- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] drm/amd/display: fix double free issue during amdgpu module unload
by liwei 29 Oct '24

29 Oct '24

From: Tim Huang <tim.huang(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit 20b5a8f9f4670a8503aa9fa95ca632e77c6bf55d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDA CVE: CVE-2024-49989 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Flexible endpoints use DIGs from available inflexible endpoints, so only the encoders of inflexible links need to be freed. Otherwise, a double free issue may occur when unloading the amdgpu module. [ 279.190523] RIP: 0010:__slab_free+0x152/0x2f0 [ 279.190577] Call Trace: [ 279.190580] <TASK> [ 279.190582] ? show_regs+0x69/0x80 [ 279.190590] ? die+0x3b/0x90 [ 279.190595] ? do_trap+0xc8/0xe0 [ 279.190601] ? do_error_trap+0x73/0xa0 [ 279.190605] ? __slab_free+0x152/0x2f0 [ 279.190609] ? exc_invalid_op+0x56/0x70 [ 279.190616] ? __slab_free+0x152/0x2f0 [ 279.190642] ? asm_exc_invalid_op+0x1f/0x30 [ 279.190648] ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu] [ 279.191096] ? __slab_free+0x152/0x2f0 [ 279.191102] ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu] [ 279.191469] kfree+0x260/0x2b0 [ 279.191474] dcn10_link_encoder_destroy+0x19/0x30 [amdgpu] [ 279.191821] link_destroy+0xd7/0x130 [amdgpu] [ 279.192248] dc_destruct+0x90/0x270 [amdgpu] [ 279.192666] dc_destroy+0x19/0x40 [amdgpu] [ 279.193020] amdgpu_dm_fini+0x16e/0x200 [amdgpu] [ 279.193432] dm_hw_fini+0x26/0x40 [amdgpu] [ 279.193795] amdgpu_device_fini_hw+0x24c/0x400 [amdgpu] [ 279.194108] amdgpu_driver_unload_kms+0x4f/0x70 [amdgpu] [ 279.194436] amdgpu_pci_remove+0x40/0x80 [amdgpu] [ 279.194632] pci_device_remove+0x3a/0xa0 [ 279.194638] device_remove+0x40/0x70 [ 279.194642] device_release_driver_internal+0x1ad/0x210 [ 279.194647] driver_detach+0x4e/0xa0 [ 279.194650] bus_remove_driver+0x6f/0xf0 [ 279.194653] driver_unregister+0x33/0x60 [ 279.194657] pci_unregister_driver+0x44/0x90 [ 279.194662] amdgpu_exit+0x19/0x1f0 [amdgpu] [ 279.194939] __do_sys_delete_module.isra.0+0x198/0x2f0 [ 279.194946] __x64_sys_delete_module+0x16/0x20 [ 279.194950] do_syscall_64+0x58/0x120 [ 279.194954] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 279.194980] </TASK> Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Tim Huang <tim.huang(a)amd.com> Reviewed-by: Roman Li <roman.li(a)amd.com> Signed-off-by: Roman Li <roman.li(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/link/link_factory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/link/link_factory.c b/drivers/gpu/drm/amd/display/dc/link/link_factory.c index 33bb96f770b8..eb7c9f226af5 100644 --- a/drivers/gpu/drm/amd/display/dc/link/link_factory.c +++ b/drivers/gpu/drm/amd/display/dc/link/link_factory.c @@ -403,7 +403,7 @@ static void link_destruct(struct dc_link *link) if (link->panel_cntl) link->panel_cntl->funcs->destroy(&link->panel_cntl); - if (link->link_enc) { + if (link->link_enc && !link->is_dig_mapping_flexible) { /* Update link encoder resource tracking variables. These are used for * the dynamic assignment of link encoders to streams. Virtual links * are not assigned encoder resources on creation. -- 2.25.1

2 1

[PATCH OLK-6.6] nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
by Zhang Kunbo 29 Oct '24

29 Oct '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v6.6.54 commit 21839b6fbc3c41b3e374ecbdb0cabbbb2c53cf34 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPKK CVE: CVE-2024-47699 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9403001ad65ae4f4c5de368bdda3a0636b51d51a ] Patch series "nilfs2: fix potential issues with empty b-tree nodes". This series addresses three potential issues with empty b-tree nodes that can occur with corrupted filesystem images, including one recently discovered by syzbot. This patch (of 3): If a b-tree is broken on the device, and the b-tree height is greater than 2 (the level of the root node is greater than 1) even if the number of child nodes of the b-tree root is 0, a NULL pointer dereference occurs in nilfs_btree_prepare_insert(), which is called from nilfs_btree_insert(). This is because, when the number of child nodes of the b-tree root is 0, nilfs_btree_do_lookup() does not set the block buffer head in any of path[x].bp_bh, leaving it as the initial value of NULL, but if the level of the b-tree root node is greater than 1, nilfs_btree_get_nonroot_node(), which accesses the buffer memory of path[x].bp_bh, is called. Fix this issue by adding a check to nilfs_btree_root_broken(), which performs sanity checks when reading the root node from the device, to detect this inconsistency. Thanks to Lizhi Xu for trying to solve the bug and clarifying the cause early on. Link: https://lkml.kernel.org/r/20240904081401.16682-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20240902084101.138971-1-lizhi.xu@windriver.com Link: https://lkml.kernel.org/r/20240904081401.16682-2-konishi.ryusuke@gmail.com Fixes: 17c76b0104e4 ("nilfs2: B-tree based block mapping") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+9bff4c7b992038a7409f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9bff4c7b992038a7409f Cc: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- fs/nilfs2/btree.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c index 598f05867059..fa51ed649968 100644 --- a/fs/nilfs2/btree.c +++ b/fs/nilfs2/btree.c @@ -381,7 +381,8 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node, if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN || level >= NILFS_BTREE_LEVEL_MAX || nchildren < 0 || - nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) { + nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX || + (nchildren == 0 && level > NILFS_BTREE_LEVEL_NODE_MIN))) { nilfs_crit(inode->i_sb, "bad btree root (ino=%lu): level = %d, flags = 0x%x, nchildren = %d", inode->i_ino, level, flags, nchildren); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
by Zhang Kunbo 29 Oct '24

29 Oct '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.227 commit 24bf40740a3da6b4056721da34997ae6938f3da1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPKK CVE: CVE-2024-47699 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 9403001ad65ae4f4c5de368bdda3a0636b51d51a ] Patch series "nilfs2: fix potential issues with empty b-tree nodes". This series addresses three potential issues with empty b-tree nodes that can occur with corrupted filesystem images, including one recently discovered by syzbot. This patch (of 3): If a b-tree is broken on the device, and the b-tree height is greater than 2 (the level of the root node is greater than 1) even if the number of child nodes of the b-tree root is 0, a NULL pointer dereference occurs in nilfs_btree_prepare_insert(), which is called from nilfs_btree_insert(). This is because, when the number of child nodes of the b-tree root is 0, nilfs_btree_do_lookup() does not set the block buffer head in any of path[x].bp_bh, leaving it as the initial value of NULL, but if the level of the b-tree root node is greater than 1, nilfs_btree_get_nonroot_node(), which accesses the buffer memory of path[x].bp_bh, is called. Fix this issue by adding a check to nilfs_btree_root_broken(), which performs sanity checks when reading the root node from the device, to detect this inconsistency. Thanks to Lizhi Xu for trying to solve the bug and clarifying the cause early on. Link: https://lkml.kernel.org/r/20240904081401.16682-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20240902084101.138971-1-lizhi.xu@windriver.com Link: https://lkml.kernel.org/r/20240904081401.16682-2-konishi.ryusuke@gmail.com Fixes: 17c76b0104e4 ("nilfs2: B-tree based block mapping") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+9bff4c7b992038a7409f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9bff4c7b992038a7409f Cc: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- fs/nilfs2/btree.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c index 90842645328b..94cffa0e7065 100644 --- a/fs/nilfs2/btree.c +++ b/fs/nilfs2/btree.c @@ -381,7 +381,8 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node, if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN || level >= NILFS_BTREE_LEVEL_MAX || nchildren < 0 || - nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) { + nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX || + (nchildren == 0 && level > NILFS_BTREE_LEVEL_NODE_MIN))) { nilfs_crit(inode->i_sb, "bad btree root (ino=%lu): level = %d, flags = 0x%x, nchildren = %d", inode->i_ino, level, flags, nchildren); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
by Liu Jian 29 Oct '24

29 Oct '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.12-rc1 commit 9c778fe48d20ef362047e3376dee56d77f8500d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPK8 CVE: CVE-2024-47685 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th->res1) Use skb_put_zero() to clear the whole TCP header, as done in nf_reject_ip_tcphdr_put() BUG: KMSAN: uninit-value in nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588 do_softirq+0x9a/0x100 kernel/softirq.c:455 __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:382 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:908 [inline] __dev_queue_xmit+0x2692/0x5610 net/core/dev.c:4450 dev_queue_xmit include/linux/netdevice.h:3105 [inline] neigh_resolve_output+0x9ca/0xae0 net/core/neighbour.c:1565 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x2347/0x2ba0 net/ipv6/ip6_output.c:141 __ip6_finish_output net/ipv6/ip6_output.c:215 [inline] ip6_finish_output+0xbb8/0x14b0 net/ipv6/ip6_output.c:226 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x356/0x620 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip6_xmit+0x1ba6/0x25d0 net/ipv6/ip6_output.c:366 inet6_csk_xmit+0x442/0x530 net/ipv6/inet6_connection_sock.c:135 __tcp_transmit_skb+0x3b07/0x4880 net/ipv4/tcp_output.c:1466 tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline] tcp_connect+0x35b6/0x7130 net/ipv4/tcp_output.c:4143 tcp_v6_connect+0x1bcc/0x1e40 net/ipv6/tcp_ipv6.c:333 __inet_stream_connect+0x2ef/0x1730 net/ipv4/af_inet.c:679 inet_stream_connect+0x6a/0xd0 net/ipv4/af_inet.c:750 __sys_connect_file net/socket.c:2061 [inline] __sys_connect+0x606/0x690 net/socket.c:2078 __do_sys_connect net/socket.c:2088 [inline] __se_sys_connect net/socket.c:2085 [inline] __x64_sys_connect+0x91/0xe0 net/socket.c:2085 x64_sys_call+0x27a5/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: nf_reject_ip6_tcphdr_put+0x60c/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:249 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588 Uninit was stored to memory at: nf_reject_ip6_tcphdr_put+0x2ca/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:231 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588 Uninit was created at: slab_post_alloc_hook mm/slub.c:3998 [inline] slab_alloc_node mm/slub.c:4041 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4084 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1320 [inline] nf_send_reset6+0x98d/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:327 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588 Fixes: c8d7b98bec43 ("netfilter: move nf_send_resetX() code to nf_reject_ipvX modules") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Link: https://patch.msgid.link/20240913170615.3670897-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv6/netfilter/nf_reject_ipv6.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c index 24858402e374..0edf9c1192de 100644 --- a/net/ipv6/netfilter/nf_reject_ipv6.c +++ b/net/ipv6/netfilter/nf_reject_ipv6.c @@ -92,33 +92,23 @@ void nf_reject_ip6_tcphdr_put(struct sk_buff *nskb, const struct tcphdr *oth, unsigned int otcplen) { struct tcphdr *tcph; - int needs_ack; skb_reset_transport_header(nskb); - tcph = skb_put(nskb, sizeof(struct tcphdr)); + tcph = skb_put_zero(nskb, sizeof(struct tcphdr)); /* Truncate to length (no data) */ tcph->doff = sizeof(struct tcphdr)/4; tcph->source = oth->dest; tcph->dest = oth->source; if (oth->ack) { - needs_ack = 0; tcph->seq = oth->ack_seq; - tcph->ack_seq = 0; } else { - needs_ack = 1; tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin + otcplen - (oth->doff<<2)); - tcph->seq = 0; + tcph->ack = 1; } - /* Reset flags */ - ((u_int8_t *)tcph)[13] = 0; tcph->rst = 1; - tcph->ack = needs_ack; - tcph->window = 0; - tcph->urg_ptr = 0; - tcph->check = 0; /* Adjust TCP checksum */ tcph->check = csum_ipv6_magic(&ipv6_hdr(nskb)->saddr, -- 2.34.1

2 1

[PATCH OLK-5.10] nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
by Zhang Kunbo 29 Oct '24

29 Oct '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.227 commit 24bf40740a3da6b4056721da34997ae6938f3da1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPKK CVE: CVE-2024-47699 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 9403001ad65ae4f4c5de368bdda3a0636b51d51a ] Patch series "nilfs2: fix potential issues with empty b-tree nodes". This series addresses three potential issues with empty b-tree nodes that can occur with corrupted filesystem images, including one recently discovered by syzbot. This patch (of 3): If a b-tree is broken on the device, and the b-tree height is greater than 2 (the level of the root node is greater than 1) even if the number of child nodes of the b-tree root is 0, a NULL pointer dereference occurs in nilfs_btree_prepare_insert(), which is called from nilfs_btree_insert(). This is because, when the number of child nodes of the b-tree root is 0, nilfs_btree_do_lookup() does not set the block buffer head in any of path[x].bp_bh, leaving it as the initial value of NULL, but if the level of the b-tree root node is greater than 1, nilfs_btree_get_nonroot_node(), which accesses the buffer memory of path[x].bp_bh, is called. Fix this issue by adding a check to nilfs_btree_root_broken(), which performs sanity checks when reading the root node from the device, to detect this inconsistency. Thanks to Lizhi Xu for trying to solve the bug and clarifying the cause early on. Link: https://lkml.kernel.org/r/20240904081401.16682-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20240902084101.138971-1-lizhi.xu@windriver.com Link: https://lkml.kernel.org/r/20240904081401.16682-2-konishi.ryusuke@gmail.com Fixes: 17c76b0104e4 ("nilfs2: B-tree based block mapping") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+9bff4c7b992038a7409f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9bff4c7b992038a7409f Cc: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- fs/nilfs2/btree.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c index 43a180be9381..4078907a03e7 100644 --- a/fs/nilfs2/btree.c +++ b/fs/nilfs2/btree.c @@ -381,7 +381,8 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node, if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN || level >= NILFS_BTREE_LEVEL_MAX || nchildren < 0 || - nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) { + nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX || + (nchildren == 0 && level > NILFS_BTREE_LEVEL_NODE_MIN))) { nilfs_crit(inode->i_sb, "bad btree root (ino=%lu): level = %d, flags = 0x%x, nchildren = %d", inode->i_ino, level, flags, nchildren); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] NFSD: Limit the number of concurrent async COPY operations
by Li Lingfeng 29 Oct '24

29 Oct '24

From: Chuck Lever <chuck.lever(a)oracle.com> mainline inclusion from mainline-v6.12-rc1 commit aadc3bbea163b6caaaebfdd2b6c4667fbc726752 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9C CVE: CVE-2024-49974 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- Nothing appears to limit the number of concurrent async COPY operations that clients can start. In addition, AFAICT each async COPY can copy an unlimited number of 4MB chunks, so can run for a long time. Thus IMO async COPY can become a DoS vector. Add a restriction mechanism that bounds the number of concurrent background COPY operations. Start simple and try to be fair -- this patch implements a per-namespace limit. An async COPY request that occurs while this limit is exceeded gets NFS4ERR_DELAY. The requesting client can choose to send the request again after a delay or fall back to a traditional read/write style copy. If there is need to make the mechanism more sophisticated, we can visit that in future patches. Cc: stable(a)vger.kernel.org Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/nfs4proc.c fs/nfsd/xdr4.h [Commit 87689df69491("NFSD: Shrink size of struct nfsd4_copy") add freeing of copy->cp_src in nfs4_put_copy; Commit 1913cdf56cb5("NFSD: Replace boolean fields in struct nfsd4_copy") replace copy->cp_synchronous with nfsd4_copy_is_async in nfsd4_copy; Commit 9ed666eba4e0("NFSD: Async COPY result needs to return a write verifier") move net_generic to the begining of nfsd4_copy; Commit 81e722978ad2("NFSD: fix problems with cleanup on errors in nfsd4_copy") add the initialization of async_copy->copies in nfsd4_copy; Commit 34e8f9ec4c9a("NFSD: fix leaked reference count of nfsd4_ssc_umount_item") remove the comment at the end of nfsd4_copy; Commit df24ac7a2e3a("NFSD: enhance inter-server copy cleanup") removed ss_mnt and add ss_nsui in nfsd4_copy; Commit 1913cdf56cb5("NFSD: Replace boolean fields in struct nfsd4_copy") add nfsd4_copy_set_sync after nfsd4_copy; Commit 75333d48f922("NFSD: fix use-after-free in __nfs42_ssc_open()") remove nfsd4_interssc_disconnect(); Commit 34e8f9ec4c9a("NFSD: fix leaked reference count of nfsd4_ssc_umount_item") moved the position of the comment.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/netns.h | 1 + fs/nfsd/nfs4proc.c | 11 +++++++++-- fs/nfsd/nfs4state.c | 1 + fs/nfsd/xdr4.h | 1 + 4 files changed, 12 insertions(+), 2 deletions(-) diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h index 7346acda9d76..04360a51a16f 100644 --- a/fs/nfsd/netns.h +++ b/fs/nfsd/netns.h @@ -128,6 +128,7 @@ struct nfsd_net { u32 s2s_cp_cl_id; struct idr s2s_cp_stateids; spinlock_t s2s_cp_lock; + atomic_t pending_async_copies; /* * Version information diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 4344b5d98318..7bca44450d27 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1111,6 +1111,7 @@ void nfs4_put_copy(struct nfsd4_copy *copy) { if (!refcount_dec_and_test(&copy->refcount)) return; + atomic_dec(&copy->cp_nn->pending_async_copies); kfree(copy); } @@ -1534,10 +1535,16 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, if (!copy->cp_synchronous) { struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); - status = nfserrno(-ENOMEM); async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL); if (!async_copy) goto out_err; + async_copy->cp_nn = nn; + /* Arbitrary cap on number of pending async copy operations */ + if (atomic_inc_return(&nn->pending_async_copies) > + (int)rqstp->rq_pool->sp_nrthreads) { + atomic_dec(&nn->pending_async_copies); + goto out_err; + } if (!nfs4_init_copy_state(nn, copy)) goto out_err; refcount_set(&async_copy->refcount, 1); @@ -1562,7 +1569,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, out_err: if (async_copy) cleanup_async_copy(async_copy); - status = nfserrno(-ENOMEM); + status = nfserr_jukebox; if (!copy->cp_intra) nfsd4_interssc_disconnect(copy->ss_mnt); goto out; diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 665d0eaeb8db..36d1ee0d7846 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -7327,6 +7327,7 @@ static int nfs4_state_create_net(struct net *net) spin_lock_init(&nn->client_lock); spin_lock_init(&nn->s2s_cp_lock); idr_init(&nn->s2s_cp_stateids); + atomic_set(&nn->pending_async_copies, 0); spin_lock_init(&nn->blocked_locks_lock); INIT_LIST_HEAD(&nn->blocked_locks_lru); diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h index 679d40af1bbb..1ced060704a3 100644 --- a/fs/nfsd/xdr4.h +++ b/fs/nfsd/xdr4.h @@ -579,6 +579,7 @@ struct nfsd4_copy { struct vfsmount *ss_mnt; struct nfs_fh c_fh; nfs4_stateid stateid; + struct nfsd_net *cp_nn; }; extern bool inter_copy_offload_enable; -- 2.31.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-49955
by liwei 29 Oct '24

29 Oct '24

Armin Wolf (2): ACPI: battery: Simplify battery hook locking ACPI: battery: Fix possible crash when unregistering a battery hook drivers/acpi/battery.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] CVE-2024-49955
by liwei 29 Oct '24

29 Oct '24

Armin Wolf (2): ACPI: battery: Simplify battery hook locking ACPI: battery: Fix possible crash when unregistering a battery hook drivers/acpi/battery.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-49955
by liwei 29 Oct '24

29 Oct '24

Armin Wolf (2): ACPI: battery: Simplify battery hook locking ACPI: battery: Fix possible crash when unregistering a battery hook drivers/acpi/battery.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] usb: typec: tipd: Free IRQ only if it was requested before
by Tong Tiangen 29 Oct '24

29 Oct '24

From: Wadim Egorov <w.egorov(a)phytec.de> stable inclusion from stable-v6.6.57 commit b72bf5cade51ba4055c8a8998d275e72e6b521ce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRI8 CVE: CVE-2024-50057 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit db63d9868f7f310de44ba7bea584e2454f8b4ed0 ] In polling mode, if no IRQ was requested there is no need to free it. Call devm_free_irq() only if client->irq is set. This fixes the warning caused by the tps6598x module removal: WARNING: CPU: 2 PID: 333 at kernel/irq/devres.c:144 devm_free_irq+0x80/0x8c ... ... Call trace: devm_free_irq+0x80/0x8c tps6598x_remove+0x28/0x88 [tps6598x] i2c_device_remove+0x2c/0x9c device_remove+0x4c/0x80 device_release_driver_internal+0x1cc/0x228 driver_detach+0x50/0x98 bus_remove_driver+0x6c/0xbc driver_unregister+0x30/0x60 i2c_del_driver+0x54/0x64 tps6598x_i2c_driver_exit+0x18/0xc3c [tps6598x] __arm64_sys_delete_module+0x184/0x264 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0xc8/0xe8 do_el0_svc+0x20/0x2c el0_svc+0x28/0x98 el0t_64_sync_handler+0x13c/0x158 el0t_64_sync+0x190/0x194 Signed-off-by: Wadim Egorov <w.egorov(a)phytec.de> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://lore.kernel.org/r/20240816124150.608125-1-w.egorov@phytec.de Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- drivers/usb/typec/tipd/core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c index 125269f39f83..01db27cbf1d1 100644 --- a/drivers/usb/typec/tipd/core.c +++ b/drivers/usb/typec/tipd/core.c @@ -907,6 +907,8 @@ static void tps6598x_remove(struct i2c_client *client) if (!client->irq) cancel_delayed_work_sync(&tps->wq_poll); + else + devm_free_irq(tps->dev, client->irq, tps); tps6598x_disconnect(tps, 0); typec_unregister_port(tps->port); -- 2.25.1

2 1

[openeuler:OLK-5.10 19410/30000] fs/xfs/xfs_buf_item.o: warning: objtool: xfs_buf_item_format()+0xb66: unreachable instruction
by kernel test robot 29 Oct '24

29 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c0e2b3247172ef46c6a75823867d668ad1c84e0c commit: f2c902d8c653f8021f9761092a27f7b9db42b662 [19410/30000] tracing: Make tracepoint lockdep check actually test something config: x86_64-randconfig-013-20241029 (https://download.01.org/0day-ci/archive/20241029/202410291534.uR1i7cip-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410291534.uR1i7cip-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410291534.uR1i7cip-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/xfs/xfs_buf_item.o: warning: objtool: xfs_buf_item_format()+0xb66: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] mm/gup: fix gup_pud_range() for dax
by Tong Tiangen 29 Oct '24

29 Oct '24

From: John Starks <jostarks(a)microsoft.com> stable inclusion from stable-v5.10.159 commit f1cf856123ceb766c49967ec79b841030fa1741f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRF3 CVE: CVE-2022-48986 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fcd0ccd836ffad73d98a66f6fea7b16f735ea920 upstream. For dax pud, pud_huge() returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Commit 414fd080d125 ("mm/gup: fix gup_pmd_range() for dax") fixed devmap-backed huge PMDs, but missed devmap-backed huge PUDs. Fix this as well. This fixes the below kernel panic: general protection fault, probably for non-canonical address 0x69e7c000cc478: 0000 [#1] SMP < snip > Call Trace: <TASK> get_user_pages_fast+0x1f/0x40 iov_iter_get_pages+0xc6/0x3b0 ? mempool_alloc+0x5d/0x170 bio_iov_iter_get_pages+0x82/0x4e0 ? bvec_alloc+0x91/0xc0 ? bio_alloc_bioset+0x19a/0x2a0 blkdev_direct_IO+0x282/0x480 ? __io_complete_rw_common+0xc0/0xc0 ? filemap_range_has_page+0x82/0xc0 generic_file_direct_write+0x9d/0x1a0 ? inode_update_time+0x24/0x30 __generic_file_write_iter+0xbd/0x1e0 blkdev_write_iter+0xb4/0x150 ? io_import_iovec+0x8d/0x340 io_write+0xf9/0x300 io_issue_sqe+0x3c3/0x1d30 ? sysvec_reschedule_ipi+0x6c/0x80 __io_queue_sqe+0x33/0x240 ? fget+0x76/0xa0 io_submit_sqes+0xe6a/0x18d0 ? __fget_light+0xd1/0x100 __x64_sys_io_uring_enter+0x199/0x880 ? __context_tracking_enter+0x1f/0x70 ? irqentry_exit_to_user_mode+0x24/0x30 ? irqentry_exit+0x1d/0x30 ? __context_tracking_exit+0xe/0x70 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fc97c11a7be < snip > </TASK> ---[ end trace 48b2e0e67debcaeb ]--- RIP: 0010:internal_get_user_pages_fast+0x340/0x990 < snip > Kernel panic - not syncing: Fatal exception Kernel Offset: disabled Link: https://lkml.kernel.org/r/1670392853-28252-1-git-send-email-ssengar@linux.m… Fixes: 414fd080d125 ("mm/gup: fix gup_pmd_range() for dax") Signed-off-by: John Starks <jostarks(a)microsoft.com> Signed-off-by: Saurabh Sengar <ssengar(a)linux.microsoft.com> Cc: Jan Kara <jack(a)suse.cz> Cc: Yu Zhao <yuzhao(a)google.com> Cc: Jason Gunthorpe <jgg(a)nvidia.com> Cc: John Hubbard <jhubbard(a)nvidia.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: Alistair Popple <apopple(a)nvidia.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- mm/gup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/gup.c b/mm/gup.c index f773ea191c2e..cd52cae41bdd 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -2669,7 +2669,7 @@ static int gup_pud_range(p4d_t *p4dp, p4d_t p4d, unsigned long addr, unsigned lo next = pud_addr_end(addr, end); if (unlikely(!pud_present(pud))) return 0; - if (unlikely(pud_huge(pud))) { + if (unlikely(pud_huge(pud) || pud_devmap(pud))) { if (!gup_huge_pud(pud, pudp, addr, next, flags, pages, nr)) return 0; -- 2.25.1

2 1

[PATCH OLK-6.6] net: do not delay dst_entries_add() in dst_release()
by Liu Jian 29 Oct '24

29 Oct '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.57 commit eae7435b48ffc8e9be0ff9cfeae40af479a609dd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRJ8 CVE: CVE-2024-50036 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit ac888d58869bb99753e7652be19a151df9ecb35d ] dst_entries_add() uses per-cpu data that might be freed at netns dismantle from ip6_route_net_exit() calling dst_entries_destroy() Before ip6_route_net_exit() can be called, we release all the dsts associated with this netns, via calls to dst_release(), which waits an rcu grace period before calling dst_destroy() dst_entries_add() use in dst_destroy() is racy, because dst_entries_destroy() could have been called already. Decrementing the number of dsts must happen sooner. Notes: 1) in CONFIG_XFRM case, dst_destroy() can call dst_release_immediate(child), this might also cause UAF if the child does not have DST_NOCOUNT set. IPSEC maintainers might take a look and see how to address this. 2) There is also discussion about removing this count of dst, which might happen in future kernels. Fixes: f88649721268 ("ipv4: fix dst race in sk_dst_get()") Closes: https://lore.kernel.org/lkml/CANn89iLCCGsP7SFn9HKpvnKu96Td4KD08xf7aGtiYgZnk… Reported-by: Naresh Kamboju <naresh.kamboju(a)linaro.org> Tested-by: Linux Kernel Functional Testing <lkft(a)linaro.org> Tested-by: Naresh Kamboju <naresh.kamboju(a)linaro.org> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Xin Long <lucien.xin(a)gmail.com> Cc: Steffen Klassert <steffen.klassert(a)secunet.com> Reviewed-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20241008143110.1064899-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/dst.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/net/core/dst.c b/net/core/dst.c index 980e2fd2f013..137b8d1c7220 100644 --- a/net/core/dst.c +++ b/net/core/dst.c @@ -109,9 +109,6 @@ struct dst_entry *dst_destroy(struct dst_entry * dst) child = xdst->child; } #endif - if (!(dst->flags & DST_NOCOUNT)) - dst_entries_add(dst->ops, -1); - if (dst->ops->destroy) dst->ops->destroy(dst); netdev_put(dst->dev, &dst->dev_tracker); @@ -161,17 +158,27 @@ void dst_dev_put(struct dst_entry *dst) } EXPORT_SYMBOL(dst_dev_put); +static void dst_count_dec(struct dst_entry *dst) +{ + if (!(dst->flags & DST_NOCOUNT)) + dst_entries_add(dst->ops, -1); +} + void dst_release(struct dst_entry *dst) { - if (dst && rcuref_put(&dst->__rcuref)) + if (dst && rcuref_put(&dst->__rcuref)) { + dst_count_dec(dst); call_rcu_hurry(&dst->rcu_head, dst_destroy_rcu); + } } EXPORT_SYMBOL(dst_release); void dst_release_immediate(struct dst_entry *dst) { - if (dst && rcuref_put(&dst->__rcuref)) + if (dst && rcuref_put(&dst->__rcuref)) { + dst_count_dec(dst); dst_destroy(dst); + } } EXPORT_SYMBOL(dst_release_immediate); -- 2.34.1

2 7

[PATCH openEuler-22.03-LTS-SP1] Bluetooth: Fix crash when replugging CSR fake controllers
by Liu Jian 29 Oct '24

29 Oct '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v5.10.159 commit 549b46f8130effccf168293270bb3b1d5da529cc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRIM CVE: CVE-2022-48982 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- commit b5ca338751ad4783ec8d37b5d99c3e37b7813e59 upstream. It seems fake CSR 5.0 clones can cause the suspend notifier to be registered twice causing the following kernel panic: [ 71.986122] Call Trace: [ 71.986124] <TASK> [ 71.986125] blocking_notifier_chain_register+0x33/0x60 [ 71.986130] hci_register_dev+0x316/0x3d0 [bluetooth 99b5497ea3d09708fa1366c1dc03288bf3cca8da] [ 71.986154] btusb_probe+0x979/0xd85 [btusb e1e0605a4f4c01984a4b9c8ac58c3666ae287477] [ 71.986159] ? __pm_runtime_set_status+0x1a9/0x300 [ 71.986162] ? ktime_get_mono_fast_ns+0x3e/0x90 [ 71.986167] usb_probe_interface+0xe3/0x2b0 [ 71.986171] really_probe+0xdb/0x380 [ 71.986174] ? pm_runtime_barrier+0x54/0x90 [ 71.986177] __driver_probe_device+0x78/0x170 [ 71.986180] driver_probe_device+0x1f/0x90 [ 71.986183] __device_attach_driver+0x89/0x110 [ 71.986186] ? driver_allows_async_probing+0x70/0x70 [ 71.986189] bus_for_each_drv+0x8c/0xe0 [ 71.986192] __device_attach+0xb2/0x1e0 [ 71.986195] bus_probe_device+0x92/0xb0 [ 71.986198] device_add+0x422/0x9a0 [ 71.986201] ? sysfs_merge_group+0xd4/0x110 [ 71.986205] usb_set_configuration+0x57a/0x820 [ 71.986208] usb_generic_driver_probe+0x4f/0x70 [ 71.986211] usb_probe_device+0x3a/0x110 [ 71.986213] really_probe+0xdb/0x380 [ 71.986216] ? pm_runtime_barrier+0x54/0x90 [ 71.986219] __driver_probe_device+0x78/0x170 [ 71.986221] driver_probe_device+0x1f/0x90 [ 71.986224] __device_attach_driver+0x89/0x110 [ 71.986227] ? driver_allows_async_probing+0x70/0x70 [ 71.986230] bus_for_each_drv+0x8c/0xe0 [ 71.986232] __device_attach+0xb2/0x1e0 [ 71.986235] bus_probe_device+0x92/0xb0 [ 71.986237] device_add+0x422/0x9a0 [ 71.986239] ? _dev_info+0x7d/0x98 [ 71.986242] ? blake2s_update+0x4c/0xc0 [ 71.986246] usb_new_device.cold+0x148/0x36d [ 71.986250] hub_event+0xa8a/0x1910 [ 71.986255] process_one_work+0x1c4/0x380 [ 71.986259] worker_thread+0x51/0x390 [ 71.986262] ? rescuer_thread+0x3b0/0x3b0 [ 71.986264] kthread+0xdb/0x110 [ 71.986266] ? kthread_complete_and_exit+0x20/0x20 [ 71.986268] ret_from_fork+0x1f/0x30 [ 71.986273] </TASK> [ 71.986274] ---[ end trace 0000000000000000 ]--- [ 71.986284] btusb: probe of 2-1.6:1.0 failed with error -17 Link: https://bugzilla.kernel.org/show_bug.cgi?id=216683 Cc: stable(a)vger.kernel.org Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Tested-by: Leonardo Eugênio <lelgenio(a)disroot.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/bluetooth/hci_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index dedb939dec2e..3a76d6656f1b 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3800,7 +3800,8 @@ int hci_register_dev(struct hci_dev *hdev) hci_sock_dev_event(hdev, HCI_DEV_REG); hci_dev_hold(hdev); - if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) { + if (!hdev->suspend_notifier.notifier_call && + !test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) { hdev->suspend_notifier.notifier_call = hci_suspend_notifier; error = register_pm_notifier(&hdev->suspend_notifier); if (error) -- 2.34.1

2 9

[PATCH OLK-5.10] net: do not delay dst_entries_add() in dst_release()
by Liu Jian 29 Oct '24

29 Oct '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.12-rc3 commit ac888d58869bb99753e7652be19a151df9ecb35d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRJ8 CVE: CVE-2024-50036 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- dst_entries_add() uses per-cpu data that might be freed at netns dismantle from ip6_route_net_exit() calling dst_entries_destroy() Before ip6_route_net_exit() can be called, we release all the dsts associated with this netns, via calls to dst_release(), which waits an rcu grace period before calling dst_destroy() dst_entries_add() use in dst_destroy() is racy, because dst_entries_destroy() could have been called already. Decrementing the number of dsts must happen sooner. Notes: 1) in CONFIG_XFRM case, dst_destroy() can call dst_release_immediate(child), this might also cause UAF if the child does not have DST_NOCOUNT set. IPSEC maintainers might take a look and see how to address this. 2) There is also discussion about removing this count of dst, which might happen in future kernels. Fixes: f88649721268 ("ipv4: fix dst race in sk_dst_get()") Closes: https://lore.kernel.org/lkml/CANn89iLCCGsP7SFn9HKpvnKu96Td4KD08xf7aGtiYgZnk… Reported-by: Naresh Kamboju <naresh.kamboju(a)linaro.org> Tested-by: Linux Kernel Functional Testing <lkft(a)linaro.org> Tested-by: Naresh Kamboju <naresh.kamboju(a)linaro.org> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Xin Long <lucien.xin(a)gmail.com> Cc: Steffen Klassert <steffen.klassert(a)secunet.com> Reviewed-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20241008143110.1064899-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/core/dst.c [Did not backport bc9d3a9f2afc.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/dst.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/net/core/dst.c b/net/core/dst.c index 453ec8aafc4a..299b4b4f76f6 100644 --- a/net/core/dst.c +++ b/net/core/dst.c @@ -109,9 +109,6 @@ struct dst_entry *dst_destroy(struct dst_entry * dst) child = xdst->child; } #endif - if (!(dst->flags & DST_NOCOUNT)) - dst_entries_add(dst->ops, -1); - if (dst->ops->destroy) dst->ops->destroy(dst); if (dst->dev) @@ -162,6 +159,12 @@ void dst_dev_put(struct dst_entry *dst) } EXPORT_SYMBOL(dst_dev_put); +static void dst_count_dec(struct dst_entry *dst) +{ + if (!(dst->flags & DST_NOCOUNT)) + dst_entries_add(dst->ops, -1); +} + void dst_release(struct dst_entry *dst) { if (dst) { @@ -171,8 +174,10 @@ void dst_release(struct dst_entry *dst) if (WARN_ONCE(newrefcnt < 0, "dst_release underflow")) net_warn_ratelimited("%s: dst:%p refcnt:%d\n", __func__, dst, newrefcnt); - if (!newrefcnt) + if (!newrefcnt) { + dst_count_dec(dst); call_rcu(&dst->rcu_head, dst_destroy_rcu); + } } } EXPORT_SYMBOL(dst_release); @@ -186,8 +191,10 @@ void dst_release_immediate(struct dst_entry *dst) if (WARN_ONCE(newrefcnt < 0, "dst_release_immediate underflow")) net_warn_ratelimited("%s: dst:%p refcnt:%d\n", __func__, dst, newrefcnt); - if (!newrefcnt) + if (!newrefcnt) { + dst_count_dec(dst); dst_destroy(dst); + } } } EXPORT_SYMBOL(dst_release_immediate); -- 2.34.1

2 7

[PATCH openEuler-1.0-LTS] net: do not delay dst_entries_add() in dst_release()
by Liu Jian 29 Oct '24

