered on UML/i386. Fixes: fe205bdd1321 ("um: Print minimum physical memory requirement") Signed-off-by: Tiwei Bie <tiwei.btw(a)antgroup.com> Link: https://patch.msgid.link/20240916045950.508910-3-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/um/kernel/physmem.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/um/kernel/physmem.c b/arch/um/kernel/physmem.c index e7c7b53a1435..87b51089b061 100644 --- a/arch/um/kernel/physmem.c +++ b/arch/um/kernel/physmem.c @@ -80,10 +80,10 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end, unsigned long len, unsigned long long highmem) { unsigned long reserve = reserve_end - start; - long map_size = len - reserve; + unsigned long map_size = len - reserve; int err; - if(map_size <= 0) { + if (len <= reserve) { os_warn("Too few physical memory! Needed=%lu, given=%lu\n", reserve, len); exit(1); @@ -94,7 +94,7 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end, err = os_map_memory((void *) reserve_end, physmem_fd, reserve, map_size, 1, 1, 1); if (err < 0) { - os_warn("setup_physmem - mapping %ld bytes of memory at 0x%p " + os_warn("setup_physmem - mapping %lu bytes of memory at 0x%p " "failed - errno = %d\n", map_size, (void *) reserve_end, err); exit(1); -- 2.22.0

2 1

[PATCH OLK-6.6] um: Fix potential integer overflow during physmem setup
by Tirui Yin 17 Jan '25

17 Jan '25

From: Tiwei Bie <tiwei.btw(a)antgroup.com> stable inclusion from stable-v6.6.64 commit a875c023155ea92b75d6323977003e64d92ae7fc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGO CVE: CVE-2024-53145 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a98b7761f697e590ed5d610d87fa12be66f23419 ] This issue happens when the real map size is greater than LONG_MAX, which can be easily triggered on UML/i386. Fixes: fe205bdd1321 ("um: Print minimum physical memory requirement") Signed-off-by: Tiwei Bie <tiwei.btw(a)antgroup.com> Link: https://patch.msgid.link/20240916045950.508910-3-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/um/kernel/physmem.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/um/kernel/physmem.c b/arch/um/kernel/physmem.c index 91485119ae67..4339580f5a4f 100644 --- a/arch/um/kernel/physmem.c +++ b/arch/um/kernel/physmem.c @@ -80,10 +80,10 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end, unsigned long len, unsigned long long highmem) { unsigned long reserve = reserve_end - start; - long map_size = len - reserve; + unsigned long map_size = len - reserve; int err; - if(map_size <= 0) { + if (len <= reserve) { os_warn("Too few physical memory! Needed=%lu, given=%lu\n", reserve, len); exit(1); @@ -94,7 +94,7 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end, err = os_map_memory((void *) reserve_end, physmem_fd, reserve, map_size, 1, 1, 1); if (err < 0) { - os_warn("setup_physmem - mapping %ld bytes of memory at 0x%p " + os_warn("setup_physmem - mapping %lu bytes of memory at 0x%p " "failed - errno = %d\n", map_size, (void *) reserve_end, err); exit(1); -- 2.22.0

2 1

[PATCH OLK-6.6] net: renesas: rswitch: avoid use-after-put for a device tree node
by Bowen You 17 Jan '25

17 Jan '25

From: Nikita Yushchenko <nikita.yoush(a)cogentembedded.com> stable inclusion from stable-v6.6.67 commit bf8c6755f02029d1eddc3ff19b870240f054afc7 category: bugfix bugzilla: 190470 CVE: CVE-2024-55639 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 66b7e9f85b8459c823b11e9af69dbf4be5eb6be8 ] The device tree node saved in the rswitch_device structure is used at several driver locations. So passing this node to of_node_put() after the first use is wrong. Move of_node_put() for this node to exit paths. Fixes: b46f1e579329 ("net: renesas: rswitch: Simplify struct phy * handling") Signed-off-by: Nikita Yushchenko <nikita.yoush(a)cogentembedded.com> Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> Link: https://patch.msgid.link/20241208095004.69468-5-nikita.yoush@cogentembedded… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/net/ethernet/renesas/rswitch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index ae9d8722b76f..5e3c0e24a1bc 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1741,7 +1741,6 @@ static int rswitch_device_alloc(struct rswitch_private *priv, int index) rdev->np_port = rswitch_get_port_node(rdev); rdev->disabled = !rdev->np_port; err = of_get_ethdev_address(rdev->np_port, ndev); - of_node_put(rdev->np_port); if (err) { if (is_valid_ether_addr(rdev->etha->mac_addr)) eth_hw_addr_set(ndev, rdev->etha->mac_addr); @@ -1771,6 +1770,7 @@ static int rswitch_device_alloc(struct rswitch_private *priv, int index) out_rxdmac: out_get_params: + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); @@ -1784,6 +1784,7 @@ static void rswitch_device_free(struct rswitch_private *priv, int index) rswitch_txdmac_free(ndev); rswitch_rxdmac_free(ndev); + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); } -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS WITH WARNING 08e54ea5e4a4948874ca30d91be3e5cca4ecbeec
by kernel test robot 17 Jan '25

17 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 08e54ea5e4a4948874ca30d91be3e5cca4ecbeec !14862 drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501170155.aI4YWysc-lkp@intel.com include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-001-20250117 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- arm64-randconfig-004-20250117 | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr | |-- fs-fscache-main.c:warning:fscache_min_object_max_active-defined-but-not-used | `-- fs-fscache-main.c:warning:fscache_min_op_max_active-defined-but-not-used |-- arm64-randconfig-054-20250117 | `-- from-schema-id:http:devicetree.org-meta-schemas-base.yaml-Documentation-devicetree-bindings-net-ti-k3-am654-cpsw-nuss.yaml:properties:compatible:oneOf:const:ti-am654-cpsw-nuss-const:ti-j721e-cpsw-nuss |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | `-- samples-bpf-hbm.c:bpf-bpf.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-001-20250117 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr | |-- fs-fscache-main.c:warning:fscache_min_object_max_active-defined-but-not-used | `-- fs-fscache-main.c:warning:fscache_min_op_max_active-defined-but-not-used |-- x86_64-buildonly-randconfig-002-20250117 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr | |-- fs-fscache-main.c:warning:fscache_min_object_max_active-defined-but-not-used | `-- fs-fscache-main.c:warning:fscache_min_op_max_active-defined-but-not-used |-- x86_64-buildonly-randconfig-003-20250117 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-fscache-main.c:warning:fscache_min_object_max_active-defined-but-not-used | `-- fs-fscache-main.c:warning:fscache_min_op_max_active-defined-but-not-used |-- x86_64-buildonly-randconfig-004-20250117 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data `-- x86_64-buildonly-randconfig-005-20250117 |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- fs-cachefiles-ondemand.c:warning:implicit-conversion-from-enum-cachefiles_obj_ref_trace-to-enum-fscache_obj_ref_trace |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr elapsed time: 731m configs tested: 15 configs skipped: 102 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250117 gcc-14.2.0 arm64 randconfig-002-20250117 clang-18 arm64 randconfig-003-20250117 clang-20 arm64 randconfig-004-20250117 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250117 gcc-12 x86_64 buildonly-randconfig-002-20250117 gcc-12 x86_64 buildonly-randconfig-003-20250117 gcc-12 x86_64 buildonly-randconfig-004-20250117 gcc-12 x86_64 buildonly-randconfig-005-20250117 gcc-12 x86_64 buildonly-randconfig-006-20250117 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2707/2707] include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function
by kernel test robot 17 Jan '25

17 Jan '25

Hi wangyigen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 08e54ea5e4a4948874ca30d91be3e5cca4ecbeec commit: 13e5c52d7cec7621f78bce452b78785e689ed0b2 [2707/2707] cgroup_writeback: bind blkcg and memcg config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20250117/202501170155.aI4YWysc-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250117/202501170155.aI4YWysc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501170155.aI4YWysc-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/filemap.c:15: In file included from include/linux/dax.h:6: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/filemap.c:32: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ mm/filemap.c:823:14: warning: no previous prototype for function '__add_to_page_cache_locked' [-Wmissing-prototypes] 823 | noinline int __add_to_page_cache_locked(struct page *page, | ^ mm/filemap.c:823:10: note: declare 'static' if the function is not intended to be used outside of this translation unit 823 | noinline int __add_to_page_cache_locked(struct page *page, | ^ | static 3 warnings generated. -- In file included from mm/fadvise.c:14: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/fadvise.c:16: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ 2 warnings generated. -- In file included from mm/page-writeback.c:19: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/page-writeback.c:25: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ In file included from mm/page-writeback.c:40: include/linux/mm_inline.h:34:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:36:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 36 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ 4 warnings generated. -- In file included from mm/swap.c:17: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/swap.c:26: include/linux/mm_inline.h:34:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:36:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 36 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ In file included from mm/swap.c:32: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ 4 warnings generated. -- In file included from mm/vmscan.c:17: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/vmscan.c:33: include/linux/mm_inline.h:34:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:36:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 36 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ In file included from mm/vmscan.c:34: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ mm/vmscan.c:569:51: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 569 | size += zone_page_state(zone, NR_ZONE_LRU_BASE + lru); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/vmscan.c:1936:4: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 1936 | __count_zid_vm_events(PGSCAN_SKIP, zid, nr_skipped[zid]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/vmscan.c:2430:51: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 2430 | inactive = lruvec_page_state(lruvec, NR_LRU_BASE + inactive_lru); | ~~~~~~~~~~~ ^ ~~~~~~~~~~~~ mm/vmscan.c:2431:49: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 2431 | active = lruvec_page_state(lruvec, NR_LRU_BASE + active_lru); | ~~~~~~~~~~~ ^ ~~~~~~~~~~ mm/vmscan.c:3263:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3263 | __count_zid_vm_events(ALLOCSTALL, sc->reclaim_idx, 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ 9 warnings generated. -- In file included from mm/page_alloc.c:19: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/page_alloc.c:50: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ In file included from mm/page_alloc.c:59: include/linux/mm_inline.h:34:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:36:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 36 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/page_alloc.c:2609:5: warning: no previous prototype for function 'find_suitable_fallback' [-Wmissing-prototypes] 2609 | int find_suitable_fallback(struct free_area *area, unsigned int order, | ^ mm/page_alloc.c:2609:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2609 | int find_suitable_fallback(struct free_area *area, unsigned int order, | ^ | static mm/page_alloc.c:3040:6: warning: no previous prototype for function '__drain_all_pages' [-Wmissing-prototypes] 3040 | void __drain_all_pages(struct zone *zone, bool force_all_cpus) | ^ mm/page_alloc.c:3040:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3040 | void __drain_all_pages(struct zone *zone, bool force_all_cpus) | ^ | static mm/page_alloc.c:3449:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3449 | __count_zid_vm_events(PGALLOC, page_zonenum(page), 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/page_alloc.c:3510:2: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3510 | __count_zid_vm_events(PGALLOC, page_zonenum(page), 1 << order); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/page_alloc.c:3603:15: warning: no previous prototype for function 'should_fail_alloc_page' [-Wmissing-prototypes] 3603 | noinline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) | ^ mm/page_alloc.c:3603:10: note: declare 'static' if the function is not intended to be used outside of this translation unit 3603 | noinline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) | ^ | static mm/page_alloc.c:5221:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 5221 | __count_zid_vm_events(PGALLOC, zone_idx(zone), 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/page_alloc.c:6753:20: warning: no previous prototype for function 'memmap_init' [-Wmissing-prototypes] 6753 | void __init __weak memmap_init(void) | ^ mm/page_alloc.c:6753:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6753 | void __init __weak memmap_init(void) | ^ | static mm/page_alloc.c:6791:23: warning: no previous prototype for function 'arch_memmap_init' [-Wmissing-prototypes] 6791 | void __meminit __weak arch_memmap_init(unsigned long size, int nid, | ^ mm/page_alloc.c:6791:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6791 | void __meminit __weak arch_memmap_init(unsigned long size, int nid, | ^ | static mm/page_alloc.c:6909:6: warning: no previous prototype for function '__zone_set_pageset_high_and_batch' [-Wmissing-prototypes] 6909 | void __zone_set_pageset_high_and_batch(struct zone *zone, unsigned long high, | ^ mm/page_alloc.c:6909:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6909 | void __zone_set_pageset_high_and_batch(struct zone *zone, unsigned long high, | ^ | static 13 warnings generated. vim +418 include/linux/backing-dev.h 417 > 418 static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, 419 struct css_set *cset) 420 { 421 } 422 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
by GONG Ruiqi 16 Jan '25

16 Jan '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.13-rc1 commit e56aac6e5a25630645607b6856d4b2a17b2311a5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFV CVE: CVE-2024-53203 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The "command" variable can be controlled by the user via debugfs. The worry is that if con_index is zero then "&uc->ucsi->connector[con_index - 1]" would be an array underflow. Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://lore.kernel.org/r/c69ef0b3-61b0-4dde-98dd-97b97f81d912@stanley.moun… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/typec/ucsi/ucsi_ccg.c [It comes from two reasons: 1. the lack of commit 13f2ec3115c8, which refactors ucsi_ccg_sync_write() to ucsi_ccg_sync_control(); 2. a possible error within the original upstream patch, causing the imbalance of pm_runtime_{get,put}_sync().] Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- drivers/usb/typec/ucsi/ucsi_ccg.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c index cf3c8e552def..acbc4def45e6 100644 --- a/drivers/usb/typec/ucsi/ucsi_ccg.c +++ b/drivers/usb/typec/ucsi/ucsi_ccg.c @@ -585,6 +585,10 @@ static int ucsi_ccg_sync_write(struct ucsi *ucsi, unsigned int offset, uc->has_multiple_dp) { con_index = (uc->last_cmd_sent >> 16) & UCSI_CMD_CONNECTOR_MASK; + if (con_index == 0) { + ret = -EINVAL; + goto err_clear_bit; + } con = &uc->ucsi->connector[con_index - 1]; ucsi_ccg_update_set_new_cam_cmd(uc, con, (u64 *)val); } -- 2.25.1

