- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1425/1425] kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats'
by kernel test robot 31 Mar '25

31 Mar '25

Hi Hui, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: ebca52abe099caa97d7669d0acc71209ea80cfec [1425/1425] sched: Add statistics for scheduler dynamic affinity config: x86_64-randconfig-103-20250219 (https://download.01.org/0day-ci/archive/20250331/202503310934.WNROVBec-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503310934.WNROVBec-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503310934.WNROVBec-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/sched/debug.c:815:6: warning: no previous prototype for function 'sysrq_sched_debug_tidy' [-Wmissing-prototypes] 815 | void sysrq_sched_debug_tidy(void) | ^ kernel/sched/debug.c:815:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 815 | void sysrq_sched_debug_tidy(void) | ^ | static >> kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:21:17: note: expanded from macro 'SEQ_printf' 21 | seq_printf(m, x); \ | ^ >> kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:23:11: note: expanded from macro 'SEQ_printf' 23 | pr_cont(x); \ | ^ include/linux/printk.h:362:26: note: expanded from macro 'pr_cont' 362 | printk(KERN_CONT fmt, ##__VA_ARGS__) | ^~~~~~~~~~~ >> kernel/sched/debug.c:991:17: error: no member named 'nr_wakeups_force_preferred_cpus' in 'struct dyn_affinity_stats' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:21:17: note: expanded from macro 'SEQ_printf' 21 | seq_printf(m, x); \ | ^ >> kernel/sched/debug.c:991:17: error: no member named 'nr_wakeups_force_preferred_cpus' in 'struct dyn_affinity_stats' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:23:11: note: expanded from macro 'SEQ_printf' 23 | pr_cont(x); \ | ^ include/linux/printk.h:362:26: note: expanded from macro 'pr_cont' 362 | printk(KERN_CONT fmt, ##__VA_ARGS__) | ^~~~~~~~~~~ 1 warning and 4 errors generated. vim +990 kernel/sched/debug.c 814 > 815 void sysrq_sched_debug_tidy(void) 816 { 817 int cpu; 818 819 SEQ_printf(NULL, "Sched Debug Version: v0.11, %s %.*s\n", 820 init_utsname()->release, 821 (int)strcspn(init_utsname()->version, " "), 822 init_utsname()->version); 823 824 for_each_online_cpu(cpu) 825 print_cpu_tidy(NULL, cpu); 826 } 827 828 /* 829 * This itererator needs some explanation. 830 * It returns 1 for the header position. 831 * This means 2 is CPU 0. 832 * In a hotplugged system some CPUs, including CPU 0, may be missing so we have 833 * to use cpumask_* to iterate over the CPUs. 834 */ 835 static void *sched_debug_start(struct seq_file *file, loff_t *offset) 836 { 837 unsigned long n = *offset; 838 839 if (n == 0) 840 return (void *) 1; 841 842 n--; 843 844 if (n > 0) 845 n = cpumask_next(n - 1, cpu_online_mask); 846 else 847 n = cpumask_first(cpu_online_mask); 848 849 *offset = n + 1; 850 851 if (n < nr_cpu_ids) 852 return (void *)(unsigned long)(n + 2); 853 854 return NULL; 855 } 856 857 static void *sched_debug_next(struct seq_file *file, void *data, loff_t *offset) 858 { 859 (*offset)++; 860 return sched_debug_start(file, offset); 861 } 862 863 static void sched_debug_stop(struct seq_file *file, void *data) 864 { 865 } 866 867 static const struct seq_operations sched_debug_sops = { 868 .start = sched_debug_start, 869 .next = sched_debug_next, 870 .stop = sched_debug_stop, 871 .show = sched_debug_show, 872 }; 873 874 static int __init init_sched_debug_procfs(void) 875 { 876 if (!proc_create_seq("sched_debug", 0444, NULL, &sched_debug_sops)) 877 return -ENOMEM; 878 return 0; 879 } 880 881 __initcall(init_sched_debug_procfs); 882 883 #define __P(F) SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) 884 #define P(F) SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)p->F) 885 #define __PN(F) SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)F)) 886 #define PN(F) SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)p->F)) 887 888 889 #ifdef CONFIG_NUMA_BALANCING 890 void print_numa_stats(struct seq_file *m, int node, unsigned long tsf, 891 unsigned long tpf, unsigned long gsf, unsigned long gpf) 892 { 893 SEQ_printf(m, "numa_faults node=%d ", node); 894 SEQ_printf(m, "task_private=%lu task_shared=%lu ", tpf, tsf); 895 SEQ_printf(m, "group_private=%lu group_shared=%lu\n", gpf, gsf); 896 } 897 #endif 898 899 900 static void sched_show_numa(struct task_struct *p, struct seq_file *m) 901 { 902 #ifdef CONFIG_NUMA_BALANCING 903 struct mempolicy *pol; 904 905 if (p->mm) 906 P(mm->numa_scan_seq); 907 908 task_lock(p); 909 pol = p->mempolicy; 910 if (pol && !(pol->flags & MPOL_F_MORON)) 911 pol = NULL; 912 mpol_get(pol); 913 task_unlock(p); 914 915 P(numa_pages_migrated); 916 P(numa_preferred_nid); 917 P(total_numa_faults); 918 SEQ_printf(m, "current_node=%d, numa_group_id=%d\n", 919 task_node(p), task_numa_group_id(p)); 920 show_numa_stats(p, m); 921 mpol_put(pol); 922 #endif 923 } 924 925 void proc_sched_show_task(struct task_struct *p, struct pid_namespace *ns, 926 struct seq_file *m) 927 { 928 #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY 929 struct dyn_affinity_stats *dyn_affi = p->se.dyn_affi_stats; 930 #endif 931 unsigned long nr_switches; 932 933 SEQ_printf(m, "%s (%d, #threads: %d)\n", p->comm, task_pid_nr_ns(p, ns), 934 get_nr_threads(p)); 935 SEQ_printf(m, 936 "---------------------------------------------------------" 937 "----------\n"); 938 #define __P(F) \ > 939 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) 940 #define P(F) \ 941 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)p->F) 942 #define P_SCHEDSTAT(F) \ 943 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)schedstat_val(p->F)) 944 #define __PN(F) \ 945 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)F)) 946 #define PN(F) \ 947 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)p->F)) 948 #define PN_SCHEDSTAT(F) \ 949 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)schedstat_val(p->F))) 950 951 PN(se.exec_start); 952 PN(se.vruntime); 953 PN(se.sum_exec_runtime); 954 955 nr_switches = p->nvcsw + p->nivcsw; 956 957 P(se.nr_migrations); 958 959 if (schedstat_enabled()) { 960 u64 avg_atom, avg_per_cpu; 961 962 PN_SCHEDSTAT(se.statistics.sum_sleep_runtime); 963 PN_SCHEDSTAT(se.statistics.wait_start); 964 PN_SCHEDSTAT(se.statistics.sleep_start); 965 PN_SCHEDSTAT(se.statistics.block_start); 966 PN_SCHEDSTAT(se.statistics.sleep_max); 967 PN_SCHEDSTAT(se.statistics.block_max); 968 PN_SCHEDSTAT(se.statistics.exec_max); 969 PN_SCHEDSTAT(se.statistics.slice_max); 970 PN_SCHEDSTAT(se.statistics.wait_max); 971 PN_SCHEDSTAT(se.statistics.wait_sum); 972 P_SCHEDSTAT(se.statistics.wait_count); 973 PN_SCHEDSTAT(se.statistics.iowait_sum); 974 P_SCHEDSTAT(se.statistics.iowait_count); 975 P_SCHEDSTAT(se.statistics.nr_migrations_cold); 976 P_SCHEDSTAT(se.statistics.nr_failed_migrations_affine); 977 P_SCHEDSTAT(se.statistics.nr_failed_migrations_running); 978 P_SCHEDSTAT(se.statistics.nr_failed_migrations_hot); 979 P_SCHEDSTAT(se.statistics.nr_forced_migrations); 980 P_SCHEDSTAT(se.statistics.nr_wakeups); 981 P_SCHEDSTAT(se.statistics.nr_wakeups_sync); 982 P_SCHEDSTAT(se.statistics.nr_wakeups_migrate); 983 P_SCHEDSTAT(se.statistics.nr_wakeups_local); 984 P_SCHEDSTAT(se.statistics.nr_wakeups_remote); 985 P_SCHEDSTAT(se.statistics.nr_wakeups_affine); 986 P_SCHEDSTAT(se.statistics.nr_wakeups_affine_attempts); 987 P_SCHEDSTAT(se.statistics.nr_wakeups_passive); 988 P_SCHEDSTAT(se.statistics.nr_wakeups_idle); 989 #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY > 990 __P(dyn_affi->nr_wakeups_preferred_cpus); > 991 __P(dyn_affi->nr_wakeups_force_preferred_cpus); 992 #endif 993 994 avg_atom = p->se.sum_exec_runtime; 995 if (nr_switches) 996 avg_atom = div64_ul(avg_atom, nr_switches); 997 else 998 avg_atom = -1LL; 999 1000 avg_per_cpu = p->se.sum_exec_runtime; 1001 if (p->se.nr_migrations) { 1002 avg_per_cpu = div64_u64(avg_per_cpu, 1003 p->se.nr_migrations); 1004 } else { 1005 avg_per_cpu = -1LL; 1006 } 1007 1008 __PN(avg_atom); 1009 __PN(avg_per_cpu); 1010 } 1011 1012 __P(nr_switches); 1013 SEQ_printf(m, "%-45s:%21Ld\n", 1014 "nr_voluntary_switches", (long long)p->nvcsw); 1015 SEQ_printf(m, "%-45s:%21Ld\n", 1016 "nr_involuntary_switches", (long long)p->nivcsw); 1017 1018 P(se.load.weight); 1019 P(se.runnable_weight); 1020 #ifdef CONFIG_SMP 1021 P(se.avg.load_sum); 1022 P(se.avg.runnable_load_sum); 1023 P(se.avg.util_sum); 1024 P(se.avg.load_avg); 1025 P(se.avg.runnable_load_avg); 1026 P(se.avg.util_avg); 1027 P(se.avg.last_update_time); 1028 P(se.avg.util_est.ewma); 1029 P(se.avg.util_est.enqueued); 1030 #endif 1031 P(policy); 1032 P(prio); 1033 if (task_has_dl_policy(p)) { 1034 P(dl.runtime); 1035 P(dl.deadline); 1036 } 1037 #undef PN_SCHEDSTAT 1038 #undef PN 1039 #undef __PN 1040 #undef P_SCHEDSTAT 1041 #undef P 1042 #undef __P 1043 1044 { 1045 unsigned int this_cpu = raw_smp_processor_id(); 1046 u64 t0, t1; 1047 1048 t0 = cpu_clock(this_cpu); 1049 t1 = cpu_clock(this_cpu); 1050 SEQ_printf(m, "%-45s:%21Ld\n", 1051 "clock-delta", (long long)(t1-t0)); 1052 } 1053 1054 sched_show_numa(p, m); 1055 } 1056 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] f2fs: fix dereference of stale list iterator after loop body
by Wupeng Ma 31 Mar '25

31 Mar '25

From: Jakob Koschel <jakobkoschel(a)gmail.com> stable inclusion from stable-v4.19.247 commit 385edd3ce5b4b1e9d31f474a5e35a39779ec1110 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBP3SH CVE: CVE-2022-49425 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2aaf51dd39afb6d01d13f1e6fe20b684733b37d5 ] The list iterator variable will be a bogus pointer if no break was hit. Dereferencing it (cur->page in this case) could load an out-of-bounds/undefined value making it unsafe to use that in the comparision to determine if the specific element was found. Since 'cur->page' *can* be out-ouf-bounds it cannot be guaranteed that by chance (or intention of an attacker) it matches the value of 'page' even though the correct element was not found. This is fixed by using a separate list iterator variable for the loop and only setting the original variable if a suitable element was found. Then determing if the element was found is simply checking if the variable is set. Fixes: 8c242db9b8c0 ("f2fs: fix stale ATOMIC_WRITTEN_PAGE private pointer") Signed-off-by: Jakob Koschel <jakobkoschel(a)gmail.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- fs/f2fs/segment.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c index 0e3e590a250f..6fbf0471323e 100644 --- a/fs/f2fs/segment.c +++ b/fs/f2fs/segment.c @@ -354,16 +354,19 @@ void f2fs_drop_inmem_page(struct inode *inode, struct page *page) struct f2fs_sb_info *sbi = F2FS_I_SB(inode); struct list_head *head = &fi->inmem_pages; struct inmem_pages *cur = NULL; + struct inmem_pages *tmp; f2fs_bug_on(sbi, !IS_ATOMIC_WRITTEN_PAGE(page)); mutex_lock(&fi->inmem_lock); - list_for_each_entry(cur, head, list) { - if (cur->page == page) + list_for_each_entry(tmp, head, list) { + if (tmp->page == page) { + cur = tmp; break; + } } - f2fs_bug_on(sbi, list_empty(head) || cur->page != page); + f2fs_bug_on(sbi, !cur); list_del(&cur->list); mutex_unlock(&fi->inmem_lock); -- 2.43.0

2 1

[openeuler:OLK-5.10 2829/2829] drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2340: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2854: first defined here
by kernel test robot 31 Mar '25

31 Mar '25

Hi DuanqiangWen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0e7e8faca7062a439fd0a56574c2c3860ceb2088 commit: 3ddd74dceeba1f4ea8b20db59276ea3c6eded3d5 [2829/2829] openeuler: net: txgbe: Fix some known bugs, merge net-swift txgbe-1.2.3 out-of-tree config: x86_64-randconfig-122-20250330 (https://download.01.org/0day-ci/archive/20250331/202503310959.wgczfMA5-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503310959.wgczfMA5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503310959.wgczfMA5-lkp@intel.com/ All errors (new ones prefixed by >>): ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `fmgr_cmd_op': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2340: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2854: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `fmgr_usr_cmd_op': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2361: multiple definition of `fmgr_usr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2875: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_erase_chip': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2371: multiple definition of `flash_erase_chip'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2885: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_erase_sector': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2377: multiple definition of `flash_erase_sector'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2891: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_write_dword': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2393: multiple definition of `flash_write_dword'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2908: first defined here sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:625:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:625:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:625:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:1004:6: sparse: sparse: symbol 'txgbe_add_uc_addr' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:1138:6: sparse: sparse: symbol 'txgbe_set_mta' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2604:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2604:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2604:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2707:5: sparse: sparse: symbol 'txgbe_setup_mac_link_hostif' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2744:5: sparse: sparse: symbol 'txgbe_crc16_ccitt' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2897:5: sparse: sparse: symbol 'flash_read_dword' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2922:5: sparse: sparse: symbol 'txgbe_flash_write_cab' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2944:5: sparse: sparse: symbol 'txgbe_flash_read_cab' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2975:5: sparse: sparse: symbol 'txgbe_flash_write_unlock' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2998:5: sparse: sparse: symbol 'txgbe_flash_write_lock' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3451:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3451:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3451:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3496:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3496:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3496:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4396:5: sparse: sparse: symbol 'txgbe_enable_rx_adapter' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4417:5: sparse: sparse: symbol 'txgbe_set_sgmii_an37_ability' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4972:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4972:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4972:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:5345:5: sparse: sparse: symbol 'txgbe_reset_misc' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6426:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6426:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6426:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6428:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6428:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6428:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6593:5: sparse: sparse: symbol 'txgbe_read_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6642:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6642:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6642:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6724:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6724:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6724:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6737:5: sparse: sparse: symbol 'txgbe_write_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6847:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6847:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6847:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6890:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6890:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6890:9: sparse: int -- drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:132:5: sparse: sparse: symbol 'txgbe_poll_for_msg' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:162:5: sparse: sparse: symbol 'txgbe_poll_for_ack' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:263:5: sparse: sparse: symbol 'txgbe_read_v2p_mailbox' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:284:5: sparse: sparse: symbol 'txgbe_check_for_bit_vf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:300:5: sparse: sparse: symbol 'txgbe_check_for_msg_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:320:5: sparse: sparse: symbol 'txgbe_check_for_ack_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:340:5: sparse: sparse: symbol 'txgbe_check_for_rst_vf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:359:5: sparse: sparse: symbol 'txgbe_obtain_mbx_lock_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:387:5: sparse: sparse: symbol 'txgbe_write_mbx_vf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:425:5: sparse: sparse: symbol 'txgbe_read_mbx_vf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:483:5: sparse: sparse: symbol 'txgbe_check_for_bit_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:503:5: sparse: sparse: symbol 'txgbe_check_for_msg_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:525:5: sparse: sparse: symbol 'txgbe_check_for_ack_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:547:5: sparse: sparse: symbol 'txgbe_check_for_rst_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:572:5: sparse: sparse: symbol 'txgbe_obtain_mbx_lock_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:601:5: sparse: sparse: symbol 'txgbe_write_mbx_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:644:5: sparse: sparse: symbol 'txgbe_read_mbx_pf' was not declared. Should it be static? vim +2340 drivers/net/ethernet/netswift/ngbe/ngbe_hw.c a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2333 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2334 /** a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2335 * cmd_addr is used for some special command: a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2336 * 1. to be sector address, when implemented erase sector command a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2337 * 2. to be flash address when implemented read, write flash address a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2338 **/ a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2339 u8 fmgr_cmd_op(struct ngbe_hw *hw, u32 cmd, u32 cmd_addr) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2340 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2341 u32 cmd_val = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2342 u32 time_out = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2343 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2344 cmd_val = (cmd << SPI_CLK_CMD_OFFSET) | (SPI_CLK_DIV << SPI_CLK_DIV_OFFSET) | cmd_addr; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2345 wr32(hw, SPI_H_CMD_REG_ADDR, cmd_val); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2346 while (1) { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2347 if (rd32(hw, SPI_H_STA_REG_ADDR) & 0x1) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2348 break; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2349 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2350 if (time_out == SPI_TIME_OUT_VALUE) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2351 return 1; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2352 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2353 time_out = time_out + 1; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2354 udelay(10); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2355 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2356 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2357 return 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2358 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2359 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2360 u8 fmgr_usr_cmd_op(struct ngbe_hw *hw, u32 usr_cmd) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2361 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2362 u8 status = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2363 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2364 wr32(hw, SPI_H_USR_CMD_REG_ADDR, usr_cmd); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2365 status = fmgr_cmd_op(hw, SPI_CMD_USER_CMD, 0); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2366 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2367 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2368 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2369 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2370 u8 flash_erase_chip(struct ngbe_hw *hw) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2371 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2372 u8 status = fmgr_cmd_op(hw, SPI_CMD_ERASE_CHIP, 0); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2373 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2374 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2375 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2376 u8 flash_erase_sector(struct ngbe_hw *hw, u32 sec_addr) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2377 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2378 u8 status = fmgr_cmd_op(hw, SPI_CMD_ERASE_SECTOR, sec_addr); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2379 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2380 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2381 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2382 u32 ngbe_flash_read_dword(struct ngbe_hw *hw, u32 addr) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2383 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2384 u8 status = fmgr_cmd_op(hw, SPI_CMD_READ_DWORD, addr); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2385 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2386 if (status) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2387 return (u32)status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2388 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2389 return rd32(hw, SPI_H_DAT_REG_ADDR); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2390 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2391 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2392 u8 flash_write_dword(struct ngbe_hw *hw, u32 addr, u32 dword) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2393 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2394 u8 status = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2395 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2396 wr32(hw, SPI_H_DAT_REG_ADDR, dword); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2397 status = fmgr_cmd_op(hw, SPI_CMD_WRITE_DWORD, addr); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2398 if (status) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2399 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2400 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2401 if (dword != ngbe_flash_read_dword(hw, addr)) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2402 return 1; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2403 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2404 return 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2405 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2406 :::::: The code at line 2340 was first introduced by commit :::::: a5961b4bc6ce09a70902686ecc848a47493a9251 openeuler: net: ngbe: add ngbe module support :::::: TO: Duanqiang Wen <duanqiangwen(a)net-swift.com> :::::: CC: Duanqiang Wen <duanqiangwen(a)net-swift.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1327/1327] mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled'
by kernel test robot 31 Mar '25

31 Mar '25

Hi liubo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: 44983705e56ab22fda801d66e2a6bd0d1be7ca0b [1327/1327] etmem: add original kernel swap enabled options config: x86_64-buildonly-randconfig-005-20241216 (https://download.01.org/0day-ci/archive/20250331/202503310818.VmXexZb9-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503310818.VmXexZb9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503310818.VmXexZb9-lkp@intel.com/ All errors (new ones prefixed by >>): mm/vmscan.c:2734:17: warning: variable 'node_lru_pages' set but not used [-Wunused-but-set-variable] 2734 | unsigned long node_lru_pages = 0; | ^ >> mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] 3257 | if (sc != NULL && !kernel_swap_enabled()) | ^ mm/vmscan.c:3257:21: note: did you mean 'kernfs_ns_enabled'? include/linux/kernfs.h:309:20: note: 'kernfs_ns_enabled' declared here 309 | static inline bool kernfs_ns_enabled(struct kernfs_node *kn) | ^ 1 warning and 1 error generated. vim +/kernel_swap_enabled +3257 mm/vmscan.c 3250 3251 /* 3252 * Check if original kernel swap is enabled 3253 * turn off kernel swap,but leave page cache reclaim on 3254 */ 3255 static inline void kernel_swap_check(struct scan_control *sc) 3256 { > 3257 if (sc != NULL && !kernel_swap_enabled()) 3258 sc->may_swap = 0; 3259 } 3260 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2829/2829] drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:177:5: sparse: sparse: symbol 'txgbe_get_link_ksettings' was not declared. Should it be static?
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0e7e8faca7062a439fd0a56574c2c3860ceb2088 commit: 96c897d3a6cb76928d7981f60f832afba1bcc01b [2829/2829] openeuler: configs: delete txgbe/Kconfig, add txgbe_config to netswift/Kconfig config: x86_64-randconfig-122-20250330 (https://download.01.org/0day-ci/archive/20250330/202503302242.szHIIxdv-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503302242.szHIIxdv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503302242.szHIIxdv-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:177:5: sparse: sparse: symbol 'txgbe_get_link_ksettings' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:447:33: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:447:33: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:447:33: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1674:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1674:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1674:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1696:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1696:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1696:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1732:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1732:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1732:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1736:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1736:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1736:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2089:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2089:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2089:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2424:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] psrc @@ got unsigned short [usertype] src_port @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2424:36: sparse: expected restricted __be16 [usertype] psrc drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2424:36: sparse: got unsigned short [usertype] src_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2425:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] psrc @@ got unsigned short [usertype] src_port @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2425:36: sparse: expected restricted __be16 [usertype] psrc drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2425:36: sparse: got unsigned short [usertype] src_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2426:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] pdst @@ got unsigned short [usertype] dst_port @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2426:36: sparse: expected restricted __be16 [usertype] pdst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2426:36: sparse: got unsigned short [usertype] dst_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2427:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] pdst @@ got unsigned short [usertype] dst_port @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2427:36: sparse: expected restricted __be16 [usertype] pdst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2427:36: sparse: got unsigned short [usertype] dst_port >> drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2428:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] ip4src @@ got unsigned int @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2428:38: sparse: expected restricted __be32 [usertype] ip4src drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2428:38: sparse: got unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2429:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] ip4src @@ got unsigned int @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2429:38: sparse: expected restricted __be32 [usertype] ip4src drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2429:38: sparse: got unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2430:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] ip4dst @@ got unsigned int @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2430:38: sparse: expected restricted __be32 [usertype] ip4dst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2430:38: sparse: got unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2431:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] ip4dst @@ got unsigned int @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2431:38: sparse: expected restricted __be32 [usertype] ip4dst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2431:38: sparse: got unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2432:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] vlan_etype @@ got unsigned short [usertype] flex_bytes @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2432:31: sparse: expected restricted __be16 [usertype] vlan_etype drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2432:31: sparse: got unsigned short [usertype] flex_bytes drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2433:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] vlan_etype @@ got unsigned short [usertype] flex_bytes @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2433:31: sparse: expected restricted __be16 [usertype] vlan_etype drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2433:31: sparse: got unsigned short [usertype] flex_bytes drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2434:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2434:28: sparse: expected restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2434:28: sparse: got unsigned int [usertype] drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2435:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2435:28: sparse: expected restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2435:28: sparse: got unsigned int [usertype] >> drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2703:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __be32 [usertype] ip4src @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2703:43: sparse: expected unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2703:43: sparse: got restricted __be32 [usertype] ip4src drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2704:34: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __be32 [usertype] ip4src @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2704:34: sparse: expected unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2704:34: sparse: got restricted __be32 [usertype] ip4src >> drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2705:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __be32 [usertype] ip4dst @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2705:43: sparse: expected unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2705:43: sparse: got restricted __be32 [usertype] ip4dst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2706:34: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __be32 [usertype] ip4dst @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2706:34: sparse: expected unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2706:34: sparse: got restricted __be32 [usertype] ip4dst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2707:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] src_port @@ got restricted __be16 [usertype] psrc @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2707:42: sparse: expected unsigned short [usertype] src_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2707:42: sparse: got restricted __be16 [usertype] psrc drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2708:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [addressable] [assigned] [usertype] src_port @@ got restricted __be16 [usertype] psrc @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2708:33: sparse: expected unsigned short [addressable] [assigned] [usertype] src_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2708:33: sparse: got restricted __be16 [usertype] psrc >> drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2709:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] dst_port @@ got restricted __be16 [usertype] pdst @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2709:42: sparse: expected unsigned short [usertype] dst_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2709:42: sparse: got restricted __be16 [usertype] pdst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2710:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [addressable] [assigned] [usertype] dst_port @@ got restricted __be16 [usertype] pdst @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2710:33: sparse: expected unsigned short [addressable] [assigned] [usertype] dst_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2710:33: sparse: got restricted __be16 [usertype] pdst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2714:48: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2716:48: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2717:52: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] flex_bytes @@ got restricted __be16 [usertype] vlan_etype @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2717:52: sparse: expected unsigned short [usertype] flex_bytes drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2717:52: sparse: got restricted __be16 [usertype] vlan_etype drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2719:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [addressable] [assigned] [usertype] flex_bytes @@ got restricted __be16 [usertype] vlan_etype @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2719:43: sparse: expected unsigned short [addressable] [assigned] [usertype] flex_bytes drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2719:43: sparse: got restricted __be16 [usertype] vlan_etype -- drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:132:5: sparse: sparse: symbol 'txgbe_poll_for_msg' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:162:5: sparse: sparse: symbol 'txgbe_poll_for_ack' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:185:5: sparse: sparse: symbol 'txgbe_check_for_bit_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:205:5: sparse: sparse: symbol 'txgbe_check_for_msg_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:227:5: sparse: sparse: symbol 'txgbe_check_for_ack_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:249:5: sparse: sparse: symbol 'txgbe_check_for_rst_pf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:274:5: sparse: sparse: symbol 'txgbe_obtain_mbx_lock_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:303:5: sparse: sparse: symbol 'txgbe_write_mbx_pf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:346:5: sparse: sparse: symbol 'txgbe_read_mbx_pf' was not declared. Should it be static? -- drivers/net/ethernet/netswift/txgbe/txgbe_main.c:170:6: sparse: sparse: symbol 'txgbe_service_event_schedule' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:930:40: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __be16 [usertype] vlan_proto @@ got unsigned short [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:930:40: sparse: expected restricted __be16 [usertype] vlan_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:930:40: sparse: got unsigned short [usertype] drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2632:6: sparse: sparse: symbol 'txgbe_disable_tx_queue' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2777:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2777:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2777:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2781:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2781:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2781:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2858:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2858:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2858:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2913:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2913:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2913:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3297:5: sparse: sparse: symbol 'txgbe_add_cloud_switcher' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3312:5: sparse: sparse: symbol 'txgbe_del_cloud_switcher' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3632:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3632:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3632:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3662:6: sparse: sparse: symbol 'txgbe_configure_isb' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3672:6: sparse: sparse: symbol 'txgbe_configure_port' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3921:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3921:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3921:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4227:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4227:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4227:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4292:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4292:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4292:17: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4310:5: sparse: sparse: symbol 'txgbe_init_shared_code' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4392:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4392:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4392:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4821:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4821:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4821:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4953:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4953:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4953:17: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5952:40: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5974:36: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5978:67: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5988:32: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5989:36: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5993:67: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6007:37: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6031:40: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6643:33: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6643:33: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6643:33: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6645:33: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6645:33: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6645:33: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6647:38: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6648:25: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6648:25: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6648:25: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6652:27: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6652:27: sparse: left side has type unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6652:27: sparse: right side has type restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6662:27: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6662:27: sparse: left side has type unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6662:27: sparse: right side has type restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6682:5: sparse: sparse: symbol 'txgbe_skb_pad_nonzero' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6724:30: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] protocol @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6724:30: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6724:30: sparse: got restricted __be16 [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6770:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6770:26: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6770:26: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6771:29: sparse: sparse: cast from restricted __be16 >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6804:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] h_vlan_TCI @@ got unsigned short [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6804:42: sparse: expected restricted __be16 [usertype] h_vlan_TCI drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6804:42: sparse: got unsigned short [usertype] drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7209:25: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] port @@ got restricted __be16 [usertype] port @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7209:25: sparse: expected unsigned short [usertype] port drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7209:25: sparse: got restricted __be16 [usertype] port drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7275:46: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7277:37: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7285:47: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7287:37: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7379:26: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] type @@ got restricted __be16 [usertype] protocol @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7379:26: sparse: expected unsigned short [usertype] type drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7379:26: sparse: got restricted __be16 [usertype] protocol >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7395:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] type @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7395:22: sparse: expected unsigned short [usertype] type drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7395:22: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7422:35: sparse: sparse: incorrect type in initializer (incompatible argument 2 (different base types)) @@ expected int ( *ndo_vlan_rx_add_vid )( ... ) @@ got int ( * )( ... ) @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7422:35: sparse: expected int ( *ndo_vlan_rx_add_vid )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7422:35: sparse: got int ( * )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7423:35: sparse: sparse: incorrect type in initializer (incompatible argument 2 (different base types)) @@ expected int ( *ndo_vlan_rx_kill_vid )( ... ) @@ got int ( * )( ... ) @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7423:35: sparse: expected int ( *ndo_vlan_rx_kill_vid )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7423:35: sparse: got int ( * )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7583:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7583:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7583:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7786:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7786:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7786:17: sparse: int -- drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:645:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:645:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:645:9: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:1042:6: sparse: sparse: symbol 'txgbe_add_uc_addr' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:1186:6: sparse: sparse: symbol 'txgbe_set_mta' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2699:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2699:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2699:9: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2806:5: sparse: sparse: symbol 'txgbe_setup_mac_link_hostif' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2845:5: sparse: sparse: symbol 'txgbe_crc16_ccitt' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3297:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3297:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3297:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3342:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3342:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3342:17: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4238:5: sparse: sparse: symbol 'txgbe_enable_rx_adapter' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4259:5: sparse: sparse: symbol 'txgbe_set_sgmii_an37_ability' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4833:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4833:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4833:9: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:5239:5: sparse: sparse: symbol 'txgbe_reset_misc' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6345:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6345:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6345:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6347:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6347:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6347:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6520:5: sparse: sparse: symbol 'txgbe_read_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6572:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6572:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6572:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6656:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6656:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6656:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6669:5: sparse: sparse: symbol 'txgbe_write_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6712:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6712:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6712:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6757:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6757:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6757:9: sparse: int vim +/txgbe_get_link_ksettings +177 drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c a493f74ade8fe6 zhenpengzheng 2021-07-13 176 a493f74ade8fe6 zhenpengzheng 2021-07-13 @177 int txgbe_get_link_ksettings(struct net_device *netdev, a493f74ade8fe6 zhenpengzheng 2021-07-13 178 struct ethtool_link_ksettings *cmd) a493f74ade8fe6 zhenpengzheng 2021-07-13 179 { a493f74ade8fe6 zhenpengzheng 2021-07-13 180 struct txgbe_adapter *adapter = netdev_priv(netdev); a493f74ade8fe6 zhenpengzheng 2021-07-13 181 struct txgbe_hw *hw = &adapter->hw; a493f74ade8fe6 zhenpengzheng 2021-07-13 182 u32 supported_link; a493f74ade8fe6 zhenpengzheng 2021-07-13 183 u32 link_speed = 0; a493f74ade8fe6 zhenpengzheng 2021-07-13 184 bool autoneg = false; a493f74ade8fe6 zhenpengzheng 2021-07-13 185 u32 supported, advertising; a493f74ade8fe6 zhenpengzheng 2021-07-13 186 bool link_up; a493f74ade8fe6 zhenpengzheng 2021-07-13 187 a493f74ade8fe6 zhenpengzheng 2021-07-13 188 ethtool_convert_link_mode_to_legacy_u32(&supported, a493f74ade8fe6 zhenpengzheng 2021-07-13 189 cmd->link_modes.supported); a493f74ade8fe6 zhenpengzheng 2021-07-13 190 a493f74ade8fe6 zhenpengzheng 2021-07-13 191 TCALL(hw, mac.ops.get_link_capabilities, &supported_link, &autoneg); a493f74ade8fe6 zhenpengzheng 2021-07-13 192 a493f74ade8fe6 zhenpengzheng 2021-07-13 193 if ((hw->subsystem_device_id & 0xF0) == TXGBE_ID_KR_KX_KX4) a493f74ade8fe6 zhenpengzheng 2021-07-13 194 autoneg = adapter->backplane_an ? 1:0; a493f74ade8fe6 zhenpengzheng 2021-07-13 195 else if ((hw->subsystem_device_id & 0xF0) == TXGBE_ID_MAC_SGMII) a493f74ade8fe6 zhenpengzheng 2021-07-13 196 autoneg = adapter->an37?1:0; a493f74ade8fe6 zhenpengzheng 2021-07-13 197 a493f74ade8fe6 zhenpengzheng 2021-07-13 198 /* set the supported link speeds */ a493f74ade8fe6 zhenpengzheng 2021-07-13 199 if (supported_link & TXGBE_LINK_SPEED_10GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 200 supported |= (txgbe_isbackplane(hw->phy.media_type)) ? a493f74ade8fe6 zhenpengzheng 2021-07-13 201 txgbe_backplane_type(hw) : SUPPORTED_10000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 202 if (supported_link & TXGBE_LINK_SPEED_1GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 203 supported |= (txgbe_isbackplane(hw->phy.media_type)) ? a493f74ade8fe6 zhenpengzheng 2021-07-13 204 SUPPORTED_1000baseKX_Full : SUPPORTED_1000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 205 if (supported_link & TXGBE_LINK_SPEED_100_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 206 supported |= SUPPORTED_100baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 207 if (supported_link & TXGBE_LINK_SPEED_10_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 208 supported |= SUPPORTED_10baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 209 a493f74ade8fe6 zhenpengzheng 2021-07-13 210 /* default advertised speed if phy.autoneg_advertised isn't set */ a493f74ade8fe6 zhenpengzheng 2021-07-13 211 advertising = supported; a493f74ade8fe6 zhenpengzheng 2021-07-13 212 a493f74ade8fe6 zhenpengzheng 2021-07-13 213 /* set the advertised speeds */ a493f74ade8fe6 zhenpengzheng 2021-07-13 214 if (hw->phy.autoneg_advertised) { a493f74ade8fe6 zhenpengzheng 2021-07-13 215 if (hw->phy.autoneg_advertised & TXGBE_LINK_SPEED_100_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 216 advertising |= ADVERTISED_100baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 217 if (hw->phy.autoneg_advertised & TXGBE_LINK_SPEED_10GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 218 advertising |= (supported & ADVERTISED_MASK_10G); a493f74ade8fe6 zhenpengzheng 2021-07-13 219 if (hw->phy.autoneg_advertised & TXGBE_LINK_SPEED_1GB_FULL) { a493f74ade8fe6 zhenpengzheng 2021-07-13 220 if (supported & SUPPORTED_1000baseKX_Full) a493f74ade8fe6 zhenpengzheng 2021-07-13 221 advertising |= ADVERTISED_1000baseKX_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 222 else a493f74ade8fe6 zhenpengzheng 2021-07-13 223 advertising |= ADVERTISED_1000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 224 } a493f74ade8fe6 zhenpengzheng 2021-07-13 225 if (hw->phy.autoneg_advertised & TXGBE_LINK_SPEED_10_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 226 advertising |= ADVERTISED_10baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 227 } else { a493f74ade8fe6 zhenpengzheng 2021-07-13 228 /* default modes in case phy.autoneg_advertised isn't set */ a493f74ade8fe6 zhenpengzheng 2021-07-13 229 if (supported_link & TXGBE_LINK_SPEED_10GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 230 advertising |= ADVERTISED_10000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 231 if (supported_link & TXGBE_LINK_SPEED_1GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 232 advertising |= ADVERTISED_1000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 233 if (supported_link & TXGBE_LINK_SPEED_100_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 234 advertising |= ADVERTISED_100baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 235 if (hw->phy.multispeed_fiber && !autoneg) { a493f74ade8fe6 zhenpengzheng 2021-07-13 236 if (supported_link & TXGBE_LINK_SPEED_10GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 237 advertising = ADVERTISED_10000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 238 } a493f74ade8fe6 zhenpengzheng 2021-07-13 239 if (supported_link & TXGBE_LINK_SPEED_10_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 240 advertising |= ADVERTISED_10baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 241 } a493f74ade8fe6 zhenpengzheng 2021-07-13 242 a493f74ade8fe6 zhenpengzheng 2021-07-13 243 if (autoneg) { a493f74ade8fe6 zhenpengzheng 2021-07-13 244 supported |= SUPPORTED_Autoneg; a493f74ade8fe6 zhenpengzheng 2021-07-13 245 advertising |= ADVERTISED_Autoneg; a493f74ade8fe6 zhenpengzheng 2021-07-13 246 cmd->base.autoneg = AUTONEG_ENABLE; a493f74ade8fe6 zhenpengzheng 2021-07-13 247 } else a493f74ade8fe6 zhenpengzheng 2021-07-13 248 cmd->base.autoneg = AUTONEG_DISABLE; a493f74ade8fe6 zhenpengzheng 2021-07-13 249 a493f74ade8fe6 zhenpengzheng 2021-07-13 250 /* Determine the remaining settings based on the PHY type. */ a493f74ade8fe6 zhenpengzheng 2021-07-13 251 switch (adapter->hw.phy.type) { a493f74ade8fe6 zhenpengzheng 2021-07-13 252 case txgbe_phy_tn: a493f74ade8fe6 zhenpengzheng 2021-07-13 253 case txgbe_phy_aq: a493f74ade8fe6 zhenpengzheng 2021-07-13 254 case txgbe_phy_cu_unknown: a493f74ade8fe6 zhenpengzheng 2021-07-13 255 supported |= SUPPORTED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 256 advertising |= ADVERTISED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 257 cmd->base.port = PORT_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 258 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 259 case txgbe_phy_qt: a493f74ade8fe6 zhenpengzheng 2021-07-13 260 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 261 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 262 cmd->base.port = PORT_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 263 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 264 case txgbe_phy_nl: a493f74ade8fe6 zhenpengzheng 2021-07-13 265 case txgbe_phy_sfp_passive_tyco: a493f74ade8fe6 zhenpengzheng 2021-07-13 266 case txgbe_phy_sfp_passive_unknown: a493f74ade8fe6 zhenpengzheng 2021-07-13 267 case txgbe_phy_sfp_ftl: a493f74ade8fe6 zhenpengzheng 2021-07-13 268 case txgbe_phy_sfp_avago: a493f74ade8fe6 zhenpengzheng 2021-07-13 269 case txgbe_phy_sfp_intel: a493f74ade8fe6 zhenpengzheng 2021-07-13 270 case txgbe_phy_sfp_unknown: a493f74ade8fe6 zhenpengzheng 2021-07-13 271 switch (adapter->hw.phy.sfp_type) { a493f74ade8fe6 zhenpengzheng 2021-07-13 272 /* SFP+ devices, further checking needed */ a493f74ade8fe6 zhenpengzheng 2021-07-13 273 case txgbe_sfp_type_da_cu: a493f74ade8fe6 zhenpengzheng 2021-07-13 274 case txgbe_sfp_type_da_cu_core0: a493f74ade8fe6 zhenpengzheng 2021-07-13 275 case txgbe_sfp_type_da_cu_core1: a493f74ade8fe6 zhenpengzheng 2021-07-13 276 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 277 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 278 cmd->base.port = PORT_DA; a493f74ade8fe6 zhenpengzheng 2021-07-13 279 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 280 case txgbe_sfp_type_sr: a493f74ade8fe6 zhenpengzheng 2021-07-13 281 case txgbe_sfp_type_lr: a493f74ade8fe6 zhenpengzheng 2021-07-13 282 case txgbe_sfp_type_srlr_core0: a493f74ade8fe6 zhenpengzheng 2021-07-13 283 case txgbe_sfp_type_srlr_core1: a493f74ade8fe6 zhenpengzheng 2021-07-13 284 case txgbe_sfp_type_1g_sx_core0: a493f74ade8fe6 zhenpengzheng 2021-07-13 285 case txgbe_sfp_type_1g_sx_core1: a493f74ade8fe6 zhenpengzheng 2021-07-13 286 case txgbe_sfp_type_1g_lx_core0: a493f74ade8fe6 zhenpengzheng 2021-07-13 287 case txgbe_sfp_type_1g_lx_core1: a493f74ade8fe6 zhenpengzheng 2021-07-13 288 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 289 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 290 cmd->base.port = PORT_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 291 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 292 case txgbe_sfp_type_not_present: a493f74ade8fe6 zhenpengzheng 2021-07-13 293 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 294 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 295 cmd->base.port = PORT_NONE; a493f74ade8fe6 zhenpengzheng 2021-07-13 296 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 297 case txgbe_sfp_type_1g_cu_core0: a493f74ade8fe6 zhenpengzheng 2021-07-13 298 case txgbe_sfp_type_1g_cu_core1: a493f74ade8fe6 zhenpengzheng 2021-07-13 299 supported |= SUPPORTED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 300 advertising |= ADVERTISED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 301 cmd->base.port = PORT_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 302 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 303 case txgbe_sfp_type_unknown: a493f74ade8fe6 zhenpengzheng 2021-07-13 304 default: a493f74ade8fe6 zhenpengzheng 2021-07-13 305 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 306 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 307 cmd->base.port = PORT_OTHER; a493f74ade8fe6 zhenpengzheng 2021-07-13 308 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 309 } a493f74ade8fe6 zhenpengzheng 2021-07-13 310 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 311 case txgbe_phy_xaui: a493f74ade8fe6 zhenpengzheng 2021-07-13 312 supported |= SUPPORTED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 313 advertising |= ADVERTISED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 314 cmd->base.port = PORT_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 315 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 316 case txgbe_phy_unknown: a493f74ade8fe6 zhenpengzheng 2021-07-13 317 case txgbe_phy_generic: a493f74ade8fe6 zhenpengzheng 2021-07-13 318 case txgbe_phy_sfp_unsupported: a493f74ade8fe6 zhenpengzheng 2021-07-13 319 default: a493f74ade8fe6 zhenpengzheng 2021-07-13 320 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 321 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 322 cmd->base.port = PORT_OTHER; a493f74ade8fe6 zhenpengzheng 2021-07-13 323 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 324 } a493f74ade8fe6 zhenpengzheng 2021-07-13 325 a493f74ade8fe6 zhenpengzheng 2021-07-13 326 if (!in_interrupt()) { a493f74ade8fe6 zhenpengzheng 2021-07-13 327 TCALL(hw, mac.ops.check_link, &link_speed, &link_up, false); a493f74ade8fe6 zhenpengzheng 2021-07-13 328 } else { a493f74ade8fe6 zhenpengzheng 2021-07-13 329 /* a493f74ade8fe6 zhenpengzheng 2021-07-13 330 * this case is a special workaround for RHEL5 bonding a493f74ade8fe6 zhenpengzheng 2021-07-13 331 * that calls this routine from interrupt context a493f74ade8fe6 zhenpengzheng 2021-07-13 332 */ a493f74ade8fe6 zhenpengzheng 2021-07-13 333 link_speed = adapter->link_speed; a493f74ade8fe6 zhenpengzheng 2021-07-13 334 link_up = adapter->link_up; a493f74ade8fe6 zhenpengzheng 2021-07-13 335 } a493f74ade8fe6 zhenpengzheng 2021-07-13 336 a493f74ade8fe6 zhenpengzheng 2021-07-13 337 supported |= SUPPORTED_Pause; a493f74ade8fe6 zhenpengzheng 2021-07-13 338 a493f74ade8fe6 zhenpengzheng 2021-07-13 339 switch (hw->fc.requested_mode) { a493f74ade8fe6 zhenpengzheng 2021-07-13 340 case txgbe_fc_full: a493f74ade8fe6 zhenpengzheng 2021-07-13 341 advertising |= ADVERTISED_Pause; a493f74ade8fe6 zhenpengzheng 2021-07-13 342 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 343 case txgbe_fc_rx_pause: a493f74ade8fe6 zhenpengzheng 2021-07-13 344 advertising |= ADVERTISED_Pause | a493f74ade8fe6 zhenpengzheng 2021-07-13 345 ADVERTISED_Asym_Pause; a493f74ade8fe6 zhenpengzheng 2021-07-13 346 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 347 case txgbe_fc_tx_pause: a493f74ade8fe6 zhenpengzheng 2021-07-13 348 advertising |= ADVERTISED_Asym_Pause; a493f74ade8fe6 zhenpengzheng 2021-07-13 349 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 350 default: a493f74ade8fe6 zhenpengzheng 2021-07-13 351 advertising &= ~(ADVERTISED_Pause | a493f74ade8fe6 zhenpengzheng 2021-07-13 352 ADVERTISED_Asym_Pause); a493f74ade8fe6 zhenpengzheng 2021-07-13 353 } a493f74ade8fe6 zhenpengzheng 2021-07-13 354 a493f74ade8fe6 zhenpengzheng 2021-07-13 355 if (link_up) { a493f74ade8fe6 zhenpengzheng 2021-07-13 356 switch (link_speed) { a493f74ade8fe6 zhenpengzheng 2021-07-13 357 case TXGBE_LINK_SPEED_10GB_FULL: a493f74ade8fe6 zhenpengzheng 2021-07-13 358 cmd->base.speed = SPEED_10000; a493f74ade8fe6 zhenpengzheng 2021-07-13 359 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 360 case TXGBE_LINK_SPEED_1GB_FULL: a493f74ade8fe6 zhenpengzheng 2021-07-13 361 cmd->base.speed = SPEED_1000; a493f74ade8fe6 zhenpengzheng 2021-07-13 362 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 363 case TXGBE_LINK_SPEED_100_FULL: a493f74ade8fe6 zhenpengzheng 2021-07-13 364 cmd->base.speed = SPEED_100; a493f74ade8fe6 zhenpengzheng 2021-07-13 365 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 366 case TXGBE_LINK_SPEED_10_FULL: a493f74ade8fe6 zhenpengzheng 2021-07-13 367 cmd->base.speed = SPEED_10; a493f74ade8fe6 zhenpengzheng 2021-07-13 368 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 369 default: a493f74ade8fe6 zhenpengzheng 2021-07-13 370 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 371 } a493f74ade8fe6 zhenpengzheng 2021-07-13 372 cmd->base.duplex = DUPLEX_FULL; a493f74ade8fe6 zhenpengzheng 2021-07-13 373 } else { a493f74ade8fe6 zhenpengzheng 2021-07-13 374 cmd->base.speed = -1; a493f74ade8fe6 zhenpengzheng 2021-07-13 375 cmd->base.duplex = -1; a493f74ade8fe6 zhenpengzheng 2021-07-13 376 } a493f74ade8fe6 zhenpengzheng 2021-07-13 377 a493f74ade8fe6 zhenpengzheng 2021-07-13 378 ethtool_convert_legacy_u32_to_link_mode(cmd->link_modes.supported, a493f74ade8fe6 zhenpengzheng 2021-07-13 379 supported); a493f74ade8fe6 zhenpengzheng 2021-07-13 380 ethtool_convert_legacy_u32_to_link_mode(cmd->link_modes.advertising, a493f74ade8fe6 zhenpengzheng 2021-07-13 381 advertising); a493f74ade8fe6 zhenpengzheng 2021-07-13 382 return 0; a493f74ade8fe6 zhenpengzheng 2021-07-13 383 } a493f74ade8fe6 zhenpengzheng 2021-07-13 384 :::::: The code at line 177 was first introduced by commit :::::: a493f74ade8fe69f3446a65ddf7627fdf34c183c net: txgbe: Add support for Netswift 10G NIC :::::: TO: zhenpengzheng <zhenpengzheng(a)net-swift.com> :::::: CC: Zheng Zengkai <zhengzengkai(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] mm/swapfile.o: warning: objtool: free_swap_and_cache()+0x10f: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: 9b3ba7800bc02ca4f0e62d79b32edc22e24ca926 [1531/1531] mm: swap: fix race between free_swap_and_cache() and swapoff() config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503301931.DQUjzVBe-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301931.DQUjzVBe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301931.DQUjzVBe-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/swapfile.c:11: In file included from include/linux/hugetlb.h:45: include/linux/mempolicy.h:329:13: warning: unused function '__do_mbind' [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ 1 warning generated. >> mm/swapfile.o: warning: objtool: free_swap_and_cache()+0x10f: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] drivers/md/dm.o: warning: objtool: dm_process_bio()+0x2ec: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: 3830dbeebc54a74b56b8253c33857b38fae427fb [1531/1531] dm: revert partial fix for redundant bio-based IO accounting config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503301828.H3xVCQ5Q-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301828.H3xVCQ5Q-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301828.H3xVCQ5Q-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/md/dm.o: warning: objtool: dm_process_bio()+0x2ec: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 5b56c883c34a890a3f9ca7baa8aea426538c88a8
by kernel test robot 30 Mar '25

30 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 !15508 scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503300608.WYcT007F-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503301024.26J3J3nq-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503301315.o2E2dF19-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503301602.HqBUoFWQ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503301705.3fAiYws1-lkp@intel.com block/blk-mq.o: warning: objtool: blk_mq_unfreeze_queue()+0x75: unreachable instruction drivers/dax/bus.o: warning: objtool: __dax_driver_register()+0xd5: unreachable instruction drivers/net/dsa/realtek-smi.c:465:34: warning: 'realtek_smi_of_match' defined but not used [-Wunused-const-variable=] drivers/nvdimm/claim.o: warning: objtool: nsio_rw_bytes()+0x368: unreachable instruction drivers/xen/events/events_base.o: warning: objtool: xen_test_irq_shared()+0xe1: unreachable instruction fs/btrfs/file.o: warning: objtool: btrfs_drop_extent_cache()+0x738: unreachable instruction kernel/trace/ring_buffer.o: warning: objtool: rb_get_reader_page()+0x4d2: unreachable instruction Unverified Error/Warning (likely false positive, kindly check if interested): 789 | eprintk("kgdbts: ERROR: beyond end of test on" 795 | eprintk("kgdbts: ERROR: put buffer overflow on" Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250329 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-tee-optee-core.c:warning:return-makes-integer-from-pointer-without-a-cast | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250329 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250329 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-004-20250329 | `-- init-Kconfig:syntax-error |-- x86_64-allnoconfig | |-- Makefile:include-config-auto.conf.cmd:No-such-file-or-directory | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-allyesconfig | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- crypto-aegis128.o:warning:objtool:missing-symbol-for-section-.init.text | |-- crypto-zstd.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-regulator-max8973-regulator.o:warning:objtool:max8973_probe:can-t-find-switch-jump-table | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- samples-vfio-mdev-mdpy-fb.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-002-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- eprintk(-kgdbts:ERROR:beyond-end-of-test-on | |-- eprintk(-kgdbts:ERROR:put-buffer-overflow-on | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_ext.o:warning:objtool:missing-symbol-for-section-.init.text | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_ext.o:warning:objtool:missing-symbol-for-section-.init.text | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-mq.o:warning:objtool:blk_mq_unfreeze_queue:unreachable-instruction | |-- drivers-dax-bus.o:warning:objtool:__dax_driver_register:unreachable-instruction | |-- drivers-fpga-dfl.o:warning:objtool:build_info_commit_dev:unreachable-instruction | |-- drivers-nvdimm-claim.o:warning:objtool:nsio_rw_bytes:unreachable-instruction | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-xen-events-events_base.o:warning:objtool:xen_test_irq_shared:unreachable-instruction | |-- fs-btrfs-file.o:warning:objtool:btrfs_drop_extent_cache:unreachable-instruction | |-- kernel-trace-ring_buffer.o:warning:objtool:rb_get_reader_page:unreachable-instruction | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-defconfig | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized-in-this-function | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-101-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-gpu-drm-i915-i915_gem.o:warning:objtool:i915_gem_fault-falls-through-to-next-function-i915_gem_object_ggtt_pin() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:_intel_adjust_tile_offset-falls-through-to-next-function-rcu_lock_acquire() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:_intel_compute_tile_offset-falls-through-to-next-function-skl_format_to_fourcc() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:skl_plane_stride-falls-through-to-next-function-skl_plane_ctl() | |-- drivers-gpu-drm-i915-vlv_dsi_pll.o:warning:objtool:bxt_dsi_pll_enable-falls-through-to-next-function-bxt_dsi_reset_clocks() | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-mmc-host-mtk-sd.o:warning:objtool:msdc_set_timeout-falls-through-to-next-function-get_best_delay() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-102-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-103-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-md-raid5.o:warning:objtool:raid5_compute_sector-falls-through-to-next-function-raid5_compute_blocknr() | |-- drivers-mmc-host-mtk-sd.o:warning:objtool:msdc_set_timeout-falls-through-to-next-function-get_best_delay() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-104-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- fs-debugfs-file.o:warning:objtool:full_proxy_open:unreachable-instruction | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-121-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-merge.c:sparse:sparse:symbol-blk_try_req_merge-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_issue-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_requeue-was-not-declared.-Should-it-be-static | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- include-linux-bpf-cgroup.h:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:invalid-assignment: | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-122-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-merge.c:sparse:sparse:symbol-blk_try_req_merge-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_issue-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_requeue-was-not-declared.-Should-it-be-static | |-- drivers-net-wireless-ath-ath9k-htc_drv_txrx.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-restricted-__be16-usertype-rs_datalen-got-unsigned-short-usertype | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- include-linux-bpf-cgroup.h:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:invalid-assignment: | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-123-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-firewire-core-topology.o:warning:objtool:fw_core_handle_bus_reset:can-t-find-switch-jump-table | |-- drivers-input-mouse-elantech.o:warning:objtool:elantech_process_byte:can-t-find-switch-jump-table | |-- drivers-leds-leds-lm355x.o:warning:objtool:lm355x_control:can-t-find-switch-jump-table | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- fs-ext4-mballoc.o:warning:objtool:ext4_mb_complex_scan_group:unreachable-instruction | |-- fs-gfs2-glock.o:warning:objtool:finish_xmote:can-t-find-switch-jump-table | |-- fs-xfs-libxfs-xfs_rmap.o:warning:objtool:xfs_rmap_convert_shared:can-t-find-switch-jump-table | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-161-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-media-tuners-fc2580.o:warning:objtool:fc2580_set_params-falls-through-to-next-function-fc2580_standby() | |-- drivers-mmc-host-mtk-sd.o:warning:objtool:msdc_set_timeout-falls-through-to-next-function-get_best_delay() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-r052-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- drivers-net-dsa-realtek-smi.c:warning:realtek_smi_of_match-defined-but-not-used | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used `-- x86_64-randconfig-r053-20250330 |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union |-- drivers-mmc-host-mtk-sd.o:warning:objtool:msdc_set_timeout-falls-through-to-next-function-get_best_delay() |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 1445m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250329 gcc-7.5.0 arm64 randconfig-002-20250329 gcc-9.5.0 arm64 randconfig-003-20250329 gcc-5.5.0 arm64 randconfig-004-20250329 gcc-5.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250329 clang-20 x86_64 buildonly-randconfig-002-20250329 gcc-12 x86_64 buildonly-randconfig-003-20250329 gcc-12 x86_64 buildonly-randconfig-004-20250329 clang-20 x86_64 buildonly-randconfig-005-20250329 clang-20 x86_64 buildonly-randconfig-006-20250329 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1536/1536] drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: c3088bd9bdf90fcfc8a69046692d75c2b04563ba [1536/1536] ath9k_htc: Discard undersized packets config: x86_64-randconfig-122-20250330 (https://download.01.org/0day-ci/archive/20250330/202503301705.3fAiYws1-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301705.3fAiYws1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301705.3fAiYws1-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] rs_datalen @@ got unsigned short [usertype] @@ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: expected restricted __be16 [usertype] rs_datalen drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: got unsigned short [usertype] drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:988:13: sparse: sparse: restricted __be16 degrades to integer drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:1001:13: sparse: sparse: restricted __be16 degrades to integer In file included from drivers/net/wireless/ath/ath9k/htc.h:23, from drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:17: In function '__skb_queue_before', inlined from '__skb_queue_tail' at include/linux/skbuff.h:1886:2, inlined from 'ath9k_htc_tx_cleanup_queue' at drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:741:4: include/linux/skbuff.h:1852:9: warning: array subscript 'struct sk_buff[0]' is partly outside array bounds of 'struct sk_buff_head[1]' [-Warray-bounds] 1852 | __skb_insert(newsk, next->prev, next, list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c: In function 'ath9k_htc_tx_cleanup_queue': drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:733:29: note: object 'queue' of size 80 733 | struct sk_buff_head queue; | ^~~~~ vim +987 drivers/net/wireless/ath/ath9k/htc_drv_txrx.c 962 963 static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, 964 struct ath9k_htc_rxbuf *rxbuf, 965 struct ieee80211_rx_status *rx_status) 966 967 { 968 struct ieee80211_hdr *hdr; 969 struct ieee80211_hw *hw = priv->hw; 970 struct sk_buff *skb = rxbuf->skb; 971 struct ath_common *common = ath9k_hw_common(priv->ah); 972 struct ath_hw *ah = common->ah; 973 struct ath_htc_rx_status *rxstatus; 974 struct ath_rx_status rx_stats; 975 bool decrypt_error = false; 976 __be16 rs_datalen; 977 bool is_phyerr; 978 979 if (skb->len < HTC_RX_FRAME_HEADER_SIZE) { 980 ath_err(common, "Corrupted RX frame, dropping (len: %d)\n", 981 skb->len); 982 goto rx_next; 983 } 984 985 rxstatus = (struct ath_htc_rx_status *)skb->data; 986 > 987 rs_datalen = be16_to_cpu(rxstatus->rs_datalen); 988 if (unlikely(rs_datalen - 989 (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0)) { 990 ath_err(common, 991 "Corrupted RX data len, dropping (dlen: %d, skblen: %d)\n", 992 rs_datalen, skb->len); 993 goto rx_next; 994 } 995 996 is_phyerr = rxstatus->rs_status & ATH9K_RXERR_PHY; 997 /* 998 * Discard zero-length packets and packets smaller than an ACK 999 * which are not PHY_ERROR (short radar pulses have a length of 3) 1000 */ 1001 if (unlikely(!rs_datalen || (rs_datalen < 10 && !is_phyerr))) { 1002 ath_warn(common, 1003 "Short RX data len, dropping (dlen: %d)\n", 1004 rs_datalen); 1005 goto rx_next; 1006 } 1007 1008 /* Get the RX status information */ 1009 1010 memset(rx_status, 0, sizeof(struct ieee80211_rx_status)); 1011 1012 /* Copy everything from ath_htc_rx_status (HTC_RX_FRAME_HEADER). 1013 * After this, we can drop this part of skb. */ 1014 rx_status_htc_to_ath(&rx_stats, rxstatus); 1015 ath9k_htc_err_stat_rx(priv, &rx_stats); 1016 rx_status->mactime = be64_to_cpu(rxstatus->rs_tstamp); 1017 skb_pull(skb, HTC_RX_FRAME_HEADER_SIZE); 1018 1019 /* 1020 * everything but the rate is checked here, the rate check is done 1021 * separately to avoid doing two lookups for a rate for each frame. 1022 */ 1023 hdr = (struct ieee80211_hdr *)skb->data; 1024 1025 /* 1026 * Process PHY errors and return so that the packet 1027 * can be dropped. 1028 */ 1029 if (unlikely(is_phyerr)) { 1030 /* TODO: Not using DFS processing now. */ 1031 if (ath_cmn_process_fft(&priv->spec_priv, hdr, 1032 &rx_stats, rx_status->mactime)) { 1033 /* TODO: Code to collect spectral scan statistics */ 1034 } 1035 goto rx_next; 1036 } 1037 1038 if (!ath9k_cmn_rx_accept(common, hdr, rx_status, &rx_stats, 1039 &decrypt_error, priv->rxfilter)) 1040 goto rx_next; 1041 1042 ath9k_cmn_rx_skb_postprocess(common, skb, &rx_stats, 1043 rx_status, decrypt_error); 1044 1045 if (ath9k_cmn_process_rate(common, hw, &rx_stats, rx_status)) 1046 goto rx_next; 1047 1048 rx_stats.is_mybeacon = ath_is_mybeacon(common, hdr); 1049 ath9k_cmn_process_rssi(common, hw, &rx_stats, rx_status); 1050 1051 rx_status->band = ah->curchan->chan->band; 1052 rx_status->freq = ah->curchan->chan->center_freq; 1053 rx_status->antenna = rx_stats.rs_antenna; 1054 rx_status->flag |= RX_FLAG_MACTIME_END; 1055 1056 return true; 1057 rx_next: 1058 return false; 1059 } 1060 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] loongarch/cpu: Switch to arch_cpu_finalize_init()
by Hongchen Zhang 30 Mar '25