29 Oct '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.12-rc3 commit ac888d58869bb99753e7652be19a151df9ecb35d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRJ8 CVE: CVE-2024-50036 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- dst_entries_add() uses per-cpu data that might be freed at netns dismantle from ip6_route_net_exit() calling dst_entries_destroy() Before ip6_route_net_exit() can be called, we release all the dsts associated with this netns, via calls to dst_release(), which waits an rcu grace period before calling dst_destroy() dst_entries_add() use in dst_destroy() is racy, because dst_entries_destroy() could have been called already. Decrementing the number of dsts must happen sooner. Notes: 1) in CONFIG_XFRM case, dst_destroy() can call dst_release_immediate(child), this might also cause UAF if the child does not have DST_NOCOUNT set. IPSEC maintainers might take a look and see how to address this. 2) There is also discussion about removing this count of dst, which might happen in future kernels. Fixes: f88649721268 ("ipv4: fix dst race in sk_dst_get()") Closes: https://lore.kernel.org/lkml/CANn89iLCCGsP7SFn9HKpvnKu96Td4KD08xf7aGtiYgZnk… Reported-by: Naresh Kamboju <naresh.kamboju(a)linaro.org> Tested-by: Linux Kernel Functional Testing <lkft(a)linaro.org> Tested-by: Naresh Kamboju <naresh.kamboju(a)linaro.org> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Xin Long <lucien.xin(a)gmail.com> Cc: Steffen Klassert <steffen.klassert(a)secunet.com> Reviewed-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20241008143110.1064899-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/core/dst.c [Did not backport bc9d3a9f2afc.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/dst.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/net/core/dst.c b/net/core/dst.c index 1a9f84f8cde1..9c46b4a87a32 100644 --- a/net/core/dst.c +++ b/net/core/dst.c @@ -129,9 +129,6 @@ struct dst_entry *dst_destroy(struct dst_entry * dst) child = xdst->child; } #endif - if (!(dst->flags & DST_NOCOUNT)) - dst_entries_add(dst->ops, -1); - if (dst->ops->destroy) dst->ops->destroy(dst); if (dst->dev) @@ -182,6 +179,12 @@ void dst_dev_put(struct dst_entry *dst) } EXPORT_SYMBOL(dst_dev_put); +static void dst_count_dec(struct dst_entry *dst) +{ + if (!(dst->flags & DST_NOCOUNT)) + dst_entries_add(dst->ops, -1); +} + void dst_release(struct dst_entry *dst) { if (dst) { @@ -191,8 +194,10 @@ void dst_release(struct dst_entry *dst) if (unlikely(newrefcnt < 0)) net_warn_ratelimited("%s: dst:%p refcnt:%d\n", __func__, dst, newrefcnt); - if (!newrefcnt) + if (!newrefcnt) { + dst_count_dec(dst); call_rcu(&dst->rcu_head, dst_destroy_rcu); + } } } EXPORT_SYMBOL(dst_release); @@ -206,8 +211,10 @@ void dst_release_immediate(struct dst_entry *dst) if (unlikely(newrefcnt < 0)) net_warn_ratelimited("%s: dst:%p refcnt:%d\n", __func__, dst, newrefcnt); - if (!newrefcnt) + if (!newrefcnt) { + dst_count_dec(dst); dst_destroy(dst); + } } } EXPORT_SYMBOL(dst_release_immediate); -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 22906/23897] fs/ext4/inode.c:2995:23: warning: unused variable 'sbi'
by kernel test robot 29 Oct '24

29 Oct '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4e7116f4c77ecbf4fe5ee0c5f388efd733f80556 commit: 7b208222f6845875c568d238aeb9db17a1c63d96 [22906/23897] ext4: avoid deadlock in fs reclaim with page writeback config: x86_64-kexec (https://download.01.org/0day-ci/archive/20241029/202410291459.qfL3pzNM-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410291459.qfL3pzNM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410291459.qfL3pzNM-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from fs/ext4/inode.c:25: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> fs/ext4/inode.c:2995:23: warning: unused variable 'sbi' [-Wunused-variable] 2995 | struct ext4_sb_info *sbi = EXT4_SB(mapping->host->i_sb); | ^~~ 2 warnings generated. vim +/sbi +2995 fs/ext4/inode.c 64769240bd07f4 Alex Tomas 2008-07-11 2988 5f0663bb4a64f5 Dan Williams 2017-12-21 2989 static int ext4_dax_writepages(struct address_space *mapping, 5f0663bb4a64f5 Dan Williams 2017-12-21 2990 struct writeback_control *wbc) 5f0663bb4a64f5 Dan Williams 2017-12-21 2991 { 5f0663bb4a64f5 Dan Williams 2017-12-21 2992 int ret; 5f0663bb4a64f5 Dan Williams 2017-12-21 2993 long nr_to_write = wbc->nr_to_write; 5f0663bb4a64f5 Dan Williams 2017-12-21 2994 struct inode *inode = mapping->host; 5f0663bb4a64f5 Dan Williams 2017-12-21 @2995 struct ext4_sb_info *sbi = EXT4_SB(mapping->host->i_sb); 7b208222f68458 Jan Kara 2024-06-11 2996 int alloc_ctx; 5f0663bb4a64f5 Dan Williams 2017-12-21 2997 5f0663bb4a64f5 Dan Williams 2017-12-21 2998 if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) 5f0663bb4a64f5 Dan Williams 2017-12-21 2999 return -EIO; 5f0663bb4a64f5 Dan Williams 2017-12-21 3000 7b208222f68458 Jan Kara 2024-06-11 3001 alloc_ctx = ext4_writepages_down_read(inode->i_sb); 5f0663bb4a64f5 Dan Williams 2017-12-21 3002 trace_ext4_writepages(inode, wbc); 5f0663bb4a64f5 Dan Williams 2017-12-21 3003 5f0663bb4a64f5 Dan Williams 2017-12-21 3004 ret = dax_writeback_mapping_range(mapping, inode->i_sb->s_bdev, wbc); 5f0663bb4a64f5 Dan Williams 2017-12-21 3005 trace_ext4_writepages_result(inode, wbc, ret, 5f0663bb4a64f5 Dan Williams 2017-12-21 3006 nr_to_write - wbc->nr_to_write); 7b208222f68458 Jan Kara 2024-06-11 3007 ext4_writepages_up_read(inode->i_sb, alloc_ctx); 5f0663bb4a64f5 Dan Williams 2017-12-21 3008 return ret; 5f0663bb4a64f5 Dan Williams 2017-12-21 3009 } 5f0663bb4a64f5 Dan Williams 2017-12-21 3010 :::::: The code at line 2995 was first introduced by commit :::::: 5f0663bb4a64f588f0a2dd6d1be68d40f9af0086 ext4, dax: introduce ext4_dax_aops :::::: TO: Dan Williams <dan.j.williams(a)intel.com> :::::: CC: Dan Williams <dan.j.williams(a)intel.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 18634/30000] drivers/ub/urma/ubcore/ubcore_umem.c:227:21: warning: no previous prototype for 'ubcore_umem_get'
by kernel test robot 29 Oct '24

29 Oct '24

Hi Yizhen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c0e2b3247172ef46c6a75823867d668ad1c84e0c commit: f6206cf05e28a7f455850a4e2de8162890f50073 [18634/30000] ub: add memory map api in ubcore config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241029/202410291451.4EuMUHij-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410291451.4EuMUHij-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410291451.4EuMUHij-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/ubcore/ubcore_umem.c:227:21: warning: no previous prototype for 'ubcore_umem_get' [-Wmissing-prototypes] 227 | struct ubcore_umem *ubcore_umem_get(struct ubcore_device *dev, uint64_t va, uint64_t len, | ^~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_umem.c:245:6: warning: no previous prototype for 'ubcore_umem_release' [-Wmissing-prototypes] 245 | void ubcore_umem_release(struct ubcore_umem *umem) | ^~~~~~~~~~~~~~~~~~~ vim +/ubcore_umem_get +227 drivers/ub/urma/ubcore/ubcore_umem.c 226 > 227 struct ubcore_umem *ubcore_umem_get(struct ubcore_device *dev, uint64_t va, uint64_t len, 228 union ubcore_umem_flag flag) 229 { 230 struct page **page_list; 231 int ret; 232 233 ret = umem_verify_input(dev, va, len, flag); 234 if (ret < 0) 235 return ERR_PTR(ret); 236 237 page_list = (struct page **)__get_free_page(GFP_KERNEL); 238 if (page_list == 0) 239 return ERR_PTR(-ENOMEM); 240 241 return ubcore_get_target_umem(dev, va, len, flag, page_list); 242 } 243 EXPORT_SYMBOL(ubcore_umem_get); 244 > 245 void ubcore_umem_release(struct ubcore_umem *umem) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 V1] kthread: unpark only parked kthread
by Cheng Yu 29 Oct '24

29 Oct '24

From: Frederic Weisbecker <frederic(a)kernel.org> stable inclusion from stable-v6.6.57 commit 19a5029981c87c2ad0845e713837faa88f5d8e2b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRFR CVE: CVE-2024-50019 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 214e01ad4ed7158cab66498810094fac5d09b218 upstream. Calling into kthread unparking unconditionally is mostly harmless when the kthread is already unparked. The wake up is then simply ignored because the target is not in TASK_PARKED state. However if the kthread is per CPU, the wake up is preceded by a call to kthread_bind() which expects the task to be inactive and in TASK_PARKED state, which obviously isn't the case if it is unparked. As a result, calling kthread_stop() on an unparked per-cpu kthread triggers such a warning: WARNING: CPU: 0 PID: 11 at kernel/kthread.c:525 __kthread_bind_mask kernel/kthread.c:525 <TASK> kthread_stop+0x17a/0x630 kernel/kthread.c:707 destroy_workqueue+0x136/0xc40 kernel/workqueue.c:5810 wg_destruct+0x1e2/0x2e0 drivers/net/wireguard/device.c:257 netdev_run_todo+0xe1a/0x1000 net/core/dev.c:10693 default_device_exit_batch+0xa14/0xa90 net/core/dev.c:11769 ops_exit_list net/core/net_namespace.c:178 [inline] cleanup_net+0x89d/0xcc0 net/core/net_namespace.c:640 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Fix this with skipping unecessary unparking while stopping a kthread. Link: https://lkml.kernel.org/r/20240913214634.12557-1-frederic@kernel.org Fixes: 5c25b5ff89f0 ("workqueue: Tag bound workers with KTHREAD_IS_PER_CPU") Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org> Reported-by: syzbot+943d34fa3cf2191e3068(a)syzkaller.appspotmail.com Tested-by: syzbot+943d34fa3cf2191e3068(a)syzkaller.appspotmail.com Suggested-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: Hillf Danton <hdanton(a)sina.com> Cc: Tejun Heo <tj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/kthread.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/kthread.c b/kernel/kthread.c index 290cbc845225..5190d30640a9 100644 --- a/kernel/kthread.c +++ b/kernel/kthread.c @@ -622,6 +622,8 @@ void kthread_unpark(struct task_struct *k) { struct kthread *kthread = to_kthread(k); + if (!test_bit(KTHREAD_SHOULD_PARK, &kthread->flags)) + return; /* * Newly created kthread was parked when the CPU was offline. * The binding was lost and we need to set it again. -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ALSA: asihpi: Fix potential OOB array access
by Liu Shixin 29 Oct '24

29 Oct '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.227 commit 219587bca2678e31700ef09ecec178ba1f735674 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRBN CVE: CVE-2024-50007 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7b986c7430a6bb68d523dac7bfc74cbd5b44ef96 ] ASIHPI driver stores some values in the static array upon a response from the driver, and its index depends on the firmware. We shouldn't trust it blindly. This patch adds a sanity check of the array index to fit in the array size. Link: https://patch.msgid.link/20240808091454.30846-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- sound/pci/asihpi/hpimsgx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/pci/asihpi/hpimsgx.c b/sound/pci/asihpi/hpimsgx.c index f7427f8eb630..761fc62f68f1 100644 --- a/sound/pci/asihpi/hpimsgx.c +++ b/sound/pci/asihpi/hpimsgx.c @@ -713,7 +713,7 @@ static u16 HPIMSGX__init(struct hpi_message *phm, phr->error = HPI_ERROR_PROCESSING_MESSAGE; return phr->error; } - if (hr.error == 0) { + if (hr.error == 0 && hr.u.s.adapter_index < HPI_MAX_ADAPTERS) { /* the adapter was created successfully save the mapping for future use */ hpi_entry_points[hr.u.s.adapter_index] = entry_point_func; -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: lsm: Set bpf_lsm_blob_sizes.lbs_task to 0
by Gu Bowen 29 Oct '24

29 Oct '24

From: Song Liu <song(a)kernel.org> stable inclusion from stable-v6.6.54 commit b3c10ac84c5a544ccd92ee4f891441df91a8cfbc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAW1S1 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 300a90b2cb5d442879e6398920c49aebbd5c8e40 upstream. bpf task local storage is now using task_struct->bpf_storage, so bpf_lsm_blob_sizes.lbs_task is no longer needed. Remove it to save some memory. Fixes: a10787e6d58c ("bpf: Enable task local storage for tracing programs") Cc: stable(a)vger.kernel.org Cc: KP Singh <kpsingh(a)kernel.org> Cc: Matt Bobrowski <mattbobrowski(a)google.com> Signed-off-by: Song Liu <song(a)kernel.org> Acked-by: Matt Bobrowski <mattbobrowski(a)google.com> Link: https://lore.kernel.org/r/20240911055508.9588-1-song@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/bpf/hooks.c | 1 - 1 file changed, 1 deletion(-) diff --git a/security/bpf/hooks.c b/security/bpf/hooks.c index cfaf1d0e6a5f..35933ae53b92 100644 --- a/security/bpf/hooks.c +++ b/security/bpf/hooks.c @@ -24,7 +24,6 @@ static int __init bpf_lsm_init(void) struct lsm_blob_sizes bpf_lsm_blob_sizes __ro_after_init = { .lbs_inode = sizeof(struct bpf_storage_blob), - .lbs_task = sizeof(struct bpf_storage_blob), }; DEFINE_LSM(bpf) = { -- 2.25.1

2 1

[PATCH OLK-5.10] ALSA: asihpi: Fix potential OOB array access
by Liu Shixin 29 Oct '24

29 Oct '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.227 commit 219587bca2678e31700ef09ecec178ba1f735674 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRBN CVE: CVE-2024-50007 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7b986c7430a6bb68d523dac7bfc74cbd5b44ef96 ] ASIHPI driver stores some values in the static array upon a response from the driver, and its index depends on the firmware. We shouldn't trust it blindly. This patch adds a sanity check of the array index to fit in the array size. Link: https://patch.msgid.link/20240808091454.30846-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- sound/pci/asihpi/hpimsgx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/pci/asihpi/hpimsgx.c b/sound/pci/asihpi/hpimsgx.c index f7427f8eb630..761fc62f68f1 100644 --- a/sound/pci/asihpi/hpimsgx.c +++ b/sound/pci/asihpi/hpimsgx.c @@ -713,7 +713,7 @@ static u16 HPIMSGX__init(struct hpi_message *phm, phr->error = HPI_ERROR_PROCESSING_MESSAGE; return phr->error; } - if (hr.error == 0) { + if (hr.error == 0 && hr.u.s.adapter_index < HPI_MAX_ADAPTERS) { /* the adapter was created successfully save the mapping for future use */ hpi_entry_points[hr.u.s.adapter_index] = entry_point_func; -- 2.34.1

2 1

[PATCH OLK-6.6] ALSA: asihpi: Fix potential OOB array access
by Liu Shixin 29 Oct '24

29 Oct '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.55 commit 7a55740996701f7b2bc46dc988b60ef2e416a747 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRBN CVE: CVE-2024-50007 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7b986c7430a6bb68d523dac7bfc74cbd5b44ef96 ] ASIHPI driver stores some values in the static array upon a response from the driver, and its index depends on the firmware. We shouldn't trust it blindly. This patch adds a sanity check of the array index to fit in the array size. Link: https://patch.msgid.link/20240808091454.30846-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- sound/pci/asihpi/hpimsgx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/pci/asihpi/hpimsgx.c b/sound/pci/asihpi/hpimsgx.c index d0caef299481..b68e6bfbbfba 100644 --- a/sound/pci/asihpi/hpimsgx.c +++ b/sound/pci/asihpi/hpimsgx.c @@ -708,7 +708,7 @@ static u16 HPIMSGX__init(struct hpi_message *phm, phr->error = HPI_ERROR_PROCESSING_MESSAGE; return phr->error; } - if (hr.error == 0) { + if (hr.error == 0 && hr.u.s.adapter_index < HPI_MAX_ADAPTERS) { /* the adapter was created successfully save the mapping for future use */ hpi_entry_points[hr.u.s.adapter_index] = entry_point_func; -- 2.34.1

2 1

[PATCH OLK-6.6 00/14] some bugfixs for khuegpaged
by Nanyong Sun 29 Oct '24

29 Oct '24

some bugfixs for khuegpaged, after this, khugepaged support collapse large folios of pagecache. Baolin Wang (6): mm: khugepaged: expand the is_refcount_suitable() to support file folios mm: khugepaged: use the number of pages in the folio to check the reference count mm: khugepaged: support shmem mTHP copy mm: khugepaged: support shmem mTHP collapse selftests: mm: support shmem mTHP collapse testing mm: khugepaged: fix the incorrect statistics when collapsing large file folios Matthew Wilcox (Oracle) (7): khugepaged: inline hpage_collapse_alloc_folio() khugepaged: convert alloc_charge_hpage to alloc_charge_folio khugepaged: remove hpage from collapse_huge_page() khugepaged: pass a folio to __collapse_huge_page_copy() khugepaged: remove hpage from collapse_file() khugepaged: use a folio throughout collapse_file() khugepaged: use a folio throughout hpage_collapse_scan_file() Yang Shi (1): mm: khugepaged: fix the arguments order in khugepaged_collapse_file trace point include/trace/events/huge_memory.h | 16 +- mm/khugepaged.c | 341 ++++++++++------------ tools/testing/selftests/mm/khugepaged.c | 4 +- tools/testing/selftests/mm/thp_settings.c | 46 ++- tools/testing/selftests/mm/thp_settings.h | 9 +- 5 files changed, 219 insertions(+), 197 deletions(-) -- 2.33.0

2 15

[OLK-6.6] drm/amd/display: fix double free issue during amdgpu module unload
by liwei 29 Oct '24

29 Oct '24

From: Tim Huang <tim.huang(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit 20b5a8f9f4670a8503aa9fa95ca632e77c6bf55d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDA CVE: CVE-2024-49989 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Flexible endpoints use DIGs from available inflexible endpoints, so only the encoders of inflexible links need to be freed. Otherwise, a double free issue may occur when unloading the amdgpu module. [ 279.190523] RIP: 0010:__slab_free+0x152/0x2f0 [ 279.190577] Call Trace: [ 279.190580] <TASK> [ 279.190582] ? show_regs+0x69/0x80 [ 279.190590] ? die+0x3b/0x90 [ 279.190595] ? do_trap+0xc8/0xe0 [ 279.190601] ? do_error_trap+0x73/0xa0 [ 279.190605] ? __slab_free+0x152/0x2f0 [ 279.190609] ? exc_invalid_op+0x56/0x70 [ 279.190616] ? __slab_free+0x152/0x2f0 [ 279.190642] ? asm_exc_invalid_op+0x1f/0x30 [ 279.190648] ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu] [ 279.191096] ? __slab_free+0x152/0x2f0 [ 279.191102] ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu] [ 279.191469] kfree+0x260/0x2b0 [ 279.191474] dcn10_link_encoder_destroy+0x19/0x30 [amdgpu] [ 279.191821] link_destroy+0xd7/0x130 [amdgpu] [ 279.192248] dc_destruct+0x90/0x270 [amdgpu] [ 279.192666] dc_destroy+0x19/0x40 [amdgpu] [ 279.193020] amdgpu_dm_fini+0x16e/0x200 [amdgpu] [ 279.193432] dm_hw_fini+0x26/0x40 [amdgpu] [ 279.193795] amdgpu_device_fini_hw+0x24c/0x400 [amdgpu] [ 279.194108] amdgpu_driver_unload_kms+0x4f/0x70 [amdgpu] [ 279.194436] amdgpu_pci_remove+0x40/0x80 [amdgpu] [ 279.194632] pci_device_remove+0x3a/0xa0 [ 279.194638] device_remove+0x40/0x70 [ 279.194642] device_release_driver_internal+0x1ad/0x210 [ 279.194647] driver_detach+0x4e/0xa0 [ 279.194650] bus_remove_driver+0x6f/0xf0 [ 279.194653] driver_unregister+0x33/0x60 [ 279.194657] pci_unregister_driver+0x44/0x90 [ 279.194662] amdgpu_exit+0x19/0x1f0 [amdgpu] [ 279.194939] __do_sys_delete_module.isra.0+0x198/0x2f0 [ 279.194946] __x64_sys_delete_module+0x16/0x20 [ 279.194950] do_syscall_64+0x58/0x120 [ 279.194954] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 279.194980] </TASK> Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Tim Huang <tim.huang(a)amd.com> Reviewed-by: Roman Li <roman.li(a)amd.com> Signed-off-by: Roman Li <roman.li(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/link/link_factory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/link/link_factory.c b/drivers/gpu/drm/amd/display/dc/link/link_factory.c index 33bb96f770b8..eb7c9f226af5 100644 --- a/drivers/gpu/drm/amd/display/dc/link/link_factory.c +++ b/drivers/gpu/drm/amd/display/dc/link/link_factory.c @@ -403,7 +403,7 @@ static void link_destruct(struct dc_link *link) if (link->panel_cntl) link->panel_cntl->funcs->destroy(&link->panel_cntl); - if (link->link_enc) { + if (link->link_enc && !link->is_dig_mapping_flexible) { /* Update link encoder resource tracking variables. These are used for * the dynamic assignment of link encoders to streams. Virtual links * are not assigned encoder resources on creation. -- 2.25.1

1 0

[PATCH OLK-5.10] blk-mq: Fix kmemleak in blk_mq_init_allocated_queue
by Yu Kuai 29 Oct '24

29 Oct '24

From: Chen Jun <chenjun102(a)huawei.com> mainline inclusion from mainline-v6.1-rc4 commit 943f45b9399ed8b2b5190cbc797995edaa97f58f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAXJQY CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a kmemleak caused by modprobe null_blk.ko unreferenced object 0xffff8881acb1f000 (size 1024): comm "modprobe", pid 836, jiffies 4294971190 (age 27.068s) hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... ff ff ff ff ff ff ff ff 00 53 99 9e ff ff ff ff .........S...... backtrace: [<000000004a10c249>] kmalloc_node_trace+0x22/0x60 [<00000000648f7950>] blk_mq_alloc_and_init_hctx+0x289/0x350 [<00000000af06de0e>] blk_mq_realloc_hw_ctxs+0x2fe/0x3d0 [<00000000e00c1872>] blk_mq_init_allocated_queue+0x48c/0x1440 [<00000000d16b4e68>] __blk_mq_alloc_disk+0xc8/0x1c0 [<00000000d10c98c3>] 0xffffffffc450d69d [<00000000b9299f48>] 0xffffffffc4538392 [<0000000061c39ed6>] do_one_initcall+0xd0/0x4f0 [<00000000b389383b>] do_init_module+0x1a4/0x680 [<0000000087cf3542>] load_module+0x6249/0x7110 [<00000000beba61b8>] __do_sys_finit_module+0x140/0x200 [<00000000fdcfff51>] do_syscall_64+0x35/0x80 [<000000003c0f1f71>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 That is because q->ma_ops is set to NULL before blk_release_queue is called. blk_mq_init_queue_data blk_mq_init_allocated_queue blk_mq_realloc_hw_ctxs for (i = 0; i < set->nr_hw_queues; i++) { old_hctx = xa_load(&q->hctx_table, i); if (!blk_mq_alloc_and_init_hctx(.., i, ..)) [1] if (!old_hctx) break; xa_for_each_start(&q->hctx_table, j, hctx, j) blk_mq_exit_hctx(q, set, hctx, j); [2] if (!q->nr_hw_queues) [3] goto err_hctxs; err_exit: q->mq_ops = NULL; [4] blk_put_queue blk_release_queue if (queue_is_mq(q)) [5] blk_mq_release(q); [1]: blk_mq_alloc_and_init_hctx failed at i != 0. [2]: The hctxs allocated by [1] are moved to q->unused_hctx_list and will be cleaned up in blk_mq_release. [3]: q->nr_hw_queues is 0. [4]: Set q->mq_ops to NULL. [5]: queue_is_mq returns false due to [4]. And blk_mq_release will not be called. The hctxs in q->unused_hctx_list are leaked. To fix it, call blk_release_queue in exception path. Fixes: 2f8f1336a48b ("blk-mq: always free hctx after request queue is freed") Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20221031031242.94107-1-chenjun102@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-mq.c [commit 4e5cc99e1e48 ("blk-mq: manage hctx map via xarray") is not backported] Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- block/blk-mq.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index bceb09f27c90..344c55531293 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -3571,9 +3571,7 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set, return q; err_hctxs: - kfree(q->queue_hw_ctx); - q->nr_hw_queues = 0; - blk_mq_sysfs_deinit(q); + blk_mq_release(q); err_poll: blk_stat_free_callback(q->poll_cb); q->poll_cb = NULL; -- 2.39.2

2 1

[openeuler:OLK-5.10 18629/30000] drivers/ub/urma/ubcore/ubcore_main.c:61:5: warning: no previous prototype for 'ubcore_open'
by kernel test robot 29 Oct '24

29 Oct '24

Hi Yizhen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 5dabb43a473af8dee4493436b2946432f83d2620 commit: 95c713224477ac3433652331dd715e9bbcbc793a [18629/30000] ub: init ubcore module config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241029/202410291112.nLGMJoif-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410291112.nLGMJoif-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410291112.nLGMJoif-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/ubcore/ubcore_main.c:61:5: warning: no previous prototype for 'ubcore_open' [-Wmissing-prototypes] 61 | int ubcore_open(struct inode *i_node, struct file *filp) | ^~~~~~~~~~~ vim +/ubcore_open +61 drivers/ub/urma/ubcore/ubcore_main.c 60 > 61 int ubcore_open(struct inode *i_node, struct file *filp) 62 { 63 return 0; 64 } 65 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] NFC: nci: Bounds check struct nfc_target arrays
by Bowen You 29 Oct '24

29 Oct '24

From: Kees Cook <keescook(a)chromium.org> stable inclusion from stable-v4.19.269 commit cff35329070b96b4484d23f9f48a5ca2c947e750 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRFA CVE: CVE-2022-48967 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e329e71013c9b5a4535b099208493c7826ee4a64 ] While running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported: memcpy: detected field-spanning write (size 129) of single field "target->sensf_res" at net/nfc/nci/ntf.c:260 (size 18) This appears to be a legitimate lack of bounds checking in nci_add_new_protocol(). Add the missing checks. Reported-by: syzbot+210e196cef4711b65139(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/lkml/0000000000001c590f05ee7b3ff4@google.com Fixes: 019c4fbaa790 ("NFC: Add NCI multiple targets support") Signed-off-by: Kees Cook <keescook(a)chromium.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://lore.kernel.org/r/20221202214410.never.693-kees@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- net/nfc/nci/ntf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c index 1e8c1a12aaec..4f75453c07aa 100644 --- a/net/nfc/nci/ntf.c +++ b/net/nfc/nci/ntf.c @@ -230,6 +230,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev, target->sens_res = nfca_poll->sens_res; target->sel_res = nfca_poll->sel_res; target->nfcid1_len = nfca_poll->nfcid1_len; + if (target->nfcid1_len > ARRAY_SIZE(target->nfcid1)) + return -EPROTO; if (target->nfcid1_len > 0) { memcpy(target->nfcid1, nfca_poll->nfcid1, target->nfcid1_len); @@ -238,6 +240,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev, nfcb_poll = (struct rf_tech_specific_params_nfcb_poll *)params; target->sensb_res_len = nfcb_poll->sensb_res_len; + if (target->sensb_res_len > ARRAY_SIZE(target->sensb_res)) + return -EPROTO; if (target->sensb_res_len > 0) { memcpy(target->sensb_res, nfcb_poll->sensb_res, target->sensb_res_len); @@ -246,6 +250,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev, nfcf_poll = (struct rf_tech_specific_params_nfcf_poll *)params; target->sensf_res_len = nfcf_poll->sensf_res_len; + if (target->sensf_res_len > ARRAY_SIZE(target->sensf_res)) + return -EPROTO; if (target->sensf_res_len > 0) { memcpy(target->sensf_res, nfcf_poll->sensf_res, target->sensf_res_len); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] libbpf: Handle size overflow for ringbuf mmap
by Pu Lehui 29 Oct '24

29 Oct '24

From: Hou Tao <houtao1(a)huawei.com> stable inclusion from stable-v5.10.158 commit 8a549ab6724520aa3c07f47e0eba820293551490 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRFE CVE: CVE-2022-49030 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 927cbb478adf917e0a142b94baa37f06279cc466 ] The maximum size of ringbuf is 2GB on x86-64 host, so 2 * max_entries will overflow u32 when mapping producer page and data pages. Only casting max_entries to size_t is not enough, because for 32-bits application on 64-bits kernel the size of read-only mmap region also could overflow size_t. So fixing it by casting the size of read-only mmap region into a __u64 and checking whether or not there will be overflow during mmap. Fixes: bf99c936f947 ("libbpf: Add BPF ring buffer support") Signed-off-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20221116072351.1168938-3-houtao@huaweicloud.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- tools/lib/bpf/ringbuf.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/tools/lib/bpf/ringbuf.c b/tools/lib/bpf/ringbuf.c index 86c31c787fb9..5e242be45206 100644 --- a/tools/lib/bpf/ringbuf.c +++ b/tools/lib/bpf/ringbuf.c @@ -59,6 +59,7 @@ int ring_buffer__add(struct ring_buffer *rb, int map_fd, __u32 len = sizeof(info); struct epoll_event *e; struct ring *r; + __u64 mmap_sz; void *tmp; int err; @@ -97,8 +98,7 @@ int ring_buffer__add(struct ring_buffer *rb, int map_fd, r->mask = info.max_entries - 1; /* Map writable consumer page */ - tmp = mmap(NULL, rb->page_size, PROT_READ | PROT_WRITE, MAP_SHARED, - map_fd, 0); + tmp = mmap(NULL, rb->page_size, PROT_READ | PROT_WRITE, MAP_SHARED, map_fd, 0); if (tmp == MAP_FAILED) { err = -errno; pr_warn("ringbuf: failed to mmap consumer page for map fd=%d: %d\n", @@ -111,8 +111,12 @@ int ring_buffer__add(struct ring_buffer *rb, int map_fd, * data size to allow simple reading of samples that wrap around the * end of a ring buffer. See kernel implementation for details. * */ - tmp = mmap(NULL, rb->page_size + 2 * info.max_entries, PROT_READ, - MAP_SHARED, map_fd, rb->page_size); + mmap_sz = rb->page_size + 2 * (__u64)info.max_entries; + if (mmap_sz != (__u64)(size_t)mmap_sz) { + pr_warn("ringbuf: ring buffer size (%u) is too big\n", info.max_entries); + return -E2BIG; + } + tmp = mmap(NULL, (size_t)mmap_sz, PROT_READ, MAP_SHARED, map_fd, rb->page_size); if (tmp == MAP_FAILED) { err = -errno; ringbuf_unmap_ring(rb, r); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net: ethernet: nixge: fix NULL dereference
by Pu Lehui 29 Oct '24

29 Oct '24

From: Yuri Karpov <YKarpov(a)ispras.ru> stable inclusion from stable-v5.10.158 commit 45752af0247589e6d3dede577415bfe117b4392c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDM CVE: CVE-2022-49019 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9256db4e45e8b497b0e993cc3ed4ad08eb2389b6 ] In function nixge_hw_dma_bd_release() dereference of NULL pointer priv->rx_bd_v is possible for the case of its allocation failure in nixge_hw_dma_bd_init(). Move for() loop with priv->rx_bd_v dereference under the check for its validity. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 492caffa8a1a ("net: ethernet: nixge: Add support for National Instruments XGE netdev") Signed-off-by: Yuri Karpov <YKarpov(a)ispras.ru> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/net/ethernet/ni/nixge.c | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c index 17205264c2c1..e5a4a2753e17 100644 --- a/drivers/net/ethernet/ni/nixge.c +++ b/drivers/net/ethernet/ni/nixge.c @@ -249,25 +249,26 @@ static void nixge_hw_dma_bd_release(struct net_device *ndev) struct sk_buff *skb; int i; - for (i = 0; i < RX_BD_NUM; i++) { - phys_addr = nixge_hw_dma_bd_get_addr(&priv->rx_bd_v[i], - phys); - - dma_unmap_single(ndev->dev.parent, phys_addr, - NIXGE_MAX_JUMBO_FRAME_SIZE, - DMA_FROM_DEVICE); - - skb = (struct sk_buff *)(uintptr_t) - nixge_hw_dma_bd_get_addr(&priv->rx_bd_v[i], - sw_id_offset); - dev_kfree_skb(skb); - } + if (priv->rx_bd_v) { + for (i = 0; i < RX_BD_NUM; i++) { + phys_addr = nixge_hw_dma_bd_get_addr(&priv->rx_bd_v[i], + phys); + + dma_unmap_single(ndev->dev.parent, phys_addr, + NIXGE_MAX_JUMBO_FRAME_SIZE, + DMA_FROM_DEVICE); + + skb = (struct sk_buff *)(uintptr_t) + nixge_hw_dma_bd_get_addr(&priv->rx_bd_v[i], + sw_id_offset); + dev_kfree_skb(skb); + } - if (priv->rx_bd_v) dma_free_coherent(ndev->dev.parent, sizeof(*priv->rx_bd_v) * RX_BD_NUM, priv->rx_bd_v, priv->rx_bd_p); + } if (priv->tx_skb) devm_kfree(ndev->dev.parent, priv->tx_skb); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
by Cui GaoSheng 29 Oct '24

29 Oct '24

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> stable inclusion from stable-v5.10.158 commit 90907cd4d11351ff76c9a447bcb5db0e264c47cd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRE1 CVE: CVE-2022-49029 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e2a87785aab0dac190ac89be6a9ba955e2c634f2 ] Smatch report warning as follows: drivers/hwmon/ibmpex.c:509 ibmpex_register_bmc() warn: '&data->list' not removed from list If ibmpex_find_sensors() fails in ibmpex_register_bmc(), data will be freed, but data->list will not be removed from driver_data.bmc_data, then list traversal may cause UAF. Fix by removeing it from driver_data.bmc_data before free(). Fixes: 57c7c3a0fdea ("hwmon: IBM power meter driver") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Link: https://lore.kernel.org/r/20221117034423.2935739-1-cuigaosheng1@huawei.com Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/hwmon/ibmpex.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/hwmon/ibmpex.c b/drivers/hwmon/ibmpex.c index b2ab83c9fd9a..fe90f0536d76 100644 --- a/drivers/hwmon/ibmpex.c +++ b/drivers/hwmon/ibmpex.c @@ -502,6 +502,7 @@ static void ibmpex_register_bmc(int iface, struct device *dev) return; out_register: + list_del(&data->list); hwmon_device_unregister(data->hwmon_dev); out_user: ipmi_destroy_user(data->user); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
by Cui GaoSheng 29 Oct '24

29 Oct '24

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> stable inclusion from stable-v4.19.268 commit 24b9633f7db7f4809be7053df1d2e117e7c2de10 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRE1 CVE: CVE-2022-49029 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e2a87785aab0dac190ac89be6a9ba955e2c634f2 ] Smatch report warning as follows: drivers/hwmon/ibmpex.c:509 ibmpex_register_bmc() warn: '&data->list' not removed from list If ibmpex_find_sensors() fails in ibmpex_register_bmc(), data will be freed, but data->list will not be removed from driver_data.bmc_data, then list traversal may cause UAF. Fix by removeing it from driver_data.bmc_data before free(). Fixes: 57c7c3a0fdea ("hwmon: IBM power meter driver") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Link: https://lore.kernel.org/r/20221117034423.2935739-1-cuigaosheng1@huawei.com Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/hwmon/ibmpex.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/hwmon/ibmpex.c b/drivers/hwmon/ibmpex.c index ab72cabf5a95..e289c845f970 100644 --- a/drivers/hwmon/ibmpex.c +++ b/drivers/hwmon/ibmpex.c @@ -517,6 +517,7 @@ static void ibmpex_register_bmc(int iface, struct device *dev) return; out_register: + list_del(&data->list); hwmon_device_unregister(data->hwmon_dev); out_user: ipmi_destroy_user(data->user); -- 2.34.1

2 1

[openeuler:OLK-6.6 7038/15358] bma_cdev.c:(.bss+0x0): multiple definition of `debug'; drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.o:bma_pci.c:(.bss+0x0): first defined here
by kernel test robot 29 Oct '24

29 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 27e5d43e49e85d816bd05ffe8672ceea631a07e4 commit: 0b6609ecfba8575f870350666ab13e25accc8d14 [7038/15358] Huawei BMA: Adding Huawei BMA driver: host_cdev_drv config: loongarch-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241029/202410291139.y46hXQik-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410291139.y46hXQik-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410291139.y46hXQik-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.o: in function `.LANCHOR1': >> bma_cdev.c:(.bss+0x0): multiple definition of `debug'; drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.o:bma_pci.c:(.bss+0x0): first defined here -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] NFC: nci: Bounds check struct nfc_target arrays
by Bowen You 29 Oct '24