2 1

[PATCH OLK-6.6] btrfs: don't take dev_replace rwsem on task already holding it
by Yifan Qiao 16 Jan '25

16 Jan '25

From: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> mainline inclusion from mainline-v6.11-rc6 commit 8cca35cb29f81eba3e96ec44dad8696c8a2f9138 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHLEX CVE: CVE-2024-48875 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Running fstests btrfs/011 with MKFS_OPTIONS="-O rst" to force the usage of the RAID stripe-tree, we get the following splat from lockdep: BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started ============================================ WARNING: possible recursive locking detected 6.11.0-rc3-btrfs-for-next #599 Not tainted -------------------------------------------- btrfs/2326 is trying to acquire lock: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250 but task is already holding lock: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&fs_info->dev_replace.rwsem); lock(&fs_info->dev_replace.rwsem); *** DEADLOCK *** May be due to missing lock nesting notation 1 lock held by btrfs/2326: #0: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250 stack backtrace: CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0x5b/0x80 __lock_acquire+0x2798/0x69d0 ? __pfx___lock_acquire+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 lock_acquire+0x19d/0x4a0 ? btrfs_map_block+0x39f/0x2250 ? __pfx_lock_acquire+0x10/0x10 ? find_held_lock+0x2d/0x110 ? lock_is_held_type+0x8f/0x100 down_read+0x8e/0x440 ? btrfs_map_block+0x39f/0x2250 ? __pfx_down_read+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 btrfs_map_block+0x39f/0x2250 ? btrfs_dev_replace_by_ioctl+0xd69/0x1d00 ? btrfs_bio_counter_inc_blocked+0xd9/0x2e0 ? __kasan_slab_alloc+0x6e/0x70 ? __pfx_btrfs_map_block+0x10/0x10 ? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10 ? kmem_cache_alloc_noprof+0x1f2/0x300 ? mempool_alloc_noprof+0xed/0x2b0 btrfs_submit_chunk+0x28d/0x17e0 ? __pfx_btrfs_submit_chunk+0x10/0x10 ? bvec_alloc+0xd7/0x1b0 ? bio_add_folio+0x171/0x270 ? __pfx_bio_add_folio+0x10/0x10 ? __kasan_check_read+0x20/0x20 btrfs_submit_bio+0x37/0x80 read_extent_buffer_pages+0x3df/0x6c0 btrfs_read_extent_buffer+0x13e/0x5f0 read_tree_block+0x81/0xe0 read_block_for_search+0x4bd/0x7a0 ? __pfx_read_block_for_search+0x10/0x10 btrfs_search_slot+0x78d/0x2720 ? __pfx_btrfs_search_slot+0x10/0x10 ? lock_is_held_type+0x8f/0x100 ? kasan_save_track+0x14/0x30 ? __kasan_slab_alloc+0x6e/0x70 ? kmem_cache_alloc_noprof+0x1f2/0x300 btrfs_get_raid_extent_offset+0x181/0x820 ? __pfx_lock_acquire+0x10/0x10 ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10 ? down_read+0x194/0x440 ? __pfx_down_read+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 btrfs_map_block+0x5b5/0x2250 ? __pfx_btrfs_map_block+0x10/0x10 scrub_submit_initial_read+0x8fe/0x11b0 ? __pfx_scrub_submit_initial_read+0x10/0x10 submit_initial_group_read+0x161/0x3a0 ? lock_release+0x20e/0x710 ? __pfx_submit_initial_group_read+0x10/0x10 ? __pfx_lock_release+0x10/0x10 scrub_simple_mirror.isra.0+0x3eb/0x580 scrub_stripe+0xe4d/0x1440 ? lock_release+0x20e/0x710 ? __pfx_scrub_stripe+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 scrub_chunk+0x257/0x4a0 scrub_enumerate_chunks+0x64c/0xf70 ? __mutex_unlock_slowpath+0x147/0x5f0 ? __pfx_scrub_enumerate_chunks+0x10/0x10 ? bit_wait_timeout+0xb0/0x170 ? __up_read+0x189/0x700 ? scrub_workers_get+0x231/0x300 ? up_write+0x490/0x4f0 btrfs_scrub_dev+0x52e/0xcd0 ? create_pending_snapshots+0x230/0x250 ? __pfx_btrfs_scrub_dev+0x10/0x10 btrfs_dev_replace_by_ioctl+0xd69/0x1d00 ? lock_acquire+0x19d/0x4a0 ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10 ? lock_release+0x20e/0x710 ? btrfs_ioctl+0xa09/0x74f0 ? __pfx_lock_release+0x10/0x10 ? do_raw_spin_lock+0x11e/0x240 ? __pfx_do_raw_spin_lock+0x10/0x10 btrfs_ioctl+0xa14/0x74f0 ? lock_acquire+0x19d/0x4a0 ? find_held_lock+0x2d/0x110 ? __pfx_btrfs_ioctl+0x10/0x10 ? lock_release+0x20e/0x710 ? do_sigaction+0x3f0/0x860 ? __pfx_do_vfs_ioctl+0x10/0x10 ? do_raw_spin_lock+0x11e/0x240 ? lockdep_hardirqs_on_prepare+0x270/0x3e0 ? _raw_spin_unlock_irq+0x28/0x50 ? do_sigaction+0x3f0/0x860 ? __pfx_do_sigaction+0x10/0x10 ? __x64_sys_rt_sigaction+0x18e/0x1e0 ? __pfx___x64_sys_rt_sigaction+0x10/0x10 ? __x64_sys_close+0x7c/0xd0 __x64_sys_ioctl+0x137/0x190 do_syscall_64+0x71/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f0bd1114f9b Code: Unable to access opcode bytes at 0x7f0bd1114f71. RSP: 002b:00007ffc8a8c3130 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f0bd1114f9b RDX: 00007ffc8a8c35e0 RSI: 00000000ca289435 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000007 R10: 0000000000000008 R11: 0000000000000246 R12: 00007ffc8a8c6c85 R13: 00000000398e72a0 R14: 0000000000004361 R15: 0000000000000004 </TASK> This happens because on RAID stripe-tree filesystems we recurse back into btrfs_map_block() on scrub to perform the logical to device physical mapping. But as the device replace task is already holding the dev_replace::rwsem we deadlock. So don't take the dev_replace::rwsem in case our task is the task performing the device replace. Suggested-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/fs.h | 2 ++ fs/btrfs/dev-replace.c | 2 ++ fs/btrfs/volumes.c | 8 +++++--- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/btrfs/fs.h b/fs/btrfs/fs.h index a523d64d5491..d24d41f7811a 100644 --- a/fs/btrfs/fs.h +++ b/fs/btrfs/fs.h @@ -271,6 +271,8 @@ struct btrfs_dev_replace { struct percpu_counter bio_counter; wait_queue_head_t replace_wait; + + struct task_struct *replace_task; }; /* diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c index f87e6ba66462..df230ddf71fc 100644 --- a/fs/btrfs/dev-replace.c +++ b/fs/btrfs/dev-replace.c @@ -646,6 +646,7 @@ static int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info, return ret; down_write(&dev_replace->rwsem); + dev_replace->replace_task = current; switch (dev_replace->replace_state) { case BTRFS_IOCTL_DEV_REPLACE_STATE_NEVER_STARTED: case BTRFS_IOCTL_DEV_REPLACE_STATE_FINISHED: @@ -978,6 +979,7 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info, list_add(&tgt_device->dev_alloc_list, &fs_devices->alloc_list); fs_devices->rw_devices++; + dev_replace->replace_task = NULL; up_write(&dev_replace->rwsem); btrfs_rm_dev_replace_blocked(fs_info); diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index 093c5a3ef079..7436044549cf 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -6317,13 +6317,15 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op, &stripe_offset, &raid56_full_stripe_start); *length = min_t(u64, em->len - map_offset, max_len); - down_read(&dev_replace->rwsem); + if (dev_replace->replace_task != current) + down_read(&dev_replace->rwsem); + dev_replace_is_ongoing = btrfs_dev_replace_is_ongoing(dev_replace); /* * Hold the semaphore for read during the whole operation, write is * requested at commit time but must wait. */ - if (!dev_replace_is_ongoing) + if (!dev_replace_is_ongoing && dev_replace->replace_task != current) up_read(&dev_replace->rwsem); num_stripes = 1; @@ -6513,7 +6515,7 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op, bioc->mirror_num = mirror_num; out: - if (dev_replace_is_ongoing) { + if (dev_replace_is_ongoing && dev_replace->replace_task != current) { lockdep_assert_held(&dev_replace->rwsem); /* Unlock and let waiting writers proceed */ up_read(&dev_replace->rwsem); -- 2.39.2

2 1

[PATCH OLK-6.6] pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
by Pu Lehui 16 Jan '25

16 Jan '25

From: Evgenii Shatokhin <e.shatokhin(a)yadro.com> stable inclusion from stable-v6.6.70 commit 8c6fd5803b988a5e78c9b9e42c70a936d7cfc6ec category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBI4HE CVE: CVE-2024-57889 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a37eecb705f33726f1fb7cd2a67e514a15dfe693 upstream. If a device uses MCP23xxx IO expander to receive IRQs, the following bug can happen: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, ... preempt_count: 1, expected: 0 ... Call Trace: ... __might_resched+0x104/0x10e __might_sleep+0x3e/0x62 mutex_lock+0x20/0x4c regmap_lock_mutex+0x10/0x18 regmap_update_bits_base+0x2c/0x66 mcp23s08_irq_set_type+0x1ae/0x1d6 __irq_set_trigger+0x56/0x172 __setup_irq+0x1e6/0x646 request_threaded_irq+0xb6/0x160 ... We observed the problem while experimenting with a touchscreen driver which used MCP23017 IO expander (I2C). The regmap in the pinctrl-mcp23s08 driver uses a mutex for protection from concurrent accesses, which is the default for regmaps without .fast_io, .disable_locking, etc. mcp23s08_irq_set_type() calls regmap_update_bits_base(), and the latter locks the mutex. However, __setup_irq() locks desc->lock spinlock before calling these functions. As a result, the system tries to lock the mutex whole holding the spinlock. It seems, the internal regmap locks are not needed in this driver at all. mcp->lock seems to protect the regmap from concurrent accesses already, except, probably, in mcp_pinconf_get/set. mcp23s08_irq_set_type() and mcp23s08_irq_mask/unmask() are called under chip_bus_lock(), which calls mcp23s08_irq_bus_lock(). The latter takes mcp->lock and enables regmap caching, so that the potentially slow I2C accesses are deferred until chip_bus_unlock(). The accesses to the regmap from mcp23s08_probe_one() do not need additional locking. In all remaining places where the regmap is accessed, except mcp_pinconf_get/set(), the driver already takes mcp->lock. This patch adds locking in mcp_pinconf_get/set() and disables internal locking in the regmap config. Among other things, it fixes the sleeping in atomic context described above. Fixes: 8f38910ba4f6 ("pinctrl: mcp23s08: switch to regmap caching") Cc: stable(a)vger.kernel.org Signed-off-by: Evgenii Shatokhin <e.shatokhin(a)yadro.com> Link: https://lore.kernel.org/20241209074659.1442898-1-e.shatokhin@yadro.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/pinctrl/pinctrl-mcp23s08.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c index 4551575e4e7d..fd97b6ee2a8d 100644 --- a/drivers/pinctrl/pinctrl-mcp23s08.c +++ b/drivers/pinctrl/pinctrl-mcp23s08.c @@ -86,6 +86,7 @@ const struct regmap_config mcp23x08_regmap = { .num_reg_defaults = ARRAY_SIZE(mcp23x08_defaults), .cache_type = REGCACHE_FLAT, .max_register = MCP_OLAT, + .disable_locking = true, /* mcp->lock protects the regmap */ }; EXPORT_SYMBOL_GPL(mcp23x08_regmap); @@ -132,6 +133,7 @@ const struct regmap_config mcp23x17_regmap = { .num_reg_defaults = ARRAY_SIZE(mcp23x17_defaults), .cache_type = REGCACHE_FLAT, .val_format_endian = REGMAP_ENDIAN_LITTLE, + .disable_locking = true, /* mcp->lock protects the regmap */ }; EXPORT_SYMBOL_GPL(mcp23x17_regmap); @@ -228,7 +230,9 @@ static int mcp_pinconf_get(struct pinctrl_dev *pctldev, unsigned int pin, switch (param) { case PIN_CONFIG_BIAS_PULL_UP: + mutex_lock(&mcp->lock); ret = mcp_read(mcp, MCP_GPPU, &data); + mutex_unlock(&mcp->lock); if (ret < 0) return ret; status = (data & BIT(pin)) ? 1 : 0; @@ -257,7 +261,9 @@ static int mcp_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, switch (param) { case PIN_CONFIG_BIAS_PULL_UP: + mutex_lock(&mcp->lock); ret = mcp_set_bit(mcp, MCP_GPPU, pin, arg); + mutex_unlock(&mcp->lock); break; default: dev_dbg(mcp->dev, "Invalid config param %04x\n", param); -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] CVE-2024-57872
by Pu Lehui 16 Jan '25