30 Mar '25

From: Thomas Gleixner <tglx(a)linutronix.de> mainline inclusion from mainline-v6.5-rc1 commit 9841c423164787feb8f1442f922b7d80a70c82f1 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBXCSJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- check_bugs() is about to be phased out. Switch over to the new arch_cpu_finalize_init() implementation. No functional change. Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Link: https://lore.kernel.org/r/20230613224545.195288218@linutronix.de Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> Signed-off-by: Juxin Gao <gaojuxin(a)loongson.cn> --- arch/loongarch/Kconfig | 1 + arch/loongarch/include/asm/bugs.h | 15 --------------- arch/loongarch/kernel/setup.c | 4 ++-- 3 files changed, 3 insertions(+), 17 deletions(-) delete mode 100644 arch/loongarch/include/asm/bugs.h diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig index 0b608275b4bb..ad5a6365dccb 100644 --- a/arch/loongarch/Kconfig +++ b/arch/loongarch/Kconfig @@ -10,6 +10,7 @@ config LOONGARCH select ARCH_ENABLE_MEMORY_HOTPLUG select ARCH_ENABLE_MEMORY_HOTREMOVE select ARCH_HAS_ACPI_TABLE_UPGRADE if ACPI + select ARCH_HAS_CPU_FINALIZE_INIT select ARCH_HAS_PHYS_TO_DMA select ARCH_HAS_PTE_SPECIAL select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST diff --git a/arch/loongarch/include/asm/bugs.h b/arch/loongarch/include/asm/bugs.h deleted file mode 100644 index 98396535163b..000000000000 --- a/arch/loongarch/include/asm/bugs.h +++ /dev/null @@ -1,15 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* - * This is included by init/main.c to check for architecture-dependent bugs. - * - * Copyright (C) 2020-2022 Loongson Technology Corporation Limited - */ -#ifndef _ASM_BUGS_H -#define _ASM_BUGS_H - -#include <asm/cpu.h> -#include <asm/cpu-info.h> - -extern void check_bugs(void); - -#endif /* _ASM_BUGS_H */ diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c index 5b6408296786..234bcbec6883 100644 --- a/arch/loongarch/kernel/setup.c +++ b/arch/loongarch/kernel/setup.c @@ -12,6 +12,7 @@ */ #include <linux/init.h> #include <linux/acpi.h> +#include <linux/cpu.h> #include <linux/dmi.h> #include <linux/efi.h> #include <linux/export.h> @@ -34,7 +35,6 @@ #include <asm/addrspace.h> #include <asm/alternative.h> #include <asm/bootinfo.h> -#include <asm/bugs.h> #include <asm/cache.h> #include <asm/cpu.h> #include <asm/dma.h> @@ -87,7 +87,7 @@ const char *get_system_type(void) return "generic-loongson-machine"; } -void __init check_bugs(void) +void __init arch_cpu_finalize_init(void) { alternative_instructions(); } -- 2.43.0

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 0e7e8faca7062a439fd0a56574c2c3860ceb2088
by kernel test robot 30 Mar '25

30 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 0e7e8faca7062a439fd0a56574c2c3860ceb2088 !15630 Fix CVE-2022-49553 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503292344.LYgqFDQe-lkp@intel.com drivers/gpu/drm/drm_atomic_helper.o: warning: objtool: drm_atomic_helper_commit_planes_on_crtc()+0x28b: unreachable instruction fs/notify/fanotify/fanotify.o: warning: objtool: fanotify_encode_fh()+0x1d6: unreachable instruction kernel/time/clocksource.o: warning: objtool: __clocksource_register_scale()+0x1c0: unreachable instruction Unverified Error/Warning (likely false positive, kindly check if interested): drivers/mtd/devices/mtd_dataflash.o: warning: objtool: dataflash_write() falls through to next function asan.module_ctor() sound/soc/fsl/fsl_easrc.o: warning: objtool: fsl_easrc_runtime_resume() falls through to next function asan.module_ctor() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-001-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-002-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-003-20250329 | |-- lib-gcc-aarch64-linux-..-plugin-include-config-elfos.h:warning:invalid-suffix-on-literal-C-requires-a-space-between-literal-and-string-macro | |-- lib-gcc-aarch64-linux-..-plugin-include-defaults.h:warning:invalid-suffix-on-literal-C-requires-a-space-between-literal-and-string-macro | |-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:field-call_clobbered-has-incomplete-type-pt_solution | |-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:field-call_used-has-incomplete-type-pt_solution | |-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:gimple_call_addr_fndecl-was-not-declared-in-this-scope | `-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:is_gimple_reg-was-not-declared-in-this-scope |-- x86_64-allnoconfig | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_file_name-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_log-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_HDD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CLEAR_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_ENABLE_MSIX-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_MASK_DISABLE-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_STATUS_EXIST_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_SSD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_mgrq_resend-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_notify-Werror-Wmissing-prototypes | `-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:error:unused-function-ps3_scsih_dev_id_get-Werror-Wunused-function |-- x86_64-buildonly-randconfig-001-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-002-20250329 | |-- arch-x86-kernel-paravirt.c:error:control-reaches-end-of-non-void-function | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-003-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-004-20250329 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-005-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-gpu-drm-drm_atomic_helper.o:warning:objtool:drm_atomic_helper_commit_planes_on_crtc:unreachable-instruction | |-- drivers-scsi-ufs-ufshcd.o:warning:objtool:ufshcd_queue_tmf:unreachable-instruction | |-- fs-notify-fanotify-fanotify.o:warning:objtool:fanotify_encode_fh:unreachable-instruction | |-- kernel-time-clocksource.o:warning:objtool:__clocksource_register_scale:unreachable-instruction | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-006-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-101-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-vmscan.o:warning:objtool:do_shrink_slab-falls-through-to-next-function-allow_direct_reclaim() | `-- sound-soc-fsl-fsl_easrc.o:warning:objtool:fsl_easrc_runtime_resume-falls-through-to-next-function-asanmodule_ctor() |-- x86_64-randconfig-102-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-103-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-video-fbdev-hyperv_fb.o:warning:objtool:synthvid_deferred_io-falls-through-to-next-function-hvfb_pci_stub_probe() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:bitmap_clear_bits-falls-through-to-next-function-free_bitmap() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- mm-vmscan.o:warning:objtool:do_shrink_slab-falls-through-to-next-function-allow_direct_reclaim() |-- x86_64-randconfig-104-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_thread_vid_cap_tick-falls-through-to-next-function-plane_vaddr() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-121-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-memcontrol.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__user-buffer | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-122-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-memcontrol.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__user-buffer | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-mtd-devices-mtd_dataflash.o:warning:objtool:dataflash_write-falls-through-to-next-function-asanmodule_ctor() | |-- drivers-nvdimm-namespace_devs.o:warning:objtool:size_store-falls-through-to-next-function-nd_namespace_label_update() | |-- fs-ufs-balloc.o:warning:objtool:ufs_free_fragments-falls-through-to-next-function-ufs_clusteracct() | |-- fs-ufs-ialloc.o:warning:objtool:ufs_new_inode-falls-through-to-next-function-ufs2_init_inodes_chunk() | |-- fs-ufs-inode.o:warning:objtool:ufs_iget-falls-through-to-next-function-ufs_set_inode_ops() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- x86_64-randconfig-161-20250329 |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_thread_vid_cap_tick-falls-through-to-next-function-plane_vaddr() |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory elapsed time: 1445m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250329 gcc-7.5.0 arm64 randconfig-002-20250329 gcc-9.5.0 arm64 randconfig-003-20250329 gcc-5.5.0 arm64 randconfig-004-20250329 gcc-5.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250329 clang-20 x86_64 buildonly-randconfig-002-20250329 gcc-12 x86_64 buildonly-randconfig-003-20250329 gcc-12 x86_64 buildonly-randconfig-004-20250329 clang-20 x86_64 buildonly-randconfig-005-20250329 clang-20 x86_64 buildonly-randconfig-006-20250329 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] kernel/trace/ring_buffer.o: warning: objtool: rb_get_reader_page()+0x4d2: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: ac59b83e5b01ef06262e927dc7207adf8553c823 [1531/1531] ring-buffer: Fix race between reset page and reading page config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503301602.HqBUoFWQ-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301602.HqBUoFWQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301602.HqBUoFWQ-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/trace/ring_buffer.c:5013:6: warning: variable 'cnt' set but not used [-Wunused-but-set-variable] 5013 | int cnt; | ^ 1 warning generated. kernel/trace/ring_buffer.c:1116: warning: Function parameter or member 'cpu_buffer' not described in 'rb_check_list' kernel/trace/ring_buffer.c:1116: warning: Function parameter or member 'list' not described in 'rb_check_list' kernel/trace/ring_buffer.c:1356: warning: Function parameter or member 'key' not described in '__ring_buffer_alloc' kernel/trace/ring_buffer.c:2329: warning: Function parameter or member 'cpu_buffer' not described in 'rb_update_event' kernel/trace/ring_buffer.c:2329: warning: Function parameter or member 'info' not described in 'rb_update_event' kernel/trace/ring_buffer.c:2329: warning: Excess function parameter 'type' description in 'rb_update_event' kernel/trace/ring_buffer.c:2329: warning: Excess function parameter 'length' description in 'rb_update_event' kernel/trace/ring_buffer.c:4381: warning: Function parameter or member 'cpu' not described in 'ring_buffer_size' kernel/trace/ring_buffer.c:4560: warning: Function parameter or member 'cpu' not described in 'ring_buffer_swap_cpu' >> kernel/trace/ring_buffer.o: warning: objtool: rb_get_reader_page()+0x4d2: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION f030d5397b5940b1ca4edfc8a40b53c553814b40
by kernel test robot 30 Mar '25

30 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f030d5397b5940b1ca4edfc8a40b53c553814b40 !15686 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.76-6.6.78 LTS Patches Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-virtcca_get_tmi_version | |-- drivers-coda-coda_pci.c:warning:Excess-function-parameter-pdev-description-in-virtcca_pci_get_rom_size | |-- drivers-coda-coda_pci.c:warning:Function-parameter-or-member-p-not-described-in-virtcca_pci_get_rom_size | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_DRBG_CTR-when-selected-by-CRYPTO_DEV_HISI_TRNG | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-defconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-001-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-002-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allmodconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allnoconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allyesconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-defconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-001-20250329 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-002-20250329 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allyesconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250329 | |-- drivers-gpu-drm-sti-sti_dvo.c:error:implicit-declaration-of-function-devm_ioremap | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250329 | |-- drivers-gpu-drm-sti-sti_dvo.c:error:implicit-declaration-of-function-devm_ioremap | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size |-- x86_64-randconfig-101-20250330 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-102-20250330 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-103-20250330 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-104-20250330 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-121-20250330 | |-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:sparse:sparse:symbol-tdm_service_exit-was-not-declared.-Should-it-be-static | |-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:sparse:sparse:symbol-tdm_service_run-was-not-declared.-Should-it-be-static | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-122-20250330 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-123-20250330 | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used `-- x86_64-randconfig-161-20250329 |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used `-- mm-mm_init.c-deferred_init_mem_pfn_range_in_zone()-warn:iterator-j-not-incremented elapsed time: 1446m configs tested: 21 configs skipped: 124 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250329 gcc-7.5.0 arm64 randconfig-002-20250329 gcc-9.5.0 arm64 randconfig-003-20250329 gcc-5.5.0 arm64 randconfig-004-20250329 gcc-5.5.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250329 gcc-14.2.0 loongarch randconfig-002-20250329 gcc-14.2.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250329 clang-20 x86_64 buildonly-randconfig-002-20250329 gcc-12 x86_64 buildonly-randconfig-003-20250329 gcc-12 x86_64 buildonly-randconfig-004-20250329 clang-20 x86_64 buildonly-randconfig-005-20250329 clang-20 x86_64 buildonly-randconfig-006-20250329 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] drivers/dax/bus.o: warning: objtool: __dax_driver_register()+0xd5: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

Hi Dan, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: 9bb67bd58e6a7e3ef00793b4966be7bb0a346830 [1531/1531] Intel: device-dax: Add support for a dax override driver config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503301315.o2E2dF19-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301315.o2E2dF19-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301315.o2E2dF19-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/dax/bus.o: warning: objtool: __dax_driver_register()+0xd5: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] block/blk-mq.o: warning: objtool: blk_mq_unfreeze_queue()+0x75: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: cbd9fe6e727ed12c1e542f74514e6dd4419f1cf6 [1531/1531] blk-mq: fix hang caused by freeze/unfreeze sequence config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503301024.26J3J3nq-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301024.26J3J3nq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301024.26J3J3nq-lkp@intel.com/ All warnings (new ones prefixed by >>): block/blk-mq.c:600:44: warning: passing 8-byte aligned argument to 32-byte aligned parameter 2 of 'smp_call_function_single_async' may result in an unaligned pointer access [-Walign-mismatch] 600 | smp_call_function_single_async(ctx->cpu, &rq->csd); | ^ 1 warning generated. >> block/blk-mq.o: warning: objtool: blk_mq_unfreeze_queue()+0x75: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] drivers/xen/events/events_base.o: warning: objtool: xen_test_irq_shared()+0xe1: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: fc0f59c16e93291923fcebd942b78c9bddfecc56 [1531/1531] xen/events: avoid removing an event channel while handling it config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503300608.WYcT007F-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503300608.WYcT007F-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503300608.WYcT007F-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/xen/events/events_base.c:1697:6: warning: no previous prototype for function 'xen_callback_vector' [-Wmissing-prototypes] 1697 | void xen_callback_vector(void) {} | ^ drivers/xen/events/events_base.c:1697:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1697 | void xen_callback_vector(void) {} | ^ | static 1 warning generated. >> drivers/xen/events/events_base.o: warning: objtool: xen_test_irq_shared()+0xe1: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2827/2827] kernel/time/clocksource.o: warning: objtool: __clocksource_register_scale()+0x1c0: unreachable instruction
by kernel test robot 29 Mar '25

29 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0e7e8faca7062a439fd0a56574c2c3860ceb2088 commit: 3e04146d67272c65eef5abc5a60c04cf8529ec71 [2827/2827] time: Add mechanism to recognize clocksource in time_get_snapshot config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250329/202503292344.LYgqFDQe-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250329/202503292344.LYgqFDQe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503292344.LYgqFDQe-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/time/clocksource.o: warning: objtool: __clocksource_register_scale()+0x1c0: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v3 00/28] Add support for heterogeneous live migration
by Jinqian Yang 29 Mar '25

29 Mar '25

Patch#1 Allow userspace to get the writable masks for feature ID registers Patch#2 Document KVM_ARM_GET_REG_WRITABLE_MASKS Patch#3 Use guest ID register values for the sake of emulation Patch#4 Advertise selected DebugVer in DBGDIDR.Version Patch#5 Reject attempts to set invalid debug arch version Patch#6 Bump up the default KVM sanitised debug version to v8p8 Patch#7 Allow userspace to change ID_AA64ISAR{0-2}_EL1 Patch#8 Allow userspace to change ID_AA64MMFR{0-2}_EL1 Patch#9 Allow userspace to change ID_AA64PFR0_EL1 Patch#10 Allow userspace to change ID_AA64ZFR0_EL1 Patch#11 Document vCPU feature selection UAPIs Patch#12 Make the exposed feature bits in AA64DFR0_EL1 writable from userspace Patch#13 Disable MPAM visibility by default and ignore VMM writes Patch#14 Rename is_id_reg() to imply VM scope Patch#15 Reset VM feature ID regs from kvm_reset_sys_regs() Patch#16 Only reset vCPU-scoped feature ID regs once Patch#17 Use read-only helper for reading VM ID registers Patch#18 Add helper for writing ID regs Patch#19 Treat CTR_EL0 as a VM feature ID register Patch#20 Rename functions for invariant sys regs Patch#21 Make the L1Ip feature bits in CTR_EL0 writable from userspace Patch#22 Show writable masks for feature registers Patch#23 Make HCX writable from userspace Patch#24 Remove duplicated AA64MMFR1_EL1 XNX Patch#25 Add support for HIP09 Spectre-BHB mitigation Patch#26 add cnp verification on Hisilicon erratum 162100125 Patch#27 use KABI_EXTEND to revert struct kvm kabi change Patch#28 Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden James Morse (1): KVM: arm64: Disable MPAM visibility by default and ignore VMM writes Jing Zhang (5): KVM: arm64: Allow userspace to get the writable masks for feature ID registers KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS KVM: arm64: Use guest ID register values for the sake of emulation KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Marc Zyngier (1): KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden Oliver Upton (11): KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version KVM: arm64: Reject attempts to set invalid debug arch version KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 KVM: arm64: Document vCPU feature selection UAPIs KVM: arm64: Rename is_id_reg() to imply VM scope KVM: arm64: Reset VM feature ID regs from kvm_reset_sys_regs() KVM: arm64: Only reset vCPU-scoped feature ID regs once KVM: arm64: Use read-only helper for reading VM ID registers KVM: arm64: Add helper for writing ID regs Russell King (1): KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX Sebastian Ott (3): KVM: arm64: Treat CTR_EL0 as a VM feature ID register KVM: arm64: rename functions for invariant sys regs KVM: arm64: show writable masks for feature registers Shameer Kolothum (2): KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace yangjinqian (4): KVM: arm64: Make HCX writable from userspace arm64: Add support for HIP09 Spectre-BHB mitigation arm64: add cnp verification on Hisilicon erratum 162100125 KVM: arm64: use KABI_EXTEND to revert struct kvm kabi change Documentation/virt/kvm/api.rst | 52 +++ Documentation/virt/kvm/arm/index.rst | 1 + Documentation/virt/kvm/arm/vcpu-features.rst | 48 +++ arch/arm64/include/asm/cpufeature.h | 14 + arch/arm64/include/asm/kvm_emulate.h | 3 +- arch/arm64/include/asm/kvm_host.h | 24 ++ arch/arm64/include/uapi/asm/kvm.h | 32 ++ arch/arm64/kernel/cpu_errata.c | 13 +- arch/arm64/kernel/proton-pack.c | 1 + arch/arm64/kvm/arm.c | 15 +- arch/arm64/kvm/pmu-emul.c | 2 +- arch/arm64/kvm/sys_regs.c | 351 +++++++++++++++---- include/uapi/linux/kvm.h | 2 + 13 files changed, 475 insertions(+), 83 deletions(-) create mode 100644 Documentation/virt/kvm/arm/vcpu-features.rst -- 2.33.0

2 29

[PATCH OLK-6.6] tracing: Fix use-after-free in print_graph_function_flags during tracer switching
by Tengda Wu 29 Mar '25

29 Mar '25

From: Tengda Wu <wutengda(a)huaweicloud.com> mainline inclusion from mainline-v6.15 commit 7f81f27b1093e4895e87b74143c59c055c3b1906 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBWWU7 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the following script: $ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tracer The root cause lies in the two calls to print_graph_function_flags within print_trace_line during each s_show(): * One through 'iter->trace->print_line()'; * Another through 'event->funcs->trace()', which is hidden in print_trace_fmt() before print_trace_line returns. Tracer switching only updates the former, while the latter continues to use the print_line function of the old tracer, which in the script above is print_graph_function_flags. Moreover, when switching from the 'function_graph' tracer to the 'timerlat' tracer, s_start only calls graph_trace_close of the 'function_graph' tracer to free 'iter->private', but does not set it to NULL. This provides an opportunity for 'event->funcs->trace()' to use an invalid 'iter->private'. To fix this issue, set 'iter->private' to NULL immediately after freeing it in graph_trace_close(), ensuring that an invalid pointer is not passed to other tracers. Additionally, clean up the unnecessary 'iter->private = NULL' during each 'cat trace' when using wakeup and irqsoff tracers. [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Zheng Yejian <zhengyejian1(a)huawei.com> Link: https://lore.kernel.org/20250320122137.23635-1-wutengda@huaweicloud.com Fixes: eecb91b9f98d ("tracing: Fix memleak due to race between current_tracer and trace") Closes: https://lore.kernel.org/all/CAMgjq7BW79KDSCyp+tZHjShSzHsScSiJxn5ffskp-QzVM0… Reported-by: Kairui Song <kasong(a)tencent.com> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_functions_graph.c | 1 + kernel/trace/trace_irqsoff.c | 2 -- kernel/trace/trace_sched_wakeup.c | 2 -- 3 files changed, 1 insertion(+), 4 deletions(-) diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c index c35fbaab2a47..4d4808186a0f 100644 --- a/kernel/trace/trace_functions_graph.c +++ b/kernel/trace/trace_functions_graph.c @@ -1317,6 +1317,7 @@ void graph_trace_close(struct trace_iterator *iter) if (data) { free_percpu(data->cpu_data); kfree(data); + iter->private = NULL; } } diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c index ba37f768e2f2..6c9db857fe0e 100644 --- a/kernel/trace/trace_irqsoff.c +++ b/kernel/trace/trace_irqsoff.c @@ -231,8 +231,6 @@ static void irqsoff_trace_open(struct trace_iterator *iter) { if (is_graph(iter->tr)) graph_trace_open(iter); - else - iter->private = NULL; } static void irqsoff_trace_close(struct trace_iterator *iter) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index 0469a04a355f..330aee1c1a49 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -168,8 +168,6 @@ static void wakeup_trace_open(struct trace_iterator *iter) { if (is_graph(iter->tr)) graph_trace_open(iter); - else - iter->private = NULL; } static void wakeup_trace_close(struct trace_iterator *iter) -- 2.34.1

2 1

[PATCH OLK-6.6] perf/core: Add RCU read lock protection to perf_iterate_ctx()
by Tengda Wu 29 Mar '25

29 Mar '25

From: Breno Leitao <leitao(a)debian.org> stable inclusion from stable-v6.6.81 commit f390c2eea571945f357a2d3b9fcb1c015767132e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVT2 CVE: CVE-2025-21889 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0fe8813baf4b2e865d3b2c735ce1a15b86002c74 upstream. The perf_iterate_ctx() function performs RCU list traversal but currently lacks RCU read lock protection. This causes lockdep warnings when running perf probe with unshare(1) under CONFIG_PROVE_RCU_LIST=y: WARNING: suspicious RCU usage kernel/events/core.c:8168 RCU-list traversed in non-reader section!! Call Trace: lockdep_rcu_suspicious ? perf_event_addr_filters_apply perf_iterate_ctx perf_event_exec begin_new_exec ? load_elf_phdrs load_elf_binary ? lock_acquire ? find_held_lock ? bprm_execve bprm_execve do_execveat_common.isra.0 __x64_sys_execve do_syscall_64 entry_SYSCALL_64_after_hwframe This protection was previously present but was removed in commit bd2756811766 ("perf: Rewrite core context handling"). Add back the necessary rcu_read_lock()/rcu_read_unlock() pair around perf_iterate_ctx() call in perf_event_exec(). [ mingo: Use scoped_guard() as suggested by Peter ] Fixes: bd2756811766 ("perf: Rewrite core context handling") Signed-off-by: Breno Leitao <leitao(a)debian.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20250117-fix_perf_rcu-v1-1-13cb9210fc6a@debian.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/events/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index c2b93f521497..0b9e703641d1 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -8124,7 +8124,8 @@ void perf_event_exec(void) perf_event_enable_on_exec(ctx); perf_event_remove_on_exec(ctx); - perf_iterate_ctx(ctx, perf_event_addr_filters_exec, NULL, true); + scoped_guard(rcu) + perf_iterate_ctx(ctx, perf_event_addr_filters_exec, NULL, true); perf_unpin_context(ctx); put_ctx(ctx); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] tracing: Make sure trace_printk() can output as soon as it can be used
by Tengda Wu 29 Mar '25

29 Mar '25

From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org> stable inclusion from stable-v4.19.272 commit b94d7c7654356860dd7719120c7d15ba38b6162a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVXX CVE: CVE-2023-53007 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3bb06eb6e9acf7c4a3e1b5bc87aed398ff8e2253 upstream. Currently trace_printk() can be used as soon as early_trace_init() is called from start_kernel(). But if a crash happens, and "ftrace_dump_on_oops" is set on the kernel command line, all you get will be: [ 0.456075] <idle>-0 0dN.2. 347519us : Unknown type 6 [ 0.456075] <idle>-0 0dN.2. 353141us : Unknown type 6 [ 0.456075] <idle>-0 0dN.2. 358684us : Unknown type 6 This is because the trace_printk() event (type 6) hasn't been registered yet. That gets done via an early_initcall(), which may be early, but not early enough. Instead of registering the trace_printk() event (and other ftrace events, which are not trace events) via an early_initcall(), have them registered at the same time that trace_printk() can be used. This way, if there is a crash before early_initcall(), then the trace_printk()s will actually be useful. Link: https://lkml.kernel.org/r/20230104161412.019f6c55@gandalf.local.home Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Fixes: e725c731e3bb1 ("tracing: Split tracing initialization into two for early initialization") Reported-by: "Joel Fernandes (Google)" <joel(a)joelfernandes.org> Tested-by: Joel Fernandes (Google) <joel(a)joelfernandes.org> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace.c | 2 ++ kernel/trace/trace.h | 1 + kernel/trace/trace_output.c | 3 +-- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 64fd3c3f84f2..161cd058662c 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -8648,6 +8648,8 @@ void __init early_trace_init(void) static_key_enable(&tracepoint_printk_key.key); } tracer_alloc_buffers(); + + init_events(); } void __init trace_init(void) diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h index d05230d21cf5..00e73361c65c 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h @@ -1509,6 +1509,7 @@ extern void trace_event_enable_cmd_record(bool enable); extern void trace_event_enable_tgid_record(bool enable); extern int event_trace_init(void); +extern int init_events(void); extern int event_trace_add_tracer(struct dentry *parent, struct trace_array *tr); extern int event_trace_del_tracer(struct trace_array *tr); diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c index 6e6cc64faa38..62015d62dd6f 100644 --- a/kernel/trace/trace_output.c +++ b/kernel/trace/trace_output.c @@ -1395,7 +1395,7 @@ static struct trace_event *events[] __initdata = { NULL }; -__init static int init_events(void) +__init int init_events(void) { struct trace_event *event; int i, ret; @@ -1413,4 +1413,3 @@ __init static int init_events(void) return 0; } -early_initcall(init_events); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] trace_events_hist: add check for return value of 'create_hist_field'
by Tengda Wu 29 Mar '25

29 Mar '25

From: Natalia Petrova <n.petrova(a)fintech.ru> stable inclusion from stable-v4.19.272 commit d2d1ada58e7cc100b8d7d6b082d19321ba4a700a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVXP CVE: CVE-2023-53005 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8b152e9150d07a885f95e1fd401fc81af202d9a4 upstream. Function 'create_hist_field' is called recursively at trace_events_hist.c:1954 and can return NULL-value that's why we have to check it to avoid null pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Link: https://lkml.kernel.org/r/20230111120409.4111-1-n.petrova@fintech.ru Cc: stable(a)vger.kernel.org Fixes: 30350d65ac56 ("tracing: Add variable support to hist triggers") Signed-off-by: Natalia Petrova <n.petrova(a)fintech.ru> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events_hist.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 2f57eb241ac9..af376cf4ba9a 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -2234,6 +2234,8 @@ static struct hist_field *create_hist_field(struct hist_trigger_data *hist_data, unsigned long fl = flags & ~HIST_FIELD_FL_LOG2; hist_field->fn = hist_field_log2; hist_field->operands[0] = create_hist_field(hist_data, field, fl, NULL); + if (!hist_field->operands[0]) + goto free; hist_field->size = hist_field->operands[0]->size; hist_field->type = kstrdup(hist_field->operands[0]->type, GFP_KERNEL); if (!hist_field->type) -- 2.34.1

2 1

[PATCH OLK-5.10] usb: gadget: f_tcm: Don't free command immediately
by Xiongfeng Wang 29 Mar '25

29 Mar '25

From: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> stable inclusion from stable-v5.10.235 commit 38229c35a6d7875697dfb293356407330cfcd23e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBREC7 CVE: CVE-2025-21816 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c225d006a31949d673e646d585d9569bc28feeb9 upstream. Don't prematurely free the command. Wait for the status completion of the sense status. It can be freed then. Otherwise we will double-free the command. Fixes: cff834c16d23 ("usb-gadget/tcm: Convert to TARGET_SCF_ACK_KREF I/O krefs") Cc: stable(a)vger.kernel.org Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Link: https://lore.kernel.org/r/ae919ac431f16275e05ec819bdffb3ac5f44cbe1.17338765… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/usb/gadget/function/f_tcm.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c index 5a2e9ce2bc352..caa23265fae4c 100644 --- a/drivers/usb/gadget/function/f_tcm.c +++ b/drivers/usb/gadget/function/f_tcm.c @@ -1068,7 +1068,6 @@ static void usbg_cmd_work(struct work_struct *work) out: transport_send_check_condition_and_sense(se_cmd, TCM_UNSUPPORTED_SCSI_OPCODE, 1); - transport_generic_free_cmd(&cmd->se_cmd, 0); } static struct usbg_cmd *usbg_get_cmd(struct f_uas *fu, @@ -1199,7 +1198,6 @@ static void bot_cmd_work(struct work_struct *work) out: transport_send_check_condition_and_sense(se_cmd, TCM_UNSUPPORTED_SCSI_OPCODE, 1); - transport_generic_free_cmd(&cmd->se_cmd, 0); } static int bot_submit_command(struct f_uas *fu, -- 2.20.1

2 1

[PATCH openEuler-1.0-LTS] drbd: Fix five use after free bugs in get_initial_state
by Xiaomeng Zhang 29 Mar '25

29 Mar '25

From: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> stable inclusion from stable-v5.10.111 commit 594205b4936771a250f9d141e7e0fff21c3dd2d9 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBX1EN Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aadb22ba2f656581b2f733deb3a467c48cc618f6 ] In get_initial_state, it calls notify_initial_state_done(skb,..) if cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_done(), the skb will be freed by nlmsg_free(skb). Then get_initial_state will goto out and the freed skb will be used by return value skb->len, which is a uaf bug. What's worse, the same problem goes even further: skb can also be freed in the notify_*_state_change -> notify_*_state calls below. Thus 4 additional uaf bugs happened. My patch lets the problem callee functions: notify_initial_state_done and notify_*_state_change return an error code if errors happen. So that the error codes could be propagated and the uaf bugs can be avoid. v2 reports a compilation warning. This v3 fixed this warning and built successfully in my local environment with no additional warnings. v2: https://lore.kernel.org/patchwork/patch/1435218/ Fixes: a29728463b254 ("drbd: Backport the "events2" command") Signed-off-by: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder(a)linbit.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/block/drbd/drbd_int.h | 8 ++--- drivers/block/drbd/drbd_nl.c | 41 ++++++++++++++++---------- drivers/block/drbd/drbd_state.c | 18 +++++------ drivers/block/drbd/drbd_state_change.h | 8 ++--- 4 files changed, 42 insertions(+), 33 deletions(-) diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h index e35a234b0a8f..4f66cf6879fd 100644 --- a/drivers/block/drbd/drbd_int.h +++ b/drivers/block/drbd/drbd_int.h @@ -1688,22 +1688,22 @@ struct sib_info { }; void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib); -extern void notify_resource_state(struct sk_buff *, +extern int notify_resource_state(struct sk_buff *, unsigned int, struct drbd_resource *, struct resource_info *, enum drbd_notification_type); -extern void notify_device_state(struct sk_buff *, +extern int notify_device_state(struct sk_buff *, unsigned int, struct drbd_device *, struct device_info *, enum drbd_notification_type); -extern void notify_connection_state(struct sk_buff *, +extern int notify_connection_state(struct sk_buff *, unsigned int, struct drbd_connection *, struct connection_info *, enum drbd_notification_type); -extern void notify_peer_device_state(struct sk_buff *, +extern int notify_peer_device_state(struct sk_buff *, unsigned int, struct drbd_peer_device *, struct peer_device_info *, diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c index 5b15ffd0c7f5..5a80453be553 100644 --- a/drivers/block/drbd/drbd_nl.c +++ b/drivers/block/drbd/drbd_nl.c @@ -4598,7 +4598,7 @@ static int nla_put_notification_header(struct sk_buff *msg, return drbd_notification_header_to_skb(msg, &nh, true); } -void notify_resource_state(struct sk_buff *skb, +int notify_resource_state(struct sk_buff *skb, unsigned int seq, struct drbd_resource *resource, struct resource_info *resource_info, @@ -4640,16 +4640,17 @@ void notify_resource_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_device_state(struct sk_buff *skb, +int notify_device_state(struct sk_buff *skb, unsigned int seq, struct drbd_device *device, struct device_info *device_info, @@ -4689,16 +4690,17 @@ void notify_device_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_connection_state(struct sk_buff *skb, +int notify_connection_state(struct sk_buff *skb, unsigned int seq, struct drbd_connection *connection, struct connection_info *connection_info, @@ -4738,16 +4740,17 @@ void notify_connection_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_peer_device_state(struct sk_buff *skb, +int notify_peer_device_state(struct sk_buff *skb, unsigned int seq, struct drbd_peer_device *peer_device, struct peer_device_info *peer_device_info, @@ -4788,13 +4791,14 @@ void notify_peer_device_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } void notify_helper(enum drbd_notification_type type, @@ -4845,7 +4849,7 @@ void notify_helper(enum drbd_notification_type type, err, seq); } -static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) +static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq) { struct drbd_genlmsghdr *dh; int err; @@ -4859,11 +4863,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) if (nla_put_notification_header(skb, NOTIFY_EXISTS)) goto nla_put_failure; genlmsg_end(skb, dh); - return; + return 0; nla_put_failure: nlmsg_free(skb); pr_err("Error %d sending event. Event seq:%u\n", err, seq); + return err; } static void free_state_changes(struct list_head *list) @@ -4890,6 +4895,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) unsigned int seq = cb->args[2]; unsigned int n; enum drbd_notification_type flags = 0; + int err = 0; /* There is no need for taking notification_mutex here: it doesn't matter if the initial state events mix with later state chage @@ -4898,32 +4904,32 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) cb->args[5]--; if (cb->args[5] == 1) { - notify_initial_state_done(skb, seq); + err = notify_initial_state_done(skb, seq); goto out; } n = cb->args[4]++; if (cb->args[4] < cb->args[3]) flags |= NOTIFY_CONTINUES; if (n < 1) { - notify_resource_state_change(skb, seq, state_change->resource, + err = notify_resource_state_change(skb, seq, state_change->resource, NOTIFY_EXISTS | flags); goto next; } n--; if (n < state_change->n_connections) { - notify_connection_state_change(skb, seq, &state_change->connections[n], + err = notify_connection_state_change(skb, seq, &state_change->connections[n], NOTIFY_EXISTS | flags); goto next; } n -= state_change->n_connections; if (n < state_change->n_devices) { - notify_device_state_change(skb, seq, &state_change->devices[n], + err = notify_device_state_change(skb, seq, &state_change->devices[n], NOTIFY_EXISTS | flags); goto next; } n -= state_change->n_devices; if (n < state_change->n_devices * state_change->n_connections) { - notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], + err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], NOTIFY_EXISTS | flags); goto next; } @@ -4938,7 +4944,10 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) cb->args[4] = 0; } out: - return skb->len; + if (err) + return err; + else + return skb->len; } int drbd_adm_get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c index b452359b6aae..1474250f9440 100644 --- a/drivers/block/drbd/drbd_state.c +++ b/drivers/block/drbd/drbd_state.c @@ -1549,7 +1549,7 @@ int drbd_bitmap_io_from_worker(struct drbd_device *device, return rv; } -void notify_resource_state_change(struct sk_buff *skb, +int notify_resource_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_resource_state_change *resource_state_change, enum drbd_notification_type type) @@ -1562,10 +1562,10 @@ void notify_resource_state_change(struct sk_buff *skb, .res_susp_fen = resource_state_change->susp_fen[NEW], }; - notify_resource_state(skb, seq, resource, &resource_info, type); + return notify_resource_state(skb, seq, resource, &resource_info, type); } -void notify_connection_state_change(struct sk_buff *skb, +int notify_connection_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_connection_state_change *connection_state_change, enum drbd_notification_type type) @@ -1576,10 +1576,10 @@ void notify_connection_state_change(struct sk_buff *skb, .conn_role = connection_state_change->peer_role[NEW], }; - notify_connection_state(skb, seq, connection, &connection_info, type); + return notify_connection_state(skb, seq, connection, &connection_info, type); } -void notify_device_state_change(struct sk_buff *skb, +int notify_device_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_device_state_change *device_state_change, enum drbd_notification_type type) @@ -1589,10 +1589,10 @@ void notify_device_state_change(struct sk_buff *skb, .dev_disk_state = device_state_change->disk_state[NEW], }; - notify_device_state(skb, seq, device, &device_info, type); + return notify_device_state(skb, seq, device, &device_info, type); } -void notify_peer_device_state_change(struct sk_buff *skb, +int notify_peer_device_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_peer_device_state_change *p, enum drbd_notification_type type) @@ -1606,7 +1606,7 @@ void notify_peer_device_state_change(struct sk_buff *skb, .peer_resync_susp_dependency = p->resync_susp_dependency[NEW], }; - notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); + return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); } static void broadcast_state_change(struct drbd_state_change *state_change) @@ -1614,7 +1614,7 @@ static void broadcast_state_change(struct drbd_state_change *state_change) struct drbd_resource_state_change *resource_state_change = &state_change->resource[0]; bool resource_state_has_changed; unsigned int n_device, n_connection, n_peer_device, n_peer_devices; - void (*last_func)(struct sk_buff *, unsigned int, void *, + int (*last_func)(struct sk_buff *, unsigned int, void *, enum drbd_notification_type) = NULL; void *uninitialized_var(last_arg); diff --git a/drivers/block/drbd/drbd_state_change.h b/drivers/block/drbd/drbd_state_change.h index ba80f612d6ab..d5b0479bc9a6 100644 --- a/drivers/block/drbd/drbd_state_change.h +++ b/drivers/block/drbd/drbd_state_change.h @@ -44,19 +44,19 @@ extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_ extern void copy_old_to_new_state_change(struct drbd_state_change *); extern void forget_state_change(struct drbd_state_change *); -extern void notify_resource_state_change(struct sk_buff *, +extern int notify_resource_state_change(struct sk_buff *, unsigned int, struct drbd_resource_state_change *, enum drbd_notification_type type); -extern void notify_connection_state_change(struct sk_buff *, +extern int notify_connection_state_change(struct sk_buff *, unsigned int, struct drbd_connection_state_change *, enum drbd_notification_type type); -extern void notify_device_state_change(struct sk_buff *, +extern int notify_device_state_change(struct sk_buff *, unsigned int, struct drbd_device_state_change *, enum drbd_notification_type type); -extern void notify_peer_device_state_change(struct sk_buff *, +extern int notify_peer_device_state_change(struct sk_buff *, unsigned int, struct drbd_peer_device_state_change *, enum drbd_notification_type type); -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] Push 2 self-developed patches to OLK-5.10
by Xiaomeng Zhang 29 Mar '25

29 Mar '25

*** BLURB HERE *** Xiaomeng Zhang (2): x86: reboot: Initialize the printk locks to avoid deadlock printk: Skip log flush in NMI context when logbuf_lock is held arch/x86/kernel/reboot.c | 1 + kernel/printk/printk_safe.c | 4 ++++ 2 files changed, 5 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] Push 2 self-developed patches to OLK-5.10
by Xiaomeng Zhang 29 Mar '25

29 Mar '25

*** BLURB HERE *** Xiaomeng Zhang (2): x86: reboot: Initialize the printk locks to avoid deadlock printk: Skip log flush in NMI context when logbuf_lock is held arch/x86/kernel/reboot.c | 1 + kernel/printk/printk_safe.c | 4 ++++ 2 files changed, 5 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6] fs/dcache: fix bad unlock balance in shrink_dentry_list()
by Baokun Li 29 Mar '25

29 Mar '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBW902 -------------------------------- Inside shrink_lock_dentry(), if we can't lock the parent, we unlock the dentry and wait for the parent lock. Once we get the parent lock, we lock the dentry again. After locking the dentry a second time, we only check d_lockref.count and don't see if d_inode changed. But during that lock gap, d_inode may be modified. If the inode changes, the inode in the dentry isn't locked. However, in dentry_unlink_inode(), we unlock the inode no matter what. Then, we will get the following Oops: ------------[ cut here ]------------ pvqspinlock: lock 0xff438c8e84836be0 has corrupted value 0x0! WARNING: CPU: 1 PID: 370 at kernel/locking/qspinlock_paravirt.h:498 CPU: 1 PID: 370 Comm: bash Not tainted 5.10.0 #2008 RIP: 0010:__pv_queued_spin_unlock_slowpath+0xbf/0xd0 Call Trace: __raw_callee_save___pv_queued_spin_unlock_slowpath+0x11/0x24 .slowpath+0x9/0x16 dentry_unlink_inode+0x91/0x120 __dentry_kill+0xf3/0x1c0 shrink_dentry_list+0x4b/0xe0 prune_dcache_sb+0x52/0x80 super_cache_scan+0x133/0x1f0 do_shrink_slab+0x14a/0x2f0 Here's how concurrency might trigger this issue: P1 | P2 --------------------------------------------- prune_dcache_sb shrink_dentry_list spin_lock(&dentry->d_lock) shrink_lock_dentry /* Negative dentry, therefore no inode to lock. ref 0 */ spin_trylock(&parent->d_lock) / try lock failed / spin_unlock(&dentry->d_lock) lookup_open __d_lookup spin_lock(&dentry->d_lock) dentry->d_lockref.count++ /* ref 1 */ spin_unlock(&dentry->d_lock) /* Negative dentry, just create the file */ xfs_generic_create d_instantiate spin_lock(&inode->i_lock) __d_instantiate spin_lock(&dentry->d_lock) __d_set_inode_and_type dentry->d_inode = inode spin_unlock(&dentry->d_lock) spin_unlock(&inode->i_lock) syscall_exit_to_user_mode /* Task exit. */ __fput dput fast_dput spin_lock(&dentry->d_lock) retain_dentry dentry->d_lockref.count-- /* ref 0 */ spin_unlock(&dentry->d_lock) spin_lock(&parent->d_lock) spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED) /* d_inode has been changed but is not locked. */ __dentry_kill dentry_unlink_inode spin_unlock(&dentry->d_lock) spin_unlock(&inode->i_lock) /* Attempt to unlock an unlocked inode. */ /* WARNING: bad unlock balance in dentry_unlink_inode */ Therefore, add the missing d_inode check to avoid this issue. Fixes: 3b3f09f48ba7 ("get rid of trylock loop in locking dentries on shrink list") Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/dcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/dcache.c b/fs/dcache.c index 3e0b9abbf4d8..fe9140b0d0eb 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -1238,7 +1238,7 @@ static bool shrink_lock_dentry(struct dentry *dentry) goto out; } spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); - if (likely(!dentry->d_lockref.count)) + if (likely(!dentry->d_lockref.count && inode == dentry->d_inode)) return true; spin_unlock(&parent->d_lock); out: -- 2.46.1

2 1

[PATCH OLK-5.10] fs/dcache: fix bad unlock balance in shrink_dentry_list()
by Baokun Li 29 Mar '25

29 Mar '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBW902 -------------------------------- Inside shrink_lock_dentry(), if we can't lock the parent, we unlock the dentry and wait for the parent lock. Once we get the parent lock, we lock the dentry again. After locking the dentry a second time, we only check d_lockref.count and don't see if d_inode changed. But during that lock gap, d_inode may be modified. If the inode changes, the inode in the dentry isn't locked. However, in dentry_unlink_inode(), we unlock the inode no matter what. Then, we will get the following Oops: ------------[ cut here ]------------ pvqspinlock: lock 0xff438c8e84836be0 has corrupted value 0x0! WARNING: CPU: 1 PID: 370 at kernel/locking/qspinlock_paravirt.h:498 CPU: 1 PID: 370 Comm: bash Not tainted 5.10.0 #2008 RIP: 0010:__pv_queued_spin_unlock_slowpath+0xbf/0xd0 Call Trace: __raw_callee_save___pv_queued_spin_unlock_slowpath+0x11/0x24 .slowpath+0x9/0x16 dentry_unlink_inode+0x91/0x120 __dentry_kill+0xf3/0x1c0 shrink_dentry_list+0x4b/0xe0 prune_dcache_sb+0x52/0x80 super_cache_scan+0x133/0x1f0 do_shrink_slab+0x14a/0x2f0 Here's how concurrency might trigger this issue: P1 | P2 --------------------------------------------- prune_dcache_sb shrink_dentry_list spin_lock(&dentry->d_lock) shrink_lock_dentry /* Negative dentry, therefore no inode to lock. ref 0 */ spin_trylock(&parent->d_lock) / try lock failed / spin_unlock(&dentry->d_lock) lookup_open __d_lookup spin_lock(&dentry->d_lock) dentry->d_lockref.count++ /* ref 1 */ spin_unlock(&dentry->d_lock) /* Negative dentry, just create the file */ xfs_generic_create d_instantiate spin_lock(&inode->i_lock) __d_instantiate spin_lock(&dentry->d_lock) __d_set_inode_and_type dentry->d_inode = inode spin_unlock(&dentry->d_lock) spin_unlock(&inode->i_lock) syscall_exit_to_user_mode /* Task exit. */ __fput dput fast_dput spin_lock(&dentry->d_lock) retain_dentry dentry->d_lockref.count-- /* ref 0 */ spin_unlock(&dentry->d_lock) spin_lock(&parent->d_lock) spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED) /* d_inode has been changed but is not locked. */ __dentry_kill dentry_unlink_inode spin_unlock(&dentry->d_lock) spin_unlock(&inode->i_lock) /* Attempt to unlock an unlocked inode. */ /* WARNING: bad unlock balance in dentry_unlink_inode */ Therefore, add the missing d_inode check to avoid this issue. Fixes: 3b3f09f48ba7 ("get rid of trylock loop in locking dentries on shrink list") Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/dcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/dcache.c b/fs/dcache.c index 5dccce5bc8c1..d36bb8fc2c41 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -1174,7 +1174,7 @@ static bool shrink_lock_dentry(struct dentry *dentry) goto out; } spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); - if (likely(!dentry->d_lockref.count)) + if (likely(!dentry->d_lockref.count && inode == dentry->d_inode)) return true; spin_unlock(&parent->d_lock); out: -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] fs/dcache: fix bad unlock balance in shrink_dentry_list()
by Baokun Li 29 Mar '25

29 Mar '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBW902 CVE: NA -------------------------------- Inside shrink_lock_dentry(), if we can't lock the parent, we unlock the dentry and wait for the parent lock. Once we get the parent lock, we lock the dentry again. After locking the dentry a second time, we only check d_lockref.count and don't see if d_inode changed. But during that lock gap, d_inode may be modified. If the inode changes, the inode in the dentry isn't locked. However, in dentry_unlink_inode(), we unlock the inode no matter what. Then, we will get the following Oops: ------------[ cut here ]------------ pvqspinlock: lock 0xff438c8e84836be0 has corrupted value 0x0! WARNING: CPU: 1 PID: 370 at kernel/locking/qspinlock_paravirt.h:498 CPU: 1 PID: 370 Comm: bash Not tainted 5.10.0 #2008 RIP: 0010:__pv_queued_spin_unlock_slowpath+0xbf/0xd0 Call Trace: __raw_callee_save___pv_queued_spin_unlock_slowpath+0x11/0x24 .slowpath+0x9/0x16 dentry_unlink_inode+0x91/0x120 __dentry_kill+0xf3/0x1c0 shrink_dentry_list+0x4b/0xe0 prune_dcache_sb+0x52/0x80 super_cache_scan+0x133/0x1f0 do_shrink_slab+0x14a/0x2f0 Here's how concurrency might trigger this issue: P1 | P2 --------------------------------------------- prune_dcache_sb shrink_dentry_list spin_lock(&dentry->d_lock) shrink_lock_dentry /* Negative dentry, therefore no inode to lock. ref 0 */ spin_trylock(&parent->d_lock) / try lock failed / spin_unlock(&dentry->d_lock) lookup_open __d_lookup spin_lock(&dentry->d_lock) dentry->d_lockref.count++ /* ref 1 */ spin_unlock(&dentry->d_lock) /* Negative dentry, just create the file */ xfs_generic_create d_instantiate spin_lock(&inode->i_lock) __d_instantiate spin_lock(&dentry->d_lock) __d_set_inode_and_type dentry->d_inode = inode spin_unlock(&dentry->d_lock) spin_unlock(&inode->i_lock) syscall_exit_to_user_mode /* Task exit. */ __fput dput fast_dput spin_lock(&dentry->d_lock) retain_dentry dentry->d_lockref.count-- /* ref 0 */ spin_unlock(&dentry->d_lock) spin_lock(&parent->d_lock) spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED) /* d_inode has been changed but is not locked. */ __dentry_kill dentry_unlink_inode spin_unlock(&dentry->d_lock) spin_unlock(&inode->i_lock) /* Attempt to unlock an unlocked inode. */ /* WARNING: bad unlock balance in dentry_unlink_inode */ Therefore, add the missing d_inode check to avoid this issue. Fixes: 3b3f09f48ba7 ("get rid of trylock loop in locking dentries on shrink list") Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/dcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/dcache.c b/fs/dcache.c index 926df08eeb0c..35f82d69d2b9 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -1118,7 +1118,7 @@ static bool shrink_lock_dentry(struct dentry *dentry) goto out; } spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); - if (likely(!dentry->d_lockref.count)) + if (likely(!dentry->d_lockref.count && inode == dentry->d_inode)) return true; spin_unlock(&parent->d_lock); out: -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] firmware: arm_scmi: Fix list protocols enumeration in the base protocol
by Gu Bowen 29 Mar '25

29 Mar '25

From: Cristian Marussi <cristian.marussi(a)arm.com> stable inclusion from stable-v4.19.247 commit 444a2d27fe9867d0da4b28fc45b793f32e099ab8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2JX CVE: CVE-2022-49451 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8009120e0354a67068e920eb10dce532391361d0 ] While enumerating protocols implemented by the SCMI platform using BASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is currently validated in an improper way since the check employs a sum between unsigned integers that could overflow and cause the check itself to be silently bypassed if the returned value 'loop_num_ret' is big enough. Fix the validation avoiding the addition. Link: https://lore.kernel.org/r/20220330150551.2573938-4-cristian.marussi@arm.com Fixes: b6f20ff8bd94 ("firmware: arm_scmi: add common infrastructure and support for base protocol") Signed-off-by: Cristian Marussi <cristian.marussi(a)arm.com> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/firmware/arm_scmi/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/arm_scmi/base.c b/drivers/firmware/arm_scmi/base.c index 204390297f4b..95d892db0dff 100644 --- a/drivers/firmware/arm_scmi/base.c +++ b/drivers/firmware/arm_scmi/base.c @@ -164,7 +164,7 @@ static int scmi_base_implementation_list_get(const struct scmi_handle *handle, break; loop_num_ret = le32_to_cpu(*num_ret); - if (tot_num_ret + loop_num_ret > MAX_PROTOCOLS_IMP) { + if (loop_num_ret > MAX_PROTOCOLS_IMP - tot_num_ret) { dev_err(dev, "No. of Protocol > MAX_PROTOCOLS_IMP"); break; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] rxrpc: Fix listen() setting the bar too high for the prealloc rings
by Gu Bowen 29 Mar '25

29 Mar '25

From: David Howells <dhowells(a)redhat.com> stable inclusion from stable-v4.19.247 commit 4a3a78b7918bdd723d8c7c9786522ca969bffcc4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2XB CVE: CVE-2022-49450 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 88e22159750b0d55793302eeed8ee603f5c1a95c ] AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump up the sysctl), but whilst the preallocation circular buffers have 32 slots in them, one of them has to be a dead slot because we're using CIRC_CNT(). This means that listen(rxrpc_sock, 32) will cause an oops when the socket is closed because rxrpc_service_prealloc_one() allocated one too many calls and rxrpc_discard_prealloc() won't then be able to get rid of them because it'll think the ring is empty. rxrpc_release_calls_on_socket() then tries to abort them, but oopses because call->peer isn't yet set. Fix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match the ring capacity. BUG: kernel NULL pointer dereference, address: 0000000000000086 ... RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc] Call Trace: <TASK> ? __wake_up_common_lock+0x7a/0x90 ? rxrpc_notify_socket+0x8e/0x140 [rxrpc] ? rxrpc_abort_call+0x4c/0x60 [rxrpc] rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc] rxrpc_release+0xc9/0x1c0 [rxrpc] __sock_release+0x37/0xa0 sock_close+0x11/0x20 __fput+0x89/0x240 task_work_run+0x59/0x90 do_exit+0x319/0xaa0 Fixes: 00e907127e6f ("rxrpc: Preallocate peers, conns and calls for incoming service requests") Reported-by: Marc Dionne <marc.dionne(a)auristor.com> Signed-off-by: David Howells <dhowells(a)redhat.com> cc: linux-afs(a)lists.infradead.org Link: https://lists.infradead.org/pipermail/linux-afs/2022-March/005079.html Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- net/rxrpc/sysctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/rxrpc/sysctl.c b/net/rxrpc/sysctl.c index d75bd15151e6..50f825f55c21 100644 --- a/net/rxrpc/sysctl.c +++ b/net/rxrpc/sysctl.c @@ -17,7 +17,7 @@ static struct ctl_table_header *rxrpc_sysctl_reg_table; static const unsigned int one = 1; static const unsigned int four = 4; -static const unsigned int thirtytwo = 32; +static const unsigned int max_backlog = RXRPC_BACKLOG_MAX - 1; static const unsigned int n_65535 = 65535; static const unsigned int n_max_acks = RXRPC_RXTX_BUFF_SIZE - 1; static const unsigned long one_jiffy = 1; @@ -111,7 +111,7 @@ static struct ctl_table rxrpc_sysctl_table[] = { .mode = 0644, .proc_handler = proc_dointvec_minmax, .extra1 = (void *)&four, - .extra2 = (void *)&thirtytwo, + .extra2 = (void *)&max_backlog, }, { .procname = "rx_window_size", -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] tty: fix deadlock caused by calling printk() under tty_port->lock
by Gu Bowen 29 Mar '25