29 Oct '24

From: Kees Cook <keescook(a)chromium.org> stable inclusion from stable-v5.10.159 commit 27eb2d7a1b9987b6d0429b7716b1ff3b82c4ffc9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRFA CVE: CVE-2022-48967 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e329e71013c9b5a4535b099208493c7826ee4a64 ] While running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported: memcpy: detected field-spanning write (size 129) of single field "target->sensf_res" at net/nfc/nci/ntf.c:260 (size 18) This appears to be a legitimate lack of bounds checking in nci_add_new_protocol(). Add the missing checks. Reported-by: syzbot+210e196cef4711b65139(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/lkml/0000000000001c590f05ee7b3ff4@google.com Fixes: 019c4fbaa790 ("NFC: Add NCI multiple targets support") Signed-off-by: Kees Cook <keescook(a)chromium.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://lore.kernel.org/r/20221202214410.never.693-kees@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- net/nfc/nci/ntf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c index 33e1170817f0..f8b20cddd5c9 100644 --- a/net/nfc/nci/ntf.c +++ b/net/nfc/nci/ntf.c @@ -218,6 +218,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev, target->sens_res = nfca_poll->sens_res; target->sel_res = nfca_poll->sel_res; target->nfcid1_len = nfca_poll->nfcid1_len; + if (target->nfcid1_len > ARRAY_SIZE(target->nfcid1)) + return -EPROTO; if (target->nfcid1_len > 0) { memcpy(target->nfcid1, nfca_poll->nfcid1, target->nfcid1_len); @@ -226,6 +228,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev, nfcb_poll = (struct rf_tech_specific_params_nfcb_poll *)params; target->sensb_res_len = nfcb_poll->sensb_res_len; + if (target->sensb_res_len > ARRAY_SIZE(target->sensb_res)) + return -EPROTO; if (target->sensb_res_len > 0) { memcpy(target->sensb_res, nfcb_poll->sensb_res, target->sensb_res_len); @@ -234,6 +238,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev, nfcf_poll = (struct rf_tech_specific_params_nfcf_poll *)params; target->sensf_res_len = nfcf_poll->sensf_res_len; + if (target->sensf_res_len > ARRAY_SIZE(target->sensf_res)) + return -EPROTO; if (target->sensf_res_len > 0) { memcpy(target->sensf_res, nfcf_poll->sensf_res, target->sensf_res_len); -- 2.34.1

2 1

[PATCH OLK-5.10] apparmor: fix policy_unpack_test on big endian systems
by Gu Bowen 29 Oct '24

29 Oct '24

From: Guenter Roeck <linux(a)roeck-us.net> stable inclusion from stable-v5.10.225 commit 7e8bad2cf3930e2ff7cab10644ca111bacaba398 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB0D93 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 98c0cc48e27e9d269a3e4db2acd72b486c88ec77 ] policy_unpack_test fails on big endian systems because data byte order is expected to be little endian but is generated in host byte order. This results in test failures such as: # policy_unpack_test_unpack_array_with_null_name: EXPECTATION FAILED at security/apparmor/policy_unpack_test.c:150 Expected array_size == (u16)16, but array_size == 4096 (0x1000) (u16)16 == 16 (0x10) # policy_unpack_test_unpack_array_with_null_name: pass:0 fail:1 skip:0 total:1 not ok 3 policy_unpack_test_unpack_array_with_null_name # policy_unpack_test_unpack_array_with_name: EXPECTATION FAILED at security/apparmor/policy_unpack_test.c:164 Expected array_size == (u16)16, but array_size == 4096 (0x1000) (u16)16 == 16 (0x10) # policy_unpack_test_unpack_array_with_name: pass:0 fail:1 skip:0 total:1 Add the missing endianness conversions when generating test data. Fixes: 4d944bcd4e73 ("apparmor: add AppArmor KUnit tests for policy unpack") Cc: Brendan Higgins <brendanhiggins(a)google.com> Cc: Kees Cook <keescook(a)chromium.org> Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/apparmor/policy_unpack_test.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/security/apparmor/policy_unpack_test.c b/security/apparmor/policy_unpack_test.c index 533137f45361..4951d9bef579 100644 --- a/security/apparmor/policy_unpack_test.c +++ b/security/apparmor/policy_unpack_test.c @@ -78,14 +78,14 @@ struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf, *(buf + 1) = strlen(TEST_U32_NAME) + 1; strcpy(buf + 3, TEST_U32_NAME); *(buf + 3 + strlen(TEST_U32_NAME) + 1) = AA_U32; - *((u32 *)(buf + 3 + strlen(TEST_U32_NAME) + 2)) = TEST_U32_DATA; + *((__le32 *)(buf + 3 + strlen(TEST_U32_NAME) + 2)) = cpu_to_le32(TEST_U32_DATA); buf = e->start + TEST_NAMED_U64_BUF_OFFSET; *buf = AA_NAME; *(buf + 1) = strlen(TEST_U64_NAME) + 1; strcpy(buf + 3, TEST_U64_NAME); *(buf + 3 + strlen(TEST_U64_NAME) + 1) = AA_U64; - *((u64 *)(buf + 3 + strlen(TEST_U64_NAME) + 2)) = TEST_U64_DATA; + *((__le64 *)(buf + 3 + strlen(TEST_U64_NAME) + 2)) = cpu_to_le64(TEST_U64_DATA); buf = e->start + TEST_NAMED_BLOB_BUF_OFFSET; *buf = AA_NAME; @@ -101,7 +101,7 @@ struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf, *(buf + 1) = strlen(TEST_ARRAY_NAME) + 1; strcpy(buf + 3, TEST_ARRAY_NAME); *(buf + 3 + strlen(TEST_ARRAY_NAME) + 1) = AA_ARRAY; - *((u16 *)(buf + 3 + strlen(TEST_ARRAY_NAME) + 2)) = TEST_ARRAY_SIZE; + *((__le16 *)(buf + 3 + strlen(TEST_ARRAY_NAME) + 2)) = cpu_to_le16(TEST_ARRAY_SIZE); return e; } -- 2.25.1

2 1

[PATCH OLK-5.10] PCI: mt7621: Add sentinel to quirks table
by liwei 29 Oct '24

29 Oct '24

From: John Thomson <git(a)johnthomson.fastmail.com.au> mainline inclusion from mainline-v6.2-rc1 commit 19098934f910b4d47cb30251dd39ffa57bef9523 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRFS Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Current driver is missing a sentinel in the struct soc_device_attribute array, which causes an oops when assessed by the soc_device_match(mt7621_pcie_quirks_match) call. This was only exposed once the CONFIG_SOC_MT7621 mt7621 soc_dev_attr was fixed to register the SOC as a device, in: commit 7c18b64bba3b ("mips: ralink: mt7621: do not use kzalloc too early") Fix it by adding the required sentinel. Link: https://lore.kernel.org/lkml/26ebbed1-0fe9-4af9-8466-65f841d0b382@app.fastm… Link: https://lore.kernel.org/r/20221205204645.301301-1-git@johnthomson.fastmail.… Fixes: b483b4e4d3f6 ("staging: mt7621-pci: add quirks for 'E2' revision using 'soc_device_attribute'") Signed-off-by: John Thomson <git(a)johnthomson.fastmail.com.au> Signed-off-by: Lorenzo Pieralisi <lpieralisi(a)kernel.org> Acked-by: Sergio Paracuellos <sergio.paracuellos(a)gmail.com> Conflicts: drivers/pci/controller/pcie-mt7621.c drivers/staging/mt7621-pci/pci-mt7621.c [commit 4793895f597d42eb54a0f54711b61263b6a8dd03("PCI: mt7621: Rename mt7621_pci_ to mt7621_pcie_") was not merged] Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/staging/mt7621-pci/pci-mt7621.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/staging/mt7621-pci/pci-mt7621.c b/drivers/staging/mt7621-pci/pci-mt7621.c index 8831db383fad..8f2c43eda4ca 100644 --- a/drivers/staging/mt7621-pci/pci-mt7621.c +++ b/drivers/staging/mt7621-pci/pci-mt7621.c @@ -677,7 +677,8 @@ static int mt7621_pcie_register_host(struct pci_host_bridge *host, } static const struct soc_device_attribute mt7621_pci_quirks_match[] = { - { .soc_id = "mt7621", .revision = "E2" } + { .soc_id = "mt7621", .revision = "E2" }, + { /* sentinel */ } }; static int mt7621_pci_probe(struct platform_device *pdev) -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] PCI: mt7621: Add sentinel to quirks table
by liwei 29 Oct '24

29 Oct '24

From: John Thomson <git(a)johnthomson.fastmail.com.au> mainline inclusion from mainline-v6.2-rc1 commit 19098934f910b4d47cb30251dd39ffa57bef9523 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRFS Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Current driver is missing a sentinel in the struct soc_device_attribute array, which causes an oops when assessed by the soc_device_match(mt7621_pcie_quirks_match) call. This was only exposed once the CONFIG_SOC_MT7621 mt7621 soc_dev_attr was fixed to register the SOC as a device, in: commit 7c18b64bba3b ("mips: ralink: mt7621: do not use kzalloc too early") Fix it by adding the required sentinel. Link: https://lore.kernel.org/lkml/26ebbed1-0fe9-4af9-8466-65f841d0b382@app.fastm… Link: https://lore.kernel.org/r/20221205204645.301301-1-git@johnthomson.fastmail.… Fixes: b483b4e4d3f6 ("staging: mt7621-pci: add quirks for 'E2' revision using 'soc_device_attribute'") Signed-off-by: John Thomson <git(a)johnthomson.fastmail.com.au> Signed-off-by: Lorenzo Pieralisi <lpieralisi(a)kernel.org> Acked-by: Sergio Paracuellos <sergio.paracuellos(a)gmail.com> Conflicts: drivers/pci/controller/pcie-mt7621.c drivers/staging/mt7621-pci/pci-mt7621.c [commit 4793895f597d42eb54a0f54711b61263b6a8dd03("PCI: mt7621: Rename mt7621_pci_ to mt7621_pcie_") was not merged] Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/staging/mt7621-pci/pci-mt7621.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/staging/mt7621-pci/pci-mt7621.c b/drivers/staging/mt7621-pci/pci-mt7621.c index 8831db383fad..8f2c43eda4ca 100644 --- a/drivers/staging/mt7621-pci/pci-mt7621.c +++ b/drivers/staging/mt7621-pci/pci-mt7621.c @@ -677,7 +677,8 @@ static int mt7621_pcie_register_host(struct pci_host_bridge *host, } static const struct soc_device_attribute mt7621_pci_quirks_match[] = { - { .soc_id = "mt7621", .revision = "E2" } + { .soc_id = "mt7621", .revision = "E2" }, + { /* sentinel */ } }; static int mt7621_pci_probe(struct platform_device *pdev) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] NFC: nci: Bounds check struct nfc_target arrays
by Bowen You 29 Oct '24

29 Oct '24

From: Kees Cook <keescook(a)chromium.org> stable inclusion from stable-v4.19.269 commit e329e71013c9b5a4535b099208493c7826ee4a64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRFA CVE: CVE-2022-48967 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit e329e71013c9b5a4535b099208493c7826ee4a64 ] While running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported: memcpy: detected field-spanning write (size 129) of single field "target->sensf_res" at net/nfc/nci/ntf.c:260 (size 18) This appears to be a legitimate lack of bounds checking in nci_add_new_protocol(). Add the missing checks. Reported-by: syzbot+210e196cef4711b65139(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/lkml/0000000000001c590f05ee7b3ff4@google.com Fixes: 019c4fbaa790 ("NFC: Add NCI multiple targets support") Signed-off-by: Kees Cook <keescook(a)chromium.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://lore.kernel.org/r/20221202214410.never.693-kees@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- net/nfc/nci/ntf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c index 1e8c1a12aaec..4f75453c07aa 100644 --- a/net/nfc/nci/ntf.c +++ b/net/nfc/nci/ntf.c @@ -230,6 +230,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev, target->sens_res = nfca_poll->sens_res; target->sel_res = nfca_poll->sel_res; target->nfcid1_len = nfca_poll->nfcid1_len; + if (target->nfcid1_len > ARRAY_SIZE(target->nfcid1)) + return -EPROTO; if (target->nfcid1_len > 0) { memcpy(target->nfcid1, nfca_poll->nfcid1, target->nfcid1_len); @@ -238,6 +240,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev, nfcb_poll = (struct rf_tech_specific_params_nfcb_poll *)params; target->sensb_res_len = nfcb_poll->sensb_res_len; + if (target->sensb_res_len > ARRAY_SIZE(target->sensb_res)) + return -EPROTO; if (target->sensb_res_len > 0) { memcpy(target->sensb_res, nfcb_poll->sensb_res, target->sensb_res_len); @@ -246,6 +250,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev, nfcf_poll = (struct rf_tech_specific_params_nfcf_poll *)params; target->sensf_res_len = nfcf_poll->sensf_res_len; + if (target->sensf_res_len > ARRAY_SIZE(target->sensf_res)) + return -EPROTO; if (target->sensf_res_len > 0) { memcpy(target->sensf_res, nfcf_poll->sensf_res, target->sensf_res_len); -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream'
by Cai Xinchen 29 Oct '24

29 Oct '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v6.6.55 commit 4778982c73d6c9f3fdbdbc6b6c8aa18df98251af category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAU CVE: CVE-2024-49912 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8141f21b941710ecebe49220b69822cab3abd23d ] This commit adds a null check for 'stream_status' in the function 'planes_changed_for_existing_stream'. Previously, the code assumed 'stream_status' could be null, but did not handle the case where it was actually null. This could lead to a null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_resource.c:3784 planes_changed_for_existing_stream() error: we previously assumed 'stream_status' could be null (see line 3774) Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c index 733e445331ea..4b34bc9d4e4b 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c @@ -2877,8 +2877,10 @@ static bool planes_changed_for_existing_stream(struct dc_state *context, } } - if (!stream_status) + if (!stream_status) { ASSERT(0); + return false; + } for (i = 0; i < set_count; i++) if (set[i].stream == stream) -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] writeback: Fix inode->i_io_list not be protected by inode->i_lock error
by Baokun Li 29 Oct '24

29 Oct '24

Jan Kara (1): init: Initialize noop_backing_dev_info early Jchao Sun (1): writeback: Fix inode->i_io_list not be protected by inode->i_lock error drivers/base/init.c | 2 ++ fs/fs-writeback.c | 37 ++++++++++++++++++++++++++++--------- fs/inode.c | 2 +- include/linux/backing-dev.h | 2 ++ mm/backing-dev.c | 11 ++--------- 5 files changed, 35 insertions(+), 19 deletions(-) -- 2.46.1

2 3

[PATCH openEuler-1.0-LTS 0/2] writeback: Fix inode->i_io_list not be protected by inode->i_lock error
by Baokun Li 29 Oct '24

29 Oct '24

Jan Kara (1): init: Initialize noop_backing_dev_info early Jchao Sun (1): writeback: Fix inode->i_io_list not be protected by inode->i_lock error drivers/base/init.c | 2 ++ fs/fs-writeback.c | 37 ++++++++++++++++++++++++++++--------- fs/inode.c | 2 +- include/linux/backing-dev.h | 2 ++ mm/backing-dev.c | 11 ++--------- 5 files changed, 35 insertions(+), 19 deletions(-) -- 2.46.1

2 3

[PATCH OLK-6.6 01/14] khugepaged: inline hpage_collapse_alloc_folio()
by Nanyong Sun 29 Oct '24

29 Oct '24

From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> mainline inclusion from mainline-v6.10-rc1 commit 4746f5ce0fa52e21b5fe432970fe9516d1a45ebc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAXCD2 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Patch series "khugepaged folio conversions". We've been kind of hacking piecemeal at converting khugepaged to use folios instead of compound pages, and so this patchset is a little larger than it should be as I undo some of our wrong moves in the past. In particular, collapse_file() now consistently uses 'new_folio' for the freshly allocated folio and 'folio' for the one that's currently in use. This patch (of 7): This function has one caller, and the combined function is simpler to read, reason about and modify. Link: https://lkml.kernel.org/r/20240403171838.1445826-1-willy@infradead.org Link: https://lkml.kernel.org/r/20240403171838.1445826-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Reviewed-by: Vishal Moola (Oracle) <vishal.moola(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/khugepaged.c [Context difference only] Signed-off-by: Nanyong Sun <sunnanyong(a)huawei.com> --- mm/khugepaged.c | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index c6379a2d55bc..4c1d69c04975 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -919,20 +919,6 @@ static int hpage_collapse_find_target_node(struct collapse_control *cc) } #endif -static bool hpage_collapse_alloc_folio(struct folio **folio, gfp_t gfp, int node, - nodemask_t *nmask) -{ - *folio = __folio_alloc(gfp, HPAGE_PMD_ORDER, node, nmask); - - if (unlikely(!*folio)) { - count_vm_event(THP_COLLAPSE_ALLOC_FAILED); - return false; - } - - count_vm_event(THP_COLLAPSE_ALLOC); - return true; -} - /* * If mmap_lock temporarily dropped, revalidate vma * before taking mmap_lock. @@ -1098,11 +1084,14 @@ static int alloc_charge_hpage(struct page **hpage, struct mm_struct *mm, if (cc->reliable) gfp |= GFP_RELIABLE; - if (!hpage_collapse_alloc_folio(&folio, gfp, node, &cc->alloc_nmask)) { + folio = __folio_alloc(gfp, HPAGE_PMD_ORDER, node, &cc->alloc_nmask); + if (!folio) { *hpage = NULL; + count_vm_event(THP_COLLAPSE_ALLOC_FAILED); return SCAN_ALLOC_HUGE_PAGE_FAIL; } + count_vm_event(THP_COLLAPSE_ALLOC); if (unlikely(mem_cgroup_charge(folio, mm, gfp))) { folio_put(folio); *hpage = NULL; -- 2.33.0

2 14

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Check null pointer before dereferencing se
by Xiaomeng Zhang 29 Oct '24

29 Oct '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.227 commit f4149eec960110ffd5bcb161075dd9f1d7773075 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZM9Wi CVE: CVE-2024-50049 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ff599ef6970ee000fa5bc38d02fa5ff5f3fc7575 ] [WHAT & HOW] se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again. This fixes 1 FORWARD_NULL issue reported by Coverity. Acked-by: Alex Hung <alex.hung(a)amd.com> Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index ddbfce8390bb..3c350c76790a 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1251,7 +1251,7 @@ bool dc_validate_seamless_boot_timing(const struct dc *dc, if (crtc_timing->pix_clk_100hz != pix_clk_100hz) return false; - if (!se->funcs->dp_get_pixel_format) + if (!se || !se->funcs->dp_get_pixel_format) return false; if (!se->funcs->dp_get_pixel_format( -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/display: Check null pointer before dereferencing se
by Xiaomeng Zhang 29 Oct '24

29 Oct '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.227 commit f4149eec960110ffd5bcb161075dd9f1d7773075 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZM9Wi CVE: CVE-2024-50049 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ff599ef6970ee000fa5bc38d02fa5ff5f3fc7575 ] [WHAT & HOW] se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again. This fixes 1 FORWARD_NULL issue reported by Coverity. Acked-by: Alex Hung <alex.hung(a)amd.com> Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index adcf5ba83703..c172622365d3 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1252,7 +1252,7 @@ bool dc_validate_seamless_boot_timing(const struct dc *dc, if (crtc_timing->pix_clk_100hz != pix_clk_100hz) return false; - if (!se->funcs->dp_get_pixel_format) + if (!se || !se->funcs->dp_get_pixel_format) return false; if (!se->funcs->dp_get_pixel_format( -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 5435/23883] drivers/tty/serial/sc16is7xx.c:1501:1: warning: label 'err_i2c' defined but not used
by kernel test robot 29 Oct '24

29 Oct '24

Hi Mao, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 27399521743732e65e7635fa93bd0cca53981c9e commit: 1c30433d9fa5c5b48039990ba214c0e8e199a22d [5435/23883] sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init() config: x86_64-randconfig-071-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290956.flJi6dhy-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290956.flJi6dhy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410290956.flJi6dhy-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/tty/serial/sc16is7xx.c: In function 'sc16is7xx_init': >> drivers/tty/serial/sc16is7xx.c:1501:1: warning: label 'err_i2c' defined but not used [-Wunused-label] 1501 | err_i2c: | ^~~~~~~ drivers/tty/serial/sc16is7xx.o: warning: objtool: sc16is7xx_gpio_get()+0x104: sibling call from callable instruction with modified stack frame drivers/tty/serial/sc16is7xx.o: warning: objtool: sc16is7xx_gpio_direction_input()+0x13: sibling call from callable instruction with modified stack frame drivers/tty/serial/sc16is7xx.o: warning: objtool: sc16is7xx_gpio_set()+0x105: sibling call from callable instruction with modified stack frame drivers/tty/serial/sc16is7xx.o: warning: objtool: sc16is7xx_gpio_direction_output()+0x2ba: sibling call from callable instruction with modified stack frame drivers/tty/serial/sc16is7xx.o: warning: objtool: sc16is7xx_set_baud()+0xdf: sibling call from callable instruction with modified stack frame vim +/err_i2c +1501 drivers/tty/serial/sc16is7xx.c 1487 1488 #ifdef CONFIG_SERIAL_SC16IS7XX_SPI 1489 ret = spi_register_driver(&sc16is7xx_spi_uart_driver); 1490 if (ret < 0) { 1491 pr_err("failed to init sc16is7xx spi --> %d\n", ret); 1492 goto err_spi; 1493 } 1494 #endif 1495 return ret; 1496 1497 err_spi: 1498 #ifdef CONFIG_SERIAL_SC16IS7XX_I2C 1499 i2c_del_driver(&sc16is7xx_i2c_uart_driver); 1500 #endif > 1501 err_i2c: 1502 uart_unregister_driver(&sc16is7xx_uart); 1503 return ret; 1504 } 1505 module_init(sc16is7xx_init); 1506 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 8359/23883] fs/gfs2/bmap.c:960:31: warning: 'lblock' may be used uninitialized
by kernel test robot 29 Oct '24

29 Oct '24

Hi Andreas, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 27399521743732e65e7635fa93bd0cca53981c9e commit: 484798bc8218ce6a0f8269675897b870a12c49e2 [8359/23883] gfs2: gfs2_walk_metadata fix config: x86_64-buildonly-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290938.ovb4D3kI-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290938.ovb4D3kI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410290938.ovb4D3kI-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): fs/gfs2/bmap.c: In function 'gfs2_iomap_alloc': fs/gfs2/bmap.c:748:28: warning: this statement may fall through [-Wimplicit-fallthrough=] 748 | if (n == 0) | ^ fs/gfs2/bmap.c:751:17: note: here 751 | case ALLOC_GROW_DEPTH: | ^~~~ fs/gfs2/bmap.c:759:28: warning: this statement may fall through [-Wimplicit-fallthrough=] 759 | if (n == 0) | ^ fs/gfs2/bmap.c:762:17: note: here 762 | case ALLOC_DATA: | ^~~~ fs/gfs2/bmap.c: In function 'gfs2_iomap_get': >> fs/gfs2/bmap.c:960:31: warning: 'lblock' may be used uninitialized [-Wmaybe-uninitialized] 960 | ret = gfs2_hole_size(inode, lblock, len, mp, iomap); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/gfs2/bmap.c:851:18: note: 'lblock' was declared here 851 | sector_t lblock; | ^~~~~~ fs/gfs2/bmap.c:960:31: warning: 'len' may be used uninitialized [-Wmaybe-uninitialized] 960 | ret = gfs2_hole_size(inode, lblock, len, mp, iomap); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/gfs2/bmap.c:855:13: note: 'len' was declared here 855 | u64 len; | ^~~ fs/gfs2/bmap.c:959:32: warning: 'height' may be used uninitialized [-Wmaybe-uninitialized] 959 | if (pos < size && height == ip->i_height) | ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~ fs/gfs2/bmap.c:857:12: note: 'height' was declared here 857 | u8 height; | ^~~~~~ fs/gfs2/bmap.c:1290: warning: Function parameter or member 'inode' not described in 'gfs2_block_zero_range' fs/gfs2/bmap.c:1290: warning: Function parameter or member 'from' not described in 'gfs2_block_zero_range' fs/gfs2/bmap.c:1290: warning: Function parameter or member 'length' not described in 'gfs2_block_zero_range' fs/gfs2/bmap.c:1493: warning: Function parameter or member 'rd_gh' not described in 'sweep_bh_for_rgrps' fs/gfs2/bmap.c:1493: warning: Excess function parameter 'rg_gh' description in 'sweep_bh_for_rgrps' fs/gfs2/bmap.c:1661: warning: Function parameter or member 'sdp' not described in 'find_nonnull_ptr' fs/gfs2/bmap.c:1661: warning: Function parameter or member 'end_list' not described in 'find_nonnull_ptr' fs/gfs2/bmap.c:1661: warning: Function parameter or member 'end_aligned' not described in 'find_nonnull_ptr' vim +/lblock +960 fs/gfs2/bmap.c 7ee66c03e40a57 Christoph Hellwig 2018-06-01 831 3974320ca6aa68 Bob Peterson 2017-02-16 832 /** 628e366df11c0a Andreas Gruenbacher 2018-06-04 833 * gfs2_iomap_get - Map blocks from an inode to disk blocks 3974320ca6aa68 Bob Peterson 2017-02-16 834 * @inode: The inode 3974320ca6aa68 Bob Peterson 2017-02-16 835 * @pos: Starting position in bytes 3974320ca6aa68 Bob Peterson 2017-02-16 836 * @length: Length to map, in bytes 3974320ca6aa68 Bob Peterson 2017-02-16 837 * @flags: iomap flags 3974320ca6aa68 Bob Peterson 2017-02-16 838 * @iomap: The iomap structure 628e366df11c0a Andreas Gruenbacher 2018-06-04 839 * @mp: The metapath 3974320ca6aa68 Bob Peterson 2017-02-16 840 * 3974320ca6aa68 Bob Peterson 2017-02-16 841 * Returns: errno 3974320ca6aa68 Bob Peterson 2017-02-16 842 */ 628e366df11c0a Andreas Gruenbacher 2018-06-04 843 static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length, 628e366df11c0a Andreas Gruenbacher 2018-06-04 844 unsigned flags, struct iomap *iomap, 628e366df11c0a Andreas Gruenbacher 2018-06-04 845 struct metapath *mp) b3b94faa5fe596 David Teigland 2006-01-16 846 { feaa7bba026c18 Steven Whitehouse 2006-06-14 847 struct gfs2_inode *ip = GFS2_I(inode); feaa7bba026c18 Steven Whitehouse 2006-06-14 848 struct gfs2_sbd *sdp = GFS2_SB(inode); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 849 loff_t size = i_size_read(inode); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 850 __be64 *ptr; 3974320ca6aa68 Bob Peterson 2017-02-16 851 sector_t lblock; 628e366df11c0a Andreas Gruenbacher 2018-06-04 852 sector_t lblock_stop; 628e366df11c0a Andreas Gruenbacher 2018-06-04 853 int ret; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 854 int eob; 628e366df11c0a Andreas Gruenbacher 2018-06-04 855 u64 len; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 856 struct buffer_head *dibh = NULL, *bh; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 857 u8 height; 7276b3b0c77101 Steven Whitehouse 2006-09-21 858 628e366df11c0a Andreas Gruenbacher 2018-06-04 859 if (!length) 628e366df11c0a Andreas Gruenbacher 2018-06-04 860 return -EINVAL; b3b94faa5fe596 David Teigland 2006-01-16 861 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 862 down_read(&ip->i_rw_mutex); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 863 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 864 ret = gfs2_meta_inode_buffer(ip, &dibh); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 865 if (ret) d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 866 goto unlock; 38084377af4fc8 Andreas Gruenbacher 2018-11-11 867 mp->mp_bh[0] = dibh; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 868 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 869 if (gfs2_is_stuffed(ip)) { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 870 if (flags & IOMAP_WRITE) { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 871 loff_t max_size = gfs2_max_stuffed_size(ip); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 872 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 873 if (pos + length > max_size) d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 874 goto unstuff; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 875 iomap->length = max_size; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 876 } else { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 877 if (pos >= size) { 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 878 if (flags & IOMAP_REPORT) { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 879 ret = -ENOENT; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 880 goto unlock; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 881 } else { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 882 /* report a hole */ d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 883 iomap->offset = pos; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 884 iomap->length = length; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 885 goto do_alloc; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 886 } 3974320ca6aa68 Bob Peterson 2017-02-16 887 } d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 888 iomap->length = size; 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 889 } d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 890 iomap->addr = (ip->i_no_addr << inode->i_blkbits) + d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 891 sizeof(struct gfs2_dinode); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 892 iomap->type = IOMAP_INLINE; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 893 iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 894 goto out; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 895 } d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 896 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 897 unstuff: 3974320ca6aa68 Bob Peterson 2017-02-16 898 lblock = pos >> inode->i_blkbits; 3974320ca6aa68 Bob Peterson 2017-02-16 899 iomap->offset = lblock << inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 900 lblock_stop = (pos + length - 1) >> inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 901 len = lblock_stop - lblock + 1; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 902 iomap->length = len << inode->i_blkbits; 20cdc1931ee8e0 Andreas Gruenbacher 2017-09-22 903 9b8c81d1de4994 Steven Whitehouse 2008-02-22 904 height = ip->i_height; 9a38662ba4e268 Andreas Gruenbacher 2018-04-16 905 while ((lblock + 1) * sdp->sd_sb.sb_bsize > sdp->sd_heightsize[height]) ecc30c79157103 Steven Whitehouse 2008-01-28 906 height++; 628e366df11c0a Andreas Gruenbacher 2018-06-04 907 find_metapath(sdp, lblock, mp, height); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 908 if (height > ip->i_height || gfs2_is_stuffed(ip)) 9b8c81d1de4994 Steven Whitehouse 2008-02-22 909 goto do_alloc; 3974320ca6aa68 Bob Peterson 2017-02-16 910 628e366df11c0a Andreas Gruenbacher 2018-06-04 911 ret = lookup_metapath(ip, mp); e8b43fe0c1e035 Andreas Gruenbacher 2017-12-08 912 if (ret) 628e366df11c0a Andreas Gruenbacher 2018-06-04 913 goto unlock; 3974320ca6aa68 Bob Peterson 2017-02-16 914 628e366df11c0a Andreas Gruenbacher 2018-06-04 915 if (mp->mp_aheight != ip->i_height) 9b8c81d1de4994 Steven Whitehouse 2008-02-22 916 goto do_alloc; 3974320ca6aa68 Bob Peterson 2017-02-16 917 628e366df11c0a Andreas Gruenbacher 2018-06-04 918 ptr = metapointer(ip->i_height - 1, mp); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 919 if (*ptr == 0) 9b8c81d1de4994 Steven Whitehouse 2008-02-22 920 goto do_alloc; 3974320ca6aa68 Bob Peterson 2017-02-16 921 628e366df11c0a Andreas Gruenbacher 2018-06-04 922 bh = mp->mp_bh[ip->i_height - 1]; bcfe94139a45fa Andreas Gruenbacher 2018-05-11 923 len = gfs2_extent_length(bh, ptr, len, &eob); 3974320ca6aa68 Bob Peterson 2017-02-16 924 628e366df11c0a Andreas Gruenbacher 2018-06-04 925 iomap->addr = be64_to_cpu(*ptr) << inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 926 iomap->length = len << inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 927 iomap->type = IOMAP_MAPPED; 0ed91eca1130e6 Andreas Gruenbacher 2018-07-25 928 iomap->flags |= IOMAP_F_MERGED; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 929 if (eob) 7ee66c03e40a57 Christoph Hellwig 2018-06-01 930 iomap->flags |= IOMAP_F_GFS2_BOUNDARY; 3974320ca6aa68 Bob Peterson 2017-02-16 931 3974320ca6aa68 Bob Peterson 2017-02-16 932 out: 628e366df11c0a Andreas Gruenbacher 2018-06-04 933 iomap->bdev = inode->i_sb->s_bdev; 628e366df11c0a Andreas Gruenbacher 2018-06-04 934 unlock: 628e366df11c0a Andreas Gruenbacher 2018-06-04 935 up_read(&ip->i_rw_mutex); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 936 return ret; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 937 9b8c81d1de4994 Steven Whitehouse 2008-02-22 938 do_alloc: 628e366df11c0a Andreas Gruenbacher 2018-06-04 939 iomap->addr = IOMAP_NULL_ADDR; 628e366df11c0a Andreas Gruenbacher 2018-06-04 940 iomap->type = IOMAP_HOLE; 628e366df11c0a Andreas Gruenbacher 2018-06-04 941 if (flags & IOMAP_REPORT) { 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 942 if (pos >= size) 3974320ca6aa68 Bob Peterson 2017-02-16 943 ret = -ENOENT; 628e366df11c0a Andreas Gruenbacher 2018-06-04 944 else if (height == ip->i_height) 628e366df11c0a Andreas Gruenbacher 2018-06-04 945 ret = gfs2_hole_size(inode, lblock, len, mp, iomap); 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 946 else 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 947 iomap->length = size - pos; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 948 } else if (flags & IOMAP_WRITE) { 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 949 u64 alloc_size; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 950 967bcc91b04493 Andreas Gruenbacher 2018-06-19 951 if (flags & IOMAP_DIRECT) 967bcc91b04493 Andreas Gruenbacher 2018-06-19 952 goto out; /* (see gfs2_file_direct_write) */ 967bcc91b04493 Andreas Gruenbacher 2018-06-19 953 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 954 len = gfs2_alloc_size(inode, mp, len); 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 955 alloc_size = len << inode->i_blkbits; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 956 if (alloc_size < iomap->length) 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 957 iomap->length = alloc_size; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 958 } else { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 959 if (pos < size && height == ip->i_height) d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 @960 ret = gfs2_hole_size(inode, lblock, len, mp, iomap); 3974320ca6aa68 Bob Peterson 2017-02-16 961 } 628e366df11c0a Andreas Gruenbacher 2018-06-04 962 goto out; 628e366df11c0a Andreas Gruenbacher 2018-06-04 963 } 628e366df11c0a Andreas Gruenbacher 2018-06-04 964 :::::: The code at line 960 was first introduced by commit :::::: d505a96a3b16f46455035dc0296bc2da6014e163 gfs2: Further iomap cleanups :::::: TO: Andreas Gruenbacher <agruenba(a)redhat.com> :::::: CC: Andreas Gruenbacher <agruenba(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 8dcdd5a432518f8f8deb6ab608551ecda71bda40
by kernel test robot 29 Oct '24

29 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 8dcdd5a432518f8f8deb6ab608551ecda71bda40 !12459 drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202410282334.pOpu4nRk-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410290217.j4yRbZGJ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410290835.BHKldai7-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410290853.IWsztKim-lkp@intel.com arch/arm64/include/asm/kgdb.h:21:25: error: value '1025' out of range for constraint 'I' drivers/ptp/ptp_hisi.c:731:36: warning: 'hisi_ptp_acpi_match' defined but not used [-Wunused-const-variable=] kernel/trace/trace_osnoise.c:933: undefined reference to `latency_fsnotify' mm/memcontrol.c:5879:40: error: implicit declaration of function 'ksm_process_profit' [-Werror=implicit-function-declaration] mm/pin_mem.c:859:63: error: lvalue required as unary '&' operand Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-001-20241029 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-002-20241029 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-003-20241029 | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- drivers-ptp-ptp_hisi.c:warning:hisi_ptp_acpi_match-defined-but-not-used | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-ubcore_create_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-ubcore_create_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-ubcore_remove_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-ubcore_remove_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:the-comparison-will-always-evaluate-as-false-for-the-address-of-head-will-never-be-NULL | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-ubcore_destroy_upi_list | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-ubcore_dispatch_event | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-ubcore_net_exit | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:strnlen-specified-bound-exceeds-source-size | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_add_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_check_port_state | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_del_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_lookup_sip_idx | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_notify_uvs_add_sip | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_notify_uvs_del_sip | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_put_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_set_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_idx_alloc | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_idx_free | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_table_init | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_table_uninit | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_unset_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:strnlen-specified-bound-exceeds-source-size | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-ubcore_modify_tp_state | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:the-comparison-will-always-evaluate-as-false-for-the-address-of-head-will-never-be-NULL | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:the-comparison-will-always-evaluate-as-false-for-the-address-of-head-will-never-be-NULL | |-- drivers-ub-urma-ubcore-ubcore_uvs_cmd.c:warning:strncpy-output-truncated-before-terminating-nul-copying-bytes-from-a-string-of-the-same-length | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-ubcore_hash_table_rmv_vtpn | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length | |-- fs-proc-base.c:warning:no-previous-prototype-for-pbha_bit0_hide_file | |-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit | `-- mm-pin_mem.c:error:lvalue-required-as-unary-operand |-- arm64-randconfig-004-20241029 | |-- arch-arm64-include-asm-kgdb.h:error:value-out-of-range-for-constraint-I | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BPF_NET_GLOBAL_PROG-when-selected-by-SCHED_TASK_RELATIONSHIP | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-TASK_PLACEMENT_BY_CPU_RANGE-when-selected-by-BPF_SCHED |-- x86_64-allyesconfig | |-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used | |-- kernel-sched-core.c:warning:no-previous-prototype-for-function-sched_setsteal | `-- kernel-sched-core.c:warning:no-previous-prototype-for-function-tg_change_steal |-- x86_64-buildonly-randconfig-002-20241029 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | `-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-mcp251xfd_tx_obj_write_sync |-- x86_64-buildonly-randconfig-003-20241029 | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit | `-- mm-memcontrol.c:error:implicit-declaration-of-function-ksm_process_profit |-- x86_64-buildonly-randconfig-004-20241029 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | `-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn |-- x86_64-buildonly-randconfig-005-20241029 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE | `-- drivers-gpu-drm-loongson-lsdc_plane.o:warning:objtool:lsdc_plane_init-falls-through-to-next-function-lsdc_plane_reset() |-- x86_64-randconfig-011-20241029 | `-- drivers-gpu-drm-radeon-evergreen.o:warning:objtool:evergreen_irq_ack-falls-through-to-next-function-evergreen_resume() |-- x86_64-randconfig-013-20241029 | `-- drivers-gpu-drm-radeon-evergreen.o:warning:objtool:evergreen_irq_ack-falls-through-to-next-function-evergreen_resume() |-- x86_64-randconfig-014-20241028 | `-- arch-x86-kvm-mmu-mmu.o:warning:objtool:mmu_set_spte:unreachable-instruction |-- x86_64-randconfig-072-20241028 | `-- kernel-trace-trace_osnoise.c:undefined-reference-to-latency_fsnotify |-- x86_64-randconfig-072-20241029 | `-- fs-ntfs3-frecord.o:warning:objtool:ni_read_frame-falls-through-to-next-function-ni_readpage_cmprcold() |-- x86_64-randconfig-075-20241029 | `-- fs-ntfs3-frecord.o:warning:objtool:ni_read_frame-falls-through-to-next-function-ni_readpage_cmprcold() `-- x86_64-randconfig-161-20241029 |-- fs-ntfs3-attrib.c-attr_allocate_frame()-error:we-previously-assumed-attr_b-could-be-null-(see-line-) |-- fs-ntfs3-fslog.c-last_log_lsn()-warn:possible-memory-leak-of-page_bufs `-- mm-memcontrol.c-uncharge_page()-error:uninitialized-symbol-objcg-. elapsed time: 749m configs tested: 35 configs skipped: 128 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241029 clang-17 arm64 randconfig-002-20241029 clang-20 arm64 randconfig-003-20241029 gcc-14.1.0 arm64 randconfig-004-20241029 clang-20 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241029 gcc-12 x86_64 buildonly-randconfig-002-20241029 gcc-12 x86_64 buildonly-randconfig-003-20241029 gcc-12 x86_64 buildonly-randconfig-004-20241029 gcc-12 x86_64 buildonly-randconfig-005-20241029 clang-19 x86_64 buildonly-randconfig-006-20241029 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241029 gcc-12 x86_64 randconfig-002-20241029 clang-19 x86_64 randconfig-003-20241029 gcc-12 x86_64 randconfig-004-20241029 clang-19 x86_64 randconfig-005-20241029 gcc-12 x86_64 randconfig-006-20241029 gcc-12 x86_64 randconfig-011-20241029 clang-19 x86_64 randconfig-012-20241029 clang-19 x86_64 randconfig-013-20241029 clang-19 x86_64 randconfig-014-20241029 clang-19 x86_64 randconfig-015-20241029 gcc-12 x86_64 randconfig-016-20241029 gcc-12 x86_64 randconfig-071-20241029 gcc-12 x86_64 randconfig-072-20241029 gcc-12 x86_64 randconfig-073-20241029 gcc-12 x86_64 randconfig-074-20241029 clang-19 x86_64 randconfig-075-20241029 gcc-12 x86_64 randconfig-076-20241029 gcc-12 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] blk_iocost: fix more out of bound shifts
by Zheng Qixing 29 Oct '24