16 Jan '25

From: Pu Lehui <pulehui(a)huaweicloud.com> Manivannan Sadhasivam (3): scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove() scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove() Uwe Kleine-König (1): scsi: ufs: Convert all platform drivers to return void drivers/ufs/host/cdns-pltfrm.c | 9 +++------ drivers/ufs/host/tc-dwc-g210-pltfrm.c | 11 +++-------- drivers/ufs/host/ti-j721e-ufs.c | 6 ++---- drivers/ufs/host/ufs-exynos.c | 9 +++------ drivers/ufs/host/ufs-hisi.c | 9 +++------ drivers/ufs/host/ufs-mediatek.c | 10 +++------- drivers/ufs/host/ufs-qcom.c | 8 +++----- drivers/ufs/host/ufs-renesas.c | 10 +++------- drivers/ufs/host/ufs-sprd.c | 10 +++------- drivers/ufs/host/ufshcd-pltfrm.c | 16 ++++++++++++++++ drivers/ufs/host/ufshcd-pltfrm.h | 1 + 11 files changed, 43 insertions(+), 56 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/4] CVE-2024-57872
by Pu Lehui 16 Jan '25

16 Jan '25

Manivannan Sadhasivam (3): scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove() scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove() Uwe Kleine-König (1): scsi: ufs: Convert all platform drivers to return void drivers/ufs/host/cdns-pltfrm.c | 9 +++------ drivers/ufs/host/tc-dwc-g210-pltfrm.c | 11 +++-------- drivers/ufs/host/ti-j721e-ufs.c | 6 ++---- drivers/ufs/host/ufs-exynos.c | 9 +++------ drivers/ufs/host/ufs-hisi.c | 9 +++------ drivers/ufs/host/ufs-mediatek.c | 10 +++------- drivers/ufs/host/ufs-qcom.c | 8 +++----- drivers/ufs/host/ufs-renesas.c | 10 +++------- drivers/ufs/host/ufs-sprd.c | 10 +++------- drivers/ufs/host/ufshcd-pltfrm.c | 16 ++++++++++++++++ drivers/ufs/host/ufshcd-pltfrm.h | 1 + 11 files changed, 43 insertions(+), 56 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] sched: qos sched support online task to preempt offline task
by He Yujie 16 Jan '25

16 Jan '25

hulk inclusion category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHNMR CVE: NA -------------------------------- Check_preempt_curr add a condition check to support online task with higher priority to preempt offline task. Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- kernel/sched/fair.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 7df2b07629c0..d8a6686774ea 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -155,6 +155,7 @@ static int hundred_thousand = 100000; static int __unthrottle_qos_cfs_rqs(int cpu); static int unthrottle_qos_cfs_rqs(int cpu); static bool qos_smt_expelled(int this_cpu); +static bool is_offline_task(struct task_struct *p); #endif #ifdef CONFIG_QOS_SCHED_SMT_EXPELLER @@ -9355,6 +9356,11 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_ if (cse_is_idle != pse_is_idle) return; +#ifdef CONFIG_QOS_SCHED + if (unlikely(is_offline_task(curr) && !is_offline_task(p))) + goto preempt; +#endif + /* * BATCH and IDLE tasks do not preempt others. */ -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] *** jffs2: Prevent rtime decompress memory corruption ***
by Yongjian Sun 16 Jan '25

16 Jan '25

*** BLURB HERE *** Kinsey Moore (1): [Backport] jffs2: Prevent rtime decompress memory corruption Richard Weinberger (1): [Backport] jffs2: Fix rtime decompressor fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.39.2

2 3

[PATCH OLK-5.10 0/2] *** jffs2: Prevent rtime decompress memory corruption ***
by Yongjian Sun 16 Jan '25

16 Jan '25

*** BLURB HERE *** Kinsey Moore (1): [Backport] jffs2: Prevent rtime decompress memory corruption Richard Weinberger (1): [Backport] jffs2: Fix rtime decompressor fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.39.2

2 3

[PATCH OLK-6.6] bpf: Check size for BTF-based ctx access of pointer members
by Tengda Wu 16 Jan '25

16 Jan '25

From: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> stable inclusion from stable-v6.6.67 commit c7e1962a3807d2a9e8c192f23cd3a55794d08f90 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBHYOV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 659b9ba7cb2d7adb64618b87ddfaa528a143766e upstream. Robert Morris reported the following program type which passes the verifier in [0]: SEC("struct_ops/bpf_cubic_init") void BPF_PROG(bpf_cubic_init, struct sock *sk) { asm volatile("r2 = *(u16*)(r1 + 0)"); // verifier should demand u64 asm volatile("*(u32 *)(r2 +1504) = 0"); // 1280 in some configs } The second line may or may not work, but the first instruction shouldn't pass, as it's a narrow load into the context structure of the struct ops callback. The code falls back to btf_ctx_access to ensure correctness and obtaining the types of pointers. Ensure that the size of the access is correctly checked to be 8 bytes, otherwise the verifier thinks the narrow load obtained a trusted BTF pointer and will permit loads/stores as it sees fit. Perform the check on size after we've verified that the load is for a pointer field, as for scalar values narrow loads are fine. Access to structs passed as arguments to a BPF program are also treated as scalars, therefore no adjustment is needed in their case. Existing verifier selftests are broken by this change, but because they were incorrect. Verifier tests for d_path were performing narrow load into context to obtain path pointer, had this program actually run it would cause a crash. The same holds for verifier_btf_ctx_access tests. [0]: https://lore.kernel.org/bpf/51338.1732985814@localhost Fixes: 9e15db66136a ("bpf: Implement accurate raw_tp context access via BTF") Reported-by: Robert Morris <rtm(a)mit.edu> Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Link: https://lore.kernel.org/r/20241212092050.3204165-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/bpf/btf.c | 6 ++++++ tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c | 4 ++-- tools/testing/selftests/bpf/progs/verifier_d_path.c | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 4299fb5b8d52..bbc99401b4e7 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -6127,6 +6127,12 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, return false; } + if (size != sizeof(u64)) { + bpf_log(log, "func '%s' size %d must be 8\n", + tname, size); + return false; + } + /* check for PTR_TO_RDONLY_BUF_OR_NULL or PTR_TO_RDWR_BUF_OR_NULL */ for (i = 0; i < prog->aux->ctx_arg_info_size; i++) { const struct bpf_ctx_arg_aux *ctx_arg_info = &prog->aux->ctx_arg_info[i]; diff --git a/tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c b/tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c index a570e48b917a..bfc3bf18fed4 100644 --- a/tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c +++ b/tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c @@ -11,7 +11,7 @@ __success __retval(0) __naked void btf_ctx_access_accept(void) { asm volatile (" \ - r2 = *(u32*)(r1 + 8); /* load 2nd argument value (int pointer) */\ + r2 = *(u64 *)(r1 + 8); /* load 2nd argument value (int pointer) */\ r0 = 0; \ exit; \ " ::: __clobber_all); @@ -23,7 +23,7 @@ __success __retval(0) __naked void ctx_access_u32_pointer_accept(void) { asm volatile (" \ - r2 = *(u32*)(r1 + 0); /* load 1nd argument value (u32 pointer) */\ + r2 = *(u64 *)(r1 + 0); /* load 1nd argument value (u32 pointer) */\ r0 = 0; \ exit; \ " ::: __clobber_all); diff --git a/tools/testing/selftests/bpf/progs/verifier_d_path.c b/tools/testing/selftests/bpf/progs/verifier_d_path.c index ec79cbcfde91..87e51a215558 100644 --- a/tools/testing/selftests/bpf/progs/verifier_d_path.c +++ b/tools/testing/selftests/bpf/progs/verifier_d_path.c @@ -11,7 +11,7 @@ __success __retval(0) __naked void d_path_accept(void) { asm volatile (" \ - r1 = *(u32*)(r1 + 0); \ + r1 = *(u64 *)(r1 + 0); \ r2 = r10; \ r2 += -8; \ r6 = 0; \ @@ -31,7 +31,7 @@ __failure __msg("helper call is not allowed in probe") __naked void d_path_reject(void) { asm volatile (" \ - r1 = *(u32*)(r1 + 0); \ + r1 = *(u64 *)(r1 + 0); \ r2 = r10; \ r2 += -8; \ r6 = 0; \ -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 077fe6dc5c97f9aae30fe6b93fcb91c7c62ccaf4
by kernel test robot 16 Jan '25

16 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 077fe6dc5c97f9aae30fe6b93fcb91c7c62ccaf4 !14663 xsk: Add generic xdp multi-buffer send support Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-002-20250115 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- fs-cachefiles-ondemand.c:warning:implicit-conversion-from-enum-cachefiles_obj_ref_trace-to-enum-fscache_obj_ref_trace | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr |-- arm64-randconfig-004-20250115 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- x86_64-allnoconfig | `-- samples-bpf-hbm.c:bpf-bpf.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-002-20250115 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | `-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character |-- x86_64-buildonly-randconfig-004-20250115 | |-- drivers-iommu-amd-iommu.o:warning:objtool:__domain_flush_pages:unreachable-instruction | `-- kernel-time-posix-cpu-timers.o:warning:objtool:run_posix_cpu_timers:unreachable-instruction |-- x86_64-buildonly-randconfig-005-20250115 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data `-- x86_64-buildonly-randconfig-006-20250115 `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data elapsed time: 778m configs tested: 15 configs skipped: 128 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250115 clang-20 arm64 randconfig-002-20250115 gcc-14.2.0 arm64 randconfig-003-20250115 clang-18 arm64 randconfig-004-20250115 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250115 gcc-12 x86_64 buildonly-randconfig-002-20250115 gcc-12 x86_64 buildonly-randconfig-003-20250115 clang-19 x86_64 buildonly-randconfig-004-20250115 clang-19 x86_64 buildonly-randconfig-005-20250115 gcc-12 x86_64 buildonly-randconfig-006-20250115 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 874edbaf1a7d11ba8ef9f03a10f8f38f09814c6a
by kernel test robot 16 Jan '25

16 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 874edbaf1a7d11ba8ef9f03a10f8f38f09814c6a !14856 sched: psi: fix bogus pressure spikes from aggregation race Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- loongarch-allmodconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allyesconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-001-20250115 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-002-20250115 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- x86_64-allnoconfig | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put `-- x86_64-buildonly-randconfig-006-20250115 `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.o:warning:objtool:.text.nbl_dev_start_user_dev:unexpected-end-of-section elapsed time: 845m configs tested: 19 configs skipped: 114 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250115 clang-20 arm64 randconfig-002-20250115 gcc-14.2.0 arm64 randconfig-003-20250115 clang-18 arm64 randconfig-004-20250115 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250115 gcc-14.2.0 loongarch randconfig-002-20250115 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250115 gcc-12 x86_64 buildonly-randconfig-002-20250115 gcc-12 x86_64 buildonly-randconfig-003-20250115 clang-19 x86_64 buildonly-randconfig-004-20250115 clang-19 x86_64 buildonly-randconfig-005-20250115 gcc-12 x86_64 buildonly-randconfig-006-20250115 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION be7c56a3331fa54879a23bece60f6670e0b0d9ed
by kernel test robot 15 Jan '25

15 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: be7c56a3331fa54879a23bece60f6670e0b0d9ed !14858 ALSA: usb-audio: Fix out of bounds reads when finding clock sources Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- arm64-randconfig-001-20250115 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20250115 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- arm64-randconfig-003-20250115 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | `-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:tcm_tis_spi_acpi_match-defined-but-not-used |-- arm64-randconfig-004-20250115 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-allyesconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions |-- x86_64-buildonly-randconfig-001-20250115 | |-- drivers-mmc-core-.tmp_core.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-staging-greybus-.tmp_core.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-video-backlight-.tmp_otm3225a.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-autofs-.tmp_expire.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-crypto-.tmp_crypto.o:warning:objtool:missing-symbol-for-section-.text.unlikely | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-002-20250115 | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- kernel-hung_task.c:error:sysctl_hung_task_all_cpu_backtrace-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-003-20250115 | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250115 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-of-dynamic.o:warning:objtool:of_reconfig_get_state_change:can-t-find-switch-jump-table | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250115 | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- x86_64-buildonly-randconfig-006-20250115 | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-pci-hotplug-pciehp_core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text | `-- net-sched-sch_etf.o:warning:objtool:missing-symbol-for-section-.init.text `-- x86_64-defconfig |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions elapsed time: 776m configs tested: 15 configs skipped: 118 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250115 gcc-14.2.0 arm64 randconfig-002-20250115 gcc-14.2.0 arm64 randconfig-003-20250115 gcc-14.2.0 arm64 randconfig-004-20250115 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250115 gcc-12 x86_64 buildonly-randconfig-002-20250115 gcc-12 x86_64 buildonly-randconfig-003-20250115 clang-19 x86_64 buildonly-randconfig-004-20250115 clang-19 x86_64 buildonly-randconfig-005-20250115 gcc-12 x86_64 buildonly-randconfig-006-20250115 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] quota: flush quota_release_work upon quota writeback
by Baokun Li 15 Jan '25

15 Jan '25

From: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> stable inclusion from stable-v5.10.231 commit 6f3821acd7c3143145999248087de5fb4b48cf26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHBWQ CVE: CVE-2024-56780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ac6f420291b3fee1113f21d612fa88b628afab5b ] One of the paths quota writeback is called from is: freeze_super() sync_filesystem() ext4_sync_fs() dquot_writeback_dquots() Since we currently don't always flush the quota_release_work queue in this path, we can end up with the following race: 1. dquot are added to releasing_dquots list during regular operations. 2. FS Freeze starts, however, this does not flush the quota_release_work queue. 3. Freeze completes. 4. Kernel eventually tries to flush the workqueue while FS is frozen which hits a WARN_ON since transaction gets started during frozen state: ext4_journal_check_start+0x28/0x110 [ext4] (unreliable) __ext4_journal_start_sb+0x64/0x1c0 [ext4] ext4_release_dquot+0x90/0x1d0 [ext4] quota_release_workfn+0x43c/0x4d0 Which is the following line: WARN_ON(sb->s_writers.frozen == SB_FREEZE_COMPLETE); Which ultimately results in generic/390 failing due to dmesg noise. This was detected on powerpc machine 15 cores. To avoid this, make sure to flush the workqueue during dquot_writeback_dquots() so we dont have any pending workitems after freeze. Reported-by: Disha Goel <disgoel(a)linux.ibm.com> CC: stable(a)vger.kernel.org Fixes: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide") Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Signed-off-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20241121123855.645335-2-ojaswin@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/quota/dquot.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index 89ca36a37376..058f0b94b98d 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -680,6 +680,8 @@ int dquot_writeback_dquots(struct super_block *sb, int type) WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount)); + flush_delayed_work(&quota_release_work); + for (cnt = 0; cnt < MAXQUOTAS; cnt++) { if (type != -1 && cnt != type) continue; -- 2.46.1