29 Mar '25

From: Qi Zheng <zhengqi.arch(a)bytedance.com> stable inclusion from stable-v4.19.247 commit 04ee31678c128a6cc7bb057ea189a8624ba5a314 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2T9 CVE: CVE-2022-49441 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6b9dbedbe3499fef862c4dff5217cf91f34e43b3 ] pty_write() invokes kmalloc() which may invoke a normal printk() to print failure message. This can cause a deadlock in the scenario reported by syz-bot below: CPU0 CPU1 CPU2 ---- ---- ---- lock(console_owner); lock(&port_lock_key); lock(&port->lock); lock(&port_lock_key); lock(&port->lock); lock(console_owner); As commit dbdda842fe96 ("printk: Add console owner and waiter logic to load balance console writes") said, such deadlock can be prevented by using printk_deferred() in kmalloc() (which is invoked in the section guarded by the port->lock). But there are too many printk() on the kmalloc() path, and kmalloc() can be called from anywhere, so changing printk() to printk_deferred() is too complicated and inelegant. Therefore, this patch chooses to specify __GFP_NOWARN to kmalloc(), so that printk() will not be called, and this deadlock problem can be avoided. Syzbot reported the following lockdep error: ====================================================== WARNING: possible circular locking dependency detected 5.4.143-00237-g08ccc19a-dirty #10 Not tainted ------------------------------------------------------ syz-executor.4/29420 is trying to acquire lock: ffffffff8aedb2a0 (console_owner){....}-{0:0}, at: console_trylock_spinning kernel/printk/printk.c:1752 [inline] ffffffff8aedb2a0 (console_owner){....}-{0:0}, at: vprintk_emit+0x2ca/0x470 kernel/printk/printk.c:2023 but task is already holding lock: ffff8880119c9158 (&port->lock){-.-.}-{2:2}, at: pty_write+0xf4/0x1f0 drivers/tty/pty.c:120 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&port->lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 tty_port_tty_get drivers/tty/tty_port.c:288 [inline] <-- lock(&port->lock); tty_port_default_wakeup+0x1d/0xb0 drivers/tty/tty_port.c:47 serial8250_tx_chars+0x530/0xa80 drivers/tty/serial/8250/8250_port.c:1767 serial8250_handle_irq.part.0+0x31f/0x3d0 drivers/tty/serial/8250/8250_port.c:1854 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1827 [inline] <-- lock(&port_lock_key); serial8250_default_handle_irq+0xb2/0x220 drivers/tty/serial/8250/8250_port.c:1870 serial8250_interrupt+0xfd/0x200 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x109/0xa50 kernel/irq/handle.c:156 [...] -> #1 (&port_lock_key){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 serial8250_console_write+0x184/0xa40 drivers/tty/serial/8250/8250_port.c:3198 <-- lock(&port_lock_key); call_console_drivers kernel/printk/printk.c:1819 [inline] console_unlock+0x8cb/0xd00 kernel/printk/printk.c:2504 vprintk_emit+0x1b5/0x470 kernel/printk/printk.c:2024 <-- lock(console_owner); vprintk_func+0x8d/0x250 kernel/printk/printk_safe.c:394 printk+0xba/0xed kernel/printk/printk.c:2084 register_console+0x8b3/0xc10 kernel/printk/printk.c:2829 univ8250_console_init+0x3a/0x46 drivers/tty/serial/8250/8250_core.c:681 console_init+0x49d/0x6d3 kernel/printk/printk.c:2915 start_kernel+0x5e9/0x879 init/main.c:713 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241 -> #0 (console_owner){....}-{0:0}: [...] lock_acquire+0x127/0x340 kernel/locking/lockdep.c:4734 console_trylock_spinning kernel/printk/printk.c:1773 [inline] <-- lock(console_owner); vprintk_emit+0x307/0x470 kernel/printk/printk.c:2023 vprintk_func+0x8d/0x250 kernel/printk/printk_safe.c:394 printk+0xba/0xed kernel/printk/printk.c:2084 fail_dump lib/fault-inject.c:45 [inline] should_fail+0x67b/0x7c0 lib/fault-inject.c:144 __should_failslab+0x152/0x1c0 mm/failslab.c:33 should_failslab+0x5/0x10 mm/slab_common.c:1224 slab_pre_alloc_hook mm/slab.h:468 [inline] slab_alloc_node mm/slub.c:2723 [inline] slab_alloc mm/slub.c:2807 [inline] __kmalloc+0x72/0x300 mm/slub.c:3871 kmalloc include/linux/slab.h:582 [inline] tty_buffer_alloc+0x23f/0x2a0 drivers/tty/tty_buffer.c:175 __tty_buffer_request_room+0x156/0x2a0 drivers/tty/tty_buffer.c:273 tty_insert_flip_string_fixed_flag+0x93/0x250 drivers/tty/tty_buffer.c:318 tty_insert_flip_string include/linux/tty_flip.h:37 [inline] pty_write+0x126/0x1f0 drivers/tty/pty.c:122 <-- lock(&port->lock); n_tty_write+0xa7a/0xfc0 drivers/tty/n_tty.c:2356 do_tty_write drivers/tty/tty_io.c:961 [inline] tty_write+0x512/0x930 drivers/tty/tty_io.c:1045 __vfs_write+0x76/0x100 fs/read_write.c:494 [...] other info that might help us debug this: Chain exists of: console_owner --> &port_lock_key --> &port->lock Link: https://lkml.kernel.org/r/20220511061951.1114-2-zhengqi.arch@bytedance.com Link: https://lkml.kernel.org/r/20220510113809.80626-2-zhengqi.arch@bytedance.com Fixes: b6da31b2c07c ("tty: Fix data race in tty_insert_flip_string_fixed_flag") Signed-off-by: Qi Zheng <zhengqi.arch(a)bytedance.com> Acked-by: Jiri Slaby <jirislaby(a)kernel.org> Acked-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Akinobu Mita <akinobu.mita(a)gmail.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/tty/tty_buffer.c [Context conflicts.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/tty_buffer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c index 93f9f9dc09fc..823630c69ef5 100644 --- a/drivers/tty/tty_buffer.c +++ b/drivers/tty/tty_buffer.c @@ -168,7 +168,8 @@ static struct tty_buffer *tty_buffer_alloc(struct tty_port *port, size_t size) if (atomic_read(&port->buf.mem_used) > port->buf.mem_limit) return NULL; printk_safe_enter(); - p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC); + p = kmalloc(sizeof(struct tty_buffer) + 2 * size, + GFP_ATOMIC | __GFP_NOWARN); printk_safe_exit(); if (p == NULL) return NULL; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] media: uvcvideo: Fix double free in error path
by Gu Bowen 29 Mar '25

29 Mar '25

From: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> stable inclusion from stable-v6.6.76 commit 6c36dcd662ec5276782838660f8533a7cb26be49 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBDI CVE: CVE-2024-57980 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c6ef3a7fa97ec823a1e1af9085cf13db9f7b3bac upstream. If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. This results in the kfree() call in uvc_status_cleanup() trying to double-free the memory. Fix it by resetting the dev->status pointer to NULL after freeing it. Fixes: a31a4055473b ("V4L/DVB:usbvideo:don't use part of buffer for USB transfer #4") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20241107235130.31372-1-laurent.pinchart@ideasonbo… Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Reviewed by: Ricardo Ribalda <ribalda(a)chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/media/usb/uvc/uvc_status.c [Context conflicts due to commit adfd3910c27fb ("media: uvcvideo: Remove void casting for the status endpoint") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/media/usb/uvc/uvc_status.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/usb/uvc/uvc_status.c b/drivers/media/usb/uvc/uvc_status.c index 883e4cab45e7..a353b3c5c03a 100644 --- a/drivers/media/usb/uvc/uvc_status.c +++ b/drivers/media/usb/uvc/uvc_status.c @@ -272,6 +272,7 @@ int uvc_status_init(struct uvc_device *dev) dev->int_urb = usb_alloc_urb(0, GFP_KERNEL); if (dev->int_urb == NULL) { kfree(dev->status); + dev->status = NULL; return -ENOMEM; } -- 2.25.1

2 1

[PATCH OLK-5.10] net: rose: fix timer races against user threads
by Gu Bowen 29 Mar '25

29 Mar '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc1 commit 5de7665e0a0746b5ad7943554b34db8f8614a196 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBF2 CVE: CVE-2025-21718 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Rose timers only acquire the socket spinlock, without checking if the socket is owned by one user thread. Add a check and rearm the timers if needed. BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174 Read of size 2 at addr ffff88802f09b82a by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174 call_timer_fn+0x187/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430 run_timer_base kernel/time/timer.c:2439 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 </IRQ> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20250122180244.1861468-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- net/rose/rose_timer.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/net/rose/rose_timer.c b/net/rose/rose_timer.c index f06ddbed3fed..1525773e94aa 100644 --- a/net/rose/rose_timer.c +++ b/net/rose/rose_timer.c @@ -122,6 +122,10 @@ static void rose_heartbeat_expiry(struct timer_list *t) struct rose_sock *rose = rose_sk(sk); bh_lock_sock(sk); + if (sock_owned_by_user(sk)) { + sk_reset_timer(sk, &sk->sk_timer, jiffies + HZ/20); + goto out; + } switch (rose->state) { case ROSE_STATE_0: /* Magic here: If we listen() and a new link dies before it @@ -152,6 +156,7 @@ static void rose_heartbeat_expiry(struct timer_list *t) } rose_start_heartbeat(sk); +out: bh_unlock_sock(sk); sock_put(sk); } @@ -162,6 +167,10 @@ static void rose_timer_expiry(struct timer_list *t) struct sock *sk = &rose->sock; bh_lock_sock(sk); + if (sock_owned_by_user(sk)) { + sk_reset_timer(sk, &rose->timer, jiffies + HZ/20); + goto out; + } switch (rose->state) { case ROSE_STATE_1: /* T1 */ case ROSE_STATE_4: /* T2 */ @@ -182,6 +191,7 @@ static void rose_timer_expiry(struct timer_list *t) } break; } +out: bh_unlock_sock(sk); sock_put(sk); } @@ -192,6 +202,10 @@ static void rose_idletimer_expiry(struct timer_list *t) struct sock *sk = &rose->sock; bh_lock_sock(sk); + if (sock_owned_by_user(sk)) { + sk_reset_timer(sk, &rose->idletimer, jiffies + HZ/20); + goto out; + } rose_clear_queues(sk); rose_write_internal(sk, ROSE_CLEAR_REQUEST); @@ -207,6 +221,7 @@ static void rose_idletimer_expiry(struct timer_list *t) sk->sk_state_change(sk); sock_set_flag(sk, SOCK_DEAD); } +out: bh_unlock_sock(sk); sock_put(sk); } -- 2.25.1

2 1

[PATCH OLK-5.10] media: uvcvideo: Fix double free in error path
by Gu Bowen 29 Mar '25

29 Mar '25

From: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> stable inclusion from stable-v6.6.76 commit 6c36dcd662ec5276782838660f8533a7cb26be49 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBM4S5 CVE: CVE-2024-57980 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c6ef3a7fa97ec823a1e1af9085cf13db9f7b3bac upstream. If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. This results in the kfree() call in uvc_status_cleanup() trying to double-free the memory. Fix it by resetting the dev->status pointer to NULL after freeing it. Fixes: a31a4055473b ("V4L/DVB:usbvideo:don't use part of buffer for USB transfer #4") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20241107235130.31372-1-laurent.pinchart@ideasonbo… Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Reviewed by: Ricardo Ribalda <ribalda(a)chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/media/usb/uvc/uvc_status.c [Context conflicts due to commit adfd3910c27fb ("media: uvcvideo: Remove void casting for the status endpoint") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/media/usb/uvc/uvc_status.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/usb/uvc/uvc_status.c b/drivers/media/usb/uvc/uvc_status.c index 73725051cc16..6edf491dd873 100644 --- a/drivers/media/usb/uvc/uvc_status.c +++ b/drivers/media/usb/uvc/uvc_status.c @@ -269,6 +269,7 @@ int uvc_status_init(struct uvc_device *dev) dev->int_urb = usb_alloc_urb(0, GFP_KERNEL); if (dev->int_urb == NULL) { kfree(dev->status); + dev->status = NULL; return -ENOMEM; } -- 2.25.1

2 1

[openeuler:OLK-6.6 2064/2064] kismet: WARNING: unmet direct dependencies detected for CRYPTO_DRBG_CTR when selected by CRYPTO_DEV_HISI_TRNG
by kernel test robot 29 Mar '25

29 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 94d50befec22eea69046e558027594d630edb926 commit: e623afb45e58ded6b45cc4f0ac6c19b3736c96f9 [2064/2064] crypto: hisilicon/trng - support to obtain random numbers from soft algorithm config: arm64-kismet-CONFIG_CRYPTO_DRBG_CTR-CONFIG_CRYPTO_DEV_HISI_TRNG-0-0 (https://download.01.org/0day-ci/archive/20250329/202503290855.eVbc4pVd-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20250329/202503290855.eVbc4pVd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503290855.eVbc4pVd-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for CRYPTO_DRBG_CTR when selected by CRYPTO_DEV_HISI_TRNG WARNING: unmet direct dependencies detected for CRYPTO_DRBG_CTR Depends on [n]: CRYPTO [=y] && CRYPTO_DRBG_MENU [=n] Selected by [y]: - CRYPTO_DEV_HISI_TRNG [=y] && CRYPTO [=y] && CRYPTO_HW [=y] && ARM64 [=y] && ACPI [=y] WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] WARNING: unmet direct dependencies detected for RESCTRL_FS Depends on [n]: MISC_FILESYSTEMS [=n] && ARCH_HAS_CPU_RESCTRL [=y] Selected by [y]: - ARM64_MPAM [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1528/1528] drivers/fpga/dfl.o: warning: objtool: build_info_commit_dev()+0x5b: unreachable instruction
by kernel test robot 29 Mar '25

29 Mar '25

Hi Scott, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4d1e247486ffeef035a5a55a97f2659f68177357 commit: 99e28159a079ea6af5a5b789e83b68240d67f9ff [1528/1528] fpga: dfl: Add lockdep classes for pdata->lock config: x86_64-buildonly-randconfig-006-20250328 (https://download.01.org/0day-ci/archive/20250329/202503290119.FlNWiz0A-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250329/202503290119.FlNWiz0A-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503290119.FlNWiz0A-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/fpga/dfl.c:57: warning: cannot understand function prototype: 'struct dfl_dev_info ' drivers/fpga/dfl.c:77: warning: cannot understand function prototype: 'struct dfl_chardev_info ' >> drivers/fpga/dfl.o: warning: objtool: build_info_commit_dev()+0x5b: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1528/1528] drivers/crypto/.tmp_qcom-rng.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 29 Mar '25

29 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4d1e247486ffeef035a5a55a97f2659f68177357 commit: c5f5aeef9b55b362ad5a0e04e4b41cd63b208842 [1528/1528] Merge git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux config: x86_64-buildonly-randconfig-002-20250328 (https://download.01.org/0day-ci/archive/20250328/202503282324.X867QbB6-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250328/202503282324.X867QbB6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503282324.X867QbB6-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/.tmp_qcom-rng.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] usb: usbip: fix a refcount leak in stub_probe()
by Xia Fukun 28 Mar '25

28 Mar '25

From: Hangyu Hua <hbh25y(a)gmail.com> stable inclusion from stable-v4.19.325 commit 247d3809e45a34d9e1a3a2bb7012e31ed8b46031 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3SN CVE: CVE-2022-49389 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 9ec4cbf1cc55d126759051acfe328d489c5d6e60 ] usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails after that, usb_put_dev() needs to be called to release the reference. Fix this by moving usb_put_dev() to sdev_free error path handling. Find this by code review. Fixes: 3ff67445750a ("usbip: fix error handling in stub_probe()") Reviewed-by: Shuah Khan <skhan(a)linuxfoundation.org> Signed-off-by: Hangyu Hua <hbh25y(a)gmail.com> Link: https://lore.kernel.org/r/20220412020257.9767-1-hbh25y@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/usb/usbip/stub_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c index 93891d445c30..2650ef62757a 100644 --- a/drivers/usb/usbip/stub_dev.c +++ b/drivers/usb/usbip/stub_dev.c @@ -410,7 +410,6 @@ static int stub_probe(struct usb_device *udev) (struct usb_dev_state *) udev); err_port: dev_set_drvdata(&udev->dev, NULL); - usb_put_dev(udev); /* we already have busid_priv, just lock busid_lock */ spin_lock(&busid_priv->busid_lock); @@ -425,6 +424,7 @@ static int stub_probe(struct usb_device *udev) put_busid_priv(busid_priv); sdev_free: + usb_put_dev(udev); stub_device_free(sdev); return rc; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1528/1528] include/asm-generic/io.h:742:19: warning: 'reg' may be used uninitialized in this function
by kernel test robot 28 Mar '25

28 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4d1e247486ffeef035a5a55a97f2659f68177357 commit: e44716ed4262a467260fccb7814e4c89588f438d [1528/1528] arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY config: arm64-randconfig-003-20250328 (https://download.01.org/0day-ci/archive/20250328/202503281620.pNXaYE13-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250328/202503281620.pNXaYE13-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503281620.pNXaYE13-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c: In function 'nv40_fifo_dma_engine_init': drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c:111:37: warning: 'ctx' may be used uninitialized in this function [-Wmaybe-uninitialized] 111 | nvkm_wo32(imem->ramfc, chan->ramfc + ctx, inst); | ^ In file included from arch/arm64/include/asm/io.h:213, from include/linux/io.h:25, from include/linux/pci.h:34, from drivers/gpu/drm/nouveau/include/nvif/os.h:8, from drivers/gpu/drm/nouveau/include/nvkm/core/os.h:4, from drivers/gpu/drm/nouveau/include/nvkm/core/oclass.h:3, from drivers/gpu/drm/nouveau/include/nvkm/core/device.h:4, from drivers/gpu/drm/nouveau/include/nvkm/core/subdev.h:4, from drivers/gpu/drm/nouveau/include/nvkm/core/engine.h:5, from drivers/gpu/drm/nouveau/include/nvkm/engine/fifo.h:4, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/priv.h:5, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/chan.h:5, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/channv04.h:5, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c:24: >> include/asm-generic/io.h:742:19: warning: 'reg' may be used uninitialized in this function [-Wmaybe-uninitialized] 742 | #define iowrite32 iowrite32 | ^~~~~~~~~ drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c:97:12: note: 'reg' was declared here 97 | u32 inst, reg, ctx; | ^~~ drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c: In function 'nv40_fifo_dma_engine_fini': drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c:80:37: warning: 'ctx' may be used uninitialized in this function [-Wmaybe-uninitialized] 80 | nvkm_wo32(imem->ramfc, chan->ramfc + ctx, 0x00000000); | ^ In file included from arch/arm64/include/asm/io.h:213, from include/linux/io.h:25, from include/linux/pci.h:34, from drivers/gpu/drm/nouveau/include/nvif/os.h:8, from drivers/gpu/drm/nouveau/include/nvkm/core/os.h:4, from drivers/gpu/drm/nouveau/include/nvkm/core/oclass.h:3, from drivers/gpu/drm/nouveau/include/nvkm/core/device.h:4, from drivers/gpu/drm/nouveau/include/nvkm/core/subdev.h:4, from drivers/gpu/drm/nouveau/include/nvkm/core/engine.h:5, from drivers/gpu/drm/nouveau/include/nvkm/engine/fifo.h:4, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/priv.h:5, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/chan.h:5, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/channv04.h:5, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c:24: >> include/asm-generic/io.h:742:19: warning: 'reg' may be used uninitialized in this function [-Wmaybe-uninitialized] 742 | #define iowrite32 iowrite32 | ^~~~~~~~~ drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c:67:6: note: 'reg' was declared here 67 | u32 reg, ctx; | ^~~ vim +/reg +742 include/asm-generic/io.h 9216efafc52ff9 Thierry Reding 2014-10-01 740 9216efafc52ff9 Thierry Reding 2014-10-01 741 #ifndef iowrite32 9216efafc52ff9 Thierry Reding 2014-10-01 @742 #define iowrite32 iowrite32 9216efafc52ff9 Thierry Reding 2014-10-01 743 static inline void iowrite32(u32 value, volatile void __iomem *addr) 9216efafc52ff9 Thierry Reding 2014-10-01 744 { 9216efafc52ff9 Thierry Reding 2014-10-01 745 writel(value, addr); 9216efafc52ff9 Thierry Reding 2014-10-01 746 } 9216efafc52ff9 Thierry Reding 2014-10-01 747 #endif 9216efafc52ff9 Thierry Reding 2014-10-01 748 :::::: The code at line 742 was first introduced by commit :::::: 9216efafc52ff99e9351ef60de5fcafc2bc8adb6 asm-generic/io.h: Reconcile I/O accessor overrides :::::: TO: Thierry Reding <treding(a)nvidia.com> :::::: CC: Thierry Reding <treding(a)nvidia.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] drivers: usb: host: Fix deadlock in oxu_bus_suspend()
by Xia Fukun 28 Mar '25

28 Mar '25

From: Duoming Zhou <duoming(a)zju.edu.cn> stable inclusion from stable-v4.19.247 commit f8242044c91cafbba9e320b0fb31abf2429a3221 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3Z3 CVE: CVE-2022-49313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4d378f2ae58138d4c55684e1d274e7dd94aa6524 ] There is a deadlock in oxu_bus_suspend(), which is shown below: (Thread 1) | (Thread 2) | timer_action() oxu_bus_suspend() | mod_timer() spin_lock_irq() //(1) | (wait a time) ... | oxu_watchdog() del_timer_sync() | spin_lock_irq() //(2) (wait timer to stop) | ... We hold oxu->lock in position (1) of thread 1, and use del_timer_sync() to wait timer to stop, but timer handler also need oxu->lock in position (2) of thread 2. As a result, oxu_bus_suspend() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irq(), which could let timer handler to obtain the needed lock. Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Link: https://lore.kernel.org/r/20220417120305.64577-1-duoming@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/usb/host/oxu210hp-hcd.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c index c5e6e8d0b5ef..0402fa3b1ea2 100644 --- a/drivers/usb/host/oxu210hp-hcd.c +++ b/drivers/usb/host/oxu210hp-hcd.c @@ -3476,8 +3476,10 @@ static int oxu_bus_suspend(struct usb_hcd *hcd) } } + spin_unlock_irq(&oxu->lock); /* turn off now-idle HC */ del_timer_sync(&oxu->watchdog); + spin_lock_irq(&oxu->lock); ehci_halt(oxu); hcd->state = HC_STATE_SUSPENDED; -- 2.34.1

2 1

[PATCH OLK-6.6 V1] platform/x86: int3472: Check for adev == NULL
by Zicheng Qu 28 Mar '25

28 Mar '25

From: Hans de Goede <hdegoede(a)redhat.com> stable inclusion from stable-v6.6.78 commit f9c7cc44758f4930b41285a6d54afa8cbd9762b4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5Y CVE: CVE-2024-58011 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cd2fd6eab480dfc247b737cf7a3d6b009c4d0f1c ] Not all devices have an ACPI companion fwnode, so adev might be NULL. This can e.g. (theoretically) happen when a user manually binds one of the int3472 drivers to another i2c/platform device through sysfs. Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in skl_int3472_get_acpi_buffer(). Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Link: https://lore.kernel.org/r/20241209220522.25288-1-hdegoede@redhat.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/platform/x86/intel/int3472/discrete.c | 3 +++ drivers/platform/x86/intel/int3472/tps68470.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/drivers/platform/x86/intel/int3472/discrete.c b/drivers/platform/x86/intel/int3472/discrete.c index e33c2d75975c..d56f79043f5e 100644 --- a/drivers/platform/x86/intel/int3472/discrete.c +++ b/drivers/platform/x86/intel/int3472/discrete.c @@ -284,6 +284,9 @@ static int skl_int3472_discrete_probe(struct platform_device *pdev) struct int3472_cldb cldb; int ret; + if (!adev) + return -ENODEV; + ret = skl_int3472_fill_cldb(adev, &cldb); if (ret) { dev_err(&pdev->dev, "Couldn't fill CLDB structure\n"); diff --git a/drivers/platform/x86/intel/int3472/tps68470.c b/drivers/platform/x86/intel/int3472/tps68470.c index 1e107fd49f82..81ac4c691963 100644 --- a/drivers/platform/x86/intel/int3472/tps68470.c +++ b/drivers/platform/x86/intel/int3472/tps68470.c @@ -152,6 +152,9 @@ static int skl_int3472_tps68470_probe(struct i2c_client *client) int ret; int i; + if (!adev) + return -ENODEV; + n_consumers = skl_int3472_fill_clk_pdata(&client->dev, &clk_pdata); if (n_consumers < 0) return n_consumers; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-21726
by Zicheng Qu 28 Mar '25

28 Mar '25

Chen Ridong (2): padata: add pd get/put refcnt helper padata: avoid UAF for reorder_work kernel/padata.c | 37 +++++++++++++++++++++++++++++-------- 1 file changed, 29 insertions(+), 8 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2025-21726
by Zicheng Qu 28 Mar '25

28 Mar '25

Chen Ridong (2): padata: add pd get/put refcnt helper padata: avoid UAF for reorder_work kernel/padata.c | 37 +++++++++++++++++++++++++++++-------- 1 file changed, 29 insertions(+), 8 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 V1] padata: fix UAF in padata_reorder
by Zicheng Qu 28 Mar '25

28 Mar '25

From: Chen Ridong <chenridong(a)huawei.com> mainline inclusion from mainline-v6.14-rc1 commit e01780ea4661172734118d2a5f41bc9720765668 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBHS CVE: CVE-2025-21727 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206 CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+ Workqueue: pdecrypt_parallel padata_parallel_worker Call Trace: <TASK> dump_stack_lvl+0x32/0x50 print_address_description.constprop.0+0x6b/0x3d0 print_report+0xdd/0x2c0 kasan_report+0xa5/0xd0 padata_find_next+0x29/0x1a0 padata_reorder+0x131/0x220 padata_parallel_worker+0x3d/0xc0 process_one_work+0x2ec/0x5a0 If 'mdelay(10)' is added before calling 'padata_find_next' in the 'padata_reorder' function, this issue could be reproduced easily with ltp test (pcrypt_aead01). This can be explained as bellow: pcrypt_aead_encrypt ... padata_do_parallel refcount_inc(&pd->refcnt); // add refcnt ... padata_do_serial padata_reorder // pd while (1) { padata_find_next(pd, true); // using pd queue_work_on ... padata_serial_worker crypto_del_alg padata_put_pd_cnt // sub refcnt padata_free_shell padata_put_pd(ps->pd); // pd is freed // loop again, but pd is freed // call padata_find_next, UAF } In the padata_reorder function, when it loops in 'while', if the alg is deleted, the refcnt may be decreased to 0 before entering 'padata_find_next', which leads to UAF. As mentioned in [1], do_serial is supposed to be called with BHs disabled and always happen under RCU protection, to address this issue, add synchronize_rcu() in 'padata_free_shell' wait for all _do_serial calls to finish. [1] https://lore.kernel.org/all/20221028160401.cccypv4euxikusiq@parnassus.local… [2] https://lore.kernel.org/linux-kernel/jfjz5d7zwbytztackem7ibzalm5lnxldi2eofe… Fixes: b128a3040935 ("padata: allocate workqueue internally") Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Signed-off-by: Qu Zicheng <quzicheng(a)huawei.com> Acked-by: Daniel Jordan <daniel.m.jordan(a)oracle.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/padata.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/padata.c b/kernel/padata.c index 9bf77b58ee08..6567ec3a6658 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -1118,6 +1118,12 @@ void padata_free_shell(struct padata_shell *ps) if (!ps) return; + /* + * Wait for all _do_serial calls to finish to avoid touching + * freed pd's and ps's. + */ + synchronize_rcu(); + mutex_lock(&ps->pinst->lock); list_del(&ps->list); pd = rcu_dereference_protected(ps->pd, 1); -- 2.34.1

2 1

[PATCH OLK-5.10 V1] padata: fix UAF in padata_reorder
by Zicheng Qu 28 Mar '25

28 Mar '25

From: Chen Ridong <chenridong(a)huawei.com> mainline inclusion from mainline-v6.14-rc1 commit e01780ea4661172734118d2a5f41bc9720765668 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBHS CVE: CVE-2025-21727 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206 CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+ Workqueue: pdecrypt_parallel padata_parallel_worker Call Trace: <TASK> dump_stack_lvl+0x32/0x50 print_address_description.constprop.0+0x6b/0x3d0 print_report+0xdd/0x2c0 kasan_report+0xa5/0xd0 padata_find_next+0x29/0x1a0 padata_reorder+0x131/0x220 padata_parallel_worker+0x3d/0xc0 process_one_work+0x2ec/0x5a0 If 'mdelay(10)' is added before calling 'padata_find_next' in the 'padata_reorder' function, this issue could be reproduced easily with ltp test (pcrypt_aead01). This can be explained as bellow: pcrypt_aead_encrypt ... padata_do_parallel refcount_inc(&pd->refcnt); // add refcnt ... padata_do_serial padata_reorder // pd while (1) { padata_find_next(pd, true); // using pd queue_work_on ... padata_serial_worker crypto_del_alg padata_put_pd_cnt // sub refcnt padata_free_shell padata_put_pd(ps->pd); // pd is freed // loop again, but pd is freed // call padata_find_next, UAF } In the padata_reorder function, when it loops in 'while', if the alg is deleted, the refcnt may be decreased to 0 before entering 'padata_find_next', which leads to UAF. As mentioned in [1], do_serial is supposed to be called with BHs disabled and always happen under RCU protection, to address this issue, add synchronize_rcu() in 'padata_free_shell' wait for all _do_serial calls to finish. [1] https://lore.kernel.org/all/20221028160401.cccypv4euxikusiq@parnassus.local… [2] https://lore.kernel.org/linux-kernel/jfjz5d7zwbytztackem7ibzalm5lnxldi2eofe… Fixes: b128a3040935 ("padata: allocate workqueue internally") Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Signed-off-by: Qu Zicheng <quzicheng(a)huawei.com> Acked-by: Daniel Jordan <daniel.m.jordan(a)oracle.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/padata.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/padata.c b/kernel/padata.c index e24244c9c2cc..c27032595247 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -1120,6 +1120,12 @@ void padata_free_shell(struct padata_shell *ps) if (!ps) return; + /* + * Wait for all _do_serial calls to finish to avoid touching + * freed pd's and ps's. + */ + synchronize_rcu(); + mutex_lock(&ps->pinst->lock); list_del(&ps->list); pd = rcu_dereference_protected(ps->pd, 1); -- 2.34.1

2 1

[PATCH OLK-6.6 V1] kernel: be more careful about dup_mmap() failures and uprobe registering
by Zicheng Qu 28 Mar '25

28 Mar '25

From: "Liam R. Howlett" <Liam.Howlett(a)Oracle.com> mainline inclusion from mainline-v6.14-rc1 commit 64c37e134b120fb462fb4a80694bfb8e7be77b14 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBM0 CVE: CVE-2025-21709 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- If a memory allocation fails during dup_mmap(), the maple tree can be left in an unsafe state for other iterators besides the exit path. All the locks are dropped before the exit_mmap() call (in mm/mmap.c), but the incomplete mm_struct can be reached through (at least) the rmap finding the vmas which have a pointer back to the mm_struct. Up to this point, there have been no issues with being able to find an mm_struct that was only partially initialised. Syzbot was able to make the incomplete mm_struct fail with recent forking changes, so it has been proven unsafe to use the mm_struct that hasn't been initialised, as referenced in the link below. Although 8ac662f5da19f ("fork: avoid inappropriate uprobe access to invalid mm") fixed the uprobe access, it does not completely remove the race. This patch sets the MMF_OOM_SKIP to avoid the iteration of the vmas on the oom side (even though this is extremely unlikely to be selected as an oom victim in the race window), and sets MMF_UNSTABLE to avoid other potential users from using a partially initialised mm_struct. When registering vmas for uprobe, skip the vmas in an mm that is marked unstable. Modifying a vma in an unstable mm may cause issues if the mm isn't fully initialised. Link: https://lore.kernel.org/all/6756d273.050a0220.2477f.003d.GAE@google.com/ Link: https://lkml.kernel.org/r/20250127170221.1761366-1-Liam.Howlett@oracle.com Fixes: d24062914837 ("fork: use __mt_dup() to duplicate maple tree in dup_mmap()") Signed-off-by: Liam R. Howlett <Liam.Howlett(a)Oracle.com> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Oleg Nesterov <oleg(a)redhat.com> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Jann Horn <jannh(a)google.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Peng Zhang <zhangpeng.00(a)bytedance.com> Cc: Matthew Wilcox <willy(a)infradead.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: kernel/events/uprobes.c [The current version does not contain the following include code: include <linux/khugepaged.h> include <linux/rcupdate_trace.h> include <linux/workqueue.h> Upon verification, all three include can be ignore.] Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/events/uprobes.c | 4 ++++ kernel/fork.c | 17 ++++++++++++++--- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index a14b0059f177..e101416c64e5 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -26,6 +26,7 @@ #include <linux/task_work.h> #include <linux/shmem_fs.h> #include <linux/khugepaged.h> +#include <linux/oom.h> /* check_stable_address_space */ #include <linux/uprobes.h> @@ -1050,6 +1051,9 @@ register_for_each_vma(struct uprobe *uprobe, struct uprobe_consumer *new) goto free; mmap_write_lock(mm); + if (check_stable_address_space(mm)) + goto unlock; + vma = find_vma(mm, info->vaddr); if (!vma || !valid_vma(vma, is_register) || file_inode(vma->vm_file) != uprobe->inode) diff --git a/kernel/fork.c b/kernel/fork.c index f30b24c68442..ca12c40b2c4c 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -793,7 +793,8 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, mt_set_in_rcu(vmi.mas.tree); ksm_fork(mm, oldmm); khugepaged_fork(mm, oldmm); - } else if (mpnt) { + } else { + /* * The entire maple tree has already been duplicated. If the * mmap duplication fails, mark the failure point with @@ -801,8 +802,18 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, * stop releasing VMAs that have not been duplicated after this * point. */ - mas_set_range(&vmi.mas, mpnt->vm_start, mpnt->vm_end - 1); - mas_store(&vmi.mas, XA_ZERO_ENTRY); + if (mpnt) { + mas_set_range(&vmi.mas, mpnt->vm_start, mpnt->vm_end - 1); + mas_store(&vmi.mas, XA_ZERO_ENTRY); + /* Avoid OOM iterating a broken tree */ + set_bit(MMF_OOM_SKIP, &mm->flags); + } + /* + * The mm_struct is going to exit, but the locks will be dropped + * first. Set the mm_struct as unstable is advisable as it is + * not fully initialised. + */ + set_bit(MMF_UNSTABLE, &mm->flags); } out: mmap_write_unlock(mm); -- 2.34.1

2 1

[PATCH OLK-6.6 V1] scsi: ufs: core: Fix use-after free in init error and remove paths
by Zicheng Qu 28 Mar '25

28 Mar '25

From: André Draszik <andre.draszik(a)linaro.org> mainline inclusion from mainline-v6.14-rc2 commit f8fb2403ddebb5eea0033d90d9daae4c88749ada category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPCAA CVE: CVE-2025-21739 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- devm_blk_crypto_profile_init() registers a cleanup handler to run when the associated (platform-) device is being released. For UFS, the crypto private data and pointers are stored as part of the ufs_hba's data structure 'struct ufs_hba::crypto_profile'. This structure is allocated as part of the underlying ufshcd and therefore Scsi_host allocation. During driver release or during error handling in ufshcd_pltfrm_init(), this structure is released as part of ufshcd_dealloc_host() before the (platform-) device associated with the crypto call above is released. Once this device is released, the crypto cleanup code will run, using the just-released 'struct ufs_hba::crypto_profile'. This causes a use-after-free situation: Call trace: kfree+0x60/0x2d8 (P) kvfree+0x44/0x60 blk_crypto_profile_destroy_callback+0x28/0x70 devm_action_release+0x1c/0x30 release_nodes+0x6c/0x108 devres_release_all+0x98/0x100 device_unbind_cleanup+0x20/0x70 really_probe+0x218/0x2d0 In other words, the initialisation code flow is: platform-device probe ufshcd_pltfrm_init() ufshcd_alloc_host() scsi_host_alloc() allocation of struct ufs_hba creation of scsi-host devices devm_blk_crypto_profile_init() devm registration of cleanup handler using platform-device and during error handling of ufshcd_pltfrm_init() or during driver removal: ufshcd_dealloc_host() scsi_host_put() put_device(scsi-host) release of struct ufs_hba put_device(platform-device) crypto cleanup handler To fix this use-after free, change ufshcd_alloc_host() to register a devres action to automatically cleanup the underlying SCSI device on ufshcd destruction, without requiring explicit calls to ufshcd_dealloc_host(). This way: * the crypto profile and all other ufs_hba-owned resources are destroyed before SCSI (as they've been registered after) * a memleak is plugged in tc-dwc-g210-pci.c remove() as a side-effect * EXPORT_SYMBOL_GPL(ufshcd_dealloc_host) can be removed fully as it's not needed anymore * no future drivers using ufshcd_alloc_host() could ever forget adding the cleanup Fixes: cb77cb5abe1f ("blk-crypto: rename blk_keyslot_manager to blk_crypto_profile") Fixes: d76d9d7d1009 ("scsi: ufs: use devm_blk_ksm_init()") Cc: stable(a)vger.kernel.org Signed-off-by: André Draszik <andre.draszik(a)linaro.org> Link: https://lore.kernel.org/r/20250124-ufshcd-fix-v4-1-c5d0144aae59@linaro.org Reviewed-by: Bean Huo <beanhuo(a)micron.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Acked-by: Eric Biggers <ebiggers(a)kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/ufs/host/ufshcd-pltfrm.c include/ufs/ufshcd.h [For ufshcd-pltfrm.c, the main purpose is to remove the goto dealloc_host. However, in the current version, some parts that are intended to be removed do not exist, resulting in conflicts. For ufshcd.h, it aims to remove ufshcd_dealloc_host only, but in the mainline, it has more code (ufshcd_enable_irq, ufshcd_disable_irq) around ufshcd_dealloc_host, but they are not relevant to this patch.] Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/ufs/core/ufshcd.c | 31 +++++++++++++++++++++---------- drivers/ufs/host/ufshcd-pci.c | 2 -- drivers/ufs/host/ufshcd-pltfrm.c | 26 ++++++++------------------ include/ufs/ufshcd.h | 1 - 4 files changed, 29 insertions(+), 31 deletions(-) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index 84dac9050074..ffa5a3ac596e 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -10220,16 +10220,6 @@ int ufshcd_system_thaw(struct device *dev) EXPORT_SYMBOL_GPL(ufshcd_system_thaw); #endif /* CONFIG_PM_SLEEP */ -/** - * ufshcd_dealloc_host - deallocate Host Bus Adapter (HBA) - * @hba: pointer to Host Bus Adapter (HBA) - */ -void ufshcd_dealloc_host(struct ufs_hba *hba) -{ - scsi_host_put(hba->host); -} -EXPORT_SYMBOL_GPL(ufshcd_dealloc_host); - /** * ufshcd_set_dma_mask - Set dma mask based on the controller * addressing capability @@ -10248,12 +10238,26 @@ static int ufshcd_set_dma_mask(struct ufs_hba *hba) return dma_set_mask_and_coherent(hba->dev, DMA_BIT_MASK(32)); } +/** + * ufshcd_devres_release - devres cleanup handler, invoked during release of + * hba->dev + * @host: pointer to SCSI host + */ +static void ufshcd_devres_release(void *host) +{ + scsi_host_put(host); +} + /** * ufshcd_alloc_host - allocate Host Bus Adapter (HBA) * @dev: pointer to device handle * @hba_handle: driver private handle * * Return: 0 on success, non-zero value on failure. + * + * NOTE: There is no corresponding ufshcd_dealloc_host() because this function + * keeps track of its allocations using devres and deallocates everything on + * device removal automatically. */ int ufshcd_alloc_host(struct device *dev, struct ufs_hba **hba_handle) { @@ -10275,6 +10279,13 @@ int ufshcd_alloc_host(struct device *dev, struct ufs_hba **hba_handle) err = -ENOMEM; goto out_error; } + + err = devm_add_action_or_reset(dev, ufshcd_devres_release, + host); + if (err) + return dev_err_probe(dev, err, + "failed to add ufshcd dealloc action\n"); + host->nr_maps = HCTX_TYPE_POLL + 1; hba = shost_priv(host); hba->host = host; diff --git a/drivers/ufs/host/ufshcd-pci.c b/drivers/ufs/host/ufshcd-pci.c index 248a49e5e7f3..446c1d604cc6 100644 --- a/drivers/ufs/host/ufshcd-pci.c +++ b/drivers/ufs/host/ufshcd-pci.c @@ -516,7 +516,6 @@ static void ufshcd_pci_remove(struct pci_dev *pdev) pm_runtime_forbid(&pdev->dev); pm_runtime_get_noresume(&pdev->dev); ufshcd_remove(hba); - ufshcd_dealloc_host(hba); } /** @@ -561,7 +560,6 @@ ufshcd_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) err = ufshcd_init(hba, mmio_base, pdev->irq); if (err) { dev_err(&pdev->dev, "Initialization failed\n"); - ufshcd_dealloc_host(hba); return err; } diff --git a/drivers/ufs/host/ufshcd-pltfrm.c b/drivers/ufs/host/ufshcd-pltfrm.c index e99d89d00606..f6c645a62362 100644 --- a/drivers/ufs/host/ufshcd-pltfrm.c +++ b/drivers/ufs/host/ufshcd-pltfrm.c @@ -339,21 +339,17 @@ int ufshcd_pltfrm_init(struct platform_device *pdev, struct device *dev = &pdev->dev; mmio_base = devm_platform_ioremap_resource(pdev, 0); - if (IS_ERR(mmio_base)) { - err = PTR_ERR(mmio_base); - goto out; - } + if (IS_ERR(mmio_base)) + return PTR_ERR(mmio_base); irq = platform_get_irq(pdev, 0); - if (irq < 0) { - err = irq; - goto out; - } + if (irq < 0) + return irq; err = ufshcd_alloc_host(dev, &hba); if (err) { dev_err(dev, "Allocation failed\n"); - goto out; + return err; } hba->vops = vops; @@ -362,13 +358,13 @@ int ufshcd_pltfrm_init(struct platform_device *pdev, if (err) { dev_err(dev, "%s: clock parse failed %d\n", __func__, err); - goto dealloc_host; + return err; } err = ufshcd_parse_regulator_info(hba); if (err) { dev_err(dev, "%s: regulator init failed %d\n", __func__, err); - goto dealloc_host; + return err; } ufshcd_init_lanes_per_dir(hba); @@ -377,18 +373,13 @@ int ufshcd_pltfrm_init(struct platform_device *pdev, if (err) { dev_err_probe(dev, err, "Initialization failed with error %d\n", err); - goto dealloc_host; + return err; } pm_runtime_set_active(dev); pm_runtime_enable(dev); return 0; - -dealloc_host: - ufshcd_dealloc_host(hba); -out: - return err; } EXPORT_SYMBOL_GPL(ufshcd_pltfrm_init); @@ -402,7 +393,6 @@ void ufshcd_pltfrm_remove(struct platform_device *pdev) pm_runtime_get_sync(&pdev->dev); ufshcd_remove(hba); - ufshcd_dealloc_host(hba); pm_runtime_disable(&pdev->dev); pm_runtime_put_noidle(&pdev->dev); } diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h index f66a275bf8cc..1572cc677b8b 100644 --- a/include/ufs/ufshcd.h +++ b/include/ufs/ufshcd.h @@ -1237,7 +1237,6 @@ static inline void ufshcd_rmwl(struct ufs_hba *hba, u32 mask, u32 val, u32 reg) } int ufshcd_alloc_host(struct device *, struct ufs_hba **); -void ufshcd_dealloc_host(struct ufs_hba *); int ufshcd_hba_enable(struct ufs_hba *hba); int ufshcd_init(struct ufs_hba *, void __iomem *, unsigned int); int ufshcd_link_recovery(struct ufs_hba *hba); -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1525/1525] drivers/char/svm.c:366:43: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 28 Mar '25

28 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4d1e247486ffeef035a5a55a97f2659f68177357 commit: 51d0e1a742714b2599d54fd92a71bd2998b01084 [1525/1525] support multiple node for getting phys interface config: arm64-randconfig-r112-20250328 (https://download.01.org/0day-ci/archive/20250328/202503281546.GkxeQtL3-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250328/202503281546.GkxeQtL3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503281546.GkxeQtL3-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/char/svm.c:248:20: sparse: sparse: symbol 'svm_find_mem_reg_node' was not declared. Should it be static? drivers/char/svm.c:325:14: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct svm_va2pa_slot *slot @@ got void [noderef] __iomem * @@ drivers/char/svm.c:325:14: sparse: expected struct svm_va2pa_slot *slot drivers/char/svm.c:325:14: sparse: got void [noderef] __iomem * >> drivers/char/svm.c:366:43: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got struct svm_va2pa_slot *slots @@ drivers/char/svm.c:366:43: sparse: expected void volatile [noderef] __iomem *addr drivers/char/svm.c:366:43: sparse: got struct svm_va2pa_slot *slots drivers/char/svm.c:449:6: sparse: sparse: symbol 'sysrq_sched_debug_show_export' was not declared. Should it be static? drivers/char/svm.c:1272:35: sparse: sparse: Using plain integer as NULL pointer drivers/char/svm.c:248:21: warning: no previous prototype for 'svm_find_mem_reg_node' [-Wmissing-prototypes] 248 | struct device_node *svm_find_mem_reg_node(struct device *dev, const char *compat) | ^~~~~~~~~~~~~~~~~~~~~ drivers/char/svm.c:449:6: warning: no previous prototype for 'sysrq_sched_debug_show_export' [-Wmissing-prototypes] 449 | void sysrq_sched_debug_show_export(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/char/svm.c:1476:5: warning: no previous prototype for 'svm_get_pasid' [-Wmissing-prototypes] 1476 | int svm_get_pasid(pid_t vpid, int dev_id __maybe_unused) | ^~~~~~~~~~~~~ drivers/char/svm.c:2269:36: warning: 'svm_acpi_match' defined but not used [-Wunused-const-variable=] 2269 | static const struct acpi_device_id svm_acpi_match[] = { | ^~~~~~~~~~~~~~ In file included from arch/arm64/include/asm/atomic.h:34, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from include/asm-generic/bug.h:18, from arch/arm64/include/asm/bug.h:37, from arch/arm64/include/asm/memory.h:27, from arch/arm64/include/asm/esr.h:21, from drivers/char/svm.c:10: In function '__cmpxchg_case_mb_4', inlined from '__cmpxchg_mb' at arch/arm64/include/asm/cmpxchg.h:143:1, inlined from 'svm_proc_load_flag' at drivers/char/svm.c:1805:12: arch/arm64/include/asm/atomic_lse.h:492:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'atomic_t[1]' [-Warray-bounds=] 492 | asm volatile( 39- | ^~~ arch/arm64/include/asm/atomic_lse.h:523:1: note: in expansion of macro '__CMPXCHG_CASE' 523 | __CMPXCHG_CASE(w, , mb_4, al, "memory") | ^~~~~~~~~~~~~~ drivers/char/svm.c: In function 'svm_proc_load_flag': drivers/char/svm.c:1796:25: note: object 'l2buf_load_flag' of size 4 1796 | static atomic_t l2buf_load_flag = ATOMIC_INIT(0); | ^~~~~~~~~~~~~~~ In function '__cmpxchg_case_mb_4', inlined from '__cmpxchg_mb' at arch/arm64/include/asm/cmpxchg.h:143:1, inlined from 'svm_proc_load_flag' at drivers/char/svm.c:1805:12: arch/arm64/include/asm/atomic_lse.h:492:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'atomic_t[1]' [-Warray-bounds=] 492 | asm volatile( 52- | ^~~ arch/arm64/include/asm/atomic_lse.h:523:1: note: in expansion of macro '__CMPXCHG_CASE' 523 | __CMPXCHG_CASE(w, , mb_4, al, "memory") | ^~~~~~~~~~~~~~ drivers/char/svm.c: In function 'svm_proc_load_flag': drivers/char/svm.c:1796:25: note: object 'l2buf_load_flag' of size 4 1796 | static atomic_t l2buf_load_flag = ATOMIC_INIT(0); | ^~~~~~~~~~~~~~~ vim +366 drivers/char/svm.c 357 358 static void svm_remove_trunk(struct device *dev) 359 { 360 int count; 361 362 for (count = 0; count < SVM_VA2PA_TRUNK_COUNT_MAX; count++) { 363 if (!va2pa_trunk[count].base) 364 break; 365 > 366 iounmap(va2pa_trunk[count].slots); 367 kvfree(va2pa_trunk[count].bitmap); 368 va2pa_trunk[count].slots = NULL; 369 va2pa_trunk[count].bitmap = NULL; 370 } 371 } 372 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 V1] list: fix a data-race around ep->rdllist
by Zicheng Qu 28 Mar '25

28 Mar '25

From: Kuniyuki Iwashima <kuniyu(a)amazon.co.jp> stable inclusion from stable-v5.15.46 commit 5d5d993f16be15d124be7b8ec71b28ef7b7dc3af category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6RN CVE: CVE-2022-49443 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- [ Upstream commit d679ae94fdd5d3ab00c35078f5af5f37e068b03d ] ep_poll() first calls ep_events_available() with no lock held and checks if ep->rdllist is empty by list_empty_careful(), which reads rdllist->prev. Thus all accesses to it need some protection to avoid store/load-tearing. Note INIT_LIST_HEAD_RCU() already has the annotation for both prev and next. Commit bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") added the first lockless ep_events_available(), and commit c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epoll_wait()") made some ep_events_available() calls lockless and added single call under a lock, finally commit e59d3c64cba6 ("epoll: eliminate unnecessary lock for zero timeout") made the last ep_events_available() lockless. BUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0: INIT_LIST_HEAD include/linux/list.h:38 [inline] list_splice_init include/linux/list.h:492 [inline] ep_start_scan fs/eventpoll.c:622 [inline] ep_send_events fs/eventpoll.c:1656 [inline] ep_poll fs/eventpoll.c:1806 [inline] do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1: list_empty_careful include/linux/list.h:329 [inline] ep_events_available fs/eventpoll.c:381 [inline] ep_poll fs/eventpoll.c:1797 [inline] do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0xffff88810480c7d0 -> 0xffff888103c15098 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G W 5.17.0-rc7-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Link: https://lkml.kernel.org/r/20220322002653.33865-3-kuniyu@amazon.co.jp Fixes: e59d3c64cba6 ("epoll: eliminate unnecessary lock for zero timeout") Fixes: c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epoll_wait()") Fixes: bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.co.jp> Reported-by: syzbot+bdd6e38a1ed5ee58d8bd(a)syzkaller.appspotmail.com Cc: Al Viro <viro(a)zeniv.linux.org.uk>, Andrew Morton <akpm(a)linux-foundation.org> Cc: Kuniyuki Iwashima <kuniyu(a)amazon.co.jp> Cc: Kuniyuki Iwashima <kuni1840(a)gmail.com> Cc: "Soheil Hassas Yeganeh" <soheil(a)google.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: "Sridhar Samudrala" <sridhar.samudrala(a)intel.com> Cc: Alexander Duyck <alexander.h.duyck(a)intel.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: include/linux/list.h [This patch lacks the prerequisite patch for the list_is_head(). Therefore, only keep the current version of "next == head" as is and only modify the READ_ONCE() additions introduced by this patch.] Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- include/linux/list.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/include/linux/list.h b/include/linux/list.h index fa9f691f2553..aab9705902ed 100644 --- a/include/linux/list.h +++ b/include/linux/list.h @@ -33,7 +33,7 @@ static inline void INIT_LIST_HEAD(struct list_head *list) { WRITE_ONCE(list->next, list); - list->prev = list; + WRITE_ONCE(list->prev, list); } #ifdef CONFIG_DEBUG_LIST @@ -296,7 +296,7 @@ static inline int list_empty(const struct list_head *head) static inline void list_del_init_careful(struct list_head *entry) { __list_del_entry(entry); - entry->prev = entry; + WRITE_ONCE(entry->prev, entry); smp_store_release(&entry->next, entry); } @@ -316,7 +316,7 @@ static inline void list_del_init_careful(struct list_head *entry) static inline int list_empty_careful(const struct list_head *head) { struct list_head *next = smp_load_acquire(&head->next); - return (next == head) && (next == head->prev); + return (next == head) && (next == READ_ONCE(head->prev)); } /** -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
by Zicheng Qu 28 Mar '25

28 Mar '25

From: Hangyu Hua <hbh25y(a)gmail.com> stable inclusion from stable-v4.19.247 commit f8cd192752a1f613b14eee77783c6f0aebb49691 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1JW CVE: CVE-2022-49467 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 947a844bb3ebff0f4736d244d792ce129f6700d7 ] drm_gem_object_lookup will call drm_gem_object_get inside. So cursor_bo needs to be put when msm_gem_get_and_pin_iova fails. Fixes: e172d10a9c4a ("drm/msm/mdp5: Add hardware cursor support") Signed-off-by: Hangyu Hua <hbh25y(a)gmail.com> Link: https://lore.kernel.org/r/20220509061125.18585-1-hbh25y@gmail.com Signed-off-by: Rob Clark <robdclark(a)chromium.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c index b1da9ce54379..11d0e810b409 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c @@ -905,8 +905,10 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc, ret = msm_gem_get_iova(cursor_bo, kms->aspace, &mdp5_crtc->cursor.iova); - if (ret) + if (ret) { + drm_gem_object_put(cursor_bo); return -EINVAL; + } pm_runtime_get_sync(&pdev->dev); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
by Zicheng Qu 28 Mar '25

28 Mar '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.247 commit 984cfef0675ed7398814e14af2c5323911723e1c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP43Y CVE: CVE-2022-49481 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit afaa7b933ef00a2d3262f4d1252087613fb5c06d ] of_node_get() returns a node with refcount incremented. Calling of_node_put() to drop the reference when not needed anymore. Fixes: 3784b6d64dc5 ("regulator: pfuze100: add pfuze100 regulator driver") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Link: https://lore.kernel.org/r/20220511113506.45185-1-linmq006@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/regulator/pfuze100-regulator.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c index 69a377ab2604..3248c194624f 100644 --- a/drivers/regulator/pfuze100-regulator.c +++ b/drivers/regulator/pfuze100-regulator.c @@ -495,6 +495,7 @@ static int pfuze_parse_regulators_dt(struct pfuze_chip *chip) parent = of_get_child_by_name(np, "regulators"); if (!parent) { dev_err(dev, "regulators node not found\n"); + of_node_put(np); return -EINVAL; } @@ -524,6 +525,7 @@ static int pfuze_parse_regulators_dt(struct pfuze_chip *chip) } of_node_put(parent); + of_node_put(np); if (ret < 0) { dev_err(dev, "Error parsing regulator init data: %d\n", ret); -- 2.34.1

2 1

[PATCH OLK-5.10 V1] sched/fair: Optimize the dynamic smt
by Cheng Yu 28 Mar '25

28 Mar '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBWWUI CVE: NA -------------------------------- The optimizations are as follows: 1. A more reasonable algorithm for obtaining load values; 2. Limit the maximum value of sysctl_sched_util_ratio to 100; 3. If the value of sysctl_sched_util_ratio is 100, the other smt of the core will not be used. Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- arch/arm64/Kconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 - init/Kconfig | 7 +++++++ kernel/sched/fair.c | 7 +++++-- kernel/sysctl.c | 1 + 5 files changed, 14 insertions(+), 3 deletions(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 2591707024d4..93ced97f8c6c 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -78,6 +78,7 @@ config ARM64 select ARCH_SUPPORTS_ATOMIC_RMW select ARCH_SUPPORTS_INT128 if CC_HAS_INT128 && (GCC_VERSION >= 50000 || CC_IS_CLANG) select ARCH_SUPPORTS_NUMA_BALANCING + select ARCH_SUPPORTS_SCHED_KEEP_ON_CORE select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH select ARCH_WANT_COMPAT_IPC_PARSE_VERSION if COMPAT select ARCH_WANT_DEFAULT_BPF_JIT diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 20bd8ac25791..e008e119e7a4 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -194,7 +194,6 @@ CONFIG_USER_NS=y CONFIG_PID_NS=y CONFIG_NET_NS=y CONFIG_SCHED_STEAL=y -# CONFIG_SCHED_KEEP_ON_CORE is not set CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set diff --git a/init/Kconfig b/init/Kconfig index be284bca406c..3a6a14e66acd 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1370,8 +1370,15 @@ config SCHED_STEAL If unsure, say N here. +# +# For architectures that want to enable the support for SCHED_KEEP_ON_CORE +# +config ARCH_SUPPORTS_SCHED_KEEP_ON_CORE + bool + config SCHED_KEEP_ON_CORE bool "Prefer physical cores when migrating tasks" + depends on ARCH_SUPPORTS_SCHED_KEEP_ON_CORE depends on SCHED_SMT default n help diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index a518d636f07f..5fc8d6a25b9a 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7330,13 +7330,16 @@ static int select_idle_core(struct task_struct *p, int core, struct cpumask *cpu #ifdef CONFIG_SCHED_KEEP_ON_CORE int sysctl_sched_util_ratio = 100; -static int core_has_spare(int cpu) +static bool core_has_spare(int cpu) { int core_id = cpumask_first(cpu_smt_mask(cpu)); struct rq *rq = cpu_rq(core_id); - unsigned long util = rq->cfs.avg.util_avg; + unsigned long util = cpu_util(cpu); unsigned long capacity = rq->cpu_capacity; + if (sysctl_sched_util_ratio == 100) + return true; + return util * 100 < capacity * sysctl_sched_util_ratio; } #endif diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 0d4d83da4b30..b4b36f8a3149 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2828,6 +2828,7 @@ static struct ctl_table kern_table[] = { .mode = 0644, .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, + .extra2 = &one_hundred, }, #endif #ifdef CONFIG_SCHED_STEAL -- 2.25.1

2 1

[PATCH OLK-5.10] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Radu Rendec <rrendec(a)redhat.com> stable inclusion from stable-v5.10.235 commit e4fde33107351ec33f1a64188612fbc6ca659284 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBPC4K CVE: CVE-2025-21785 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2 ] The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level). Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information") Signed-off-by: Radu Rendec <rrendec(a)redhat.com> Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 97c42be71338..1510f457b615 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -87,16 +87,18 @@ int populate_cache_leaves(unsigned int cpu) unsigned int level, idx; enum cache_type type; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf = this_cpu_ci->info_list; + struct cacheinfo *infos = this_cpu_ci->info_list; for (idx = 0, level = 1; level <= this_cpu_ci->num_levels && - idx < this_cpu_ci->num_leaves; idx++, level++) { + idx < this_cpu_ci->num_leaves; level++) { type = get_cache_type(level); if (type == CACHE_TYPE_SEPARATE) { - ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); - ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); + if (idx + 1 >= this_cpu_ci->num_leaves) + break; + ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level); + ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level); } else { - ci_leaf_init(this_leaf++, type, level); + ci_leaf_init(&infos[idx++], type, level); } } return 0; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Radu Rendec <rrendec(a)redhat.com> stable inclusion from stable-v5.10.235 commit e4fde33107351ec33f1a64188612fbc6ca659284 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4K CVE: CVE-2025-21785 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2 ] The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level). Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information") Signed-off-by: Radu Rendec <rrendec(a)redhat.com> Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 0c0cd4d26b87..80a4ab1c43fd 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -96,16 +96,18 @@ static int __populate_cache_leaves(unsigned int cpu) unsigned int level, idx; enum cache_type type; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf = this_cpu_ci->info_list; + struct cacheinfo *infos = this_cpu_ci->info_list; for (idx = 0, level = 1; level <= this_cpu_ci->num_levels && - idx < this_cpu_ci->num_leaves; idx++, level++) { + idx < this_cpu_ci->num_leaves; level++) { type = get_cache_type(level); if (type == CACHE_TYPE_SEPARATE) { - ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); - ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); + if (idx + 1 >= this_cpu_ci->num_leaves) + break; + ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level); + ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level); } else { - ci_leaf_init(this_leaf++, type, level); + ci_leaf_init(&infos[idx++], type, level); } } return 0; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] PM / devfreq: rk3399_dmc: Disable edev on remove()
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Brian Norris <briannorris(a)chromium.org> stable inclusion from stable-v4.19.247 commit 664736e2cc09e504ce58ec61164d029d1f2651bb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6Y5 CVE: CVE-2022-49460 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2fccf9e6050e0e3b8b4cd275d41daf7f7fa22804 ] Otherwise we hit an unablanced enable-count when unbinding the DFI device: [ 1279.659119] ------------[ cut here ]------------ [ 1279.659179] WARNING: CPU: 2 PID: 5638 at drivers/devfreq/devfreq-event.c:360 devfreq_event_remove_edev+0x84/0x8c ... [ 1279.659352] Hardware name: Google Kevin (DT) [ 1279.659363] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO BTYPE=--) [ 1279.659371] pc : devfreq_event_remove_edev+0x84/0x8c [ 1279.659380] lr : devm_devfreq_event_release+0x1c/0x28 ... [ 1279.659571] Call trace: [ 1279.659582] devfreq_event_remove_edev+0x84/0x8c [ 1279.659590] devm_devfreq_event_release+0x1c/0x28 [ 1279.659602] release_nodes+0x1cc/0x244 [ 1279.659611] devres_release_all+0x44/0x60 [ 1279.659621] device_release_driver_internal+0x11c/0x1ac [ 1279.659629] device_driver_detach+0x20/0x2c [ 1279.659641] unbind_store+0x7c/0xb0 [ 1279.659650] drv_attr_store+0x2c/0x40 [ 1279.659663] sysfs_kf_write+0x44/0x58 [ 1279.659672] kernfs_fop_write_iter+0xf4/0x190 [ 1279.659684] vfs_write+0x2b0/0x2e4 [ 1279.659693] ksys_write+0x80/0xec [ 1279.659701] __arm64_sys_write+0x24/0x30 [ 1279.659714] el0_svc_common+0xf0/0x1d8 [ 1279.659724] do_el0_svc_compat+0x28/0x3c [ 1279.659738] el0_svc_compat+0x10/0x1c [ 1279.659746] el0_sync_compat_handler+0xa8/0xcc [ 1279.659758] el0_sync_compat+0x188/0x1c0 [ 1279.659768] ---[ end trace cec200e5094155b4 ]--- Signed-off-by: Brian Norris <briannorris(a)chromium.org> Signed-off-by: Chanwoo Choi <cw00.choi(a)samsung.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/devfreq/rk3399_dmc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/devfreq/rk3399_dmc.c b/drivers/devfreq/rk3399_dmc.c index e795ad2b3f6b..eefda6edc89c 100644 --- a/drivers/devfreq/rk3399_dmc.c +++ b/drivers/devfreq/rk3399_dmc.c @@ -411,6 +411,8 @@ static int rk3399_dmcfreq_remove(struct platform_device *pdev) { struct rk3399_dmcfreq *dmcfreq = dev_get_drvdata(&pdev->dev); + devfreq_event_disable_edev(dmcfreq->edev); + /* * Before remove the opp table we need to unregister the opp notifier. */ -- 2.43.0