29 Oct '24

From: Konstantin Ovsepian <ovs(a)ovs.to> stable inclusion from stable-v5.10.227 commit 1f61d509257d6a05763d05bf37943b35306522b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCW CVE: CVE-2024-49933 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9bce8005ec0dcb23a58300e8522fe4a31da606fa ] Recently running UBSAN caught few out of bound shifts in the ioc_forgive_debts() function: UBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... UBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... Call Trace: <IRQ> dump_stack_lvl+0xca/0x130 __ubsan_handle_shift_out_of_bounds+0x22c/0x280 ? __lock_acquire+0x6441/0x7c10 ioc_timer_fn+0x6cec/0x7750 ? blk_iocost_init+0x720/0x720 ? call_timer_fn+0x5d/0x470 call_timer_fn+0xfa/0x470 ? blk_iocost_init+0x720/0x720 __run_timer_base+0x519/0x700 ... Actual impact of this issue was not identified but I propose to fix the undefined behaviour. The proposed fix to prevent those out of bound shifts consist of precalculating exponent before using it the shift operations by taking min value from the actual exponent and maximum possible number of bits. Reported-by: Breno Leitao <leitao(a)debian.org> Signed-off-by: Konstantin Ovsepian <ovs(a)ovs.to> Acked-by: Tejun Heo <tj(a)kernel.org> Link: https://lore.kernel.org/r/20240822154137.2627818-1-ovs@ovs.to Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-iocost.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index 2b3bbae302e2..35e10e1c58fe 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -2047,7 +2047,7 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, struct ioc_now *now) { struct ioc_gq *iocg; - u64 dur, usage_pct, nr_cycles; + u64 dur, usage_pct, nr_cycles, nr_cycles_shift; /* if no debtor, reset the cycle */ if (!nr_debtors) { @@ -2109,10 +2109,12 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, old_debt = iocg->abs_vdebt; old_delay = iocg->delay; + nr_cycles_shift = min_t(u64, nr_cycles, BITS_PER_LONG - 1); if (iocg->abs_vdebt) - iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles ?: 1; + iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles_shift ?: 1; + if (iocg->delay) - iocg->delay = iocg->delay >> nr_cycles ?: 1; + iocg->delay = iocg->delay >> nr_cycles_shift ?: 1; iocg_kick_waitq(iocg, true, now); -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 27399521743732e65e7635fa93bd0cca53981c9e
by kernel test robot 29 Oct '24

29 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 27399521743732e65e7635fa93bd0cca53981c9e !12441 hwmon: (coretemp) Check for null before removing sysfs attrs Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-001-20241029 | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_map_cpu | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_unmap_cpu | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit | |-- mm-pin_mem.c:error:HUGETLB_PAGE_DTOR-undeclared-(first-use-in-this-function) | `-- mm-pin_mem.c:error:lvalue-required-as-unary-operand |-- arm64-randconfig-002-20241029 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | `-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount |-- arm64-randconfig-003-20241029 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:expected-before-ptrval | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-pin_mem.c:error:HUGETLB_PAGE_DTOR-undeclared-(first-use-in-this-function) | `-- mm-pin_mem.c:error:lvalue-required-as-unary-operand |-- arm64-randconfig-004-20241029 | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_map_cpu | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_unmap_cpu | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- include-linux-uaccess.h:warning:cap-may-be-used-uninitialized | `-- mm-pin_mem.c:error:HUGETLB_PAGE_DTOR-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-001-20241029 | `-- fs-nilfs2-btree.c:warning:bh-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-002-20241029 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- drivers-soundwire-bus_type.o:warning:objtool:missing-symbol-for-section-.init.text | `-- drivers-soundwire-intel.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-003-20241029 | |-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init | `-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-buildonly-randconfig-006-20241029 | |-- fs-nilfs2-btree.c:warning:bh-may-be-used-uninitialized | |-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized | `-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized |-- x86_64-randconfig-001-20241029 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-randconfig-002-20241029 | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group |-- x86_64-randconfig-014-20241029 | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group `-- x86_64-randconfig-076-20241029 `-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init elapsed time: 737m configs tested: 35 configs skipped: 127 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241029 gcc-14.1.0 arm64 randconfig-002-20241029 gcc-14.1.0 arm64 randconfig-003-20241029 gcc-14.1.0 arm64 randconfig-004-20241029 gcc-14.1.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241029 gcc-12 x86_64 buildonly-randconfig-002-20241029 gcc-12 x86_64 buildonly-randconfig-003-20241029 gcc-12 x86_64 buildonly-randconfig-004-20241029 gcc-12 x86_64 buildonly-randconfig-005-20241029 clang-19 x86_64 buildonly-randconfig-006-20241029 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241029 gcc-12 x86_64 randconfig-002-20241029 clang-19 x86_64 randconfig-003-20241029 gcc-12 x86_64 randconfig-004-20241029 clang-19 x86_64 randconfig-005-20241029 gcc-12 x86_64 randconfig-006-20241029 gcc-12 x86_64 randconfig-011-20241029 clang-19 x86_64 randconfig-012-20241029 clang-19 x86_64 randconfig-013-20241029 clang-19 x86_64 randconfig-014-20241029 clang-19 x86_64 randconfig-015-20241029 gcc-12 x86_64 randconfig-016-20241029 gcc-12 x86_64 randconfig-071-20241029 gcc-12 x86_64 randconfig-072-20241029 gcc-12 x86_64 randconfig-073-20241029 gcc-12 x86_64 randconfig-074-20241029 clang-19 x86_64 randconfig-075-20241029 gcc-12 x86_64 randconfig-076-20241029 gcc-12 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] blk_iocost: fix more out of bound shifts
by Zheng Qixing 29 Oct '24

29 Oct '24

From: Konstantin Ovsepian <ovs(a)ovs.to> stable inclusion from stable-v5.10.227 commit 1f61d509257d6a05763d05bf37943b35306522b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCW CVE: CVE-2024-49933 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9bce8005ec0dcb23a58300e8522fe4a31da606fa ] Recently running UBSAN caught few out of bound shifts in the ioc_forgive_debts() function: UBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... UBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... Call Trace: <IRQ> dump_stack_lvl+0xca/0x130 __ubsan_handle_shift_out_of_bounds+0x22c/0x280 ? __lock_acquire+0x6441/0x7c10 ioc_timer_fn+0x6cec/0x7750 ? blk_iocost_init+0x720/0x720 ? call_timer_fn+0x5d/0x470 call_timer_fn+0xfa/0x470 ? blk_iocost_init+0x720/0x720 __run_timer_base+0x519/0x700 ... Actual impact of this issue was not identified but I propose to fix the undefined behaviour. The proposed fix to prevent those out of bound shifts consist of precalculating exponent before using it the shift operations by taking min value from the actual exponent and maximum possible number of bits. Reported-by: Breno Leitao <leitao(a)debian.org> Signed-off-by: Konstantin Ovsepian <ovs(a)ovs.to> Acked-by: Tejun Heo <tj(a)kernel.org> Link: https://lore.kernel.org/r/20240822154137.2627818-1-ovs@ovs.to Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-iocost.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index 2b3bbae302e2..35e10e1c58fe 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -2047,7 +2047,7 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, struct ioc_now *now) { struct ioc_gq *iocg; - u64 dur, usage_pct, nr_cycles; + u64 dur, usage_pct, nr_cycles, nr_cycles_shift; /* if no debtor, reset the cycle */ if (!nr_debtors) { @@ -2109,10 +2109,12 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, old_debt = iocg->abs_vdebt; old_delay = iocg->delay; + nr_cycles_shift = min_t(u64, nr_cycles, BITS_PER_LONG - 1); if (iocg->abs_vdebt) - iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles ?: 1; + iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles_shift ?: 1; + if (iocg->delay) - iocg->delay = iocg->delay >> nr_cycles ?: 1; + iocg->delay = iocg->delay >> nr_cycles_shift ?: 1; iocg_kick_waitq(iocg, true, now); -- 2.39.2

2 1

[PATCH OLK-6.6] blk_iocost: fix more out of bound shifts
by Zheng Qixing 29 Oct '24

29 Oct '24

From: Konstantin Ovsepian <ovs(a)ovs.to> stable inclusion from stable-v6.6.55 commit 1ab2cfe19700fb3dde4c7dfec392acff34db3120 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCW CVE: CVE-2024-49933 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9bce8005ec0dcb23a58300e8522fe4a31da606fa ] Recently running UBSAN caught few out of bound shifts in the ioc_forgive_debts() function: UBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... UBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... Call Trace: <IRQ> dump_stack_lvl+0xca/0x130 __ubsan_handle_shift_out_of_bounds+0x22c/0x280 ? __lock_acquire+0x6441/0x7c10 ioc_timer_fn+0x6cec/0x7750 ? blk_iocost_init+0x720/0x720 ? call_timer_fn+0x5d/0x470 call_timer_fn+0xfa/0x470 ? blk_iocost_init+0x720/0x720 __run_timer_base+0x519/0x700 ... Actual impact of this issue was not identified but I propose to fix the undefined behaviour. The proposed fix to prevent those out of bound shifts consist of precalculating exponent before using it the shift operations by taking min value from the actual exponent and maximum possible number of bits. Reported-by: Breno Leitao <leitao(a)debian.org> Signed-off-by: Konstantin Ovsepian <ovs(a)ovs.to> Acked-by: Tejun Heo <tj(a)kernel.org> Link: https://lore.kernel.org/r/20240822154137.2627818-1-ovs@ovs.to Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-iocost.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index 3ac79f0c098f..3a5ba10ba2b1 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -2076,7 +2076,7 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, struct ioc_now *now) { struct ioc_gq *iocg; - u64 dur, usage_pct, nr_cycles; + u64 dur, usage_pct, nr_cycles, nr_cycles_shift; /* if no debtor, reset the cycle */ if (!nr_debtors) { @@ -2138,10 +2138,12 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, old_debt = iocg->abs_vdebt; old_delay = iocg->delay; + nr_cycles_shift = min_t(u64, nr_cycles, BITS_PER_LONG - 1); if (iocg->abs_vdebt) - iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles ?: 1; + iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles_shift ?: 1; + if (iocg->delay) - iocg->delay = iocg->delay >> nr_cycles ?: 1; + iocg->delay = iocg->delay >> nr_cycles_shift ?: 1; iocg_kick_waitq(iocg, true, now); -- 2.39.2

2 1

[openeuler:OLK-6.6] BUILD REGRESSION 27e5d43e49e85d816bd05ffe8672ceea631a07e4
by kernel test robot 29 Oct '24

29 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 27e5d43e49e85d816bd05ffe8672ceea631a07e4 !12462 drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202410290303.9DGdQJBL-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410290508.V6mqgsUO-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410290516.SciOffDt-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410290657.8iWV8CTG-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410290700.Xq3inTZy-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410290739.pk9x3tTN-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410290851.Q4YycFaU-lkp@intel.com arch/arm64/kvm/virtcca_cvm.c:954:5: warning: no previous prototype for function 'kvm_cvm_create_dev_ttt_levels' [-Wmissing-prototypes] drivers/char/ipmi/ipmi_bt_sm.c:194:11: error: call to undeclared function 'acpi_evaluate_integer'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] drivers/crypto/ccp/hygon/tdm-dev.c:340:84: error: invalid use of undefined type 'struct module' drivers/net/ethernet/mucse/rnp/rnp_main.c:7056:17: warning: unused variable 'hw' [-Wunused-variable] drivers/net/ethernet/mucse/rnp/rnp_sriov.c:396:6: warning: variable 'err' set but not used [-Wunused-but-set-variable] drivers/net/ethernet/mucse/rnp/rnp_sriov.c:411:2: warning: non-void function does not return a value [-Wreturn-type] drivers/net/ethernet/mucse/rnp/rnp_sriov.c:413:2: error: expected identifier or '(' drivers/net/ethernet/mucse/rnp/rnp_sriov.c:414:1: error: extraneous closing brace ('}') include/linux/compiler-gcc.h:132:33: warning: 'alias' attribute ignored [-Wattributes] include/linux/syscalls.h:247:28: error: invalid storage class for function '__do_sys_membarrier' include/linux/syscalls.h:249:25: error: static declaration of '__se_sys_membarrier' follows non-static declaration include/linux/syscalls.h:249:25: warning: '__se_sys_membarrier' defined but not used [-Wunused-function] include/linux/syscalls.h:251:28: error: implicit declaration of function '__do_sys_membarrier'; did you mean '__se_sys_membarrier'? [-Wimplicit-function-declaration] kernel/sched/autogroup.c:129:6: warning: 'task_wants_autogroup' defined but not used [-Wunused-function] kernel/sched/autogroup.c:147:6: warning: 'sched_autogroup_exit_task' defined but not used [-Wunused-function] kernel/sched/autogroup.c:158:1: error: invalid storage class for function 'autogroup_move_group' kernel/sched/autogroup.c:202:15: error: non-static declaration of 'sched_autogroup_create_attach' follows static declaration kernel/sched/autogroup.c:209:15: error: non-static declaration of 'sched_autogroup_detach' follows static declaration kernel/sched/autogroup.c:211:6: warning: 'sched_autogroup_fork' defined but not used [-Wunused-function] kernel/sched/autogroup.c:216:6: warning: 'sched_autogroup_exit' defined but not used [-Wunused-function] kernel/sched/autogroup.c:221:19: error: invalid storage class for function 'setup_autogroup' kernel/sched/autogroup.c:227:24: error: initializer element is not constant kernel/sched/autogroup.c:285:5: warning: 'autogroup_path' defined but not used [-Wunused-function] kernel/sched/autogroup.c:33:13: warning: 'autogroup_init' defined but not used [-Wunused-function] kernel/sched/autogroup.c:42:6: warning: 'autogroup_free' defined but not used [-Wunused-function] kernel/sched/autogroup.c:47:20: error: invalid storage class for function 'autogroup_destroy' kernel/sched/autogroup.c:60:20: error: invalid storage class for function 'autogroup_kref_put' kernel/sched/autogroup.c:65:33: error: invalid storage class for function 'autogroup_kref_get' kernel/sched/autogroup.c:71:33: error: invalid storage class for function 'autogroup_task_get' kernel/sched/autogroup.c:7:28: error: section attribute cannot be specified for local variables kernel/sched/autogroup.c:85:33: error: invalid storage class for function 'autogroup_create' kernel/sched/build_utility.c:110: error: expected declaration or statement at end of input kernel/sched/isolation.c:100:20: error: invalid storage class for function 'housekeeping_setup_type' kernel/sched/isolation.c:109:19: error: invalid storage class for function 'housekeeping_setup' kernel/sched/isolation.c:180:19: error: invalid storage class for function 'housekeeping_nohz_full_setup' kernel/sched/isolation.c:189:23: error: initializer element is not constant kernel/sched/isolation.c:191:19: error: invalid storage class for function 'housekeeping_isolcpus_setup' kernel/sched/isolation.c:244:19: error: invalid storage class for function 'enhanced_isolcpus_setup' kernel/sched/isolation.c:24:19: error: extern declaration of 'housekeeping_overridden' follows declaration with no linkage kernel/sched/isolation.c:37:19: error: non-static declaration of 'housekeeping_enabled' follows static declaration kernel/sched/isolation.c:54:19: error: non-static declaration of 'housekeeping_any_cpu' follows static declaration kernel/sched/isolation.c:63:19: error: non-static declaration of 'housekeeping_cpumask' follows static declaration kernel/sched/isolation.c:71:19: error: non-static declaration of 'housekeeping_affine' follows static declaration kernel/sched/isolation.c:80:19: error: non-static declaration of 'housekeeping_test_cpu' follows static declaration kernel/sched/isolation.c:82:13: warning: 'housekeeping_init' defined but not used [-Wunused-function] kernel/sched/membarrier.c:165:13: error: invalid storage class for function 'ipi_mb' kernel/sched/membarrier.c:170:13: error: invalid storage class for function 'ipi_sync_core' kernel/sched/membarrier.c:187:13: error: invalid storage class for function 'ipi_rseq' kernel/sched/membarrier.c:200:13: error: invalid storage class for function 'ipi_sync_rq_state' kernel/sched/membarrier.c:217:6: warning: 'membarrier_exec_mmap' defined but not used [-Wunused-function] kernel/sched/membarrier.c:233:6: warning: 'membarrier_update_current_mm' defined but not used [-Wunused-function] kernel/sched/membarrier.c:245:12: error: invalid storage class for function 'membarrier_global_expedited' kernel/sched/membarrier.c:310:12: error: invalid storage class for function 'membarrier_private_expedited' kernel/sched/membarrier.c:426:12: error: invalid storage class for function 'sync_runqueues_membarrier_state' kernel/sched/membarrier.c:483:12: error: invalid storage class for function 'membarrier_register_global_expedited' kernel/sched/membarrier.c:502:12: error: invalid storage class for function 'membarrier_register_private_expedited' kernel/sched/membarrier.c:544:12: error: invalid storage class for function 'membarrier_get_registrations' kernel/sched/psi.c:1106:13: error: invalid storage class for function 'task_is_in_psi_v1' kernel/sched/psi.c:1112:33: error: invalid storage class for function 'task_psi_group' kernel/sched/psi.c:1130:13: error: invalid storage class for function 'psi_flags_change' kernel/sched/psi.c:1168:6: warning: 'psi_task_switch' defined but not used [-Wunused-function] kernel/sched/psi.c:1262:6: warning: 'psi_account_irqtime' defined but not used [-Wunused-function] kernel/sched/psi.c:1338:19: error: non-static declaration of 'psi_memstall_enter' follows static declaration kernel/sched/psi.c:1370:19: error: non-static declaration of 'psi_memstall_leave' follows static declaration kernel/sched/psi.c:1373:5: warning: 'psi_cgroup_alloc' defined but not used [-Wunused-function] kernel/sched/psi.c:1392:6: warning: 'psi_cgroup_free' defined but not used [-Wunused-function] kernel/sched/psi.c:1416:6: warning: 'cgroup_move_task' defined but not used [-Wunused-function] kernel/sched/psi.c:1471:6: warning: 'psi_cgroup_restart' defined but not used [-Wunused-function] kernel/sched/psi.c:1506:5: warning: 'psi_show' defined but not used [-Wunused-function] kernel/sched/psi.c:1551:21: warning: 'psi_trigger_create' defined but not used [-Wunused-function] kernel/sched/psi.c:1653:6: warning: 'psi_trigger_destroy' defined but not used [-Wunused-function] kernel/sched/psi.c:1738:10: warning: 'psi_trigger_poll' defined but not used [-Wunused-function] kernel/sched/psi.c:178:13: warning: 'psi_avgs_work' used but never defined kernel/sched/psi.c:180:13: warning: 'poll_timer_fn' used but never defined kernel/sched/psi.c:384:13: error: invalid storage class for function 'test_fine_grained_stat' kernel/sched/psi.c:419:13: error: invalid storage class for function 'psi_group_stat_change' kernel/sched/psi.c:447:13: error: invalid storage class for function 'psi_stat_flags_change' kernel/sched/psi.c:469:13: error: invalid storage class for function 'get_recent_stat_times' kernel/sched/psi.c:516:20: error: invalid storage class for function 'update_throttle_type' kernel/sched/psi.c:520:13: error: invalid storage class for function 'collect_percpu_times' kernel/sched/psi.c:588:13: error: invalid storage class for function 'window_reset' kernel/sched/psi.c:607:12: error: invalid storage class for function 'window_update' kernel/sched/psi.c:633:12: error: invalid storage class for function 'update_triggers' kernel/sched/psi.c:706:12: error: invalid storage class for function 'update_averages' kernel/sched/psi.c:771:13: error: invalid storage class for function 'psi_avgs_work' kernel/sched/psi.c:807:13: error: invalid storage class for function 'init_rtpoll_triggers' kernel/sched/psi.c:820:13: error: invalid storage class for function 'psi_schedule_rtpoll_work' kernel/sched/psi.c:847:13: error: invalid storage class for function 'psi_rtpoll_work' kernel/sched/psi.c:931:12: error: invalid storage class for function 'psi_rtpoll_worker' kernel/sched/psi.c:949:13: error: invalid storage class for function 'poll_timer_fn' kernel/sched/psi.c:949:13: warning: 'poll_timer_fn' defined but not used [-Wunused-function] kernel/sched/psi.c:957:13: error: invalid storage class for function 'record_times' kernel/sched/psi.c:990:13: error: invalid storage class for function 'psi_group_change' loongson3-acpi-cpufreq.c:(.text+0x2aa0): undefined reference to `acpi_processor_register_performance' loongson3-acpi-cpufreq.c:(.text+0x714): undefined reference to `acpi_processor_unregister_performance' mm/page_alloc.c:4110:9: error: call to undeclared function 'dynamic_pool_should_alloc'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_dev_ttt_levels | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- arm64-randconfig-002-20241029 | `-- drivers-char-ipmi-ipmi_bt_sm.c:error:call-to-undeclared-function-acpi_evaluate_integer-ISO-C99-and-later-do-not-support-implicit-function-declarations |-- arm64-randconfig-003-20241029 | |-- fs-proc-etmem_scan.c:warning:suggest-braces-around-empty-body-in-an-else-statement | |-- mm-share_pool.c:error:implicit-declaration-of-function-huge_ptep_get | `-- mm-share_pool.c:error:invalid-initializer |-- arm64-randconfig-004-20241029 | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:unused-variable-hw | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:error:expected-identifier-or-( | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:error:extraneous-closing-brace-(-) | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:non-void-function-does-not-return-a-value | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:variable-err-set-but-not-used | `-- mm-page_alloc.c:error:call-to-undeclared-function-dynamic_pool_should_alloc-ISO-C99-and-later-do-not-support-implicit-function-declarations |-- loongarch-allmodconfig | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | `-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance |-- loongarch-allnoconfig | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- loongarch-randconfig-002-20241029 | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | |-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) | |-- include-linux-compiler-gcc.h:warning:alias-attribute-ignored | |-- include-linux-syscalls.h:error:implicit-declaration-of-function-__do_sys_membarrier | |-- include-linux-syscalls.h:error:invalid-storage-class-for-function-__do_sys_membarrier | |-- include-linux-syscalls.h:error:static-declaration-of-__se_sys_membarrier-follows-non-static-declaration | |-- include-linux-syscalls.h:warning:__se_sys_membarrier-defined-but-not-used | |-- kernel-sched-autogroup.c:error:initializer-element-is-not-constant | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_create | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_destroy | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_kref_get | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_kref_put | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_move_group | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_task_get | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-setup_autogroup | |-- kernel-sched-autogroup.c:error:non-static-declaration-of-sched_autogroup_create_attach-follows-static-declaration | |-- kernel-sched-autogroup.c:error:non-static-declaration-of-sched_autogroup_detach-follows-static-declaration | |-- kernel-sched-autogroup.c:error:section-attribute-cannot-be-specified-for-local-variables | |-- kernel-sched-autogroup.c:warning:autogroup_free-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:autogroup_init-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:autogroup_path-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:sched_autogroup_exit-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:sched_autogroup_exit_task-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:sched_autogroup_fork-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:task_wants_autogroup-defined-but-not-used | |-- kernel-sched-build_utility.c:error:expected-declaration-or-statement-at-end-of-input | |-- kernel-sched-isolation.c:error:extern-declaration-of-housekeeping_overridden-follows-declaration-with-no-linkage | |-- kernel-sched-isolation.c:error:initializer-element-is-not-constant | |-- kernel-sched-isolation.c:error:invalid-storage-class-for-function-enhanced_isolcpus_setup | |-- kernel-sched-isolation.c:error:invalid-storage-class-for-function-housekeeping_isolcpus_setup | |-- kernel-sched-isolation.c:error:invalid-storage-class-for-function-housekeeping_nohz_full_setup | |-- kernel-sched-isolation.c:error:invalid-storage-class-for-function-housekeeping_setup | |-- kernel-sched-isolation.c:error:invalid-storage-class-for-function-housekeeping_setup_type | |-- kernel-sched-isolation.c:error:non-static-declaration-of-housekeeping_affine-follows-static-declaration | |-- kernel-sched-isolation.c:error:non-static-declaration-of-housekeeping_any_cpu-follows-static-declaration | |-- kernel-sched-isolation.c:error:non-static-declaration-of-housekeeping_cpumask-follows-static-declaration | |-- kernel-sched-isolation.c:error:non-static-declaration-of-housekeeping_enabled-follows-static-declaration | |-- kernel-sched-isolation.c:error:non-static-declaration-of-housekeeping_test_cpu-follows-static-declaration | |-- kernel-sched-isolation.c:warning:housekeeping_init-defined-but-not-used | |-- kernel-sched-membarrier.c:error:invalid-storage-class-for-function-ipi_mb | |-- kernel-sched-membarrier.c:error:invalid-storage-class-for-function-ipi_rseq | |-- kernel-sched-membarrier.c:error:invalid-storage-class-for-function-ipi_sync_core | |-- kernel-sched-membarrier.c:error:invalid-storage-class-for-function-ipi_sync_rq_state | |-- kernel-sched-membarrier.c:error:invalid-storage-class-for-function-membarrier_get_registrations | |-- kernel-sched-membarrier.c:error:invalid-storage-class-for-function-membarrier_global_expedited | |-- kernel-sched-membarrier.c:error:invalid-storage-class-for-function-membarrier_private_expedited | |-- kernel-sched-membarrier.c:error:invalid-storage-class-for-function-membarrier_register_global_expedited | |-- kernel-sched-membarrier.c:error:invalid-storage-class-for-function-membarrier_register_private_expedited | |-- kernel-sched-membarrier.c:error:invalid-storage-class-for-function-sync_runqueues_membarrier_state | |-- kernel-sched-membarrier.c:warning:membarrier_exec_mmap-defined-but-not-used | |-- kernel-sched-membarrier.c:warning:membarrier_update_current_mm-defined-but-not-used | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-collect_percpu_times | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-get_recent_stat_times | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-init_rtpoll_triggers | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-poll_timer_fn | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_avgs_work | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_flags_change | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_group_change | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_group_stat_change | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_rtpoll_work | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_rtpoll_worker | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_schedule_rtpoll_work | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_stat_flags_change | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-record_times | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-task_is_in_psi_v1 | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-task_psi_group | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-test_fine_grained_stat | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-update_averages | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-update_throttle_type | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-update_triggers | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-window_reset | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-window_update | |-- kernel-sched-psi.c:error:non-static-declaration-of-psi_memstall_enter-follows-static-declaration | |-- kernel-sched-psi.c:error:non-static-declaration-of-psi_memstall_leave-follows-static-declaration | |-- kernel-sched-psi.c:warning:cgroup_move_task-defined-but-not-used | |-- kernel-sched-psi.c:warning:poll_timer_fn-defined-but-not-used | |-- kernel-sched-psi.c:warning:poll_timer_fn-used-but-never-defined | |-- kernel-sched-psi.c:warning:psi_account_irqtime-defined-but-not-used | |-- kernel-sched-psi.c:warning:psi_avgs_work-used-but-never-defined | |-- kernel-sched-psi.c:warning:psi_cgroup_alloc-defined-but-not-used | |-- kernel-sched-psi.c:warning:psi_cgroup_free-defined-but-not-used | |-- kernel-sched-psi.c:warning:psi_cgroup_restart-defined-but-not-used | |-- kernel-sched-psi.c:warning:psi_show-defined-but-not-used | |-- kernel-sched-psi.c:warning:psi_task_switch-defined-but-not-used | |-- kernel-sched-psi.c:warning:psi_trigger_create-defined-but-not-used | |-- kernel-sched-psi.c:warning:psi_trigger_destroy-defined-but-not-used | `-- kernel-sched-psi.c:warning:psi_trigger_poll-defined-but-not-used |-- x86_64-allnoconfig | |-- Warning:drivers-net-ethernet-nebula-matrix-Kconfig-references-a-file-that-doesn-t-exist:file:Documentation-networking-device_drivers-ethernet-nebula-matrix-m18110.rst | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_include-nbl_include.h:linux-pci.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-calcs-dcn_calc_auto.c:warning:stack-frame-size-()-exceeds-limit-()-in-mode_support_and_system_configuration | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- x86_64-buildonly-randconfig-001-20241029 | |-- drivers-crypto-ccp-hygon-hct.c:error:struct-device-has-no-member-named-numa_node | `-- drivers-crypto-ccp-hygon-tdm-dev.c:error:invalid-use-of-undefined-type-struct-module |-- x86_64-buildonly-randconfig-002-20241029 | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | `-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain |-- x86_64-buildonly-randconfig-005-20241029 | `-- ld.lld:error:undefined-symbol:iova_reserve_domain_addr |-- x86_64-kexec | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | `-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain |-- x86_64-randconfig-001-20241029 | `-- arch-x86-kernel-zhaoxin_kh40000.c:error:implicit-declaration-of-function-iommu_get_dma_domain |-- x86_64-randconfig-002-20241029 | `-- arch-x86-kernel-zhaoxin_kh40000.c:error:call-to-undeclared-function-iommu_get_dma_domain-ISO-C99-and-later-do-not-support-implicit-function-declarations |-- x86_64-randconfig-003-20241029 | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory |-- x86_64-randconfig-004-20241029 | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- x86_64-randconfig-005-20241029 | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:implicit-declaration-of-function-iommu_get_dma_domain | `-- kernel-dma-contiguous.c:error:is_zhaoxin_kh40000-undeclared-(first-use-in-this-function) |-- x86_64-randconfig-006-20241029 | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory |-- x86_64-randconfig-011-20241029 | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- x86_64-randconfig-012-20241029 | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- x86_64-randconfig-013-20241029 | `-- ld.lld:error:undefined-symbol:iova_reserve_domain_addr |-- x86_64-randconfig-014-20241029 | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- x86_64-randconfig-015-20241029 | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:implicit-declaration-of-function-iommu_get_dma_domain | `-- kernel-dma-contiguous.c:error:is_zhaoxin_kh40000-undeclared-(first-use-in-this-function) |-- x86_64-randconfig-071-20241029 | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory |-- x86_64-randconfig-072-20241029 | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-svm-sev.c:error:lvalue-required-as-unary-operand | |-- arch-x86-kvm-svm-sev.c:error:struct-hygon_kvm_hooks_table-has-no-member-named-false | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | |-- fs-proc-etmem_scan.c:warning:suggest-braces-around-empty-body-in-an-else-statement | `-- mm-memcontrol.c:warning:no-previous-prototype-for-memcg_swapmax_read |-- x86_64-randconfig-073-20241029 | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-crypto-ccp-hygon-hct.c:error:struct-device-has-no-member-named-numa_node | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory |-- x86_64-randconfig-075-20241029 | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:implicit-declaration-of-function-iommu_get_dma_domain | `-- kernel-dma-contiguous.c:error:is_zhaoxin_kh40000-undeclared-(first-use-in-this-function) |-- x86_64-randconfig-076-20241029 | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory |-- x86_64-randconfig-161-20241029 | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory |-- x86_64-rhel-8.3 | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory |-- x86_64-rhel-8.3-func | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory `-- x86_64-rhel-8.3-kselftests |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory elapsed time: 735m configs tested: 39 configs skipped: 124 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241029 clang-17 arm64 randconfig-002-20241029 clang-20 arm64 randconfig-003-20241029 gcc-14.1.0 arm64 randconfig-004-20241029 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20241029 gcc-14.1.0 loongarch randconfig-002-20241029 gcc-14.1.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241029 gcc-12 x86_64 buildonly-randconfig-002-20241029 gcc-12 x86_64 buildonly-randconfig-003-20241029 gcc-12 x86_64 buildonly-randconfig-004-20241029 gcc-12 x86_64 buildonly-randconfig-005-20241029 clang-19 x86_64 buildonly-randconfig-006-20241029 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241029 gcc-12 x86_64 randconfig-002-20241029 clang-19 x86_64 randconfig-003-20241029 gcc-12 x86_64 randconfig-004-20241029 clang-19 x86_64 randconfig-005-20241029 gcc-12 x86_64 randconfig-006-20241029 gcc-12 x86_64 randconfig-011-20241029 clang-19 x86_64 randconfig-012-20241029 clang-19 x86_64 randconfig-013-20241029 clang-19 x86_64 randconfig-014-20241029 clang-19 x86_64 randconfig-015-20241029 gcc-12 x86_64 randconfig-016-20241029 gcc-12 x86_64 randconfig-071-20241029 gcc-12 x86_64 randconfig-072-20241029 gcc-12 x86_64 randconfig-073-20241029 gcc-12 x86_64 randconfig-074-20241029 clang-19 x86_64 randconfig-075-20241029 gcc-12 x86_64 randconfig-076-20241029 gcc-12 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 15620/30000] drivers/ptp/ptp_hisi.c:731:36: warning: 'hisi_ptp_acpi_match' defined but not used
by kernel test robot 29 Oct '24

29 Oct '24

Hi Yonglong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8dcdd5a432518f8f8deb6ab608551ecda71bda40 commit: c64545e1e5fa4e09603149e918f306562a22a60a [15620/30000] net: hns3: add support for Hisilicon ptp sync device config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290853.IWsztKim-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290853.IWsztKim-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410290853.IWsztKim-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ptp/ptp_hisi.c:731:36: warning: 'hisi_ptp_acpi_match' defined but not used [-Wunused-const-variable=] 731 | static const struct acpi_device_id hisi_ptp_acpi_match[] = { | ^~~~~~~~~~~~~~~~~~~ vim +/hisi_ptp_acpi_match +731 drivers/ptp/ptp_hisi.c 730 > 731 static const struct acpi_device_id hisi_ptp_acpi_match[] = { 732 { "HISI0411", 0 }, 733 { } 734 }; 735 MODULE_DEVICE_TABLE(acpi, hisi_ptp_acpi_match); 736 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] swap: stop add to avail list if swap is full
by Wupeng Ma 29 Oct '24

29 Oct '24

From: Ma Wupeng <mawupeng1(a)huawei.com> mainline inclusion from mainline-v6.6-rc1 commit c70699e555537b611f4cb426c26f8ab4a264a8a0 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB0CMQ CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Our test finds a WARN_ON in add_to_avail_list. During add_to_avail_list, avail_lists is already in swap_avail_heads, while leads to this WARN_ON. Here is the simplified calltrace: ------------[ cut here ]------------ Call trace: add_to_avail_list+0xb8/0xc0 swap_range_free+0x110/0x138 swapcache_free_entries+0x100/0x1c0 free_swap_slot+0xbc/0xe0 put_swap_folio+0x1f0/0x2ec delete_from_swap_cache+0x6c/0xd0 folio_free_swap+0xa4/0xe4 __try_to_reclaim_swap+0x9c/0x190 free_swap_and_cache+0x84/0x88 unmap_page_range+0x31c/0x934 unmap_single_vma.isra.0+0x48/0x84 unmap_vmas+0x98/0x10c exit_mmap+0xa4/0x210 mmput+0x88/0x158 do_exit+0x284/0x970 do_group_exit+0x34/0x90 post_copy_siginfo_from_user32+0x0/0x1cc do_notify_resume+0x15c/0x470 el0_svc+0x74/0x84 el0t_64_sync_handler+0xb8/0xbc el0t_64_sync+0x190/0x194 During swapoff, try_to_unuse fails to alloc memory due to memory limit and this leads to the failure of swapoff and causes re-insertion of swap space back into swap_list. During _enable_swap_info, this swap device is added to avail list even this swap device if full. At the same time, one entry in this full swap device in released and we try to add this device into avail list and find it is already in the avail list. This causes this WARN_ON. To fix this. Don't add to avail list is swap is full. [akpm(a)linux-foundation.org: coding-style cleanups] Link: https://lkml.kernel.org/r/20230627120833.2230766-3-mawupeng1@huawei.com Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Cc: Hugh Dickins <hughd(a)google.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- mm/swapfile.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/mm/swapfile.c b/mm/swapfile.c index b505a827e589..cff30234879d 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -2579,7 +2579,10 @@ static void _enable_swap_info(struct swap_info_struct *p) * swap_info_struct. */ plist_add(&p->list, &swap_active_head); - add_to_avail_list(p); + + /* add to available list iff swap device is not full */ + if (p->highest_bit) + add_to_avail_list(p); } static void enable_swap_info(struct swap_info_struct *p, int prio, -- 2.25.1