2 1

[PATCH OLK-5.10] quota: flush quota_release_work upon quota writeback
by Baokun Li 15 Jan '25

15 Jan '25

From: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> stable inclusion from stable-v5.10.231 commit 6f3821acd7c3143145999248087de5fb4b48cf26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHBWQ CVE: CVE-2024-56780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ac6f420291b3fee1113f21d612fa88b628afab5b ] One of the paths quota writeback is called from is: freeze_super() sync_filesystem() ext4_sync_fs() dquot_writeback_dquots() Since we currently don't always flush the quota_release_work queue in this path, we can end up with the following race: 1. dquot are added to releasing_dquots list during regular operations. 2. FS Freeze starts, however, this does not flush the quota_release_work queue. 3. Freeze completes. 4. Kernel eventually tries to flush the workqueue while FS is frozen which hits a WARN_ON since transaction gets started during frozen state: ext4_journal_check_start+0x28/0x110 [ext4] (unreliable) __ext4_journal_start_sb+0x64/0x1c0 [ext4] ext4_release_dquot+0x90/0x1d0 [ext4] quota_release_workfn+0x43c/0x4d0 Which is the following line: WARN_ON(sb->s_writers.frozen == SB_FREEZE_COMPLETE); Which ultimately results in generic/390 failing due to dmesg noise. This was detected on powerpc machine 15 cores. To avoid this, make sure to flush the workqueue during dquot_writeback_dquots() so we dont have any pending workitems after freeze. Reported-by: Disha Goel <disgoel(a)linux.ibm.com> CC: stable(a)vger.kernel.org Fixes: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide") Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Signed-off-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20241121123855.645335-2-ojaswin@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/quota/dquot.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index 001482fac9fd..94fa70e38087 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -687,6 +687,8 @@ int dquot_writeback_dquots(struct super_block *sb, int type) WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount)); + flush_delayed_work(&quota_release_work); + for (cnt = 0; cnt < MAXQUOTAS; cnt++) { if (type != -1 && cnt != type) continue; -- 2.46.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-56724
by Liao Chen 15 Jan '25

15 Jan '25

fix CVE-2024-56724 Andy Shevchenko (1): mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device drivers/mfd/intel_soc_pmic_bxtwc.c | 31 ++++++++++++++------------ drivers/platform/x86/intel/bxtwc_tmu.c | 22 +++++------------- 2 files changed, 23 insertions(+), 30 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/2] *** jffs2: Prevent rtime decompress memory corruption ***
by Yongjian Sun 15 Jan '25

15 Jan '25

*** BLURB HERE *** Kinsey Moore (1): [Backport] jffs2: Prevent rtime decompress memory corruption Richard Weinberger (1): [Backport] jffs2: Fix rtime decompressor fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.39.2

2 3

[PATCH OLK-5.10 0/2] *** jffs2: Prevent rtime decompress memory corruption ***
by Yongjian Sun 15 Jan '25

15 Jan '25

*** BLURB HERE *** Kinsey Moore (1): [Backport] jffs2: Prevent rtime decompress memory corruption Richard Weinberger (1): [Backport] jffs2: Fix rtime decompressor fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.39.2

2 3

[PATCH OLK-5.10] NFS: Fix up nfs_ctx_key_to_expire()
by Yang Erkun 15 Jan '25

15 Jan '25

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v5.16-rc1 commit ca05cbae2a0468e5d78e9b4605936a8bf5da328b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBGMYF Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the cached credential exists but doesn't have any expiration callback then exit early. Fix up atomicity issues when replacing the credential with a new one since the existing code could lead to refcount leaks. Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/nfs/inode.c | 4 ++-- fs/nfs/write.c | 41 ++++++++++++++++++++++++++++------------- include/linux/nfs_fs.h | 2 +- 3 files changed, 31 insertions(+), 16 deletions(-) diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c index cd7d7aa2b3c6..22d425f21087 100644 --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -998,7 +998,7 @@ struct nfs_open_context *alloc_nfs_open_context(struct dentry *dentry, ctx->cred = get_cred(filp->f_cred); else ctx->cred = get_current_cred(); - ctx->ll_cred = NULL; + rcu_assign_pointer(ctx->ll_cred, NULL); ctx->state = NULL; ctx->mode = f_mode; ctx->flags = 0; @@ -1037,7 +1037,7 @@ static void __put_nfs_open_context(struct nfs_open_context *ctx, int is_sync) put_cred(ctx->cred); dput(ctx->dentry); nfs_sb_deactive(sb); - put_rpccred(ctx->ll_cred); + put_rpccred(rcu_dereference_protected(ctx->ll_cred, 1)); kfree(ctx->mdsthreshold); kfree_rcu(ctx, rcu_head); } diff --git a/fs/nfs/write.c b/fs/nfs/write.c index 4cf060691979..92239a7571aa 100644 --- a/fs/nfs/write.c +++ b/fs/nfs/write.c @@ -1221,7 +1221,7 @@ nfs_key_timeout_notify(struct file *filp, struct inode *inode) struct nfs_open_context *ctx = nfs_file_open_context(filp); if (nfs_ctx_key_to_expire(ctx, inode) && - !ctx->ll_cred) + !rcu_access_pointer(ctx->ll_cred)) /* Already expired! */ return -EACCES; return 0; @@ -1233,23 +1233,38 @@ nfs_key_timeout_notify(struct file *filp, struct inode *inode) bool nfs_ctx_key_to_expire(struct nfs_open_context *ctx, struct inode *inode) { struct rpc_auth *auth = NFS_SERVER(inode)->client->cl_auth; - struct rpc_cred *cred = ctx->ll_cred; + struct rpc_cred *cred, *new, *old = NULL; struct auth_cred acred = { .cred = ctx->cred, }; + bool ret = false; - if (cred && !cred->cr_ops->crmatch(&acred, cred, 0)) { - put_rpccred(cred); - ctx->ll_cred = NULL; - cred = NULL; - } - if (!cred) - cred = auth->au_ops->lookup_cred(auth, &acred, 0); - if (!cred || IS_ERR(cred)) + rcu_read_lock(); + cred = rcu_dereference(ctx->ll_cred); + if (cred && !(cred->cr_ops->crkey_timeout && + cred->cr_ops->crkey_timeout(cred))) + goto out; + rcu_read_unlock(); + + new = auth->au_ops->lookup_cred(auth, &acred, 0); + if (new == cred) { + put_rpccred(new); return true; - ctx->ll_cred = cred; - return !!(cred->cr_ops->crkey_timeout && - cred->cr_ops->crkey_timeout(cred)); + } + if (IS_ERR_OR_NULL(new)) { + new = NULL; + ret = true; + } else if (new->cr_ops->crkey_timeout && + new->cr_ops->crkey_timeout(new)) + ret = true; + + rcu_read_lock(); + old = rcu_dereference_protected(xchg(&ctx->ll_cred, + RCU_INITIALIZER(new)), 1); +out: + rcu_read_unlock(); + put_rpccred(old); + return ret; } /* diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h index 7488864589a7..010176828f15 100644 --- a/include/linux/nfs_fs.h +++ b/include/linux/nfs_fs.h @@ -71,7 +71,7 @@ struct nfs_open_context { fl_owner_t flock_owner; struct dentry *dentry; const struct cred *cred; - struct rpc_cred *ll_cred; /* low-level cred - use to check for expiry */ + struct rpc_cred __rcu *ll_cred; /* low-level cred - use to check for expiry */ struct nfs4_state *state; fmode_t mode; -- 2.39.2

2 1

[PATCH OLK-5.10] fs/dirty_pages: Add exclusive open lock to prevent null pointer dereference
by Zizhi Wo 15 Jan '25

15 Jan '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBHTNK -------------------------------- The current mechanism for printing dirty pages involves "/proc/dirty/buffer_size" and "/proc/dirty/dirty_list" being able to be opened simultaneously. If "buffer_size" is opened firstly and 1 is written to it, and then "dirty_list" is opened, followed by writing 0 to "buffer_size". Then variable "buf_dirty" will be freed and set to NULL. However, the user can still access "buf_dirty" through the already opened "dirty_list", which could lead to a NULL pointer dereference issue. To prevent the NULL pointer dereference problem, add an exclusive open lock. And now "/proc/dirty/buffer_size" and "/proc/dirty/dirty_list" cannot be opened at the same time unless "/proc/dirty/buffer_size" is opened in read-only mode. At the same time, "buff_used" and "buff_lock" in the original code are not needed, and the redundant code is deleted. Fixes: aeb96447becc ("fs/dirty_pages: dump the number of dirty pages for each inode") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/dirty_pages.c | 83 +++++++++++++++++++++++++++--------------------- 1 file changed, 47 insertions(+), 36 deletions(-) diff --git a/fs/dirty_pages.c b/fs/dirty_pages.c index f75a5158d94b..81bd52ad50f0 100644 --- a/fs/dirty_pages.c +++ b/fs/dirty_pages.c @@ -19,12 +19,10 @@ static char *buf_dirty; /* buffer to store number of dirty pages */ static unsigned long buf_size; /* size of buffer in bytes */ static long buff_num; /* size of buffer in number of pages */ static int buff_limit; /* filter threshold of dirty pages*/ +static unsigned long lock_word; /* for exclusive access to buffer */ static struct proc_dir_entry *dirty_dir; -static struct mutex buff_used; /* buffer is in used */ -static struct mutex buff_lock; /* lock when buffer is changed */ - /* proc root directory */ #define DIRTY_ROOT "dirty" /* proc file for buffer allocation and release */ @@ -40,6 +38,18 @@ static void seq_set_overflow(struct seq_file *m) m->count = m->size; } +static bool dirty_pages_lock(void) +{ + if (xchg(&lock_word, 1) == 1) + return false; + return true; +} + +static void dirty_pages_unlock(void) +{ + lock_word = 0; +} + static unsigned long dump_dirtypages_inode(struct inode *inode) { struct pagevec pvec; @@ -195,10 +205,6 @@ static ssize_t seq_read_dirty( size_t n; int err = 0; - if (!mutex_trylock(&buff_used)) - return -EBUSY; - /* don't allow buffer to change during read */ - mutex_lock(&buff_lock); if (m->count == 0) { memset(buf_dirty, 0, buf_size); if (!m->buf) { @@ -210,13 +216,6 @@ static ssize_t seq_read_dirty( goto done; } - /* if buffer changed somehow */ - if (m->size != buf_size) { - mutex_unlock(&buff_lock); - mutex_unlock(&buff_used); - return -EFAULT; - } - n = min(m->count - m->from, size); /* check if this is the last read */ if (n == 0) @@ -234,8 +233,6 @@ static ssize_t seq_read_dirty( else *ppos += copied; - mutex_unlock(&buff_lock); - mutex_unlock(&buff_used); return copied; } @@ -247,6 +244,7 @@ static void free_buf_dirty(void) buf_size = 0; } } + static ssize_t write_proc( struct file *filp, const char *buf, @@ -257,9 +255,6 @@ static ssize_t write_proc( int ret = 0; long old_buff_num; - if (!mutex_trylock(&buff_used)) - return -EBUSY; - if (count > PAGE_SIZE) { ret = -EINVAL; goto error; @@ -283,42 +278,44 @@ static ssize_t write_proc( goto free; } - mutex_lock(&buff_lock); - ret = count; if (buff_num == 0) { free_buf_dirty(); - goto out; + goto free; } if (buff_num == old_buff_num) - goto out; + goto free; free_buf_dirty(); buf_size = PAGE_SIZE * buff_num; buf_dirty = vzalloc(buf_size); - if (!buf_dirty) { + if (!buf_dirty) ret = -ENOMEM; - goto out; - } -out: - mutex_unlock(&buff_lock); free: kfree(msg); error: - mutex_unlock(&buff_used); return ret; } static int proc_dpages_open(struct inode *inode, struct file *filp) { + int ret; + + if (!dirty_pages_lock()) + return -EBUSY; + if (buf_dirty == NULL || buf_size == 0) { pr_warn("please allocate buffer before getting dirty pages\n"); + dirty_pages_unlock(); return -ENOMEM; } - return single_open(filp, proc_dpages_show, NULL); + ret = single_open(filp, proc_dpages_show, NULL); + if (ret) + dirty_pages_unlock(); + return ret; } static int seq_release_dirty(struct inode *inode, struct file *file) @@ -327,6 +324,7 @@ static int seq_release_dirty(struct inode *inode, struct file *file) /* we don't want to free the buf */ m->buf = NULL; + dirty_pages_unlock(); single_release(inode, file); return 0; } @@ -351,7 +349,16 @@ static int proc_limit_show(struct seq_file *m, void *v) static int proc_switch_open(struct inode *inode, struct file *filp) { - return single_open(filp, proc_switch_show, NULL); + int ret; + + if (((filp->f_flags & O_ACCMODE) != O_RDONLY) && !dirty_pages_lock()) + return -EBUSY; + + ret = single_open(filp, proc_switch_show, NULL); + if (ret && ((filp->f_flags & O_ACCMODE) != O_RDONLY)) + dirty_pages_unlock(); + + return ret; } static int proc_limit_open(struct inode *inode, struct file *filp) @@ -359,6 +366,14 @@ static int proc_limit_open(struct inode *inode, struct file *filp) return single_open(filp, proc_limit_show, NULL); } +static int proc_switch_release(struct inode *inode, struct file *filp) +{ + if ((filp->f_flags & O_ACCMODE) != O_RDONLY) + dirty_pages_unlock(); + + return single_release(inode, filp); +} + static ssize_t write_limit_proc( struct file *filp, const char *buf, @@ -405,7 +420,7 @@ static const struct proc_ops proc_switch_operations = { .proc_read = seq_read, .proc_write = write_proc, .proc_lseek = seq_lseek, - .proc_release = single_release, + .proc_release = proc_switch_release, }; static const struct proc_ops proc_limit_operations = { @@ -440,8 +455,6 @@ static int __init dpages_proc_init(void) if (!proc_file) goto fail_limit; - mutex_init(&buff_used); - mutex_init(&buff_lock); return 0; fail_limit: @@ -456,9 +469,7 @@ static int __init dpages_proc_init(void) static void dpages_proc_exit(void) { - mutex_lock(&buff_lock); free_buf_dirty(); - mutex_unlock(&buff_lock); remove_proc_entry(DIRTY_PAGES, dirty_dir); remove_proc_entry(DIRTY_SWITCH, dirty_dir); remove_proc_entry(DIRTY_LIMIT, dirty_dir); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] [Backport] drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
by Lin Ruifeng 15 Jan '25