2 1

[PATCH OLK-6.6] ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
by Yifan Qiao 28 Mar '25

28 Mar '25

From: Vasiliy Kovalev <kovalev(a)altlinux.org> mainline inclusion from mainline-v6.14-rc5 commit c84e125fff2615b4d9c259e762596134eddd2f27 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVT6 CVE: CVE-2025-21887 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still accessed in ovl_dentry_remote(). Move dput(upper) after its last use to prevent use-after-free. BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline] BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 ovl_dentry_remote fs/overlayfs/util.c:162 [inline] ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 ovl_link_up fs/overlayfs/copy_up.c:610 [inline] ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223 ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136 vfs_rename+0xf84/0x20a0 fs/namei.c:4893 ... </TASK> Fixes: b07d5cc93e1b ("ovl: update of dentry revalidate flags after copy up") Reported-by: syzbot+316db8a1191938280eb6(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=316db8a1191938280eb6 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Link: https://lore.kernel.org/r/20250214215148.761147-1-kovalev@altlinux.org Reviewed-by: Amir Goldstein <amir73il(a)gmail.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/overlayfs/copy_up.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c index 18e018cb1811..dbf7b3cd70ca 100644 --- a/fs/overlayfs/copy_up.c +++ b/fs/overlayfs/copy_up.c @@ -570,7 +570,6 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) err = PTR_ERR(upper); if (!IS_ERR(upper)) { err = ovl_do_link(ofs, ovl_dentry_upper(c->dentry), udir, upper); - dput(upper); if (!err) { /* Restore timestamps on parent (best effort) */ @@ -578,6 +577,7 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) ovl_dentry_set_upper_alias(c->dentry); ovl_dentry_update_reval(c->dentry, upper); } + dput(upper); } inode_unlock(udir); if (err) -- 2.39.2

2 1

[PATCH OLK-5.10] ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
by Yifan Qiao 28 Mar '25

28 Mar '25

From: Vasiliy Kovalev <kovalev(a)altlinux.org> mainline inclusion from mainline-v6.14-rc5 commit c84e125fff2615b4d9c259e762596134eddd2f27 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVT6 CVE: CVE-2025-21887 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still accessed in ovl_dentry_remote(). Move dput(upper) after its last use to prevent use-after-free. BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline] BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 ovl_dentry_remote fs/overlayfs/util.c:162 [inline] ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 ovl_link_up fs/overlayfs/copy_up.c:610 [inline] ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223 ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136 vfs_rename+0xf84/0x20a0 fs/namei.c:4893 ... </TASK> Fixes: b07d5cc93e1b ("ovl: update of dentry revalidate flags after copy up") Reported-by: syzbot+316db8a1191938280eb6(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=316db8a1191938280eb6 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Link: https://lore.kernel.org/r/20250214215148.761147-1-kovalev@altlinux.org Reviewed-by: Amir Goldstein <amir73il(a)gmail.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/overlayfs/copy_up.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c index 65ac504595ba..a1ec45fc77d8 100644 --- a/fs/overlayfs/copy_up.c +++ b/fs/overlayfs/copy_up.c @@ -469,7 +469,6 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) err = PTR_ERR(upper); if (!IS_ERR(upper)) { err = ovl_do_link(ovl_dentry_upper(c->dentry), udir, upper); - dput(upper); if (!err) { /* Restore timestamps on parent (best effort) */ @@ -477,6 +476,7 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) ovl_dentry_set_upper_alias(c->dentry); ovl_dentry_update_reval(c->dentry, upper); } + dput(upper); } inode_unlock(udir); if (err) -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 1525/1525] drivers/char/svm.c:249:20: sparse: sparse: symbol 'svm_find_mem_reg_node' was not declared. Should it be static?
by kernel test robot 28 Mar '25

28 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3f8283040b83a49bdad8dc3dd4ccd3f50910af28 commit: 9469d1759c2905dcef49df7e6240ad5c32b66296 [1525/1525] ascend: share_pool: enable svm to use share pool memory config: arm64-randconfig-r112-20250328 (https://download.01.org/0day-ci/archive/20250328/202503281257.212dRYe6-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250328/202503281257.212dRYe6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503281257.212dRYe6-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/char/svm.c:240:24: sparse: sparse: symbol 'va2pa_trunk' was not declared. Should it be static? >> drivers/char/svm.c:249:20: sparse: sparse: symbol 'svm_find_mem_reg_node' was not declared. Should it be static? >> drivers/char/svm.c:320:14: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct svm_va2pa_slot *slot @@ got void [noderef] __iomem * @@ drivers/char/svm.c:320:14: sparse: expected struct svm_va2pa_slot *slot drivers/char/svm.c:320:14: sparse: got void [noderef] __iomem * drivers/char/svm.c:338:28: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got struct svm_va2pa_slot *[addressable] [assigned] [toplevel] slots @@ drivers/char/svm.c:338:28: sparse: expected void volatile [noderef] __iomem *addr drivers/char/svm.c:338:28: sparse: got struct svm_va2pa_slot *[addressable] [assigned] [toplevel] slots drivers/char/svm.c:419:6: sparse: sparse: symbol 'sysrq_sched_debug_show_export' was not declared. Should it be static? drivers/char/svm.c:1242:35: sparse: sparse: Using plain integer as NULL pointer drivers/char/svm.c:1502:5: sparse: sparse: symbol '__svm_get_mpam' was not declared. Should it be static? drivers/char/svm.c:249:21: warning: no previous prototype for 'svm_find_mem_reg_node' [-Wmissing-prototypes] 249 | struct device_node *svm_find_mem_reg_node(struct device *dev, const char *compat) | ^~~~~~~~~~~~~~~~~~~~~ drivers/char/svm.c:419:6: warning: no previous prototype for 'sysrq_sched_debug_show_export' [-Wmissing-prototypes] 419 | void sysrq_sched_debug_show_export(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/char/svm.c:1429:5: warning: no previous prototype for 'svm_get_pasid' [-Wmissing-prototypes] 1429 | int svm_get_pasid(pid_t vpid, int dev_id __maybe_unused) | ^~~~~~~~~~~~~ drivers/char/svm.c:1502:5: warning: no previous prototype for '__svm_get_mpam' [-Wmissing-prototypes] 1502 | int __svm_get_mpam(struct svm_mpam *mpam) | ^~~~~~~~~~~~~~ drivers/char/svm.c:2437:36: warning: 'svm_acpi_match' defined but not used [-Wunused-const-variable=] 2437 | static const struct acpi_device_id svm_acpi_match[] = { | ^~~~~~~~~~~~~~ In file included from arch/arm64/include/asm/atomic.h:34, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from include/asm-generic/bug.h:18, from arch/arm64/include/asm/bug.h:37, from arch/arm64/include/asm/memory.h:27, from arch/arm64/include/asm/esr.h:21, from drivers/char/svm.c:10: In function '__cmpxchg_case_mb_4', inlined from '__cmpxchg_mb' at arch/arm64/include/asm/cmpxchg.h:143:1, inlined from 'svm_proc_load_flag' at drivers/char/svm.c:1967:12: arch/arm64/include/asm/atomic_lse.h:492:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'atomic_t[1]' [-Warray-bounds=] 492 | asm volatile( 44- | ^~~ arch/arm64/include/asm/atomic_lse.h:523:1: note: in expansion of macro '__CMPXCHG_CASE' 523 | __CMPXCHG_CASE(w, , mb_4, al, "memory") | ^~~~~~~~~~~~~~ drivers/char/svm.c: In function 'svm_proc_load_flag': drivers/char/svm.c:1958:25: note: object 'l2buf_load_flag' of size 4 1958 | static atomic_t l2buf_load_flag = ATOMIC_INIT(0); | ^~~~~~~~~~~~~~~ In function '__cmpxchg_case_mb_4', inlined from '__cmpxchg_mb' at arch/arm64/include/asm/cmpxchg.h:143:1, inlined from 'svm_proc_load_flag' at drivers/char/svm.c:1967:12: arch/arm64/include/asm/atomic_lse.h:492:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'atomic_t[1]' [-Warray-bounds=] 492 | asm volatile( 57- | ^~~ arch/arm64/include/asm/atomic_lse.h:523:1: note: in expansion of macro '__CMPXCHG_CASE' 523 | __CMPXCHG_CASE(w, , mb_4, al, "memory") | ^~~~~~~~~~~~~~ drivers/char/svm.c: In function 'svm_proc_load_flag': drivers/char/svm.c:1958:25: note: object 'l2buf_load_flag' of size 4 1958 | static atomic_t l2buf_load_flag = ATOMIC_INIT(0); | ^~~~~~~~~~~~~~~ vim +/svm_find_mem_reg_node +249 drivers/char/svm.c 248 > 249 struct device_node *svm_find_mem_reg_node(struct device *dev, const char *compat) 250 { 251 int index = 0; 252 struct device_node *tmp = NULL; 253 struct device_node *np = dev->of_node; 254 255 for (; ; index++) { 256 tmp = of_parse_phandle(np, "memory-region", index); 257 if (!tmp) 258 break; 259 260 if (of_device_is_compatible(tmp, compat)) 261 return tmp; 262 263 of_node_put(tmp); 264 } 265 266 return NULL; 267 } 268 269 static int svm_parse_trunk_memory(struct device *dev, phys_addr_t *base, unsigned long *size) 270 { 271 int err; 272 struct resource r; 273 struct device_node *trunk = NULL; 274 275 trunk = svm_find_mem_reg_node(dev, SVM_MEM_REG); 276 if (!trunk) { 277 dev_err(dev, "Didn't find reserved memory\n"); 278 return -EINVAL; 279 } 280 281 err = of_address_to_resource(trunk, 0, &r); 282 of_node_put(trunk); 283 if (err) { 284 dev_err(dev, "Couldn't address to resource for reserved memory\n"); 285 return -ENOMEM; 286 } 287 288 *base = r.start; 289 *size = resource_size(&r); 290 291 return 0; 292 } 293 294 static int svm_setup_trunk(struct device *dev, phys_addr_t base, unsigned long size) 295 { 296 int slot_total; 297 unsigned long *bitmap = NULL; 298 struct svm_va2pa_slot *slot = NULL; 299 300 if (!IS_ALIGNED(base, SVM_VA2PA_MEMORY_ALIGN)) { 301 dev_err(dev, "Didn't aligned to %u\n", SVM_VA2PA_MEMORY_ALIGN); 302 return -EINVAL; 303 } 304 305 if ((size == 0) || (size > SVM_VA2PA_TRUNK_SIZE_MAX)) { 306 dev_err(dev, "Size of reserved memory is not right\n"); 307 return -EINVAL; 308 } 309 310 slot_total = size / SVM_VA2PA_SLOT_SIZE; 311 if (slot_total < BITS_PER_LONG) 312 return -EINVAL; 313 314 bitmap = kvcalloc(slot_total / BITS_PER_LONG, sizeof(unsigned long), GFP_KERNEL); 315 if (!bitmap) { 316 dev_err(dev, "alloc memory failed\n"); 317 return -ENOMEM; 318 } 319 > 320 slot = ioremap(base, size); 321 if (!slot) { 322 kvfree(bitmap); 323 dev_err(dev, "Ioremap trunk failed\n"); 324 return -ENXIO; 325 } 326 327 va2pa_trunk.slots = slot; 328 va2pa_trunk.slot_used = 0; 329 va2pa_trunk.slot_total = slot_total; 330 va2pa_trunk.bitmap = bitmap; 331 mutex_init(&va2pa_trunk.mutex); 332 333 return 0; 334 } 335 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

Kernel SIG双周例会
by openEuler conference 28 Mar '25

28 Mar '25

您好！ Kernel 邀请您参加 2025-03-28 14:00 召开的WeLink会议(自动录制) 会议主题：Kernel SIG双周例会会议链接：https://meeting.huaweicloud.com:36443/#/j/964258324 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2025-03-28 14:00, The subject of the conference is Kernel SIG双周例会 You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/964258324 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[openeuler:OLK-6.6] BUILD REGRESSION b28aab59b06935f0d1c9bce8f013f25b4094764d
by kernel test robot 28 Mar '25

28 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: b28aab59b06935f0d1c9bce8f013f25b4094764d !15593 io_uring: prevent opcode speculation Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503280313.olFyEFIT-lkp@intel.com https://lore.kernel.org/oe-kbuild/202503271832.WycjTkRa-lkp@intel.com clang: warning: -Wl,-soname=linux-ilp32-vdso.so.1: 'linker' input unused [-Wunused-command-line-argument] error: unknown target ABI 'ilp32' Unverified Error/Warning (likely false positive, kindly check if interested): drivers/hid/hid-thrustmaster.c:178 thrustmaster_interrupts() warn: possible memory leak of 'send_buf' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-virtcca_get_tmi_version | |-- drivers-coda-coda_pci.c:warning:Excess-function-parameter-pdev-description-in-virtcca_pci_get_rom_size | |-- drivers-coda-coda_pci.c:warning:Function-parameter-or-member-p-not-described-in-virtcca_pci_get_rom_size | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-defconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-002-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-003-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-004-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-r112-20250328 | |-- clang:warning:Wl-soname-linux-ilp32-vdso.so.:linker-input-unused | `-- error:unknown-target-ABI-ilp32 |-- loongarch-allmodconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allnoconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allyesconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-defconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-002-20250327 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-r061-20250327 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allyesconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250327 | |-- drivers-gpu-drm-sti-sti_dvo.c:error:implicit-declaration-of-function-devm_ioremap | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size |-- x86_64-randconfig-101-20250328 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-102-20250328 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-103-20250328 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-104-20250328 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-121-20250328 | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-122-20250328 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-123-20250328 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-161-20250326 | `-- drivers-hid-hid-thrustmaster.c-thrustmaster_interrupts()-warn:possible-memory-leak-of-send_buf `-- x86_64-randconfig-161-20250327 `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used elapsed time: 1448m configs tested: 21 configs skipped: 124 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250327 gcc-5.5.0 arm64 randconfig-002-20250327 clang-21 arm64 randconfig-003-20250327 clang-21 arm64 randconfig-004-20250327 clang-21 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250327 gcc-14.2.0 loongarch randconfig-002-20250327 gcc-14.2.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250327 gcc-12 x86_64 buildonly-randconfig-002-20250327 gcc-12 x86_64 buildonly-randconfig-003-20250327 clang-20 x86_64 buildonly-randconfig-004-20250327 clang-20 x86_64 buildonly-randconfig-005-20250327 gcc-12 x86_64 buildonly-randconfig-006-20250327 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Radu Rendec <rrendec(a)redhat.com> stable inclusion from stable-v5.10.235 commit e4fde33107351ec33f1a64188612fbc6ca659284 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4K CVE: CVE-2025-21785 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2 ] The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level). Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information") Signed-off-by: Radu Rendec <rrendec(a)redhat.com> Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 0c0cd4d26b87..80a4ab1c43fd 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -96,16 +96,18 @@ static int __populate_cache_leaves(unsigned int cpu) unsigned int level, idx; enum cache_type type; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf = this_cpu_ci->info_list; + struct cacheinfo *infos = this_cpu_ci->info_list; for (idx = 0, level = 1; level <= this_cpu_ci->num_levels && - idx < this_cpu_ci->num_leaves; idx++, level++) { + idx < this_cpu_ci->num_leaves; level++) { type = get_cache_type(level); if (type == CACHE_TYPE_SEPARATE) { - ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); - ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); + if (idx + 1 >= this_cpu_ci->num_leaves) + break; + ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level); + ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level); } else { - ci_leaf_init(this_leaf++, type, level); + ci_leaf_init(&infos[idx++], type, level); } } return 0; -- 2.43.0

2 1

[PATCH OLK-5.10] arm64: mm: add mc support for __buffer_migrate_page
by Wupeng Ma 28 Mar '25

28 Mar '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB0OV7 -------------------------------- During our test, panic happens when kernel try to read a user page in __buffer_migrate_page with the following trace: Internal error: synchronous external abort: ffffffff96000410 [#1] SMP pstate: 00401009 (nzcv daif +PAN -UAO -TCO BTYPE=--) pc : copy_page+0x40/0xbc lr : copy_highpage+0x3c/0x60 sp : ffff8040de1caec0 Call trace: copy_page+0x40/0xbc migrate_page_copy+0x44/0xd0 __buffer_migrate_page.part.0+0x288/0x3f0 buffer_migrate_page+0x28/0x60 move_to_new_page+0x68/0x274 __unmap_and_move+0x424/0x574 unmap_and_move+0x84/0x67c migrate_pages+0x160/0x540 compact_zone+0x1d8/0x5b4 compact_zone_order+0xa4/0xfc try_to_compact_pages+0xb0/0x2a0 __alloc_pages_direct_compact+0x9c/0x210 __alloc_pages+0x844/0x1214 alloc_pages_vma+0x388/0x3e0 do_huge_pmd_anonymous_page+0x170/0x574 __handle_mm_fault+0x374/0x3ac handle_mm_fault+0xf4/0x260 __get_user_pages+0x218/0x42c __gup_longterm_locked+0x94/0x2c0 internal_get_user_pages_fast+0x140/0x240 pin_user_pages_fast+0x24/0x50 __ib_umem_get.part.0+0x22c/0x4e0 [ib_uverbs] ib_umem_get+0x90/0xc0 [ib_uverbs] hns_roce_mtr_create+0x78/0x334 [hns_roce_hw_v2] alloc_mr_pbl+0xe4/0x18c [hns_roce_hw_v2] hns_roce_reg_user_mr+0xf4/0x1a0 [hns_roce_hw_v2] ib_uverbs_reg_mr+0x120/0x2c0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xe4/0x180 [ib_uverbs] ib_uverbs_run_method+0x33c/0x3d4 [ib_uverbs] ib_uverbs_cmd_verbs+0x128/0x1dc [ib_uverbs] ib_uverbs_ioctl+0xfc/0x1d0 [ib_uverbs] __arm64_sys_ioctl+0xb0/0x110 invoke_syscall+0x50/0x134 el0_svc_common.constprop.0+0x10c/0x12c do_el0_svc+0x34/0xe0 el0_svc+0x20/0x30 el0_sync_handler+0xb8/0xc0 el0_sync+0x160/0x180 Code: 91020021 f2402c1f d503201f a8300c02 (a9400c22) ---[ end trace ccd629679fc3e8d1 ]--- To fix this, Use migrate_page_mc_extra to replace migrate_page_copy in __buffer_migrate_page to add mc support for this function. Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/migrate.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/mm/migrate.c b/mm/migrate.c index cf8c05ea821e..0d79382f9697 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -820,6 +820,7 @@ static int __buffer_migrate_page(struct address_space *mapping, struct buffer_head *bh, *head; int rc; int expected_count; + bool copy_done = false; if (!page_has_buffers(page)) return migrate_page(mapping, newpage, page, mode); @@ -860,7 +861,13 @@ static int __buffer_migrate_page(struct address_space *mapping, } } - rc = migrate_page_move_mapping(mapping, newpage, page, 0); + if (IS_ENABLED(CONFIG_ARM64) && IS_ENABLED(CONFIG_ARCH_HAS_COPY_MC) && + (mode != MIGRATE_SYNC_NO_COPY)) { + rc = migrate_page_mc_extra(mapping, newpage, page, mode, 0); + copy_done = true; + } else { + rc = migrate_page_move_mapping(mapping, newpage, page, 0); + } if (rc != MIGRATEPAGE_SUCCESS) goto unlock_buffers; @@ -873,6 +880,9 @@ static int __buffer_migrate_page(struct address_space *mapping, } while (bh != head); + if (copy_done) + goto unlock_buffers; + if (mode != MIGRATE_SYNC_NO_COPY) migrate_page_copy(newpage, page); else -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Radu Rendec <rrendec(a)redhat.com> stable inclusion from stable-v5.10.235 commit e4fde33107351ec33f1a64188612fbc6ca659284 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4K CVE: CVE-2025-21785 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2 ] The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level). Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information") Signed-off-by: Radu Rendec <rrendec(a)redhat.com> Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 0c0cd4d26b87..80a4ab1c43fd 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -96,16 +96,18 @@ static int __populate_cache_leaves(unsigned int cpu) unsigned int level, idx; enum cache_type type; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf = this_cpu_ci->info_list; + struct cacheinfo *infos = this_cpu_ci->info_list; for (idx = 0, level = 1; level <= this_cpu_ci->num_levels && - idx < this_cpu_ci->num_leaves; idx++, level++) { + idx < this_cpu_ci->num_leaves; level++) { type = get_cache_type(level); if (type == CACHE_TYPE_SEPARATE) { - ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); - ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); + if (idx + 1 >= this_cpu_ci->num_leaves) + break; + ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level); + ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level); } else { - ci_leaf_init(this_leaf++, type, level); + ci_leaf_init(&infos[idx++], type, level); } } return 0; -- 2.43.0

2 1

[PATCH OLK-5.10] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Radu Rendec <rrendec(a)redhat.com> [ Upstream commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2 ] The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level). Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information") Signed-off-by: Radu Rendec <rrendec(a)redhat.com> Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 97c42be71338..1510f457b615 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -87,16 +87,18 @@ int populate_cache_leaves(unsigned int cpu) unsigned int level, idx; enum cache_type type; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf = this_cpu_ci->info_list; + struct cacheinfo *infos = this_cpu_ci->info_list; for (idx = 0, level = 1; level <= this_cpu_ci->num_levels && - idx < this_cpu_ci->num_leaves; idx++, level++) { + idx < this_cpu_ci->num_leaves; level++) { type = get_cache_type(level); if (type == CACHE_TYPE_SEPARATE) { - ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); - ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); + if (idx + 1 >= this_cpu_ci->num_leaves) + break; + ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level); + ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level); } else { - ci_leaf_init(this_leaf++, type, level); + ci_leaf_init(&infos[idx++], type, level); } } return 0; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] PM / devfreq: rk3399_dmc: Disable edev on remove()
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Brian Norris <briannorris(a)chromium.org> stable inclusion from stable-v4.19.247 commit 664736e2cc09e504ce58ec61164d029d1f2651bb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6Y5 CVE: CVE-2022-49460 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2fccf9e6050e0e3b8b4cd275d41daf7f7fa22804 ] Otherwise we hit an unablanced enable-count when unbinding the DFI device: [ 1279.659119] ------------[ cut here ]------------ [ 1279.659179] WARNING: CPU: 2 PID: 5638 at drivers/devfreq/devfreq-event.c:360 devfreq_event_remove_edev+0x84/0x8c ... [ 1279.659352] Hardware name: Google Kevin (DT) [ 1279.659363] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO BTYPE=--) [ 1279.659371] pc : devfreq_event_remove_edev+0x84/0x8c [ 1279.659380] lr : devm_devfreq_event_release+0x1c/0x28 ... [ 1279.659571] Call trace: [ 1279.659582] devfreq_event_remove_edev+0x84/0x8c [ 1279.659590] devm_devfreq_event_release+0x1c/0x28 [ 1279.659602] release_nodes+0x1cc/0x244 [ 1279.659611] devres_release_all+0x44/0x60 [ 1279.659621] device_release_driver_internal+0x11c/0x1ac [ 1279.659629] device_driver_detach+0x20/0x2c [ 1279.659641] unbind_store+0x7c/0xb0 [ 1279.659650] drv_attr_store+0x2c/0x40 [ 1279.659663] sysfs_kf_write+0x44/0x58 [ 1279.659672] kernfs_fop_write_iter+0xf4/0x190 [ 1279.659684] vfs_write+0x2b0/0x2e4 [ 1279.659693] ksys_write+0x80/0xec [ 1279.659701] __arm64_sys_write+0x24/0x30 [ 1279.659714] el0_svc_common+0xf0/0x1d8 [ 1279.659724] do_el0_svc_compat+0x28/0x3c [ 1279.659738] el0_svc_compat+0x10/0x1c [ 1279.659746] el0_sync_compat_handler+0xa8/0xcc [ 1279.659758] el0_sync_compat+0x188/0x1c0 [ 1279.659768] ---[ end trace cec200e5094155b4 ]--- Signed-off-by: Brian Norris <briannorris(a)chromium.org> Signed-off-by: Chanwoo Choi <cw00.choi(a)samsung.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/devfreq/rk3399_dmc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/devfreq/rk3399_dmc.c b/drivers/devfreq/rk3399_dmc.c index e795ad2b3f6b..eefda6edc89c 100644 --- a/drivers/devfreq/rk3399_dmc.c +++ b/drivers/devfreq/rk3399_dmc.c @@ -411,6 +411,8 @@ static int rk3399_dmcfreq_remove(struct platform_device *pdev) { struct rk3399_dmcfreq *dmcfreq = dev_get_drvdata(&pdev->dev); + devfreq_event_disable_edev(dmcfreq->edev); + /* * Before remove the opp table we need to unregister the opp notifier. */ -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2024-57976
by Zizhi Wo 28 Mar '25

28 Mar '25

*** BLURB HERE *** Naohiro Aota (1): btrfs: zoned: fix extent range end unlock in cow_file_range() Qu Wenruo (1): btrfs: do proper folio cleanup when cow_file_range() failed fs/btrfs/inode.c | 63 ++++++++++++++++++++++++++---------------------- 1 file changed, 34 insertions(+), 29 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 1/2] btrfs: do proper folio cleanup when cow_file_range() failed
by Zizhi Wo 28 Mar '25

28 Mar '25

From: Qu Wenruo <wqu(a)suse.com> stable inclusion from stable-v6.13.2 commit 692cf71173bb41395c855acbbbe197d3aedfa5d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBJV CVE: CVE-2024-57976 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 06f364284794f149d2abc167c11d556cf20c954b upstream. [BUG] When testing with COW fixup marked as BUG_ON() (this is involved with the new pin_user_pages*() change, which should not result new out-of-band dirty pages), I hit a crash triggered by the BUG_ON() from hitting COW fixup path. This BUG_ON() happens just after a failed btrfs_run_delalloc_range(): BTRFS error (device dm-2): failed to run delalloc range, root 348 ino 405 folio 65536 submit_bitmap 6-15 start 90112 len 106496: -28 ------------[ cut here ]------------ kernel BUG at fs/btrfs/extent_io.c:1444! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 0 UID: 0 PID: 434621 Comm: kworker/u24:8 Tainted: G OE 6.12.0-rc7-custom+ #86 Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs] pc : extent_writepage_io+0x2d4/0x308 [btrfs] lr : extent_writepage_io+0x2d4/0x308 [btrfs] Call trace: extent_writepage_io+0x2d4/0x308 [btrfs] extent_writepage+0x218/0x330 [btrfs] extent_write_cache_pages+0x1d4/0x4b0 [btrfs] btrfs_writepages+0x94/0x150 [btrfs] do_writepages+0x74/0x190 filemap_fdatawrite_wbc+0x88/0xc8 start_delalloc_inodes+0x180/0x3b0 [btrfs] btrfs_start_delalloc_roots+0x174/0x280 [btrfs] shrink_delalloc+0x114/0x280 [btrfs] flush_space+0x250/0x2f8 [btrfs] btrfs_async_reclaim_data_space+0x180/0x228 [btrfs] process_one_work+0x164/0x408 worker_thread+0x25c/0x388 kthread+0x100/0x118 ret_from_fork+0x10/0x20 Code: aa1403e1 9402f3ef aa1403e0 9402f36f (d4210000) ---[ end trace 0000000000000000 ]--- [CAUSE] That failure is mostly from cow_file_range(), where we can hit -ENOSPC. Although the -ENOSPC is already a bug related to our space reservation code, let's just focus on the error handling. For example, we have the following dirty range [0, 64K) of an inode, with 4K sector size and 4K page size: 0 16K 32K 48K 64K |///////////////////////////////////////| |#######################################| Where |///| means page are still dirty, and |###| means the extent io tree has EXTENT_DELALLOC flag. - Enter extent_writepage() for page 0 - Enter btrfs_run_delalloc_range() for range [0, 64K) - Enter cow_file_range() for range [0, 64K) - Function btrfs_reserve_extent() only reserved one 16K extent So we created extent map and ordered extent for range [0, 16K) 0 16K 32K 48K 64K |////////|//////////////////////////////| |<- OE ->|##############################| And range [0, 16K) has its delalloc flag cleared. But since we haven't yet submit any bio, involved 4 pages are still dirty. - Function btrfs_reserve_extent() returns with -ENOSPC Now we have to run error cleanup, which will clear all EXTENT_DELALLOC* flags and clear the dirty flags for the remaining ranges: 0 16K 32K 48K 64K |////////| | | | | Note that range [0, 16K) still has its pages dirty. - Some time later, writeback is triggered again for the range [0, 16K) since the page range still has dirty flags. - btrfs_run_delalloc_range() will do nothing because there is no EXTENT_DELALLOC flag. - extent_writepage_io() finds page 0 has no ordered flag Which falls into the COW fixup path, triggering the BUG_ON(). Unfortunately this error handling bug dates back to the introduction of btrfs. Thankfully with the abuse of COW fixup, at least it won't crash the kernel. [FIX] Instead of immediately unlocking the extent and folios, we keep the extent and folios locked until either erroring out or the whole delalloc range finished. When the whole delalloc range finished without error, we just unlock the whole range with PAGE_SET_ORDERED (and PAGE_UNLOCK for !keep_locked cases), with EXTENT_DELALLOC and EXTENT_LOCKED cleared. And the involved folios will be properly submitted, with their dirty flags cleared during submission. For the error path, it will be a little more complex: - The range with ordered extent allocated (range (1)) We only clear the EXTENT_DELALLOC and EXTENT_LOCKED, as the remaining flags are cleaned up by btrfs_mark_ordered_io_finished()->btrfs_finish_one_ordered(). For folios we finish the IO (clear dirty, start writeback and immediately finish the writeback) and unlock the folios. - The range with reserved extent but no ordered extent (range(2)) - The range we never touched (range(3)) For both range (2) and range(3) the behavior is not changed. Now even if cow_file_range() failed halfway with some successfully reserved extents/ordered extents, we will keep all folios clean, so there will be no future writeback triggered on them. CC: stable(a)vger.kernel.org Fixes: 524272607e88 ("btrfs: Handle delalloc error correctly to avoid ordered extent hang") Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/btrfs/inode.c [Some context conflicts are encountered when adapting: 1. ram_size -> cur_size: 5599f39356c6 ("btrfs: simplify range tracking in cow_file_range()"), just simplify the process and do not affect the logic. 2. There is no lock_extent related code: 0ab540995ae0 ("btrfs: push lock_extent into cow_file_range_inline")\a0766d8f35d8 ("btrfs: push extent lock into cow_file_range"), this is to narrow the scope of lock, but does not affect this patch. 3. extent_clear_unlock_delalloc() missed a parameter named "cached": 6b0a63a4fa31 ("btrfs: add a cached state to extent_clear_unlock_delalloc"), does not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/btrfs/inode.c | 54 ++++++++++++++++++++++++------------------------ 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 71902110c2fe..862cc8703bf0 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -1356,6 +1356,17 @@ static noinline int cow_file_range(struct btrfs_inode *inode, alloc_hint = get_extent_allocation_hint(inode, start, num_bytes); + /* + * We're not doing compressed IO, don't unlock the first page (which + * the caller expects to stay locked), don't clear any dirty bits and + * don't set any writeback bits. + * + * Do set the Ordered (Private2) bit so we know this page was properly + * setup for writepage. + */ + page_ops = (keep_locked ? 0 : PAGE_UNLOCK); + page_ops |= PAGE_SET_ORDERED; + /* * Relocation relies on the relocated extents to have exactly the same * size as the original extents. Normally writeback for relocation data @@ -1456,21 +1467,6 @@ static noinline int cow_file_range(struct btrfs_inode *inode, btrfs_dec_block_group_reservations(fs_info, ins.objectid); - /* - * We're not doing compressed IO, don't unlock the first page - * (which the caller expects to stay locked), don't clear any - * dirty bits and don't set any writeback bits - * - * Do set the Ordered (Private2) bit so we know this page was - * properly setup for writepage. - */ - page_ops = (keep_locked ? 0 : PAGE_UNLOCK); - page_ops |= PAGE_SET_ORDERED; - - extent_clear_unlock_delalloc(inode, start, start + ram_size - 1, - locked_page, - EXTENT_LOCKED | EXTENT_DELALLOC, - page_ops); if (num_bytes < cur_alloc_size) num_bytes = 0; else @@ -1487,6 +1483,8 @@ static noinline int cow_file_range(struct btrfs_inode *inode, if (ret) goto out_unlock; } + extent_clear_unlock_delalloc(inode, orig_start, end, locked_page, + EXTENT_LOCKED | EXTENT_DELALLOC, page_ops); done: if (done_offset) *done_offset = end; @@ -1507,29 +1505,31 @@ static noinline int cow_file_range(struct btrfs_inode *inode, * We process each region below. */ - clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | - EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV; - page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; - /* * For the range (1). We have already instantiated the ordered extents * for this region. They are cleaned up by * btrfs_cleanup_ordered_extents() in e.g, - * btrfs_run_delalloc_range(). EXTENT_LOCKED | EXTENT_DELALLOC are - * already cleared in the above loop. And, EXTENT_DELALLOC_NEW | - * EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV are handled by the cleanup - * function. + * btrfs_run_delalloc_range(). + * EXTENT_DELALLOC_NEW | EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV + * are also handled by the cleanup function. * - * However, in case of @keep_locked, we still need to unlock the pages - * (except @locked_page) to ensure all the pages are unlocked. + * So here we only clear EXTENT_LOCKED and EXTENT_DELALLOC flag, and + * finish the writeback of the involved folios, which will be never submitted. */ - if (keep_locked && orig_start < start) { + if (orig_start < start) { + clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC; + page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; + if (!locked_page) mapping_set_error(inode->vfs_inode.i_mapping, ret); extent_clear_unlock_delalloc(inode, orig_start, start - 1, - locked_page, 0, page_ops); + locked_page, clear_bits, page_ops); } + clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | + EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV; + page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; + /* * For the range (2). If we reserved an extent for our delalloc range * (or a subrange) and failed to create the respective ordered extent, -- 2.39.2

2 3

[openeuler:OLK-5.10] BUILD REGRESSION 8c45ad1b4135b7bbeb7c208ce99391363bd666f7
by kernel test robot 28 Mar '25

28 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 8c45ad1b4135b7bbeb7c208ce99391363bd666f7 !15595 io_uring: prevent opcode speculation Unverified Error/Warning (likely false positive, kindly check if interested): drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.o: warning: objtool: st_lsm6dsx_shub_wait_complete() falls through to next function st_lsm6dsx_shub_read_output() drivers/media/test-drivers/vivid/vivid-kthread-cap.o: warning: objtool: vivid_copy_buffer() falls through to next function scale_line() drivers/media/test-drivers/vivid/vivid-kthread-cap.o: warning: objtool: vivid_thread_vid_cap_tick() falls through to next function plane_vaddr() fs/btrfs/free-space-cache.o: warning: objtool: add_bytes_to_bitmap() falls through to next function tree_insert_offset() fs/btrfs/free-space-tree.o: warning: objtool: update_free_space_extent_count() falls through to next function alloc_bitmap() fs/ufs/balloc.o: warning: objtool: ufs_free_fragments() falls through to next function ufs_clusteracct() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-alldefconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-allnoconfig | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-allnoconfig | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_file_name-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_log-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_HDD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CLEAR_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_ENABLE_MSIX-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_MASK_DISABLE-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_STATUS_EXIST_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_SSD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_mgrq_resend-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_notify-Werror-Wmissing-prototypes | `-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:error:unused-function-ps3_scsih_dev_id_get-Werror-Wunused-function |-- x86_64-buildonly-randconfig-001-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-003-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-004-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-005-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-101-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-media-tuners-e4000.o:warning:objtool:e4000_set_params-falls-through-to-next-function-e4000_standby() | |-- drivers-nvdimm-namespace_devs.o:warning:objtool:size_store-falls-through-to-next-function-nd_namespace_label_update() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:bitmap_clear_bits-falls-through-to-next-function-free_bitmap() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-102-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-103-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-104-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- fs-ufs-ialloc.o:warning:objtool:ufs_new_inode-falls-through-to-next-function-ufs2_init_inodes_chunk() | |-- fs-ufs-inode.o:warning:objtool:ufs_iget-falls-through-to-next-function-ufs_set_inode_ops() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-121-20250326 | |-- drivers-iio-imu-st_lsm6dsx-st_lsm6dsx_shub.o:warning:objtool:st_lsm6dsx_shub_wait_complete-falls-through-to-next-function-st_lsm6dsx_shub_read_output() | |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_copy_buffer-falls-through-to-next-function-scale_line() | |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_thread_vid_cap_tick-falls-through-to-next-function-plane_vaddr() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-tree_insert_offset() | `-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-alloc_bitmap() |-- x86_64-randconfig-121-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-122-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-memcontrol.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__user-buffer | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static `-- x86_64-randconfig-161-20250327 |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- drivers-gpu-drm-bridge-tc358768.o:warning:objtool:tc358768_bridge_pre_enable-falls-through-to-next-function-tc358768_bridge_enable() |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() |-- fs-btrfs-free-space-cache.o:warning:objtool:bitmap_clear_bits-falls-through-to-next-function-free_bitmap() |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() |-- fs-ufs-balloc.o:warning:objtool:ufs_free_fragments-falls-through-to-next-function-ufs_clusteracct() |-- fs-ufs-ialloc.o:warning:objtool:ufs_new_inode-falls-through-to-next-function-ufs2_init_inodes_chunk() |-- fs-ufs-inode.o:warning:objtool:ufs_iget-falls-through-to-next-function-ufs_set_inode_ops() |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- net-ceph-striper.o:warning:objtool:ceph_calc_file_object_mapping-falls-through-to-next-function-ceph_file_to_extents() elapsed time: 1455m configs tested: 17 configs skipped: 128 tested configs: arm64 alldefconfig gcc-14.2.0 arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250327 gcc-5.5.0 arm64 randconfig-002-20250327 clang-21 arm64 randconfig-003-20250327 clang-21 arm64 randconfig-004-20250327 clang-21 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250327 gcc-12 x86_64 buildonly-randconfig-002-20250327 gcc-12 x86_64 buildonly-randconfig-003-20250327 clang-20 x86_64 buildonly-randconfig-004-20250327 clang-20 x86_64 buildonly-randconfig-005-20250327 gcc-12 x86_64 buildonly-randconfig-006-20250327 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1525/1525] drivers/char/svm.c:353:35: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 28 Mar '25

28 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3f8283040b83a49bdad8dc3dd4ccd3f50910af28 commit: b8c0480a3eba11ee6616019a3aaa75ee38f06f02 [1525/1525] svm: serach dts to init children device config: arm64-randconfig-r112-20250328 (https://download.01.org/0day-ci/archive/20250328/202503280904.ByoMg5CF-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250328/202503280904.ByoMg5CF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503280904.ByoMg5CF-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/char/svm.c:353:35: sparse: sparse: Using plain integer as NULL pointer vim +353 drivers/char/svm.c 221 222 static int svm_init_core(struct svm_device *sdev) 223 { 224 int err = 0; 225 struct device *dev = sdev->dev; 226 struct acpi_device *adev = ACPI_COMPANION(sdev->dev); 227 struct acpi_device *cdev = NULL; 228 int id = 0; 229 230 down_write(&svm_sem); 231 if (!svm_bus_type.iommu_ops) { 232 err = bus_register(&svm_bus_type); 233 if (err) { 234 up_write(&svm_sem); 235 dev_err(dev, "failed to register svm_bus_type\n"); 236 return err; 237 } 238 239 err = bus_set_iommu(&svm_bus_type, dev->bus->iommu_ops); 240 if (err) { 241 up_write(&svm_sem); 242 dev_err(dev, "failed to set iommu for svm_bus_type\n"); 243 goto err_unregister_bus; 244 } 245 } else if (svm_bus_type.iommu_ops != dev->bus->iommu_ops) { 246 err = -EBUSY; 247 up_write(&svm_sem); 248 dev_err(dev, "iommu_ops configured, but changed!\n"); 249 goto err_unregister_bus; 250 } 251 up_write(&svm_sem); 252 253 list_for_each_entry(cdev, &adev->children, node) { 254 err = svm_acpi_add_core(sdev, cdev, id++); 255 if (err) 256 device_for_each_child(dev, NULL, svm_remove_core); 257 } 258 259 return err; 260 261 err_unregister_bus: 262 bus_unregister(&svm_bus_type); 263 264 return err; 265 } 266 #else 267 static int svm_of_add_core(struct svm_device *sdev, struct device_node *np) 268 { 269 int err; 270 struct resource res; 271 struct core_device *cdev = NULL; 272 char *name = NULL; 273 274 name = devm_kasprintf(sdev->dev, GFP_KERNEL, "svm%llu_%s", 275 sdev->id, np->name); 276 if (name == NULL) 277 return -ENOMEM; 278 279 cdev = kzalloc(sizeof(*cdev), GFP_KERNEL); 280 if (cdev == NULL) 281 return -ENOMEM; 282 283 cdev->dev.of_node = np; 284 cdev->dev.parent = sdev->dev; 285 cdev->dev.bus = &svm_bus_type; 286 cdev->dev.release = cdev_device_release; 287 cdev->smmu_bypass = of_property_read_bool(np, "hisi,smmu_bypass"); 288 dev_set_name(&cdev->dev, "%s", name); 289 290 err = device_register(&cdev->dev); 291 if (err) { 292 dev_info(&cdev->dev, "core_device register failed\n"); 293 put_device(&cdev->dev); 294 kfree(cdev); 295 return err; 296 } 297 298 err = of_dma_configure(&cdev->dev, np, true); 299 if (err) { 300 dev_dbg(&cdev->dev, "of_dma_configure failed\n"); 301 goto err_unregister_dev; 302 } 303 304 err = of_address_to_resource(np, 0, &res); 305 if (err) { 306 dev_info(&cdev->dev, "no reg, FW should install the sid\n"); 307 } else { 308 /* If the reg specified, install sid for the core */ 309 void __iomem *core_base = NULL; 310 int sid = cdev->dev.iommu_fwspec->ids[0]; 311 312 core_base = ioremap(res.start, resource_size(&res)); 313 if (core_base == NULL) { 314 err = -ENOMEM; 315 dev_err(&cdev->dev, "ioremap failed\n"); 316 goto err_unregister_dev; 317 } 318 319 writel_relaxed(sid, core_base + CORE_SID); 320 iounmap(core_base); 321 } 322 323 /* If core device is smmu bypass, request direct map. */ 324 if (cdev->smmu_bypass) { 325 err = iommu_request_dm_for_dev(&cdev->dev); 326 if (err) 327 goto err_unregister_dev; 328 329 return 0; 330 } 331 332 cdev->group = iommu_group_get(&cdev->dev); 333 if (IS_ERR_OR_NULL(cdev->group)) { 334 err = -ENXIO; 335 dev_err(&cdev->dev, "smmu is not right configured\n"); 336 goto err_unregister_dev; 337 } 338 339 cdev->domain = iommu_domain_alloc(sdev->dev->bus); 340 if (cdev->domain == NULL) { 341 err = -ENOMEM; 342 dev_info(&cdev->dev, "failed to alloc domain\n"); 343 goto err_unregister_dev; 344 } 345 346 err = iommu_attach_group(cdev->domain, cdev->group); 347 if (err) { 348 dev_err(&cdev->dev, "failed group to domain\n"); 349 goto err_free_domain; 350 } 351 352 err = iommu_sva_device_init(&cdev->dev, IOMMU_SVA_FEAT_IOPF, > 353 UINT_MAX, 0); 354 if (err) { 355 dev_err(&cdev->dev, "failed to init sva device\n"); 356 goto err_detach_group; 357 } 358 359 return 0; 360 361 err_detach_group: 362 iommu_detach_group(cdev->domain, cdev->group); 363 err_free_domain: 364 iommu_domain_free(cdev->domain); 365 err_unregister_dev: 366 device_unregister(&cdev->dev); 367 368 return err; 369 } 370 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2063/2063] error: unknown target ABI 'ilp32'
by kernel test robot 28 Mar '25

28 Mar '25

Hi Andrew, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b28aab59b06935f0d1c9bce8f013f25b4094764d commit: f9b54a6714445cde83aeff0318cf767b3b81229d [2063/2063] arm64:ilp32: add ARM64_ILP32 to Kconfig config: arm64-randconfig-r112-20250328 (https://download.01.org/0day-ci/archive/20250328/202503280313.olFyEFIT-lkp@…) compiler: clang version 21.0.0git (https://github.com/llvm/llvm-project c2692afc0a92cd5da140dfcdfff7818a5b8ce997) reproduce: (https://download.01.org/0day-ci/archive/20250328/202503280313.olFyEFIT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503280313.olFyEFIT-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from arch/arm64/kernel/asm-offsets.c:12: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2168: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ 4 warnings generated. arch/arm64/kernel/vdso-ilp32/Makefile:84: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:87: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:90: FORCE prerequisite is missing >> clang: warning: -Wl,-soname=linux-ilp32-vdso.so.1: 'linker' input unused [-Wunused-command-line-argument] >> error: unknown target ABI 'ilp32' >> error: unknown target ABI 'ilp32' make[3]: *** [scripts/Makefile.build:373: arch/arm64/kernel/vdso-ilp32/vdso-ilp32.lds] Error 1 make[3]: *** [arch/arm64/kernel/vdso-ilp32/Makefile:84: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o] Error 1 >> error: error: unknown target ABI 'ilp32' unknown target ABI 'ilp32' make[3]: *** [arch/arm64/kernel/vdso-ilp32/Makefile:87: arch/arm64/kernel/vdso-ilp32/note-ilp32.o] Error 1 make[3]: *** [arch/arm64/kernel/vdso-ilp32/Makefile:90: arch/arm64/kernel/vdso-ilp32/sigreturn-ilp32.o] Error 1 make[3]: Target 'include/generated/vdso-ilp32-offsets.h' not remade because of errors. make[2]: *** [arch/arm64/Makefile:201: vdso_prepare] Error 2 make[2]: Target 'prepare' not remade because of errors. make[1]: *** [Makefile:234: __sub-make] Error 2 make[1]: Target 'prepare' not remade because of errors. make: *** [Makefile:234: __sub-make] Error 2 make: Target 'prepare' not remade because of errors. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2025-21858
by Zhang Changzhong 27 Mar '25

27 Mar '25

Kuniyuki Iwashima (2): geneve: Fix use-after-free in geneve_find_dev(). geneve: Suppress list corruption splat in geneve_destroy_tunnels(). drivers/net/geneve.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) -- 2.9.5

2 3

[openeuler:openEuler-1.0-LTS 1523/1523] fs/.tmp_select.o: warning: objtool: poll_select_finish()+0x1aa: can't find switch jump table
by kernel test robot 27 Mar '25

27 Mar '25

Hi Oleg, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: 44ae3d3e5f1f99c0fd5f040e4da88b0c5b3ec76b [1523/1523] select: shift restore_saved_sigmask_unless() into poll_select_copy_remaining() config: x86_64-buildonly-randconfig-004-20250327 (https://download.01.org/0day-ci/archive/20250327/202503272038.iOCRCuV8-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503272038.iOCRCuV8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503272038.iOCRCuV8-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/.tmp_select.o: warning: objtool: poll_select_finish()+0x1aa: can't find switch jump table -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ARM: versatile: Add missing of_node_put in dcscb_init
by Peng Zhang 27 Mar '25

27 Mar '25

From: Peng Wu <wupeng58(a)huawei.com> stable inclusion from stable-v4.19.247 commit a0fc05cd17617e63fc13ad0c01f3f0afd890d8ec category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP128 CVE: CVE-2022-49457 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------- [ Upstream commit 23b44f9c649bbef10b45fa33080cd8b4166800ae ] The device_node pointer is returned by of_find_compatible_node with refcount incremented. We should use of_node_put() to avoid the refcount leak. Signed-off-by: Peng Wu <wupeng58(a)huawei.com> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Link: https://lore.kernel.org/r/20220428230356.69418-1-linus.walleij@linaro.org' Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- arch/arm/mach-vexpress/dcscb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/mach-vexpress/dcscb.c b/arch/arm/mach-vexpress/dcscb.c index ee2a0faafaa1..aaade91f6551 100644 --- a/arch/arm/mach-vexpress/dcscb.c +++ b/arch/arm/mach-vexpress/dcscb.c @@ -146,6 +146,7 @@ static int __init dcscb_init(void) if (!node) return -ENODEV; dcscb_base = of_iomap(node, 0); + of_node_put(node); if (!dcscb_base) return -EADDRNOTAVAIL; cfg = readl_relaxed(dcscb_base + DCS_CFG_R); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
by Peng Zhang 27 Mar '25

27 Mar '25

From: Dafna Hirschfeld <dafna.hirschfeld(a)collabora.com> stable inclusion from stable-v4.19.238 commit f04a520a422222fc921bf035dc67414c500a286a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3SR CVE: CVE-2022-49247 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------- [ Upstream commit fbe04b49a54e31f4321d632270207f0e6304cd16 ] If the callback 'start_streaming' fails, then all queued buffers in the driver should be returned with state 'VB2_BUF_STATE_QUEUED'. Currently, they are returned with 'VB2_BUF_STATE_ERROR' which is wrong. Fix this. This also fixes the warning: [ 65.583633] WARNING: CPU: 5 PID: 593 at drivers/media/common/videobuf2/videobuf2-core.c:1612 vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.585027] Modules linked in: snd_usb_audio snd_hwdep snd_usbmidi_lib snd_rawmidi snd_soc_hdmi_codec dw_hdmi_i2s_audio saa7115 stk1160 videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc crct10dif_ce panfrost snd_soc_simple_card snd_soc_audio_graph_card snd_soc_spdif_tx snd_soc_simple_card_utils gpu_sched phy_rockchip_pcie snd_soc_rockchip_i2s rockchipdrm analogix_dp dw_mipi_dsi dw_hdmi cec drm_kms_helper drm rtc_rk808 rockchip_saradc industrialio_triggered_buffer kfifo_buf rockchip_thermal pcie_rockchip_host ip_tables x_tables ipv6 [ 65.589383] CPU: 5 PID: 593 Comm: v4l2src0:src Tainted: G W 5.16.0-rc4-62408-g32447129cb30-dirty #14 [ 65.590293] Hardware name: Radxa ROCK Pi 4B (DT) [ 65.590696] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 65.591304] pc : vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.591850] lr : vb2_start_streaming+0x6c/0x160 [videobuf2_common] [ 65.592395] sp : ffff800012bc3ad0 [ 65.592685] x29: ffff800012bc3ad0 x28: 0000000000000000 x27: ffff800012bc3cd8 [ 65.593312] x26: 0000000000000000 x25: ffff00000d8a7800 x24: 0000000040045612 [ 65.593938] x23: ffff800011323000 x22: ffff800012bc3cd8 x21: ffff00000908a8b0 [ 65.594562] x20: ffff00000908a8c8 x19: 00000000fffffff4 x18: ffffffffffffffff [ 65.595188] x17: 000000040044ffff x16: 00400034b5503510 x15: ffff800011323f78 [ 65.595813] x14: ffff000013163886 x13: ffff000013163885 x12: 00000000000002ce [ 65.596439] x11: 0000000000000028 x10: 0000000000000001 x9 : 0000000000000228 [ 65.597064] x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff726c5e78 [ 65.597690] x5 : ffff800012bc3990 x4 : 0000000000000000 x3 : ffff000009a34880 [ 65.598315] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000007cd99f0 [ 65.598940] Call trace: [ 65.599155] vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.599672] vb2_core_streamon+0x17c/0x1a8 [videobuf2_common] [ 65.600179] vb2_streamon+0x54/0x88 [videobuf2_v4l2] [ 65.600619] vb2_ioctl_streamon+0x54/0x60 [videobuf2_v4l2] [ 65.601103] v4l_streamon+0x3c/0x50 [videodev] [ 65.601521] __video_do_ioctl+0x1a4/0x428 [videodev] [ 65.601977] video_usercopy+0x320/0x828 [videodev] [ 65.602419] video_ioctl2+0x3c/0x58 [videodev] [ 65.602830] v4l2_ioctl+0x60/0x90 [videodev] [ 65.603227] __arm64_sys_ioctl+0xa8/0xe0 [ 65.603576] invoke_syscall+0x54/0x118 [ 65.603911] el0_svc_common.constprop.3+0x84/0x100 [ 65.604332] do_el0_svc+0x34/0xa0 [ 65.604625] el0_svc+0x1c/0x50 [ 65.604897] el0t_64_sync_handler+0x88/0xb0 [ 65.605264] el0t_64_sync+0x16c/0x170 [ 65.605587] ---[ end trace 578e0ba07742170d ]--- Fixes: 8ac456495a33d ("[media] stk1160: Stop device and unqueue buffers when start_streaming() fails") Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld(a)collabora.com> Reviewed-by: Ezequiel Garcia <ezequiel(a)vanguardiasur.com.ar> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/media/usb/stk1160/stk1160-core.c | 2 +- drivers/media/usb/stk1160/stk1160-v4l.c | 10 +++++----- drivers/media/usb/stk1160/stk1160.h | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c index 468f5ccf4ae6..685872f8b306 100644 --- a/drivers/media/usb/stk1160/stk1160-core.c +++ b/drivers/media/usb/stk1160/stk1160-core.c @@ -413,7 +413,7 @@ static void stk1160_disconnect(struct usb_interface *interface) /* Here is the only place where isoc get released */ stk1160_uninit_isoc(dev); - stk1160_clear_queue(dev); + stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); video_unregister_device(&dev->vdev); v4l2_device_disconnect(&dev->v4l2_dev); diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c index 504e413edcd2..381f9f189bb7 100644 --- a/drivers/media/usb/stk1160/stk1160-v4l.c +++ b/drivers/media/usb/stk1160/stk1160-v4l.c @@ -269,7 +269,7 @@ static int stk1160_start_streaming(struct stk1160 *dev) stk1160_uninit_isoc(dev); out_stop_hw: usb_set_interface(dev->udev, 0, 0); - stk1160_clear_queue(dev); + stk1160_clear_queue(dev, VB2_BUF_STATE_QUEUED); mutex_unlock(&dev->v4l_lock); @@ -317,7 +317,7 @@ static int stk1160_stop_streaming(struct stk1160 *dev) stk1160_stop_hw(dev); - stk1160_clear_queue(dev); + stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); stk1160_dbg("streaming stopped\n"); @@ -762,7 +762,7 @@ static const struct video_device v4l_template = { /********************************************************************/ /* Must be called with both v4l_lock and vb_queue_lock hold */ -void stk1160_clear_queue(struct stk1160 *dev) +void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state) { struct stk1160_buffer *buf; unsigned long flags; @@ -773,7 +773,7 @@ void stk1160_clear_queue(struct stk1160 *dev) buf = list_first_entry(&dev->avail_bufs, struct stk1160_buffer, list); list_del(&buf->list); - vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); + vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); stk1160_dbg("buffer [%p/%d] aborted\n", buf, buf->vb.vb2_buf.index); } @@ -783,7 +783,7 @@ void stk1160_clear_queue(struct stk1160 *dev) buf = dev->isoc_ctl.buf; dev->isoc_ctl.buf = NULL; - vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); + vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); stk1160_dbg("buffer [%p/%d] aborted\n", buf, buf->vb.vb2_buf.index); } diff --git a/drivers/media/usb/stk1160/stk1160.h b/drivers/media/usb/stk1160/stk1160.h index acd1c811db08..54a046aacd33 100644 --- a/drivers/media/usb/stk1160/stk1160.h +++ b/drivers/media/usb/stk1160/stk1160.h @@ -177,7 +177,7 @@ struct regval { int stk1160_vb2_setup(struct stk1160 *dev); int stk1160_video_register(struct stk1160 *dev); void stk1160_video_unregister(struct stk1160 *dev); -void stk1160_clear_queue(struct stk1160 *dev); +void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state); /* Provided by stk1160-video.c */ int stk1160_alloc_isoc(struct stk1160 *dev); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
by Peng Zhang 27 Mar '25