2 1

[openeuler:OLK-6.6 14667/15358] arch/arm64/kvm/virtcca_cvm.c:954:5: warning: no previous prototype for function 'kvm_cvm_create_dev_ttt_levels'
by kernel test robot 29 Oct '24

29 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 27e5d43e49e85d816bd05ffe8672ceea631a07e4 commit: 6ae1290a135c545470e99e6b117d9be75836d0ac [14667/15358] virtcca feature: vfio driver dma map config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20241029/202410290851.Q4YycFaU-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 5886454669c3c9026f7f27eab13509dd0241f2d6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290851.Q4YycFaU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410290851.Q4YycFaU-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/arm64/kvm/virtcca_cvm.c:5: In file included from include/linux/kvm_host.h:16: In file included from include/linux/mm.h:2243: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/virtcca_cvm.c:954:5: warning: no previous prototype for function 'kvm_cvm_create_dev_ttt_levels' [-Wmissing-prototypes] 954 | int kvm_cvm_create_dev_ttt_levels(struct kvm *kvm, struct virtcca_cvm *cvm, | ^ arch/arm64/kvm/virtcca_cvm.c:954:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 954 | int kvm_cvm_create_dev_ttt_levels(struct kvm *kvm, struct virtcca_cvm *cvm, | ^ | static 6 warnings generated. vim +/kvm_cvm_create_dev_ttt_levels +954 arch/arm64/kvm/virtcca_cvm.c 952 953 /* CVM create ttt level information about device */ > 954 int kvm_cvm_create_dev_ttt_levels(struct kvm *kvm, struct virtcca_cvm *cvm, 955 unsigned long ipa, 956 int level, 957 int max_level, 958 struct kvm_mmu_memory_cache *mc) 959 { 960 int ret = 0; 961 962 if (WARN_ON(level == max_level)) 963 return 0; 964 965 while (level++ < max_level) { 966 u64 numa_set = kvm_get_first_binded_numa_set(kvm); 967 968 ret = kvm_cvm_dev_ttt_create(cvm, ipa, level, numa_set); 969 if (ret) 970 return -ENXIO; 971 } 972 973 return 0; 974 } 975 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 15345/30000] mm/memcontrol.c:5402:40: error: implicit declaration of function 'ksm_process_profit'
by kernel test robot 29 Oct '24

29 Oct '24

Hi Nanyong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8dcdd5a432518f8f8deb6ab608551ecda71bda40 commit: 0f6fb3570be40b783d8c756d64297be1a8e3d2b3 [15345/30000] memcg: support ksm merge any mode per cgroup config: x86_64-buildonly-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290835.BHKldai7-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290835.BHKldai7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410290835.BHKldai7-lkp@intel.com/ All errors (new ones prefixed by >>): mm/memcontrol.c: In function 'memory_ksm_show': >> mm/memcontrol.c:5402:40: error: implicit declaration of function 'ksm_process_profit' [-Werror=implicit-function-declaration] 5402 | ksm_process_profits += ksm_process_profit(mm); | ^~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/ksm_process_profit +5402 mm/memcontrol.c 5379 5380 static int memory_ksm_show(struct seq_file *m, void *v) 5381 { 5382 unsigned long ksm_merging_pages = 0; 5383 unsigned long ksm_rmap_items = 0; 5384 long ksm_process_profits = 0; 5385 unsigned int tasks = 0; 5386 struct task_struct *task; 5387 struct mm_struct *mm; 5388 struct css_task_iter it; 5389 struct mem_cgroup *memcg = mem_cgroup_from_seq(m); 5390 5391 css_task_iter_start(&memcg->css, CSS_TASK_ITER_PROCS, &it); 5392 while ((task = css_task_iter_next(&it))) { 5393 mm = get_task_mm(task); 5394 if (!mm) 5395 continue; 5396 5397 if (test_bit(MMF_VM_MERGE_ANY, &mm->flags)) 5398 tasks++; 5399 5400 ksm_rmap_items += mm->ksm_rmap_items; 5401 ksm_merging_pages += mm->ksm_merging_pages; > 5402 ksm_process_profits += ksm_process_profit(mm); 5403 mmput(mm); 5404 } 5405 css_task_iter_end(&it); 5406 5407 seq_printf(m, "merge any state: %d\n", READ_ONCE(memcg->ksm_merge_any)); 5408 seq_printf(m, "merge any tasks: %u\n", tasks); 5409 seq_printf(m, "ksm_rmap_items %lu\n", ksm_rmap_items); 5410 seq_printf(m, "ksm_merging_pages %lu\n", ksm_merging_pages); 5411 seq_printf(m, "ksm_process_profits %ld\n", ksm_process_profits); 5412 return 0; 5413 } 5414 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2850/15358] kernel/sched/isolation.c:244:19: error: invalid storage class for function 'enhanced_isolcpus_setup'
by kernel test robot 29 Oct '24

29 Oct '24

Hi Xiongfeng, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 27e5d43e49e85d816bd05ffe8672ceea631a07e4 commit: 5f20541757730418065c3ae77dfdbcde3f523394 [2850/15358] blk-mq: avoid housekeeping CPUs scheduling a worker on a non-housekeeping CPU config: loongarch-randconfig-002-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290700.Xq3inTZy-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290700.Xq3inTZy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410290700.Xq3inTZy-lkp@intel.com/ All errors (new ones prefixed by >>): 54 | EXPORT_SYMBOL_GPL(housekeeping_any_cpu); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:39:5: note: previous definition of 'housekeeping_any_cpu' with type 'int(enum hk_type)' 39 | int housekeeping_any_cpu(enum hk_type type) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:63:19: error: non-static declaration of 'housekeeping_cpumask' follows static declaration 63 | EXPORT_SYMBOL_GPL(housekeeping_cpumask); | ^~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:63:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 63 | EXPORT_SYMBOL_GPL(housekeeping_cpumask); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:56:23: note: previous definition of 'housekeeping_cpumask' with type 'const struct cpumask *(enum hk_type)' 56 | const struct cpumask *housekeeping_cpumask(enum hk_type type) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:71:19: error: non-static declaration of 'housekeeping_affine' follows static declaration 71 | EXPORT_SYMBOL_GPL(housekeeping_affine); | ^~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:71:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 71 | EXPORT_SYMBOL_GPL(housekeeping_affine); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:65:6: note: previous definition of 'housekeeping_affine' with type 'void(struct task_struct *, enum hk_type)' 65 | void housekeeping_affine(struct task_struct *t, enum hk_type type) | ^~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:80:19: error: non-static declaration of 'housekeeping_test_cpu' follows static declaration 80 | EXPORT_SYMBOL_GPL(housekeeping_test_cpu); | ^~~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:80:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 80 | EXPORT_SYMBOL_GPL(housekeeping_test_cpu); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:73:6: note: previous definition of 'housekeeping_test_cpu' with type 'bool(int, enum hk_type)' {aka '_Bool(int, enum hk_type)'} 73 | bool housekeeping_test_cpu(int cpu, enum hk_type type) | ^~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:100:20: error: invalid storage class for function 'housekeeping_setup_type' 100 | static void __init housekeeping_setup_type(enum hk_type type, | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:109:19: error: invalid storage class for function 'housekeeping_setup' 109 | static int __init housekeeping_setup(char *str, unsigned long flags) | ^~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:180:19: error: invalid storage class for function 'housekeeping_nohz_full_setup' 180 | static int __init housekeeping_nohz_full_setup(char *str) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/printk.h:6, from include/linux/kernel.h:30: kernel/sched/isolation.c:189:23: error: initializer element is not constant 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:189:1: note: in expansion of macro '__setup' 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~ kernel/sched/isolation.c:189:23: note: (near initialization for '__setup_housekeeping_nohz_full_setup.setup_func') 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:189:1: note: in expansion of macro '__setup' 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~ kernel/sched/isolation.c:191:19: error: invalid storage class for function 'housekeeping_isolcpus_setup' 191 | static int __init housekeeping_isolcpus_setup(char *str) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:241:22: error: initializer element is not constant 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:241:1: note: in expansion of macro '__setup' 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~ kernel/sched/isolation.c:241:22: note: (near initialization for '__setup_housekeeping_isolcpus_setup.setup_func') 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:241:1: note: in expansion of macro '__setup' 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~ >> kernel/sched/isolation.c:244:19: error: invalid storage class for function 'enhanced_isolcpus_setup' 244 | static int __init enhanced_isolcpus_setup(char *str) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:249:30: error: initializer element is not constant 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:249:1: note: in expansion of macro '__setup' 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~ kernel/sched/isolation.c:249:30: note: (near initialization for '__setup_enhanced_isolcpus_setup.setup_func') 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:249:1: note: in expansion of macro '__setup' 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~ In file included from kernel/sched/build_utility.c:109: kernel/sched/autogroup.c:7:28: error: section attribute cannot be specified for local variables 7 | unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:47:20: error: invalid storage class for function 'autogroup_destroy' 47 | static inline void autogroup_destroy(struct kref *kref) | ^~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:60:20: error: invalid storage class for function 'autogroup_kref_put' 60 | static inline void autogroup_kref_put(struct autogroup *ag) | ^~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:65:33: error: invalid storage class for function 'autogroup_kref_get' 65 | static inline struct autogroup *autogroup_kref_get(struct autogroup *ag) | ^~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:71:33: error: invalid storage class for function 'autogroup_task_get' 71 | static inline struct autogroup *autogroup_task_get(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:85:33: error: invalid storage class for function 'autogroup_create' 85 | static inline struct autogroup *autogroup_create(void) | ^~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:158:1: error: invalid storage class for function 'autogroup_move_group' 158 | autogroup_move_group(struct task_struct *p, struct autogroup *ag) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:202:15: error: non-static declaration of 'sched_autogroup_create_attach' follows static declaration 202 | EXPORT_SYMBOL(sched_autogroup_create_attach); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:86:41: note: in expansion of macro '_EXPORT_SYMBOL' 86 | #define EXPORT_SYMBOL(sym) _EXPORT_SYMBOL(sym, "") | ^~~~~~~~~~~~~~ kernel/sched/autogroup.c:202:1: note: in expansion of macro 'EXPORT_SYMBOL' 202 | EXPORT_SYMBOL(sched_autogroup_create_attach); | ^~~~~~~~~~~~~ kernel/sched/autogroup.c:193:6: note: previous definition of 'sched_autogroup_create_attach' with type 'void(struct task_struct *)' 193 | void sched_autogroup_create_attach(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:209:15: error: non-static declaration of 'sched_autogroup_detach' follows static declaration 209 | EXPORT_SYMBOL(sched_autogroup_detach); | ^~~~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:86:41: note: in expansion of macro '_EXPORT_SYMBOL' 86 | #define EXPORT_SYMBOL(sym) _EXPORT_SYMBOL(sym, "") | ^~~~~~~~~~~~~~ kernel/sched/autogroup.c:209:1: note: in expansion of macro 'EXPORT_SYMBOL' 209 | EXPORT_SYMBOL(sched_autogroup_detach); | ^~~~~~~~~~~~~ kernel/sched/autogroup.c:205:6: note: previous definition of 'sched_autogroup_detach' with type 'void(struct task_struct *)' 205 | void sched_autogroup_detach(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:221:19: error: invalid storage class for function 'setup_autogroup' 221 | static int __init setup_autogroup(char *str) | ^~~~~~~~~~~~~~~ kernel/sched/autogroup.c:227:24: error: initializer element is not constant 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/autogroup.c:227:1: note: in expansion of macro '__setup' 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~ kernel/sched/autogroup.c:227:24: note: (near initialization for '__setup_setup_autogroup.setup_func') 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/autogroup.c:227:1: note: in expansion of macro '__setup' 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~ kernel/sched/build_utility.c:110: error: expected declaration or statement at end of input 110 | #endif kernel/sched/psi.c: At top level: kernel/sched/psi.c:178:13: warning: 'psi_avgs_work' used but never defined 178 | static void psi_avgs_work(struct work_struct *work); | ^~~~~~~~~~~~~ kernel/sched/psi.c:180:13: warning: 'poll_timer_fn' used but never defined vim +/enhanced_isolcpus_setup +244 kernel/sched/isolation.c 242 243 bool enhanced_isolcpus; > 244 static int __init enhanced_isolcpus_setup(char *str) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7193/15358] mm/page_alloc.c:4110:9: error: call to undeclared function 'dynamic_pool_should_alloc'; ISO C99 and later do not support implicit function declarations
by kernel test robot 29 Oct '24

29 Oct '24

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 27e5d43e49e85d816bd05ffe8672ceea631a07e4 commit: fd855715f24e3eeadaa56de5fde21c55a14aeea0 [7193/15358] mm/mem_reliable: Fallback to dpool if reliable memory is not enough config: arm64-randconfig-004-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290739.pk9x3tTN-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 5886454669c3c9026f7f27eab13509dd0241f2d6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290739.pk9x3tTN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410290739.pk9x3tTN-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from mm/page_alloc.c:19: In file included from include/linux/mm.h:2204: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/page_alloc.c:43: include/linux/mm_inline.h:47:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 47 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:49:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 49 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/page_alloc.c:2769:2: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 2769 | __count_zid_vm_events(PGALLOC, page_zonenum(page), 1 << order); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/page_alloc.c:2886:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 2886 | __count_zid_vm_events(PGALLOC, page_zonenum(page), 1 << order); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ >> mm/page_alloc.c:4110:9: error: call to undeclared function 'dynamic_pool_should_alloc'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 4110 | return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); | ^ mm/page_alloc.c:4596:2: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 4596 | __count_zid_vm_events(PGALLOC, zone_idx(zone), nr_account); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ 10 warnings and 1 error generated. vim +/dynamic_pool_should_alloc +4110 mm/page_alloc.c 4101 4102 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4103 { 4104 if (!reliable_allow_fb_enabled()) 4105 return false; 4106 4107 if (!(gfp_mask & GFP_RELIABLE)) 4108 return false; 4109 > 4110 return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); 4111 } 4112 #else 4113 static inline struct zone *mem_reliable_fallback_zone(gfp_t gfp_mask, 4114 struct alloc_context *ac) 4115 { 4116 return NULL; 4117 } 4118 static inline void mem_reliable_fallback_slowpath(gfp_t gfp_mask, 4119 struct alloc_context *ac) {} 4120 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4121 { 4122 return false; 4123 } 4124 #endif 4125 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 6858/15358] drivers/char/ipmi/ipmi_bt_sm.c:194:11: error: call to undeclared function 'acpi_evaluate_integer'; ISO C99 and later do not support implicit function declarations
by kernel test robot 29 Oct '24

29 Oct '24

Hi Devyn, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 27e5d43e49e85d816bd05ffe8672ceea631a07e4 commit: 6449ff7a5a2b148bc0a60efb3f0d723aaeceaae6 [6858/15358] ipmi: Errata workaround to prevent SMS message processing timeout config: arm64-randconfig-002-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290657.8iWV8CTG-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 5886454669c3c9026f7f27eab13509dd0241f2d6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290657.8iWV8CTG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410290657.8iWV8CTG-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/char/ipmi/ipmi_bt_sm.c:194:11: error: call to undeclared function 'acpi_evaluate_integer'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 194 | status = acpi_evaluate_integer(handle, "SATN", NULL, &tmp); | ^ drivers/char/ipmi/ipmi_bt_sm.c:194:11: note: did you mean 'acpi_evaluate_object'? include/acpi/acpixf.h:550:8: note: 'acpi_evaluate_object' declared here 550 | acpi_evaluate_object(acpi_handle object, | ^ include/acpi/platform/aclinux.h:93:21: note: expanded from macro 'ACPI_EXTERNAL_RETURN_STATUS' 93 | static ACPI_INLINE prototype {return(AE_NOT_CONFIGURED);} | ^ 1 error generated. vim +/acpi_evaluate_integer +194 drivers/char/ipmi/ipmi_bt_sm.c 177 178 #ifdef CONFIG_HISILICON_ERRATUM_162102203 179 /* 180 * To confirm whether the SMS_ATN flag needs to be stored and get 181 * quirk through the method reported by the BIOS. Because in special 182 * cases SMS_ATN flag bits may be lost before being processed. 183 */ 184 static bool get_sms_atn_quirk(struct si_sm_io *io) 185 { 186 acpi_handle handle; 187 acpi_status status; 188 unsigned long long tmp; 189 190 handle = ACPI_HANDLE(io->dev); 191 if (!handle) 192 return false; 193 > 194 status = acpi_evaluate_integer(handle, "SATN", NULL, &tmp); 195 if (ACPI_FAILURE(status)) 196 return false; 197 else if (tmp != 1) 198 return false; 199 200 return true; 201 } 202 #endif 203 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2387/15358] kernel/sched/psi.c:384:13: error: invalid storage class for function 'test_fine_grained_stat'
by kernel test robot 29 Oct '24

29 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 27e5d43e49e85d816bd05ffe8672ceea631a07e4 commit: 654944510822988390470cbc5b6f914c19dd9b88 [2387/15358] sched/psi: add cpu fine grained stall tracking in pressure.stat config: loongarch-randconfig-002-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290508.V6mqgsUO-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290508.V6mqgsUO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410290508.V6mqgsUO-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from include/linux/irq.h:23, from kernel/sched/build_utility.c:29: include/linux/nmi.h: In function 'trigger_all_cpu_backtrace': arch/loongarch/include/asm/irq.h:42:40: error: void value not ignored as it ought to be 42 | #define arch_trigger_cpumask_backtrace arch_trigger_cpumask_backtrace include/linux/nmi.h:160:16: note: in expansion of macro 'arch_trigger_cpumask_backtrace' 160 | return arch_trigger_cpumask_backtrace(cpu_online_mask, -1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/nmi.h: In function 'trigger_allbutcpu_cpu_backtrace': arch/loongarch/include/asm/irq.h:42:40: error: void value not ignored as it ought to be 42 | #define arch_trigger_cpumask_backtrace arch_trigger_cpumask_backtrace include/linux/nmi.h:165:16: note: in expansion of macro 'arch_trigger_cpumask_backtrace' 165 | return arch_trigger_cpumask_backtrace(cpu_online_mask, exclude_cpu); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/nmi.h: In function 'trigger_cpumask_backtrace': arch/loongarch/include/asm/irq.h:42:40: error: void value not ignored as it ought to be 42 | #define arch_trigger_cpumask_backtrace arch_trigger_cpumask_backtrace include/linux/nmi.h:170:16: note: in expansion of macro 'arch_trigger_cpumask_backtrace' 170 | return arch_trigger_cpumask_backtrace(mask, -1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/nmi.h: In function 'trigger_single_cpu_backtrace': arch/loongarch/include/asm/irq.h:42:40: error: void value not ignored as it ought to be 42 | #define arch_trigger_cpumask_backtrace arch_trigger_cpumask_backtrace include/linux/nmi.h:175:16: note: in expansion of macro 'arch_trigger_cpumask_backtrace' 175 | return arch_trigger_cpumask_backtrace(cpumask_of(cpu), -1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sched/build_utility.c:97: kernel/sched/psi.c: In function 'record_stat_times': >> kernel/sched/psi.c:384:13: error: invalid storage class for function 'test_fine_grained_stat' 384 | static bool test_fine_grained_stat(unsigned int *stat_tasks, | ^~~~~~~~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:419:13: error: invalid storage class for function 'psi_group_stat_change' 419 | static void psi_group_stat_change(struct psi_group *group, int cpu, | ^~~~~~~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:447:13: error: invalid storage class for function 'psi_stat_flags_change' 447 | static void psi_stat_flags_change(struct task_struct *task, int *stat_set, | ^~~~~~~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:469:13: error: invalid storage class for function 'get_recent_stat_times' 469 | static void get_recent_stat_times(struct psi_group *group, int cpu, | ^~~~~~~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:516:20: error: invalid storage class for function 'update_throttle_type' 516 | static inline void update_throttle_type(struct task_struct *task, int cpu, | ^~~~~~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:520:13: error: invalid storage class for function 'collect_percpu_times' 520 | static void collect_percpu_times(struct psi_group *group, | ^~~~~~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:588:13: error: invalid storage class for function 'window_reset' 588 | static void window_reset(struct psi_window *win, u64 now, u64 value, | ^~~~~~~~~~~~ >> kernel/sched/psi.c:607:12: error: invalid storage class for function 'window_update' 607 | static u64 window_update(struct psi_window *win, u64 now, u64 value) | ^~~~~~~~~~~~~ >> kernel/sched/psi.c:633:12: error: invalid storage class for function 'update_triggers' 633 | static u64 update_triggers(struct psi_group *group, u64 now, bool *update_total, | ^~~~~~~~~~~~~~~ >> kernel/sched/psi.c:706:12: error: invalid storage class for function 'update_averages' 706 | static u64 update_averages(struct psi_group *group, u64 now) | ^~~~~~~~~~~~~~~ >> kernel/sched/psi.c:771:13: error: invalid storage class for function 'psi_avgs_work' 771 | static void psi_avgs_work(struct work_struct *work) | ^~~~~~~~~~~~~ >> kernel/sched/psi.c:807:13: error: invalid storage class for function 'init_rtpoll_triggers' 807 | static void init_rtpoll_triggers(struct psi_group *group, u64 now) | ^~~~~~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:820:13: error: invalid storage class for function 'psi_schedule_rtpoll_work' 820 | static void psi_schedule_rtpoll_work(struct psi_group *group, unsigned long delay, | ^~~~~~~~~~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:847:13: error: invalid storage class for function 'psi_rtpoll_work' 847 | static void psi_rtpoll_work(struct psi_group *group) | ^~~~~~~~~~~~~~~ >> kernel/sched/psi.c:931:12: error: invalid storage class for function 'psi_rtpoll_worker' 931 | static int psi_rtpoll_worker(void *data) | ^~~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:949:13: error: invalid storage class for function 'poll_timer_fn' 949 | static void poll_timer_fn(struct timer_list *t) | ^~~~~~~~~~~~~ >> kernel/sched/psi.c:957:13: error: invalid storage class for function 'record_times' 957 | static void record_times(struct psi_group_cpu *groupc, u64 now) | ^~~~~~~~~~~~ >> kernel/sched/psi.c:990:13: error: invalid storage class for function 'psi_group_change' 990 | static void psi_group_change(struct psi_group *group, int cpu, | ^~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:1106:13: error: invalid storage class for function 'task_is_in_psi_v1' 1106 | static bool task_is_in_psi_v1(void) | ^~~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:1112:33: error: invalid storage class for function 'task_psi_group' 1112 | static inline struct psi_group *task_psi_group(struct task_struct *task) | ^~~~~~~~~~~~~~ kernel/sched/psi.c: In function 'task_psi_group': kernel/sched/psi.c:1120:52: error: 'cpuacct_cgrp_id' undeclared (first use in this function); did you mean 'cpuset_cgrp_id'? 1120 | cgroup = task_cgroup(task, cpuacct_cgrp_id); | ^~~~~~~~~~~~~~~ | cpuset_cgrp_id kernel/sched/psi.c:1120:52: note: each undeclared identifier is reported only once for each function it appears in kernel/sched/psi.c: In function 'record_stat_times': kernel/sched/psi.c:1130:13: error: invalid storage class for function 'psi_flags_change' 1130 | static void psi_flags_change(struct task_struct *task, int clear, int set) | ^~~~~~~~~~~~~~~~ In file included from include/linux/linkage.h:7, from include/linux/kernel.h:17, from include/linux/cpumask.h:10, from include/linux/smp.h:13, from include/linux/sched/clock.h:5, from kernel/sched/build_utility.c:12: kernel/sched/psi.c:1338:19: error: non-static declaration of 'psi_memstall_enter' follows static declaration 1338 | EXPORT_SYMBOL_GPL(psi_memstall_enter); | ^~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/psi.c:1338:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 1338 | EXPORT_SYMBOL_GPL(psi_memstall_enter); | ^~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1306:6: note: previous definition of 'psi_memstall_enter' with type 'void(long unsigned int *)' 1306 | void psi_memstall_enter(unsigned long *flags) | ^~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1370:19: error: non-static declaration of 'psi_memstall_leave' follows static declaration 1370 | EXPORT_SYMBOL_GPL(psi_memstall_leave); | ^~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/psi.c:1370:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 1370 | EXPORT_SYMBOL_GPL(psi_memstall_leave); | ^~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1346:6: note: previous definition of 'psi_memstall_leave' with type 'void(long unsigned int *)' 1346 | void psi_memstall_leave(unsigned long *flags) | ^~~~~~~~~~~~~~~~~~ In file included from kernel/sched/build_utility.c:101: kernel/sched/membarrier.c:165:13: error: invalid storage class for function 'ipi_mb' 165 | static void ipi_mb(void *info) | ^~~~~~ kernel/sched/membarrier.c:170:13: error: invalid storage class for function 'ipi_sync_core' 170 | static void ipi_sync_core(void *info) | ^~~~~~~~~~~~~ kernel/sched/membarrier.c:187:13: error: invalid storage class for function 'ipi_rseq' 187 | static void ipi_rseq(void *info) | ^~~~~~~~ kernel/sched/membarrier.c:200:13: error: invalid storage class for function 'ipi_sync_rq_state' 200 | static void ipi_sync_rq_state(void *info) | ^~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:245:12: error: invalid storage class for function 'membarrier_global_expedited' 245 | static int membarrier_global_expedited(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:310:12: error: invalid storage class for function 'membarrier_private_expedited' 310 | static int membarrier_private_expedited(int flags, int cpu_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:426:12: error: invalid storage class for function 'sync_runqueues_membarrier_state' 426 | static int sync_runqueues_membarrier_state(struct mm_struct *mm) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:483:12: error: invalid storage class for function 'membarrier_register_global_expedited' 483 | static int membarrier_register_global_expedited(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:502:12: error: invalid storage class for function 'membarrier_register_private_expedited' 502 | static int membarrier_register_private_expedited(int flags) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:544:12: error: invalid storage class for function 'membarrier_get_registrations' 544 | static int membarrier_get_registrations(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler_types.h:153, from <command-line>: include/linux/compiler-gcc.h:132:33: warning: 'alias' attribute ignored [-Wattributes] 132 | #define __diag(s) _Pragma(__diag_str(GCC diagnostic s)) | ^~~~~~~ include/linux/compiler-gcc.h:135:33: note: in expansion of macro '__diag' 135 | #define __diag_GCC_8(s) __diag(s) | ^~~~~~ include/linux/compiler-gcc.h:123:9: note: in expansion of macro '__diag_GCC_8' 123 | __diag_GCC_ ## version(__diag_GCC_ ## severity s) | ^~~~~~~~~~~ include/linux/compiler_types.h:444:9: note: in expansion of macro '__diag_GCC' 444 | __diag_ ## compiler(version, ignore, option) | ^~~~~~~ include/linux/syscalls.h:242:9: note: in expansion of macro '__diag_ignore' 242 | __diag_ignore(GCC, 8, "-Wattribute-alias", \ | ^~~~~~~~~~~~~ include/linux/syscalls.h:230:9: note: in expansion of macro '__SYSCALL_DEFINEx' 230 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:221:36: note: in expansion of macro 'SYSCALL_DEFINEx' vim +/test_fine_grained_stat +384 kernel/sched/psi.c a65983d90bfb5e Lu Jialin 2024-01-04 383 a65983d90bfb5e Lu Jialin 2024-01-04 @384 static bool test_fine_grained_stat(unsigned int *stat_tasks, a65983d90bfb5e Lu Jialin 2024-01-04 385 unsigned int nr_running, a65983d90bfb5e Lu Jialin 2024-01-04 386 enum psi_stat_states state) a65983d90bfb5e Lu Jialin 2024-01-04 387 { a65983d90bfb5e Lu Jialin 2024-01-04 388 switch (state) { a65983d90bfb5e Lu Jialin 2024-01-04 389 case PSI_MEMCG_RECLAIM_SOME: a65983d90bfb5e Lu Jialin 2024-01-04 390 return unlikely(stat_tasks[NR_MEMCG_RECLAIM]); a65983d90bfb5e Lu Jialin 2024-01-04 391 case PSI_MEMCG_RECLAIM_FULL: a65983d90bfb5e Lu Jialin 2024-01-04 392 return unlikely(stat_tasks[NR_MEMCG_RECLAIM] && a65983d90bfb5e Lu Jialin 2024-01-04 393 nr_running == stat_tasks[NR_MEMCG_RECLAIM_RUNNING]); 25d00f6853c3c6 Lu Jialin 2024-01-04 394 case PSI_GLOBAL_RECLAIM_SOME: 25d00f6853c3c6 Lu Jialin 2024-01-04 395 return unlikely(stat_tasks[NR_GLOBAL_RECLAIM]); 25d00f6853c3c6 Lu Jialin 2024-01-04 396 case PSI_GLOBAL_RECLAIM_FULL: 25d00f6853c3c6 Lu Jialin 2024-01-04 397 return unlikely(stat_tasks[NR_GLOBAL_RECLAIM] && 25d00f6853c3c6 Lu Jialin 2024-01-04 398 nr_running == stat_tasks[NR_GLOBAL_RECLAIM_RUNNING]); 25d00f6853c3c6 Lu Jialin 2024-01-04 399 case PSI_COMPACT_SOME: 25d00f6853c3c6 Lu Jialin 2024-01-04 400 return unlikely(stat_tasks[NR_COMPACT]); 25d00f6853c3c6 Lu Jialin 2024-01-04 401 case PSI_COMPACT_FULL: 25d00f6853c3c6 Lu Jialin 2024-01-04 402 return unlikely(stat_tasks[NR_COMPACT] && 25d00f6853c3c6 Lu Jialin 2024-01-04 403 nr_running == stat_tasks[NR_COMPACT_RUNNING]); 25d00f6853c3c6 Lu Jialin 2024-01-04 404 case PSI_ASYNC_MEMCG_RECLAIM_SOME: 25d00f6853c3c6 Lu Jialin 2024-01-04 405 return unlikely(stat_tasks[NR_ASYNC_MEMCG_RECLAIM]); 25d00f6853c3c6 Lu Jialin 2024-01-04 406 case PSI_ASYNC_MEMCG_RECLAIM_FULL: 25d00f6853c3c6 Lu Jialin 2024-01-04 407 return unlikely(stat_tasks[NR_ASYNC_MEMCG_RECLAIM] && 25d00f6853c3c6 Lu Jialin 2024-01-04 408 nr_running == stat_tasks[NR_ASYNC_MEMCG_RECLAIM_RUNNING]); 25d00f6853c3c6 Lu Jialin 2024-01-04 409 case PSI_SWAP_SOME: 25d00f6853c3c6 Lu Jialin 2024-01-04 410 return unlikely(stat_tasks[NR_SWAP]); 25d00f6853c3c6 Lu Jialin 2024-01-04 411 case PSI_SWAP_FULL: 25d00f6853c3c6 Lu Jialin 2024-01-04 412 return unlikely(stat_tasks[NR_SWAP] && 25d00f6853c3c6 Lu Jialin 2024-01-04 413 nr_running == stat_tasks[NR_SWAP_RUNNING]); a65983d90bfb5e Lu Jialin 2024-01-04 414 default: a65983d90bfb5e Lu Jialin 2024-01-04 415 return false; a65983d90bfb5e Lu Jialin 2024-01-04 416 } a65983d90bfb5e Lu Jialin 2024-01-04 417 } a65983d90bfb5e Lu Jialin 2024-01-04 418 a65983d90bfb5e Lu Jialin 2024-01-04 @419 static void psi_group_stat_change(struct psi_group *group, int cpu, a65983d90bfb5e Lu Jialin 2024-01-04 420 int clear, int set) a65983d90bfb5e Lu Jialin 2024-01-04 421 { a65983d90bfb5e Lu Jialin 2024-01-04 422 int t; a65983d90bfb5e Lu Jialin 2024-01-04 423 u32 state_mask = 0; a65983d90bfb5e Lu Jialin 2024-01-04 424 enum psi_stat_states s; a65983d90bfb5e Lu Jialin 2024-01-04 425 struct psi_group_cpu *groupc = per_cpu_ptr(group->pcpu, cpu); a65983d90bfb5e Lu Jialin 2024-01-04 426 a65983d90bfb5e Lu Jialin 2024-01-04 427 write_seqcount_begin(&groupc->seq); a65983d90bfb5e Lu Jialin 2024-01-04 428 a65983d90bfb5e Lu Jialin 2024-01-04 429 for (t = 0; clear; clear &= ~(1 << t), t++) a65983d90bfb5e Lu Jialin 2024-01-04 430 if (clear & (1 << t)) a65983d90bfb5e Lu Jialin 2024-01-04 431 groupc->fine_grained_tasks[t]--; a65983d90bfb5e Lu Jialin 2024-01-04 432 for (t = 0; set; set &= ~(1 << t), t++) a65983d90bfb5e Lu Jialin 2024-01-04 433 if (set & (1 << t)) a65983d90bfb5e Lu Jialin 2024-01-04 434 groupc->fine_grained_tasks[t]++; 65494451082298 Lu Jialin 2024-01-04 435 for (s = 0; s < PSI_CPU_CFS_BANDWIDTH_FULL; s++) a65983d90bfb5e Lu Jialin 2024-01-04 436 if (test_fine_grained_stat(groupc->fine_grained_tasks, a65983d90bfb5e Lu Jialin 2024-01-04 437 groupc->tasks[NR_RUNNING], s)) a65983d90bfb5e Lu Jialin 2024-01-04 438 state_mask |= (1 << s); a65983d90bfb5e Lu Jialin 2024-01-04 439 if (unlikely(groupc->state_mask & PSI_ONCPU) && a65983d90bfb5e Lu Jialin 2024-01-04 440 cpu_curr(cpu)->memstall_type) a65983d90bfb5e Lu Jialin 2024-01-04 441 state_mask |= (1 << (cpu_curr(cpu)->memstall_type * 2 - 1)); a65983d90bfb5e Lu Jialin 2024-01-04 442 a65983d90bfb5e Lu Jialin 2024-01-04 443 groupc->fine_grained_state_mask = state_mask; a65983d90bfb5e Lu Jialin 2024-01-04 444 write_seqcount_end(&groupc->seq); a65983d90bfb5e Lu Jialin 2024-01-04 445 } a65983d90bfb5e Lu Jialin 2024-01-04 446 a65983d90bfb5e Lu Jialin 2024-01-04 @447 static void psi_stat_flags_change(struct task_struct *task, int *stat_set, a65983d90bfb5e Lu Jialin 2024-01-04 448 int *stat_clear, int set, int clear) a65983d90bfb5e Lu Jialin 2024-01-04 449 { a65983d90bfb5e Lu Jialin 2024-01-04 450 if (!task->memstall_type) a65983d90bfb5e Lu Jialin 2024-01-04 451 return; a65983d90bfb5e Lu Jialin 2024-01-04 452 a65983d90bfb5e Lu Jialin 2024-01-04 453 if (clear) { a65983d90bfb5e Lu Jialin 2024-01-04 454 if (clear & TSK_MEMSTALL) a65983d90bfb5e Lu Jialin 2024-01-04 455 *stat_clear |= 1 << (2 * task->memstall_type - 2); a65983d90bfb5e Lu Jialin 2024-01-04 456 if (clear & TSK_MEMSTALL_RUNNING) a65983d90bfb5e Lu Jialin 2024-01-04 457 *stat_clear |= 1 << (2 * task->memstall_type - 1); a65983d90bfb5e Lu Jialin 2024-01-04 458 } a65983d90bfb5e Lu Jialin 2024-01-04 459 if (set) { a65983d90bfb5e Lu Jialin 2024-01-04 460 if (set & TSK_MEMSTALL) a65983d90bfb5e Lu Jialin 2024-01-04 461 *stat_set |= 1 << (2 * task->memstall_type - 2); a65983d90bfb5e Lu Jialin 2024-01-04 462 if (set & TSK_MEMSTALL_RUNNING) a65983d90bfb5e Lu Jialin 2024-01-04 463 *stat_set |= 1 << (2 * task->memstall_type - 1); a65983d90bfb5e Lu Jialin 2024-01-04 464 } a65983d90bfb5e Lu Jialin 2024-01-04 465 if (!task->in_memstall) a65983d90bfb5e Lu Jialin 2024-01-04 466 task->memstall_type = 0; a65983d90bfb5e Lu Jialin 2024-01-04 467 } a65983d90bfb5e Lu Jialin 2024-01-04 468 0df60cce43301d Lu Jialin 2024-01-04 @469 static void get_recent_stat_times(struct psi_group *group, int cpu, 0df60cce43301d Lu Jialin 2024-01-04 470 enum psi_aggregators aggregator, u64 *stat_delta, u64 nonidle) 0df60cce43301d Lu Jialin 2024-01-04 471 { 0df60cce43301d Lu Jialin 2024-01-04 472 struct psi_group_cpu *groupc = per_cpu_ptr(group->pcpu, cpu); 0df60cce43301d Lu Jialin 2024-01-04 473 u32 times[NR_PSI_STAT_STATES] = {0}; 0df60cce43301d Lu Jialin 2024-01-04 474 enum psi_stat_states s; 0df60cce43301d Lu Jialin 2024-01-04 475 u32 delta; 0df60cce43301d Lu Jialin 2024-01-04 476 0df60cce43301d Lu Jialin 2024-01-04 477 memcpy(times, groupc->fine_grained_times, sizeof(groupc->fine_grained_times)); 0df60cce43301d Lu Jialin 2024-01-04 478 for (s = 0; s < NR_PSI_STAT_STATES; s++) { 0df60cce43301d Lu Jialin 2024-01-04 479 if (groupc->fine_grained_state_mask & (1 << s)) 0df60cce43301d Lu Jialin 2024-01-04 480 times[s] += groupc->fine_grained_times_delta; 0df60cce43301d Lu Jialin 2024-01-04 481 delta = times[s] - groupc->fine_grained_times_prev[aggregator][s]; 0df60cce43301d Lu Jialin 2024-01-04 482 groupc->fine_grained_times_prev[aggregator][s] = times[s]; 0df60cce43301d Lu Jialin 2024-01-04 483 stat_delta[s] += (u64)delta * nonidle; 0df60cce43301d Lu Jialin 2024-01-04 484 } 0df60cce43301d Lu Jialin 2024-01-04 485 } a65983d90bfb5e Lu Jialin 2024-01-04 486 #else a65983d90bfb5e Lu Jialin 2024-01-04 487 static inline void psi_group_stat_change(struct psi_group *group, int cpu, a65983d90bfb5e Lu Jialin 2024-01-04 488 int clear, int set) {} a65983d90bfb5e Lu Jialin 2024-01-04 489 static inline void psi_stat_flags_change(struct task_struct *task, a65983d90bfb5e Lu Jialin 2024-01-04 490 int *stat_set, int *stat_clear, a65983d90bfb5e Lu Jialin 2024-01-04 491 int set, int clear) {} a65983d90bfb5e Lu Jialin 2024-01-04 492 #endif a65983d90bfb5e Lu Jialin 2024-01-04 493 65494451082298 Lu Jialin 2024-01-04 494 #if defined(CONFIG_CFS_BANDWIDTH) && defined(CONFIG_CGROUP_CPUACCT) && \ 65494451082298 Lu Jialin 2024-01-04 495 defined(CONFIG_PSI_FINE_GRAINED) 65494451082298 Lu Jialin 2024-01-04 496 static void update_throttle_type(struct task_struct *task, int cpu, bool next) 65494451082298 Lu Jialin 2024-01-04 497 { 65494451082298 Lu Jialin 2024-01-04 498 if (!cgroup_subsys_on_dfl(cpuacct_cgrp_subsys)) { 65494451082298 Lu Jialin 2024-01-04 499 struct cgroup *cpuacct_cgrp; 65494451082298 Lu Jialin 2024-01-04 500 struct psi_group_cpu *groupc; 65494451082298 Lu Jialin 2024-01-04 501 struct task_group *tsk_grp; 65494451082298 Lu Jialin 2024-01-04 502 65494451082298 Lu Jialin 2024-01-04 503 rcu_read_lock(); 65494451082298 Lu Jialin 2024-01-04 504 cpuacct_cgrp = task_cgroup(task, cpuacct_cgrp_id); 65494451082298 Lu Jialin 2024-01-04 505 if (cgroup_parent(cpuacct_cgrp)) { 65494451082298 Lu Jialin 2024-01-04 506 groupc = per_cpu_ptr(cgroup_psi(cpuacct_cgrp)->pcpu, cpu); 65494451082298 Lu Jialin 2024-01-04 507 tsk_grp = task_group(task); 65494451082298 Lu Jialin 2024-01-04 508 if (next) 65494451082298 Lu Jialin 2024-01-04 509 groupc->prev_throttle = groupc->cur_throttle; 65494451082298 Lu Jialin 2024-01-04 510 groupc->cur_throttle = tsk_grp->cfs_rq[cpu]->throttled; 65494451082298 Lu Jialin 2024-01-04 511 } 65494451082298 Lu Jialin 2024-01-04 512 rcu_read_unlock(); 65494451082298 Lu Jialin 2024-01-04 513 } 65494451082298 Lu Jialin 2024-01-04 514 } 65494451082298 Lu Jialin 2024-01-04 515 #else 65494451082298 Lu Jialin 2024-01-04 @516 static inline void update_throttle_type(struct task_struct *task, int cpu, 65494451082298 Lu Jialin 2024-01-04 517 bool next) {} 65494451082298 Lu Jialin 2024-01-04 518 #endif 65494451082298 Lu Jialin 2024-01-04 519 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 @520 static void collect_percpu_times(struct psi_group *group, 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 521 enum psi_aggregators aggregator, 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 522 u32 *pchanged_states) eb414681d5a07d Johannes Weiner 2018-10-26 523 { 0df60cce43301d Lu Jialin 2024-01-04 524 #ifdef CONFIG_PSI_FINE_GRAINED 0df60cce43301d Lu Jialin 2024-01-04 525 u64 stat_delta[NR_PSI_STAT_STATES] = { 0 }; 0df60cce43301d Lu Jialin 2024-01-04 526 #endif eb414681d5a07d Johannes Weiner 2018-10-26 527 u64 deltas[NR_PSI_STATES - 1] = { 0, }; eb414681d5a07d Johannes Weiner 2018-10-26 528 unsigned long nonidle_total = 0; 333f3017c5a893 Suren Baghdasaryan 2019-05-14 529 u32 changed_states = 0; eb414681d5a07d Johannes Weiner 2018-10-26 530 int cpu; eb414681d5a07d Johannes Weiner 2018-10-26 531 int s; eb414681d5a07d Johannes Weiner 2018-10-26 532 eb414681d5a07d Johannes Weiner 2018-10-26 533 /* eb414681d5a07d Johannes Weiner 2018-10-26 534 * Collect the per-cpu time buckets and average them into a eb414681d5a07d Johannes Weiner 2018-10-26 535 * single time sample that is normalized to wallclock time. eb414681d5a07d Johannes Weiner 2018-10-26 536 * eb414681d5a07d Johannes Weiner 2018-10-26 537 * For averaging, each CPU is weighted by its non-idle time in eb414681d5a07d Johannes Weiner 2018-10-26 538 * the sampling period. This eliminates artifacts from uneven eb414681d5a07d Johannes Weiner 2018-10-26 539 * loading, or even entirely idle CPUs. eb414681d5a07d Johannes Weiner 2018-10-26 540 */ eb414681d5a07d Johannes Weiner 2018-10-26 541 for_each_possible_cpu(cpu) { eb414681d5a07d Johannes Weiner 2018-10-26 542 u32 times[NR_PSI_STATES]; eb414681d5a07d Johannes Weiner 2018-10-26 543 u32 nonidle; 333f3017c5a893 Suren Baghdasaryan 2019-05-14 544 u32 cpu_changed_states; eb414681d5a07d Johannes Weiner 2018-10-26 545 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 546 get_recent_times(group, cpu, aggregator, times, 333f3017c5a893 Suren Baghdasaryan 2019-05-14 547 &cpu_changed_states); 333f3017c5a893 Suren Baghdasaryan 2019-05-14 548 changed_states |= cpu_changed_states; eb414681d5a07d Johannes Weiner 2018-10-26 549 eb414681d5a07d Johannes Weiner 2018-10-26 550 nonidle = nsecs_to_jiffies(times[PSI_NONIDLE]); eb414681d5a07d Johannes Weiner 2018-10-26 551 nonidle_total += nonidle; eb414681d5a07d Johannes Weiner 2018-10-26 552 eb414681d5a07d Johannes Weiner 2018-10-26 553 for (s = 0; s < PSI_NONIDLE; s++) eb414681d5a07d Johannes Weiner 2018-10-26 554 deltas[s] += (u64)times[s] * nonidle; 0df60cce43301d Lu Jialin 2024-01-04 555 #ifdef CONFIG_PSI_FINE_GRAINED 0df60cce43301d Lu Jialin 2024-01-04 556 get_recent_stat_times(group, cpu, aggregator, stat_delta, nonidle); 0df60cce43301d Lu Jialin 2024-01-04 557 #endif eb414681d5a07d Johannes Weiner 2018-10-26 558 } eb414681d5a07d Johannes Weiner 2018-10-26 559 eb414681d5a07d Johannes Weiner 2018-10-26 560 /* eb414681d5a07d Johannes Weiner 2018-10-26 561 * Integrate the sample into the running statistics that are eb414681d5a07d Johannes Weiner 2018-10-26 562 * reported to userspace: the cumulative stall times and the eb414681d5a07d Johannes Weiner 2018-10-26 563 * decaying averages. eb414681d5a07d Johannes Weiner 2018-10-26 564 * eb414681d5a07d Johannes Weiner 2018-10-26 565 * Pressure percentages are sampled at PSI_FREQ. We might be eb414681d5a07d Johannes Weiner 2018-10-26 566 * called more often when the user polls more frequently than eb414681d5a07d Johannes Weiner 2018-10-26 567 * that; we might be called less often when there is no task eb414681d5a07d Johannes Weiner 2018-10-26 568 * activity, thus no data, and clock ticks are sporadic. The eb414681d5a07d Johannes Weiner 2018-10-26 569 * below handles both. eb414681d5a07d Johannes Weiner 2018-10-26 570 */ eb414681d5a07d Johannes Weiner 2018-10-26 571 eb414681d5a07d Johannes Weiner 2018-10-26 572 /* total= */ eb414681d5a07d Johannes Weiner 2018-10-26 573 for (s = 0; s < NR_PSI_STATES - 1; s++) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 574 group->total[aggregator][s] += 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 575 div_u64(deltas[s], max(nonidle_total, 1UL)); eb414681d5a07d Johannes Weiner 2018-10-26 576 :::::: The code at line 384 was first introduced by commit :::::: a65983d90bfb5e031444fea492b32f931c83ffcf sched/psi: Introduce fine grained stall time collect for cgroup reclaim :::::: TO: Lu Jialin <lujialin4(a)huawei.com> :::::: CC: yanhaitao <yanhaitao2(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3876/15358] drivers/net/ethernet/mucse/rnp/rnp_main.c:7167:17: warning: unused variable 'hw'
by kernel test robot 29 Oct '24