15 Jan '25

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v5.15.174 commit f5804567cf9605d6e5ec46c0bb786f7d50f18c13 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHBX6 CVE: CVE-2024-56777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e965e771b069421c233d674c3c8cd8c7f7245f42 upstream. The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure. Cc: stable(a)vger.kernel.org Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Acked-by: Alain Volmat <alain.volmat(a)foss.st.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240909063359.1197065-1-make… Signed-off-by: Alain Volmat <alain.volmat(a)foss.st.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/gpu/drm/sti/sti_gdp.c [Context conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/sti/sti_gdp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/sti/sti_gdp.c b/drivers/gpu/drm/sti/sti_gdp.c index c32de6cbf061..0bd3230b2caa 100644 --- a/drivers/gpu/drm/sti/sti_gdp.c +++ b/drivers/gpu/drm/sti/sti_gdp.c @@ -629,6 +629,9 @@ static int sti_gdp_atomic_check(struct drm_plane *drm_plane, mixer = to_sti_mixer(crtc); crtc_state = drm_atomic_get_crtc_state(state->state, crtc); + if (IS_ERR(crtc_state)) + return PTR_ERR(crtc_state); + mode = &crtc_state->mode; dst_x = state->crtc_x; dst_y = state->crtc_y; -- 2.22.0

2 1

[PATCH OLK-6.6] [Backport] drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
by Lin Ruifeng 15 Jan '25

15 Jan '25

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v6.6.64 commit 997b64c3f4c1827c5cfda8ae7f5d13f78d28b541 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHBX6 CVE: CVE-2024-56777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e965e771b069421c233d674c3c8cd8c7f7245f42 upstream. The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure. Cc: stable(a)vger.kernel.org Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Acked-by: Alain Volmat <alain.volmat(a)foss.st.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240909063359.1197065-1-make… Signed-off-by: Alain Volmat <alain.volmat(a)foss.st.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/sti/sti_gdp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/sti/sti_gdp.c b/drivers/gpu/drm/sti/sti_gdp.c index 43c72c2604a0..f046f5f7ad25 100644 --- a/drivers/gpu/drm/sti/sti_gdp.c +++ b/drivers/gpu/drm/sti/sti_gdp.c @@ -638,6 +638,9 @@ static int sti_gdp_atomic_check(struct drm_plane *drm_plane, mixer = to_sti_mixer(crtc); crtc_state = drm_atomic_get_crtc_state(state, crtc); + if (IS_ERR(crtc_state)) + return PTR_ERR(crtc_state); + mode = &crtc_state->mode; dst_x = new_plane_state->crtc_x; dst_y = new_plane_state->crtc_y; -- 2.22.0

2 1

[PATCH OLK-5.10] [Backport] drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
by Lin Ruifeng 15 Jan '25

15 Jan '25

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v5.15.174 commit f5804567cf9605d6e5ec46c0bb786f7d50f18c13 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHBX6 CVE: CVE-2024-56777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e965e771b069421c233d674c3c8cd8c7f7245f42 upstream. The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure. Cc: stable(a)vger.kernel.org Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Acked-by: Alain Volmat <alain.volmat(a)foss.st.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240909063359.1197065-1-make… Signed-off-by: Alain Volmat <alain.volmat(a)foss.st.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/gpu/drm/sti/sti_gdp.c [Context conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/sti/sti_gdp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/sti/sti_gdp.c b/drivers/gpu/drm/sti/sti_gdp.c index 2d5a2b5b78b8..c268a2ef1431 100644 --- a/drivers/gpu/drm/sti/sti_gdp.c +++ b/drivers/gpu/drm/sti/sti_gdp.c @@ -634,6 +634,9 @@ static int sti_gdp_atomic_check(struct drm_plane *drm_plane, mixer = to_sti_mixer(crtc); crtc_state = drm_atomic_get_crtc_state(state->state, crtc); + if (IS_ERR(crtc_state)) + return PTR_ERR(crtc_state); + mode = &crtc_state->mode; dst_x = state->crtc_x; dst_y = state->crtc_y; -- 2.22.0

2 1

openEuler Kernel SIG双周例会
by openEuler conference 15 Jan '25

15 Jan '25

您好！ Kernel 邀请您参加 2025-01-17 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复本邮件申报，也可直接填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/988444011 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2025-01-17 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复本邮件申报，也可直接填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/988444011. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 3bfb552dbcbc9d1f3e9eb36c119271a0d590e7f8
by kernel test robot 14 Jan '25

14 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 3bfb552dbcbc9d1f3e9eb36c119271a0d590e7f8 !14740 NFSv4: Fix deadlock during the running of state manager Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- arm64-allnoconfig | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-001-20250114 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20250114 | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) |-- arm64-randconfig-003-20250114 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-004-20250114 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:tcm_tis_spi_acpi_match-defined-but-not-used |-- x86_64-allmodconfig | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | `-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests |-- x86_64-allnoconfig | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions |-- x86_64-buildonly-randconfig-001-20250114 | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-media-i2c-ak7375.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-ov2680.o:warning:objtool:missing-symbol-for-section-.init.text | |-- kernel-trace-preemptirq_delay_test.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250114 | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20250114 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250114 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250114 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250114 | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-crypto-ccree-cc_debugfs.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-crypto-ccree-cc_hash.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-fpga-dfl-fme-mgr.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-fpga-dfl-pci.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-bridge-cdns-dsi.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-panel-panel-ilitek-ili9881c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-ak7375.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-ov2680.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-video-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pci-ats.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-watchdog-menz69_wdt.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-defconfig |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions elapsed time: 729m configs tested: 15 configs skipped: 108 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250114 gcc-14.2.0 arm64 randconfig-002-20250114 gcc-14.2.0 arm64 randconfig-003-20250114 gcc-14.2.0 arm64 randconfig-004-20250114 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250114 clang-19 x86_64 buildonly-randconfig-002-20250114 clang-19 x86_64 buildonly-randconfig-003-20250114 clang-19 x86_64 buildonly-randconfig-004-20250114 clang-19 x86_64 buildonly-randconfig-005-20250114 clang-19 x86_64 buildonly-randconfig-006-20250114 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 44e699017cdc4881f46ede1e7b88fde9f037766c
by kernel test robot 14 Jan '25

14 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 44e699017cdc4881f46ede1e7b88fde9f037766c !14838 v2 fs: Filter specific inodes to prevent UAF issues Error/Warning (recently discovered and may have been fixed): drivers/mtd/nand/raw/nand_macronix.o: warning: objtool: nand_power_down_op()+0x1de: unreachable instruction net/hsr/hsr_device.o: warning: objtool: hsr_check_carrier_and_operstate()+0xea: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-defconfig | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- arm64-randconfig-003-20250114 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- x86_64-allnoconfig | `-- samples-bpf-hbm.c:bpf-bpf.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-001-20250114 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- x86_64-buildonly-randconfig-002-20241228 | |-- drivers-mtd-nand-raw-nand_macronix.o:warning:objtool:nand_power_down_op:unreachable-instruction | `-- net-hsr-hsr_device.o:warning:objtool:hsr_check_carrier_and_operstate:unreachable-instruction |-- x86_64-buildonly-randconfig-002-20250114 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- fs-fscache-main.c:warning:unused-variable-fscache_min_object_max_active | `-- fs-fscache-main.c:warning:unused-variable-fscache_min_op_max_active |-- x86_64-buildonly-randconfig-004-20250114 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- x86_64-buildonly-randconfig-005-20250114 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data `-- x86_64-randconfig-r062-20250114 |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and `-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character elapsed time: 732m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250114 clang-17 arm64 randconfig-002-20250114 clang-19 arm64 randconfig-003-20250114 gcc-14.2.0 arm64 randconfig-004-20250114 clang-20 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250114 clang-19 x86_64 buildonly-randconfig-002-20250114 clang-19 x86_64 buildonly-randconfig-003-20250114 clang-19 x86_64 buildonly-randconfig-004-20250114 clang-19 x86_64 buildonly-randconfig-005-20250114 clang-19 x86_64 buildonly-randconfig-006-20250114 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] drm/sti: avoid potential dereference of error pointers
by Li Huafei 14 Jan '25

14 Jan '25

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v6.6.64 commit 8ab73ac97c0fa528f66eeccd9bb53eb6eb7d20dc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHLRS CVE: CVE-2024-56776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 831214f77037de02afc287eae93ce97f218d8c04 upstream. The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure. Cc: stable(a)vger.kernel.org Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Link: https://patchwork.freedesktop.org/patch/msgid/20240913090412.2022848-1-make… Signed-off-by: Alain Volmat <alain.volmat(a)foss.st.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/gpu/drm/sti/sti_cursor.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/sti/sti_cursor.c b/drivers/gpu/drm/sti/sti_cursor.c index db0a1eb53532..c59fcb4dca32 100644 --- a/drivers/gpu/drm/sti/sti_cursor.c +++ b/drivers/gpu/drm/sti/sti_cursor.c @@ -200,6 +200,9 @@ static int sti_cursor_atomic_check(struct drm_plane *drm_plane, return 0; crtc_state = drm_atomic_get_crtc_state(state, crtc); + if (IS_ERR(crtc_state)) + return PTR_ERR(crtc_state); + mode = &crtc_state->mode; dst_x = new_plane_state->crtc_x; dst_y = new_plane_state->crtc_y; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: usb-audio: Fix out of bounds reads when finding clock sources
by Luo Gengkun 14 Jan '25

14 Jan '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.231 commit 45a92cbc88e4013bfed7fd2ccab3ade45f8e896b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGG CVE: CVE-2024-53150 Reference: https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b -------------------------------- commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 upstream. The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Reported-by: Benoît Sevens <bsevens(a)google.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Benoît Sevens <bsevens(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/usb/clock.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index 01b414448312..de8d7e2c6b3a 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -35,6 +35,10 @@ #include "clock.h" #include "quirks.h" +/* check whether the descriptor bLength has the minimal length */ +#define DESC_LENGTH_CHECK(p) \ + (p->bLength >= sizeof(*p)) + static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, bool (*validator)(void *, int), u8 type) { @@ -52,36 +56,60 @@ static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, static bool validate_clock_source_v2(void *p, int id) { struct uac_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_source_v3(void *p, int id) { struct uac3_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_selector_v2(void *p, int id) { struct uac_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 1 /* bmControls */ + 1 /* iClockSelector */; } static bool validate_clock_selector_v3(void *p, int id) { struct uac3_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 4 /* bmControls */ + 2 /* wCSelectorDescrStr */; } static bool validate_clock_multiplier_v2(void *p, int id) { struct uac_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_multiplier_v3(void *p, int id) { struct uac3_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } -- 2.34.1

2 1

[openeuler:OLK-6.6] BUILD REGRESSION 4fbc633527d173d6e350da6be39009c6a449a802
by kernel test robot 14 Jan '25

14 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 4fbc633527d173d6e350da6be39009c6a449a802 !14846 net: stmmac: fix TSO DMA API usage causing oops Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501140558.Dz2Pe9bS-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202501140732.yHKX6wmK-lkp@intel.com drivers/i2c/busses/i2c-zhaoxin-smbus.c:367:36: warning: unused variable 'zxsmb_acpi_match' [-Wunused-const-variable] drivers/irqchip/irq-gic-v3.c:1086:43: error: incompatible integer to pointer conversion passing 'int' to parameter of type 'void *' [-Wint-conversion] include/../drivers/pci/msi/msi.h:113:57: warning: declaration of 'struct msix_entry' will not be visible outside of this function [-Wvisibility] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- arm64-randconfig-002-20250114 | |-- drivers-i2c-busses-i2c-zhaoxin-smbus.c:warning:unused-variable-zxsmb_acpi_match | `-- kernel-cgroup-cgroup.c:error:use-of-undeclared-identifier-cgroup_psi_stat_show |-- arm64-randconfig-004-20250114 | |-- drivers-irqchip-irq-gic-v3.c:error:incompatible-integer-to-pointer-conversion-passing-int-to-parameter-of-type-void | `-- include-..-drivers-pci-msi-msi.h:warning:declaration-of-struct-msix_entry-will-not-be-visible-outside-of-this-function |-- loongarch-allmodconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allyesconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-002-20250114 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- x86_64-allnoconfig | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. `-- x86_64-allyesconfig |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put elapsed time: 738m configs tested: 19 configs skipped: 113 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250114 clang-17 arm64 randconfig-002-20250114 clang-19 arm64 randconfig-003-20250114 gcc-14.2.0 arm64 randconfig-004-20250114 clang-20 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250114 gcc-14.2.0 loongarch randconfig-002-20250114 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250114 clang-19 x86_64 buildonly-randconfig-002-20250114 clang-19 x86_64 buildonly-randconfig-003-20250114 clang-19 x86_64 buildonly-randconfig-004-20250114 clang-19 x86_64 buildonly-randconfig-005-20250114 clang-19 x86_64 buildonly-randconfig-006-20250114 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] sched: psi: fix bogus pressure spikes from aggregation race
by Chen Ridong 14 Jan '25