27 Mar '25

From: Zekun Shen <bruceshenzk(a)gmail.com> stable inclusion from stable-v4.19.238 commit 25efc5d03455c3839249bc77fce5e29ecb54677e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP5YP CVE: CVE-2021-47633 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------- [ Upstream commit 564d4eceb97eaf381dd6ef6470b06377bb50c95a ] The bug was found during fuzzing. Stacktrace locates it in ath5k_eeprom_convert_pcal_info_5111. When none of the curve is selected in the loop, idx can go up to AR5K_EEPROM_N_PD_CURVES. The line makes pd out of bound. pd = &chinfo[pier].pd_curves[idx]; There are many OOB writes using pd later in the code. So I added a sanity check for idx. Checks for other loops involving AR5K_EEPROM_N_PD_CURVES are not needed as the loop index is not used outside the loops. The patch is NOT tested with real device. The following is the fuzzing report BUG: KASAN: slab-out-of-bounds in ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] Write of size 1 at addr ffff8880174a4d60 by task modprobe/214 CPU: 0 PID: 214 Comm: modprobe Not tainted 5.6.0 #1 Call Trace: dump_stack+0x76/0xa0 print_address_description.constprop.0+0x16/0x200 ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] __kasan_report.cold+0x37/0x7c ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] kasan_report+0xe/0x20 ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] ? apic_timer_interrupt+0xa/0x20 ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k] ? ath5k_pci_eeprom_read+0x228/0x3c0 [ath5k] ath5k_eeprom_init+0x2513/0x6290 [ath5k] ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k] ? usleep_range+0xb8/0x100 ? apic_timer_interrupt+0xa/0x20 ? ath5k_eeprom_read_pcal_info_2413+0x2f20/0x2f20 [ath5k] ath5k_hw_init+0xb60/0x1970 [ath5k] ath5k_init_ah+0x6fe/0x2530 [ath5k] ? kasprintf+0xa6/0xe0 ? ath5k_stop+0x140/0x140 [ath5k] ? _dev_notice+0xf6/0xf6 ? apic_timer_interrupt+0xa/0x20 ath5k_pci_probe.cold+0x29a/0x3d6 [ath5k] ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k] ? mutex_lock+0x89/0xd0 ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k] local_pci_probe+0xd3/0x160 pci_device_probe+0x23f/0x3e0 ? pci_device_remove+0x280/0x280 ? pci_device_remove+0x280/0x280 really_probe+0x209/0x5d0 Reported-by: Brendan Dolan-Gavitt <brendandg(a)nyu.edu> Signed-off-by: Zekun Shen <bruceshenzk(a)gmail.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/YckvDdj3mtCkDRIt@a-10-27-26-18.dynapool.vpn.nyu.e… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/net/wireless/ath/ath5k/eeprom.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c index 94d34ee02265..01163b333945 100644 --- a/drivers/net/wireless/ath/ath5k/eeprom.c +++ b/drivers/net/wireless/ath/ath5k/eeprom.c @@ -746,6 +746,9 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode, } } + if (idx == AR5K_EEPROM_N_PD_CURVES) + goto err_out; + ee->ee_pd_gains[mode] = 1; pd = &chinfo[pier].pd_curves[idx]; -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1523/1523] ERROR: "ata_dev_same_device" [drivers/scsi/libsas/libsas.ko] undefined!
by kernel test robot 27 Mar '25

27 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: d856ec500c97835c591ffacc005f514509f1a931 [1523/1523] scsi: libsas: check if the same sata device when flutter config: x86_64-buildonly-randconfig-005-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271838.22rCFdNn-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271838.22rCFdNn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271838.22rCFdNn-lkp@intel.com/ All errors (new ones prefixed by >>): >> ERROR: "ata_dev_same_device" [drivers/scsi/libsas/libsas.ko] undefined! -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1520/1520] arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.
by kernel test robot 27 Mar '25

27 Mar '25

Hi Peter, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: 3acbac72baea337e0ac79801a8ba4b81e3b67014 [1520/1520] x86/speculation: Change FILL_RETURN_BUFFER to work with objtool config: x86_64-randconfig-161-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271858.j6vJ9Bhc-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271858.j6vJ9Bhc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271858.j6vJ9Bhc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1e1: unsupported intra-function call >> arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 V2 0/3] add support DVMBM in HIP12
by Jinqian Yang 27 Mar '25

27 Mar '25

Patch#1 kvm: hisi_virt: fix kernel panic when enable DVMBM in nVHE Patch#2 kvm: hisi_virt: Update TLBI broadcast feature for hip12 Patch#3 KVM: arm64: Add new HiSi CPU type to support DVMBM Xiang Chen (1): kvm: hisi_virt: Update TLBI broadcast feature for hip12 yangjinqian (2): kvm: hisi_virt: fix kernel panic when enable DVMBM in nVHE KVM: arm64: Add new HiSi CPU type to support DVMBM arch/arm64/kvm/hisilicon/hisi_virt.c | 72 ++++++++++++++++++++++++++-- arch/arm64/kvm/hisilicon/hisi_virt.h | 8 ++++ 2 files changed, 76 insertions(+), 4 deletions(-) -- 2.33.0

2 4

[openeuler:openEuler-1.0-LTS 1523/1523] drivers/edac/skx_common.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 27 Mar '25

27 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: e34047f6dc606c123911c6db8fa424bb4a035262 [1523/1523] EDAC, skx_edac: Delete duplicated code config: x86_64-buildonly-randconfig-002-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271455.zeSbmwpC-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271455.zeSbmwpC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271455.zeSbmwpC-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/edac/skx_common.c: In function 'skx_mce_output_error': drivers/edac/skx_common.c:470:15: warning: variable 'type' set but not used [-Wunused-but-set-variable] 470 | char *type, *optype; | ^~~~ >> drivers/edac/skx_common.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
by Qi Xi 27 Mar '25

27 Mar '25

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> mainline inclusion from mainline-v6.14-rc1 commit 301c26a018acb94dd537a4418cefa0f654500c6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRED3 CVE: CVE-2024-58077 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc_pcm_ret(). It is used from many functions, ignoring -EINVAL is over-kill. The reason why -EINVAL was ignored was it really should only be used upon invalid parameters coming from userspace and in that case we don't want to log an error since we do not want to give userspace a way to do a denial-of-service attack on the syslog / diskspace. So don't use soc_pcm_ret() on .prepare callback is better idea. Link: https://lore.kernel.org/r/87v7vptzap.wl-kuninori.morimoto.gx@renesas.com Cc: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Link: https://patch.msgid.link/87bjxg8jju.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- sound/soc/soc-pcm.c | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 511446a30c05..60248a6820aa 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -38,7 +38,6 @@ static inline int _soc_pcm_ret(struct snd_soc_pcm_runtime *rtd, switch (ret) { case -EPROBE_DEFER: case -ENOTSUPP: - case -EINVAL: break; default: dev_err(rtd->dev, @@ -902,7 +901,13 @@ static int __soc_pcm_prepare(struct snd_soc_pcm_runtime *rtd, } out: - return soc_pcm_ret(rtd, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } /* PCM prepare ops for non-DPCM streams */ @@ -914,6 +919,13 @@ static int soc_pcm_prepare(struct snd_pcm_substream *substream) snd_soc_dpcm_mutex_lock(rtd); ret = __soc_pcm_prepare(rtd, substream); snd_soc_dpcm_mutex_unlock(rtd); + + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ return ret; } @@ -2461,7 +2473,13 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) be->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE; } - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) @@ -2501,7 +2519,13 @@ static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO); snd_soc_dpcm_mutex_unlock(fe); - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_run_update_shutdown(struct snd_soc_pcm_runtime *fe, int stream) -- 2.33.0

2 1

[openeuler:openEuler-1.0-LTS 1523/1523] net/netfilter/nft_nat.c:165:23: warning: 'alen' may be used uninitialized in this function
by kernel test robot 27 Mar '25

27 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: 1a53a31cdd778dfc49a1bf495394238cb9de9bef [1523/1523] netfilter: nft_nat: allow to specify layer 4 protocol NAT only config: arm64-randconfig-004-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271418.7nn4LU8p-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271418.7nn4LU8p-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271418.7nn4LU8p-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): net/netfilter/nft_nat.c: In function 'nft_nat_init': >> net/netfilter/nft_nat.c:165:23: warning: 'alen' may be used uninitialized in this function [-Wmaybe-uninitialized] 165 | err = nft_validate_register_load(priv->sreg_addr_min, alen); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/alen +165 net/netfilter/nft_nat.c 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 116 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 117 static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 118 const struct nlattr * const tb[]) 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 119 { 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 120 struct nft_nat *priv = nft_expr_priv(expr); d07db9884a5fba Patrick McHardy 2015-04-11 121 unsigned int alen, plen; 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 122 u32 family; 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 123 int err; 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 124 5c819a39753d6a Pablo Neira Ayuso 2014-10-16 125 if (tb[NFTA_NAT_TYPE] == NULL || 5c819a39753d6a Pablo Neira Ayuso 2014-10-16 126 (tb[NFTA_NAT_REG_ADDR_MIN] == NULL && 5c819a39753d6a Pablo Neira Ayuso 2014-10-16 127 tb[NFTA_NAT_REG_PROTO_MIN] == NULL)) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 128 return -EINVAL; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 129 eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 130 switch (ntohl(nla_get_be32(tb[NFTA_NAT_TYPE]))) { eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 131 case NFT_NAT_SNAT: eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 132 priv->type = NF_NAT_MANIP_SRC; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 133 break; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 134 case NFT_NAT_DNAT: eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 135 priv->type = NF_NAT_MANIP_DST; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 136 break; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 137 default: cc8272882c3dad Pablo Neira Ayuso 2020-09-22 138 return -EOPNOTSUPP; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 139 } eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 140 eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 141 if (tb[NFTA_NAT_FAMILY] == NULL) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 142 return -EINVAL; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 143 a4c2e8beba8432 Patrick McHardy 2014-03-07 144 family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY])); 36596dadf54a92 Pablo Neira Ayuso 2018-01-09 145 if (family != ctx->family) a4c2e8beba8432 Patrick McHardy 2014-03-07 146 return -EOPNOTSUPP; d07db9884a5fba Patrick McHardy 2015-04-11 147 d07db9884a5fba Patrick McHardy 2015-04-11 148 switch (family) { d07db9884a5fba Patrick McHardy 2015-04-11 149 case NFPROTO_IPV4: d07db9884a5fba Patrick McHardy 2015-04-11 150 alen = FIELD_SIZEOF(struct nf_nat_range, min_addr.ip); d07db9884a5fba Patrick McHardy 2015-04-11 151 break; d07db9884a5fba Patrick McHardy 2015-04-11 152 case NFPROTO_IPV6: d07db9884a5fba Patrick McHardy 2015-04-11 153 alen = FIELD_SIZEOF(struct nf_nat_range, min_addr.ip6); d07db9884a5fba Patrick McHardy 2015-04-11 154 break; d07db9884a5fba Patrick McHardy 2015-04-11 155 default: 1a53a31cdd778d Pablo Neira Ayuso 2021-10-25 156 if (tb[NFTA_NAT_REG_ADDR_MIN]) d07db9884a5fba Patrick McHardy 2015-04-11 157 return -EAFNOSUPPORT; 1a53a31cdd778d Pablo Neira Ayuso 2021-10-25 158 break; d07db9884a5fba Patrick McHardy 2015-04-11 159 } a4c2e8beba8432 Patrick McHardy 2014-03-07 160 priv->family = family; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 161 eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 162 if (tb[NFTA_NAT_REG_ADDR_MIN]) { 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 163 priv->sreg_addr_min = b1c96ed37ceeef Patrick McHardy 2015-04-11 164 nft_parse_register(tb[NFTA_NAT_REG_ADDR_MIN]); d07db9884a5fba Patrick McHardy 2015-04-11 @165 err = nft_validate_register_load(priv->sreg_addr_min, alen); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 166 if (err < 0) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 167 return err; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 168 eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 169 if (tb[NFTA_NAT_REG_ADDR_MAX]) { 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 170 priv->sreg_addr_max = b1c96ed37ceeef Patrick McHardy 2015-04-11 171 nft_parse_register(tb[NFTA_NAT_REG_ADDR_MAX]); 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 172 d07db9884a5fba Patrick McHardy 2015-04-11 173 err = nft_validate_register_load(priv->sreg_addr_max, d07db9884a5fba Patrick McHardy 2015-04-11 174 alen); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 175 if (err < 0) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 176 return err; 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 177 } else { eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 178 priv->sreg_addr_max = priv->sreg_addr_min; 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 179 } 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 180 } eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 181 d07db9884a5fba Patrick McHardy 2015-04-11 182 plen = FIELD_SIZEOF(struct nf_nat_range, min_addr.all); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 183 if (tb[NFTA_NAT_REG_PROTO_MIN]) { 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 184 priv->sreg_proto_min = b1c96ed37ceeef Patrick McHardy 2015-04-11 185 nft_parse_register(tb[NFTA_NAT_REG_PROTO_MIN]); 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 186 d07db9884a5fba Patrick McHardy 2015-04-11 187 err = nft_validate_register_load(priv->sreg_proto_min, plen); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 188 if (err < 0) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 189 return err; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 190 eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 191 if (tb[NFTA_NAT_REG_PROTO_MAX]) { 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 192 priv->sreg_proto_max = b1c96ed37ceeef Patrick McHardy 2015-04-11 193 nft_parse_register(tb[NFTA_NAT_REG_PROTO_MAX]); 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 194 d07db9884a5fba Patrick McHardy 2015-04-11 195 err = nft_validate_register_load(priv->sreg_proto_max, d07db9884a5fba Patrick McHardy 2015-04-11 196 plen); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 197 if (err < 0) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 198 return err; 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 199 } else { eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 200 priv->sreg_proto_max = priv->sreg_proto_min; 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 201 } 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 202 } eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 203 e42eff8a32f8b7 Arturo Borrero 2014-09-04 204 if (tb[NFTA_NAT_FLAGS]) { e42eff8a32f8b7 Arturo Borrero 2014-09-04 205 priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS])); e42eff8a32f8b7 Arturo Borrero 2014-09-04 206 if (priv->flags & ~NF_NAT_RANGE_MASK) cc8272882c3dad Pablo Neira Ayuso 2020-09-22 207 return -EOPNOTSUPP; e42eff8a32f8b7 Arturo Borrero 2014-09-04 208 } e42eff8a32f8b7 Arturo Borrero 2014-09-04 209 20afd423976ef3 Florian Westphal 2016-11-15 210 return nf_ct_netns_get(ctx->net, family); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 211 } eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 212 :::::: The code at line 165 was first introduced by commit :::::: d07db9884a5fba8c8020166c86183c79a18d066a netfilter: nf_tables: introduce nft_validate_register_load() :::::: TO: Patrick McHardy <kaber(a)trash.net> :::::: CC: Pablo Neira Ayuso <pablo(a)netfilter.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1523/1523] include/asm-generic/atomic-instrumented.h:33:9: warning: 'wait_req' may be used uninitialized
by kernel test robot 27 Mar '25

27 Mar '25

Hi Ryusuke, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: 6741506ca02825b90e77088e8fce01c3d02edfdd [1523/1523] nilfs2: fix unexpected freezing of nilfs_segctor_sync() config: x86_64-buildonly-randconfig-001-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271341.WPxyfHvo-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271341.WPxyfHvo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271341.WPxyfHvo-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from arch/x86/include/asm/atomic.h:265, from include/linux/atomic.h:7, from arch/x86/include/asm/thread_info.h:54, from include/linux/thread_bits.h:22, from include/linux/thread_info.h:14, from arch/x86/include/asm/preempt.h:7, from include/linux/preempt.h:81, from include/linux/spinlock.h:51, from include/linux/mmzone.h:9, from include/linux/gfp.h:6, from include/linux/mm.h:11, from include/linux/pagemap.h:8, from fs/nilfs2/segment.c:11: In function 'atomic_set', inlined from 'nilfs_segctor_sync' at fs/nilfs2/segment.c:2175:2: >> include/asm-generic/atomic-instrumented.h:33:9: warning: 'wait_req' may be used uninitialized [-Wmaybe-uninitialized] 33 | kasan_check_write(v, sizeof(*v)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:265, from include/asm-generic/bug.h:5, from arch/x86/include/asm/bug.h:83, from include/linux/bug.h:5, from include/linux/mmdebug.h:5, from include/linux/mm.h:10: include/linux/kasan-checks.h: In function 'nilfs_segctor_sync': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ fs/nilfs2/segment.c:2170:43: note: 'wait_req' declared here 2170 | struct nilfs_segctor_wait_request wait_req; | ^~~~~~~~ vim +/wait_req +33 include/asm-generic/atomic-instrumented.h b06ed71a624ba0 Dmitry Vyukov 2018-01-29 30 b06ed71a624ba0 Dmitry Vyukov 2018-01-29 31 static __always_inline void atomic_set(atomic_t *v, int i) b06ed71a624ba0 Dmitry Vyukov 2018-01-29 32 { a35353bb9eb199 Dmitry Vyukov 2018-01-29 @33 kasan_check_write(v, sizeof(*v)); b06ed71a624ba0 Dmitry Vyukov 2018-01-29 34 arch_atomic_set(v, i); b06ed71a624ba0 Dmitry Vyukov 2018-01-29 35 } b06ed71a624ba0 Dmitry Vyukov 2018-01-29 36 :::::: The code at line 33 was first introduced by commit :::::: a35353bb9eb1990a44a0d7585f99e9589bcdb682 locking/atomic, asm-generic: Add KASAN instrumentation to atomic operations :::::: TO: Dmitry Vyukov <dvyukov(a)google.com> :::::: CC: Ingo Molnar <mingo(a)kernel.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] cifs: Revert two patches to prevent statistics leakage on the lo device.
by Wang Zhaolong 26 Mar '25

26 Mar '25

Wang Zhaolong (2): Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" Revert "smb: client: fix TCP timers deadlock after rmmod" fs/cifs/connect.c | 33 +++++++++------------------------ 1 file changed, 9 insertions(+), 24 deletions(-) -- 2.39.2

2 3

[openeuler:OLK-5.10] BUILD REGRESSION 0d616a77cb5f7198cca524a24f717f59ad51b41b
by kernel test robot 26 Mar '25

26 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 0d616a77cb5f7198cca524a24f717f59ad51b41b !15379 bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503252017.UYNRpRjt-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503252115.VoLdAs0Z-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503260202.467f83vo-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503260613.Q2n0VF4Y-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503260949.1ZCW1y7H-lkp@intel.com arch/x86/kernel/paravirt.c:68:1: error: control reaches end of non-void function [-Werror=return-type] block/bio.o: warning: objtool: bvec_alloc()+0xf5: unreachable instruction drivers/media/pci/intel/ipu3/ipu3-cio2.o: warning: objtool: cio2_subdev_get_fmt()+0x8a: unreachable instruction drivers/pci/endpoint/functions/pci-epf-test.o: warning: objtool: pci_epf_test_cmd_handler()+0x429: unreachable instruction io_uring/io_uring.o: warning: objtool: __io_uring_free()+0x69: unreachable instruction kernel/rcu/tree.o: warning: objtool: rcu_iw_handler()+0x9e: unreachable instruction mm/slab_common.o: warning: objtool: kmalloc_slab()+0x63: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-001-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-003-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-allnoconfig | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_file_name-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_log-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_HDD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CLEAR_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_ENABLE_MSIX-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_MASK_DISABLE-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_STATUS_EXIST_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_SSD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_mgrq_resend-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_notify-Werror-Wmissing-prototypes | `-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:error:unused-function-ps3_scsih_dev_id_get-Werror-Wunused-function |-- x86_64-buildonly-randconfig-001-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-002-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-003-20250325 | |-- arch-x86-kernel-paravirt.c:error:control-reaches-end-of-non-void-function | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-005-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-bio.o:warning:objtool:bvec_alloc:unreachable-instruction | |-- drivers-media-pci-intel-ipu3-ipu3-cio2.o:warning:objtool:cio2_subdev_get_fmt:unreachable-instruction | |-- drivers-pci-endpoint-functions-pci-epf-test.o:warning:objtool:pci_epf_test_cmd_handler:unreachable-instruction | |-- io_uring-io_uring.o:warning:objtool:__io_uring_free:unreachable-instruction | |-- kernel-rcu-tree.o:warning:objtool:rcu_iw_handler:unreachable-instruction | |-- kernel-rcu-update.o:warning:objtool:synchronize_rcu_tasks_rude:unreachable-instruction | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- mm-slab_common.o:warning:objtool:kmalloc_slab:unreachable-instruction |-- x86_64-buildonly-randconfig-006-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-102-20250326 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-121-20250326 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-media-tuners-e4000.o:warning:objtool:e4000_set_params-falls-through-to-next-function-e4000_standby() | |-- drivers-mtd-nand-raw-cadence-nand-controller.o:warning:objtool:cadence_nand_setup_interface-falls-through-to-next-function-cadence_nand_read_page() | |-- drivers-net-virtio_net.o:warning:objtool:virtnet_set_affinity-falls-through-to-next-function-virtnet_clean_affinity() | |-- drivers-nvdimm-namespace_devs.o:warning:objtool:size_store-falls-through-to-next-function-nd_namespace_label_update() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- mm-vmscan.o:warning:objtool:do_shrink_slab-falls-through-to-next-function-allow_direct_reclaim() |-- x86_64-randconfig-122-20250326 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20250325 | `-- net-core-sock_map.c:sparse:sparse:symbol-sock_map_prog_lookup-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20250326 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static `-- x86_64-randconfig-161-20250325 `-- mm-memcontrol.c-uncharge_page()-error:uninitialized-symbol-objcg-. elapsed time: 1462m configs tested: 16 configs skipped: 128 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250325 gcc-9.5.0 arm64 randconfig-002-20250325 clang-18 arm64 randconfig-003-20250325 gcc-7.5.0 arm64 randconfig-004-20250325 clang-20 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250325 gcc-12 x86_64 buildonly-randconfig-002-20250325 clang-20 x86_64 buildonly-randconfig-003-20250325 gcc-12 x86_64 buildonly-randconfig-004-20250325 gcc-12 x86_64 buildonly-randconfig-005-20250325 clang-20 x86_64 buildonly-randconfig-006-20250325 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
by Gu Bowen 26 Mar '25

26 Mar '25

From: Pavel Skripkin <paskripkin(a)gmail.com> stable inclusion from stable-v4.19.247 commit a3660e06675bccec4bf149c7229ea1d491ba10d7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6VC CVE: CVE-2022-49478 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 471bec68457aaf981add77b4f590d65dd7da1059 ] Syzbot reported that -1 is used as array index. The problem was in missing validation check. hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that. hdw->workpoll initialization moved upper to prevent warning in __flush_work. Reported-and-tested-by: syzbot+1a247e36149ffd709a9b(a)syzkaller.appspotmail.com Fixes: d855497edbfb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18") Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c index fcb201a40920..3fb2cfe583e8 100644 --- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c @@ -2561,6 +2561,11 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf, } while (0); mutex_unlock(&pvr2_unit_mtx); + INIT_WORK(&hdw->workpoll, pvr2_hdw_worker_poll); + + if (hdw->unit_number == -1) + goto fail; + cnt1 = 0; cnt2 = scnprintf(hdw->name+cnt1,sizeof(hdw->name)-cnt1,"pvrusb2"); cnt1 += cnt2; @@ -2572,8 +2577,6 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf, if (cnt1 >= sizeof(hdw->name)) cnt1 = sizeof(hdw->name)-1; hdw->name[cnt1] = 0; - INIT_WORK(&hdw->workpoll,pvr2_hdw_worker_poll); - pvr2_trace(PVR2_TRACE_INIT,"Driver unit number is %d, name is %s", hdw->unit_number,hdw->name); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] tty: goldfish: Fix free_irq() on remove
by Gu Bowen 26 Mar '25

26 Mar '25

From: Vincent Whitchurch <vincent.whitchurch(a)axis.com> stable inclusion from stable-v4.19.249 commit c83a1d40dc624070a203eb383ef9fb60eb634136 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP33Y CVE: CVE-2022-49724 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 499e13aac6c762e1e828172b0f0f5275651d6512 ] Pass the correct dev_id to free_irq() to fix this splat when the driver is unbound: WARNING: CPU: 0 PID: 30 at kernel/irq/manage.c:1895 free_irq Trying to free already-free IRQ 65 Call Trace: warn_slowpath_fmt free_irq goldfish_tty_remove platform_remove device_remove device_release_driver_internal device_driver_detach unbind_store drv_attr_store ... Fixes: 465893e18878e119 ("tty: goldfish: support platform_device with id -1") Signed-off-by: Vincent Whitchurch <vincent.whitchurch(a)axis.com> Link: https://lore.kernel.org/r/20220609141704.1080024-1-vincent.whitchurch@axis.… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/tty/goldfish.c [Context conflicts.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/goldfish.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c index ed0f3a7b8fe5..48ea55beaf43 100644 --- a/drivers/tty/goldfish.c +++ b/drivers/tty/goldfish.c @@ -427,7 +427,7 @@ static int goldfish_tty_remove(struct platform_device *pdev) tty_unregister_device(goldfish_tty_driver, qtty->console.index); iounmap(qtty->base); qtty->base = NULL; - free_irq(qtty->irq, pdev); + free_irq(qtty->irq, qtty); goldfish_tty_current_line_count--; if (goldfish_tty_current_line_count == 0) goldfish_tty_delete_driver(); -- 2.25.1

2 1

[PATCH OLK-5.10 0/3] bpf: unify array->elem_size usage in arraymap.c and add inner_array_lookup.c selftest
by Xiaomeng Zhang 26 Mar '25

26 Mar '25

Andrii Nakryiko (1): bpf: make uniform use of array->elem_size everywhere in arraymap.c Rhys Rustad-Elliott (2): bpf: Fix elem_size not being set for inner maps selftests/bpf: Add access_inner_map selftest kernel/bpf/arraymap.c | 14 +++--- kernel/bpf/map_in_map.c | 8 +++- .../bpf/prog_tests/inner_array_lookup.c | 31 +++++++++++++ .../selftests/bpf/progs/inner_array_lookup.c | 45 +++++++++++++++++++ 4 files changed, 90 insertions(+), 8 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c create mode 100644 tools/testing/selftests/bpf/progs/inner_array_lookup.c -- 2.34.1

2 4

[PATCH] arm64_mpam: Add prefetch option
by Zeng Heng 26 Mar '25

26 Mar '25

Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/include/asm/mpam.h | 15 +++++ arch/arm64/include/asm/thread_info.h | 4 ++ fs/resctrl/internal.h | 1 + fs/resctrl/rdtgroup.c | 84 ++++++++++++++++++++++++++++ 4 files changed, 104 insertions(+) diff --git a/arch/arm64/include/asm/mpam.h b/arch/arm64/include/asm/mpam.h index 9abe1fe58c34..ac7b6250250c 100644 --- a/arch/arm64/include/asm/mpam.h +++ b/arch/arm64/include/asm/mpam.h @@ -143,16 +143,31 @@ static inline void resctrl_arch_set_rmid(struct task_struct *tsk, u32 rmid) #endif } +#define setbit(x, y) (x |= (1<<y)) +#define clrbit(x, y) (x &= ~(1<<y)) + static inline void mpam_thread_switch(struct task_struct *tsk) { u64 oldregval; int cpu = smp_processor_id(); u64 regval = mpam_get_regval(tsk); + u64 val, val1; if (!IS_ENABLED(CONFIG_ARM64_MPAM) || !static_branch_likely(&mpam_enabled)) return; + asm volatile("mrs %0, S3_1_c15_c6_4" : "=r" (val)); + val1 = val; + + if (task_thread_info(tsk)->prefetch_dis) + setbit(val1, 0); + else + clrbit(val1, 0); + + if (val1 != val) + asm volatile("msr S3_1_c15_c6_4, %0" : : "r"(val1)); + if (regval == READ_ONCE(mpam_resctrl_default_group)) regval = READ_ONCE(per_cpu(arm64_mpam_default, cpu)); diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h index 379d24059f5b..a996caebb08e 100644 --- a/arch/arm64/include/asm/thread_info.h +++ b/arch/arm64/include/asm/thread_info.h @@ -48,7 +48,11 @@ struct thread_info { #endif u32 cpu; +#ifdef CONFIG_ARM64_MPAM + KABI_USE(1, u32 prefetch_dis) +#else KABI_RESERVE(1) +#endif KABI_RESERVE(2) }; diff --git a/fs/resctrl/internal.h b/fs/resctrl/internal.h index fb620beba958..fbc76efa06d9 100644 --- a/fs/resctrl/internal.h +++ b/fs/resctrl/internal.h @@ -173,6 +173,7 @@ struct rdtgroup { struct mongroup mon; enum rdtgrp_mode mode; struct pseudo_lock_region *plr; + u32 prefetch_dis; }; /* List of all resource groups */ diff --git a/fs/resctrl/rdtgroup.c b/fs/resctrl/rdtgroup.c index 9776b4e2834c..bdf75b75b695 100644 --- a/fs/resctrl/rdtgroup.c +++ b/fs/resctrl/rdtgroup.c @@ -822,6 +822,80 @@ static int rdtgroup_tasks_show(struct kernfs_open_file *of, return ret; } +#ifdef CONFIG_ARM64_MPAM +static void update_prefetch_tasks(struct rdtgroup *r, u32 prefetch_dis) +{ + struct task_struct *p, *t; + + rcu_read_lock(); + + for_each_process_thread(p, t) { + if (is_closid_match(t, r) || is_rmid_match(t, r)) { + WRITE_ONCE(task_thread_info(t)->prefetch_dis, prefetch_dis); + /* Update task_struct and will send IPI to target cpu */ + smp_mb(); + update_task_closid_rmid(t); + } + } + + rcu_read_unlock(); +} + +static ssize_t rdtgroup_prefetch_write(struct kernfs_open_file *of, + char *buf, size_t nbytes, loff_t off) +{ + struct rdtgroup *rdtgrp; + int ret = 0; + u32 prefetch_dis; + + rdtgrp = rdtgroup_kn_lock_live(of->kn); + if (!rdtgrp) { + rdtgroup_kn_unlock(of->kn); + return -ENOENT; + } + rdt_last_cmd_clear(); + + if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED || + rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) { + ret = -EINVAL; + rdt_last_cmd_puts("Pseudo-locking in progress\n"); + goto unlock; + } + + if (kstrtou32(buf, 0, &prefetch_dis)) { + rdt_last_cmd_printf("Task list parsing error prefetch %s\n", buf); + ret = -EINVAL; + goto unlock; + } + + if (rdtgrp->prefetch_dis != prefetch_dis) { + rdtgrp->prefetch_dis = prefetch_dis; + update_prefetch_tasks(rdtgrp, prefetch_dis); + } + +unlock: + rdtgroup_kn_unlock(of->kn); + + return ret ?: nbytes; +} + +static int rdtgroup_prefetch_show(struct kernfs_open_file *of, + struct seq_file *s, void *v) +{ + struct rdtgroup *rdtgrp; + int ret = 0; + + rdtgrp = rdtgroup_kn_lock_live(of->kn); + if (rdtgrp) + seq_printf(s, "%u\n", rdtgrp->prefetch_dis); + else + ret = -ENOENT; + rdtgroup_kn_unlock(of->kn); + + return ret; +} +#endif + static int rdtgroup_closid_show(struct kernfs_open_file *of, struct seq_file *s, void *v) { @@ -1891,6 +1965,16 @@ static struct rftype res_common_files[] = { .seq_show = rdtgroup_tasks_show, .fflags = RFTYPE_BASE, }, +#ifdef CONFIG_ARM64_MPAM + { + .name = "prefetch_dis", + .mode = 0644, + .kf_ops = &rdtgroup_kf_single_ops, + .write = rdtgroup_prefetch_write, + .seq_show = rdtgroup_prefetch_show, + .fflags = RFTYPE_BASE, + }, +#endif { .name = "mon_hw_id", .mode = 0444, -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] media: uvcvideo: Remove dangling pointers
by Zhao Yipeng 26 Mar '25

26 Mar '25

From: Ricardo Ribalda <ribalda(a)chromium.org> mainline inclusion from mainline-v6.14-rc1 commit 221cd51efe4565501a3dbf04cc011b537dcce7fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8W CVE: CVE-2024-58002 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the device is done. Which could be anytime in the future. If the user closes that file descriptor, its structure will be freed, and there will be one dangling pointer per pending async control, that the driver will try to use. Clean all the dangling pointers during release(). To avoid adding a performance penalty in the most common case (no async operation), a counter has been introduced with some logic to make sure that it is properly handled. Cc: stable(a)vger.kernel.org Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives") Reviewed-by: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Link: https://lore.kernel.org/r/20241203-uvc-fix-async-v6-3-26c867231118@chromium… Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Conflicts: drivers/media/usb/uvc/uvc_ctrl.c drivers/media/usb/uvc/uvc_v4l2.c drivers/media/usb/uvc/uvcvideo.h [The guard() function is not introduced. 'for' loop initial declaration are only allowed in C99 or C11 mode. And other conflicts are contextual due to the commits d9fecd096f67, 9e56380ae625 and d9c8763e6129 not being merged.] Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- drivers/media/usb/uvc/uvc_ctrl.c | 64 +++++++++++++++++++++++++++++++- drivers/media/usb/uvc/uvc_v4l2.c | 2 + drivers/media/usb/uvc/uvcvideo.h | 9 ++++- 3 files changed, 72 insertions(+), 3 deletions(-) diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index f2854337cdca..fc02bbcd6245 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -1276,6 +1276,40 @@ static void uvc_ctrl_send_slave_event(struct uvc_video_chain *chain, uvc_ctrl_send_event(chain, handle, ctrl, mapping, val, changes); } +static void uvc_ctrl_set_handle(struct uvc_fh *handle, struct uvc_control *ctrl, + struct uvc_fh *new_handle) +{ + lockdep_assert_held(&handle->chain->ctrl_mutex); + + if (new_handle) { + if (ctrl->handle) + dev_warn_ratelimited(&handle->stream->dev->udev->dev, + "UVC non compliance: Setting an async control with a pending operation."); + + if (new_handle == ctrl->handle) + return; + + if (ctrl->handle) { + WARN_ON(!ctrl->handle->pending_async_ctrls); + if (ctrl->handle->pending_async_ctrls) + ctrl->handle->pending_async_ctrls--; + } + + ctrl->handle = new_handle; + handle->pending_async_ctrls++; + return; + } + + /* Cannot clear the handle for a control not owned by us.*/ + if (WARN_ON(ctrl->handle != handle)) + return; + + ctrl->handle = NULL; + if (WARN_ON(!handle->pending_async_ctrls)) + return; + handle->pending_async_ctrls--; +} + static void uvc_ctrl_status_event_work(struct work_struct *work) { struct uvc_device *dev = container_of(work, struct uvc_device, @@ -1291,7 +1325,8 @@ static void uvc_ctrl_status_event_work(struct work_struct *work) mutex_lock(&chain->ctrl_mutex); handle = ctrl->handle; - ctrl->handle = NULL; + if (handle) + uvc_ctrl_set_handle(handle, ctrl, NULL); list_for_each_entry(mapping, &ctrl->info.mappings, list) { s32 value = __uvc_ctrl_get_value(mapping, w->data); @@ -1684,7 +1719,7 @@ int uvc_ctrl_set(struct uvc_fh *handle, uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT)); if (ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS) - ctrl->handle = handle; + uvc_ctrl_set_handle(handle, ctrl, handle); ctrl->dirty = 1; ctrl->modified = 1; @@ -2330,6 +2365,31 @@ int uvc_ctrl_init_device(struct uvc_device *dev) return 0; } +void uvc_ctrl_cleanup_fh(struct uvc_fh *handle) +{ + struct uvc_entity *entity; + + mutex_lock(&handle->chain->ctrl_mutex); + + if (!handle->pending_async_ctrls) { + mutex_unlock(&handle->chain->ctrl_mutex); + return; + } + + list_for_each_entry(entity, &handle->chain->dev->entities, list) { + unsigned int i; + + for (i = 0; i < entity->ncontrols; ++i) { + if (entity->controls[i].handle != handle) + continue; + uvc_ctrl_set_handle(handle, &entity->controls[i], NULL); + } + } + + WARN_ON(handle->pending_async_ctrls); + mutex_unlock(&handle->chain->ctrl_mutex); +} + /* * Cleanup device controls. */ diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index 18a7384b50ee..34b9843cec3a 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -563,6 +563,8 @@ static int uvc_v4l2_release(struct file *file) uvc_trace(UVC_TRACE_CALLS, "uvc_v4l2_release\n"); + uvc_ctrl_cleanup_fh(handle); + /* Only free resources if this is a privileged handle. */ if (uvc_has_privileges(handle)) uvc_queue_release(&stream->queue); diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h index a738486fd9d6..243caeb4a6d7 100644 --- a/drivers/media/usb/uvc/uvcvideo.h +++ b/drivers/media/usb/uvc/uvcvideo.h @@ -434,7 +434,11 @@ struct uvc_video_chain { struct uvc_entity *processing; /* Processing unit */ struct uvc_entity *selector; /* Selector unit */ - struct mutex ctrl_mutex; /* Protects ctrl.info */ + struct mutex ctrl_mutex; /* + * Protects ctrl.info, + * ctrl.handle and + * uvc_fh.pending_async_ctrls + */ struct v4l2_prio_state prio; /* V4L2 priority state */ u32 caps; /* V4L2 chain-wide caps */ @@ -626,6 +630,7 @@ struct uvc_fh { struct uvc_video_chain *chain; struct uvc_streaming *stream; enum uvc_handle_state state; + unsigned int pending_async_ctrls; }; struct uvc_driver { @@ -792,6 +797,8 @@ int uvc_ctrl_set(struct uvc_fh *handle, struct v4l2_ext_control *xctrl); int uvc_xu_ctrl_query(struct uvc_video_chain *chain, struct uvc_xu_control_query *xqry); +void uvc_ctrl_cleanup_fh(struct uvc_fh *handle); + /* Utility functions */ void uvc_simplify_fraction(u32 *numerator, u32 *denominator, unsigned int n_terms, unsigned int threshold); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] nilfs2: do not force clear folio if buffer is referenced
by Liu Chuang 26 Mar '25

26 Mar '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.14-rc1 commit ca76bb226bf47ff04c782cacbd299f12ddee1ec1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBK0 CVE: CVE-2025-21722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------- Patch series "nilfs2: protect busy buffer heads from being force-cleared". This series fixes the buffer head state inconsistency issues reported by syzbot that occurs when the filesystem is corrupted and falls back to read-only, and the associated buffer head use-after-free issue. This patch (of 2): Syzbot has reported that after nilfs2 detects filesystem corruption and falls back to read-only, inconsistencies in the buffer state may occur. One of the inconsistencies is that when nilfs2 calls mark_buffer_dirty() to set a data or metadata buffer as dirty, but it detects that the buffer is not in the uptodate state: WARNING: CPU: 0 PID: 6049 at fs/buffer.c:1177 mark_buffer_dirty+0x2e5/0x520 fs/buffer.c:1177 ... Call Trace: <TASK> nilfs_palloc_commit_alloc_entry+0x4b/0x160 fs/nilfs2/alloc.c:598 nilfs_ifile_create_inode+0x1dd/0x3a0 fs/nilfs2/ifile.c:73 nilfs_new_inode+0x254/0x830 fs/nilfs2/inode.c:344 nilfs_mkdir+0x10d/0x340 fs/nilfs2/namei.c:218 vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257 do_mkdirat+0x264/0x3a0 fs/namei.c:4280 __do_sys_mkdirat fs/namei.c:4295 [inline] __se_sys_mkdirat fs/namei.c:4293 [inline] __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The other is when nilfs_btree_propagate(), which propagates the dirty state to the ancestor nodes of a b-tree that point to a dirty buffer, detects that the origin buffer is not dirty, even though it should be: WARNING: CPU: 0 PID: 5245 at fs/nilfs2/btree.c:2089 nilfs_btree_propagate+0xc79/0xdf0 fs/nilfs2/btree.c:2089 ... Call Trace: <TASK> nilfs_bmap_propagate+0x75/0x120 fs/nilfs2/bmap.c:345 nilfs_collect_file_data+0x4d/0xd0 fs/nilfs2/segment.c:587 nilfs_segctor_apply_buffers+0x184/0x340 fs/nilfs2/segment.c:1006 nilfs_segctor_scan_file+0x28c/0xa50 fs/nilfs2/segment.c:1045 nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1216 [inline] nilfs_segctor_collect fs/nilfs2/segment.c:1540 [inline] nilfs_segctor_do_construct+0x1c28/0x6b90 fs/nilfs2/segment.c:2115 nilfs_segctor_construct+0x181/0x6b0 fs/nilfs2/segment.c:2479 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2587 [inline] nilfs_segctor_thread+0x69e/0xe80 fs/nilfs2/segment.c:2701 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Both of these issues are caused by the callbacks that handle the page/folio write requests, forcibly clear various states, including the working state of the buffers they hold, at unexpected times when they detect read-only fallback. Fix these issues by checking if the buffer is referenced before clearing the page/folio state, and skipping the clear if it is. Link: https://lkml.kernel.org/r/20250107200202.6432-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20250107200202.6432-2-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b2b14916b77acf8626d7 Reported-by: syzbot+d98fd19acd08b36ff422(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d98fd19acd08b36ff422 Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") Tested-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/nilfs2/page.c [Due to previous commits not merged.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- fs/nilfs2/page.c | 36 +++++++++++++++++++++++++++++++----- 1 file changed, 31 insertions(+), 5 deletions(-) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index cc3308d1c61d..78661186c360 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -383,6 +383,11 @@ void nilfs_clear_dirty_pages(struct address_space *mapping, bool silent) * nilfs_clear_dirty_page - discard dirty page * @page: dirty page that will be discarded * @silent: suppress [true] or print [false] warning messages + * + * nilfs_clear_dirty_page() clears working states including dirty state for + * the page and its buffers. If the page has buffers, clear only if it is + * confirmed that none of the buffer heads are busy (none have valid + * references and none are locked). */ void nilfs_clear_dirty_page(struct page *page, bool silent) { @@ -396,18 +401,35 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) "discard dirty page: offset=%lld, ino=%lu", page_offset(page), inode->i_ino); - ClearPageUptodate(page); - ClearPageMappedToDisk(page); - ClearPageChecked(page); - if (page_has_buffers(page)) { struct buffer_head *bh, *head; const unsigned long clear_bits = (BIT(BH_Uptodate) | BIT(BH_Dirty) | BIT(BH_Mapped) | BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) | BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected)); + bool busy, invalidated = false; - bh = head = page_buffers(page); + head = page_buffers(page); + +recheck_buffers: + busy = false; + bh = head; + do { + if (atomic_read(&bh->b_count) | buffer_locked(bh)) { + busy = true; + break; + } + } while (bh = bh->b_this_page, bh != head); + + if (busy) { + if (invalidated) + return; + invalidate_bh_lrus(); + invalidated = true; + goto recheck_buffers; + } + + bh = head; do { lock_buffer(bh); if (!silent) @@ -420,6 +442,10 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) } while (bh = bh->b_this_page, bh != head); } + ClearPageUptodate(page); + ClearPageMappedToDisk(page); + ClearPageChecked(page); + __nilfs_clear_page_dirty(page); } -- 2.34.1

2 1

[PATCH OLK-5.10] nilfs2: do not force clear folio if buffer is referenced
by Liu Chuang 26 Mar '25

26 Mar '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.14-rc1 commit ca76bb226bf47ff04c782cacbd299f12ddee1ec1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBK0 CVE: CVE-2025-21722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------- Patch series "nilfs2: protect busy buffer heads from being force-cleared". This series fixes the buffer head state inconsistency issues reported by syzbot that occurs when the filesystem is corrupted and falls back to read-only, and the associated buffer head use-after-free issue. This patch (of 2): Syzbot has reported that after nilfs2 detects filesystem corruption and falls back to read-only, inconsistencies in the buffer state may occur. One of the inconsistencies is that when nilfs2 calls mark_buffer_dirty() to set a data or metadata buffer as dirty, but it detects that the buffer is not in the uptodate state: WARNING: CPU: 0 PID: 6049 at fs/buffer.c:1177 mark_buffer_dirty+0x2e5/0x520 fs/buffer.c:1177 ... Call Trace: <TASK> nilfs_palloc_commit_alloc_entry+0x4b/0x160 fs/nilfs2/alloc.c:598 nilfs_ifile_create_inode+0x1dd/0x3a0 fs/nilfs2/ifile.c:73 nilfs_new_inode+0x254/0x830 fs/nilfs2/inode.c:344 nilfs_mkdir+0x10d/0x340 fs/nilfs2/namei.c:218 vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257 do_mkdirat+0x264/0x3a0 fs/namei.c:4280 __do_sys_mkdirat fs/namei.c:4295 [inline] __se_sys_mkdirat fs/namei.c:4293 [inline] __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The other is when nilfs_btree_propagate(), which propagates the dirty state to the ancestor nodes of a b-tree that point to a dirty buffer, detects that the origin buffer is not dirty, even though it should be: WARNING: CPU: 0 PID: 5245 at fs/nilfs2/btree.c:2089 nilfs_btree_propagate+0xc79/0xdf0 fs/nilfs2/btree.c:2089 ... Call Trace: <TASK> nilfs_bmap_propagate+0x75/0x120 fs/nilfs2/bmap.c:345 nilfs_collect_file_data+0x4d/0xd0 fs/nilfs2/segment.c:587 nilfs_segctor_apply_buffers+0x184/0x340 fs/nilfs2/segment.c:1006 nilfs_segctor_scan_file+0x28c/0xa50 fs/nilfs2/segment.c:1045 nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1216 [inline] nilfs_segctor_collect fs/nilfs2/segment.c:1540 [inline] nilfs_segctor_do_construct+0x1c28/0x6b90 fs/nilfs2/segment.c:2115 nilfs_segctor_construct+0x181/0x6b0 fs/nilfs2/segment.c:2479 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2587 [inline] nilfs_segctor_thread+0x69e/0xe80 fs/nilfs2/segment.c:2701 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Both of these issues are caused by the callbacks that handle the page/folio write requests, forcibly clear various states, including the working state of the buffers they hold, at unexpected times when they detect read-only fallback. Fix these issues by checking if the buffer is referenced before clearing the page/folio state, and skipping the clear if it is. Link: https://lkml.kernel.org/r/20250107200202.6432-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20250107200202.6432-2-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b2b14916b77acf8626d7 Reported-by: syzbot+d98fd19acd08b36ff422(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d98fd19acd08b36ff422 Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") Tested-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/nilfs2/page.c [Conflicts due to previous commits not merged.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- fs/nilfs2/page.c | 34 +++++++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 5 deletions(-) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index d2d6d5c761e8..3b97d2f51ec9 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -390,6 +390,11 @@ void nilfs_clear_dirty_pages(struct address_space *mapping, bool silent) * nilfs_clear_dirty_page - discard dirty page * @page: dirty page that will be discarded * @silent: suppress [true] or print [false] warning messages + * + * nilfs_clear_dirty_page() clears working states including dirty state for + * the page and its buffers. If the page has buffers, clear only if it is + * confirmed that none of the buffer heads are busy (none have valid + * references and none are locked). */ void nilfs_clear_dirty_page(struct page *page, bool silent) { @@ -402,10 +407,6 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) nilfs_warn(sb, "discard dirty page: offset=%lld, ino=%lu", page_offset(page), inode->i_ino); - ClearPageUptodate(page); - ClearPageMappedToDisk(page); - ClearPageChecked(page); - if (page_has_buffers(page)) { struct buffer_head *bh, *head; const unsigned long clear_bits = @@ -413,8 +414,28 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) | BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected) | BIT(BH_Delay)); + bool busy, invalidated = false; - bh = head = page_buffers(page); + head = page_buffers(page); +recheck_buffers: + busy = false; + bh = head; + do { + if (atomic_read(&bh->b_count) | buffer_locked(bh)) { + busy = true; + break; + } + } while (bh = bh->b_this_page, bh != head); + + if (busy) { + if (invalidated) + return; + invalidate_bh_lrus(); + invalidated = true; + goto recheck_buffers; + } + + bh = head; do { lock_buffer(bh); if (!silent) @@ -427,6 +448,9 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) } while (bh = bh->b_this_page, bh != head); } + ClearPageUptodate(page); + ClearPageMappedToDisk(page); + ClearPageChecked(page); __nilfs_clear_page_dirty(page); } -- 2.34.1

2 1

[PATCH OLK-6.6] nilfs2: do not force clear folio if buffer is referenced
by Liu Chuang 26 Mar '25

26 Mar '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.14-rc1 commit ca76bb226bf47ff04c782cacbd299f12ddee1ec1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBK0 CVE: CVE-2025-21722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------- Patch series "nilfs2: protect busy buffer heads from being force-cleared". This series fixes the buffer head state inconsistency issues reported by syzbot that occurs when the filesystem is corrupted and falls back to read-only, and the associated buffer head use-after-free issue. This patch (of 2): Syzbot has reported that after nilfs2 detects filesystem corruption and falls back to read-only, inconsistencies in the buffer state may occur. One of the inconsistencies is that when nilfs2 calls mark_buffer_dirty() to set a data or metadata buffer as dirty, but it detects that the buffer is not in the uptodate state: WARNING: CPU: 0 PID: 6049 at fs/buffer.c:1177 mark_buffer_dirty+0x2e5/0x520 fs/buffer.c:1177 ... Call Trace: <TASK> nilfs_palloc_commit_alloc_entry+0x4b/0x160 fs/nilfs2/alloc.c:598 nilfs_ifile_create_inode+0x1dd/0x3a0 fs/nilfs2/ifile.c:73 nilfs_new_inode+0x254/0x830 fs/nilfs2/inode.c:344 nilfs_mkdir+0x10d/0x340 fs/nilfs2/namei.c:218 vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257 do_mkdirat+0x264/0x3a0 fs/namei.c:4280 __do_sys_mkdirat fs/namei.c:4295 [inline] __se_sys_mkdirat fs/namei.c:4293 [inline] __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The other is when nilfs_btree_propagate(), which propagates the dirty state to the ancestor nodes of a b-tree that point to a dirty buffer, detects that the origin buffer is not dirty, even though it should be: WARNING: CPU: 0 PID: 5245 at fs/nilfs2/btree.c:2089 nilfs_btree_propagate+0xc79/0xdf0 fs/nilfs2/btree.c:2089 ... Call Trace: <TASK> nilfs_bmap_propagate+0x75/0x120 fs/nilfs2/bmap.c:345 nilfs_collect_file_data+0x4d/0xd0 fs/nilfs2/segment.c:587 nilfs_segctor_apply_buffers+0x184/0x340 fs/nilfs2/segment.c:1006 nilfs_segctor_scan_file+0x28c/0xa50 fs/nilfs2/segment.c:1045 nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1216 [inline] nilfs_segctor_collect fs/nilfs2/segment.c:1540 [inline] nilfs_segctor_do_construct+0x1c28/0x6b90 fs/nilfs2/segment.c:2115 nilfs_segctor_construct+0x181/0x6b0 fs/nilfs2/segment.c:2479 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2587 [inline] nilfs_segctor_thread+0x69e/0xe80 fs/nilfs2/segment.c:2701 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Both of these issues are caused by the callbacks that handle the page/folio write requests, forcibly clear various states, including the working state of the buffers they hold, at unexpected times when they detect read-only fallback. Fix these issues by checking if the buffer is referenced before clearing the page/folio state, and skipping the clear if it is. Link: https://lkml.kernel.org/r/20250107200202.6432-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20250107200202.6432-2-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b2b14916b77acf8626d7 Reported-by: syzbot+d98fd19acd08b36ff422(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d98fd19acd08b36ff422 Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") Tested-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/nilfs2/page.c [Conflicts due to previous commits not merged.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- fs/nilfs2/page.c | 34 +++++++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 5 deletions(-) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index d2d6d5c761e8..3b97d2f51ec9 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -390,6 +390,11 @@ void nilfs_clear_dirty_pages(struct address_space *mapping, bool silent) * nilfs_clear_dirty_page - discard dirty page * @page: dirty page that will be discarded * @silent: suppress [true] or print [false] warning messages + * + * nilfs_clear_dirty_page() clears working states including dirty state for + * the page and its buffers. If the page has buffers, clear only if it is + * confirmed that none of the buffer heads are busy (none have valid + * references and none are locked). */ void nilfs_clear_dirty_page(struct page *page, bool silent) { @@ -402,10 +407,6 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) nilfs_warn(sb, "discard dirty page: offset=%lld, ino=%lu", page_offset(page), inode->i_ino); - ClearPageUptodate(page); - ClearPageMappedToDisk(page); - ClearPageChecked(page); - if (page_has_buffers(page)) { struct buffer_head *bh, *head; const unsigned long clear_bits = @@ -413,8 +414,28 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) | BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected) | BIT(BH_Delay)); + bool busy, invalidated = false; - bh = head = page_buffers(page); + head = page_buffers(page); +recheck_buffers: + busy = false; + bh = head; + do { + if (atomic_read(&bh->b_count) | buffer_locked(bh)) { + busy = true; + break; + } + } while (bh = bh->b_this_page, bh != head); + + if (busy) { + if (invalidated) + return; + invalidate_bh_lrus(); + invalidated = true; + goto recheck_buffers; + } + + bh = head; do { lock_buffer(bh); if (!silent) @@ -427,6 +448,9 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) } while (bh = bh->b_this_page, bh != head); } + ClearPageUptodate(page); + ClearPageMappedToDisk(page); + ClearPageChecked(page); __nilfs_clear_page_dirty(page); } -- 2.34.1

2 1

[PATCH OLK-6.6] ata: libata-sff: Ensure that we cannot write outside the allocated buffer
by Zheng Qixing 26 Mar '25

26 Mar '25

From: Niklas Cassel <cassel(a)kernel.org> stable inclusion from stable-v6.6.78 commit d5e6e3000309359eae2a17117aa6e3c44897bf6c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5G CVE: CVE-2025-21738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit 6e74e53b34b6dec5a50e1404e2680852ec6768d2 upstream. reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len set to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to ATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to write outside the allocated buffer, overwriting random memory. While a ATA device is supposed to abort a ATA_NOP command, there does seem to be a bug either in libata-sff or QEMU, where either this status is not set, or the status is cleared before read by ata_sff_hsm_move(). Anyway, that is most likely a separate bug. Looking at __atapi_pio_bytes(), it already has a safety check to ensure that __atapi_pio_bytes() cannot write outside the allocated buffer. Add a similar check to ata_pio_sector(), such that also ata_pio_sector() cannot write outside the allocated buffer. Cc: stable(a)vger.kernel.org Reported-by: reveliofuzzing <reveliofuzzing(a)gmail.com> Closes: https://lore.kernel.org/linux-ide/CA+-ZZ_jTgxh3bS7m+KX07_EWckSnW3N2adX3KV63… Link: https://lore.kernel.org/r/20250127154303.15567-2-cassel@kernel.org Signed-off-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/ata/libata-sff.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c index 8fcc622fcb3d..9b6529f2dfcb 100644 --- a/drivers/ata/libata-sff.c +++ b/drivers/ata/libata-sff.c @@ -602,7 +602,7 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) { struct ata_port *ap = qc->ap; struct page *page; - unsigned int offset; + unsigned int offset, count; if (!qc->cursg) { qc->curbytes = qc->nbytes; @@ -618,25 +618,27 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) page = nth_page(page, (offset >> PAGE_SHIFT)); offset %= PAGE_SIZE; - trace_ata_sff_pio_transfer_data(qc, offset, qc->sect_size); + /* don't overrun current sg */ + count = min(qc->cursg->length - qc->cursg_ofs, qc->sect_size); + + trace_ata_sff_pio_transfer_data(qc, offset, count); /* * Split the transfer when it splits a page boundary. Note that the * split still has to be dword aligned like all ATA data transfers. */ WARN_ON_ONCE(offset % 4); - if (offset + qc->sect_size > PAGE_SIZE) { + if (offset + count > PAGE_SIZE) { unsigned int split_len = PAGE_SIZE - offset; ata_pio_xfer(qc, page, offset, split_len); - ata_pio_xfer(qc, nth_page(page, 1), 0, - qc->sect_size - split_len); + ata_pio_xfer(qc, nth_page(page, 1), 0, count - split_len); } else { - ata_pio_xfer(qc, page, offset, qc->sect_size); + ata_pio_xfer(qc, page, offset, count); } - qc->curbytes += qc->sect_size; - qc->cursg_ofs += qc->sect_size; + qc->curbytes += count; + qc->cursg_ofs += count; if (qc->cursg_ofs == qc->cursg->length) { qc->cursg = sg_next(qc->cursg); -- 2.39.2

2 1

[PATCH OLK-5.10 0/3] Sidecarless
by Xiaomeng Zhang 26 Mar '25

26 Mar '25

Andrii Nakryiko (1): bpf: make uniform use of array->elem_size everywhere in arraymap.c Rhys Rustad-Elliott (2): bpf: Fix elem_size not being set for inner maps selftests/bpf: Add access_inner_map selftest kernel/bpf/arraymap.c | 14 +++--- kernel/bpf/map_in_map.c | 8 +++- .../bpf/prog_tests/inner_array_lookup.c | 31 +++++++++++++ .../selftests/bpf/progs/inner_array_lookup.c | 45 +++++++++++++++++++ 4 files changed, 90 insertions(+), 8 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c create mode 100644 tools/testing/selftests/bpf/progs/inner_array_lookup.c -- 2.34.1

2 4

[PATCH OLK-6.6] block: don't revert iter for -EIOCBQUEUED
by Zheng Qixing 26 Mar '25

26 Mar '25

From: Jens Axboe <axboe(a)kernel.dk> stable inclusion from stable-v6.6.78 commit 84671b0630ccb46ae9f1f99a45c7d63ffcd6a474 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRECT CVE: CVE-2025-21832 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit b13ee668e8280ca5b07f8ce2846b9957a8a10853 upstream. blkdev_read_iter() has a few odd checks, like gating the position and count adjustment on whether or not the result is bigger-than-or-equal to zero (where bigger than makes more sense), and not checking the return value of blkdev_direct_IO() before doing an iov_iter_revert(). The latter can lead to attempting to revert with a negative value, which when passed to iov_iter_revert() as an unsigned value will lead to throwing a WARN_ON() because unroll is bigger than MAX_RW_COUNT. Be sane and don't revert for -EIOCBQUEUED, like what is done in other spots. Cc: stable(a)vger.kernel.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/fops.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/block/fops.c b/block/fops.c index 33b724b1d963..cda9978ebf67 100644 --- a/block/fops.c +++ b/block/fops.c @@ -730,11 +730,12 @@ static ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to) file_accessed(iocb->ki_filp); ret = blkdev_direct_IO(iocb, to); - if (ret >= 0) { + if (ret > 0) { iocb->ki_pos += ret; count -= ret; } - iov_iter_revert(to, count - iov_iter_count(to)); + if (ret != -EIOCBQUEUED) + iov_iter_revert(to, count - iov_iter_count(to)); if (ret < 0 || !count) goto reexpand; } -- 2.39.2

2 1

[PATCH OLK-5.10 0/3] Sidecarless
by Xiaomeng Zhang 26 Mar '25

26 Mar '25

Andrii Nakryiko (1): bpf: make uniform use of array->elem_size everywhere in arraymap.c Rhys Rustad-Elliott (2): bpf: Fix elem_size not being set for inner maps selftests/bpf: Add access_inner_map selftest kernel/bpf/arraymap.c | 14 +++--- kernel/bpf/map_in_map.c | 8 +++- .../bpf/prog_tests/inner_array_lookup.c | 31 +++++++++++++ .../selftests/bpf/progs/inner_array_lookup.c | 45 +++++++++++++++++++ 4 files changed, 90 insertions(+), 8 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c create mode 100644 tools/testing/selftests/bpf/progs/inner_array_lookup.c -- 2.34.1

2 4

[openeuler:OLK-5.10 2821/2821] block/bio.o: warning: objtool: bvec_alloc()+0xf5: unreachable instruction
by kernel test robot 26 Mar '25