29 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 27e5d43e49e85d816bd05ffe8672ceea631a07e4 commit: 455d45ae080810ae554f5e586adb9004230f9f70 [3876/15358] drivers: initial support for rnp drivers from Mucse Technology config: arm64-randconfig-004-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290516.SciOffDt-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 5886454669c3c9026f7f27eab13509dd0241f2d6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290516.SciOffDt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410290516.SciOffDt-lkp@intel.com/ All error/warnings (new ones prefixed by >>): | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:175:6: warning: no previous prototype for function 'rnp_unmap_and_free_tx_resource' [-Wmissing-prototypes] 175 | void rnp_unmap_and_free_tx_resource(struct rnp_ring *ring, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:175:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 175 | void rnp_unmap_and_free_tx_resource(struct rnp_ring *ring, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:670:5: warning: no previous prototype for function 'rnp_rx_ring_reinit' [-Wmissing-prototypes] 670 | int rnp_rx_ring_reinit(struct rnp_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:670:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 670 | int rnp_rx_ring_reinit(struct rnp_adapter *adapter, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:1777:7: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable] 1777 | bool xdp_xmit = false; | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:2012:6: warning: no previous prototype for function 'rnp_write_eitr_rx' [-Wmissing-prototypes] 2012 | void rnp_write_eitr_rx(struct rnp_q_vector *q_vector) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:2012:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2012 | void rnp_write_eitr_rx(struct rnp_q_vector *q_vector) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:2818:6: warning: variable 'rxctrl' set but not used [-Wunused-but-set-variable] 2818 | u32 rxctrl = 0, dma_axi_ctl; | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:3176:6: warning: no previous prototype for function 'rnp_vlan_stags_flag' [-Wmissing-prototypes] 3176 | void rnp_vlan_stags_flag(struct rnp_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:3176:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3176 | void rnp_vlan_stags_flag(struct rnp_adapter *adapter) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:3580:5: warning: no previous prototype for function 'rnp_xmit_nop_frame_ring' [-Wmissing-prototypes] 3580 | int rnp_xmit_nop_frame_ring(struct rnp_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:3580:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3580 | int rnp_xmit_nop_frame_ring(struct rnp_adapter *adapter, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:4842:6: warning: no previous prototype for function 'rnp_service_timer' [-Wmissing-prototypes] 4842 | void rnp_service_timer(struct timer_list *t) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:4842:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4842 | void rnp_service_timer(struct timer_list *t) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:4950:6: warning: no previous prototype for function 'rnp_service_task' [-Wmissing-prototypes] 4950 | void rnp_service_task(struct work_struct *work) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:4950:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4950 | void rnp_service_task(struct work_struct *work) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:5972:5: warning: no previous prototype for function 'rnp_delete_knode' [-Wmissing-prototypes] 5972 | int rnp_delete_knode(struct net_device *dev, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:5972:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 5972 | int rnp_delete_knode(struct net_device *dev, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:6061:5: warning: no previous prototype for function 'rnp_config_knode' [-Wmissing-prototypes] 6061 | int rnp_config_knode(struct net_device *dev, __be16 protocol, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:6061:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6061 | int rnp_config_knode(struct net_device *dev, __be16 protocol, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:6120:5: warning: no previous prototype for function 'rnp_setup_tc_cls_u32' [-Wmissing-prototypes] 6120 | int rnp_setup_tc_cls_u32(struct net_device *dev, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:6120:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6120 | int rnp_setup_tc_cls_u32(struct net_device *dev, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:6197:6: warning: no previous prototype for function 'rnp_do_reset' [-Wmissing-prototypes] 6197 | void rnp_do_reset(struct net_device *netdev) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:6197:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6197 | void rnp_do_reset(struct net_device *netdev) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:6452:6: warning: no previous prototype for function 'rnp_assign_netdev_ops' [-Wmissing-prototypes] 6452 | void rnp_assign_netdev_ops(struct net_device *dev) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:6452:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6452 | void rnp_assign_netdev_ops(struct net_device *dev) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:6628:5: warning: no previous prototype for function 'rnp_can_rpu_start' [-Wmissing-prototypes] 6628 | int rnp_can_rpu_start(struct rnp_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:6628:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6628 | int rnp_can_rpu_start(struct rnp_adapter *adapter) | ^ | static >> drivers/net/ethernet/mucse/rnp/rnp_main.c:7167:17: warning: unused variable 'hw' [-Wunused-variable] 7167 | struct rnp_hw *hw = &adapter->hw; | ^~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6481:29: warning: unused function 'rnp_tso_features' [-Wunused-function] 6481 | static inline unsigned long rnp_tso_features(struct rnp_hw *hw) | ^~~~~~~~~~~~~~~~ 22 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnp/rnp_sriov.c:6: In file included from include/linux/pci.h:1663: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_sriov.c:305:6: warning: no previous prototype for function 'check_ari_mode' [-Wmissing-prototypes] 305 | bool check_ari_mode(struct pci_dev *dev) | ^ drivers/net/ethernet/mucse/rnp/rnp_sriov.c:305:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 305 | bool check_ari_mode(struct pci_dev *dev) | ^ | static >> drivers/net/ethernet/mucse/rnp/rnp_sriov.c:397:6: warning: variable 'err' set but not used [-Wunused-but-set-variable] 397 | int err; | ^ >> drivers/net/ethernet/mucse/rnp/rnp_sriov.c:411:2: warning: non-void function does not return a value [-Wreturn-type] 411 | } | ^ >> drivers/net/ethernet/mucse/rnp/rnp_sriov.c:413:2: error: expected identifier or '(' 413 | return err; | ^ >> drivers/net/ethernet/mucse/rnp/rnp_sriov.c:414:1: error: extraneous closing brace ('}') 414 | } | ^ drivers/net/ethernet/mucse/rnp/rnp_sriov.c:1140:5: warning: no previous prototype for function 'rnp_msg_post_status_signle_link' [-Wmissing-prototypes] 1140 | int rnp_msg_post_status_signle_link(struct rnp_adapter *adapter, int vf, | ^ drivers/net/ethernet/mucse/rnp/rnp_sriov.c:1140:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1140 | int rnp_msg_post_status_signle_link(struct rnp_adapter *adapter, int vf, | ^ | static 9 warnings and 2 errors generated. vim +/hw +7167 drivers/net/ethernet/mucse/rnp/rnp_main.c 7153 7154 /** 7155 * rnp_io_error_detected - called when PCI error is detected 7156 * @pdev: Pointer to PCI device 7157 * @state: The current pci connection state 7158 * 7159 * This function is called after a PCI bus error affecting 7160 * this device has been detected. 7161 */ 7162 static pci_ers_result_t rnp_io_error_detected(struct pci_dev *pdev, 7163 pci_channel_state_t state) 7164 { 7165 struct rnp_adapter *adapter = pci_get_drvdata(pdev); 7166 struct net_device *netdev = adapter->netdev; > 7167 struct rnp_hw *hw = &adapter->hw; 7168 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13319/15358] drivers/crypto/ccp/hygon/tdm-dev.c:340:84: error: invalid use of undefined type 'struct module'
by kernel test robot 29 Oct '24

29 Oct '24

Hi chench00, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 27e5d43e49e85d816bd05ffe8672ceea631a07e4 commit: a1dd4972da4e66d9a9d1a89b3dfd8f742c20193b [13319/15358] crypto: tdm: Add Hygon TDM driver config: x86_64-buildonly-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290303.9DGdQJBL-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290303.9DGdQJBL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410290303.9DGdQJBL-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/crypto/ccp/hygon/tdm-dev.c: In function 'list_enqueue': drivers/crypto/ccp/hygon/tdm-dev.c:94:13: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 94 | int ret = 0; | ^~~ In file included from include/linux/string.h:294, from include/linux/bitmap.h:11, from include/linux/cpumask.h:12, from arch/x86/include/asm/cpumask.h:5, from arch/x86/include/asm/msr.h:11, from arch/x86/include/asm/processor.h:23, from arch/x86/include/asm/timex.h:5, from include/linux/timex.h:67, from include/linux/time32.h:13, from include/linux/time.h:60, from include/linux/stat.h:19, from include/linux/module.h:13, from drivers/crypto/ccp/hygon/tdm-dev.c:11: drivers/crypto/ccp/hygon/tdm-dev.c: In function 'tdm_get_cmd_context_hash': >> drivers/crypto/ccp/hygon/tdm-dev.c:340:84: error: invalid use of undefined type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ^~ include/linux/fortify-string.h:650:48: note: in definition of macro '__fortify_memcpy_chk' 650 | const size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/crypto/ccp/hygon/tdm-dev.c:340:25: note: in expansion of macro 'memcpy' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ^~~~~~ drivers/crypto/ccp/hygon/tdm-dev.c:340:61: error: invalid use of undefined type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ^~ include/linux/fortify-string.h:652:34: note: in definition of macro '__fortify_memcpy_chk' 652 | const size_t __q_size = (q_size); \ | ^~~~~~ include/linux/fortify-string.h:708:35: note: in expansion of macro '__struct_size' 708 | __struct_size(p), __struct_size(q), \ | ^~~~~~~~~~~~~ drivers/crypto/ccp/hygon/tdm-dev.c:340:25: note: in expansion of macro 'memcpy' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ^~~~~~ drivers/crypto/ccp/hygon/tdm-dev.c:340:61: error: invalid use of undefined type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ^~ include/linux/fortify-string.h:654:40: note: in definition of macro '__fortify_memcpy_chk' 654 | const size_t __q_size_field = (q_size_field); \ | ^~~~~~~~~~~~ include/linux/fortify-string.h:709:35: note: in expansion of macro '__member_size' 709 | __member_size(p), __member_size(q), \ | ^~~~~~~~~~~~~ drivers/crypto/ccp/hygon/tdm-dev.c:340:25: note: in expansion of macro 'memcpy' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ^~~~~~ drivers/crypto/ccp/hygon/tdm-dev.c:340:61: error: invalid use of undefined type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ^~ include/linux/fortify-string.h:662:30: note: in definition of macro '__fortify_memcpy_chk' 662 | __underlying_##op(p, q, __fortify_size); \ | ^ drivers/crypto/ccp/hygon/tdm-dev.c:340:25: note: in expansion of macro 'memcpy' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ^~~~~~ drivers/crypto/ccp/hygon/tdm-dev.c: In function 'psp_create_measure_task': drivers/crypto/ccp/hygon/tdm-dev.c:606:27: warning: variable 'head' set but not used [-Wunused-but-set-variable] 606 | struct list_head *head = NULL; | ^~~~ vim +340 drivers/crypto/ccp/hygon/tdm-dev.c 323 324 if (!hash) { 325 ret = -DYN_NULL_POINTER; 326 pr_err("Null pointer\n"); 327 goto end; 328 } 329 330 ctx_msg.flag = flag; 331 ctx_msg.pid = current->pid; 332 memcpy(ctx_msg.comm, current->comm, sizeof(current->comm)); 333 334 return_address = CALLER_ADDR1; 335 if (return_address) { 336 #if IS_BUILTIN(CONFIG_CRYPTO_DEV_CCP_DD) 337 p_module = __module_address(return_address); 338 // caller is module 339 if (p_module) > 340 memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); 341 // caller is build-in 342 else 343 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 344 #elif IS_ENABLED(CONFIG_KALLSYMS) 345 symbol_len = sprint_symbol((char *)symbol_buf, return_address); 346 if (!symbol_len) { 347 ret = -DYN_ERR_API; 348 pr_err("sprint_symbol failed\n"); 349 goto end; 350 } 351 symbol_begin = strchr((char *)symbol_buf, '['); 352 if (!symbol_begin) { 353 ret = -DYN_NULL_POINTER; 354 pr_err("module name is not exist\n"); 355 goto end; 356 } 357 symbol_end = strchr((char *)symbol_buf, ']'); 358 if (!symbol_end) { 359 ret = -DYN_NULL_POINTER; 360 pr_err("module name is not exist\n"); 361 goto end; 362 } 363 symbol_begin++; 364 if (symbol_end - symbol_begin) 365 memcpy(ctx_msg.module_name, symbol_begin, symbol_end - symbol_begin); 366 else 367 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 368 #else 369 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 370 #endif 371 } else 372 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 373 374 ret = calc_task_context_hash(ctx_msg, hash); 375 if (ret) { 376 pr_err("calc_task_context_hash failed\n"); 377 goto end; 378 } 379 380 end: 381 return ret; 382 } 383 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 15681/30000] arch/arm64/include/asm/kgdb.h:21:25: error: value '1025' out of range for constraint 'I'
by kernel test robot 29 Oct '24

29 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8dcdd5a432518f8f8deb6ab608551ecda71bda40 commit: 78568d28ad62c586e32e3989de5354fcb014c09f [15681/30000] scripts: Fix issue of module signing with openssl 3.x config: arm64-randconfig-004-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290217.j4yRbZGJ-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 5886454669c3c9026f7f27eab13509dd0241f2d6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290217.j4yRbZGJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410290217.j4yRbZGJ-lkp@intel.com/ All errors (new ones prefixed by >>): | ^ /usr/include/openssl/macros.h:62:52: note: expanded from macro 'OSSL_DEPRECATED' 62 | # define OSSL_DEPRECATED(since) __attribute__((deprecated)) | ^ scripts/sign-file.c:146:7: warning: 'ENGINE_init' is deprecated [-Wdeprecated-declarations] 146 | if (ENGINE_init(e)) | ^ /usr/include/openssl/engine.h:620:1: note: 'ENGINE_init' has been explicitly marked deprecated here 620 | OSSL_DEPRECATEDIN_3_0 int ENGINE_init(ENGINE *e); | ^ /usr/include/openssl/macros.h:182:49: note: expanded from macro 'OSSL_DEPRECATEDIN_3_0' 182 | # define OSSL_DEPRECATEDIN_3_0 OSSL_DEPRECATED(3.0) | ^ /usr/include/openssl/macros.h:62:52: note: expanded from macro 'OSSL_DEPRECATED' 62 | # define OSSL_DEPRECATED(since) __attribute__((deprecated)) | ^ scripts/sign-file.c:151:9: warning: 'ENGINE_ctrl_cmd_string' is deprecated [-Wdeprecated-declarations] 151 | ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), | ^ /usr/include/openssl/engine.h:478:1: note: 'ENGINE_ctrl_cmd_string' has been explicitly marked deprecated here 478 | OSSL_DEPRECATEDIN_3_0 | ^ /usr/include/openssl/macros.h:182:49: note: expanded from macro 'OSSL_DEPRECATEDIN_3_0' 182 | # define OSSL_DEPRECATEDIN_3_0 OSSL_DEPRECATED(3.0) | ^ /usr/include/openssl/macros.h:62:52: note: expanded from macro 'OSSL_DEPRECATED' 62 | # define OSSL_DEPRECATED(since) __attribute__((deprecated)) | ^ scripts/sign-file.c:153:17: warning: 'ENGINE_load_private_key' is deprecated [-Wdeprecated-declarations] 153 | private_key = ENGINE_load_private_key(e, private_key_name, | ^ /usr/include/openssl/engine.h:637:1: note: 'ENGINE_load_private_key' has been explicitly marked deprecated here 637 | OSSL_DEPRECATEDIN_3_0 | ^ /usr/include/openssl/macros.h:182:49: note: expanded from macro 'OSSL_DEPRECATEDIN_3_0' 182 | # define OSSL_DEPRECATEDIN_3_0 OSSL_DEPRECATED(3.0) | ^ /usr/include/openssl/macros.h:62:52: note: expanded from macro 'OSSL_DEPRECATED' 62 | # define OSSL_DEPRECATED(since) __attribute__((deprecated)) | ^ 7 warnings generated. In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:17: In file included from include/linux/lockdep.h:14: In file included from include/linux/smp.h:102: In file included from include/linux/preempt.h:78: In file included from arch/arm64/include/asm/preempt.h:5: In file included from include/linux/thread_info.h:14: In file included from include/linux/thread_bits.h:32: In file included from arch/arm64/include/asm/thread_info.h:18: arch/arm64/include/asm/stack_pointer.h:8:51: error: register 'sp' unsuitable for global register variables on this target 8 | register unsigned long current_stack_pointer asm ("sp"); | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:35: In file included from include/acpi/acpi_io.h:7: In file included from arch/arm64/include/asm/acpi.h:13: In file included from include/linux/memblock.h:13: In file included from include/linux/mm.h:1573: include/linux/vmstat.h:417:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 417 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 418 | item]; | ~~~~ include/linux/vmstat.h:424:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 424 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 425 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:436:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 436 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 437 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:445:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 445 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 446 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ In file included from arch/arm64/kernel/asm-offsets.c:14: In file included from include/linux/kvm_host.h:36: In file included from arch/arm64/include/asm/kvm_host.h:20: In file included from arch/arm64/include/asm/arch_gicv3.h:17: In file included from arch/arm64/include/asm/cacheflush.h:11: In file included from include/linux/kgdb.h:21: >> arch/arm64/include/asm/kgdb.h:21:25: error: value '1025' out of range for constraint 'I' 21 | asm ("brk %0" : : "I" (KGDB_COMPILED_DBG_BRK_IMM)); | ^~~~~~~~~~~~~~~~~~~~~~~~~ arch/arm64/include/asm/brk-imm.h:27:35: note: expanded from macro 'KGDB_COMPILED_DBG_BRK_IMM' 27 | #define KGDB_COMPILED_DBG_BRK_IMM 0x401 | ^~~~~ 5 warnings and 2 errors generated. make[2]: *** [scripts/Makefile.build:117: arch/arm64/kernel/asm-offsets.s] Error 1 shuffle=3502639818 make[2]: Target '__build' not remade because of errors. make[1]: *** [Makefile:1238: prepare0] Error 2 shuffle=3502639818 make[1]: Target 'prepare' not remade because of errors. make: *** [Makefile:187: __sub-make] Error 2 shuffle=3502639818 make: Target 'prepare' not remade because of errors. vim +21 arch/arm64/include/asm/kgdb.h bcf5763b0d58d2 Vijaya Kumar K 2014-01-28 18 bcf5763b0d58d2 Vijaya Kumar K 2014-01-28 19 static inline void arch_kgdb_breakpoint(void) bcf5763b0d58d2 Vijaya Kumar K 2014-01-28 20 { 7acf71d1a224b6 Catalin Marinas 2014-09-25 @21 asm ("brk %0" : : "I" (KGDB_COMPILED_DBG_BRK_IMM)); bcf5763b0d58d2 Vijaya Kumar K 2014-01-28 22 } bcf5763b0d58d2 Vijaya Kumar K 2014-01-28 23 :::::: The code at line 21 was first introduced by commit :::::: 7acf71d1a224b6e7a40a244d804cea1780a643ed arm64: Fix typos in KGDB macros :::::: TO: Catalin Marinas <catalin.marinas(a)arm.com> :::::: CC: Catalin Marinas <catalin.marinas(a)arm.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 26477/30000] arch/x86/kvm/mmu/mmu.o: warning: objtool: mmu_set_spte()+0x79d: unreachable instruction
by kernel test robot 28 Oct '24

28 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8dcdd5a432518f8f8deb6ab608551ecda71bda40 commit: 86d7f506e7147594712be20f0160b2e7f0b447f7 [26477/30000] KVM: x86: mmu: trace kvm_mmu_set_spte after the new SPTE was set config: x86_64-randconfig-014-20241028 (https://download.01.org/0day-ci/archive/20241028/202410282334.pOpu4nRk-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241028/202410282334.pOpu4nRk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410282334.pOpu4nRk-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/kvm/mmu/mmu.o: warning: objtool: mmu_set_spte()+0x79d: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] fix CVE-2024-46802
by Heyuan Wang 28 Oct '24

28 Oct '24

From: Yu Liao <liaoyu15(a)huawei.com> Yu Liao (1): drm/amd/display: fix mixed declarations warning winstang (1): drm/amd/display: added NULL check at start of dc_validate_stream drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] drm/amd/display: Check null pointer before dereferencing se
by Xiaomeng Zhang 28 Oct '24

28 Oct '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit ff599ef6970ee000fa5bc38d02fa5ff5f3fc7575 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZM9W Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [WHAT & HOW] se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again. This fixes 1 FORWARD_NULL issue reported by Coverity. Acked-by: Alex Hung <alex.hung(a)amd.com> Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index 50e643bfdfba..cefa1756e122 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1691,7 +1691,7 @@ bool dc_validate_boot_timing(const struct dc *dc, if (crtc_timing->pix_clk_100hz != pix_clk_100hz) return false; - if (!se->funcs->dp_get_pixel_format) + if (!se || !se->funcs->dp_get_pixel_format) return false; if (!se->funcs->dp_get_pixel_format( -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 20444/23875] arch/arm64/kernel/cpufeature.c:1287:9: error: 'a32_elf_hwcap2' undeclared; did you mean 'elf_hwcap'?
by kernel test robot 28 Oct '24

28 Oct '24

Hi James, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 858328aa50984206eb1dfc7218a03c5cc0165d3f commit: 6dfc76f160cb5e8bf25cb85d4763cdc3144bfda8 [20444/23875] arm64: errata: Remove AES hwcap for COMPAT tasks config: arm64-randconfig-004-20241027 (https://download.01.org/0day-ci/archive/20241028/202410282030.pKjQvIBc-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241028/202410282030.pKjQvIBc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410282030.pKjQvIBc-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/kernel/cpufeature.c: In function 'elf_hwcap_fixup': >> arch/arm64/kernel/cpufeature.c:1287:9: error: 'a32_elf_hwcap2' undeclared (first use in this function); did you mean 'elf_hwcap'? 1287 | a32_elf_hwcap2 &= ~COMPAT_HWCAP2_AES; | ^~~~~~~~~~~~~~ | elf_hwcap arch/arm64/kernel/cpufeature.c:1287:9: note: each undeclared identifier is reported only once for each function it appears in vim +1287 arch/arm64/kernel/cpufeature.c 1282 1283 static void elf_hwcap_fixup(void) 1284 { 1285 #ifdef CONFIG_ARM64_ERRATUM_1742098 1286 if (cpus_have_const_cap(ARM64_WORKAROUND_1742098)) > 1287 a32_elf_hwcap2 &= ~COMPAT_HWCAP2_AES; 1288 #endif /* ARM64_ERRATUM_1742098 */ 1289 } 1290 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] loop: fix the the direct I/O support check when used on top of block devices
by Yu Kuai 28 Oct '24

28 Oct '24

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.8-rc1 commit baa7d536077dcdfe2b70c476a8873d1745d3de0f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAXIMQ CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- __loop_update_dio only checks the alignment requirement for block backed file systems, but misses them for the case where the loop device is created directly on top of another block device. Due to this creating a loop device with default option plus the direct I/O flag on a > 512 byte sector size file system will lead to incorrect I/O being submitted to the lower block device and a lot of error from the lock layer. This can be seen with xfstests generic/563. Fix the code in __loop_update_dio by factoring the alignment check into a helper, and calling that also for the struct block_device of a block device inode. Also remove the TODO comment talking about dynamically switching between buffered and direct I/O, which is a would be a recipe for horrible performance and occasional data loss. Fixes: 2e5ab5f379f9 ("block: loop: prepare for supporing direct IO") Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20240117175901.871796-1-hch@lst.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: drivers/block/loop.c [A lot of conflicts, main functional related are: commit a2ad63daa88b ("VFS: add FMODE_CAN_ODIRECT file flag") commit 47e9624616c8 ("block: remove support for cryptoloop and the xor transfer")] Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/block/loop.c | 56 +++++++++++++++++++++----------------------- 1 file changed, 27 insertions(+), 29 deletions(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 8eefd1462c3f..ff49c3f43b25 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -167,41 +167,39 @@ static loff_t get_loop_size(struct loop_device *lo, struct file *file) return get_size(lo->lo_offset, lo->lo_sizelimit, file); } +/* + * We support direct I/O only if lo_offset is aligned with the logical I/O size + * of backing device, and the logical block size of loop is bigger than that of + * the backing device. + */ +static bool lo_bdev_can_use_dio(struct loop_device *lo, + struct block_device *backing_bdev) +{ + unsigned short sb_bsize = bdev_logical_block_size(backing_bdev); + + if (queue_logical_block_size(lo->lo_queue) < sb_bsize) + return false; + if (lo->lo_offset & (sb_bsize - 1)) + return false; + if (lo->transfer) + return false; + return true; +} + static void __loop_update_dio(struct loop_device *lo, bool dio) { struct file *file = lo->lo_backing_file; - struct address_space *mapping = file->f_mapping; - struct inode *inode = mapping->host; - unsigned short sb_bsize = 0; - unsigned dio_align = 0; + struct inode *inode = file->f_mapping->host; + struct block_device *backing_bdev = NULL; bool use_dio; - if (inode->i_sb->s_bdev) { - sb_bsize = bdev_logical_block_size(inode->i_sb->s_bdev); - dio_align = sb_bsize - 1; - } + if (S_ISBLK(inode->i_mode)) + backing_bdev = I_BDEV(inode); + else if (inode->i_sb->s_bdev) + backing_bdev = inode->i_sb->s_bdev; - /* - * We support direct I/O only if lo_offset is aligned with the - * logical I/O size of backing device, and the logical block - * size of loop is bigger than the backing device's and the loop - * needn't transform transfer. - * - * TODO: the above condition may be loosed in the future, and - * direct I/O may be switched runtime at that time because most - * of requests in sane applications should be PAGE_SIZE aligned - */ - if (dio) { - if (queue_logical_block_size(lo->lo_queue) >= sb_bsize && - !(lo->lo_offset & dio_align) && - mapping->a_ops->direct_IO && - !lo->transfer) - use_dio = true; - else - use_dio = false; - } else { - use_dio = false; - } + use_dio = dio && (file->f_mapping->a_ops->direct_IO) && + (!backing_bdev || lo_bdev_can_use_dio(lo, backing_bdev)); if (lo->use_dio == use_dio) return; -- 2.39.2

2 1

[openeuler:OLK-5.10 28630/30000] drivers/irqchip/irq-mbigen.c:693:12: warning: 'vtimer_mbigen_set_regs' defined but not used
by kernel test robot 28 Oct '24