14 Jan '25

From: Johannes Weiner <hannes(a)cmpxchg.org> stable inclusion from stable-v6.6.55 commit 1f997b1d13e0b9819468e577622e747b546516fe category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB6YDK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3840cbe24cf060ea05a585ca497814609f5d47d1 ] Brandon reports sporadic, non-sensical spikes in cumulative pressure time (total=) when reading cpu.pressure at a high rate. This is due to a race condition between reader aggregation and tasks changing states. While it affects all states and all resources captured by PSI, in practice it most likely triggers with CPU pressure, since scheduling events are so frequent compared to other resource events. The race context is the live snooping of ongoing stalls during a pressure read. The read aggregates per-cpu records for stalls that have concluded, but will also incorporate ad-hoc the duration of any active state that hasn't been recorded yet. This is important to get timely measurements of ongoing stalls. Those ad-hoc samples are calculated on-the-fly up to the current time on that CPU; since the stall hasn't concluded, it's expected that this is the minimum amount of stall time that will enter the per-cpu records once it does. The problem is that the path that concludes the state uses a CPU clock read that is not synchronized against aggregators; the clock is read outside of the seqlock protection. This allows aggregators to race and snoop a stall with a longer duration than will actually be recorded. With the recorded stall time being less than the last snapshot remembered by the aggregator, a subsequent sample will underflow and observe a bogus delta value, resulting in an erratic jump in pressure. Fix this by moving the clock read of the state change into the seqlock protection. This ensures no aggregation can snoop live stalls past the time that's recorded when the state concludes. Reported-by: Brandon Duffany <brandon(a)buildbuddy.io> Link: https://bugzilla.kernel.org/show_bug.cgi?id=219194 Link: https://lore.kernel.org/lkml/20240827121851.GB438928@cmpxchg.org/ Fixes: d67515514ca5 ("psi: Reduce calls to sched_clock() in psi") Cc: stable(a)vger.kernel.org Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org> Reviewed-by: Chengming Zhou <chengming.zhou(a)linux.dev> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: kernel/sched/psi.c [ Context conflicts and psi_cgroup_restart(re-enable) is not merged. Move the update_psi_stat_delta into the psi_group_change functions ] Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- kernel/sched/psi.c | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c index 977c973d1e70..b0068145b185 100644 --- a/kernel/sched/psi.c +++ b/kernel/sched/psi.c @@ -962,13 +962,14 @@ static void record_times(struct psi_group_cpu *groupc, u64 now) } static void psi_group_change(struct psi_group *group, int cpu, - unsigned int clear, unsigned int set, u64 now, + unsigned int clear, unsigned int set, bool wake_clock) { struct psi_group_cpu *groupc; unsigned int t, m; enum psi_states s; u32 state_mask; + u64 now; groupc = per_cpu_ptr(group->pcpu, cpu); @@ -981,7 +982,9 @@ static void psi_group_change(struct psi_group *group, int cpu, * change requested through the @clear and @set bits. */ write_seqcount_begin(&groupc->seq); + now = cpu_clock(cpu); + update_psi_stat_delta(group, cpu, now); record_times(groupc, now); record_cpu_stat_times(group, cpu); @@ -1110,7 +1113,6 @@ void psi_task_change(struct task_struct *task, int clear, int set) int cpu = task_cpu(task); struct psi_group *group; void *iter = NULL; - u64 now; int stat_set = 0; int stat_clear = 0; @@ -1120,11 +1122,8 @@ void psi_task_change(struct task_struct *task, int clear, int set) psi_flags_change(task, clear, set); psi_stat_flags_change(task, &stat_set, &stat_clear, set, clear); - now = cpu_clock(cpu); - while ((group = iterate_groups(task, &iter))) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, true); + psi_group_change(group, cpu, clear, set, true); psi_group_stat_change(group, cpu, stat_clear, stat_set); } } @@ -1135,7 +1134,6 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, struct psi_group *group, *common = NULL; int cpu = task_cpu(prev); void *iter; - u64 now = cpu_clock(cpu); if (next->pid) { update_throttle_type(next, cpu, true); @@ -1153,8 +1151,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, break; } - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, 0, TSK_ONCPU, now, true); + psi_group_change(group, cpu, 0, TSK_ONCPU, true); psi_group_stat_change(group, cpu, 0, 0); } } @@ -1196,8 +1193,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, iter = NULL; while ((group = iterate_groups(prev, &iter)) && group != common) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } #ifdef CONFIG_PSI_FINE_GRAINED @@ -1214,8 +1210,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, memstall_type_change) { clear &= ~TSK_ONCPU; for (; group; group = iterate_groups(prev, &iter)) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } @@ -1238,12 +1233,11 @@ void psi_account_irqtime(struct task_struct *task, u32 delta) if (!task->pid) return; - now = cpu_clock(cpu); - while ((group = iterate_groups(task, &iter))) { groupc = per_cpu_ptr(group->pcpu, cpu); write_seqcount_begin(&groupc->seq); + now = cpu_clock(cpu); update_psi_stat_delta(group, cpu, now); record_stat_times(to_psi_group_ext(group), cpu); -- 2.34.1

2 1

[PATCH OLK-6.6] sched: psi: fix bogus pressure spikes from aggregation race
by Chen Ridong 14 Jan '25

14 Jan '25

From: Johannes Weiner <hannes(a)cmpxchg.org> stable inclusion from stable-v6.6.55 commit 1f997b1d13e0b9819468e577622e747b546516fe category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB6YDK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3840cbe24cf060ea05a585ca497814609f5d47d1 ] Brandon reports sporadic, non-sensical spikes in cumulative pressure time (total=) when reading cpu.pressure at a high rate. This is due to a race condition between reader aggregation and tasks changing states. While it affects all states and all resources captured by PSI, in practice it most likely triggers with CPU pressure, since scheduling events are so frequent compared to other resource events. The race context is the live snooping of ongoing stalls during a pressure read. The read aggregates per-cpu records for stalls that have concluded, but will also incorporate ad-hoc the duration of any active state that hasn't been recorded yet. This is important to get timely measurements of ongoing stalls. Those ad-hoc samples are calculated on-the-fly up to the current time on that CPU; since the stall hasn't concluded, it's expected that this is the minimum amount of stall time that will enter the per-cpu records once it does. The problem is that the path that concludes the state uses a CPU clock read that is not synchronized against aggregators; the clock is read outside of the seqlock protection. This allows aggregators to race and snoop a stall with a longer duration than will actually be recorded. With the recorded stall time being less than the last snapshot remembered by the aggregator, a subsequent sample will underflow and observe a bogus delta value, resulting in an erratic jump in pressure. Fix this by moving the clock read of the state change into the seqlock protection. This ensures no aggregation can snoop live stalls past the time that's recorded when the state concludes. Reported-by: Brandon Duffany <brandon(a)buildbuddy.io> Link: https://bugzilla.kernel.org/show_bug.cgi?id=219194 Link: https://lore.kernel.org/lkml/20240827121851.GB438928@cmpxchg.org/ Fixes: df77430639c9 ("psi: Reduce calls to sched_clock() in psi") Cc: stable(a)vger.kernel.org Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org> Reviewed-by: Chengming Zhou <chengming.zhou(a)linux.dev> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: kernel/sched/psi.c [ Just context conflicts. ] Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> --- kernel/sched/psi.c | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-) diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c index 9f68756a3bafe..1c8b1f9975138 100644 --- a/kernel/sched/psi.c +++ b/kernel/sched/psi.c @@ -988,13 +988,14 @@ static void record_times(struct psi_group_cpu *groupc, u64 now) } static void psi_group_change(struct psi_group *group, int cpu, - unsigned int clear, unsigned int set, u64 now, + unsigned int clear, unsigned int set, bool wake_clock) { struct psi_group_cpu *groupc; unsigned int t, m; enum psi_states s; u32 state_mask; + u64 now; groupc = per_cpu_ptr(group->pcpu, cpu); @@ -1008,6 +1009,7 @@ static void psi_group_change(struct psi_group *group, int cpu, * SOME and FULL time these may have resulted in. */ write_seqcount_begin(&groupc->seq); + now = cpu_clock(cpu); /* * Start with TSK_ONCPU, which doesn't have a corresponding @@ -1150,7 +1152,6 @@ void psi_task_change(struct task_struct *task, int clear, int set) { int cpu = task_cpu(task); struct psi_group *group; - u64 now; int stat_set = 0; int stat_clear = 0; @@ -1160,11 +1161,9 @@ void psi_task_change(struct task_struct *task, int clear, int set) psi_flags_change(task, clear, set); psi_stat_flags_change(task, &stat_set, &stat_clear, set, clear); - now = cpu_clock(cpu); - group = task_psi_group(task); do { - psi_group_change(group, cpu, clear, set, now, true); + psi_group_change(group, cpu, clear, set, true); psi_group_stat_change(group, cpu, stat_clear, stat_set); } while ((group = group->parent)); } @@ -1174,7 +1173,6 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, { struct psi_group *group, *common = NULL; int cpu = task_cpu(prev); - u64 now = cpu_clock(cpu); if (next->pid) { update_throttle_type(next, cpu, true); @@ -1192,7 +1190,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, break; } - psi_group_change(group, cpu, 0, TSK_ONCPU, now, true); + psi_group_change(group, cpu, 0, TSK_ONCPU, true); psi_group_stat_change(group, cpu, 0, 0); } while ((group = group->parent)); } @@ -1236,7 +1234,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, do { if (group == common) break; - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } while ((group = group->parent)); @@ -1255,7 +1253,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, memstall_type_change) { clear &= ~TSK_ONCPU; for (; group; group = group->parent) { - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } } @@ -1268,7 +1266,6 @@ void psi_account_irqtime(struct task_struct *task, u32 delta) int cpu = task_cpu(task); struct psi_group *group; struct psi_group_cpu *groupc; - u64 now; if (static_branch_likely(&psi_disabled)) return; @@ -1276,14 +1273,15 @@ void psi_account_irqtime(struct task_struct *task, u32 delta) if (!task->pid) return; - now = cpu_clock(cpu); - group = task_psi_group(task); do { + u64 now; + if (!group->enabled) continue; groupc = per_cpu_ptr(group->pcpu, cpu); + now = cpu_clock(cpu); write_seqcount_begin(&groupc->seq); @@ -1497,11 +1495,9 @@ void psi_cgroup_restart(struct psi_group *group) for_each_possible_cpu(cpu) { struct rq *rq = cpu_rq(cpu); struct rq_flags rf; - u64 now; rq_lock_irq(rq, &rf); - now = cpu_clock(cpu); - psi_group_change(group, cpu, 0, 0, now, true); + psi_group_change(group, cpu, 0, 0, true); rq_unlock_irq(rq, &rf); } } -- 2.34.1

2 1

[PATCH OLK-5.10] sched: psi: fix bogus pressure spikes from aggregation race
by Chen Ridong 14 Jan '25

14 Jan '25

From: Johannes Weiner <hannes(a)cmpxchg.org> stable inclusion from stable-v6.6.55 commit 1f997b1d13e0b9819468e577622e747b546516fe category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB6YDK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3840cbe24cf060ea05a585ca497814609f5d47d1 ] Brandon reports sporadic, non-sensical spikes in cumulative pressure time (total=) when reading cpu.pressure at a high rate. This is due to a race condition between reader aggregation and tasks changing states. While it affects all states and all resources captured by PSI, in practice it most likely triggers with CPU pressure, since scheduling events are so frequent compared to other resource events. The race context is the live snooping of ongoing stalls during a pressure read. The read aggregates per-cpu records for stalls that have concluded, but will also incorporate ad-hoc the duration of any active state that hasn't been recorded yet. This is important to get timely measurements of ongoing stalls. Those ad-hoc samples are calculated on-the-fly up to the current time on that CPU; since the stall hasn't concluded, it's expected that this is the minimum amount of stall time that will enter the per-cpu records once it does. The problem is that the path that concludes the state uses a CPU clock read that is not synchronized against aggregators; the clock is read outside of the seqlock protection. This allows aggregators to race and snoop a stall with a longer duration than will actually be recorded. With the recorded stall time being less than the last snapshot remembered by the aggregator, a subsequent sample will underflow and observe a bogus delta value, resulting in an erratic jump in pressure. Fix this by moving the clock read of the state change into the seqlock protection. This ensures no aggregation can snoop live stalls past the time that's recorded when the state concludes. Reported-by: Brandon Duffany <brandon(a)buildbuddy.io> Link: https://bugzilla.kernel.org/show_bug.cgi?id=219194 Link: https://lore.kernel.org/lkml/20240827121851.GB438928@cmpxchg.org/ Fixes: df77430639c9 ("psi: Reduce calls to sched_clock() in psi") Cc: stable(a)vger.kernel.org Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org> Reviewed-by: Chengming Zhou <chengming.zhou(a)linux.dev> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: kernel/sched/psi.c [ Context conflicts and psi_cgroup_restart(re-enable) is not merged. Move the update_psi_stat_delta into the psi_group_change functions ] Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- kernel/sched/psi.c | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c index 977c973d1e70..b0068145b185 100644 --- a/kernel/sched/psi.c +++ b/kernel/sched/psi.c @@ -962,13 +962,14 @@ static void record_times(struct psi_group_cpu *groupc, u64 now) } static void psi_group_change(struct psi_group *group, int cpu, - unsigned int clear, unsigned int set, u64 now, + unsigned int clear, unsigned int set, bool wake_clock) { struct psi_group_cpu *groupc; unsigned int t, m; enum psi_states s; u32 state_mask; + u64 now; groupc = per_cpu_ptr(group->pcpu, cpu); @@ -981,7 +982,9 @@ static void psi_group_change(struct psi_group *group, int cpu, * change requested through the @clear and @set bits. */ write_seqcount_begin(&groupc->seq); + now = cpu_clock(cpu); + update_psi_stat_delta(group, cpu, now); record_times(groupc, now); record_cpu_stat_times(group, cpu); @@ -1110,7 +1113,6 @@ void psi_task_change(struct task_struct *task, int clear, int set) int cpu = task_cpu(task); struct psi_group *group; void *iter = NULL; - u64 now; int stat_set = 0; int stat_clear = 0; @@ -1120,11 +1122,8 @@ void psi_task_change(struct task_struct *task, int clear, int set) psi_flags_change(task, clear, set); psi_stat_flags_change(task, &stat_set, &stat_clear, set, clear); - now = cpu_clock(cpu); - while ((group = iterate_groups(task, &iter))) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, true); + psi_group_change(group, cpu, clear, set, true); psi_group_stat_change(group, cpu, stat_clear, stat_set); } } @@ -1135,7 +1134,6 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, struct psi_group *group, *common = NULL; int cpu = task_cpu(prev); void *iter; - u64 now = cpu_clock(cpu); if (next->pid) { update_throttle_type(next, cpu, true); @@ -1153,8 +1151,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, break; } - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, 0, TSK_ONCPU, now, true); + psi_group_change(group, cpu, 0, TSK_ONCPU, true); psi_group_stat_change(group, cpu, 0, 0); } } @@ -1196,8 +1193,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, iter = NULL; while ((group = iterate_groups(prev, &iter)) && group != common) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } #ifdef CONFIG_PSI_FINE_GRAINED @@ -1214,8 +1210,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, memstall_type_change) { clear &= ~TSK_ONCPU; for (; group; group = iterate_groups(prev, &iter)) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } @@ -1238,12 +1233,11 @@ void psi_account_irqtime(struct task_struct *task, u32 delta) if (!task->pid) return; - now = cpu_clock(cpu); - while ((group = iterate_groups(task, &iter))) { groupc = per_cpu_ptr(group->pcpu, cpu); write_seqcount_begin(&groupc->seq); + now = cpu_clock(cpu); update_psi_stat_delta(group, cpu, now); record_stat_times(to_psi_group_ext(group), cpu); -- 2.34.1