26 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0d616a77cb5f7198cca524a24f717f59ad51b41b commit: 958384da6a734ebe7a49d0fafcea86968390e9d9 [2821/2821] block: use bi_max_vecs to find the bvec pool config: x86_64-buildonly-randconfig-005-20250325 (https://download.01.org/0day-ci/archive/20250326/202503260949.1ZCW1y7H-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250326/202503260949.1ZCW1y7H-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503260949.1ZCW1y7H-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/bio.o: warning: objtool: bvec_alloc()+0xf5: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49374
by Wang Liang 26 Mar '25

26 Mar '25

Hoang Le (2): tipc: add extack messages for bearer/media failure tipc: check attribute length for bearer name net/tipc/bearer.c | 53 ++++++++++++++++++++++++++++++++++++----------- 1 file changed, 41 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] net_sched: sch_sfq: don't allow 1 packet limit
by Wang Liang 26 Mar '25

26 Mar '25

From: Octavian Purdila <tavip(a)google.com> mainline inclusion from mainline-v6.14-rc1 commit 10685681bafce6febb39770f3387621bf5d67d0b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBVH45 CVE: CVE-2024-57996 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The current implementation does not work correctly with a limit of 1. iproute2 actually checks for this and this patch adds the check in kernel as well. This fixes the following syzkaller reported crash: UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:210:6 index 65535 is out of range for type 'struct sfq_head[128]' CPU: 0 PID: 2569 Comm: syz-executor101 Not tainted 5.10.0-smp-DEV #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x125/0x19f lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:148 [inline] __ubsan_handle_out_of_bounds+0xed/0x120 lib/ubsan.c:347 sfq_link net/sched/sch_sfq.c:210 [inline] sfq_dec+0x528/0x600 net/sched/sch_sfq.c:238 sfq_dequeue+0x39b/0x9d0 net/sched/sch_sfq.c:500 sfq_reset+0x13/0x50 net/sched/sch_sfq.c:525 qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026 tbf_reset+0x3d/0x100 net/sched/sch_tbf.c:319 qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026 dev_reset_queue+0x8c/0x140 net/sched/sch_generic.c:1296 netdev_for_each_tx_queue include/linux/netdevice.h:2350 [inline] dev_deactivate_many+0x6dc/0xc20 net/sched/sch_generic.c:1362 __dev_close_many+0x214/0x350 net/core/dev.c:1468 dev_close_many+0x207/0x510 net/core/dev.c:1506 unregister_netdevice_many+0x40f/0x16b0 net/core/dev.c:10738 unregister_netdevice_queue+0x2be/0x310 net/core/dev.c:10695 unregister_netdevice include/linux/netdevice.h:2893 [inline] __tun_detach+0x6b6/0x1600 drivers/net/tun.c:689 tun_detach drivers/net/tun.c:705 [inline] tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3640 __fput+0x203/0x840 fs/file_table.c:280 task_work_run+0x129/0x1b0 kernel/task_work.c:185 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0x5ce/0x2200 kernel/exit.c:931 do_group_exit+0x144/0x310 kernel/exit.c:1046 __do_sys_exit_group kernel/exit.c:1057 [inline] __se_sys_exit_group kernel/exit.c:1055 [inline] __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1055 do_syscall_64+0x6c/0xd0 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fe5e7b52479 Code: Unable to access opcode bytes at RIP 0x7fe5e7b5244f. RSP: 002b:00007ffd3c800398 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe5e7b52479 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 00007fe5e7bcd2d0 R08: ffffffffffffffb8 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe5e7bcd2d0 R13: 0000000000000000 R14: 00007fe5e7bcdd20 R15: 00007fe5e7b24270 The crash can be also be reproduced with the following (with a tc recompiled to allow for sfq limits of 1): tc qdisc add dev dummy0 handle 1: root tbf rate 1Kbit burst 100b lat 1s ../iproute2-6.9.0/tc/tc qdisc add dev dummy0 handle 2: parent 1:10 sfq limit 1 ifconfig dummy0 up ping -I dummy0 -f -c2 -W0.1 8.8.8.8 sleep 1 Scenario that triggers the crash: * the first packet is sent and queued in TBF and SFQ; qdisc qlen is 1 * TBF dequeues: it peeks from SFQ which moves the packet to the gso_skb list and keeps qdisc qlen set to 1. TBF is out of tokens so it schedules itself for later. * the second packet is sent and TBF tries to queues it to SFQ. qdisc qlen is now 2 and because the SFQ limit is 1 the packet is dropped by SFQ. At this point qlen is 1, and all of the SFQ slots are empty, however q->tail is not NULL. At this point, assuming no more packets are queued, when sch_dequeue runs again it will decrement the qlen for the current empty slot causing an underflow and the subsequent out of bounds access. Reported-by: syzbot <syzkaller(a)googlegroups.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Octavian Purdila <tavip(a)google.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241204030520.2084663-2-tavip@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/sched/sch_sfq.c [conflicts due to not merge e4650d7ae425 ("net_sched: sch_sfq: handle bigger packets")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sched/sch_sfq.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c index 74f697c4a4d3..9fb5ee64834a 100644 --- a/net/sched/sch_sfq.c +++ b/net/sched/sch_sfq.c @@ -658,6 +658,9 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) if (!p) return -ENOMEM; } + if (ctl->limit == 1) + return -EINVAL; + sch_tree_lock(sch); if (ctl->quantum) { q->quantum = ctl->quantum; -- 2.34.1

2 1

[openeuler:OLK-5.10 2821/2821] io_uring/io_uring.o: warning: objtool: __io_uring_free()+0x69: unreachable instruction
by kernel test robot 26 Mar '25

26 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0d616a77cb5f7198cca524a24f717f59ad51b41b commit: 2c4dc5d73facd120aab1305ec14eef4f9a524812 [2821/2821] io_uring/tctx: work around xa_store() allocation error issue config: x86_64-buildonly-randconfig-005-20250325 (https://download.01.org/0day-ci/archive/20250326/202503260613.Q2n0VF4Y-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250326/202503260613.Q2n0VF4Y-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503260613.Q2n0VF4Y-lkp@intel.com/ All warnings (new ones prefixed by >>): >> io_uring/io_uring.o: warning: objtool: __io_uring_free()+0x69: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2821/2821] kernel/rcu/tree.o: warning: objtool: rcu_iw_handler()+0x9e: unreachable instruction
by kernel test robot 26 Mar '25

26 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0d616a77cb5f7198cca524a24f717f59ad51b41b commit: 44a47613c5cbb589453938cf7bf355d8043fa53f [2821/2821] irq_work: Cleanup config: x86_64-buildonly-randconfig-005-20250325 (https://download.01.org/0day-ci/archive/20250326/202503260202.467f83vo-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250326/202503260202.467f83vo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503260202.467f83vo-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/rcu/tree.o: warning: objtool: rcu_iw_handler()+0x9e: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1514/1514] mm/memory.c:4489:43: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a0f7a942ef42e73c8748687d469ed61f380bf0cf commit: ae0cd4d46ced733c522f2cc6da2d380d69123fc4 [1514/1514] mm: parallelize clear_gigantic_page config: x86_64-randconfig-121-20250325 (https://download.01.org/0day-ci/archive/20250325/202503252231.BsBQmABZ-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503252231.BsBQmABZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503252231.BsBQmABZ-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/memory.c:4489:43: sparse: sparse: Using plain integer as NULL pointer mm/memory.c:4560:22: sparse: sparse: cast removes address space '__user' of expression mm/memory.c:833:17: sparse: sparse: context imbalance in 'copy_pte_range' - different lock contexts for basic block mm/memory.c:1436:16: sparse: sparse: context imbalance in '__get_locked_pte' - different lock contexts for basic block mm/memory.c:1478:9: sparse: sparse: context imbalance in 'insert_page' - different lock contexts for basic block mm/memory.c:1579:9: sparse: sparse: context imbalance in 'insert_pfn' - different lock contexts for basic block mm/memory.c:1746:17: sparse: sparse: context imbalance in 'remap_pte_range' - different lock contexts for basic block mm/memory.c:1975:17: sparse: sparse: context imbalance in 'apply_to_pte_range' - unexpected unlock mm/memory.c:2422:17: sparse: sparse: context imbalance in 'wp_pfn_shared' - unexpected unlock mm/memory.c:2484:19: sparse: sparse: context imbalance in 'do_wp_page' - different lock contexts for basic block mm/memory.c:3055:19: sparse: sparse: context imbalance in 'pte_alloc_one_map' - different lock contexts for basic block mm/memory.c:3295:17: sparse: sparse: context imbalance in 'finish_fault' - unexpected unlock mm/memory.c:3409:9: sparse: sparse: context imbalance in 'do_fault_around' - unexpected unlock mm/memory.c:4062:12: sparse: sparse: context imbalance in '__follow_pte_pmd' - different lock contexts for basic block mm/memory.c:4146:16: sparse: sparse: context imbalance in 'follow_pte_pmd' - different lock contexts for basic block mm/memory.c:4206:9: sparse: sparse: context imbalance in 'follow_phys' - unexpected unlock In file included from mm/memory.c:72: mm/memory.c: In function 'clear_huge_page': include/linux/ktask.h:123:35: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct cgp_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] 123 | .kc_thread_func = (ktask_thread_func)(thread_func), 22- | ^ include/linux/ktask.h:139:17: note: in expansion of macro 'KTASK_CTL_INITIALIZER' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) 25- | ^~~~~~~~~~~~~~~~~~~~~ mm/memory.c:4491:17: note: in expansion of macro 'DEFINE_KTASK_CTL' 4491 | DEFINE_KTASK_CTL(ctl, clear_gigantic_page_chunk, &args, | ^~~~~~~~~~~~~~~~ vim +4489 mm/memory.c 4480 4481 void clear_huge_page(struct page *page, 4482 unsigned long addr_hint, unsigned int pages_per_huge_page) 4483 { 4484 unsigned long addr = addr_hint & 4485 ~(((unsigned long)pages_per_huge_page << PAGE_SHIFT) - 1); 4486 4487 if (unlikely(pages_per_huge_page > MAX_ORDER_NR_PAGES)) { 4488 struct cgp_args args = {page, addr}; > 4489 struct ktask_node node = {0, pages_per_huge_page, 4490 page_to_nid(page)}; 4491 DEFINE_KTASK_CTL(ctl, clear_gigantic_page_chunk, &args, 4492 KTASK_MEM_CHUNK); 4493 4494 ktask_run_numa(&node, 1, &ctl); 4495 return; 4496 } 4497 4498 process_huge_page(addr_hint, pages_per_huge_page, clear_subpage, page); 4499 } 4500 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1514/1514] include/linux/bpf-cgroup.h:274:41: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a0f7a942ef42e73c8748687d469ed61f380bf0cf commit: f42ee093be2980f2689ea7a170d580364820f48b [1514/1514] bpf/test_run: support cgroup local storage config: x86_64-randconfig-122-20250325 (https://download.01.org/0day-ci/archive/20250325/202503252213.JKA9UxCh-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503252213.JKA9UxCh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503252213.JKA9UxCh-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) net/bpf/test_run.c: note: in included file (through include/linux/cgroup-defs.h, include/linux/cgroup.h, include/net/netprio_cgroup.h, ...): >> include/linux/bpf-cgroup.h:274:41: sparse: sparse: Using plain integer as NULL pointer vim +274 include/linux/bpf-cgroup.h fdb5c4531c1e0e Sean Young 2018-06-19 267 aa0ad5b0391e26 Roman Gushchin 2018-08-02 268 static inline void bpf_cgroup_storage_set(struct bpf_cgroup_storage *storage) {} de9cbbaadba5ad Roman Gushchin 2018-08-02 269 static inline int bpf_cgroup_storage_assign(struct bpf_prog *prog, de9cbbaadba5ad Roman Gushchin 2018-08-02 270 struct bpf_map *map) { return 0; } de9cbbaadba5ad Roman Gushchin 2018-08-02 271 static inline void bpf_cgroup_storage_release(struct bpf_prog *prog, de9cbbaadba5ad Roman Gushchin 2018-08-02 272 struct bpf_map *map) {} de9cbbaadba5ad Roman Gushchin 2018-08-02 273 static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc( de9cbbaadba5ad Roman Gushchin 2018-08-02 @274 struct bpf_prog *prog) { return 0; } de9cbbaadba5ad Roman Gushchin 2018-08-02 275 static inline void bpf_cgroup_storage_free( de9cbbaadba5ad Roman Gushchin 2018-08-02 276 struct bpf_cgroup_storage *storage) {} de9cbbaadba5ad Roman Gushchin 2018-08-02 277 :::::: The code at line 274 was first introduced by commit :::::: de9cbbaadba5adf88a19e46df61f7054000838f6 bpf: introduce cgroup storage maps :::::: TO: Roman Gushchin <guro(a)fb.com> :::::: CC: Daniel Borkmann <daniel(a)iogearbox.net> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2820/2820] net/core/sock_map.c:1501:5: sparse: sparse: symbol 'sock_map_prog_lookup' was not declared. Should it be static?
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0d616a77cb5f7198cca524a24f717f59ad51b41b commit: 050383882de382969e4fb8362235749b232cccae [2820/2820] bpf: support BPF_PROG_QUERY for progs attached to sockmap config: x86_64-randconfig-123-20250325 (https://download.01.org/0day-ci/archive/20250325/202503252115.VoLdAs0Z-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503252115.VoLdAs0Z-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503252115.VoLdAs0Z-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> net/core/sock_map.c:1501:5: sparse: sparse: symbol 'sock_map_prog_lookup' was not declared. Should it be static? vim +/sock_map_prog_lookup +1501 net/core/sock_map.c 1500 > 1501 int sock_map_prog_lookup(struct bpf_map *map, struct bpf_prog ***pprog, 1502 u32 which) 1503 { 1504 struct sk_psock_progs *progs = sock_map_progs(map); 1505 1506 if (!progs) 1507 return -EOPNOTSUPP; 1508 1509 switch (which) { 1510 case BPF_SK_MSG_VERDICT: 1511 *pprog = &progs->msg_parser; 1512 break; 1513 case BPF_SK_SKB_STREAM_PARSER: 1514 *pprog = &progs->skb_parser; 1515 break; 1516 case BPF_SK_SKB_STREAM_VERDICT: 1517 *pprog = &progs->skb_verdict; 1518 break; 1519 default: 1520 return -EOPNOTSUPP; 1521 } 1522 return 0; 1523 } 1524 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2821/2821] arch/x86/kernel/paravirt.c:68:1: error: control reaches end of non-void function
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0d616a77cb5f7198cca524a24f717f59ad51b41b commit: 822da186955cbcd69b4715b8a307053e6c756f30 [2821/2821] x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() config: x86_64-buildonly-randconfig-003-20250325 (https://download.01.org/0day-ci/archive/20250325/202503252017.UYNRpRjt-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503252017.UYNRpRjt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503252017.UYNRpRjt-lkp@intel.com/ All errors (new ones prefixed by >>): arch/x86/kernel/paravirt.c: In function 'paravirt_patch_call': arch/x86/kernel/paravirt.c:65:9: error: implicit declaration of function '__text_gen_insn' [-Werror=implicit-function-declaration] 65 | __text_gen_insn(insn_buff, CALL_INSN_OPCODE, | ^~~~~~~~~~~~~~~ arch/x86/kernel/paravirt.c:65:36: error: 'CALL_INSN_OPCODE' undeclared (first use in this function) 65 | __text_gen_insn(insn_buff, CALL_INSN_OPCODE, | ^~~~~~~~~~~~~~~~ arch/x86/kernel/paravirt.c:65:36: note: each undeclared identifier is reported only once for each function it appears in arch/x86/kernel/paravirt.c:66:47: error: 'CALL_INSN_SIZE' undeclared (first use in this function) 66 | (void *)addr, target, CALL_INSN_SIZE); | ^~~~~~~~~~~~~~ >> arch/x86/kernel/paravirt.c:68:1: error: control reaches end of non-void function [-Werror=return-type] 68 | } | ^ cc1: some warnings being treated as errors vim +68 arch/x86/kernel/paravirt.c 19d36ccdc34f5e arch/i386/kernel/paravirt.c Andi Kleen 2007-07-22 61 1fc654cf6e04b4 arch/x86/kernel/paravirt.c Ingo Molnar 2019-04-25 62 static unsigned paravirt_patch_call(void *insn_buff, const void *target, abc745f85c1193 arch/x86/kernel/paravirt.c Juergen Gross 2018-08-28 63 unsigned long addr, unsigned len) 63f70270ccd981 arch/i386/kernel/paravirt.c Jeremy Fitzhardinge 2007-05-02 64 { 822da186955cbc arch/x86/kernel/paravirt.c Peter Zijlstra 2022-03-08 65 __text_gen_insn(insn_buff, CALL_INSN_OPCODE, 822da186955cbc arch/x86/kernel/paravirt.c Peter Zijlstra 2022-03-08 66 (void *)addr, target, CALL_INSN_SIZE); 822da186955cbc arch/x86/kernel/paravirt.c Peter Zijlstra 2022-03-08 67 return CALL_INSN_SIZE; 63f70270ccd981 arch/i386/kernel/paravirt.c Jeremy Fitzhardinge 2007-05-02 @68 } 63f70270ccd981 arch/i386/kernel/paravirt.c Jeremy Fitzhardinge 2007-05-02 69 :::::: The code at line 68 was first introduced by commit :::::: 63f70270ccd981ce40a8ff58c03a8c2e97e368be [PATCH] i386: PARAVIRT: add common patching machinery :::::: TO: Jeremy Fitzhardinge <jeremy(a)goop.org> :::::: CC: Andi Kleen <andi(a)basil.nowhere.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 3e8e3ea77f0dd528b080f91d615144093b741003
by kernel test robot 25 Mar '25

25 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 3e8e3ea77f0dd528b080f91d615144093b741003 !15582 CVE-2022-49508 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503251400.xG2WACIP-lkp@intel.com crypto/aegis128.o: warning: objtool: missing symbol for section .init.text mm/page_ext.o: warning: objtool: missing symbol for section .init.text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250324 | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-lo | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-void-u64)-aka-int-(-const)(struct-bpf_map-void-void-long-long-unsigned-int)-to-u64-(-)(u64 | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-void-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-l | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250324 | |-- drivers-soc-qcom-llcc-slice.c:warning:ret-may-be-used-uninitialized-in-this-function | |-- include-scsi-scsi_cmnd.h:warning:scsi_cmnd-may-be-used-uninitialized-in-this-function | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250324 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250324 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-051-20250324 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-055-20250324 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-r111-20250325 | `-- init-Kconfig:syntax-error |-- x86_64-allnoconfig | |-- Makefile:include-config-auto.conf.cmd:No-such-file-or-directory | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250324 | |-- Section-mismatch-in-reference-from-the-(unknown-reference)-(unknown)-to-the-(unknown-reference)-.irqentry.text:(unknown) | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250324 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250324 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250324 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration | `-- samples-vfio-mdev-mdpy-fb.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-005-20250324 | |-- crypto-aegis128.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_ext.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250324 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-defconfig | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized-in-this-function | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-101-20250325 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-102-20250325 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-103-20250325 | |-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-104-20250325 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-121-20250325 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:invalid-assignment: | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-122-20250325 | |-- block-blk-merge.c:sparse:sparse:symbol-blk_try_req_merge-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_issue-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_requeue-was-not-declared.-Should-it-be-static | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:invalid-assignment: | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-123-20250325 | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:invalid-assignment: | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used `-- x86_64-randconfig-161-20250325 |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 1444m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250324 gcc-8.5.0 arm64 randconfig-002-20250324 gcc-10.5.0 arm64 randconfig-003-20250324 gcc-14.2.0 arm64 randconfig-004-20250324 gcc-6.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250324 clang-20 x86_64 buildonly-randconfig-002-20250324 gcc-12 x86_64 buildonly-randconfig-003-20250324 clang-20 x86_64 buildonly-randconfig-004-20250324 clang-20 x86_64 buildonly-randconfig-005-20250324 clang-20 x86_64 buildonly-randconfig-006-20250324 clang-20 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2059/2059] drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:5: sparse: sparse: symbol 'tdm_service_run' was not declared. Should it be static?
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0278be80a99934144f0e708459f3475248f280c4 commit: 3ad98583441f7c8a2553e1e8d6340ed4397033e2 [2059/2059] crypto: tdm: Support dynamic protection for SCT and IDT by HYGON TDM config: x86_64-randconfig-121-20250325 (https://download.01.org/0day-ci/archive/20250325/202503251859.zDW2wWzp-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503251859.zDW2wWzp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503251859.zDW2wWzp-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:5: sparse: sparse: symbol 'tdm_service_run' was not declared. Should it be static? >> drivers/crypto/ccp/hygon/tdm-kernel-guard.c:212:5: sparse: sparse: symbol 'tdm_service_exit' was not declared. Should it be static? vim +/tdm_service_run +151 drivers/crypto/ccp/hygon/tdm-kernel-guard.c 150 > 151 int tdm_service_run(struct tdm_security_enhance *data) 152 { 153 int ret = 0; 154 struct addr_range_info *addr_range = NULL; 155 156 // Allocate memory for addr_range 157 addr_range = kzalloc(sizeof(struct addr_range_info) + sizeof(struct addr_info), GFP_KERNEL); 158 if (!addr_range) { 159 ret = -DYN_ERR_MEM; 160 pr_err("addr_range kzalloc memory failed\n"); 161 goto end; 162 } 163 164 // Fill in addr_range 165 addr_range->count = 1; 166 addr_range->addr[0].addr_start = data->vaddr; 167 addr_range->addr[0].length = data->size; 168 data->mem_range = addr_range; 169 170 // Context configuration 171 data->context |= TASK_CREATE_VADDR; 172 173 // Allocate memory for authcode 174 data->authcode = kzalloc(sizeof(struct authcode_2b) + AUTHCODE_MAX, GFP_KERNEL); 175 if (!data->authcode) { 176 ret = -DYN_ERR_MEM; 177 pr_err("authcode_2b kzalloc memory failed\n"); 178 goto free_addr_range_info; 179 } 180 181 data->authcode->len = AUTHCODE_MAX; 182 183 // Measurement data configuration 184 data->mdata.hash_algo = HASH_ALGO_SM3; 185 data->mdata.period_ms = 0; 186 ret = calc_expected_hash((uint8_t *)data->vaddr, data->size, 187 data->mdata.expected_measurement); 188 if (ret) { 189 pr_err("calculate expected hash failed!\n"); 190 goto free_authcode; 191 } 192 193 // Create and start tdm task 194 ret = tdm_task_create_and_run(data); 195 if (ret) { 196 pr_err("tdm_task_create_and_run failed!\n"); 197 goto free_authcode; 198 } 199 200 return ret; 201 202 free_authcode: 203 kfree(data->authcode); 204 data->authcode = NULL; 205 free_addr_range_info: 206 kfree(data->mem_range); 207 data->mem_range = NULL; 208 end: 209 return ret; 210 } 211 > 212 int tdm_service_exit(struct tdm_security_enhance *data) 213 { 214 int ret = 0; 215 int task_status = 0; 216 217 task_status = psp_startstop_measure_task(data->task_id, data->authcode, false); 218 if (task_status < 0) { 219 ret = task_status; 220 pr_err("task_id %d stop failed with 0x%x\n", data->task_id, ret); 221 goto end; 222 } 223 224 // Waiting for the task to end 225 msleep(40); 226 227 psp_destroy_measure_task(data->task_id, data->authcode); 228 229 kfree(data->authcode); 230 data->authcode = NULL; 231 kfree(data->mem_range); 232 data->mem_range = NULL; 233 end: 234 return ret; 235 } 236 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS 0278be80a99934144f0e708459f3475248f280c4
by kernel test robot 25 Mar '25

25 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 0278be80a99934144f0e708459f3475248f280c4 !15477 PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region() Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-virtcca_get_tmi_version | |-- drivers-coda-coda_pci.c:warning:Excess-function-parameter-pdev-description-in-virtcca_pci_get_rom_size | |-- drivers-coda-coda_pci.c:warning:Function-parameter-or-member-p-not-described-in-virtcca_pci_get_rom_size | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-defconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-001-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-002-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-003-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-052-20250324 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-053-20250324 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-054-20250324 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- loongarch-allmodconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allnoconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allyesconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-defconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-001-20250324 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-002-20250324 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allyesconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size |-- x86_64-randconfig-101-20250325 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-102-20250325 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-103-20250325 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size |-- x86_64-randconfig-104-20250325 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-121-20250325 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-122-20250325 | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-123-20250325 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used `-- x86_64-randconfig-161-20250324 |-- mm-kasan-kasan_test.c-rcu_uaf_reclaim()-error:dereferencing-freed-memory-fp-(line-) `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used elapsed time: 1445m configs tested: 21 configs skipped: 123 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250324 gcc-8.5.0 arm64 randconfig-002-20250324 clang-14 arm64 randconfig-003-20250324 clang-21 arm64 randconfig-004-20250324 gcc-6.5.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250324 gcc-14.2.0 loongarch randconfig-002-20250324 gcc-14.2.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250324 clang-20 x86_64 buildonly-randconfig-002-20250324 gcc-12 x86_64 buildonly-randconfig-003-20250324 clang-20 x86_64 buildonly-randconfig-004-20250324 clang-20 x86_64 buildonly-randconfig-005-20250324 clang-20 x86_64 buildonly-randconfig-006-20250324 clang-20 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ALSA: oss: Fix PCM OSS buffer allocation overflow
by Jinjiang Tu 25 Mar '25

25 Mar '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v4.19.237 commit a63af1baf0a5e11827db60e3127f87e437cab6e5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1SP CVE: CVE-2022-49292 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit efb6402c3c4a7c26d97c92d70186424097b6e366 upstream. We've got syzbot reports hitting INT_MAX overflow at vmalloc() allocation that is called from snd_pcm_plug_alloc(). Although we apply the restrictions to input parameters, it's based only on the hw_params of the underlying PCM device. Since the PCM OSS layer allocates a temporary buffer for the data conversion, the size may become unexpectedly large when more channels or higher rates is given; in the reported case, it went over INT_MAX, hence it hits WARN_ON(). This patch is an attempt to avoid such an overflow and an allocation for too large buffers. First off, it adds the limit of 1MB as the upper bound for period bytes. This must be large enough for all use cases, and we really don't want to handle a larger temporary buffer than this size. The size check is performed at two places, where the original period bytes is calculated and where the plugin buffer size is calculated. In addition, the driver uses array_size() and array3_size() for multiplications to catch overflows for the converted period size and buffer bytes. Reported-by: syzbot+72732c532ac1454eeee9(a)syzkaller.appspotmail.com Suggested-by: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/00000000000085b1b305da5a66f3@google.com Link: https://lore.kernel.org/r/20220318082036.29699-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- sound/core/oss/pcm_oss.c | 12 ++++++++---- sound/core/oss/pcm_plugin.c | 5 ++++- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index 7f434a37d860..f22d239eebe4 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -789,6 +789,11 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream, if (oss_period_size < 16) return -EINVAL; + + /* don't allocate too large period; 1MB period must be enough */ + if (oss_period_size > 1024 * 1024) + return -ENOMEM; + runtime->oss.period_bytes = oss_period_size; runtime->oss.period_frames = 1; runtime->oss.periods = oss_periods; @@ -1053,10 +1058,9 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) goto failure; } #endif - oss_period_size *= oss_frame_size; - - oss_buffer_size = oss_period_size * runtime->oss.periods; - if (oss_buffer_size < 0) { + oss_period_size = array_size(oss_period_size, oss_frame_size); + oss_buffer_size = array_size(oss_period_size, runtime->oss.periods); + if (oss_buffer_size <= 0) { err = -EINVAL; goto failure; } diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c index 31cb2acf8afc..624aca32fe69 100644 --- a/sound/core/oss/pcm_plugin.c +++ b/sound/core/oss/pcm_plugin.c @@ -61,7 +61,10 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t } if ((width = snd_pcm_format_physical_width(format->format)) < 0) return width; - size = frames * format->channels * width; + size = array3_size(frames, format->channels, width); + /* check for too large period size once again */ + if (size > 1024 * 1024) + return -ENOMEM; if (snd_BUG_ON(size % 8)) return -ENXIO; size /= 8; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
by Jinjiang Tu 25 Mar '25

25 Mar '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.238 commit b0c56a0071116a37c24df998166c22a7e4684626 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3W0 CVE: CVE-2022-49243 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f590797fa3c1bccdd19e55441592a23b46aef449 ] This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak. Fixes: 531f67e41dcd ("ASoC: at91sam9g20ek-wm8731: convert to dt support") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Reviewed-by: Codrin Ciubotariu <codrin.ciubotariu(a)microchip.com> Link: https://lore.kernel.org/r/20220307124539.1743-1-linmq006@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- sound/soc/atmel/sam9g20_wm8731.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c index 98f93e79c654..5041f43ee5f7 100644 --- a/sound/soc/atmel/sam9g20_wm8731.c +++ b/sound/soc/atmel/sam9g20_wm8731.c @@ -225,6 +225,7 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev) cpu_np = of_parse_phandle(np, "atmel,ssc-controller", 0); if (!cpu_np) { dev_err(&pdev->dev, "dai and pcm info missing\n"); + of_node_put(codec_np); return -EINVAL; } at91sam9g20ek_dai.cpu_of_node = cpu_np; -- 2.43.0

2 1

Re: [PATCH OLK-6.6 v2 2/3] arm64: entry: Support hardware xint
by Jinjie Ruan 25 Mar '25

25 Mar '25

On 2025/3/25 15:00, Liao, Chang wrote: > > > 在 2025/3/24 21:53, Jinjie Ruan 写道: >> hulk inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/release-management/issues/IBV2E4 >> >> -------------------------------- >> >> Support hardware xint. Hardware xint provides a separate entry for >> interrupt handling, so we can use it to customize and respond to >> interrupts relatively quickly. >> >> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> >> --- >> v2: >> - Reuse the xint set and check logic in xint 1.0. >> - Introduce fast_handle_xint(). >> - Rename enable_xint_xcall() to enable_xfunc(). >> - Rename test_has_xint_xcall() to test_has_xfunc(). >> - Fix a typo, Harware -> Hardware. >> - Add a blank line after declarations in el0t_64_xint_handler(). >> --- >> arch/arm64/Kconfig | 7 +++ >> arch/arm64/include/asm/sysreg.h | 4 ++ >> arch/arm64/kernel/cpufeature.c | 75 ++++++++++++++++++++++++- >> arch/arm64/kernel/entry-common.c | 35 +++++++++--- >> arch/arm64/kernel/entry.S | 40 +++++++++++++- >> arch/arm64/tools/cpucaps | 2 +- >> drivers/irqchip/irq-gic-v3.c | 89 ++++++++++++++++++++++++++++-- >> include/linux/irqchip/arm-gic-v3.h | 6 +- >> kernel/irq/debugfs.c | 6 +- >> kernel/irq/internals.h | 3 +- >> 10 files changed, 244 insertions(+), 23 deletions(-) >> >> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig >> index 9da9d58f1c02..57d05cfbd29e 100644 >> --- a/arch/arm64/Kconfig >> +++ b/arch/arm64/Kconfig >> @@ -1717,6 +1717,13 @@ config ARCH_DEFAULT_KEXEC_IMAGE_VERIFY_SIG >> config ARCH_SUPPORTS_CRASH_DUMP >> def_bool y >> >> +config ARCH_SUPPORTS_XINT >> + bool "Hardware xint support" >> + default n >> + depends on ARM64_NMI >> + depends on ARM_GIC_V3 >> + depends on !COMPAT >> + >> config TRANS_TABLE >> def_bool y >> depends on HIBERNATION || KEXEC_CORE >> diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h >> index 435634a703c6..b34e8cc4476b 100644 >> --- a/arch/arm64/include/asm/sysreg.h >> +++ b/arch/arm64/include/asm/sysreg.h >> @@ -269,6 +269,10 @@ >> #define SYS_REVIDR_EL1 sys_reg(3, 0, 0, 0, 6) >> >> #define SYS_ACTLR_EL1 sys_reg(3, 0, 1, 0, 1) >> + >> +#define ACTLR_ELx_XINT_SHIFT 21 >> +#define ACTLR_ELx_XINT (BIT(ACTLR_ELx_XINT_SHIFT)) >> + > > I don't think sysreg.h is the best place for those ACTLR_ELx bits. This header's > more about the actual uint32 upcode of system register. not the details of the fields. > And since ACTLR_ELx fields vary implementation. I think we should put them in a new > heade, actlr.h like kernel does with esr.h. > > >> #define SYS_RGSR_EL1 sys_reg(3, 0, 1, 0, 5) >> #define SYS_GCR_EL1 sys_reg(3, 0, 1, 0, 6) >> >> diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c >> index a1736e9044da..b4de05241f7d 100644 >> --- a/arch/arm64/kernel/cpufeature.c >> +++ b/arch/arm64/kernel/cpufeature.c >> @@ -2406,8 +2406,12 @@ static bool has_xcall_support(const struct arm64_cpu_capabilities *entry, int __ >> } >> #endif >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> bool is_xint_support; >> +bool hw_xint_support; >> +#endif >> + >> +#ifdef CONFIG_FAST_IRQ >> static int __init xint_setup(char *str) >> { >> if (!cpus_have_cap(ARM64_HAS_GIC_CPUIF_SYSREGS)) >> @@ -2424,6 +2428,66 @@ static bool has_xint_support(const struct arm64_cpu_capabilities *entry, int __u >> } >> #endif >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +static bool test_has_xfunc(void) > > test_has_xfunc is a bit strange, could we just use has_arch_xint_support()? > >> +{ >> + u64 new, old = read_sysreg(actlr_el1); >> + >> + write_sysreg(old | ACTLR_ELx_XINT, actlr_el1); >> + isb(); >> + new = read_sysreg(actlr_el1); >> + if (new & ACTLR_ELx_XINT) { >> + write_sysreg(old, actlr_el1); >> + hw_xint_support = true; >> + return true; >> + } >> + >> + return false; >> +} >> + >> +static void enable_xfunc(void) > > Could we use cpu_enable_arch_xint()? it is not hard to find some helper functions > in this file has similar role as this. > >> +{ >> + u64 actlr_el1, actlr_el2; >> + u64 el; >> + >> + el = read_sysreg(CurrentEL); >> + if (el == CurrentEL_EL2) { >> + actlr_el2 = read_sysreg(actlr_el2); >> + actlr_el2 |= ACTLR_ELx_XINT; >> + write_sysreg(actlr_el2, actlr_el2); >> + isb(); >> + actlr_el2 = read_sysreg(actlr_el2); >> + pr_info("actlr_el2: %llx, cpu:%d\n", actlr_el2, smp_processor_id()); >> + } >> + >> + actlr_el1 = read_sysreg(actlr_el1); >> + actlr_el1 |= ACTLR_ELx_XINT; >> + write_sysreg(actlr_el1, actlr_el1); >> + isb(); >> + actlr_el1 = read_sysreg(actlr_el1); >> + pr_info("actlr_el1: %llx, cpu:%d\n", actlr_el1, smp_processor_id()); >> +} >> + >> +static bool test_has_xint(const struct arm64_cpu_capabilities *entry, int scope) >> +{ >> + if (!IS_ENABLED(CONFIG_ARM64_NMI)) >> + pr_info("CONFIG_ARM64_NMI disabled, using XINTs for guests only\n"); >> +#ifdef CONFIG_ARM64_PSEUDO_NMI >> + else if (IS_ENABLED(CONFIG_ARM64_PSEUDO_NMI) && enable_pseudo_nmi) { >> + pr_info("Pseudo NMI enabled, not using architected XINT\n"); >> + return false; >> + } >> +#endif >> + >> + return test_has_xfunc(); >> +} > > Fold this function into has_arch_xint_support(). > >> + >> +static void xint_enable(const struct arm64_cpu_capabilities *__unused) >> +{ >> + enable_xfunc(); > > Fold this function into cpu_enable_arch_xint(). > >> +} >> +#endif >> + >> static const struct arm64_cpu_capabilities arm64_features[] = { >> { >> .capability = ARM64_ALWAYS_BOOT, >> @@ -2971,6 +3035,15 @@ static const struct arm64_cpu_capabilities arm64_features[] = { >> .type = ARM64_CPUCAP_SYSTEM_FEATURE, >> .matches = has_xint_support, >> }, >> +#endif >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + { >> + .desc = "Hardware xint Support", > > Mind the ppercase for first letter. > >> + .capability = ARM64_HAS_HW_XINT, >> + .type = ARM64_CPUCAP_SYSTEM_FEATURE, >> + .matches = test_has_xint, >> + .cpu_enable = xint_enable, >> + }, >> #endif > > I really can't recall why we add "Xint support" data into arm64_feature array before. > Just to be clear, "Xint support' is a software solution, it's about making interrupt > handler faster. It's not tied to any particular CPU feature. "Hardware Xint Support" > would means something different, like a real CPU feature. So I think we should take > it out from the arm64_feature array upon CPU can support a hardware xint entry. > >> {}, >> }; >> diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c >> index 4602c107c40a..d09029dfcf02 100644 >> --- a/arch/arm64/kernel/entry-common.c >> +++ b/arch/arm64/kernel/entry-common.c >> @@ -6,6 +6,9 @@ >> */ >> >> #include <linux/context_tracking.h> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +#include <linux/irqchip/arm-gic-v3.h> >> +#endif >> #include <linux/kasan.h> >> #include <linux/linkage.h> >> #include <linux/lockdep.h> >> @@ -607,7 +610,7 @@ static void noinstr el0_xint(struct pt_regs *regs, u64 nmi_flag, >> } >> >> >> -asmlinkage void noinstr el0t_64_xint_handler(struct pt_regs *regs) >> +asmlinkage void noinstr el0t_64_sw_xint_handler(struct pt_regs *regs) >> { >> el0_xint(regs, ISR_EL1_IS, handle_arch_irq, handle_arch_nmi_irq); >> } >> @@ -966,6 +969,30 @@ asmlinkage void noinstr el0t_64_error_handler(struct pt_regs *regs) >> __el0_error_handler_common(regs); >> } >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +asmlinkage void noinstr el0t_64_xint_handler(struct pt_regs *regs) >> +{ >> + u32 irqnr = read_sysreg_s(SYS_ICC_HPPIR1_EL1); >> + >> + if (gic_irqnr_is_special(irqnr)) >> + return; >> + >> + if (is_xint(irqnr)) >> + fast_handle_xint(regs, irqnr); >> + else >> + el0t_64_irq_handler(regs); >> +} > > Could we register fast_handle_xint() in gic-v3 driver, like kernel does for gic_handle_irq() > and gic_handle_nmi_irq(). By checking the return value, it still has chance to fall through > to the regular irq handler. 这里做不到，一旦ACK了，就没法回头了 > >> +#else >> +#ifdef CONFIG_AARCH32_EL0 >> +asmlinkage void noinstr el0t_32_irq_handler(struct pt_regs *regs) >> +{ >> + __el0_irq_handler_common(regs); >> +} >> +#else /* CONFIG_AARCH32_EL0 */ >> +UNHANDLED(el0t, 32, irq) >> +#endif >> +#endif >> + >> #ifdef CONFIG_AARCH32_EL0 >> static void noinstr el0_cp15(struct pt_regs *regs, unsigned long esr) >> { >> @@ -1028,11 +1055,6 @@ asmlinkage void noinstr el0t_32_sync_handler(struct pt_regs *regs) >> } >> } >> >> -asmlinkage void noinstr el0t_32_irq_handler(struct pt_regs *regs) >> -{ >> - __el0_irq_handler_common(regs); >> -} >> - >> asmlinkage void noinstr el0t_32_fiq_handler(struct pt_regs *regs) >> { >> __el0_fiq_handler_common(regs); >> @@ -1044,7 +1066,6 @@ asmlinkage void noinstr el0t_32_error_handler(struct pt_regs *regs) >> } >> #else /* CONFIG_AARCH32_EL0 */ >> UNHANDLED(el0t, 32, sync) >> -UNHANDLED(el0t, 32, irq) >> UNHANDLED(el0t, 32, fiq) >> UNHANDLED(el0t, 32, error) >> #endif /* CONFIG_AARCH32_EL0 */ >> diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S >> index da3809632f0f..046225fa2f90 100644 >> --- a/arch/arm64/kernel/entry.S >> +++ b/arch/arm64/kernel/entry.S >> @@ -565,7 +565,11 @@ SYM_CODE_START(vectors) >> kernel_ventry 0, t, 64, error // Error 64-bit EL0 >> >> kernel_ventry 0, t, 32, sync // Synchronous 32-bit EL0 >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + kernel_ventry 0, t, 64, xint // XINT 64-bit EL0 >> +#else >> kernel_ventry 0, t, 32, irq // IRQ 32-bit EL0 >> +#endif >> kernel_ventry 0, t, 32, fiq // FIQ 32-bit EL0 >> kernel_ventry 0, t, 32, error // Error 32-bit EL0 >> SYM_CODE_END(vectors) >> @@ -696,7 +700,7 @@ SYM_CODE_END(__bad_stack) >> kernel_entry 0, 64 >> #endif >> mov x0, sp >> - bl el0t_64_xint_handler >> + bl el0t_64_sw_xint_handler >> #ifdef CONFIG_SECURITY_FEATURE_BYPASS >> kernel_exit 0, xint >> #else >> @@ -729,6 +733,18 @@ SYM_CODE_START_LOCAL(el\el\ht\()_\regsize\()_\label) >> check_xint_pre_kernel_entry >> .Lskip_check_xint\@: >> .endif >> +#endif >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + .if \el == 0 && \regsize == 64 && \label == xint >> + alternative_if_not ARM64_HAS_HW_XINT >> + b .Lskip_hw_xint\@ >> + alternative_else_nop_endif >> + kernel_entry 0, 64, xint >> + mov x0, sp >> + bl el0t_64_xint_handler >> + kernel_exit 0, xint > > Could we fold the assembly code on else branch into its own macro？ > Let's give a the macro an name that has similar style with the ones > we uses in the code braced by CONFIG_FAST_IRQ/SYSCALL. > >> +.Lskip_hw_xint\@: >> + .endif >> #endif >> kernel_entry \el, \regsize >> mov x0, sp >> @@ -760,7 +776,11 @@ SYM_CODE_END(el\el\ht\()_\regsize\()_\label) >> entry_handler 0, t, 64, error >> >> entry_handler 0, t, 32, sync >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + entry_handler 0, t, 64, xint >> +#else >> entry_handler 0, t, 32, irq >> +#endif >> entry_handler 0, t, 32, fiq >> entry_handler 0, t, 32, error >> >> @@ -905,7 +925,14 @@ alternative_else_nop_endif >> .rept 4 >> tramp_ventry .Lvector_start\@, 64, \kpti, \bhb >> .endr >> - .rept 4 >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + tramp_ventry .Lvector_start\@, 64, \kpti, \bhb >> +#else >> + tramp_ventry .Lvector_start\@, 32, \kpti, \bhb >> +#endif >> + >> + .rept 3 >> tramp_ventry .Lvector_start\@, 32, \kpti, \bhb >> .endr >> .endm >> @@ -955,7 +982,14 @@ SYM_CODE_END(tramp_exit) >> .rept 4 >> tramp_ventry .Lvector_start\@, 64, 0, \bhb >> .endr >> - .rept 4 >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + tramp_ventry .Lvector_start\@, 64, 0, \bhb >> +#else >> + tramp_ventry .Lvector_start\@, 32, 0, \bhb >> +#endif >> + >> + .rept 3 > >> tramp_ventry .Lvector_start\@, 32, 0, \bhb >> .endr >> .endm >> diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps >> index f2ddced689b5..b1f109f17e4f 100644 >> --- a/arch/arm64/tools/cpucaps >> +++ b/arch/arm64/tools/cpucaps >> @@ -110,7 +110,7 @@ WORKAROUND_HISI_HIP08_RU_PREFETCH >> WORKAROUND_HISILICON_1980005 >> HAS_XCALL >> HAS_XINT >> -KABI_RESERVE_3 >> +HAS_HW_XINT >> KABI_RESERVE_4 >> KABI_RESERVE_5 >> KABI_RESERVE_6 >> diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c >> index 4cc8b95d533f..32ffdf06f61e 100644 >> --- a/drivers/irqchip/irq-gic-v3.c >> +++ b/drivers/irqchip/irq-gic-v3.c >> @@ -35,7 +35,7 @@ >> >> #include "irq-gic-common.h" >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> #include "../../../kernel/irq/internals.h" >> #endif >> >> @@ -828,7 +828,7 @@ static bool gic_rpr_is_nmi_prio(void) >> return unlikely(gic_read_rpr() == GICD_INT_RPR_PRI(GICD_INT_NMI_PRI)); >> } >> >> -static bool gic_irqnr_is_special(u32 irqnr) >> +bool gic_irqnr_is_special(u32 irqnr) >> { >> return irqnr >= 1020 && irqnr <= 1023; >> } > > Please don't do this, left it static. > >> @@ -993,7 +993,11 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs >> __gic_handle_irq_from_irqson(regs); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +DECLARE_BITMAP(irqnr_nmi_map, 1024); >> +#endif >> + >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> DECLARE_BITMAP(irqnr_xint_map, 1024); >> >> static bool can_set_xint(unsigned int hwirq) >> @@ -1002,12 +1006,18 @@ static bool can_set_xint(unsigned int hwirq) >> __get_intid_range(hwirq) == SPI_RANGE) >> return true; >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (hw_xint_support && __get_intid_range(hwirq) == PPI_RANGE) >> + return true; >> +#endif >> + >> return false; >> } >> >> static bool xint_transform(int irqno, enum xint_op op) >> { >> struct irq_data *data = irq_get_irq_data(irqno); >> + struct irq_desc *desc; >> int hwirq; >> >> while (data->parent_data) >> @@ -1018,14 +1028,29 @@ static bool xint_transform(int irqno, enum xint_op op) >> if (!can_set_xint(hwirq)) >> return false; >> >> + desc = irq_data_to_desc(data); >> + >> switch (op) { >> case IRQ_TO_XINT: >> set_bit(hwirq, irqnr_xint_map); >> xint_add_debugfs_entry(irqno); >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (has_v3_3_nmi() && hw_xint_support && !irq_is_nmi(desc)) { >> + gic_irq_enable_nmi(data); >> + set_bit(hwirq, irqnr_nmi_map); >> + } >> +#endif >> return true; >> case XINT_TO_IRQ: >> clear_bit(hwirq, irqnr_xint_map); >> xint_remove_debugfs_entry(irqno); >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (has_v3_3_nmi() && hw_xint_support && irq_is_nmi(desc) && >> + test_bit(hwirq, irqnr_nmi_map)) { >> + gic_irq_disable_nmi(data); >> + clear_bit(hwirq, irqnr_nmi_map); >> + } >> +#endif >> return false; >> case XINT_SET_CHECK: >> return test_bit(hwirq, irqnr_xint_map); >> @@ -1096,7 +1121,7 @@ static const struct proc_ops xint_proc_ops = { >> >> void register_irqchip_proc(struct irq_desc *desc, void *irqp) >> { >> - if (!is_xint_support) >> + if (!is_xint_support && !hw_xint_support) >> return; >> >> /* create /proc/irq/<irq>/xint */ >> @@ -1105,12 +1130,63 @@ void register_irqchip_proc(struct irq_desc *desc, void *irqp) >> >> void unregister_irqchip_proc(struct irq_desc *desc) >> { >> - if (!is_xint_support) >> + if (!is_xint_support && !hw_xint_support) >> return; >> >> remove_proc_entry("xint", desc->dir); >> } >> -#endif /* CONFIG_FAST_IRQ */ >> +#endif >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +bool is_xint(unsigned long hwirq) >> +{ >> + return test_bit(hwirq, irqnr_xint_map); >> +} >> + >> +static bool is_spi(unsigned long hwirq) >> +{ >> + if (__get_intid_range(hwirq) == SPI_RANGE || >> + __get_intid_range(hwirq) == ESPI_RANGE) >> + return true; >> + >> + return false; >> +} >> + >> +void fast_handle_xint(struct pt_regs *regs, u32 irqnr) >> +{ >> + struct pt_regs *old_regs; >> + struct irq_domain *domain; >> + struct irqaction *action; >> + struct irq_desc *desc; >> + struct irq_data *data; >> + >> + arch_nmi_enter(); >> + BUG_ON(in_nmi() == NMI_MASK); >> + __preempt_count_add(NMI_OFFSET + HARDIRQ_OFFSET); >> + old_regs = set_irq_regs(regs); >> + >> + domain = irq_get_default_host(); >> + data = radix_tree_lookup(&domain->revmap_tree, irqnr); >> + >> + desc = irq_data_to_desc(data); >> + action = desc->action; >> + >> + gic_read_nmiar(); >> + write_gicreg(irqnr, ICC_EOIR1_EL1); >> + isb(); >> + >> + if (is_spi(irqnr)) >> + action->handler(data->irq, action->dev_id); >> + else >> + action->handler(data->irq, raw_cpu_ptr(action->percpu_dev_id)); >> + gic_write_dir(irqnr); >> + >> + set_irq_regs(old_regs); >> + BUG_ON(!in_nmi()); >> + __preempt_count_sub(NMI_OFFSET + HARDIRQ_OFFSET); >> + arch_nmi_exit(); >> +} >> +#endif >> >> static u32 gic_get_pribits(void) >> { >> @@ -2358,6 +2434,7 @@ static int __init gic_init_bases(phys_addr_t dist_phys_base, >> goto out_free; >> } >> >> + irq_set_default_host(gic_data.domain); >> irq_domain_update_bus_token(gic_data.domain, DOMAIN_BUS_WIRED); >> >> gic_data.has_rss = !!(typer & GICD_TYPER_RSS); >> diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h >> index 548b8a5c46cf..3c0f04b86c15 100644 >> --- a/include/linux/irqchip/arm-gic-v3.h >> +++ b/include/linux/irqchip/arm-gic-v3.h >> @@ -721,8 +721,9 @@ static inline enum gic_intid_range __get_intid_range(irq_hw_number_t hwirq) >> } >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> extern bool is_xint_support; >> +extern bool hw_xint_support; >> >> enum xint_op { >> XINT_TO_IRQ, >> @@ -733,6 +734,9 @@ enum xint_op { >> >> void register_irqchip_proc(struct irq_desc *desc, void *irqp); >> void unregister_irqchip_proc(struct irq_desc *desc); >> +bool gic_irqnr_is_special(u32 irqnr); >> +bool is_xint(unsigned long hwirq); >> +void fast_handle_xint(struct pt_regs *regs, u32 irqnr); >> #endif >> #endif >> >> diff --git a/kernel/irq/debugfs.c b/kernel/irq/debugfs.c >> index dc94c360b54b..2152125f8ae2 100644 >> --- a/kernel/irq/debugfs.c >> +++ b/kernel/irq/debugfs.c >> @@ -242,7 +242,7 @@ void irq_add_debugfs_entry(unsigned int irq, struct irq_desc *desc) >> &dfs_irq_ops); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> static struct dentry *xint_dir; >> >> void xint_add_debugfs_entry(unsigned int irq) >> @@ -281,8 +281,8 @@ static int __init irq_debugfs_init(void) >> >> irq_dir = debugfs_create_dir("irqs", root_dir); >> >> -#ifdef CONFIG_FAST_IRQ >> - if (is_xint_support) >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> + if (is_xint_support || hw_xint_support) >> xint_dir = debugfs_create_dir("xints", root_dir); >> #endif >> >> diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h >> index 2fb08139a9e4..1c64854102f5 100644 >> --- a/kernel/irq/internals.h >> +++ b/kernel/irq/internals.h >> @@ -506,8 +506,9 @@ static inline void irq_remove_debugfs_entry(struct irq_desc *desc) >> kfree(desc->dev_name); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> extern bool is_xint_support; >> +extern bool hw_xint_support; >> >> void xint_add_debugfs_entry(unsigned int irq); >> void xint_remove_debugfs_entry(unsigned int irq); >

1 0

[PATCH openEuler-1.0-LTS] macsec: fix UAF bug for real_dev
by Wang Liang 25 Mar '25

25 Mar '25

From: Ziyang Xuan <william.xuanziyang(a)huawei.com> mainline inclusion from mainline-v5.19-rc1 commit 196a888ca6571deb344468e1d7138e3273206335 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2L3 CVE: CVE-2022-49390 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Create a new macsec device but not get reference to real_dev. That can not ensure that real_dev is freed after macsec. That will trigger the UAF bug for real_dev as following: ================================================================== BUG: KASAN: use-after-free in macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662 Call Trace: ... macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662 dev_get_iflink+0x73/0xe0 net/core/dev.c:637 default_operstate net/core/link_watch.c:42 [inline] rfc2863_policy+0x233/0x2d0 net/core/link_watch.c:54 linkwatch_do_dev+0x2a/0x150 net/core/link_watch.c:161 Allocated by task 22209: ... alloc_netdev_mqs+0x98/0x1100 net/core/dev.c:10549 rtnl_create_link+0x9d7/0xc00 net/core/rtnetlink.c:3235 veth_newlink+0x20e/0xa90 drivers/net/veth.c:1748 Freed by task 8: ... kfree+0xd6/0x4d0 mm/slub.c:4552 kvfree+0x42/0x50 mm/util.c:615 device_release+0x9f/0x240 drivers/base/core.c:2229 kobject_cleanup lib/kobject.c:673 [inline] kobject_release lib/kobject.c:704 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1c8/0x540 lib/kobject.c:721 netdev_run_todo+0x72e/0x10b0 net/core/dev.c:10327 After commit faab39f63c1f ("net: allow out-of-order netdev unregistration") and commit e5f80fcf869a ("ipv6: give an IPv6 dev to blackhole_netdev"), we can add dev_hold_track() in macsec_dev_init() and dev_put_track() in macsec_free_netdev() to fix the problem. Fixes: 2bce1ebed17d ("macsec: fix refcnt leak in module exit routine") Reported-by: syzbot+d0e94b65ac259c29ce7a(a)syzkaller.appspotmail.com Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Link: https://lore.kernel.org/r/20220531074500.1272846-1-william.xuanziyang@huawe… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: drivers/net/macsec.c [conflicts due to not mergered 4d92b95ff2f9 ("net: add net device refcount tracker infrastructure")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/macsec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c index 10a8ef2d025a..a0f565814d30 100644 --- a/drivers/net/macsec.c +++ b/drivers/net/macsec.c @@ -2783,6 +2783,9 @@ static int macsec_dev_init(struct net_device *dev) if (is_zero_ether_addr(dev->broadcast)) memcpy(dev->broadcast, real_dev->broadcast, dev->addr_len); + /* Get macsec's reference to real_dev */ + dev_hold(real_dev); + return 0; } @@ -3009,6 +3012,8 @@ static void macsec_free_netdev(struct net_device *dev) free_percpu(macsec->stats); free_percpu(macsec->secy.tx_sc.stats); + /* Get rid of the macsec's reference to real_dev */ + dev_put(macsec->real_dev); } static void macsec_setup(struct net_device *dev) -- 2.34.1

2 1

Re: [PATCH OLK-6.6 v2 2/3] arm64: entry: Support hardware xint
by Jinjie Ruan 25 Mar '25