28 Oct '24

Hi weiyuchen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: a0194593a9cec12b03a0b5d84cbc937243e65153 commit: a8af21a94f6331eb77ca486a511cbbb548de94df [28630/30000] mbigen: add kvm dependency config: arm64-randconfig-001-20241028 (https://download.01.org/0day-ci/archive/20241028/202410281921.NaI3m81D-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241028/202410281921.NaI3m81D-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410281921.NaI3m81D-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/irqchip/irq-mbigen.c:875:36: warning: 'mbigen_acpi_match' defined but not used [-Wunused-const-variable=] 875 | static const struct acpi_device_id mbigen_acpi_match[] = { | ^~~~~~~~~~~~~~~~~ >> drivers/irqchip/irq-mbigen.c:693:12: warning: 'vtimer_mbigen_set_regs' defined but not used [-Wunused-function] 693 | static int vtimer_mbigen_set_regs(struct platform_device *pdev) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/irqchip/irq-mbigen.c:651:13: warning: 'vtimer_mbigen_should_probe' defined but not used [-Wunused-function] 651 | static bool vtimer_mbigen_should_probe(struct mbigen_device *mgn_chip) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/irqchip/irq-mbigen.c:636:13: warning: 'is_mbigen_vtimer_bypass_enabled' defined but not used [-Wunused-function] 636 | static bool is_mbigen_vtimer_bypass_enabled(struct mbigen_device *mgn_chip) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/irqchip/irq-mbigen.c:597:12: warning: 'vtimer_mbigen_chip_match_cpu' defined but not used [-Wunused-function] 597 | static int vtimer_mbigen_chip_match_cpu(struct vtimer_mbigen_device *chip) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/irqchip/irq-mbigen.c:588:12: warning: 'vtimer_mbigen_chip_read_aff3' defined but not used [-Wunused-function] 588 | static int vtimer_mbigen_chip_read_aff3(struct vtimer_mbigen_device *chip) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/irqchip/irq-mbigen.c:581:13: warning: 'vtimer_mbigen_set_kvm_info' defined but not used [-Wunused-function] 581 | static void vtimer_mbigen_set_kvm_info(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/irqchip/irq-mbigen.c:268:12: warning: 'vtimer_mbigen_set_type' defined but not used [-Wunused-function] 268 | static int vtimer_mbigen_set_type(unsigned int cpu_id) | ^~~~~~~~~~~~~~~~~~~~~~ vim +/vtimer_mbigen_set_regs +693 drivers/irqchip/irq-mbigen.c f907c515ffb06e Hanjun Guo 2017-03-28 580 212e82b2357f91 Kunkun Jiang 2023-12-06 @581 static void vtimer_mbigen_set_kvm_info(void) 212e82b2357f91 Kunkun Jiang 2023-12-06 582 { 212e82b2357f91 Kunkun Jiang 2023-12-06 583 struct arch_timer_kvm_info *info = arch_timer_get_kvm_info(); 212e82b2357f91 Kunkun Jiang 2023-12-06 584 212e82b2357f91 Kunkun Jiang 2023-12-06 585 info->irqbypass_flag |= VT_EXPANDDEV_PROBED; 212e82b2357f91 Kunkun Jiang 2023-12-06 586 } 212e82b2357f91 Kunkun Jiang 2023-12-06 587 212e82b2357f91 Kunkun Jiang 2023-12-06 @588 static int vtimer_mbigen_chip_read_aff3(struct vtimer_mbigen_device *chip) 212e82b2357f91 Kunkun Jiang 2023-12-06 589 { 212e82b2357f91 Kunkun Jiang 2023-12-06 590 void __iomem *base = chip->base; 212e82b2357f91 Kunkun Jiang 2023-12-06 591 void __iomem *addr = base + MBIGEN_CTLR; 212e82b2357f91 Kunkun Jiang 2023-12-06 592 u32 val = readl_relaxed(addr); 212e82b2357f91 Kunkun Jiang 2023-12-06 593 212e82b2357f91 Kunkun Jiang 2023-12-06 594 return ((val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT); 212e82b2357f91 Kunkun Jiang 2023-12-06 595 } 212e82b2357f91 Kunkun Jiang 2023-12-06 596 212e82b2357f91 Kunkun Jiang 2023-12-06 @597 static int vtimer_mbigen_chip_match_cpu(struct vtimer_mbigen_device *chip) 212e82b2357f91 Kunkun Jiang 2023-12-06 598 { 212e82b2357f91 Kunkun Jiang 2023-12-06 599 int cpu; 212e82b2357f91 Kunkun Jiang 2023-12-06 600 212e82b2357f91 Kunkun Jiang 2023-12-06 601 chip->cpu_base = -1; 212e82b2357f91 Kunkun Jiang 2023-12-06 602 chip->cpu_num = 0; 212e82b2357f91 Kunkun Jiang 2023-12-06 603 212e82b2357f91 Kunkun Jiang 2023-12-06 604 for_each_possible_cpu(cpu) { 212e82b2357f91 Kunkun Jiang 2023-12-06 605 int mpidr_aff3 = MPIDR_AFFINITY_LEVEL(cpu_logical_map(cpu), 3); 212e82b2357f91 Kunkun Jiang 2023-12-06 606 212e82b2357f91 Kunkun Jiang 2023-12-06 607 if (chip->mpidr_aff3 == mpidr_aff3) { 212e82b2357f91 Kunkun Jiang 2023-12-06 608 /* get the first cpu attached to the mbigen */ 212e82b2357f91 Kunkun Jiang 2023-12-06 609 if (chip->cpu_base == -1) { 212e82b2357f91 Kunkun Jiang 2023-12-06 610 /* Make sure cpu_base is attached to PIN0 */ 212e82b2357f91 Kunkun Jiang 2023-12-06 611 u64 mpidr = cpu_logical_map(cpu); 212e82b2357f91 Kunkun Jiang 2023-12-06 612 if (!MPIDR_AFFINITY_LEVEL(mpidr, 2) && 212e82b2357f91 Kunkun Jiang 2023-12-06 613 !MPIDR_AFFINITY_LEVEL(mpidr, 1) && 212e82b2357f91 Kunkun Jiang 2023-12-06 614 !MPIDR_AFFINITY_LEVEL(mpidr, 0)) 212e82b2357f91 Kunkun Jiang 2023-12-06 615 chip->cpu_base = cpu; 212e82b2357f91 Kunkun Jiang 2023-12-06 616 } 212e82b2357f91 Kunkun Jiang 2023-12-06 617 212e82b2357f91 Kunkun Jiang 2023-12-06 618 chip->cpu_num++; 212e82b2357f91 Kunkun Jiang 2023-12-06 619 /* 212e82b2357f91 Kunkun Jiang 2023-12-06 620 * check if this cpu has already 212e82b2357f91 Kunkun Jiang 2023-12-06 621 * attached to another mbigen 212e82b2357f91 Kunkun Jiang 2023-12-06 622 */ 212e82b2357f91 Kunkun Jiang 2023-12-06 623 if (cpumask_test_and_set_cpu(cpu, &vtimer_cpu_mask)) { 212e82b2357f91 Kunkun Jiang 2023-12-06 624 WARN_ON_ONCE(1); 212e82b2357f91 Kunkun Jiang 2023-12-06 625 return -EINVAL; 212e82b2357f91 Kunkun Jiang 2023-12-06 626 } 212e82b2357f91 Kunkun Jiang 2023-12-06 627 } 212e82b2357f91 Kunkun Jiang 2023-12-06 628 } 212e82b2357f91 Kunkun Jiang 2023-12-06 629 212e82b2357f91 Kunkun Jiang 2023-12-06 630 if (chip->cpu_base == -1 || chip->cpu_num > IRQS_PER_MBIGEN_NODE) 212e82b2357f91 Kunkun Jiang 2023-12-06 631 return -EINVAL; 212e82b2357f91 Kunkun Jiang 2023-12-06 632 212e82b2357f91 Kunkun Jiang 2023-12-06 633 return 0; 212e82b2357f91 Kunkun Jiang 2023-12-06 634 } 212e82b2357f91 Kunkun Jiang 2023-12-06 635 212e82b2357f91 Kunkun Jiang 2023-12-06 @636 static bool is_mbigen_vtimer_bypass_enabled(struct mbigen_device *mgn_chip) 212e82b2357f91 Kunkun Jiang 2023-12-06 637 { 212e82b2357f91 Kunkun Jiang 2023-12-06 638 void __iomem *base = mgn_chip->base; 212e82b2357f91 Kunkun Jiang 2023-12-06 639 void __iomem *addr = base + MBIGEN_NODE_CFG_OFFSET; 212e82b2357f91 Kunkun Jiang 2023-12-06 640 u32 val = readl_relaxed(addr); 212e82b2357f91 Kunkun Jiang 2023-12-06 641 212e82b2357f91 Kunkun Jiang 2023-12-06 642 return ((val & MBIGEN_TYPE_MASK) >> MBIGEN_TYPE_SHIFT) 212e82b2357f91 Kunkun Jiang 2023-12-06 643 == TYPE_VTIMER_ENABLED; 212e82b2357f91 Kunkun Jiang 2023-12-06 644 } 212e82b2357f91 Kunkun Jiang 2023-12-06 645 212e82b2357f91 Kunkun Jiang 2023-12-06 646 /** 212e82b2357f91 Kunkun Jiang 2023-12-06 647 * MBIX_VPPI_ITS_TA: Indicates the address of the ITS corresponding 212e82b2357f91 Kunkun Jiang 2023-12-06 648 * to the mbigen. 212e82b2357f91 Kunkun Jiang 2023-12-06 649 */ 212e82b2357f91 Kunkun Jiang 2023-12-06 650 #define MBIX_VPPI_ITS_TA 0x0038 212e82b2357f91 Kunkun Jiang 2023-12-06 @651 static bool vtimer_mbigen_should_probe(struct mbigen_device *mgn_chip) 212e82b2357f91 Kunkun Jiang 2023-12-06 652 { 212e82b2357f91 Kunkun Jiang 2023-12-06 653 unsigned int mpidr_aff3; 212e82b2357f91 Kunkun Jiang 2023-12-06 654 struct vtimer_mbigen_device *chip; 212e82b2357f91 Kunkun Jiang 2023-12-06 655 void __iomem *addr; 212e82b2357f91 Kunkun Jiang 2023-12-06 656 u32 val; 212e82b2357f91 Kunkun Jiang 2023-12-06 657 212e82b2357f91 Kunkun Jiang 2023-12-06 658 /* find the valid mbigen */ 212e82b2357f91 Kunkun Jiang 2023-12-06 659 addr = mgn_chip->base + MBIX_VPPI_ITS_TA; 212e82b2357f91 Kunkun Jiang 2023-12-06 660 val = readl_relaxed(addr); 212e82b2357f91 Kunkun Jiang 2023-12-06 661 if (!val) 212e82b2357f91 Kunkun Jiang 2023-12-06 662 return false; 212e82b2357f91 Kunkun Jiang 2023-12-06 663 212e82b2357f91 Kunkun Jiang 2023-12-06 664 addr = mgn_chip->base + MBIGEN_CTLR; 212e82b2357f91 Kunkun Jiang 2023-12-06 665 val = readl_relaxed(addr); 212e82b2357f91 Kunkun Jiang 2023-12-06 666 mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; 212e82b2357f91 Kunkun Jiang 2023-12-06 667 list_for_each_entry(chip, &vtimer_mgn_list, entry) { 212e82b2357f91 Kunkun Jiang 2023-12-06 668 if (chip->mpidr_aff3 == mpidr_aff3) 212e82b2357f91 Kunkun Jiang 2023-12-06 669 return false; 212e82b2357f91 Kunkun Jiang 2023-12-06 670 } 212e82b2357f91 Kunkun Jiang 2023-12-06 671 212e82b2357f91 Kunkun Jiang 2023-12-06 672 return true; 212e82b2357f91 Kunkun Jiang 2023-12-06 673 } 212e82b2357f91 Kunkun Jiang 2023-12-06 674 473e1b802231d7 Kunkun Jiang 2023-12-06 675 #define CHIP0_TA_MBIGEN_PHY_BASE 0x4604400000 473e1b802231d7 Kunkun Jiang 2023-12-06 676 #define CHIP0_TA_MBIGEN_ITS_BASE 0x84028 473e1b802231d7 Kunkun Jiang 2023-12-06 677 #define CHIP0_TA_PERI_PHY_BASE 0x4614002018 473e1b802231d7 Kunkun Jiang 2023-12-06 678 473e1b802231d7 Kunkun Jiang 2023-12-06 679 #define CHIP0_TB_MBIGEN_PHY_BASE 0xc604400000 473e1b802231d7 Kunkun Jiang 2023-12-06 680 #define CHIP0_TB_PERI_PHY_BASE 0xc614002018 473e1b802231d7 Kunkun Jiang 2023-12-06 681 #define CHIP0_TB_MBIGEN_ITS_BASE 0x4028 473e1b802231d7 Kunkun Jiang 2023-12-06 682 473e1b802231d7 Kunkun Jiang 2023-12-06 683 #define CHIP1_TA_MBIGEN_PHY_BASE 0x204604400000 473e1b802231d7 Kunkun Jiang 2023-12-06 684 #define CHIP1_TA_PERI_PHY_BASE 0x204614002018 473e1b802231d7 Kunkun Jiang 2023-12-06 685 #define CHIP1_TA_MBIGEN_ITS_BASE 0x2084028 473e1b802231d7 Kunkun Jiang 2023-12-06 686 473e1b802231d7 Kunkun Jiang 2023-12-06 687 #define CHIP1_TB_MBIGEN_PHY_BASE 0x20c604400000 473e1b802231d7 Kunkun Jiang 2023-12-06 688 #define CHIP1_TB_MBIGEN_ITS_BASE 0x2004028 473e1b802231d7 Kunkun Jiang 2023-12-06 689 #define CHIP1_TB_PERI_PHY_BASE 0x20c614002018 473e1b802231d7 Kunkun Jiang 2023-12-06 690 473e1b802231d7 Kunkun Jiang 2023-12-06 691 extern bool vtimer_irqbypass; 473e1b802231d7 Kunkun Jiang 2023-12-06 692 473e1b802231d7 Kunkun Jiang 2023-12-06 @693 static int vtimer_mbigen_set_regs(struct platform_device *pdev) 473e1b802231d7 Kunkun Jiang 2023-12-06 694 { 473e1b802231d7 Kunkun Jiang 2023-12-06 695 struct mbigen_device *mgn_chip = platform_get_drvdata(pdev); 473e1b802231d7 Kunkun Jiang 2023-12-06 696 struct resource *res; 473e1b802231d7 Kunkun Jiang 2023-12-06 697 void __iomem *addr; 473e1b802231d7 Kunkun Jiang 2023-12-06 698 unsigned int mpidr_aff3; 473e1b802231d7 Kunkun Jiang 2023-12-06 699 u32 val; 473e1b802231d7 Kunkun Jiang 2023-12-06 700 struct vtimer_mbigen_device *chip; 473e1b802231d7 Kunkun Jiang 2023-12-06 701 473e1b802231d7 Kunkun Jiang 2023-12-06 702 addr = mgn_chip->base + MBIGEN_CTLR; 473e1b802231d7 Kunkun Jiang 2023-12-06 703 val = readl_relaxed(addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 704 mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; 473e1b802231d7 Kunkun Jiang 2023-12-06 705 list_for_each_entry(chip, &vtimer_mgn_list, entry) { 473e1b802231d7 Kunkun Jiang 2023-12-06 706 if (chip->mpidr_aff3 == mpidr_aff3) 473e1b802231d7 Kunkun Jiang 2023-12-06 707 return 0; 473e1b802231d7 Kunkun Jiang 2023-12-06 708 } 473e1b802231d7 Kunkun Jiang 2023-12-06 709 473e1b802231d7 Kunkun Jiang 2023-12-06 710 res = platform_get_resource(pdev, IORESOURCE_MEM, 0); 473e1b802231d7 Kunkun Jiang 2023-12-06 711 if (!mgn_chip) 473e1b802231d7 Kunkun Jiang 2023-12-06 712 return -ENOMEM; 473e1b802231d7 Kunkun Jiang 2023-12-06 713 473e1b802231d7 Kunkun Jiang 2023-12-06 714 if (res->start == CHIP0_TA_MBIGEN_PHY_BASE) { 473e1b802231d7 Kunkun Jiang 2023-12-06 715 addr = ioremap(CHIP0_TA_PERI_PHY_BASE, 4); 473e1b802231d7 Kunkun Jiang 2023-12-06 716 if (!addr) { 473e1b802231d7 Kunkun Jiang 2023-12-06 717 pr_err("Unable to map CHIP0-TA-PERI\n"); 473e1b802231d7 Kunkun Jiang 2023-12-06 718 return -ENOMEM; 473e1b802231d7 Kunkun Jiang 2023-12-06 719 } 473e1b802231d7 Kunkun Jiang 2023-12-06 720 473e1b802231d7 Kunkun Jiang 2023-12-06 721 writel_relaxed(1, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 722 iounmap(addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 723 473e1b802231d7 Kunkun Jiang 2023-12-06 724 addr = mgn_chip->base + MBIX_VPPI_ITS_TA; 473e1b802231d7 Kunkun Jiang 2023-12-06 725 writel_relaxed(CHIP0_TA_MBIGEN_ITS_BASE, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 726 } 473e1b802231d7 Kunkun Jiang 2023-12-06 727 473e1b802231d7 Kunkun Jiang 2023-12-06 728 if (res->start == CHIP0_TB_MBIGEN_PHY_BASE) { 473e1b802231d7 Kunkun Jiang 2023-12-06 729 addr = ioremap(CHIP0_TB_PERI_PHY_BASE, 4); 473e1b802231d7 Kunkun Jiang 2023-12-06 730 if (!addr) { 473e1b802231d7 Kunkun Jiang 2023-12-06 731 pr_err("Unable to map CHIP0-TB-PERI\n"); 473e1b802231d7 Kunkun Jiang 2023-12-06 732 return -ENOMEM; 473e1b802231d7 Kunkun Jiang 2023-12-06 733 } 473e1b802231d7 Kunkun Jiang 2023-12-06 734 473e1b802231d7 Kunkun Jiang 2023-12-06 735 writel_relaxed(1, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 736 iounmap(addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 737 473e1b802231d7 Kunkun Jiang 2023-12-06 738 addr = mgn_chip->base + MBIX_VPPI_ITS_TA; 473e1b802231d7 Kunkun Jiang 2023-12-06 739 writel_relaxed(CHIP0_TB_MBIGEN_ITS_BASE, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 740 } 473e1b802231d7 Kunkun Jiang 2023-12-06 741 473e1b802231d7 Kunkun Jiang 2023-12-06 742 if (res->start == CHIP1_TA_MBIGEN_PHY_BASE) { 473e1b802231d7 Kunkun Jiang 2023-12-06 743 addr = ioremap(CHIP1_TA_PERI_PHY_BASE, 4); 473e1b802231d7 Kunkun Jiang 2023-12-06 744 if (!addr) { 473e1b802231d7 Kunkun Jiang 2023-12-06 745 pr_err("Unable to map CHIP1-TA-PERI\n"); 473e1b802231d7 Kunkun Jiang 2023-12-06 746 return -ENOMEM; 473e1b802231d7 Kunkun Jiang 2023-12-06 747 } 473e1b802231d7 Kunkun Jiang 2023-12-06 748 473e1b802231d7 Kunkun Jiang 2023-12-06 749 writel_relaxed(1, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 750 iounmap(addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 751 473e1b802231d7 Kunkun Jiang 2023-12-06 752 addr = mgn_chip->base + MBIX_VPPI_ITS_TA; 473e1b802231d7 Kunkun Jiang 2023-12-06 753 writel_relaxed(CHIP1_TA_MBIGEN_ITS_BASE, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 754 } 473e1b802231d7 Kunkun Jiang 2023-12-06 755 473e1b802231d7 Kunkun Jiang 2023-12-06 756 if (res->start == CHIP1_TB_MBIGEN_PHY_BASE) { 473e1b802231d7 Kunkun Jiang 2023-12-06 757 addr = ioremap(CHIP1_TB_PERI_PHY_BASE, 4); 473e1b802231d7 Kunkun Jiang 2023-12-06 758 if (!addr) { 473e1b802231d7 Kunkun Jiang 2023-12-06 759 pr_err("Unable to map CHIP1-TB-PERI\n"); 473e1b802231d7 Kunkun Jiang 2023-12-06 760 return -ENOMEM; 473e1b802231d7 Kunkun Jiang 2023-12-06 761 } 473e1b802231d7 Kunkun Jiang 2023-12-06 762 473e1b802231d7 Kunkun Jiang 2023-12-06 763 writel_relaxed(1, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 764 iounmap(addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 765 473e1b802231d7 Kunkun Jiang 2023-12-06 766 addr = mgn_chip->base + MBIX_VPPI_ITS_TA; 473e1b802231d7 Kunkun Jiang 2023-12-06 767 writel_relaxed(CHIP1_TB_MBIGEN_ITS_BASE, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 768 } 473e1b802231d7 Kunkun Jiang 2023-12-06 769 473e1b802231d7 Kunkun Jiang 2023-12-06 770 return 0; 473e1b802231d7 Kunkun Jiang 2023-12-06 771 } 473e1b802231d7 Kunkun Jiang 2023-12-06 772 :::::: The code at line 693 was first introduced by commit :::::: 473e1b802231d790ba8eb31c0597d5b8eba306d6 mbigen: Sets the regs related to vtimer irqbypass :::::: TO: Kunkun Jiang <jiangkunkun(a)huawei.com> :::::: CC: Dongxu Sun <sundongxu3(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] iommufd: Require drivers to supply the cache_invalidate_user ops
by Lin Ruifeng 28 Oct '24

28 Oct '24

From: Jason Gunthorpe <jgg(a)nvidia.com> stable inclusion from stable-v6.10.10 commit 89827a4de802765b1ebb401fc1e73a90108c7520 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9LS CVE: CVE-2024-46824 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a11dda723c6493bb1853bbc61c093377f96e2d47 ] If drivers don't do this then iommufd will oops invalidation ioctls with something like: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000086000004 EC = 0x21: IABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101059000 [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 371 Comm: qemu-system-aar Not tainted 6.8.0-rc7-gde77230ac23a #9 Hardware name: linux,dummy-virt (DT) pstate: 81400809 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=-c) pc : 0x0 lr : iommufd_hwpt_invalidate+0xa4/0x204 sp : ffff800080f3bcc0 x29: ffff800080f3bcf0 x28: ffff0000c369b300 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000000000000 x22: 00000000c1e334a0 x21: ffff0000c1e334a0 x20: ffff800080f3bd38 x19: ffff800080f3bd58 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffff8240d6d8 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000001000000002 x7 : 0000fffeac1ec950 x6 : 0000000000000000 x5 : ffff800080f3bd78 x4 : 0000000000000003 x3 : 0000000000000002 x2 : 0000000000000000 x1 : ffff800080f3bcc8 x0 : ffff0000c6034d80 Call trace: 0x0 iommufd_fops_ioctl+0x154/0x274 __arm64_sys_ioctl+0xac/0xf0 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xb4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x190/0x194 All existing drivers implement this op for nesting, this is mostly a bisection aid. Fixes: 8c6eabae3807 ("iommufd: Add IOMMU_HWPT_INVALIDATE") Link: https://lore.kernel.org/r/0-v1-e153859bd707+61-iommufd_check_ops_jgg@nvidia… Reviewed-by: Nicolin Chen <nicolinc(a)nvidia.com> Reviewed-by: Yi Liu <yi.l.liu(a)intel.com> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/iommu/iommufd/hw_pagetable.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/iommufd/hw_pagetable.c b/drivers/iommu/iommufd/hw_pagetable.c index 33d142f8057d..a9f1fe44c4c0 100644 --- a/drivers/iommu/iommufd/hw_pagetable.c +++ b/drivers/iommu/iommufd/hw_pagetable.c @@ -236,7 +236,8 @@ iommufd_hwpt_nested_alloc(struct iommufd_ctx *ictx, } hwpt->domain->owner = ops; - if (WARN_ON_ONCE(hwpt->domain->type != IOMMU_DOMAIN_NESTED)) { + if (WARN_ON_ONCE(hwpt->domain->type != IOMMU_DOMAIN_NESTED || + !hwpt->domain->ops->cache_invalidate_user)) { rc = -EINVAL; goto out_abort; } -- 2.17.1

2 1

[PATCH OLK-5.10] drm/amd/display: Check null pointer before dereferencing se
by Xiaomeng Zhang 28 Oct '24

28 Oct '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit ff599ef6970ee000fa5bc38d02fa5ff5f3fc7575 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZM9W Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [WHAT & HOW] se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again. This fixes 1 FORWARD_NULL issue reported by Coverity. Acked-by: Alex Hung <alex.hung(a)amd.com> Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index adcf5ba83703..c172622365d3 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1252,7 +1252,7 @@ bool dc_validate_seamless_boot_timing(const struct dc *dc, if (crtc_timing->pix_clk_100hz != pix_clk_100hz) return false; - if (!se->funcs->dp_get_pixel_format) + if (!se || !se->funcs->dp_get_pixel_format) return false; if (!se->funcs->dp_get_pixel_format( -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Check null pointer before dereferencing se
by Xiaomeng Zhang 28 Oct '24

28 Oct '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit ff599ef6970ee000fa5bc38d02fa5ff5f3fc7575 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZM9W Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [WHAT & HOW] se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again. This fixes 1 FORWARD_NULL issue reported by Coverity. Acked-by: Alex Hung <alex.hung(a)amd.com> Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index ddbfce8390bb..3c350c76790a 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1251,7 +1251,7 @@ bool dc_validate_seamless_boot_timing(const struct dc *dc, if (crtc_timing->pix_clk_100hz != pix_clk_100hz) return false; - if (!se->funcs->dp_get_pixel_format) + if (!se || !se->funcs->dp_get_pixel_format) return false; if (!se->funcs->dp_get_pixel_format( -- 2.34.1

2 1

[PATCH OLK-5.10] scsi: fnic: Move flush_work initialization out of if block
by GONG Ruiqi 28 Oct '24

28 Oct '24

From: Martin Wilck <martin.wilck(a)suse.com> mainline inclusion from mainline-v6.12-rc3 commit f30e5f77d2f205ac14d09dec40fd4bb76712f13d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRJ6 CVE: CVE-2024-50025 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- After commit 379a58caa199 ("scsi: fnic: Move fnic_fnic_flush_tx() to a work queue"), it can happen that a work item is sent to an uninitialized work queue. This may has the effect that the item being queued is never actually queued, and any further actions depending on it will not proceed. The following warning is observed while the fnic driver is loaded: kernel: WARNING: CPU: 11 PID: 0 at ../kernel/workqueue.c:1524 __queue_work+0x373/0x410 kernel: <IRQ> kernel: queue_work_on+0x3a/0x50 kernel: fnic_wq_copy_cmpl_handler+0x54a/0x730 [fnic 62fbff0c42e7fb825c60a55cde2fb91facb2ed24] kernel: fnic_isr_msix_wq_copy+0x2d/0x60 [fnic 62fbff0c42e7fb825c60a55cde2fb91facb2ed24] kernel: __handle_irq_event_percpu+0x36/0x1a0 kernel: handle_irq_event_percpu+0x30/0x70 kernel: handle_irq_event+0x34/0x60 kernel: handle_edge_irq+0x7e/0x1a0 kernel: __common_interrupt+0x3b/0xb0 kernel: common_interrupt+0x58/0xa0 kernel: </IRQ> It has been observed that this may break the rediscovery of Fibre Channel devices after a temporary fabric failure. This patch fixes it by moving the work queue initialization out of an if block in fnic_probe(). Signed-off-by: Martin Wilck <mwilck(a)suse.com> Fixes: 379a58caa199 ("scsi: fnic: Move fnic_fnic_flush_tx() to a work queue") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240930133014.71615-1-mwilck@suse.com Reviewed-by: Lee Duncan <lduncan(a)suse.com> Reviewed-by: Karan Tilak Kumar <kartilak(a)cisco.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- drivers/scsi/fnic/fnic_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c index 16c2cdacd0a6..580ee456eab3 100644 --- a/drivers/scsi/fnic/fnic_main.c +++ b/drivers/scsi/fnic/fnic_main.c @@ -776,7 +776,6 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) spin_lock_init(&fnic->vlans_lock); INIT_WORK(&fnic->fip_frame_work, fnic_handle_fip_frame); INIT_WORK(&fnic->event_work, fnic_handle_event); - INIT_WORK(&fnic->flush_work, fnic_flush_tx); skb_queue_head_init(&fnic->fip_frame_queue); INIT_LIST_HEAD(&fnic->evlist); INIT_LIST_HEAD(&fnic->vlans); @@ -877,6 +876,7 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) INIT_WORK(&fnic->link_work, fnic_handle_link); INIT_WORK(&fnic->frame_work, fnic_handle_frame); + INIT_WORK(&fnic->flush_work, fnic_flush_tx); skb_queue_head_init(&fnic->frame_queue); skb_queue_head_init(&fnic->tx_queue); -- 2.25.1

2 1

[PATCH OLK-6.6] scsi: fnic: Move flush_work initialization out of if block
by GONG Ruiqi 28 Oct '24

28 Oct '24

From: Martin Wilck <martin.wilck(a)suse.com> mainline inclusion from mainline-v6.12-rc3 commit f30e5f77d2f205ac14d09dec40fd4bb76712f13d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRJ6 CVE: CVE-2024-50025 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- After commit 379a58caa199 ("scsi: fnic: Move fnic_fnic_flush_tx() to a work queue"), it can happen that a work item is sent to an uninitialized work queue. This may has the effect that the item being queued is never actually queued, and any further actions depending on it will not proceed. The following warning is observed while the fnic driver is loaded: kernel: WARNING: CPU: 11 PID: 0 at ../kernel/workqueue.c:1524 __queue_work+0x373/0x410 kernel: <IRQ> kernel: queue_work_on+0x3a/0x50 kernel: fnic_wq_copy_cmpl_handler+0x54a/0x730 [fnic 62fbff0c42e7fb825c60a55cde2fb91facb2ed24] kernel: fnic_isr_msix_wq_copy+0x2d/0x60 [fnic 62fbff0c42e7fb825c60a55cde2fb91facb2ed24] kernel: __handle_irq_event_percpu+0x36/0x1a0 kernel: handle_irq_event_percpu+0x30/0x70 kernel: handle_irq_event+0x34/0x60 kernel: handle_edge_irq+0x7e/0x1a0 kernel: __common_interrupt+0x3b/0xb0 kernel: common_interrupt+0x58/0xa0 kernel: </IRQ> It has been observed that this may break the rediscovery of Fibre Channel devices after a temporary fabric failure. This patch fixes it by moving the work queue initialization out of an if block in fnic_probe(). Signed-off-by: Martin Wilck <mwilck(a)suse.com> Fixes: 379a58caa199 ("scsi: fnic: Move fnic_fnic_flush_tx() to a work queue") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240930133014.71615-1-mwilck@suse.com Reviewed-by: Lee Duncan <lduncan(a)suse.com> Reviewed-by: Karan Tilak Kumar <kartilak(a)cisco.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- drivers/scsi/fnic/fnic_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c index de369bb03e3e..e85bbdf5ebae 100644 --- a/drivers/scsi/fnic/fnic_main.c +++ b/drivers/scsi/fnic/fnic_main.c @@ -792,7 +792,6 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) spin_lock_init(&fnic->vlans_lock); INIT_WORK(&fnic->fip_frame_work, fnic_handle_fip_frame); INIT_WORK(&fnic->event_work, fnic_handle_event); - INIT_WORK(&fnic->flush_work, fnic_flush_tx); skb_queue_head_init(&fnic->fip_frame_queue); INIT_LIST_HEAD(&fnic->evlist); INIT_LIST_HEAD(&fnic->vlans); @@ -893,6 +892,7 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) INIT_WORK(&fnic->link_work, fnic_handle_link); INIT_WORK(&fnic->frame_work, fnic_handle_frame); + INIT_WORK(&fnic->flush_work, fnic_flush_tx); skb_queue_head_init(&fnic->frame_queue); skb_queue_head_init(&fnic->tx_queue); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] fix CVE-2024-47699
by Zhang Kunbo 28 Oct '24

28 Oct '24

This addresses three potential issues with empty b-tree nodes that can occur with corrupted filesystem images, including one recently discovered by syzbot. Ryusuke Konishi (3): nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() nilfs2: determine empty node blocks as corrupted nilfs2: fix potential oob read in nilfs_btree_check_delete() fs/nilfs2/btree.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-1.0-LTS] pinctrl: single: fix potential NULL dereference in pcs_get_function()
by Zhang Zekun 28 Oct '24

28 Oct '24

From: Ma Ke <make24(a)iscas.ac.cn> mainline inclusion from mainline-v6.11-rc6 commit 1c38a62f15e595346a1106025722869e87ffe044 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR49K CVE: CVE-2024-46685 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------- pinmux_generic_get_function() can return NULL and the pointer 'function' was dereferenced without checking against NULL. Add checking of pointer 'function' in pcs_get_function(). Found by code review. Cc: stable(a)vger.kernel.org Fixes: 571aec4df5b7 ("pinctrl: single: Use generic pinmux helpers for managing functions") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Link: https://lore.kernel.org/20240808041355.2766009-1-make24@iscas.ac.cn Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/pinctrl/pinctrl-single.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c index 2958758935ed..4aea8e10aea7 100644 --- a/drivers/pinctrl/pinctrl-single.c +++ b/drivers/pinctrl/pinctrl-single.c @@ -323,6 +323,8 @@ static int pcs_get_function(struct pinctrl_dev *pctldev, unsigned pin, return -ENOTSUPP; fselector = setting->func; function = pinmux_generic_get_function(pctldev, fselector); + if (!function) + return -EINVAL; *func = function->data; if (!(*func)) { dev_err(pcs->dev, "%s could not find function%i\n", -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] of/irq: Prevent device address out-of-bounds read in interrupt map walk
by Zhang Zekun 28 Oct '24

28 Oct '24

From: Stefan Wiehler <stefan.wiehler(a)nokia.com> mainline inclusion from mainline-v6.11-rc4 commit b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWTE CVE: CVE-2024-46743 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------------- When of_irq_parse_raw() is invoked with a device address smaller than the interrupt parent node (from #address-cells property), KASAN detects the following out-of-bounds read when populating the initial match table (dyndbg="func of_irq_parse_* +p"): OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0 OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2 OF: intspec=4 OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2 OF: -> addrsize=3 ================================================================== BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0 Read of size 4 at addr ffffff81beca5608 by task bash/764 CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokia_sm_arm64 #1 Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023 Call trace: dump_backtrace+0xdc/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0x6c/0x84 print_report+0x150/0x448 kasan_report+0x98/0x140 __asan_load4+0x78/0xa0 of_irq_parse_raw+0x2b8/0x8d0 of_irq_parse_one+0x24c/0x270 parse_interrupts+0xc0/0x120 of_fwnode_add_links+0x100/0x2d0 fw_devlink_parse_fwtree+0x64/0xc0 device_add+0xb38/0xc30 of_device_add+0x64/0x90 of_platform_device_create_pdata+0xd0/0x170 of_platform_bus_create+0x244/0x600 of_platform_notify+0x1b0/0x254 blocking_notifier_call_chain+0x9c/0xd0 __of_changeset_entry_notify+0x1b8/0x230 __of_changeset_apply_notify+0x54/0xe4 of_overlay_fdt_apply+0xc04/0xd94 ... The buggy address belongs to the object at ffffff81beca5600 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 8 bytes inside of 128-byte region [ffffff81beca5600, ffffff81beca5680) The buggy address belongs to the physical page: page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4 head:00000000230d3d03 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x8000000000010200(slab|head|zone=2) raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ================================================================== OF: -> got it ! Prevent the out-of-bounds read by copying the device address into a buffer of sufficient size. Signed-off-by: Stefan Wiehler <stefan.wiehler(a)nokia.com> Link: https://lore.kernel.org/r/20240812100652.3800963-1-stefan.wiehler@nokia.com Signed-off-by: Rob Herring (Arm) <robh(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/of/irq.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index 02ad93a304a4..f06c9df60e34 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -289,7 +289,8 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar struct device_node *p; const __be32 *addr; u32 intsize; - int i, res; + int i, res, addr_len; + __be32 addr_buf[3] = { 0 }; pr_debug("of_irq_parse_one: dev=%pOF, index=%d\n", device, index); @@ -298,13 +299,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar return of_irq_parse_oldworld(device, index, out_irq); /* Get the reg property (if any) */ - addr = of_get_property(device, "reg", NULL); + addr = of_get_property(device, "reg", &addr_len); + + /* Prevent out-of-bounds read in case of longer interrupt parent address size */ + if (addr_len > (3 * sizeof(__be32))) + addr_len = 3 * sizeof(__be32); + if (addr) + memcpy(addr_buf, addr, addr_len); /* Try the new-style interrupts-extended first */ res = of_parse_phandle_with_args(device, "interrupts-extended", "#interrupt-cells", index, out_irq); if (!res) - return of_irq_parse_raw(addr, out_irq); + return of_irq_parse_raw(addr_buf, out_irq); /* Look for the interrupt parent. */ p = of_irq_find_parent(device); @@ -334,7 +341,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar /* Check if there are any interrupt-map translations to process */ - res = of_irq_parse_raw(addr, out_irq); + res = of_irq_parse_raw(addr_buf, out_irq); out: of_node_put(p); return res; -- 2.17.1

2 1

[PATCH OLK-6.6] cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value
by Bowen You 28 Oct '24

28 Oct '24

From: Anastasia Belova <abelova(a)astralinux.ru> mainline inclusion from mainline-v6.12-rc1 commit 5493f9714e4cdaf0ee7cec15899a231400cb1a9f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRBF CVE: CVE-2024-50009 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cpufreq_cpu_get may return NULL. To avoid NULL-dereference check it and return in case of error. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Anastasia Belova <abelova(a)astralinux.ru> Reviewed-by: Perry Yuan <perry.yuan(a)amd.com> Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org> Conflicts: drivers/cpufreq/amd-pstate.c [amd_pstate_update_limits is not involved, target_freq isn't removed] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/cpufreq/amd-pstate.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c index 0cec9ab94340..e119571ddd9b 100644 --- a/drivers/cpufreq/amd-pstate.c +++ b/drivers/cpufreq/amd-pstate.c @@ -579,9 +579,14 @@ static void amd_pstate_adjust_perf(unsigned int cpu, unsigned long max_perf, min_perf, des_perf, cap_perf, lowest_nonlinear_perf, max_freq; struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); - struct amd_cpudata *cpudata = policy->driver_data; + struct amd_cpudata *cpudata; unsigned int target_freq; + if (!policy) + return; + + cpudata = policy->driver_data; + if (policy->min != cpudata->min_limit_freq || policy->max != cpudata->max_limit_freq) amd_pstate_update_min_max_limit(policy); -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] fix CVE-2024-47699
by Zhang Kunbo 28 Oct '24

28 Oct '24

This addresses three potential issues with empty b-tree nodes that can occur with corrupted filesystem images, including one recently discovered by syzbot. Ryusuke Konishi (3): nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() nilfs2: determine empty node blocks as corrupted nilfs2: fix potential oob read in nilfs_btree_check_delete() fs/nilfs2/btree.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Check null pointer before dereferencing se
by Xiaomeng Zhang 28 Oct '24