2 1

[openeuler:OLK-6.6 1823/1823] drivers/irqchip/irq-gic-v3.c:1086:43: error: incompatible integer to pointer conversion passing 'int' to parameter of type 'void *'
by kernel test robot 14 Jan '25

14 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4fbc633527d173d6e350da6be39009c6a449a802 commit: 63f9ef213a477c796c6b343010762513f6315f83 [1823/1823] arm64: Add debugfs dir for xint config: arm64-randconfig-004-20250114 (https://download.01.org/0day-ci/archive/20250114/202501140732.yHKX6wmK-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project f5cd181ffbb7cb61d582fe130d46580d5969d47a) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250114/202501140732.yHKX6wmK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501140732.yHKX6wmK-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/irqchip/irq-gic-v3.c:25: In file included from include/linux/irqchip/arm-gic-v3.h:632: In file included from arch/arm64/include/asm/arch_gicv3.h:17: In file included from arch/arm64/include/asm/cacheflush.h:11: In file included from include/linux/kgdb.h:19: In file included from include/linux/kprobes.h:28: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2247: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-gic-v3.c:1042:23: error: call to undeclared function 'pde_data'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1042 | int irq = (int)(long)pde_data(file_inode(file)); | ^ drivers/irqchip/irq-gic-v3.c:1086:43: error: call to undeclared function 'pde_data'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1086 | return single_open(file, xint_proc_show, pde_data(inode)); | ^ >> drivers/irqchip/irq-gic-v3.c:1086:43: error: incompatible integer to pointer conversion passing 'int' to parameter of type 'void *' [-Wint-conversion] 1086 | return single_open(file, xint_proc_show, pde_data(inode)); | ^~~~~~~~~~~~~~~ include/linux/seq_file.h:166:74: note: passing argument to parameter here 166 | int single_open(struct file *, int (*)(struct seq_file *, void *), void *); | ^ drivers/irqchip/irq-gic-v3.c:1089:30: error: variable has incomplete type 'const struct proc_ops' 1089 | static const struct proc_ops xint_proc_ops = { | ^ drivers/irqchip/irq-gic-v3.c:1089:21: note: forward declaration of 'struct proc_ops' 1089 | static const struct proc_ops xint_proc_ops = { | ^ drivers/irqchip/irq-gic-v3.c:1103:2: error: call to undeclared function 'proc_create_data'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1103 | proc_create_data("xint", 0644, desc->dir, &xint_proc_ops, irqp); | ^ drivers/irqchip/irq-gic-v3.c:1111:2: error: call to undeclared function 'remove_proc_entry'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1111 | remove_proc_entry("xint", desc->dir); | ^ 5 warnings and 6 errors generated. vim +1086 drivers/irqchip/irq-gic-v3.c 3053668e6b2119 Jinjie Ruan 2024-11-25 1083 3053668e6b2119 Jinjie Ruan 2024-11-25 1084 static int xint_proc_open(struct inode *inode, struct file *file) 3053668e6b2119 Jinjie Ruan 2024-11-25 1085 { 3053668e6b2119 Jinjie Ruan 2024-11-25 @1086 return single_open(file, xint_proc_show, pde_data(inode)); 3053668e6b2119 Jinjie Ruan 2024-11-25 1087 } 3053668e6b2119 Jinjie Ruan 2024-11-25 1088 :::::: The code at line 1086 was first introduced by commit :::::: 3053668e6b211924bb67c19d791a5a532eca2ad8 arm64: Introduce Xint software solution :::::: TO: Jinjie Ruan <ruanjinjie(a)huawei.com> :::::: CC: Jinjie Ruan <ruanjinjie(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1823/1823] include/../drivers/pci/msi/msi.h:113:57: warning: declaration of 'struct msix_entry' will not be visible outside of this function
by kernel test robot 14 Jan '25

14 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4fbc633527d173d6e350da6be39009c6a449a802 commit: ad540a13eb8292fc92651b3bf281088a502a85f9 [1823/1823] virtcca feature: fix msi iova map config: arm64-randconfig-004-20250114 (https://download.01.org/0day-ci/archive/20250114/202501140558.Dz2Pe9bS-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project f5cd181ffbb7cb61d582fe130d46580d5969d47a) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250114/202501140558.Dz2Pe9bS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501140558.Dz2Pe9bS-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/coda/coda_pci.c:5: In file included from include/linux/kvm_host.h:16: In file included from include/linux/mm.h:2243: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/coda/coda_pci.c:8: >> include/../drivers/pci/msi/msi.h:113:57: warning: declaration of 'struct msix_entry' will not be visible outside of this function [-Wvisibility] 113 | int __pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries, int minvec, | ^ 6 warnings generated. vim +113 include/../drivers/pci/msi/msi.h 897a0b6aa8c7ee Ahmed S. Darwish 2022-11-11 107 b12d0bec385b7a Ahmed S. Darwish 2022-11-11 108 /* MSI internal functions invoked from the public APIs */ b12d0bec385b7a Ahmed S. Darwish 2022-11-11 109 void pci_msi_shutdown(struct pci_dev *dev); 18e1926b8c8b7c Ahmed S. Darwish 2022-11-11 110 void pci_msix_shutdown(struct pci_dev *dev); b12d0bec385b7a Ahmed S. Darwish 2022-11-11 111 void pci_free_msi_irqs(struct pci_dev *dev); bbda3407982211 Ahmed S. Darwish 2022-11-11 112 int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec, struct irq_affinity *affd); be7496c1ef47e1 Ahmed S. Darwish 2022-11-11 @113 int __pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries, int minvec, be7496c1ef47e1 Ahmed S. Darwish 2022-11-11 114 int maxvec, struct irq_affinity *affd, int flags); 57127da98bc876 Ahmed S. Darwish 2022-11-11 115 void __pci_restore_msi_state(struct pci_dev *dev); 57127da98bc876 Ahmed S. Darwish 2022-11-11 116 void __pci_restore_msix_state(struct pci_dev *dev); b12d0bec385b7a Ahmed S. Darwish 2022-11-11 117 :::::: The code at line 113 was first introduced by commit :::::: be7496c1ef47e1ba8c4b389ee23178fcf066cc4e PCI/MSI: Move pci_enable_msix_range() to api.c :::::: TO: Ahmed S. Darwish <darwi(a)linutronix.de> :::::: CC: Thomas Gleixner <tglx(a)linutronix.de> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] [Backport] btrfs: check folio mapping after unlock in relocate_one_folio()
by Yongjian Sun 13 Jan '25

13 Jan '25

mainline inclusion from mainline-v6.12-rc3 commit 3e74859ee35edc33a022c3f3971df066ea0ca6b9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PL CVE: CVE-2024-56758 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When we call btrfs_read_folio() to bring a folio uptodate, we unlock the folio. The result of that is that a different thread can modify the mapping (like remove it with invalidate) before we call folio_lock(). This results in an invalid page and we need to try again. In particular, if we are relocating concurrently with aborting a transaction, this can result in a crash like the following: BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 76 PID: 1411631 Comm: kworker/u322:5 Workqueue: events_unbound btrfs_reclaim_bgs_work RIP: 0010:set_page_extent_mapped+0x20/0xb0 RSP: 0018:ffffc900516a7be8 EFLAGS: 00010246 RAX: ffffea009e851d08 RBX: ffffea009e0b1880 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffc900516a7b90 RDI: ffffea009e0b1880 RBP: 0000000003573000 R08: 0000000000000001 R09: ffff88c07fd2f3f0 R10: 0000000000000000 R11: 0000194754b575be R12: 0000000003572000 R13: 0000000003572fff R14: 0000000000100cca R15: 0000000005582fff FS: 0000000000000000(0000) GS:ffff88c07fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000407d00f002 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die+0x78/0xc0 ? page_fault_oops+0x2a8/0x3a0 ? __switch_to+0x133/0x530 ? wq_worker_running+0xa/0x40 ? exc_page_fault+0x63/0x130 ? asm_exc_page_fault+0x22/0x30 ? set_page_extent_mapped+0x20/0xb0 relocate_file_extent_cluster+0x1a7/0x940 relocate_data_extent+0xaf/0x120 relocate_block_group+0x20f/0x480 btrfs_relocate_block_group+0x152/0x320 btrfs_relocate_chunk+0x3d/0x120 btrfs_reclaim_bgs_work+0x2ae/0x4e0 process_scheduled_works+0x184/0x370 worker_thread+0xc6/0x3e0 ? blk_add_timer+0xb0/0xb0 kthread+0xae/0xe0 ? flush_tlb_kernel_range+0x90/0x90 ret_from_fork+0x2f/0x40 ? flush_tlb_kernel_range+0x90/0x90 ret_from_fork_asm+0x11/0x20 </TASK> This occurs because cleanup_one_transaction() calls destroy_delalloc_inodes() which calls invalidate_inode_pages2() which takes the folio_lock before setting mapping to NULL. We fail to check this, and subsequently call set_extent_mapping(), which assumes that mapping != NULL (in fact it asserts that in debug mode) Note that the "fixes" patch here is not the one that introduced the race (the very first iteration of this code from 2009) but a more recent change that made this particular crash happen in practice. Fixes: e7f1326cc24e ("btrfs: set page extent mapped after read_folio in relocate_one_page") CC: stable(a)vger.kernel.org # 6.1+ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Boris Burkov <boris(a)bur.io> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/relocation.c [The Evolution from Page to Folio] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/btrfs/relocation.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index a67dd544a52d..48915256fd8b 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -2732,7 +2732,7 @@ static int relocate_file_extent_cluster(struct inode *inode, PAGE_SIZE); if (ret) goto out; - +again: page = find_lock_page(inode->i_mapping, index); if (!page) { page_cache_sync_readahead(inode->i_mapping, @@ -2769,6 +2769,11 @@ static int relocate_file_extent_cluster(struct inode *inode, ret = -EIO; goto out; } + if (page->mapping != inode->i_mapping) { + unlock_page(page); + put_page(page); + goto again; + } } page_start = page_offset(page); -- 2.39.2

2 1

[PATCH OLK-5.10] drm/i915/hdcp: Add encoder check in hdcp2_get_capability
by He Yujie 13 Jan '25

13 Jan '25

From: Suraj Kandpal <suraj.kandpal(a)intel.com> mainline inclusion from mainline-v6.12-rc1 commit d34f4f058edf1235c103ca9c921dc54820d14d40 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQZ CVE: CVE-2024-53050 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add encoder check in intel_hdcp2_get_capability to avoid null pointer error. Signed-off-by: Suraj Kandpal <suraj.kandpal(a)intel.com> Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240722064451.3610512-3-sura… Conflicts: drivers/gpu/drm/i915/display/intel_hdcp.c drivers/gpu/drm/i915/display/intel_dp_hdcp.c [ Context conflict: 130849f8ec14("drm/i915/hdcp: Use intel_connector as argument for hdcp_2_2_capable") a35239a89259("drm/i915/hdcp: Use correct aux for capability check scenario") 287c0de8b294("drm/i915/hdcp: Move to direct reads for HDCP") 55d9b2b8e440("drm/i915/hdcp: Refactor intel_dp_hdcp2_capable") 8e754d9e9e8a("drm/i915/hdcp: Rename hdcp capable functions") the above patches are not merge. ] Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/gpu/drm/i915/display/intel_hdcp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/display/intel_hdcp.c b/drivers/gpu/drm/i915/display/intel_hdcp.c index 17a8c2e73a82..020dff600883 100644 --- a/drivers/gpu/drm/i915/display/intel_hdcp.c +++ b/drivers/gpu/drm/i915/display/intel_hdcp.c @@ -86,7 +86,7 @@ bool intel_hdcp_capable(struct intel_connector *connector) /* Is HDCP2.2 capable on Platform and Sink */ bool intel_hdcp2_capable(struct intel_connector *connector) { - struct intel_digital_port *dig_port = intel_attached_dig_port(connector); + struct intel_digital_port *dig_port; struct drm_i915_private *dev_priv = to_i915(connector->base.dev); struct intel_hdcp *hdcp = &connector->hdcp; bool capable = false; @@ -103,6 +103,11 @@ bool intel_hdcp2_capable(struct intel_connector *connector) } mutex_unlock(&dev_priv->hdcp_comp_mutex); + if (!intel_attached_encoder(connector)) + return false; + + dig_port = intel_attached_dig_port(connector); + /* Sink's capability for HDCP2.2 */ hdcp->shim->hdcp_2_2_capable(dig_port, &capable); -- 2.34.1