25 Mar '25

On 2025/3/25 15:00, Liao, Chang wrote: > > > 在 2025/3/24 21:53, Jinjie Ruan 写道: >> hulk inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/release-management/issues/IBV2E4 >> >> -------------------------------- >> >> Support hardware xint. Hardware xint provides a separate entry for >> interrupt handling, so we can use it to customize and respond to >> interrupts relatively quickly. >> >> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> >> --- >> v2: >> - Reuse the xint set and check logic in xint 1.0. >> - Introduce fast_handle_xint(). >> - Rename enable_xint_xcall() to enable_xfunc(). >> - Rename test_has_xint_xcall() to test_has_xfunc(). >> - Fix a typo, Harware -> Hardware. >> - Add a blank line after declarations in el0t_64_xint_handler(). >> --- >> arch/arm64/Kconfig | 7 +++ >> arch/arm64/include/asm/sysreg.h | 4 ++ >> arch/arm64/kernel/cpufeature.c | 75 ++++++++++++++++++++++++- >> arch/arm64/kernel/entry-common.c | 35 +++++++++--- >> arch/arm64/kernel/entry.S | 40 +++++++++++++- >> arch/arm64/tools/cpucaps | 2 +- >> drivers/irqchip/irq-gic-v3.c | 89 ++++++++++++++++++++++++++++-- >> include/linux/irqchip/arm-gic-v3.h | 6 +- >> kernel/irq/debugfs.c | 6 +- >> kernel/irq/internals.h | 3 +- >> 10 files changed, 244 insertions(+), 23 deletions(-) >> >> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig >> index 9da9d58f1c02..57d05cfbd29e 100644 >> --- a/arch/arm64/Kconfig >> +++ b/arch/arm64/Kconfig >> @@ -1717,6 +1717,13 @@ config ARCH_DEFAULT_KEXEC_IMAGE_VERIFY_SIG >> config ARCH_SUPPORTS_CRASH_DUMP >> def_bool y >> >> +config ARCH_SUPPORTS_XINT >> + bool "Hardware xint support" >> + default n >> + depends on ARM64_NMI >> + depends on ARM_GIC_V3 >> + depends on !COMPAT >> + >> config TRANS_TABLE >> def_bool y >> depends on HIBERNATION || KEXEC_CORE >> diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h >> index 435634a703c6..b34e8cc4476b 100644 >> --- a/arch/arm64/include/asm/sysreg.h >> +++ b/arch/arm64/include/asm/sysreg.h >> @@ -269,6 +269,10 @@ >> #define SYS_REVIDR_EL1 sys_reg(3, 0, 0, 0, 6) >> >> #define SYS_ACTLR_EL1 sys_reg(3, 0, 1, 0, 1) >> + >> +#define ACTLR_ELx_XINT_SHIFT 21 >> +#define ACTLR_ELx_XINT (BIT(ACTLR_ELx_XINT_SHIFT)) >> + > > I don't think sysreg.h is the best place for those ACTLR_ELx bits. This header's > more about the actual uint32 upcode of system register. not the details of the fields. > And since ACTLR_ELx fields vary implementation. I think we should put them in a new > heade, actlr.h like kernel does with esr.h. > > >> #define SYS_RGSR_EL1 sys_reg(3, 0, 1, 0, 5) >> #define SYS_GCR_EL1 sys_reg(3, 0, 1, 0, 6) >> >> diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c >> index a1736e9044da..b4de05241f7d 100644 >> --- a/arch/arm64/kernel/cpufeature.c >> +++ b/arch/arm64/kernel/cpufeature.c >> @@ -2406,8 +2406,12 @@ static bool has_xcall_support(const struct arm64_cpu_capabilities *entry, int __ >> } >> #endif >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> bool is_xint_support; >> +bool hw_xint_support; >> +#endif >> + >> +#ifdef CONFIG_FAST_IRQ >> static int __init xint_setup(char *str) >> { >> if (!cpus_have_cap(ARM64_HAS_GIC_CPUIF_SYSREGS)) >> @@ -2424,6 +2428,66 @@ static bool has_xint_support(const struct arm64_cpu_capabilities *entry, int __u >> } >> #endif >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +static bool test_has_xfunc(void) > > test_has_xfunc is a bit strange, could we just use has_arch_xint_support()? > >> +{ >> + u64 new, old = read_sysreg(actlr_el1); >> + >> + write_sysreg(old | ACTLR_ELx_XINT, actlr_el1); >> + isb(); >> + new = read_sysreg(actlr_el1); >> + if (new & ACTLR_ELx_XINT) { >> + write_sysreg(old, actlr_el1); >> + hw_xint_support = true; >> + return true; >> + } >> + >> + return false; >> +} >> + >> +static void enable_xfunc(void) > > Could we use cpu_enable_arch_xint()? it is not hard to find some helper functions > in this file has similar role as this. > >> +{ >> + u64 actlr_el1, actlr_el2; >> + u64 el; >> + >> + el = read_sysreg(CurrentEL); >> + if (el == CurrentEL_EL2) { >> + actlr_el2 = read_sysreg(actlr_el2); >> + actlr_el2 |= ACTLR_ELx_XINT; >> + write_sysreg(actlr_el2, actlr_el2); >> + isb(); >> + actlr_el2 = read_sysreg(actlr_el2); >> + pr_info("actlr_el2: %llx, cpu:%d\n", actlr_el2, smp_processor_id()); >> + } >> + >> + actlr_el1 = read_sysreg(actlr_el1); >> + actlr_el1 |= ACTLR_ELx_XINT; >> + write_sysreg(actlr_el1, actlr_el1); >> + isb(); >> + actlr_el1 = read_sysreg(actlr_el1); >> + pr_info("actlr_el1: %llx, cpu:%d\n", actlr_el1, smp_processor_id()); >> +} >> + >> +static bool test_has_xint(const struct arm64_cpu_capabilities *entry, int scope) >> +{ >> + if (!IS_ENABLED(CONFIG_ARM64_NMI)) >> + pr_info("CONFIG_ARM64_NMI disabled, using XINTs for guests only\n"); >> +#ifdef CONFIG_ARM64_PSEUDO_NMI >> + else if (IS_ENABLED(CONFIG_ARM64_PSEUDO_NMI) && enable_pseudo_nmi) { >> + pr_info("Pseudo NMI enabled, not using architected XINT\n"); >> + return false; >> + } >> +#endif >> + >> + return test_has_xfunc(); >> +} > > Fold this function into has_arch_xint_support(). > >> + >> +static void xint_enable(const struct arm64_cpu_capabilities *__unused) >> +{ >> + enable_xfunc(); > > Fold this function into cpu_enable_arch_xint(). > >> +} >> +#endif >> + >> static const struct arm64_cpu_capabilities arm64_features[] = { >> { >> .capability = ARM64_ALWAYS_BOOT, >> @@ -2971,6 +3035,15 @@ static const struct arm64_cpu_capabilities arm64_features[] = { >> .type = ARM64_CPUCAP_SYSTEM_FEATURE, >> .matches = has_xint_support, >> }, >> +#endif >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + { >> + .desc = "Hardware xint Support", > > Mind the ppercase for first letter. > >> + .capability = ARM64_HAS_HW_XINT, >> + .type = ARM64_CPUCAP_SYSTEM_FEATURE, >> + .matches = test_has_xint, >> + .cpu_enable = xint_enable, >> + }, >> #endif > > I really can't recall why we add "Xint support" data into arm64_feature array before. > Just to be clear, "Xint support' is a software solution, it's about making interrupt > handler faster. It's not tied to any particular CPU feature. "Hardware Xint Support" > would means something different, like a real CPU feature. So I think we should take > it out from the arm64_feature array upon CPU can support a hardware xint entry. > >> {}, >> }; >> diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c >> index 4602c107c40a..d09029dfcf02 100644 >> --- a/arch/arm64/kernel/entry-common.c >> +++ b/arch/arm64/kernel/entry-common.c >> @@ -6,6 +6,9 @@ >> */ >> >> #include <linux/context_tracking.h> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +#include <linux/irqchip/arm-gic-v3.h> >> +#endif >> #include <linux/kasan.h> >> #include <linux/linkage.h> >> #include <linux/lockdep.h> >> @@ -607,7 +610,7 @@ static void noinstr el0_xint(struct pt_regs *regs, u64 nmi_flag, >> } >> >> >> -asmlinkage void noinstr el0t_64_xint_handler(struct pt_regs *regs) >> +asmlinkage void noinstr el0t_64_sw_xint_handler(struct pt_regs *regs) >> { >> el0_xint(regs, ISR_EL1_IS, handle_arch_irq, handle_arch_nmi_irq); >> } >> @@ -966,6 +969,30 @@ asmlinkage void noinstr el0t_64_error_handler(struct pt_regs *regs) >> __el0_error_handler_common(regs); >> } >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +asmlinkage void noinstr el0t_64_xint_handler(struct pt_regs *regs) >> +{ >> + u32 irqnr = read_sysreg_s(SYS_ICC_HPPIR1_EL1); >> + >> + if (gic_irqnr_is_special(irqnr)) >> + return; >> + >> + if (is_xint(irqnr)) >> + fast_handle_xint(regs, irqnr); >> + else >> + el0t_64_irq_handler(regs); >> +} > > Could we register fast_handle_xint() in gic-v3 driver, like kernel does for gic_handle_irq() > and gic_handle_nmi_irq(). By checking the return value, it still has chance to fall through > to the regular irq handler. > >> +#else >> +#ifdef CONFIG_AARCH32_EL0 >> +asmlinkage void noinstr el0t_32_irq_handler(struct pt_regs *regs) >> +{ >> + __el0_irq_handler_common(regs); >> +} >> +#else /* CONFIG_AARCH32_EL0 */ >> +UNHANDLED(el0t, 32, irq) >> +#endif >> +#endif >> + >> #ifdef CONFIG_AARCH32_EL0 >> static void noinstr el0_cp15(struct pt_regs *regs, unsigned long esr) >> { >> @@ -1028,11 +1055,6 @@ asmlinkage void noinstr el0t_32_sync_handler(struct pt_regs *regs) >> } >> } >> >> -asmlinkage void noinstr el0t_32_irq_handler(struct pt_regs *regs) >> -{ >> - __el0_irq_handler_common(regs); >> -} >> - >> asmlinkage void noinstr el0t_32_fiq_handler(struct pt_regs *regs) >> { >> __el0_fiq_handler_common(regs); >> @@ -1044,7 +1066,6 @@ asmlinkage void noinstr el0t_32_error_handler(struct pt_regs *regs) >> } >> #else /* CONFIG_AARCH32_EL0 */ >> UNHANDLED(el0t, 32, sync) >> -UNHANDLED(el0t, 32, irq) >> UNHANDLED(el0t, 32, fiq) >> UNHANDLED(el0t, 32, error) >> #endif /* CONFIG_AARCH32_EL0 */ >> diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S >> index da3809632f0f..046225fa2f90 100644 >> --- a/arch/arm64/kernel/entry.S >> +++ b/arch/arm64/kernel/entry.S >> @@ -565,7 +565,11 @@ SYM_CODE_START(vectors) >> kernel_ventry 0, t, 64, error // Error 64-bit EL0 >> >> kernel_ventry 0, t, 32, sync // Synchronous 32-bit EL0 >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + kernel_ventry 0, t, 64, xint // XINT 64-bit EL0 >> +#else >> kernel_ventry 0, t, 32, irq // IRQ 32-bit EL0 >> +#endif >> kernel_ventry 0, t, 32, fiq // FIQ 32-bit EL0 >> kernel_ventry 0, t, 32, error // Error 32-bit EL0 >> SYM_CODE_END(vectors) >> @@ -696,7 +700,7 @@ SYM_CODE_END(__bad_stack) >> kernel_entry 0, 64 >> #endif >> mov x0, sp >> - bl el0t_64_xint_handler >> + bl el0t_64_sw_xint_handler >> #ifdef CONFIG_SECURITY_FEATURE_BYPASS >> kernel_exit 0, xint >> #else >> @@ -729,6 +733,18 @@ SYM_CODE_START_LOCAL(el\el\ht\()_\regsize\()_\label) >> check_xint_pre_kernel_entry >> .Lskip_check_xint\@: >> .endif >> +#endif >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + .if \el == 0 && \regsize == 64 && \label == xint >> + alternative_if_not ARM64_HAS_HW_XINT >> + b .Lskip_hw_xint\@ >> + alternative_else_nop_endif >> + kernel_entry 0, 64, xint >> + mov x0, sp >> + bl el0t_64_xint_handler >> + kernel_exit 0, xint > > Could we fold the assembly code on else branch into its own macro？ > Let's give a the macro an name that has similar style with the ones > we uses in the code braced by CONFIG_FAST_IRQ/SYSCALL. 软件方案需要检查，硬件方案不需要这些检查逻辑，从xcall/xint这个入口进来就确定了是xcall/xint > >> +.Lskip_hw_xint\@: >> + .endif >> #endif >> kernel_entry \el, \regsize >> mov x0, sp >> @@ -760,7 +776,11 @@ SYM_CODE_END(el\el\ht\()_\regsize\()_\label) >> entry_handler 0, t, 64, error >> >> entry_handler 0, t, 32, sync >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + entry_handler 0, t, 64, xint >> +#else >> entry_handler 0, t, 32, irq >> +#endif >> entry_handler 0, t, 32, fiq >> entry_handler 0, t, 32, error >> >> @@ -905,7 +925,14 @@ alternative_else_nop_endif >> .rept 4 >> tramp_ventry .Lvector_start\@, 64, \kpti, \bhb >> .endr >> - .rept 4 >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + tramp_ventry .Lvector_start\@, 64, \kpti, \bhb >> +#else >> + tramp_ventry .Lvector_start\@, 32, \kpti, \bhb >> +#endif >> + >> + .rept 3 >> tramp_ventry .Lvector_start\@, 32, \kpti, \bhb >> .endr >> .endm >> @@ -955,7 +982,14 @@ SYM_CODE_END(tramp_exit) >> .rept 4 >> tramp_ventry .Lvector_start\@, 64, 0, \bhb >> .endr >> - .rept 4 >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + tramp_ventry .Lvector_start\@, 64, 0, \bhb >> +#else >> + tramp_ventry .Lvector_start\@, 32, 0, \bhb >> +#endif >> + >> + .rept 3 > >> tramp_ventry .Lvector_start\@, 32, 0, \bhb >> .endr >> .endm >> diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps >> index f2ddced689b5..b1f109f17e4f 100644 >> --- a/arch/arm64/tools/cpucaps >> +++ b/arch/arm64/tools/cpucaps >> @@ -110,7 +110,7 @@ WORKAROUND_HISI_HIP08_RU_PREFETCH >> WORKAROUND_HISILICON_1980005 >> HAS_XCALL >> HAS_XINT >> -KABI_RESERVE_3 >> +HAS_HW_XINT >> KABI_RESERVE_4 >> KABI_RESERVE_5 >> KABI_RESERVE_6 >> diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c >> index 4cc8b95d533f..32ffdf06f61e 100644 >> --- a/drivers/irqchip/irq-gic-v3.c >> +++ b/drivers/irqchip/irq-gic-v3.c >> @@ -35,7 +35,7 @@ >> >> #include "irq-gic-common.h" >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> #include "../../../kernel/irq/internals.h" >> #endif >> >> @@ -828,7 +828,7 @@ static bool gic_rpr_is_nmi_prio(void) >> return unlikely(gic_read_rpr() == GICD_INT_RPR_PRI(GICD_INT_NMI_PRI)); >> } >> >> -static bool gic_irqnr_is_special(u32 irqnr) >> +bool gic_irqnr_is_special(u32 irqnr) >> { >> return irqnr >= 1020 && irqnr <= 1023; >> } > > Please don't do this, left it static. > >> @@ -993,7 +993,11 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs >> __gic_handle_irq_from_irqson(regs); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +DECLARE_BITMAP(irqnr_nmi_map, 1024); >> +#endif >> + >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> DECLARE_BITMAP(irqnr_xint_map, 1024); >> >> static bool can_set_xint(unsigned int hwirq) >> @@ -1002,12 +1006,18 @@ static bool can_set_xint(unsigned int hwirq) >> __get_intid_range(hwirq) == SPI_RANGE) >> return true; >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (hw_xint_support && __get_intid_range(hwirq) == PPI_RANGE) >> + return true; >> +#endif >> + >> return false; >> } >> >> static bool xint_transform(int irqno, enum xint_op op) >> { >> struct irq_data *data = irq_get_irq_data(irqno); >> + struct irq_desc *desc; >> int hwirq; >> >> while (data->parent_data) >> @@ -1018,14 +1028,29 @@ static bool xint_transform(int irqno, enum xint_op op) >> if (!can_set_xint(hwirq)) >> return false; >> >> + desc = irq_data_to_desc(data); >> + >> switch (op) { >> case IRQ_TO_XINT: >> set_bit(hwirq, irqnr_xint_map); >> xint_add_debugfs_entry(irqno); >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (has_v3_3_nmi() && hw_xint_support && !irq_is_nmi(desc)) { >> + gic_irq_enable_nmi(data); >> + set_bit(hwirq, irqnr_nmi_map); >> + } >> +#endif >> return true; >> case XINT_TO_IRQ: >> clear_bit(hwirq, irqnr_xint_map); >> xint_remove_debugfs_entry(irqno); >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (has_v3_3_nmi() && hw_xint_support && irq_is_nmi(desc) && >> + test_bit(hwirq, irqnr_nmi_map)) { >> + gic_irq_disable_nmi(data); >> + clear_bit(hwirq, irqnr_nmi_map); >> + } >> +#endif >> return false; >> case XINT_SET_CHECK: >> return test_bit(hwirq, irqnr_xint_map); >> @@ -1096,7 +1121,7 @@ static const struct proc_ops xint_proc_ops = { >> >> void register_irqchip_proc(struct irq_desc *desc, void *irqp) >> { >> - if (!is_xint_support) >> + if (!is_xint_support && !hw_xint_support) >> return; >> >> /* create /proc/irq/<irq>/xint */ >> @@ -1105,12 +1130,63 @@ void register_irqchip_proc(struct irq_desc *desc, void *irqp) >> >> void unregister_irqchip_proc(struct irq_desc *desc) >> { >> - if (!is_xint_support) >> + if (!is_xint_support && !hw_xint_support) >> return; >> >> remove_proc_entry("xint", desc->dir); >> } >> -#endif /* CONFIG_FAST_IRQ */ >> +#endif >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +bool is_xint(unsigned long hwirq) >> +{ >> + return test_bit(hwirq, irqnr_xint_map); >> +} >> + >> +static bool is_spi(unsigned long hwirq) >> +{ >> + if (__get_intid_range(hwirq) == SPI_RANGE || >> + __get_intid_range(hwirq) == ESPI_RANGE) >> + return true; >> + >> + return false; >> +} >> + >> +void fast_handle_xint(struct pt_regs *regs, u32 irqnr) >> +{ >> + struct pt_regs *old_regs; >> + struct irq_domain *domain; >> + struct irqaction *action; >> + struct irq_desc *desc; >> + struct irq_data *data; >> + >> + arch_nmi_enter(); >> + BUG_ON(in_nmi() == NMI_MASK); >> + __preempt_count_add(NMI_OFFSET + HARDIRQ_OFFSET); >> + old_regs = set_irq_regs(regs); >> + >> + domain = irq_get_default_host(); >> + data = radix_tree_lookup(&domain->revmap_tree, irqnr); >> + >> + desc = irq_data_to_desc(data); >> + action = desc->action; >> + >> + gic_read_nmiar(); >> + write_gicreg(irqnr, ICC_EOIR1_EL1); >> + isb(); >> + >> + if (is_spi(irqnr)) >> + action->handler(data->irq, action->dev_id); >> + else >> + action->handler(data->irq, raw_cpu_ptr(action->percpu_dev_id)); >> + gic_write_dir(irqnr); >> + >> + set_irq_regs(old_regs); >> + BUG_ON(!in_nmi()); >> + __preempt_count_sub(NMI_OFFSET + HARDIRQ_OFFSET); >> + arch_nmi_exit(); >> +} >> +#endif >> >> static u32 gic_get_pribits(void) >> { >> @@ -2358,6 +2434,7 @@ static int __init gic_init_bases(phys_addr_t dist_phys_base, >> goto out_free; >> } >> >> + irq_set_default_host(gic_data.domain); >> irq_domain_update_bus_token(gic_data.domain, DOMAIN_BUS_WIRED); >> >> gic_data.has_rss = !!(typer & GICD_TYPER_RSS); >> diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h >> index 548b8a5c46cf..3c0f04b86c15 100644 >> --- a/include/linux/irqchip/arm-gic-v3.h >> +++ b/include/linux/irqchip/arm-gic-v3.h >> @@ -721,8 +721,9 @@ static inline enum gic_intid_range __get_intid_range(irq_hw_number_t hwirq) >> } >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> extern bool is_xint_support; >> +extern bool hw_xint_support; >> >> enum xint_op { >> XINT_TO_IRQ, >> @@ -733,6 +734,9 @@ enum xint_op { >> >> void register_irqchip_proc(struct irq_desc *desc, void *irqp); >> void unregister_irqchip_proc(struct irq_desc *desc); >> +bool gic_irqnr_is_special(u32 irqnr); >> +bool is_xint(unsigned long hwirq); >> +void fast_handle_xint(struct pt_regs *regs, u32 irqnr); >> #endif >> #endif >> >> diff --git a/kernel/irq/debugfs.c b/kernel/irq/debugfs.c >> index dc94c360b54b..2152125f8ae2 100644 >> --- a/kernel/irq/debugfs.c >> +++ b/kernel/irq/debugfs.c >> @@ -242,7 +242,7 @@ void irq_add_debugfs_entry(unsigned int irq, struct irq_desc *desc) >> &dfs_irq_ops); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> static struct dentry *xint_dir; >> >> void xint_add_debugfs_entry(unsigned int irq) >> @@ -281,8 +281,8 @@ static int __init irq_debugfs_init(void) >> >> irq_dir = debugfs_create_dir("irqs", root_dir); >> >> -#ifdef CONFIG_FAST_IRQ >> - if (is_xint_support) >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> + if (is_xint_support || hw_xint_support) >> xint_dir = debugfs_create_dir("xints", root_dir); >> #endif >> >> diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h >> index 2fb08139a9e4..1c64854102f5 100644 >> --- a/kernel/irq/internals.h >> +++ b/kernel/irq/internals.h >> @@ -506,8 +506,9 @@ static inline void irq_remove_debugfs_entry(struct irq_desc *desc) >> kfree(desc->dev_name); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> extern bool is_xint_support; >> +extern bool hw_xint_support; >> >> void xint_add_debugfs_entry(unsigned int irq); >> void xint_remove_debugfs_entry(unsigned int irq); >

1 0

Re: [PATCH OLK-6.6 v2 2/3] arm64: entry: Support hardware xint
by Jinjie Ruan 25 Mar '25

25 Mar '25

On 2025/3/25 15:00, Liao, Chang wrote: > > > 在 2025/3/24 21:53, Jinjie Ruan 写道: >> hulk inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/release-management/issues/IBV2E4 >> >> -------------------------------- >> >> Support hardware xint. Hardware xint provides a separate entry for >> interrupt handling, so we can use it to customize and respond to >> interrupts relatively quickly. >> >> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> >> --- >> v2: >> - Reuse the xint set and check logic in xint 1.0. >> - Introduce fast_handle_xint(). >> - Rename enable_xint_xcall() to enable_xfunc(). >> - Rename test_has_xint_xcall() to test_has_xfunc(). >> - Fix a typo, Harware -> Hardware. >> - Add a blank line after declarations in el0t_64_xint_handler(). >> --- >> arch/arm64/Kconfig | 7 +++ >> arch/arm64/include/asm/sysreg.h | 4 ++ >> arch/arm64/kernel/cpufeature.c | 75 ++++++++++++++++++++++++- >> arch/arm64/kernel/entry-common.c | 35 +++++++++--- >> arch/arm64/kernel/entry.S | 40 +++++++++++++- >> arch/arm64/tools/cpucaps | 2 +- >> drivers/irqchip/irq-gic-v3.c | 89 ++++++++++++++++++++++++++++-- >> include/linux/irqchip/arm-gic-v3.h | 6 +- >> kernel/irq/debugfs.c | 6 +- >> kernel/irq/internals.h | 3 +- >> 10 files changed, 244 insertions(+), 23 deletions(-) >> >> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig >> index 9da9d58f1c02..57d05cfbd29e 100644 >> --- a/arch/arm64/Kconfig >> +++ b/arch/arm64/Kconfig >> @@ -1717,6 +1717,13 @@ config ARCH_DEFAULT_KEXEC_IMAGE_VERIFY_SIG >> config ARCH_SUPPORTS_CRASH_DUMP >> def_bool y >> >> +config ARCH_SUPPORTS_XINT >> + bool "Hardware xint support" >> + default n >> + depends on ARM64_NMI >> + depends on ARM_GIC_V3 >> + depends on !COMPAT >> + >> config TRANS_TABLE >> def_bool y >> depends on HIBERNATION || KEXEC_CORE >> diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h >> index 435634a703c6..b34e8cc4476b 100644 >> --- a/arch/arm64/include/asm/sysreg.h >> +++ b/arch/arm64/include/asm/sysreg.h >> @@ -269,6 +269,10 @@ >> #define SYS_REVIDR_EL1 sys_reg(3, 0, 0, 0, 6) >> >> #define SYS_ACTLR_EL1 sys_reg(3, 0, 1, 0, 1) >> + >> +#define ACTLR_ELx_XINT_SHIFT 21 >> +#define ACTLR_ELx_XINT (BIT(ACTLR_ELx_XINT_SHIFT)) >> + > > I don't think sysreg.h is the best place for those ACTLR_ELx bits. This header's > more about the actual uint32 upcode of system register. not the details of the fields. > And since ACTLR_ELx fields vary implementation. I think we should put them in a new > heade, actlr.h like kernel does with esr.h. > > >> #define SYS_RGSR_EL1 sys_reg(3, 0, 1, 0, 5) >> #define SYS_GCR_EL1 sys_reg(3, 0, 1, 0, 6) >> >> diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c >> index a1736e9044da..b4de05241f7d 100644 >> --- a/arch/arm64/kernel/cpufeature.c >> +++ b/arch/arm64/kernel/cpufeature.c >> @@ -2406,8 +2406,12 @@ static bool has_xcall_support(const struct arm64_cpu_capabilities *entry, int __ >> } >> #endif >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> bool is_xint_support; >> +bool hw_xint_support; >> +#endif >> + >> +#ifdef CONFIG_FAST_IRQ >> static int __init xint_setup(char *str) >> { >> if (!cpus_have_cap(ARM64_HAS_GIC_CPUIF_SYSREGS)) >> @@ -2424,6 +2428,66 @@ static bool has_xint_support(const struct arm64_cpu_capabilities *entry, int __u >> } >> #endif >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +static bool test_has_xfunc(void) > > test_has_xfunc is a bit strange, could we just use has_arch_xint_support()? > >> +{ >> + u64 new, old = read_sysreg(actlr_el1); >> + >> + write_sysreg(old | ACTLR_ELx_XINT, actlr_el1); >> + isb(); >> + new = read_sysreg(actlr_el1); >> + if (new & ACTLR_ELx_XINT) { >> + write_sysreg(old, actlr_el1); >> + hw_xint_support = true; >> + return true; >> + } >> + >> + return false; >> +} >> + >> +static void enable_xfunc(void) > > Could we use cpu_enable_arch_xint()? it is not hard to find some helper functions > in this file has similar role as this. > >> +{ >> + u64 actlr_el1, actlr_el2; >> + u64 el; >> + >> + el = read_sysreg(CurrentEL); >> + if (el == CurrentEL_EL2) { >> + actlr_el2 = read_sysreg(actlr_el2); >> + actlr_el2 |= ACTLR_ELx_XINT; >> + write_sysreg(actlr_el2, actlr_el2); >> + isb(); >> + actlr_el2 = read_sysreg(actlr_el2); >> + pr_info("actlr_el2: %llx, cpu:%d\n", actlr_el2, smp_processor_id()); >> + } >> + >> + actlr_el1 = read_sysreg(actlr_el1); >> + actlr_el1 |= ACTLR_ELx_XINT; >> + write_sysreg(actlr_el1, actlr_el1); >> + isb(); >> + actlr_el1 = read_sysreg(actlr_el1); >> + pr_info("actlr_el1: %llx, cpu:%d\n", actlr_el1, smp_processor_id()); >> +} >> + >> +static bool test_has_xint(const struct arm64_cpu_capabilities *entry, int scope) >> +{ >> + if (!IS_ENABLED(CONFIG_ARM64_NMI)) >> + pr_info("CONFIG_ARM64_NMI disabled, using XINTs for guests only\n"); >> +#ifdef CONFIG_ARM64_PSEUDO_NMI >> + else if (IS_ENABLED(CONFIG_ARM64_PSEUDO_NMI) && enable_pseudo_nmi) { >> + pr_info("Pseudo NMI enabled, not using architected XINT\n"); >> + return false; >> + } >> +#endif >> + >> + return test_has_xfunc(); >> +} > > Fold this function into has_arch_xint_support(). > >> + >> +static void xint_enable(const struct arm64_cpu_capabilities *__unused) >> +{ >> + enable_xfunc(); > > Fold this function into cpu_enable_arch_xint(). > >> +} >> +#endif >> + >> static const struct arm64_cpu_capabilities arm64_features[] = { >> { >> .capability = ARM64_ALWAYS_BOOT, >> @@ -2971,6 +3035,15 @@ static const struct arm64_cpu_capabilities arm64_features[] = { >> .type = ARM64_CPUCAP_SYSTEM_FEATURE, >> .matches = has_xint_support, >> }, >> +#endif >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + { >> + .desc = "Hardware xint Support", > > Mind the ppercase for first letter. > >> + .capability = ARM64_HAS_HW_XINT, >> + .type = ARM64_CPUCAP_SYSTEM_FEATURE, >> + .matches = test_has_xint, >> + .cpu_enable = xint_enable, >> + }, >> #endif > > I really can't recall why we add "Xint support" data into arm64_feature array before. > Just to be clear, "Xint support' is a software solution, it's about making interrupt > handler faster. It's not tied to any particular CPU feature. "Hardware Xint Support" > would means something different, like a real CPU feature. So I think we should take > it out from the arm64_feature array upon CPU can support a hardware xint entry. 这个在实现xcall/xint 1.0代码的时候，是为了和后面硬件xcall/xint的检测代码兼容吧，当时检视意见是统一和xcall一样这样做 @邹贻鹏 > >> {}, >> }; >> diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c >> index 4602c107c40a..d09029dfcf02 100644 >> --- a/arch/arm64/kernel/entry-common.c >> +++ b/arch/arm64/kernel/entry-common.c >> @@ -6,6 +6,9 @@ >> */ >> >> #include <linux/context_tracking.h> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +#include <linux/irqchip/arm-gic-v3.h> >> +#endif >> #include <linux/kasan.h> >> #include <linux/linkage.h> >> #include <linux/lockdep.h> >> @@ -607,7 +610,7 @@ static void noinstr el0_xint(struct pt_regs *regs, u64 nmi_flag, >> } >> >> >> -asmlinkage void noinstr el0t_64_xint_handler(struct pt_regs *regs) >> +asmlinkage void noinstr el0t_64_sw_xint_handler(struct pt_regs *regs) >> { >> el0_xint(regs, ISR_EL1_IS, handle_arch_irq, handle_arch_nmi_irq); >> } >> @@ -966,6 +969,30 @@ asmlinkage void noinstr el0t_64_error_handler(struct pt_regs *regs) >> __el0_error_handler_common(regs); >> } >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +asmlinkage void noinstr el0t_64_xint_handler(struct pt_regs *regs) >> +{ >> + u32 irqnr = read_sysreg_s(SYS_ICC_HPPIR1_EL1); >> + >> + if (gic_irqnr_is_special(irqnr)) >> + return; >> + >> + if (is_xint(irqnr)) >> + fast_handle_xint(regs, irqnr); >> + else >> + el0t_64_irq_handler(regs); >> +} > > Could we register fast_handle_xint() in gic-v3 driver, like kernel does for gic_handle_irq() > and gic_handle_nmi_irq(). By checking the return value, it still has chance to fall through > to the regular irq handler. > >> +#else >> +#ifdef CONFIG_AARCH32_EL0 >> +asmlinkage void noinstr el0t_32_irq_handler(struct pt_regs *regs) >> +{ >> + __el0_irq_handler_common(regs); >> +} >> +#else /* CONFIG_AARCH32_EL0 */ >> +UNHANDLED(el0t, 32, irq) >> +#endif >> +#endif >> + >> #ifdef CONFIG_AARCH32_EL0 >> static void noinstr el0_cp15(struct pt_regs *regs, unsigned long esr) >> { >> @@ -1028,11 +1055,6 @@ asmlinkage void noinstr el0t_32_sync_handler(struct pt_regs *regs) >> } >> } >> >> -asmlinkage void noinstr el0t_32_irq_handler(struct pt_regs *regs) >> -{ >> - __el0_irq_handler_common(regs); >> -} >> - >> asmlinkage void noinstr el0t_32_fiq_handler(struct pt_regs *regs) >> { >> __el0_fiq_handler_common(regs); >> @@ -1044,7 +1066,6 @@ asmlinkage void noinstr el0t_32_error_handler(struct pt_regs *regs) >> } >> #else /* CONFIG_AARCH32_EL0 */ >> UNHANDLED(el0t, 32, sync) >> -UNHANDLED(el0t, 32, irq) >> UNHANDLED(el0t, 32, fiq) >> UNHANDLED(el0t, 32, error) >> #endif /* CONFIG_AARCH32_EL0 */ >> diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S >> index da3809632f0f..046225fa2f90 100644 >> --- a/arch/arm64/kernel/entry.S >> +++ b/arch/arm64/kernel/entry.S >> @@ -565,7 +565,11 @@ SYM_CODE_START(vectors) >> kernel_ventry 0, t, 64, error // Error 64-bit EL0 >> >> kernel_ventry 0, t, 32, sync // Synchronous 32-bit EL0 >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + kernel_ventry 0, t, 64, xint // XINT 64-bit EL0 >> +#else >> kernel_ventry 0, t, 32, irq // IRQ 32-bit EL0 >> +#endif >> kernel_ventry 0, t, 32, fiq // FIQ 32-bit EL0 >> kernel_ventry 0, t, 32, error // Error 32-bit EL0 >> SYM_CODE_END(vectors) >> @@ -696,7 +700,7 @@ SYM_CODE_END(__bad_stack) >> kernel_entry 0, 64 >> #endif >> mov x0, sp >> - bl el0t_64_xint_handler >> + bl el0t_64_sw_xint_handler >> #ifdef CONFIG_SECURITY_FEATURE_BYPASS >> kernel_exit 0, xint >> #else >> @@ -729,6 +733,18 @@ SYM_CODE_START_LOCAL(el\el\ht\()_\regsize\()_\label) >> check_xint_pre_kernel_entry >> .Lskip_check_xint\@: >> .endif >> +#endif >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + .if \el == 0 && \regsize == 64 && \label == xint >> + alternative_if_not ARM64_HAS_HW_XINT >> + b .Lskip_hw_xint\@ >> + alternative_else_nop_endif >> + kernel_entry 0, 64, xint >> + mov x0, sp >> + bl el0t_64_xint_handler >> + kernel_exit 0, xint > > Could we fold the assembly code on else branch into its own macro？ > Let's give a the macro an name that has similar style with the ones > we uses in the code braced by CONFIG_FAST_IRQ/SYSCALL. > >> +.Lskip_hw_xint\@: >> + .endif >> #endif >> kernel_entry \el, \regsize >> mov x0, sp >> @@ -760,7 +776,11 @@ SYM_CODE_END(el\el\ht\()_\regsize\()_\label) >> entry_handler 0, t, 64, error >> >> entry_handler 0, t, 32, sync >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + entry_handler 0, t, 64, xint >> +#else >> entry_handler 0, t, 32, irq >> +#endif >> entry_handler 0, t, 32, fiq >> entry_handler 0, t, 32, error >> >> @@ -905,7 +925,14 @@ alternative_else_nop_endif >> .rept 4 >> tramp_ventry .Lvector_start\@, 64, \kpti, \bhb >> .endr >> - .rept 4 >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + tramp_ventry .Lvector_start\@, 64, \kpti, \bhb >> +#else >> + tramp_ventry .Lvector_start\@, 32, \kpti, \bhb >> +#endif >> + >> + .rept 3 >> tramp_ventry .Lvector_start\@, 32, \kpti, \bhb >> .endr >> .endm >> @@ -955,7 +982,14 @@ SYM_CODE_END(tramp_exit) >> .rept 4 >> tramp_ventry .Lvector_start\@, 64, 0, \bhb >> .endr >> - .rept 4 >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + tramp_ventry .Lvector_start\@, 64, 0, \bhb >> +#else >> + tramp_ventry .Lvector_start\@, 32, 0, \bhb >> +#endif >> + >> + .rept 3 > >> tramp_ventry .Lvector_start\@, 32, 0, \bhb >> .endr >> .endm >> diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps >> index f2ddced689b5..b1f109f17e4f 100644 >> --- a/arch/arm64/tools/cpucaps >> +++ b/arch/arm64/tools/cpucaps >> @@ -110,7 +110,7 @@ WORKAROUND_HISI_HIP08_RU_PREFETCH >> WORKAROUND_HISILICON_1980005 >> HAS_XCALL >> HAS_XINT >> -KABI_RESERVE_3 >> +HAS_HW_XINT >> KABI_RESERVE_4 >> KABI_RESERVE_5 >> KABI_RESERVE_6 >> diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c >> index 4cc8b95d533f..32ffdf06f61e 100644 >> --- a/drivers/irqchip/irq-gic-v3.c >> +++ b/drivers/irqchip/irq-gic-v3.c >> @@ -35,7 +35,7 @@ >> >> #include "irq-gic-common.h" >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> #include "../../../kernel/irq/internals.h" >> #endif >> >> @@ -828,7 +828,7 @@ static bool gic_rpr_is_nmi_prio(void) >> return unlikely(gic_read_rpr() == GICD_INT_RPR_PRI(GICD_INT_NMI_PRI)); >> } >> >> -static bool gic_irqnr_is_special(u32 irqnr) >> +bool gic_irqnr_is_special(u32 irqnr) >> { >> return irqnr >= 1020 && irqnr <= 1023; >> } > > Please don't do this, left it static. > >> @@ -993,7 +993,11 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs >> __gic_handle_irq_from_irqson(regs); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +DECLARE_BITMAP(irqnr_nmi_map, 1024); >> +#endif >> + >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> DECLARE_BITMAP(irqnr_xint_map, 1024); >> >> static bool can_set_xint(unsigned int hwirq) >> @@ -1002,12 +1006,18 @@ static bool can_set_xint(unsigned int hwirq) >> __get_intid_range(hwirq) == SPI_RANGE) >> return true; >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (hw_xint_support && __get_intid_range(hwirq) == PPI_RANGE) >> + return true; >> +#endif >> + >> return false; >> } >> >> static bool xint_transform(int irqno, enum xint_op op) >> { >> struct irq_data *data = irq_get_irq_data(irqno); >> + struct irq_desc *desc; >> int hwirq; >> >> while (data->parent_data) >> @@ -1018,14 +1028,29 @@ static bool xint_transform(int irqno, enum xint_op op) >> if (!can_set_xint(hwirq)) >> return false; >> >> + desc = irq_data_to_desc(data); >> + >> switch (op) { >> case IRQ_TO_XINT: >> set_bit(hwirq, irqnr_xint_map); >> xint_add_debugfs_entry(irqno); >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (has_v3_3_nmi() && hw_xint_support && !irq_is_nmi(desc)) { >> + gic_irq_enable_nmi(data); >> + set_bit(hwirq, irqnr_nmi_map); >> + } >> +#endif >> return true; >> case XINT_TO_IRQ: >> clear_bit(hwirq, irqnr_xint_map); >> xint_remove_debugfs_entry(irqno); >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (has_v3_3_nmi() && hw_xint_support && irq_is_nmi(desc) && >> + test_bit(hwirq, irqnr_nmi_map)) { >> + gic_irq_disable_nmi(data); >> + clear_bit(hwirq, irqnr_nmi_map); >> + } >> +#endif >> return false; >> case XINT_SET_CHECK: >> return test_bit(hwirq, irqnr_xint_map); >> @@ -1096,7 +1121,7 @@ static const struct proc_ops xint_proc_ops = { >> >> void register_irqchip_proc(struct irq_desc *desc, void *irqp) >> { >> - if (!is_xint_support) >> + if (!is_xint_support && !hw_xint_support) >> return; >> >> /* create /proc/irq/<irq>/xint */ >> @@ -1105,12 +1130,63 @@ void register_irqchip_proc(struct irq_desc *desc, void *irqp) >> >> void unregister_irqchip_proc(struct irq_desc *desc) >> { >> - if (!is_xint_support) >> + if (!is_xint_support && !hw_xint_support) >> return; >> >> remove_proc_entry("xint", desc->dir); >> } >> -#endif /* CONFIG_FAST_IRQ */ >> +#endif >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +bool is_xint(unsigned long hwirq) >> +{ >> + return test_bit(hwirq, irqnr_xint_map); >> +} >> + >> +static bool is_spi(unsigned long hwirq) >> +{ >> + if (__get_intid_range(hwirq) == SPI_RANGE || >> + __get_intid_range(hwirq) == ESPI_RANGE) >> + return true; >> + >> + return false; >> +} >> + >> +void fast_handle_xint(struct pt_regs *regs, u32 irqnr) >> +{ >> + struct pt_regs *old_regs; >> + struct irq_domain *domain; >> + struct irqaction *action; >> + struct irq_desc *desc; >> + struct irq_data *data; >> + >> + arch_nmi_enter(); >> + BUG_ON(in_nmi() == NMI_MASK); >> + __preempt_count_add(NMI_OFFSET + HARDIRQ_OFFSET); >> + old_regs = set_irq_regs(regs); >> + >> + domain = irq_get_default_host(); >> + data = radix_tree_lookup(&domain->revmap_tree, irqnr); >> + >> + desc = irq_data_to_desc(data); >> + action = desc->action; >> + >> + gic_read_nmiar(); >> + write_gicreg(irqnr, ICC_EOIR1_EL1); >> + isb(); >> + >> + if (is_spi(irqnr)) >> + action->handler(data->irq, action->dev_id); >> + else >> + action->handler(data->irq, raw_cpu_ptr(action->percpu_dev_id)); >> + gic_write_dir(irqnr); >> + >> + set_irq_regs(old_regs); >> + BUG_ON(!in_nmi()); >> + __preempt_count_sub(NMI_OFFSET + HARDIRQ_OFFSET); >> + arch_nmi_exit(); >> +} >> +#endif >> >> static u32 gic_get_pribits(void) >> { >> @@ -2358,6 +2434,7 @@ static int __init gic_init_bases(phys_addr_t dist_phys_base, >> goto out_free; >> } >> >> + irq_set_default_host(gic_data.domain); >> irq_domain_update_bus_token(gic_data.domain, DOMAIN_BUS_WIRED); >> >> gic_data.has_rss = !!(typer & GICD_TYPER_RSS); >> diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h >> index 548b8a5c46cf..3c0f04b86c15 100644 >> --- a/include/linux/irqchip/arm-gic-v3.h >> +++ b/include/linux/irqchip/arm-gic-v3.h >> @@ -721,8 +721,9 @@ static inline enum gic_intid_range __get_intid_range(irq_hw_number_t hwirq) >> } >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> extern bool is_xint_support; >> +extern bool hw_xint_support; >> >> enum xint_op { >> XINT_TO_IRQ, >> @@ -733,6 +734,9 @@ enum xint_op { >> >> void register_irqchip_proc(struct irq_desc *desc, void *irqp); >> void unregister_irqchip_proc(struct irq_desc *desc); >> +bool gic_irqnr_is_special(u32 irqnr); >> +bool is_xint(unsigned long hwirq); >> +void fast_handle_xint(struct pt_regs *regs, u32 irqnr); >> #endif >> #endif >> >> diff --git a/kernel/irq/debugfs.c b/kernel/irq/debugfs.c >> index dc94c360b54b..2152125f8ae2 100644 >> --- a/kernel/irq/debugfs.c >> +++ b/kernel/irq/debugfs.c >> @@ -242,7 +242,7 @@ void irq_add_debugfs_entry(unsigned int irq, struct irq_desc *desc) >> &dfs_irq_ops); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> static struct dentry *xint_dir; >> >> void xint_add_debugfs_entry(unsigned int irq) >> @@ -281,8 +281,8 @@ static int __init irq_debugfs_init(void) >> >> irq_dir = debugfs_create_dir("irqs", root_dir); >> >> -#ifdef CONFIG_FAST_IRQ >> - if (is_xint_support) >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> + if (is_xint_support || hw_xint_support) >> xint_dir = debugfs_create_dir("xints", root_dir); >> #endif >> >> diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h >> index 2fb08139a9e4..1c64854102f5 100644 >> --- a/kernel/irq/internals.h >> +++ b/kernel/irq/internals.h >> @@ -506,8 +506,9 @@ static inline void irq_remove_debugfs_entry(struct irq_desc *desc) >> kfree(desc->dev_name); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> extern bool is_xint_support; >> +extern bool hw_xint_support; >> >> void xint_add_debugfs_entry(unsigned int irq); >> void xint_remove_debugfs_entry(unsigned int irq); >

1 0

[openeuler:openEuler-1.0-LTS 1513/1513] mm/page_ext.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3e8e3ea77f0dd528b080f91d615144093b741003 commit: 5f0e34d2aceec67c169be7599d82f0e8519c37f7 [1513/1513] mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning config: x86_64-buildonly-randconfig-005-20250324 (https://download.01.org/0day-ci/archive/20250325/202503251400.xG2WACIP-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503251400.xG2WACIP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503251400.xG2WACIP-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/page_ext.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] btrfs: do proper folio cleanup when cow_file_range() failed
by Zizhi Wo 25 Mar '25

25 Mar '25

From: Qu Wenruo <wqu(a)suse.com> stable inclusion from stable-v6.13.2 commit 692cf71173bb41395c855acbbbe197d3aedfa5d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBJV CVE: CVE-2024-57976 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 06f364284794f149d2abc167c11d556cf20c954b upstream. [BUG] When testing with COW fixup marked as BUG_ON() (this is involved with the new pin_user_pages*() change, which should not result new out-of-band dirty pages), I hit a crash triggered by the BUG_ON() from hitting COW fixup path. This BUG_ON() happens just after a failed btrfs_run_delalloc_range(): BTRFS error (device dm-2): failed to run delalloc range, root 348 ino 405 folio 65536 submit_bitmap 6-15 start 90112 len 106496: -28 ------------[ cut here ]------------ kernel BUG at fs/btrfs/extent_io.c:1444! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 0 UID: 0 PID: 434621 Comm: kworker/u24:8 Tainted: G OE 6.12.0-rc7-custom+ #86 Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs] pc : extent_writepage_io+0x2d4/0x308 [btrfs] lr : extent_writepage_io+0x2d4/0x308 [btrfs] Call trace: extent_writepage_io+0x2d4/0x308 [btrfs] extent_writepage+0x218/0x330 [btrfs] extent_write_cache_pages+0x1d4/0x4b0 [btrfs] btrfs_writepages+0x94/0x150 [btrfs] do_writepages+0x74/0x190 filemap_fdatawrite_wbc+0x88/0xc8 start_delalloc_inodes+0x180/0x3b0 [btrfs] btrfs_start_delalloc_roots+0x174/0x280 [btrfs] shrink_delalloc+0x114/0x280 [btrfs] flush_space+0x250/0x2f8 [btrfs] btrfs_async_reclaim_data_space+0x180/0x228 [btrfs] process_one_work+0x164/0x408 worker_thread+0x25c/0x388 kthread+0x100/0x118 ret_from_fork+0x10/0x20 Code: aa1403e1 9402f3ef aa1403e0 9402f36f (d4210000) ---[ end trace 0000000000000000 ]--- [CAUSE] That failure is mostly from cow_file_range(), where we can hit -ENOSPC. Although the -ENOSPC is already a bug related to our space reservation code, let's just focus on the error handling. For example, we have the following dirty range [0, 64K) of an inode, with 4K sector size and 4K page size: 0 16K 32K 48K 64K |///////////////////////////////////////| |#######################################| Where |///| means page are still dirty, and |###| means the extent io tree has EXTENT_DELALLOC flag. - Enter extent_writepage() for page 0 - Enter btrfs_run_delalloc_range() for range [0, 64K) - Enter cow_file_range() for range [0, 64K) - Function btrfs_reserve_extent() only reserved one 16K extent So we created extent map and ordered extent for range [0, 16K) 0 16K 32K 48K 64K |////////|//////////////////////////////| |<- OE ->|##############################| And range [0, 16K) has its delalloc flag cleared. But since we haven't yet submit any bio, involved 4 pages are still dirty. - Function btrfs_reserve_extent() returns with -ENOSPC Now we have to run error cleanup, which will clear all EXTENT_DELALLOC* flags and clear the dirty flags for the remaining ranges: 0 16K 32K 48K 64K |////////| | | | | Note that range [0, 16K) still has its pages dirty. - Some time later, writeback is triggered again for the range [0, 16K) since the page range still has dirty flags. - btrfs_run_delalloc_range() will do nothing because there is no EXTENT_DELALLOC flag. - extent_writepage_io() finds page 0 has no ordered flag Which falls into the COW fixup path, triggering the BUG_ON(). Unfortunately this error handling bug dates back to the introduction of btrfs. Thankfully with the abuse of COW fixup, at least it won't crash the kernel. [FIX] Instead of immediately unlocking the extent and folios, we keep the extent and folios locked until either erroring out or the whole delalloc range finished. When the whole delalloc range finished without error, we just unlock the whole range with PAGE_SET_ORDERED (and PAGE_UNLOCK for !keep_locked cases), with EXTENT_DELALLOC and EXTENT_LOCKED cleared. And the involved folios will be properly submitted, with their dirty flags cleared during submission. For the error path, it will be a little more complex: - The range with ordered extent allocated (range (1)) We only clear the EXTENT_DELALLOC and EXTENT_LOCKED, as the remaining flags are cleaned up by btrfs_mark_ordered_io_finished()->btrfs_finish_one_ordered(). For folios we finish the IO (clear dirty, start writeback and immediately finish the writeback) and unlock the folios. - The range with reserved extent but no ordered extent (range(2)) - The range we never touched (range(3)) For both range (2) and range(3) the behavior is not changed. Now even if cow_file_range() failed halfway with some successfully reserved extents/ordered extents, we will keep all folios clean, so there will be no future writeback triggered on them. CC: stable(a)vger.kernel.org Fixes: 524272607e88 ("btrfs: Handle delalloc error correctly to avoid ordered extent hang") Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/btrfs/inode.c [Some context conflicts are encountered when adapting: 1. ram_size -> cur_size: 5599f39356c6 ("btrfs: simplify range tracking in cow_file_range()"), just simplify the process and do not affect the logic. 2. There is no lock_extent related code: 0ab540995ae0 ("btrfs: push lock_extent into cow_file_range_inline")\a0766d8f35d8 ("btrfs: push extent lock into cow_file_range"), this is to narrow the scope of lock, but does not affect this patch. 3. extent_clear_unlock_delalloc() missed a parameter named "cached": 6b0a63a4fa31 ("btrfs: add a cached state to extent_clear_unlock_delalloc"), does not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/btrfs/inode.c | 54 ++++++++++++++++++++++++------------------------ 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 71902110c2fe..862cc8703bf0 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -1356,6 +1356,17 @@ static noinline int cow_file_range(struct btrfs_inode *inode, alloc_hint = get_extent_allocation_hint(inode, start, num_bytes); + /* + * We're not doing compressed IO, don't unlock the first page (which + * the caller expects to stay locked), don't clear any dirty bits and + * don't set any writeback bits. + * + * Do set the Ordered (Private2) bit so we know this page was properly + * setup for writepage. + */ + page_ops = (keep_locked ? 0 : PAGE_UNLOCK); + page_ops |= PAGE_SET_ORDERED; + /* * Relocation relies on the relocated extents to have exactly the same * size as the original extents. Normally writeback for relocation data @@ -1456,21 +1467,6 @@ static noinline int cow_file_range(struct btrfs_inode *inode, btrfs_dec_block_group_reservations(fs_info, ins.objectid); - /* - * We're not doing compressed IO, don't unlock the first page - * (which the caller expects to stay locked), don't clear any - * dirty bits and don't set any writeback bits - * - * Do set the Ordered (Private2) bit so we know this page was - * properly setup for writepage. - */ - page_ops = (keep_locked ? 0 : PAGE_UNLOCK); - page_ops |= PAGE_SET_ORDERED; - - extent_clear_unlock_delalloc(inode, start, start + ram_size - 1, - locked_page, - EXTENT_LOCKED | EXTENT_DELALLOC, - page_ops); if (num_bytes < cur_alloc_size) num_bytes = 0; else @@ -1487,6 +1483,8 @@ static noinline int cow_file_range(struct btrfs_inode *inode, if (ret) goto out_unlock; } + extent_clear_unlock_delalloc(inode, orig_start, end, locked_page, + EXTENT_LOCKED | EXTENT_DELALLOC, page_ops); done: if (done_offset) *done_offset = end; @@ -1507,29 +1505,31 @@ static noinline int cow_file_range(struct btrfs_inode *inode, * We process each region below. */ - clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | - EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV; - page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; - /* * For the range (1). We have already instantiated the ordered extents * for this region. They are cleaned up by * btrfs_cleanup_ordered_extents() in e.g, - * btrfs_run_delalloc_range(). EXTENT_LOCKED | EXTENT_DELALLOC are - * already cleared in the above loop. And, EXTENT_DELALLOC_NEW | - * EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV are handled by the cleanup - * function. + * btrfs_run_delalloc_range(). + * EXTENT_DELALLOC_NEW | EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV + * are also handled by the cleanup function. * - * However, in case of @keep_locked, we still need to unlock the pages - * (except @locked_page) to ensure all the pages are unlocked. + * So here we only clear EXTENT_LOCKED and EXTENT_DELALLOC flag, and + * finish the writeback of the involved folios, which will be never submitted. */ - if (keep_locked && orig_start < start) { + if (orig_start < start) { + clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC; + page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; + if (!locked_page) mapping_set_error(inode->vfs_inode.i_mapping, ret); extent_clear_unlock_delalloc(inode, orig_start, start - 1, - locked_page, 0, page_ops); + locked_page, clear_bits, page_ops); } + clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | + EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV; + page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; + /* * For the range (2). If we reserved an extent for our delalloc range * (or a subrange) and failed to create the respective ordered extent, -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2022-49553
by Zizhi Wo 25 Mar '25

25 Mar '25

Randy Dunlap (1): fs/ntfs3: validate BOOT sectors_per_clusters Shigeru Yoshida (1): fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst() fs/ntfs3/super.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
by Zizhi Wo 25 Mar '25

25 Mar '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.247 commit 8d8ad067b90f231b8fdb14acee673ca4012f6045 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBXX CVE: CVE-2022-49354 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 10d6bdf532902be1d8aa5900b3c03c5671612aa2 ] of_find_device_by_node() takes reference, we should use put_device() to release it when not need anymore. Add missing put_device() to avoid refcount leak. Fixes: 43f01da0f279 ("MIPS/OCTEON/ata: Convert pata_octeon_cf.c to use device tree.") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Reviewed-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Signed-off-by: Damien Le Moal <damien.lemoal(a)opensource.wdc.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/ata/pata_octeon_cf.c.rej [Simple context conflict, no practical impact.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- drivers/ata/pata_octeon_cf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c index d3d851b014a3..ed7473aa0ba2 100644 --- a/drivers/ata/pata_octeon_cf.c +++ b/drivers/ata/pata_octeon_cf.c @@ -888,12 +888,14 @@ static int octeon_cf_probe(struct platform_device *pdev) int i; res_dma = platform_get_resource(dma_dev, IORESOURCE_MEM, 0); if (!res_dma) { + put_device(&dma_dev->dev); of_node_put(dma_node); return -EINVAL; } cf_port->dma_base = (u64)devm_ioremap_nocache(&pdev->dev, res_dma->start, resource_size(res_dma)); if (!cf_port->dma_base) { + put_device(&dma_dev->dev); of_node_put(dma_node); return -EINVAL; } @@ -902,6 +904,7 @@ static int octeon_cf_probe(struct platform_device *pdev) i = platform_get_irq(dma_dev, 0); if (i > 0) irq = i; + put_device(&dma_dev->dev); } of_node_put(dma_node); } -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
by Zizhi Wo 25 Mar '25

25 Mar '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.247 commit 30d110ca703ce60162ec337aa564a3e4da30715f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP75W CVE: CVE-2022-49482 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2be84f73785fa9ed6443e3c5b158730266f1c2ee ] of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Fixes: 08641c7c74dd ("ASoC: mxs: add device tree support for mxs-saif") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Link: https://lore.kernel.org/r/20220511133725.39039-1-linmq006@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- sound/soc/mxs/mxs-saif.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c index 156aa7c00787..f5f7f49ab3f1 100644 --- a/sound/soc/mxs/mxs-saif.c +++ b/sound/soc/mxs/mxs-saif.c @@ -777,6 +777,7 @@ static int mxs_saif_probe(struct platform_device *pdev) saif->master_id = saif->id; } else { ret = of_alias_get_id(master, "saif"); + of_node_put(master); if (ret < 0) return ret; else -- 2.39.2

2 1

[PATCH OLK-5.10] fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()'
by Zizhi Wo 25 Mar '25

25 Mar '25

From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> stable inclusion from stable-v5.15.46 commit d8be98ab88250dc12a98efdb703792a537b0eac3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6NP CVE: CVE-2021-47660 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e589f9b7078e1c0191613cd736f598e81d2390de upstream. All error handling paths lead to 'out' where many resources are freed. Do it as well here instead of a direct return, otherwise 'log', 'ra' and 'log->one_page_buf' (at least) will leak. Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal") Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ntfs3/fslog.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c index fb56c4c33987..d1f48ffe846e 100644 --- a/fs/ntfs3/fslog.c +++ b/fs/ntfs3/fslog.c @@ -4096,8 +4096,10 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) if (client == LFS_NO_CLIENT_LE) { /* Insert "NTFS" client LogFile. */ client = ra->client_idx[0]; - if (client == LFS_NO_CLIENT_LE) - return -EINVAL; + if (client == LFS_NO_CLIENT_LE) { + err = -EINVAL; + goto out; + } t16 = le16_to_cpu(client); cr = ca + t16; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] proc: fix use-after-free in proc_get_inode()
by Wang Zhaolong 25 Mar '25

25 Mar '25

From: Ye Bin <yebin10(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBRR1N CVE: NA Reference: https://lore.kernel.org/linux-fsdevel/20250301034024.277290-1-yebin@huaweic… -------------------------------- There's a issue as follows: BUG: unable to handle page fault for address: fffffbfff80a702b PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:proc_get_inode+0x302/0x6e0 RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> proc_lookup_de+0x11f/0x2e0 __lookup_slow+0x188/0x350 walk_component+0x2ab/0x4f0 path_lookupat+0x120/0x660 filename_lookup+0x1ce/0x560 vfs_statx+0xac/0x150 __do_sys_newstat+0x96/0x110 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Above issue may happen as follows: rmmod lookup sys_delete_module proc_lookup_de read_lock(&proc_subdir_lock); pde_get(de); read_unlock(&proc_subdir_lock); proc_get_inode(dir->i_sb, de); mod->exit() proc_remove remove_proc_subtree write_lock(&proc_subdir_lock); write_unlock(&proc_subdir_lock); proc_entry_rundown(de); free_module(mod); if (S_ISREG(inode->i_mode)) if (de->proc_ops->proc_read_iter) --> As module is already freed, will trigger UAF To solve above issue there's need to get 'in_use' before use proc_dir_entry in proc_get_inode(). Fixes: 778f3dd5a13c ("Fix procfs compat_ioctl regression") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Conflicts: fs/proc/inode.c [The pre-patch d919b33dafb3 ("proc: faster open/read/close with "permanent" files") is not imported.] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/proc/inode.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/proc/inode.c b/fs/proc/inode.c index 31bf3bb8ddae..7d225a2b8b2a 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -460,10 +460,18 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) if (is_empty_pde(de)) { make_empty_dir_inode(inode); return inode; } + + if (!use_pde(de)) { + PROC_I(inode)->pde = NULL; + pde_put(de); + iput(inode); + return NULL; + } + if (de->mode) { inode->i_mode = de->mode; inode->i_uid = de->uid; inode->i_gid = de->gid; } @@ -484,10 +492,11 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) inode->i_fop = &proc_reg_file_ops; } else { inode->i_fop = de->proc_fops; } } + unuse_pde(de); } else pde_put(de); return inode; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] proc: fix use-after-free in proc_get_inode()
by Wang Zhaolong 25 Mar '25

25 Mar '25

From: Ye Bin <yebin10(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBRR1N CVE: NA Reference: https://lore.kernel.org/linux-fsdevel/20250301034024.277290-1-yebin@huaweic… -------------------------------- There's a issue as follows: BUG: unable to handle page fault for address: fffffbfff80a702b PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:proc_get_inode+0x302/0x6e0 RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> proc_lookup_de+0x11f/0x2e0 __lookup_slow+0x188/0x350 walk_component+0x2ab/0x4f0 path_lookupat+0x120/0x660 filename_lookup+0x1ce/0x560 vfs_statx+0xac/0x150 __do_sys_newstat+0x96/0x110 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Above issue may happen as follows: rmmod lookup sys_delete_module proc_lookup_de read_lock(&proc_subdir_lock); pde_get(de); read_unlock(&proc_subdir_lock); proc_get_inode(dir->i_sb, de); mod->exit() proc_remove remove_proc_subtree write_lock(&proc_subdir_lock); write_unlock(&proc_subdir_lock); proc_entry_rundown(de); free_module(mod); if (S_ISREG(inode->i_mode)) if (de->proc_ops->proc_read_iter) --> As module is already freed, will trigger UAF To solve above issue there's need to get 'in_use' before use proc_dir_entry in proc_get_inode(). Fixes: 9c7af565c58e ("centos 8.1: import linux-4.18.0-147.5.1.el8_1") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Conflicts: fs/proc/inode.c [The pre-patch d919b33dafb3 ("proc: faster open/read/close with "permanent" files") is not imported.] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/proc/inode.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/proc/inode.c b/fs/proc/inode.c index 31bf3bb8ddae..7d225a2b8b2a 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -460,10 +460,18 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) if (is_empty_pde(de)) { make_empty_dir_inode(inode); return inode; } + + if (!use_pde(de)) { + PROC_I(inode)->pde = NULL; + pde_put(de); + iput(inode); + return NULL; + } + if (de->mode) { inode->i_mode = de->mode; inode->i_uid = de->uid; inode->i_gid = de->gid; } @@ -484,10 +492,11 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) inode->i_fop = &proc_reg_file_ops; } else { inode->i_fop = de->proc_fops; } } + unuse_pde(de); } else pde_put(de); return inode; } -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] Fix UAF in acct(2)
by Liu Kai 25 Mar '25