28 Oct '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit ff599ef6970ee000fa5bc38d02fa5ff5f3fc7575 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZM9W Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [WHAT & HOW] se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again. This fixes 1 FORWARD_NULL issue reported by Coverity. Acked-by: Alex Hung <alex.hung(a)amd.com> Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index ddbfce8390bb..3c350c76790a 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1251,7 +1251,7 @@ bool dc_validate_seamless_boot_timing(const struct dc *dc, if (crtc_timing->pix_clk_100hz != pix_clk_100hz) return false; - if (!se->funcs->dp_get_pixel_format) + if (!se || !se->funcs->dp_get_pixel_format) return false; if (!se->funcs->dp_get_pixel_format( -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Check null pointer before dereferencing se
by Xiaomeng Zhang 28 Oct '24

28 Oct '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit ff599ef6970ee000fa5bc38d02fa5ff5f3fc7575 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZM9W Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [WHAT & HOW] se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again. This fixes 1 FORWARD_NULL issue reported by Coverity. Acked-by: Alex Hung <alex.hung(a)amd.com> Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index ddbfce8390bb..3c350c76790a 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1251,7 +1251,7 @@ bool dc_validate_seamless_boot_timing(const struct dc *dc, if (crtc_timing->pix_clk_100hz != pix_clk_100hz) return false; - if (!se->funcs->dp_get_pixel_format) + if (!se || !se->funcs->dp_get_pixel_format) return false; if (!se->funcs->dp_get_pixel_format( -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Check null pointer before dereferencing se
by Xiaomeng Zhang 28 Oct '24

28 Oct '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit ff599ef6970ee000fa5bc38d02fa5ff5f3fc7575 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZM9W Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [WHAT & HOW] se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again. This fixes 1 FORWARD_NULL issue reported by Coverity. Acked-by: Alex Hung <alex.hung(a)amd.com> Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index ddbfce8390bb..3c350c76790a 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1251,7 +1251,7 @@ bool dc_validate_seamless_boot_timing(const struct dc *dc, if (crtc_timing->pix_clk_100hz != pix_clk_100hz) return false; - if (!se->funcs->dp_get_pixel_format) + if (!se || !se->funcs->dp_get_pixel_format) return false; if (!se->funcs->dp_get_pixel_format( -- 2.34.1

2 1

[PATCH OLK-6.6] ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
by Liu Mingrui 28 Oct '24

28 Oct '24

From: robelin <robelin(a)nvidia.com> stable inclusion from stable-v5.10.226 commit 8ca21e7a27c66b95a4b215edc8e45e5d66679f9f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYAA CVE: CVE-2024-46798 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b4a90b543d9f62d3ac34ec1ab97fc5334b048565 upstream. When using kernel with the following extra config, - CONFIG_KASAN=y - CONFIG_KASAN_GENERIC=y - CONFIG_KASAN_INLINE=y - CONFIG_KASAN_VMALLOC=y - CONFIG_FRAME_WARN=4096 kernel detects that snd_pcm_suspend_all() access a freed 'snd_soc_pcm_runtime' object when the system is suspended, which leads to a use-after-free bug: [ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270 [ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330 [ 52.047785] Call trace: [ 52.047787] dump_backtrace+0x0/0x3c0 [ 52.047794] show_stack+0x34/0x50 [ 52.047797] dump_stack_lvl+0x68/0x8c [ 52.047802] print_address_description.constprop.0+0x74/0x2c0 [ 52.047809] kasan_report+0x210/0x230 [ 52.047815] __asan_report_load1_noabort+0x3c/0x50 [ 52.047820] snd_pcm_suspend_all+0x1a8/0x270 [ 52.047824] snd_soc_suspend+0x19c/0x4e0 The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before making any access. So we need to always set 'substream->runtime' to NULL everytime we kfree() it. Fixes: a72706ed8208 ("ASoC: codec2codec: remove ephemeral variables") Signed-off-by: robelin <robelin(a)nvidia.com> Signed-off-by: Sameer Pujar <spujar(a)nvidia.com> Link: https://patch.msgid.link/20240823144342.4123814-2-spujar@nvidia.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- sound/soc/soc-dapm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c index 85e3bbf7e5f0..7729f8f4d5e6 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -4018,6 +4018,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w, case SND_SOC_DAPM_POST_PMD: kfree(substream->runtime); + substream->runtime = NULL; break; default: -- 2.25.1

2 5

[PATCH OLK-6.6 0/7] Fix CVE-2024-47703
by Tengda Wu 28 Oct '24

28 Oct '24

This patchset is going to fix CVE-2024-47703, which may resulting in kernel panic. Andrii Nakryiko (2): bpf: enforce exact retval range on subprog/callback exit bpf: enforce precise retval range on program exit Tengda Wu (2): bpf: Fix kabi breakage in struct bpf_func_state bpf: Fix kabi breakage in struct bpf_insn_access_aux Xu Kuohai (3): bpf, lsm: Add disabled BPF LSM hook list bpf, lsm: Add check for BPF LSM return value bpf: Fix compare error in function retval_range_within include/linux/bpf.h | 1 + include/linux/bpf_lsm.h | 8 + include/linux/bpf_verifier.h | 8 +- kernel/bpf/bpf_lsm.c | 63 +++++++- kernel/bpf/btf.c | 5 +- kernel/bpf/verifier.c | 149 ++++++++++++------ .../selftests/bpf/progs/test_global_func15.c | 2 +- .../selftests/bpf/progs/timer_failure.c | 2 +- .../selftests/bpf/progs/user_ringbuf_fail.c | 2 +- .../bpf/progs/verifier_cgroup_inv_retcode.c | 8 +- .../bpf/progs/verifier_netfilter_retcode.c | 2 +- 11 files changed, 193 insertions(+), 57 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
by Liu Mingrui 28 Oct '24

28 Oct '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v6.6.54 commit ddf9ff244d704e1903533f7be377615ed34b83e7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPJV CVE: CVE-2024-47720 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2 ] This commit adds a null check for the set_output_gamma function pointer in the dcn30_set_output_transfer_func function. Previously, set_output_gamma was being checked for nullity at line 386, but then it was being dereferenced without any nullity check at line 401. This could potentially lead to a null pointer dereference error if set_output_gamma is indeed null. To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a nullity check for set_output_gamma before the call to set_output_gamma at line 401. If set_output_gamma is null, we log an error message and do not call the function. This fix prevents a potential null pointer dereference error. drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 dcn30_set_output_transfer_func() error: we previously assumed 'mpc->funcs->set_output_gamma' could be null (see line 386) drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c 373 bool dcn30_set_output_transfer_func(struct dc *dc, 374 struct pipe_ctx *pipe_ctx, 375 const struct dc_stream_state *stream) 376 { 377 int mpcc_id = pipe_ctx->plane_res.hubp->inst; 378 struct mpc *mpc = pipe_ctx->stream_res.opp->ctx->dc->res_pool->mpc; 379 const struct pwl_params *params = NULL; 380 bool ret = false; 381 382 /* program OGAM or 3DLUT only for the top pipe*/ 383 if (pipe_ctx->top_pipe == NULL) { 384 /*program rmu shaper and 3dlut in MPC*/ 385 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream); 386 if (ret == false && mpc->funcs->set_output_gamma) { ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If this is NULL 387 if (stream->out_transfer_func.type == TF_TYPE_HWPWL) 388 params = &stream->out_transfer_func.pwl; 389 else if (pipe_ctx->stream->out_transfer_func.type == 390 TF_TYPE_DISTRIBUTED_POINTS && 391 cm3_helper_translate_curve_to_hw_format( 392 &stream->out_transfer_func, 393 &mpc->blender_params, false)) 394 params = &mpc->blender_params; 395 /* there are no ROM LUTs in OUTGAM */ 396 if (stream->out_transfer_func.type == TF_TYPE_PREDEFINED) 397 BREAK_TO_DEBUGGER(); 398 } 399 } 400 --> 401 mpc->funcs->set_output_gamma(mpc, mpcc_id, params); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Then it will crash 402 return ret; 403 } Fixes: d99f13878d6f ("drm/amd/display: Add DCN3 HWSEQ") Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Hersen Wu <hersenxs.wu(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c index 22c77e96f6a5..1a5e8ee63cf3 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c @@ -210,7 +210,11 @@ bool dcn30_set_output_transfer_func(struct dc *dc, } } - mpc->funcs->set_output_gamma(mpc, mpcc_id, params); + if (mpc->funcs->set_output_gamma) + mpc->funcs->set_output_gamma(mpc, mpcc_id, params); + else + DC_LOG_ERROR("%s: set_output_gamma function pointer is NULL.\n", __func__); + return ret; } -- 2.25.1

2 1

[PATCH OLK-5.10] drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
by Liu Mingrui 28 Oct '24

28 Oct '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v6.6.54 commit ddf9ff244d704e1903533f7be377615ed34b83e7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPJV CVE: CVE-2024-47720 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2 ] This commit adds a null check for the set_output_gamma function pointer in the dcn30_set_output_transfer_func function. Previously, set_output_gamma was being checked for nullity at line 386, but then it was being dereferenced without any nullity check at line 401. This could potentially lead to a null pointer dereference error if set_output_gamma is indeed null. To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a nullity check for set_output_gamma before the call to set_output_gamma at line 401. If set_output_gamma is null, we log an error message and do not call the function. This fix prevents a potential null pointer dereference error. drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 dcn30_set_output_transfer_func() error: we previously assumed 'mpc->funcs->set_output_gamma' could be null (see line 386) drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c 373 bool dcn30_set_output_transfer_func(struct dc *dc, 374 struct pipe_ctx *pipe_ctx, 375 const struct dc_stream_state *stream) 376 { 377 int mpcc_id = pipe_ctx->plane_res.hubp->inst; 378 struct mpc *mpc = pipe_ctx->stream_res.opp->ctx->dc->res_pool->mpc; 379 const struct pwl_params *params = NULL; 380 bool ret = false; 381 382 /* program OGAM or 3DLUT only for the top pipe*/ 383 if (pipe_ctx->top_pipe == NULL) { 384 /*program rmu shaper and 3dlut in MPC*/ 385 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream); 386 if (ret == false && mpc->funcs->set_output_gamma) { ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If this is NULL 387 if (stream->out_transfer_func.type == TF_TYPE_HWPWL) 388 params = &stream->out_transfer_func.pwl; 389 else if (pipe_ctx->stream->out_transfer_func.type == 390 TF_TYPE_DISTRIBUTED_POINTS && 391 cm3_helper_translate_curve_to_hw_format( 392 &stream->out_transfer_func, 393 &mpc->blender_params, false)) 394 params = &mpc->blender_params; 395 /* there are no ROM LUTs in OUTGAM */ 396 if (stream->out_transfer_func.type == TF_TYPE_PREDEFINED) 397 BREAK_TO_DEBUGGER(); 398 } 399 } 400 --> 401 mpc->funcs->set_output_gamma(mpc, mpcc_id, params); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Then it will crash 402 return ret; 403 } Fixes: d99f13878d6f ("drm/amd/display: Add DCN3 HWSEQ") Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Hersen Wu <hersenxs.wu(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c index 22c77e96f6a5..1a5e8ee63cf3 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c @@ -210,7 +210,11 @@ bool dcn30_set_output_transfer_func(struct dc *dc, } } - mpc->funcs->set_output_gamma(mpc, mpcc_id, params); + if (mpc->funcs->set_output_gamma) + mpc->funcs->set_output_gamma(mpc, mpcc_id, params); + else + DC_LOG_ERROR("%s: set_output_gamma function pointer is NULL.\n", __func__); + return ret; } -- 2.25.1

2 1

[PATCH v4 OLK-6.6] KVM:arm64:Add a kvm module param to get current enabled GIC version
by ni-zhiqiang111 28 Oct '24

28 Oct '24

From: Yanan Wang <wangyanan55(a)huawei.com> virt inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAR5EZ CVE: NA -------------------------------- Using GICv4.1 is not a 100% win in all scenarios, sometimes we need to use different GIC version in different usecases. Given that there is not a straight forward way to check the GIC version that system is using (e.g., kernel messages may be overridden with time elapses), let's add a module param in KVM such that userspace can check the GIC version simply by reading /sys/module/kvm/parameters/gic_version. Signed-off-by: Yanan Wang <wangyanan55(a)huawei.com> Signed-off-by: Zhiqiang Ni <nizhiqiang1(a)huawei.com> --- arch/arm64/kvm/vgic/vgic-v3.c | 32 ++++++++++++++++++++++++++++++++ arch/arm64/kvm/vgic/vgic.h | 9 +++++++++ 2 files changed, 41 insertions(+) diff --git a/arch/arm64/kvm/vgic/vgic-v3.c b/arch/arm64/kvm/vgic/vgic-v3.c index dab599e857b5..1f37ae886f86 100644 --- a/arch/arm64/kvm/vgic/vgic-v3.c +++ b/arch/arm64/kvm/vgic/vgic-v3.c @@ -20,6 +20,32 @@ static bool common_trap; static bool dir_trap; static bool gicv4_enable; +enum GIC_VERSION global_gic_version = UNKNOWN_GIC_VERSION; + +static int get_gic_version(char *buffer, const struct kernel_param *kp); +static const struct kernel_param_ops gic_version_ops = { + .get = get_gic_version, +}; + +static const char *gic_version; +module_param_cb(gic_version, &gic_version_ops, &gic_version, 0444); + +static int get_gic_version(char *buffer, const struct kernel_param *kp) +{ + int index = global_gic_version; + const char * const gic_version_str[] = { + "GICv2", + "GICv3", + "GICv4", + "GICv4.1", + "unknown" + }; + + gic_version = gic_version_str[index]; + + return param_get_charp(buffer, kp); +} + void vgic_v3_set_underflow(struct kvm_vcpu *vcpu) { struct vgic_v3_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v3; @@ -654,6 +680,7 @@ int vgic_v3_probe(const struct gic_kvm_info *info) kvm_vgic_global_state.nr_lr = (ich_vtr_el2 & 0xf) + 1; kvm_vgic_global_state.can_emulate_gicv2 = false; kvm_vgic_global_state.ich_vtr_el2 = ich_vtr_el2; + global_gic_version = GICV3; /* GICv4 support? */ if (info->has_v4) { @@ -663,6 +690,11 @@ int vgic_v3_probe(const struct gic_kvm_info *info) kvm_vgic_global_state.has_gicv4_1 ? ".1" : "", gicv4_enable ? "en" : "dis"); + if (kvm_vgic_global_state.has_gicv4_1) + global_gic_version = GICV4_1; + else if (kvm_vgic_global_state.has_gicv4) + global_gic_version = GICV4; + #ifdef CONFIG_VIRT_VTIMER_IRQ_BYPASS kvm_vgic_global_state.has_direct_vtimer = info->has_vtimer && gicv4_enable; if (kvm_vgic_global_state.has_direct_vtimer) diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h index f78c026c20f0..a9e420eece0c 100644 --- a/arch/arm64/kvm/vgic/vgic.h +++ b/arch/arm64/kvm/vgic/vgic.h @@ -157,6 +157,15 @@ static inline bool vgic_direct_sgi_or_ppi(struct vgic_irq *irq) #endif } +enum GIC_VERSION { + GICV2, + GICV3, + GICV4, + GICV4_1, + UNKNOWN_GIC_VERSION +}; +extern enum GIC_VERSION global_gic_version; + /* * This struct provides an intermediate representation of the fields contained * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC -- 2.43.0

2 1

[PATCH openEuler-22.03-LTS-SP1] gpio: amd8111: Fix PCI device reference count leak
by Liu Mingrui 28 Oct '24

28 Oct '24

From: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> stable inclusion from stable-v4.19.269 commit b2bc053ebbba57a06fa655db5ea796de2edce445 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRFI CVE: CVE-2022-48973 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 45fecdb9f658d9c82960c98240bc0770ade19aca ] for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. Add the missing pci_dev_put() after the 'out' label. Since pci_dev_put() can handle NULL input parameter, there is no problem for the 'Device not found' branch. For the normal path, add pci_dev_put() in amd_gpio_exit(). Fixes: f942a7de047d ("gpio: add a driver for GPIO pins found on AMD-8111 south bridge chips") Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/gpio/gpio-amd8111.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpio/gpio-amd8111.c b/drivers/gpio/gpio-amd8111.c index fdcebe59510d..68d95051dd0e 100644 --- a/drivers/gpio/gpio-amd8111.c +++ b/drivers/gpio/gpio-amd8111.c @@ -231,7 +231,10 @@ static int __init amd_gpio_init(void) ioport_unmap(gp.pm); goto out; } + return 0; + out: + pci_dev_put(pdev); return err; } @@ -239,6 +242,7 @@ static void __exit amd_gpio_exit(void) { gpiochip_remove(&gp.chip); ioport_unmap(gp.pm); + pci_dev_put(gp.pdev); } module_init(amd_gpio_init); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] gpio: amd8111: Fix PCI device reference count leak
by Liu Mingrui 28 Oct '24

28 Oct '24

From: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> stable inclusion from stable-v4.19.269 commit b2bc053ebbba57a06fa655db5ea796de2edce445 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRFI CVE: CVE-2022-48973 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 45fecdb9f658d9c82960c98240bc0770ade19aca ] for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. Add the missing pci_dev_put() after the 'out' label. Since pci_dev_put() can handle NULL input parameter, there is no problem for the 'Device not found' branch. For the normal path, add pci_dev_put() in amd_gpio_exit(). Fixes: f942a7de047d ("gpio: add a driver for GPIO pins found on AMD-8111 south bridge chips") Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/gpio/gpio-amd8111.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpio/gpio-amd8111.c b/drivers/gpio/gpio-amd8111.c index fdcebe59510d..68d95051dd0e 100644 --- a/drivers/gpio/gpio-amd8111.c +++ b/drivers/gpio/gpio-amd8111.c @@ -231,7 +231,10 @@ static int __init amd_gpio_init(void) ioport_unmap(gp.pm); goto out; } + return 0; + out: + pci_dev_put(pdev); return err; } @@ -239,6 +242,7 @@ static void __exit amd_gpio_exit(void) { gpiochip_remove(&gp.chip); ioport_unmap(gp.pm); + pci_dev_put(gp.pdev); } module_init(amd_gpio_init); -- 2.25.1

2 1

[PATCH OLK-5.10 0/3] fix CVE-2024-47699
by Zhang Kunbo 28 Oct '24

28 Oct '24

This addresses three potential issues with empty b-tree nodes that can occur with corrupted filesystem images, including one recently discovered by syzbot. Ryusuke Konishi (3): nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() nilfs2: determine empty node blocks as corrupted nilfs2: fix potential oob read in nilfs_btree_check_delete() fs/nilfs2/btree.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) -- 2.34.1

2 4

[PATCH v4 OLK-6.6] KVM:arm64:Add a kvm module param to get current enabled GIC version
by ni-zhiqiang111 28 Oct '24

28 Oct '24

From: Yanan Wang <wangyanan55(a)huawei.com> Using GICv4.1 is not a 100% win in all scenarios, sometimes we need to use different GIC version in different usecases. Given that there is not a straight forward way to check the GIC version that system is using (e.g., kernel messages may be overridden with time elapses), let's add a module param in KVM such that userspace can check the GIC version simply by reading /sys/module/kvm/parameters/gic_version. Signed-off-by: Yanan Wang <wangyanan55(a)huawei.com> Signed-off-by: Zhiqiang Ni <nizhiqiang1(a)huawei.com> --- arch/arm64/kvm/vgic/vgic-v3.c | 32 ++++++++++++++++++++++++++++++++ arch/arm64/kvm/vgic/vgic.h | 9 +++++++++ 2 files changed, 41 insertions(+) diff --git a/arch/arm64/kvm/vgic/vgic-v3.c b/arch/arm64/kvm/vgic/vgic-v3.c index dab599e857b5..1f37ae886f86 100644 --- a/arch/arm64/kvm/vgic/vgic-v3.c +++ b/arch/arm64/kvm/vgic/vgic-v3.c @@ -20,6 +20,32 @@ static bool common_trap; static bool dir_trap; static bool gicv4_enable; +enum GIC_VERSION global_gic_version = UNKNOWN_GIC_VERSION; + +static int get_gic_version(char *buffer, const struct kernel_param *kp); +static const struct kernel_param_ops gic_version_ops = { + .get = get_gic_version, +}; + +static const char *gic_version; +module_param_cb(gic_version, &gic_version_ops, &gic_version, 0444); + +static int get_gic_version(char *buffer, const struct kernel_param *kp) +{ + int index = global_gic_version; + const char * const gic_version_str[] = { + "GICv2", + "GICv3", + "GICv4", + "GICv4.1", + "unknown" + }; + + gic_version = gic_version_str[index]; + + return param_get_charp(buffer, kp); +} + void vgic_v3_set_underflow(struct kvm_vcpu *vcpu) { struct vgic_v3_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v3; @@ -654,6 +680,7 @@ int vgic_v3_probe(const struct gic_kvm_info *info) kvm_vgic_global_state.nr_lr = (ich_vtr_el2 & 0xf) + 1; kvm_vgic_global_state.can_emulate_gicv2 = false; kvm_vgic_global_state.ich_vtr_el2 = ich_vtr_el2; + global_gic_version = GICV3; /* GICv4 support? */ if (info->has_v4) { @@ -663,6 +690,11 @@ int vgic_v3_probe(const struct gic_kvm_info *info) kvm_vgic_global_state.has_gicv4_1 ? ".1" : "", gicv4_enable ? "en" : "dis"); + if (kvm_vgic_global_state.has_gicv4_1) + global_gic_version = GICV4_1; + else if (kvm_vgic_global_state.has_gicv4) + global_gic_version = GICV4; + #ifdef CONFIG_VIRT_VTIMER_IRQ_BYPASS kvm_vgic_global_state.has_direct_vtimer = info->has_vtimer && gicv4_enable; if (kvm_vgic_global_state.has_direct_vtimer) diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h index f78c026c20f0..a9e420eece0c 100644 --- a/arch/arm64/kvm/vgic/vgic.h +++ b/arch/arm64/kvm/vgic/vgic.h @@ -157,6 +157,15 @@ static inline bool vgic_direct_sgi_or_ppi(struct vgic_irq *irq) #endif } +enum GIC_VERSION { + GICV2, + GICV3, + GICV4, + GICV4_1, + UNKNOWN_GIC_VERSION +}; +extern enum GIC_VERSION global_gic_version; + /* * This struct provides an intermediate representation of the fields contained * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC -- 2.43.0

2 1

[PATCH OLK-6.6 0/7] Fix CVE-2024-47703
by Tengda Wu 28 Oct '24

28 Oct '24

This patchset is going to fix CVE-2024-47703, which may resulting in kernel panic. Andrii Nakryiko (2): bpf: enforce exact retval range on subprog/callback exit bpf: enforce precise retval range on program exit Tengda Wu (2): bpf: Fix kabi breakage in struct bpf_func_state bpf: Fix kabi breakage in struct bpf_insn_access_aux Xu Kuohai (3): bpf, lsm: Add disabled BPF LSM hook list bpf, lsm: Add check for BPF LSM return value bpf: Fix compare error in function retval_range_within include/linux/bpf.h | 1 + include/linux/bpf_lsm.h | 8 + include/linux/bpf_verifier.h | 8 +- kernel/bpf/bpf_lsm.c | 63 +++++++- kernel/bpf/btf.c | 5 +- kernel/bpf/verifier.c | 149 ++++++++++++------ .../selftests/bpf/progs/test_global_func15.c | 2 +- .../selftests/bpf/progs/timer_failure.c | 2 +- .../selftests/bpf/progs/user_ringbuf_fail.c | 2 +- .../bpf/progs/verifier_cgroup_inv_retcode.c | 8 +- .../bpf/progs/verifier_netfilter_retcode.c | 2 +- 11 files changed, 193 insertions(+), 57 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-1.0-LTS] media: pci: cx23885: check cx23885_vdev_init() return
by Tengda Wu 28 Oct '24

28 Oct '24

From: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> stable inclusion from stable-v4.19.321 commit 8e31b096e2e1949bc8f0be019c9ae70d414404c6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYYUE CVE: CVE-2023-52918 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 15126b916e39b0cb67026b0af3c014bfeb1f76b3 ] cx23885_vdev_init() can return a NULL pointer, but that pointer is used in the next line without a check. Add a NULL pointer check and go to the error unwind if it is NULL. Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Reported-by: Sicong Huang <huangsicong(a)iie.ac.cn> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/media/pci/cx23885/cx23885-video.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/media/pci/cx23885/cx23885-video.c b/drivers/media/pci/cx23885/cx23885-video.c index f8a3deadc77a..b9f3ec89ede3 100644 --- a/drivers/media/pci/cx23885/cx23885-video.c +++ b/drivers/media/pci/cx23885/cx23885-video.c @@ -1296,6 +1296,10 @@ int cx23885_video_register(struct cx23885_dev *dev) /* register Video device */ dev->video_dev = cx23885_vdev_init(dev, dev->pci, &cx23885_video_template, "video"); + if (!dev->video_dev) { + err = -ENOMEM; + goto fail_unreg; + } dev->video_dev->queue = &dev->vb2_vidq; err = video_register_device(dev->video_dev, VFL_TYPE_GRABBER, video_nr[dev->nr]); @@ -1310,6 +1314,10 @@ int cx23885_video_register(struct cx23885_dev *dev) /* register VBI device */ dev->vbi_dev = cx23885_vdev_init(dev, dev->pci, &cx23885_vbi_template, "vbi"); + if (!dev->vbi_dev) { + err = -ENOMEM; + goto fail_unreg; + } dev->vbi_dev->queue = &dev->vb2_vbiq; err = video_register_device(dev->vbi_dev, VFL_TYPE_VBI, vbi_nr[dev->nr]); -- 2.34.1

2 1

[PATCH OLK-5.10 v2 0/2] Randomized Kmalloc 5.10 Backport V2
by GONG Ruiqi 28 Oct '24

28 Oct '24

v2: - Modify bugzilla link - Update x86 & arm64's openeuler_defconfig to pass checkdefconfig GONG Ruiqi (1): Randomized slab caches for kmalloc() Jesper Dangaard Brouer (1): mm/slab: introduce kmem_cache flag SLAB_NO_MERGE arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/percpu.h | 12 +++-- include/linux/slab.h | 49 ++++++++++++++++++-- init/Kconfig | 19 +++++++- mm/kfence/kfence_test.c | 14 +++--- mm/slab.c | 8 ++-- mm/slab.h | 7 +-- mm/slab_common.c | 63 +++++++++++++++++++++----- mm/slub.c | 8 ++-- 10 files changed, 145 insertions(+), 37 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 v3] openeuler_defconfig: Disable CONFIG_DEBUG_INFO_BTF_MODULES
by Pu Lehui 28 Oct '24

28 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAX0HW -------------------------------- Disable CONFIG_DEBUG_INFO_BTF_MODULES as standalone build kernel modules will suffer BTF validate failed issue. Fixes: 5f9ae91f7c0d ("kbuild: Build kernel module BTFs if BTF is enabled and pahole supports it") Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- include/linux/module.h | 3 +++ 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 96ca8b990e22..3304cf0bd9e1 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7923,7 +7923,7 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y CONFIG_DEBUG_INFO_BTF=y CONFIG_PAHOLE_HAS_SPLIT_BTF=y CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y -CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_DEBUG_INFO_BTF_MODULES is not set # CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index d95d966f7fb2..6bf96adf974a 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -9076,7 +9076,7 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y CONFIG_DEBUG_INFO_BTF=y CONFIG_PAHOLE_HAS_SPLIT_BTF=y CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y -CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_DEBUG_INFO_BTF_MODULES is not set # CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 diff --git a/include/linux/module.h b/include/linux/module.h index 4db2878d9e42..990f9d66d2f1 100644 --- a/include/linux/module.h +++ b/include/linux/module.h @@ -516,6 +516,9 @@ struct module { #ifdef CONFIG_DEBUG_INFO_BTF_MODULES unsigned int btf_data_size; void *btf_data; +#else + KABI_DEPRECATE(unsigned int, btf_data_size) + KABI_DEPRECATE(void *, btf_data) #endif #ifdef CONFIG_JUMP_LABEL struct jump_entry *jump_entries; -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] fix CVE-2024-47667
by Heyuan Wang 28 Oct '24

28 Oct '24

Dan Carpenter (1): PCI: keystone: Fix if-statement expression in ks_pcie_quirk() Kishon Vijay Abraham I (1): PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) drivers/pci/controller/dwc/pci-keystone.c | 44 ++++++++++++++++++++++- 1 file changed, 43 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6 v2] openeuler_defconfig: Disable CONFIG_DEBUG_INFO_BTF_MODULES
by Pu Lehui 28 Oct '24

28 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAX0HW -------------------------------- Disable CONFIG_DEBUG_INFO_BTF_MODULES as standalone build kernel modules will suffer BTF validate failed issue. Fixes: 5f9ae91f7c0d ("kbuild: Build kernel module BTFs if BTF is enabled and pahole supports it") Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- arch/powerpc/configs/openeuler_defconfig | 1 + arch/riscv/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- include/linux/module.h | 3 +++ 5 files changed, 7 insertions(+), 3 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 96ca8b990e22..3304cf0bd9e1 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7923,7 +7923,7 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y CONFIG_DEBUG_INFO_BTF=y CONFIG_PAHOLE_HAS_SPLIT_BTF=y CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y -CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_DEBUG_INFO_BTF_MODULES is not set # CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 diff --git a/arch/powerpc/configs/openeuler_defconfig b/arch/powerpc/configs/openeuler_defconfig index 19754209e3c8..ee4e09a89d87 100644 --- a/arch/powerpc/configs/openeuler_defconfig +++ b/arch/powerpc/configs/openeuler_defconfig @@ -7358,6 +7358,7 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +# CONFIG_DEBUG_INFO_BTF_MODULES is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y diff --git a/arch/riscv/configs/openeuler_defconfig b/arch/riscv/configs/openeuler_defconfig index 026582613f2c..7d0a444ce018 100644 --- a/arch/riscv/configs/openeuler_defconfig +++ b/arch/riscv/configs/openeuler_defconfig @@ -7111,7 +7111,7 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y CONFIG_DEBUG_INFO_BTF=y CONFIG_PAHOLE_HAS_SPLIT_BTF=y CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y -CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_DEBUG_INFO_BTF_MODULES is not set # CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index d95d966f7fb2..6bf96adf974a 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -9076,7 +9076,7 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y CONFIG_DEBUG_INFO_BTF=y CONFIG_PAHOLE_HAS_SPLIT_BTF=y CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y -CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_DEBUG_INFO_BTF_MODULES is not set # CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 diff --git a/include/linux/module.h b/include/linux/module.h index 4db2878d9e42..990f9d66d2f1 100644 --- a/include/linux/module.h +++ b/include/linux/module.h @@ -516,6 +516,9 @@ struct module { #ifdef CONFIG_DEBUG_INFO_BTF_MODULES unsigned int btf_data_size; void *btf_data; +#else + KABI_DEPRECATE(unsigned int, btf_data_size) + KABI_DEPRECATE(void *, btf_data) #endif #ifdef CONFIG_JUMP_LABEL struct jump_entry *jump_entries; -- 2.34.1

2 1

[PATCH OLK-6.6] openeuler_defconfig: Disable CONFIG_DEBUG_INFO_BTF_MODULES
by Pu Lehui 28 Oct '24

28 Oct '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAX0HW -------------------------------- Disable CONFIG_DEBUG_INFO_BTF_MODULES as standalone build kernel modules will suffer BTF validate failed issue. Fixes: 5f9ae91f7c0d ("kbuild: Build kernel module BTFs if BTF is enabled and pahole supports it") Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- arch/powerpc/configs/openeuler_defconfig | 1 + arch/riscv/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- include/linux/module.h | 3 +++ 5 files changed, 7 insertions(+), 3 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 96ca8b990e22..3304cf0bd9e1 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7923,7 +7923,7 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y CONFIG_DEBUG_INFO_BTF=y CONFIG_PAHOLE_HAS_SPLIT_BTF=y CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y -CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_DEBUG_INFO_BTF_MODULES is not set # CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 diff --git a/arch/powerpc/configs/openeuler_defconfig b/arch/powerpc/configs/openeuler_defconfig index 19754209e3c8..ee4e09a89d87 100644 --- a/arch/powerpc/configs/openeuler_defconfig +++ b/arch/powerpc/configs/openeuler_defconfig @@ -7358,6 +7358,7 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +# CONFIG_DEBUG_INFO_BTF_MODULES is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y diff --git a/arch/riscv/configs/openeuler_defconfig b/arch/riscv/configs/openeuler_defconfig index 026582613f2c..7d0a444ce018 100644 --- a/arch/riscv/configs/openeuler_defconfig +++ b/arch/riscv/configs/openeuler_defconfig @@ -7111,7 +7111,7 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y CONFIG_DEBUG_INFO_BTF=y CONFIG_PAHOLE_HAS_SPLIT_BTF=y CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y -CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_DEBUG_INFO_BTF_MODULES is not set # CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index d95d966f7fb2..6bf96adf974a 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -9076,7 +9076,7 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y CONFIG_DEBUG_INFO_BTF=y CONFIG_PAHOLE_HAS_SPLIT_BTF=y CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y -CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_DEBUG_INFO_BTF_MODULES is not set # CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 diff --git a/include/linux/module.h b/include/linux/module.h index 4db2878d9e42..990f9d66d2f1 100644 --- a/include/linux/module.h +++ b/include/linux/module.h @@ -516,6 +516,9 @@ struct module { #ifdef CONFIG_DEBUG_INFO_BTF_MODULES unsigned int btf_data_size; void *btf_data; +#else + KABI_DEPRECATE(unsigned int, btf_data_size) + KABI_DEPRECATE(void *, btf_data) #endif #ifdef CONFIG_JUMP_LABEL struct jump_entry *jump_entries; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
by Luo Gengkun 28 Oct '24

28 Oct '24

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.1-rc7 commit 05530ef7cf7c7d700f6753f058999b1b5099a026 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDZ CVE: CVE-2022-48994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes matching snd_seq_dump_func_t. Adjust this and remove the casts. There are not resulting binary output differences. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches. Reported-by: kernel test robot <lkp(a)intel.com> Link: https://lore.kernel.org/lkml/202211041527.HD8TLSE1-lkp@intel.com Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: "Gustavo A. R. Silva" <gustavoars(a)kernel.org> Cc: alsa-devel(a)alsa-project.org Signed-off-by: Kees Cook <keescook(a)chromium.org> Link: https://lore.kernel.org/r/20221118232346.never.380-kees@kernel.org Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/core/seq/seq_memory.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c index 5b0388202bac..ac854beb8347 100644 --- a/sound/core/seq/seq_memory.c +++ b/sound/core/seq/seq_memory.c @@ -126,15 +126,19 @@ EXPORT_SYMBOL(snd_seq_dump_var_event); * expand the variable length event to linear buffer space. */ -static int seq_copy_in_kernel(char **bufptr, const void *src, int size) +static int seq_copy_in_kernel(void *ptr, void *src, int size) { + char **bufptr = ptr; + memcpy(*bufptr, src, size); *bufptr += size; return 0; } -static int seq_copy_in_user(char __user **bufptr, const void *src, int size) +static int seq_copy_in_user(void *ptr, void *src, int size) { + char __user **bufptr = ptr; + if (copy_to_user(*bufptr, src, size)) return -EFAULT; *bufptr += size; @@ -163,8 +167,7 @@ int snd_seq_expand_var_event(const struct snd_seq_event *event, int count, char return newlen; } err = snd_seq_dump_var_event(event, - in_kernel ? (snd_seq_dump_func_t)seq_copy_in_kernel : - (snd_seq_dump_func_t)seq_copy_in_user, + in_kernel ? seq_copy_in_kernel : seq_copy_in_user, &buf); return err < 0 ? err : newlen; } -- 2.34.1

2 1

[PATCH OLK-6.6] KEYS: prevent NULL pointer dereference in find_asymmetric_key()
by Yi Yang 28 Oct '24

28 Oct '24

From: Roman Smirnov <r.smirnov(a)omp.ru> stable inclusion from stable-v6.6.54 commit a3765b497a4f5224cb2f7a6a2d3357d3066214ee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR0Z CVE: CVE-2024-47743 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 70fd1966c93bf3bfe3fe6d753eb3d83a76597eef upstream. In find_asymmetric_key(), if all NULLs are passed in the id_{0,1,2} arguments, the kernel will first emit WARN but then have an oops because id_2 gets dereferenced anyway. Add the missing id_2 check and move WARN_ON() to the final else branch to avoid duplicate NULL checks. Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool. Cc: stable(a)vger.kernel.org # v5.17+ Fixes: 7d30198ee24f ("keys: X.509 public key issuer lookup without AKID") Suggested-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Signed-off-by: Roman Smirnov <r.smirnov(a)omp.ru> Reviewed-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Reviewed-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- crypto/asymmetric_keys/asymmetric_type.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c index a5da8ccd353e..43af5fa510c0 100644 --- a/crypto/asymmetric_keys/asymmetric_type.c +++ b/crypto/asymmetric_keys/asymmetric_type.c @@ -60,17 +60,18 @@ struct key *find_asymmetric_key(struct key *keyring, char *req, *p; int len; - WARN_ON(!id_0 && !id_1 && !id_2); - if (id_0) { lookup = id_0->data; len = id_0->len; } else if (id_1) { lookup = id_1->data; len = id_1->len; - } else { + } else if (id_2) { lookup = id_2->data; len = id_2->len; + } else { + WARN_ON(1); + return ERR_PTR(-EINVAL); } /* Construct an identifier "id:<keyid>". */ -- 2.25.1

2 1