2 1

[PATCH OLK-5.10] octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
by He Yujie 13 Jan '25

13 Jan '25

From: Dipendra Khadka <kdipendra88(a)gmail.com> stable inclusion from stable-v5.10.231 commit 5ff9de1f2712cbca53da2e37d831eea7ffcb43b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGGI CVE: CVE-2024-56728 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e26f8eac6bb20b20fdb8f7dc695711ebce4c7c5c ] Add error pointer check after calling otx2_mbox_get_rsp(). Fixes: 75f36270990c ("octeontx2-pf: Support to enable/disable pause frames via ethtool") Fixes: d0cf9503e908 ("octeontx2-pf: ethtool fec mode support") Signed-off-by: Dipendra Khadka <kdipendra88(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Andrew Lunn <andrew(a)lunn.ch> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c [ Context conflict: d0cf9503e908 ("octeontx2-pf: ethtool fec mode support") is not merged ] Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c index 196354c142fe..43642eab200a 100644 --- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c @@ -264,6 +264,11 @@ static void otx2_get_pauseparam(struct net_device *netdev, if (!otx2_sync_mbox_msg(&pfvf->mbox)) { rsp = (struct cgx_pause_frm_cfg *) otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr); + if (IS_ERR(rsp)) { + mutex_unlock(&pfvf->mbox.lock); + return; + } + pause->rx_pause = rsp->rx_pause; pause->tx_pause = rsp->tx_pause; } -- 2.34.1

2 1

[PATCH OLK-5.10] nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
by He Yujie 13 Jan '25

13 Jan '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.231 commit b017697a517f8779ada4e8ce1c2c75dbf60a2636 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQZ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cd45e963e44b0f10d90b9e6c0e8b4f47f3c92471 upstream. Patch series "nilfs2: fix null-ptr-deref bugs on block tracepoints". This series fixes null pointer dereference bugs that occur when using nilfs2 and two block-related tracepoints. This patch (of 2): It has been reported that when using "block:block_touch_buffer" tracepoint, touch_buffer() called from __nilfs_get_folio_block() causes a NULL pointer dereference, or a general protection fault when KASAN is enabled. This happens because since the tracepoint was added in touch_buffer(), it references the dev_t member bh->b_bdev->bd_dev regardless of whether the buffer head has a pointer to a block_device structure. In the current implementation, the block_device structure is set after the function returns to the caller. Here, touch_buffer() is used to mark the folio/page that owns the buffer head as accessed, but the common search helper for folio/page used by the caller function was optimized to mark the folio/page as accessed when it was reimplemented a long time ago, eliminating the need to call touch_buffer() here in the first place. So this solves the issue by eliminating the touch_buffer() call itself. Link: https://lkml.kernel.org/r/20241106160811.3316-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20241106160811.3316-2-konishi.ryusuke@gmail.com Fixes: 5305cb830834 ("block: add block_{touch|dirty}_buffer tracepoint") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: Ubisectech Sirius <bugreport(a)valiantsec.com> Closes: https://lkml.kernel.org/r/86bd3013-887e-4e38-960f-ca45c657f032.bugreport@va… Reported-by: syzbot+9982fb8d18eba905abe2(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9982fb8d18eba905abe2 Tested-by: syzbot+9982fb8d18eba905abe2(a)syzkaller.appspotmail.com Cc: Tejun Heo <tj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- fs/nilfs2/page.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index 80f1f371d729..d2d6d5c761e8 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -39,7 +39,6 @@ __nilfs_get_page_block(struct page *page, unsigned long block, pgoff_t index, first_block = (unsigned long)index << (PAGE_SHIFT - blkbits); bh = nilfs_page_get_nth_block(page, block - first_block); - touch_buffer(bh); wait_on_buffer(bh); return bh; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix rt warning
by Zheng Zucheng 13 Jan '25

13 Jan '25

Zheng Zucheng (2): sched/rt: Fix rt_runtime leaks with cpu hotplug sched: Replace WARN_ON_ONCE to printk_deferred_once kernel/sched/rt.c | 14 ++++++++++---- kernel/sched/sched.h | 2 +- 2 files changed, 11 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-25.03 0/1] etmem: fix use-after-free of mm in the scan release process
by chenrenhui 13 Jan '25

13 Jan '25

etmem: fix use-after-free of mm in the scan release process chenrenhui (1): etmem: fix use-after-free of mm in the scan release process fs/proc/etmem_proc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.33.0

2 2

[PATCH OLK-6.6] LoongArch: Fix sleeping in atomic context for PREEMPT_RT
by Xiaomeng Zhang 13 Jan '25

13 Jan '25

From: Huacai Chen <chenhuacai(a)loongson.cn> stable inclusion from stable-v6.6.66 commit c5f89458a2ea0800866b9fc690d3fa8367dc8f8d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP8 CVE: CVE-2024-56585 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 88fd2b70120d52c1010257d36776876941375490 ] Commit bab1c299f3945ffe79 ("LoongArch: Fix sleeping in atomic context in setup_tlb_handler()") changes the gfp flag from GFP_KERNEL to GFP_ATOMIC for alloc_pages_node(). However, for PREEMPT_RT kernels we can still get a "sleeping in atomic context" error: [ 0.372259] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 0.372266] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 [ 0.372268] preempt_count: 1, expected: 0 [ 0.372270] RCU nest depth: 1, expected: 1 [ 0.372272] 3 locks held by swapper/1/0: [ 0.372274] #0: 900000000c9f5e60 (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x524/0x1c60 [ 0.372294] #1: 90000000087013b8 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x50/0x140 [ 0.372305] #2: 900000047fffd388 (&zone->lock){+.+.}-{3:3}, at: __rmqueue_pcplist+0x30c/0xea0 [ 0.372314] irq event stamp: 0 [ 0.372316] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 0.372322] hardirqs last disabled at (0): [<9000000005947320>] copy_process+0x9c0/0x26e0 [ 0.372329] softirqs last enabled at (0): [<9000000005947320>] copy_process+0x9c0/0x26e0 [ 0.372335] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 0.372341] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.12.0-rc7+ #1891 [ 0.372346] Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022 [ 0.372349] Stack : 0000000000000089 9000000005a0db9c 90000000071519c8 9000000100388000 [ 0.372486] 900000010038b890 0000000000000000 900000010038b898 9000000007e53788 [ 0.372492] 900000000815bcc8 900000000815bcc0 900000010038b700 0000000000000001 [ 0.372498] 0000000000000001 4b031894b9d6b725 00000000055ec000 9000000100338fc0 [ 0.372503] 00000000000000c4 0000000000000001 000000000000002d 0000000000000003 [ 0.372509] 0000000000000030 0000000000000003 00000000055ec000 0000000000000003 [ 0.372515] 900000000806d000 9000000007e53788 00000000000000b0 0000000000000004 [ 0.372521] 0000000000000000 0000000000000000 900000000c9f5f10 0000000000000000 [ 0.372526] 90000000076f12d8 9000000007e53788 9000000005924778 0000000000000000 [ 0.372532] 00000000000000b0 0000000000000004 0000000000000000 0000000000070000 [ 0.372537] ... [ 0.372540] Call Trace: [ 0.372542] [<9000000005924778>] show_stack+0x38/0x180 [ 0.372548] [<90000000071519c4>] dump_stack_lvl+0x94/0xe4 [ 0.372555] [<900000000599b880>] __might_resched+0x1a0/0x260 [ 0.372561] [<90000000071675cc>] rt_spin_lock+0x4c/0x140 [ 0.372565] [<9000000005cbb768>] __rmqueue_pcplist+0x308/0xea0 [ 0.372570] [<9000000005cbed84>] get_page_from_freelist+0x564/0x1c60 [ 0.372575] [<9000000005cc0d98>] __alloc_pages_noprof+0x218/0x1820 [ 0.372580] [<900000000593b36c>] tlb_init+0x1ac/0x298 [ 0.372585] [<9000000005924b74>] per_cpu_trap_init+0x114/0x140 [ 0.372589] [<9000000005921964>] cpu_probe+0x4e4/0xa60 [ 0.372592] [<9000000005934874>] start_secondary+0x34/0xc0 [ 0.372599] [<900000000715615c>] smpboot_entry+0x64/0x6c This is because in PREEMPT_RT kernels normal spinlocks are replaced by rt spinlocks and rt_spin_lock() will cause sleeping. Fix it by disabling NUMA optimization completely for PREEMPT_RT kernels. Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- arch/loongarch/mm/tlb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/loongarch/mm/tlb.c b/arch/loongarch/mm/tlb.c index 5fcda8adf90d..5503d4e4b096 100644 --- a/arch/loongarch/mm/tlb.c +++ b/arch/loongarch/mm/tlb.c @@ -289,7 +289,7 @@ static void setup_tlb_handler(int cpu) /* Avoid lockdep warning */ rcu_cpu_starting(cpu); -#ifdef CONFIG_NUMA +#if defined(CONFIG_NUMA) && !defined(CONFIG_PREEMPT_RT) vec_sz = sizeof(exception_handlers); if (pcpu_handlers[cpu]) -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: put bpf_link's program when link is safe to be deallocated
by Tengda Wu 13 Jan '25

13 Jan '25

From: Andrii Nakryiko <andrii(a)kernel.org> stable inclusion from stable-v6.6.66 commit 5fe23c57abadfd46a7a66e81f3536e4757252a0b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHAY1 CVE: CVE-2024-56786 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f44ec8733a8469143fde1984b5e6931b2e2f6f3f ] In general, BPF link's underlying BPF program should be considered to be reachable through attach hook -> link -> prog chain, and, pessimistically, we have to assume that as long as link's memory is not safe to free, attach hook's code might hold a pointer to BPF program and use it. As such, it's not (generally) correct to put link's program early before waiting for RCU GPs to go through. More eager bpf_prog_put() that we currently do is mostly correct due to BPF program's release code doing similar RCU GP waiting, but as will be shown in the following patches, BPF program can be non-sleepable (and, thus, reliant on only "classic" RCU GP), while BPF link's attach hook can have sleepable semantics and needs to be protected by RCU Tasks Trace, and for such cases BPF link has to go through RCU Tasks Trace + "classic" RCU GPs before being deallocated. And so, if we put BPF program early, we might free BPF program before we free BPF link, leading to use-after-free situation. So, this patch defers bpf_prog_put() until we are ready to perform bpf_link's deallocation. At worst, this delays BPF program freeing by one extra RCU GP, but that seems completely acceptable. Alternatively, we'd need more elaborate ways to determine BPF hook, BPF link, and BPF program lifetimes, and how they relate to each other, which seems like an unnecessary complication. Note, for most BPF links we still will perform eager bpf_prog_put() and link dealloc, so for those BPF links there are no observable changes whatsoever. Only BPF links that use deferred dealloc might notice slightly delayed freeing of BPF programs. Also, to reduce code and logic duplication, extract program put + link dealloc logic into bpf_link_dealloc() helper. Link: https://lore.kernel.org/20241101181754.782341-1-andrii@kernel.org Tested-by: Jordan Rife <jrife(a)google.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/bpf/syscall.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index d5eb3a3edb31..46ef10fddd98 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -2877,12 +2877,24 @@ void bpf_link_inc(struct bpf_link *link) atomic64_inc(&link->refcnt); } +static void bpf_link_dealloc(struct bpf_link *link) +{ + /* now that we know that bpf_link itself can't be reached, put underlying BPF program */ + if (link->prog) + bpf_prog_put(link->prog); + + /* free bpf_link and its containing memory */ + if (link->ops->dealloc_deferred) + link->ops->dealloc_deferred(link); + else + link->ops->dealloc(link); +} + static void bpf_link_defer_dealloc_rcu_gp(struct rcu_head *rcu) { struct bpf_link *link = container_of(rcu, struct bpf_link, rcu); - /* free bpf_link and its containing memory */ - link->ops->dealloc_deferred(link); + bpf_link_dealloc(link); } static void bpf_link_defer_dealloc_mult_rcu_gp(struct rcu_head *rcu) @@ -2904,7 +2916,6 @@ static void bpf_link_free(struct bpf_link *link) sleepable = link->prog->aux->sleepable; /* detach BPF program, clean up used resources */ ops->release(link); - bpf_prog_put(link->prog); } if (ops->dealloc_deferred) { /* schedule BPF link deallocation; if underlying BPF program @@ -2915,8 +2926,9 @@ static void bpf_link_free(struct bpf_link *link) call_rcu_tasks_trace(&link->rcu, bpf_link_defer_dealloc_mult_rcu_gp); else call_rcu(&link->rcu, bpf_link_defer_dealloc_rcu_gp); - } else if (ops->dealloc) - ops->dealloc(link); + } else if (ops->dealloc) { + bpf_link_dealloc(link); + } } static void bpf_link_put_deferred(struct work_struct *work) -- 2.34.1

2 1