25 Mar '25

Fix UAF in acct(2) Christian Brauner (2): acct: perform last write from workqueue acct: block access to kernel internal filesystems kernel/acct.c | 134 +++++++++++++++++++++++++++++++------------------- 1 file changed, 84 insertions(+), 50 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] misc: fastrpc: Fix copy buffer page size
by Liu Kai 25 Mar '25

25 Mar '25

From: Ekansh Gupta <quic_ekangupt(a)quicinc.com> stable inclusion from stable-v6.6.78 commit c0464bad0e85fcd5d47e4297d1e410097c979e55 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC3E CVE: CVE-2025-21734 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e966eae72762ecfdbdb82627e2cda48845b9dd66 upstream. For non-registered buffer, fastrpc driver copies the buffer and pass it to the remote subsystem. There is a problem with current implementation of page size calculation which is not considering the offset in the calculation. This might lead to passing of improper and out-of-bounds page size which could result in memory issue. Calculate page start and page end using the offset adjusted address instead of absolute address. Fixes: 02b45b47fbe8 ("misc: fastrpc: fix remote page size calculation") Cc: stable(a)kernel.org Signed-off-by: Ekansh Gupta <quic_ekangupt(a)quicinc.com> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> Link: https://lore.kernel.org/r/20250110134239.123603-4-srinivas.kandagatla@linar… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/misc/fastrpc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 4df0d7a0cd11..6c77d56847d8 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1015,8 +1015,8 @@ static int fastrpc_get_args(u32 kernel, struct fastrpc_invoke_ctx *ctx) (pkt_size - rlen); pages[i].addr = pages[i].addr & PAGE_MASK; - pg_start = (args & PAGE_MASK) >> PAGE_SHIFT; - pg_end = ((args + len - 1) & PAGE_MASK) >> PAGE_SHIFT; + pg_start = (rpra[i].buf.pv & PAGE_MASK) >> PAGE_SHIFT; + pg_end = ((rpra[i].buf.pv + len - 1) & PAGE_MASK) >> PAGE_SHIFT; pages[i].size = (pg_end - pg_start + 1) * PAGE_SIZE; args = args + mlen; rlen -= mlen; -- 2.34.1

2 1

[PATCH OLK-6.6] s390/ism: add release function for struct device
by Liu Kai 25 Mar '25

25 Mar '25

From: Julian Ruess <julianr(a)linux.ibm.com> stable inclusion from stable-v6.6.80 commit 940d15254d2216b585558bcf36312da50074e711 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSW0X CVE: CVE-2025-21856 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 915e34d5ad35a6a9e56113f852ade4a730fb88f0 ] According to device_release() in /drivers/base/core.c, a device without a release function is a broken device and must be fixed. The current code directly frees the device after calling device_add() without waiting for other kernel parts to release their references. Thus, a reference could still be held to a struct device, e.g., by sysfs, leading to potential use-after-free issues if a proper release function is not set. Fixes: 8c81ba20349d ("net/smc: De-tangle ism and smc device initialization") Reviewed-by: Alexandra Winter <wintera(a)linux.ibm.com> Reviewed-by: Wenjia Zhang <wenjia(a)linux.ibm.com> Signed-off-by: Julian Ruess <julianr(a)linux.ibm.com> Signed-off-by: Alexandra Winter <wintera(a)linux.ibm.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20250214120137.563409-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/s390/net/ism_drv.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c index e36e3ea165d3..2f34761e6413 100644 --- a/drivers/s390/net/ism_drv.c +++ b/drivers/s390/net/ism_drv.c @@ -588,6 +588,15 @@ static int ism_dev_init(struct ism_dev *ism) return ret; } +static void ism_dev_release(struct device *dev) +{ + struct ism_dev *ism; + + ism = container_of(dev, struct ism_dev, dev); + + kfree(ism); +} + static int ism_probe(struct pci_dev *pdev, const struct pci_device_id *id) { struct ism_dev *ism; @@ -601,6 +610,7 @@ static int ism_probe(struct pci_dev *pdev, const struct pci_device_id *id) dev_set_drvdata(&pdev->dev, ism); ism->pdev = pdev; ism->dev.parent = &pdev->dev; + ism->dev.release = ism_dev_release; device_initialize(&ism->dev); dev_set_name(&ism->dev, dev_name(&pdev->dev)); ret = device_add(&ism->dev); @@ -637,7 +647,7 @@ static int ism_probe(struct pci_dev *pdev, const struct pci_device_id *id) device_del(&ism->dev); err_dev: dev_set_drvdata(&pdev->dev, NULL); - kfree(ism); + put_device(&ism->dev); return ret; } @@ -682,7 +692,7 @@ static void ism_remove(struct pci_dev *pdev) pci_disable_device(pdev); device_del(&ism->dev); dev_set_drvdata(&pdev->dev, NULL); - kfree(ism); + put_device(&ism->dev); } static struct pci_driver ism_driver = { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] partitions: mac: fix handling of bogus partition table
by Long Li 25 Mar '25

25 Mar '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.10-rc2 commit 80e648042e512d5a767da251d44132553fe04ae0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5K CVE: CVE-2025-21772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix several issues in partition probing: - The bailout for a bad partoffset must use put_dev_sector(), since the preceding read_part_sector() succeeded. - If the partition table claims a silly sector size like 0xfff bytes (which results in partition table entries straddling sector boundaries), bail out instead of accessing out-of-bounds memory. - We must not assume that the partition table contains proper NUL termination - use strnlen() and strncmp() instead of strlen() and strcmp(). Cc: stable(a)vger.kernel.org Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20250214-partition-mac-v1-1-c1c626dffbd5@google.c… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- block/partitions/mac.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/block/partitions/mac.c b/block/partitions/mac.c index b6095335636c..ca619d852757 100644 --- a/block/partitions/mac.c +++ b/block/partitions/mac.c @@ -51,13 +51,25 @@ int mac_partition(struct parsed_partitions *state) } secsize = be16_to_cpu(md->block_size); put_dev_sector(sect); + + /* + * If the "block size" is not a power of 2, things get weird - we might + * end up with a partition straddling a sector boundary, so we wouldn't + * be able to read a partition entry with read_part_sector(). + * Real block sizes are probably (?) powers of two, so just require + * that. + */ + if (!is_power_of_2(secsize)) + return -1; datasize = round_down(secsize, 512); data = read_part_sector(state, datasize / 512, &sect); if (!data) return -1; partoffset = secsize % 512; - if (partoffset + sizeof(*part) > datasize) + if (partoffset + sizeof(*part) > datasize) { + put_dev_sector(sect); return -1; + } part = (struct mac_partition *) (data + partoffset); if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) { put_dev_sector(sect); @@ -110,8 +122,8 @@ int mac_partition(struct parsed_partitions *state) int i, l; goodness++; - l = strlen(part->name); - if (strcmp(part->name, "/") == 0) + l = strnlen(part->name, sizeof(part->name)); + if (strncmp(part->name, "/", sizeof(part->name)) == 0) goodness++; for (i = 0; i <= l - 4; ++i) { if (strncasecmp(part->name + i, "root", -- 2.39.2

2 1

[PATCH OLK-5.10] partitions: mac: fix handling of bogus partition table
by Long Li 25 Mar '25

25 Mar '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.10-rc2 commit 80e648042e512d5a767da251d44132553fe04ae0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5K CVE: CVE-2025-21772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix several issues in partition probing: - The bailout for a bad partoffset must use put_dev_sector(), since the preceding read_part_sector() succeeded. - If the partition table claims a silly sector size like 0xfff bytes (which results in partition table entries straddling sector boundaries), bail out instead of accessing out-of-bounds memory. - We must not assume that the partition table contains proper NUL termination - use strnlen() and strncmp() instead of strlen() and strcmp(). Cc: stable(a)vger.kernel.org Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20250214-partition-mac-v1-1-c1c626dffbd5@google.c… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- block/partitions/mac.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/block/partitions/mac.c b/block/partitions/mac.c index b6095335636c..ca619d852757 100644 --- a/block/partitions/mac.c +++ b/block/partitions/mac.c @@ -51,13 +51,25 @@ int mac_partition(struct parsed_partitions *state) } secsize = be16_to_cpu(md->block_size); put_dev_sector(sect); + + /* + * If the "block size" is not a power of 2, things get weird - we might + * end up with a partition straddling a sector boundary, so we wouldn't + * be able to read a partition entry with read_part_sector(). + * Real block sizes are probably (?) powers of two, so just require + * that. + */ + if (!is_power_of_2(secsize)) + return -1; datasize = round_down(secsize, 512); data = read_part_sector(state, datasize / 512, &sect); if (!data) return -1; partoffset = secsize % 512; - if (partoffset + sizeof(*part) > datasize) + if (partoffset + sizeof(*part) > datasize) { + put_dev_sector(sect); return -1; + } part = (struct mac_partition *) (data + partoffset); if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) { put_dev_sector(sect); @@ -110,8 +122,8 @@ int mac_partition(struct parsed_partitions *state) int i, l; goodness++; - l = strlen(part->name); - if (strcmp(part->name, "/") == 0) + l = strnlen(part->name, sizeof(part->name)); + if (strncmp(part->name, "/", sizeof(part->name)) == 0) goodness++; for (i = 0; i <= l - 4; ++i) { if (strncasecmp(part->name + i, "root", -- 2.39.2

2 1

[PATCH OLK-6.6] ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
by Qi Xi 25 Mar '25

25 Mar '25

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> mainline inclusion from mainline-v6.14-rc1 commit 301c26a018acb94dd537a4418cefa0f654500c6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRED3 CVE: CVE-2024-58077 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc_pcm_ret(). It is used from many functions, ignoring -EINVAL is over-kill. The reason why -EINVAL was ignored was it really should only be used upon invalid parameters coming from userspace and in that case we don't want to log an error since we do not want to give userspace a way to do a denial-of-service attack on the syslog / diskspace. So don't use soc_pcm_ret() on .prepare callback is better idea. Link: https://lore.kernel.org/r/87v7vptzap.wl-kuninori.morimoto.gx@renesas.com Cc: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Link: https://patch.msgid.link/87bjxg8jju.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- sound/soc/soc-pcm.c | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 511446a30c05..60248a6820aa 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -38,7 +38,6 @@ static inline int _soc_pcm_ret(struct snd_soc_pcm_runtime *rtd, switch (ret) { case -EPROBE_DEFER: case -ENOTSUPP: - case -EINVAL: break; default: dev_err(rtd->dev, @@ -902,7 +901,13 @@ static int __soc_pcm_prepare(struct snd_soc_pcm_runtime *rtd, } out: - return soc_pcm_ret(rtd, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } /* PCM prepare ops for non-DPCM streams */ @@ -914,6 +919,13 @@ static int soc_pcm_prepare(struct snd_pcm_substream *substream) snd_soc_dpcm_mutex_lock(rtd); ret = __soc_pcm_prepare(rtd, substream); snd_soc_dpcm_mutex_unlock(rtd); + + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ return ret; } @@ -2461,7 +2473,13 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) be->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE; } - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) @@ -2501,7 +2519,13 @@ static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO); snd_soc_dpcm_mutex_unlock(fe); - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_run_update_shutdown(struct snd_soc_pcm_runtime *fe, int stream) -- 2.33.0

2 1

[PATCH OLK-6.6 v2 0/3] arm64: entry: Support hardware xint and xcall
by Jinjie Ruan 24 Mar '25

24 Mar '25

Support hardware xint and xcall. Changes in v2: - Reuse irq_is_nmi(). - Reuse the xint set and check logic in xint 1.0. - Introduce fast_handle_xint(). - Rename enable_xint_xcall() to enable_xfunc() and rename test_has_xint_xcall() to test_has_xfunc(). - Fix a typo. - Add a blank line after declarations. - Remove an excess semicolon. Jinjie Ruan (3): genirq: Reuse irq_is_nmi() arm64: entry: Support hardware xint arm64: entry: Support hardware xcall arch/Kconfig | 14 ++-- arch/arm64/Kconfig | 12 ++++ arch/arm64/include/asm/sysreg.h | 7 ++ arch/arm64/kernel/cpufeature.c | 107 ++++++++++++++++++++++++++++- arch/arm64/kernel/entry-common.c | 39 ++++++++--- arch/arm64/kernel/entry.S | 74 ++++++++++++++++++-- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 89 ++++++++++++++++++++++-- include/linux/irqchip/arm-gic-v3.h | 6 +- kernel/irq/debugfs.c | 6 +- kernel/irq/internals.h | 8 ++- kernel/irq/irqdesc.c | 5 -- kernel/irq/manage.c | 16 ++--- kernel/irq/resend.c | 2 +- 14 files changed, 341 insertions(+), 48 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/4] Add cacheline reorganize
by Yue Haibing 24 Mar '25

24 Mar '25

Coco Li (4): cache: enforce cache groups netns-ipv4: reorganize netns_ipv4 fast path variables net-device: reorganize net_device fast path variables tcp: reorganize tcp_sock fast path variables include/linux/cache.h | 25 ++++ include/linux/netdevice.h | 107 +++++++++------- include/linux/tcp.h | 249 ++++++++++++++++++++------------------ include/net/netns/ipv4.h | 45 ++++--- net/core/dev.c | 54 +++++++++ net/core/net_namespace.c | 45 +++++++ net/ipv4/tcp.c | 93 ++++++++++++++ scripts/kernel-doc | 5 + 8 files changed, 450 insertions(+), 173 deletions(-) -- 2.34.1

1 0

[PATCH OLK-5.10 0/4] Add cacheline reorganize
by Yue Haibing 24 Mar '25

24 Mar '25

Coco Li (4): cache: enforce cache groups netns-ipv4: reorganize netns_ipv4 fast path variables net-device: reorganize net_device fast path variables tcp: reorganize tcp_sock fast path variables include/linux/cache.h | 25 ++++ include/linux/netdevice.h | 107 +++++++++------- include/linux/tcp.h | 249 ++++++++++++++++++++------------------ include/net/netns/ipv4.h | 45 ++++--- net/core/dev.c | 54 +++++++++ net/core/net_namespace.c | 45 +++++++ net/ipv4/tcp.c | 93 ++++++++++++++ scripts/kernel-doc | 5 + 8 files changed, 450 insertions(+), 173 deletions(-) -- 2.34.1

1 0

[PATCH OLK-5.10 0/4] Add cacheline reorganize
by Yue Haibing 24 Mar '25

24 Mar '25

Coco Li (4): cache: enforce cache groups netns-ipv4: reorganize netns_ipv4 fast path variables net-device: reorganize net_device fast path variables tcp: reorganize tcp_sock fast path variables include/linux/cache.h | 25 ++++ include/linux/netdevice.h | 107 +++++++++------- include/linux/tcp.h | 249 ++++++++++++++++++++------------------ include/net/netns/ipv4.h | 45 ++++--- net/core/dev.c | 54 +++++++++ net/core/net_namespace.c | 45 +++++++ net/ipv4/tcp.c | 93 ++++++++++++++ scripts/kernel-doc | 5 + 8 files changed, 450 insertions(+), 173 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/6] CVE-2024-57952
by Yongjian Sun 24 Mar '25

24 Mar '25

Chuck Lever (5): [Backport] libfs: Return ENOSPC when the directory offset range is exhausted [Backport] Revert "libfs: Add simple_offset_empty()" [Backport] Revert "libfs: fix infinite directory reads for offset dir" [Backport] libfs: Replace simple_offset end-of-directory detection [Backport] libfs: Use d_children list to iterate simple_offset directories Yongjian Sun (1): [Backport] libfs: Fix duplicate directory entry in offset_dir_lookup fs/libfs.c | 164 ++++++++++++++++++++++----------------------- include/linux/fs.h | 1 - mm/shmem.c | 4 +- 3 files changed, 81 insertions(+), 88 deletions(-) -- 2.39.2

2 7

[openeuler:openEuler-1.0-LTS 1513/1513] include/scsi/scsi_cmnd.h:327:12: warning: 'scsi_cmnd' may be used uninitialized in this function
by kernel test robot 24 Mar '25

24 Mar '25

Hi chenxiang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 256df080c8e0f3a9c8a5cc997ffc10fd5075dc6d commit: b4adbc622b73d2bc61e6d712e0a916e568f0ce3f [1513/1513] scsi: hisi_sas: add support for DIF/DIX feature of v3 hw config: arm64-randconfig-002-20250324 (https://download.01.org/0day-ci/archive/20250324/202503241626.r5trN0HW-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250324/202503241626.r5trN0HW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503241626.r5trN0HW-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from include/scsi/libsas.h:36, from include/scsi/sas_ata.h:29, from drivers/scsi/hisi_sas/hisi_sas.h:27, from drivers/scsi/hisi_sas/hisi_sas_main.c:12: drivers/scsi/hisi_sas/hisi_sas_main.c: In function 'hisi_sas_dif_dma_map': >> include/scsi/scsi_cmnd.h:327:12: warning: 'scsi_cmnd' may be used uninitialized in this function [-Wmaybe-uninitialized] 327 | return cmd->prot_sdb ? cmd->prot_sdb->table.sgl : NULL; | ~~~^~~~~~~~~~ drivers/scsi/hisi_sas/hisi_sas_main.c:412:20: note: 'scsi_cmnd' was declared here 412 | struct scsi_cmnd *scsi_cmnd; | ^~~~~~~~~ vim +/scsi_cmnd +327 include/scsi/scsi_cmnd.h 7027ad72a68979 Martin K. Petersen 2008-07-17 324 7027ad72a68979 Martin K. Petersen 2008-07-17 325 static inline struct scatterlist *scsi_prot_sglist(struct scsi_cmnd *cmd) 7027ad72a68979 Martin K. Petersen 2008-07-17 326 { 7027ad72a68979 Martin K. Petersen 2008-07-17 @327 return cmd->prot_sdb ? cmd->prot_sdb->table.sgl : NULL; 7027ad72a68979 Martin K. Petersen 2008-07-17 328 } 7027ad72a68979 Martin K. Petersen 2008-07-17 329 :::::: The code at line 327 was first introduced by commit :::::: 7027ad72a689797475973c6feb5f0b673382f779 [SCSI] Support devices with protection information :::::: TO: Martin K. Petersen <martin.petersen(a)oracle.com> :::::: CC: James Bottomley <James.Bottomley(a)HansenPartnership.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION abf385ef625e6aeb4923da42fef9ebce788f4ecf
by kernel test robot 23 Mar '25

23 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: abf385ef625e6aeb4923da42fef9ebce788f4ecf !15465 CVE-2022-49490 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503221848.AeSAEte6-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503222010.7VOhhbEu-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503230934.Ug2Wd8BQ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503231236.qN1C5HOM-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503231358.Xv9EXuDB-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503231359.qdyINbl7-lkp@intel.com arch/x86/kernel/apic/io_apic.o: warning: objtool: acpi_get_override_irq()+0x108: can't find switch jump table arch/x86/kernel/hw_breakpoint.o: warning: objtool: missing symbol for section .text drivers/gpu/drm/amd/amdgpu/amdgpu_ids.o: warning: objtool: amdgpu_vmid_grab()+0xd3e: unreachable instruction drivers/gpu/drm/gma500/intel_bios.o: warning: objtool: psb_intel_init_bios()+0x2c2b: can't find switch jump table drivers/input/mouse/elantech.o: warning: objtool: elantech_process_byte()+0x726: can't find switch jump table drivers/leds/leds-lm355x.o: warning: objtool: lm355x_control()+0x27c: can't find switch jump table drivers/media/i2c/adv7511-v4l2.o: warning: objtool: adv7511_set_fmt()+0x805: unreachable instruction drivers/mtd/nand/onenand/onenand_bbt.o: warning: objtool: onenand_isbad_bbt()+0xe7: can't find switch jump table drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.o: warning: objtool: bnx2x_848xx_read_status()+0x218: can't find switch jump table drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.o: warning: objtool: cudbg_collect_mem_region()+0x270: can't find switch jump table drivers/net/ethernet/jme.o: warning: objtool: jme_check_link()+0x900: can't find switch jump table drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.o: warning: objtool: dwmac1000_debug()+0xb6: can't find switch jump table drivers/scsi/qla1280.o: warning: objtool: qla1280_error_action()+0x3ab: can't find switch jump table drivers/usb/gadget/function/f_fs.o: warning: objtool: __ffs_event_add()+0x7d: can't find switch jump table fs/debugfs/file.o: warning: objtool: full_proxy_open()+0x55a: unreachable instruction fs/ext4/mballoc.o: warning: objtool: ext4_mb_complex_scan_group()+0x11a4: unreachable instruction include/linux/uaccess.h:115:17: warning: 'entry' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'slot' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'ticks' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:72:9: warning: 'sve' may be used uninitialized [-Wmaybe-uninitialized] kernel/cgroup/rstat.o: warning: objtool: missing symbol for section .text kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace' kernel/livepatch/core.c:1013:12: warning: no previous prototype for function 'arch_klp_func_can_patch' [-Wmissing-prototypes] kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats' kernel/sched/debug.c:991:17: error: no member named 'nr_wakeups_force_preferred_cpus' in 'struct dyn_affinity_stats' kernel/sched/grid/qos.c:84:31: error: 'struct mempolicy' has no member named 'v' kernel/sched/grid/qos.c:95:31: error: 'struct task_struct' has no member named 'il_prev' mm/debug.c:143:21: warning: more '%' conversions than data arguments [-Wformat-insufficient-args] mm/debug.c:174:3: warning: format specifies type 'void *' but the argument has type 'int' [-Wformat] mm/debug.c:175:18: warning: format specifies type 'unsigned long' but the argument has type 'const unsigned long *' [-Wformat] mm/debug.c:175:3: warning: format specifies type 'int' but the argument has type 'unsigned long' [-Wformat] mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] mm/page_alloc.c:1645:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-mismatch] mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] Unverified Error/Warning (likely false positive, kindly check if interested): drivers/usb/dwc2/gadget.o: warning: objtool: dwc2_gadget_config_nonisoc_xfer_ddma() falls through to next function dwc2_hsotg_read_frameno() include/asm-generic/bug.h:70:12: warning: 'mcu_ctrl' may be used uninitialized in this function [-Wmaybe-uninitialized] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250322 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- include-linux-uaccess.h:warning:ces32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:entry-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rdwr_arg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rs485-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:slot-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:sve-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ticks-may-be-used-uninitialized | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250322 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250322 | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-lo | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-void-u64)-aka-int-(-const)(struct-bpf_map-void-void-long-long-unsigned-int)-to-u64-(-)(u64 | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-void-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-l | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250322 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-054-20250323 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-r061-20250323 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- kernel-sched-grid-qos.c:error:struct-mempolicy-has-no-member-named-v | |-- kernel-sched-grid-qos.c:error:struct-task_struct-has-no-member-named-il_prev | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-r132-20250322 | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | `-- mm-page_alloc.c:sparse:sparse:invalid-assignment: |-- x86_64-allnoconfig | |-- Makefile:include-config-auto.conf.cmd:No-such-file-or-directory | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250322 | |-- arch-x86-kernel-hw_breakpoint.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- kernel-cgroup-rstat.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250322 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20250207 | `-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool |-- x86_64-buildonly-randconfig-003-20250217 | `-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type |-- x86_64-buildonly-randconfig-003-20250315 | `-- arch-x86-kernel-apic-io_apic.o:warning:objtool:acpi_get_override_irq:can-t-find-switch-jump-table |-- x86_64-buildonly-randconfig-003-20250322 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250102 | `-- drivers-media-i2c-adv7511-v4l2.o:warning:objtool:adv7511_set_fmt:unreachable-instruction |-- x86_64-buildonly-randconfig-004-20250322 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-005-20241216 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250322 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- fs-ext4-mballoc.o:warning:objtool:ext4_mb_complex_scan_group:unreachable-instruction | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250322 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-defconfig | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized-in-this-function | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-101-20241223 | `-- fs-ext4-mballoc.o:warning:objtool:ext4_mb_complex_scan_group:unreachable-instruction |-- x86_64-randconfig-101-20250322 | |-- drivers-gpu-drm-gma500-intel_bios.o:warning:objtool:psb_intel_init_bios:can-t-find-switch-jump-table | |-- drivers-input-mouse-elantech.o:warning:objtool:elantech_process_byte:can-t-find-switch-jump-table | |-- drivers-leds-leds-lm355x.o:warning:objtool:lm355x_control:can-t-find-switch-jump-table | |-- drivers-net-ethernet-broadcom-bnx2x-bnx2x_link.o:warning:objtool:bnx2x_848xx_read_status:can-t-find-switch-jump-table | |-- drivers-net-ethernet-chelsio-cxgb4-cudbg_lib.o:warning:objtool:cudbg_collect_mem_region:can-t-find-switch-jump-table | |-- drivers-net-ethernet-jme.o:warning:objtool:jme_check_link:can-t-find-switch-jump-table | |-- drivers-net-ethernet-stmicro-stmmac-dwmac1000_core.o:warning:objtool:dwmac1000_debug:can-t-find-switch-jump-table | `-- drivers-usb-gadget-function-f_fs.o:warning:objtool:__ffs_event_add:can-t-find-switch-jump-table |-- x86_64-randconfig-101-20250323 | |-- drivers-md-raid5.o:warning:objtool:raid5_compute_sector-falls-through-to-next-function-raid5_compute_blocknr() | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-102-20250103 | `-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. |-- x86_64-randconfig-102-20250323 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-103-20241218 | `-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace |-- x86_64-randconfig-103-20250219 | |-- kernel-sched-debug.c:error:no-member-named-nr_wakeups_force_preferred_cpus-in-struct-dyn_affinity_stats | `-- kernel-sched-debug.c:error:no-member-named-nr_wakeups_preferred_cpus-in-struct-dyn_affinity_stats |-- x86_64-randconfig-103-20250305 | `-- drivers-gpu-drm-amd-amdgpu-amdgpu_ids.o:warning:objtool:amdgpu_vmid_grab:unreachable-instruction |-- x86_64-randconfig-103-20250323 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-104-20250320 | |-- drivers-mtd-nand-onenand-onenand_bbt.o:warning:objtool:onenand_isbad_bbt:can-t-find-switch-jump-table | `-- drivers-scsi-qla1280.o:warning:objtool:qla1280_error_action:can-t-find-switch-jump-table |-- x86_64-randconfig-104-20250321 | `-- drivers-usb-dwc2-gadget.o:warning:objtool:dwc2_gadget_config_nonisoc_xfer_ddma-falls-through-to-next-function-dwc2_hsotg_read_frameno() |-- x86_64-randconfig-104-20250323 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-121-20250323 | |-- drivers-mmc-host-mtk-sd.o:warning:objtool:msdc_set_timeout-falls-through-to-next-function-get_best_delay() | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-122-20241226 | `-- fs-debugfs-file.o:warning:objtool:full_proxy_open:unreachable-instruction |-- x86_64-randconfig-122-20250309 | `-- drivers-net-tun.c:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): |-- x86_64-randconfig-122-20250323 | |-- drivers-md-raid5.o:warning:objtool:raid5_compute_sector-falls-through-to-next-function-raid5_compute_blocknr() | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-123-20250323 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- drivers-usb-dwc2-gadget.o:warning:objtool:dwc2_gadget_config_nonisoc_xfer_ddma-falls-through-to-next-function-dwc2_hsotg_read_frameno() | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-161-20250322 | `-- kernel-livepatch-core.c:warning:no-previous-prototype-for-function-arch_klp_func_can_patch |-- x86_64-randconfig-161-20250323 | |-- drivers-md-raid5.o:warning:objtool:raid5_compute_sector-falls-through-to-next-function-raid5_compute_blocknr() | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-r112-20250311 |-- mm-debug.c:warning:format-specifies-type-int-but-the-argument-has-type-unsigned-long |-- mm-debug.c:warning:format-specifies-type-unsigned-long-but-the-argument-has-type-const-unsigned-long |-- mm-debug.c:warning:format-specifies-type-void-but-the-argument-has-type-int `-- mm-debug.c:warning:more-conversions-than-data-arguments elapsed time: 1447m configs tested: 16 configs skipped: 128 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250322 gcc-14.2.0 arm64 randconfig-002-20250322 gcc-12.3.0 arm64 randconfig-003-20250322 gcc-8.5.0 arm64 randconfig-004-20250322 gcc-14.2.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250322 clang-20 x86_64 buildonly-randconfig-002-20250322 clang-20 x86_64 buildonly-randconfig-003-20250322 clang-20 x86_64 buildonly-randconfig-004-20250322 gcc-12 x86_64 buildonly-randconfig-005-20250322 clang-20 x86_64 buildonly-randconfig-006-20250322 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 6f6f173b2b8fa65e1ef7ebc6e43b0b02c2a52759
by kernel test robot 23 Mar '25

23 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 6f6f173b2b8fa65e1ef7ebc6e43b0b02c2a52759 !15360 USB: hub: Ignore non-compliant devices with too many configs or interfaces Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503230511.2940KCeN-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503230912.NNxJbHgI-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503230914.IDoSqyA4-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503231008.CBNqLNFq-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503231038.JR2kOoEd-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503231043.bCX9sPgT-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503231106.ZSS1yt6E-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503231154.d6j01UpO-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503231208.7HZ1I0ac-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503231209.3Hgyvn46-lkp@intel.com drivers/irqchip/irq-gic-v3.c:1086:43: warning: passing argument 3 of 'single_open' makes pointer from integer without a cast [-Wint-conversion] drivers/platform/mpam/mpam_devices.c:247:11: error: incompatible types when assigning to type 'pgprot_t' {aka 'struct <anonymous>'} from type 'int' kernel/module/strict_rwx.c:36:6: warning: no previous prototype for function 'module_disable_ro' [-Wmissing-prototypes] kernel/sched/core.c:11516:4: warning: format specifies type 'unsigned long long' but the argument has type 'int' [-Wformat] mm/mem_reliable.c:320:13: warning: 'mem_reliable_ctrl_bit_disabled' defined but not used [-Wunused-function] mm/mem_reliable.c:345:2: error: implicit declaration of function 'mem_reliable_ctrl_bit_disable' is invalid in C99 [-Werror,-Wimplicit-function-declaration] mm/memcontrol.c:3147:6: warning: no previous prototype for 'hisi_oom_recover' [-Wmissing-prototypes] Unverified Error/Warning (likely false positive, kindly check if interested): mm/mm_init.c:2030 deferred_init_mem_pfn_range_in_zone() warn: iterator 'j' not incremented Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-virtcca_get_tmi_version | |-- drivers-coda-coda_pci.c:warning:Excess-function-parameter-pdev-description-in-virtcca_pci_get_rom_size | |-- drivers-coda-coda_pci.c:warning:Function-parameter-or-member-p-not-described-in-virtcca_pci_get_rom_size | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-defconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-001-20250322 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-002-20250322 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-003-20250322 | |-- aarch64-linux-ld:Unexpected-GOT-PLT-entries-detected | |-- aarch64-linux-ld:Unexpected-run-time-procedure-linkages-detected | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-004-20250322 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-051-20250323 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-052-20250323 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-053-20250323 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-055-20250323 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-r061-20250323 | |-- kernel-sched-core.c:warning:format-specifies-type-unsigned-long-long-but-the-argument-has-type-int | |-- mm-mem_reliable.c:error:implicit-declaration-of-function-mem_reliable_ctrl_bit_disable-is-invalid-in-C99-Werror-Wimplicit-function-declaration | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-r064-20250323 | |-- drivers-platform-mpam-mpam_devices.c:error:incompatible-types-when-assigning-to-type-pgprot_t-aka-struct-anonymous-from-type-int | |-- mm-mem_reliable.c:warning:mem_reliable_ctrl_bit_disabled-defined-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-r111-20250323 | |-- drivers-irqchip-irq-gic-v3.c:warning:passing-argument-of-single_open-makes-pointer-from-integer-without-a-cast | |-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-gfp_t-usertype-gfp-got-unsigned-int-flag | |-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-usertype-value-got-restricted-__be32-usertype | |-- drivers-scsi-leapioraid-leapioraid_func.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-usertype-value-got-restricted-__le32-usertype | |-- include-linux-if_caqm.h:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-caqm_hdr_info-got-restricted-__be16-usertype-h_caqm_info | |-- include-linux-if_caqm.h:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-got-restricted-__be16-usertype | |-- mm-memcontrol.c:sparse:sparse:symbol-hisi_oom_recover-was-not-declared.-Should-it-be-static | |-- mm-memcontrol.c:warning:no-previous-prototype-for-hisi_oom_recover | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allmodconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allnoconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allyesconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-defconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-001-20250322 | `-- include-linux-mmzone.h:error:error-Allocator-MAX_ORDER-exceeds-SECTION_SIZE |-- loongarch-randconfig-002-20250322 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-r131-20250323 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | `-- mm-show_mem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-int-noderef-__percpu |-- x86_64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250322 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250322 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250322 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250322 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250322 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250322 | |-- drivers-cpufreq-acpi-cpufreq.c:warning:sched_set_itmt-defined-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size |-- x86_64-randconfig-101-20250323 | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-102-20250323 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-103-20250323 | |-- drivers-cpufreq-acpi-cpufreq.c:warning:sched_set_itmt-defined-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-104-20250323 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-121-20250323 | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-122-20250323 | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-123-20250323 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-161-20250322 | |-- kernel-module-strict_rwx.c:warning:no-previous-prototype-for-function-module_disable_ro | `-- mm-mm_init.c-deferred_init_mem_pfn_range_in_zone()-warn:iterator-j-not-incremented `-- x86_64-randconfig-161-20250323 |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used `-- mm-mm_init.c-deferred_init_mem_pfn_range_in_zone()-warn:iterator-j-not-incremented elapsed time: 1447m configs tested: 21 configs skipped: 124 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250322 clang-21 arm64 randconfig-002-20250322 clang-21 arm64 randconfig-003-20250322 gcc-8.5.0 arm64 randconfig-004-20250322 clang-21 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250322 gcc-14.2.0 loongarch randconfig-002-20250322 gcc-14.2.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250322 clang-20 x86_64 buildonly-randconfig-002-20250322 clang-20 x86_64 buildonly-randconfig-003-20250322 clang-20 x86_64 buildonly-randconfig-004-20250322 gcc-12 x86_64 buildonly-randconfig-005-20250322 clang-20 x86_64 buildonly-randconfig-006-20250322 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1425/1425] kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats'
by kernel test robot 23 Mar '25

23 Mar '25

Hi Hui, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: abf385ef625e6aeb4923da42fef9ebce788f4ecf commit: ebca52abe099caa97d7669d0acc71209ea80cfec [1425/1425] sched: Add statistics for scheduler dynamic affinity config: x86_64-randconfig-103-20250219 (https://download.01.org/0day-ci/archive/20250323/202503231358.Xv9EXuDB-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250323/202503231358.Xv9EXuDB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503231358.Xv9EXuDB-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/sched/debug.c:815:6: warning: no previous prototype for function 'sysrq_sched_debug_tidy' [-Wmissing-prototypes] 815 | void sysrq_sched_debug_tidy(void) | ^ kernel/sched/debug.c:815:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 815 | void sysrq_sched_debug_tidy(void) | ^ | static >> kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:21:17: note: expanded from macro 'SEQ_printf' 21 | seq_printf(m, x); \ | ^ >> kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:23:11: note: expanded from macro 'SEQ_printf' 23 | pr_cont(x); \ | ^ include/linux/printk.h:362:26: note: expanded from macro 'pr_cont' 362 | printk(KERN_CONT fmt, ##__VA_ARGS__) | ^~~~~~~~~~~ >> kernel/sched/debug.c:991:17: error: no member named 'nr_wakeups_force_preferred_cpus' in 'struct dyn_affinity_stats' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:21:17: note: expanded from macro 'SEQ_printf' 21 | seq_printf(m, x); \ | ^ >> kernel/sched/debug.c:991:17: error: no member named 'nr_wakeups_force_preferred_cpus' in 'struct dyn_affinity_stats' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:23:11: note: expanded from macro 'SEQ_printf' 23 | pr_cont(x); \ | ^ include/linux/printk.h:362:26: note: expanded from macro 'pr_cont' 362 | printk(KERN_CONT fmt, ##__VA_ARGS__) | ^~~~~~~~~~~ 1 warning and 4 errors generated. vim +990 kernel/sched/debug.c 924 925 void proc_sched_show_task(struct task_struct *p, struct pid_namespace *ns, 926 struct seq_file *m) 927 { 928 #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY 929 struct dyn_affinity_stats *dyn_affi = p->se.dyn_affi_stats; 930 #endif 931 unsigned long nr_switches; 932 933 SEQ_printf(m, "%s (%d, #threads: %d)\n", p->comm, task_pid_nr_ns(p, ns), 934 get_nr_threads(p)); 935 SEQ_printf(m, 936 "---------------------------------------------------------" 937 "----------\n"); 938 #define __P(F) \ 939 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) 940 #define P(F) \ 941 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)p->F) 942 #define P_SCHEDSTAT(F) \ 943 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)schedstat_val(p->F)) 944 #define __PN(F) \ 945 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)F)) 946 #define PN(F) \ 947 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)p->F)) 948 #define PN_SCHEDSTAT(F) \ 949 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)schedstat_val(p->F))) 950 951 PN(se.exec_start); 952 PN(se.vruntime); 953 PN(se.sum_exec_runtime); 954 955 nr_switches = p->nvcsw + p->nivcsw; 956 957 P(se.nr_migrations); 958 959 if (schedstat_enabled()) { 960 u64 avg_atom, avg_per_cpu; 961 962 PN_SCHEDSTAT(se.statistics.sum_sleep_runtime); 963 PN_SCHEDSTAT(se.statistics.wait_start); 964 PN_SCHEDSTAT(se.statistics.sleep_start); 965 PN_SCHEDSTAT(se.statistics.block_start); 966 PN_SCHEDSTAT(se.statistics.sleep_max); 967 PN_SCHEDSTAT(se.statistics.block_max); 968 PN_SCHEDSTAT(se.statistics.exec_max); 969 PN_SCHEDSTAT(se.statistics.slice_max); 970 PN_SCHEDSTAT(se.statistics.wait_max); 971 PN_SCHEDSTAT(se.statistics.wait_sum); 972 P_SCHEDSTAT(se.statistics.wait_count); 973 PN_SCHEDSTAT(se.statistics.iowait_sum); 974 P_SCHEDSTAT(se.statistics.iowait_count); 975 P_SCHEDSTAT(se.statistics.nr_migrations_cold); 976 P_SCHEDSTAT(se.statistics.nr_failed_migrations_affine); 977 P_SCHEDSTAT(se.statistics.nr_failed_migrations_running); 978 P_SCHEDSTAT(se.statistics.nr_failed_migrations_hot); 979 P_SCHEDSTAT(se.statistics.nr_forced_migrations); 980 P_SCHEDSTAT(se.statistics.nr_wakeups); 981 P_SCHEDSTAT(se.statistics.nr_wakeups_sync); 982 P_SCHEDSTAT(se.statistics.nr_wakeups_migrate); 983 P_SCHEDSTAT(se.statistics.nr_wakeups_local); 984 P_SCHEDSTAT(se.statistics.nr_wakeups_remote); 985 P_SCHEDSTAT(se.statistics.nr_wakeups_affine); 986 P_SCHEDSTAT(se.statistics.nr_wakeups_affine_attempts); 987 P_SCHEDSTAT(se.statistics.nr_wakeups_passive); 988 P_SCHEDSTAT(se.statistics.nr_wakeups_idle); 989 #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY > 990 __P(dyn_affi->nr_wakeups_preferred_cpus); > 991 __P(dyn_affi->nr_wakeups_force_preferred_cpus); 992 #endif 993 994 avg_atom = p->se.sum_exec_runtime; 995 if (nr_switches) 996 avg_atom = div64_ul(avg_atom, nr_switches); 997 else 998 avg_atom = -1LL; 999 1000 avg_per_cpu = p->se.sum_exec_runtime; 1001 if (p->se.nr_migrations) { 1002 avg_per_cpu = div64_u64(avg_per_cpu, 1003 p->se.nr_migrations); 1004 } else { 1005 avg_per_cpu = -1LL; 1006 } 1007 1008 __PN(avg_atom); 1009 __PN(avg_per_cpu); 1010 } 1011 1012 __P(nr_switches); 1013 SEQ_printf(m, "%-45s:%21Ld\n", 1014 "nr_voluntary_switches", (long long)p->nvcsw); 1015 SEQ_printf(m, "%-45s:%21Ld\n", 1016 "nr_involuntary_switches", (long long)p->nivcsw); 1017 1018 P(se.load.weight); 1019 P(se.runnable_weight); 1020 #ifdef CONFIG_SMP 1021 P(se.avg.load_sum); 1022 P(se.avg.runnable_load_sum); 1023 P(se.avg.util_sum); 1024 P(se.avg.load_avg); 1025 P(se.avg.runnable_load_avg); 1026 P(se.avg.util_avg); 1027 P(se.avg.last_update_time); 1028 P(se.avg.util_est.ewma); 1029 P(se.avg.util_est.enqueued); 1030 #endif 1031 P(policy); 1032 P(prio); 1033 if (task_has_dl_policy(p)) { 1034 P(dl.runtime); 1035 P(dl.deadline); 1036 } 1037 #undef PN_SCHEDSTAT 1038 #undef PN 1039 #undef __PN 1040 #undef P_SCHEDSTAT 1041 #undef P 1042 #undef __P 1043 1044 { 1045 unsigned int this_cpu = raw_smp_processor_id(); 1046 u64 t0, t1; 1047 1048 t0 = cpu_clock(this_cpu); 1049 t1 = cpu_clock(this_cpu); 1050 SEQ_printf(m, "%-45s:%21Ld\n", 1051 "clock-delta", (long long)(t1-t0)); 1052 } 1053 1054 sched_show_numa(p, m); 1055 } 1056 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 23 Mar '25

23 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: abf385ef625e6aeb4923da42fef9ebce788f4ecf commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250323/202503231359.qdyINbl7-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503231359.qdyINbl7-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1424/1424] mm/page_alloc.c:1645:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type
by kernel test robot 23 Mar '25

23 Mar '25

Hi Daniel, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: abf385ef625e6aeb4923da42fef9ebce788f4ecf commit: eb761d6521c32c006a4987260394a61c6684fb35 [1424/1424] mm: parallelize deferred struct page initialization within each node config: x86_64-buildonly-randconfig-003-20250217 (https://download.01.org/0day-ci/archive/20250323/202503231236.qN1C5HOM-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250323/202503231236.qN1C5HOM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503231236.qN1C5HOM-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/page_alloc.c:1412:6: warning: no previous prototype for function 'set_zone_contiguous' [-Wmissing-prototypes] 1412 | void set_zone_contiguous(struct zone *zone) | ^ mm/page_alloc.c:1412:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1412 | void set_zone_contiguous(struct zone *zone) | ^ | static mm/page_alloc.c:1433:6: warning: no previous prototype for function 'clear_zone_contiguous' [-Wmissing-prototypes] 1433 | void clear_zone_contiguous(struct zone *zone) | ^ mm/page_alloc.c:1433:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1433 | void clear_zone_contiguous(struct zone *zone) | ^ | static >> mm/page_alloc.c:1645:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-mismatch] 1645 | DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1646 | KTASK_PTE_MINCHUNK); | ~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:139:3: note: expanded from macro 'DEFINE_KTASK_CTL' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: note: expanded from macro 'KTASK_CTL_INITIALIZER' 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1661:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-mismatch] 1661 | DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1662 | KTASK_PTE_MINCHUNK); | ~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:139:3: note: expanded from macro 'DEFINE_KTASK_CTL' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: note: expanded from macro 'KTASK_CTL_INITIALIZER' 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 4 warnings generated. vim +1645 mm/page_alloc.c 1587 1588 /* Initialise remaining memory on a node */ 1589 static int __init deferred_init_memmap(void *data) 1590 { 1591 pg_data_t *pgdat = data; 1592 int nid = pgdat->node_id; 1593 unsigned long start = jiffies; 1594 unsigned long nr_init = 0, nr_free = 0; 1595 unsigned long spfn, epfn, first_init_pfn, flags; 1596 phys_addr_t spa, epa; 1597 int zid; 1598 struct zone *zone; 1599 const struct cpumask *cpumask = cpumask_of_node(pgdat->node_id); 1600 u64 i; 1601 unsigned long nr_node_cpus; 1602 struct ktask_node kn; 1603 1604 /* Bind memory initialisation thread to a local node if possible */ 1605 if (!cpumask_empty(cpumask)) 1606 set_cpus_allowed_ptr(current, cpumask); 1607 1608 pgdat_resize_lock(pgdat, &flags); 1609 first_init_pfn = pgdat->first_deferred_pfn; 1610 if (first_init_pfn == ULONG_MAX) { 1611 pgdat_resize_unlock(pgdat, &flags); 1612 pgdat_init_report_one_done(); 1613 return 0; 1614 } 1615 1616 /* 1617 * We'd like to know the memory bandwidth of the chip to calculate the 1618 * most efficient number of threads to start, but we can't. In 1619 * testing, a good value for a variety of systems was a quarter of the 1620 * CPUs on the node. 1621 */ 1622 nr_node_cpus = DIV_ROUND_UP(cpumask_weight(cpumask), 4); 1623 1624 /* Sanity check boundaries */ 1625 BUG_ON(pgdat->first_deferred_pfn < pgdat->node_start_pfn); 1626 BUG_ON(pgdat->first_deferred_pfn > pgdat_end_pfn(pgdat)); 1627 pgdat->first_deferred_pfn = ULONG_MAX; 1628 1629 /* Only the highest zone is deferred so find it */ 1630 for (zid = 0; zid < MAX_NR_ZONES; zid++) { 1631 zone = pgdat->node_zones + zid; 1632 if (first_init_pfn < zone_end_pfn(zone)) 1633 break; 1634 } 1635 first_init_pfn = max(zone->zone_start_pfn, first_init_pfn); 1636 1637 /* 1638 * Initialize and free pages. We do it in two loops: first we initialize 1639 * struct page, than free to buddy allocator, because while we are 1640 * freeing pages we can access pages that are ahead (computing buddy 1641 * page in __free_one_page()). 1642 */ 1643 for_each_free_mem_range(i, nid, MEMBLOCK_NONE, &spa, &epa, NULL) { 1644 struct deferred_args args = { nid, zid, ATOMIC64_INIT(0) }; > 1645 DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, 1646 KTASK_PTE_MINCHUNK); 1647 ktask_ctl_set_max_threads(&ctl, nr_node_cpus); 1648 1649 spfn = max_t(unsigned long, first_init_pfn, PFN_UP(spa)); 1650 epfn = min_t(unsigned long, zone_end_pfn(zone), PFN_DOWN(epa)); 1651 1652 kn.kn_start = (void *)spfn; 1653 kn.kn_task_size = (spfn < epfn) ? epfn - spfn : 0; 1654 kn.kn_nid = nid; 1655 (void) ktask_run_numa(&kn, 1, &ctl); 1656 1657 nr_init += atomic64_read(&args.nr_pages); 1658 } 1659 for_each_free_mem_range(i, nid, MEMBLOCK_NONE, &spa, &epa, NULL) { 1660 struct deferred_args args = { nid, zid, ATOMIC64_INIT(0) }; 1661 DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, 1662 KTASK_PTE_MINCHUNK); 1663 ktask_ctl_set_max_threads(&ctl, nr_node_cpus); 1664 1665 spfn = max_t(unsigned long, first_init_pfn, PFN_UP(spa)); 1666 epfn = min_t(unsigned long, zone_end_pfn(zone), PFN_DOWN(epa)); 1667 1668 kn.kn_start = (void *)spfn; 1669 kn.kn_task_size = (spfn < epfn) ? epfn - spfn : 0; 1670 kn.kn_nid = nid; 1671 (void) ktask_run_numa(&kn, 1, &ctl); 1672 1673 nr_free += atomic64_read(&args.nr_pages); 1674 } 1675 pgdat_resize_unlock(pgdat, &flags); 1676 1677 /* Sanity check that the next zone really is unpopulated */ 1678 WARN_ON(++zid < MAX_NR_ZONES && populated_zone(++zone)); 1679 VM_BUG_ON(nr_init != nr_free); 1680 1681 zone->managed_pages += nr_free; 1682 1683 pr_info("node %d initialised, %lu pages in %ums\n", nid, nr_free, 1684 jiffies_to_msecs(jiffies - start)); 1685 1686 pgdat_init_report_one_done(); 1687 return 0; 1688 } 1689 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2051/2051] drivers/irqchip/irq-gic-v3.c:1086:43: warning: passing argument 3 of 'single_open' makes pointer from integer without a cast
by kernel test robot 23 Mar '25

23 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6f6f173b2b8fa65e1ef7ebc6e43b0b02c2a52759 commit: 63f9ef213a477c796c6b343010762513f6315f83 [2051/2051] arm64: Add debugfs dir for xint config: arm64-randconfig-r111-20250323 (https://download.01.org/0day-ci/archive/20250323/202503231209.3Hgyvn46-lkp@…) compiler: aarch64-linux-gcc (GCC) 9.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250323/202503231209.3Hgyvn46-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503231209.3Hgyvn46-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/irqchip/irq-gic-v3.c: In function 'xint_proc_write': drivers/irqchip/irq-gic-v3.c:1042:23: error: implicit declaration of function 'pde_data' [-Werror=implicit-function-declaration] 1042 | int irq = (int)(long)pde_data(file_inode(file)); | ^~~~~~~~ drivers/irqchip/irq-gic-v3.c: In function 'xint_proc_open': >> drivers/irqchip/irq-gic-v3.c:1086:43: warning: passing argument 3 of 'single_open' makes pointer from integer without a cast [-Wint-conversion] 1086 | return single_open(file, xint_proc_show, pde_data(inode)); | ^~~~~~~~~~~~~~~ | | | int In file included from include/linux/debugfs.h:16, from arch/arm64/include/../../../kernel/irq/internals.h:495, from drivers/irqchip/irq-gic-v3.c:39: include/linux/seq_file.h:166:68: note: expected 'void *' but argument is of type 'int' 166 | int single_open(struct file *, int (*)(struct seq_file *, void *), void *); | ^~~~~~ drivers/irqchip/irq-gic-v3.c: At top level: drivers/irqchip/irq-gic-v3.c:1089:21: error: variable 'xint_proc_ops' has initializer but incomplete type 1089 | static const struct proc_ops xint_proc_ops = { | ^~~~~~~~ drivers/irqchip/irq-gic-v3.c:1090:3: error: 'const struct proc_ops' has no member named 'proc_open' 1090 | .proc_open = xint_proc_open, | ^~~~~~~~~ drivers/irqchip/irq-gic-v3.c:1090:15: warning: excess elements in struct initializer 1090 | .proc_open = xint_proc_open, | ^~~~~~~~~~~~~~ drivers/irqchip/irq-gic-v3.c:1090:15: note: (near initialization for 'xint_proc_ops') drivers/irqchip/irq-gic-v3.c:1091:3: error: 'const struct proc_ops' has no member named 'proc_read' 1091 | .proc_read = seq_read, | ^~~~~~~~~ drivers/irqchip/irq-gic-v3.c:1091:15: warning: excess elements in struct initializer 1091 | .proc_read = seq_read, | ^~~~~~~~ drivers/irqchip/irq-gic-v3.c:1091:15: note: (near initialization for 'xint_proc_ops') drivers/irqchip/irq-gic-v3.c:1092:3: error: 'const struct proc_ops' has no member named 'proc_lseek' 1092 | .proc_lseek = seq_lseek, | ^~~~~~~~~~ drivers/irqchip/irq-gic-v3.c:1092:16: warning: excess elements in struct initializer 1092 | .proc_lseek = seq_lseek, | ^~~~~~~~~ drivers/irqchip/irq-gic-v3.c:1092:16: note: (near initialization for 'xint_proc_ops') drivers/irqchip/irq-gic-v3.c:1093:3: error: 'const struct proc_ops' has no member named 'proc_release' 1093 | .proc_release = single_release, | ^~~~~~~~~~~~ drivers/irqchip/irq-gic-v3.c:1093:18: warning: excess elements in struct initializer 1093 | .proc_release = single_release, | ^~~~~~~~~~~~~~ drivers/irqchip/irq-gic-v3.c:1093:18: note: (near initialization for 'xint_proc_ops') drivers/irqchip/irq-gic-v3.c:1094:3: error: 'const struct proc_ops' has no member named 'proc_write' 1094 | .proc_write = xint_proc_write, | ^~~~~~~~~~ drivers/irqchip/irq-gic-v3.c:1094:16: warning: excess elements in struct initializer 1094 | .proc_write = xint_proc_write, | ^~~~~~~~~~~~~~~ drivers/irqchip/irq-gic-v3.c:1094:16: note: (near initialization for 'xint_proc_ops') drivers/irqchip/irq-gic-v3.c: In function 'register_irqchip_proc': drivers/irqchip/irq-gic-v3.c:1103:2: error: implicit declaration of function 'proc_create_data' [-Werror=implicit-function-declaration] 1103 | proc_create_data("xint", 0644, desc->dir, &xint_proc_ops, irqp); | ^~~~~~~~~~~~~~~~ drivers/irqchip/irq-gic-v3.c: In function 'unregister_irqchip_proc': drivers/irqchip/irq-gic-v3.c:1111:2: error: implicit declaration of function 'remove_proc_entry' [-Werror=implicit-function-declaration] 1111 | remove_proc_entry("xint", desc->dir); | ^~~~~~~~~~~~~~~~~ drivers/irqchip/irq-gic-v3.c: At top level: drivers/irqchip/irq-gic-v3.c:1089:30: error: storage size of 'xint_proc_ops' isn't known 1089 | static const struct proc_ops xint_proc_ops = { | ^~~~~~~~~~~~~ cc1: some warnings being treated as errors Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] vim +/single_open +1086 drivers/irqchip/irq-gic-v3.c 3053668e6b2119 Jinjie Ruan 2024-11-25 1038 3053668e6b2119 Jinjie Ruan 2024-11-25 1039 static ssize_t xint_proc_write(struct file *file, 3053668e6b2119 Jinjie Ruan 2024-11-25 1040 const char __user *buffer, size_t count, loff_t *pos) 3053668e6b2119 Jinjie Ruan 2024-11-25 1041 { 3053668e6b2119 Jinjie Ruan 2024-11-25 @1042 int irq = (int)(long)pde_data(file_inode(file)); 3053668e6b2119 Jinjie Ruan 2024-11-25 1043 bool xint_state = false; 3053668e6b2119 Jinjie Ruan 2024-11-25 1044 unsigned long val; 3053668e6b2119 Jinjie Ruan 2024-11-25 1045 char *buf = NULL; 3053668e6b2119 Jinjie Ruan 2024-11-25 1046 3053668e6b2119 Jinjie Ruan 2024-11-25 1047 if (!xint_transform(irq, XINT_RANGE_CHECK)) 3053668e6b2119 Jinjie Ruan 2024-11-25 1048 return -EPERM; 3053668e6b2119 Jinjie Ruan 2024-11-25 1049 3053668e6b2119 Jinjie Ruan 2024-11-25 1050 buf = memdup_user_nul(buffer, count); 3053668e6b2119 Jinjie Ruan 2024-11-25 1051 if (IS_ERR(buf)) 3053668e6b2119 Jinjie Ruan 2024-11-25 1052 return PTR_ERR(buf); 3053668e6b2119 Jinjie Ruan 2024-11-25 1053 3053668e6b2119 Jinjie Ruan 2024-11-25 1054 if (kstrtoul(buf, 0, &val) || (val != 0 && val != 1)) { 3053668e6b2119 Jinjie Ruan 2024-11-25 1055 kfree(buf); 3053668e6b2119 Jinjie Ruan 2024-11-25 1056 return -EINVAL; 3053668e6b2119 Jinjie Ruan 2024-11-25 1057 } 3053668e6b2119 Jinjie Ruan 2024-11-25 1058 3053668e6b2119 Jinjie Ruan 2024-11-25 1059 xint_state = xint_transform(irq, XINT_SET_CHECK); 3053668e6b2119 Jinjie Ruan 2024-11-25 1060 if (xint_state == val) { 3053668e6b2119 Jinjie Ruan 2024-11-25 1061 kfree(buf); 3053668e6b2119 Jinjie Ruan 2024-11-25 1062 return -EBUSY; 3053668e6b2119 Jinjie Ruan 2024-11-25 1063 } 3053668e6b2119 Jinjie Ruan 2024-11-25 1064 3053668e6b2119 Jinjie Ruan 2024-11-25 1065 local_irq_disable(); 3053668e6b2119 Jinjie Ruan 2024-11-25 1066 disable_irq(irq); 3053668e6b2119 Jinjie Ruan 2024-11-25 1067 3053668e6b2119 Jinjie Ruan 2024-11-25 1068 xint_transform(irq, xint_state ? XINT_TO_IRQ : IRQ_TO_XINT); 3053668e6b2119 Jinjie Ruan 2024-11-25 1069 3053668e6b2119 Jinjie Ruan 2024-11-25 1070 enable_irq(irq); 3053668e6b2119 Jinjie Ruan 2024-11-25 1071 local_irq_enable(); 3053668e6b2119 Jinjie Ruan 2024-11-25 1072 3053668e6b2119 Jinjie Ruan 2024-11-25 1073 kfree(buf); 3053668e6b2119 Jinjie Ruan 2024-11-25 1074 3053668e6b2119 Jinjie Ruan 2024-11-25 1075 return count; 3053668e6b2119 Jinjie Ruan 2024-11-25 1076 } 3053668e6b2119 Jinjie Ruan 2024-11-25 1077 3053668e6b2119 Jinjie Ruan 2024-11-25 1078 static int xint_proc_show(struct seq_file *m, void *v) 3053668e6b2119 Jinjie Ruan 2024-11-25 1079 { 3053668e6b2119 Jinjie Ruan 2024-11-25 1080 seq_printf(m, "%d\n", xint_transform((long)m->private, XINT_SET_CHECK)); 3053668e6b2119 Jinjie Ruan 2024-11-25 1081 return 0; 3053668e6b2119 Jinjie Ruan 2024-11-25 1082 } 3053668e6b2119 Jinjie Ruan 2024-11-25 1083 3053668e6b2119 Jinjie Ruan 2024-11-25 1084 static int xint_proc_open(struct inode *inode, struct file *file) 3053668e6b2119 Jinjie Ruan 2024-11-25 1085 { 3053668e6b2119 Jinjie Ruan 2024-11-25 @1086 return single_open(file, xint_proc_show, pde_data(inode)); 3053668e6b2119 Jinjie Ruan 2024-11-25 1087 } 3053668e6b2119 Jinjie Ruan 2024-11-25 1088 :::::: The code at line 1086 was first introduced by commit :::::: 3053668e6b211924bb67c19d791a5a532eca2ad8 arm64: Introduce Xint software solution :::::: TO: Jinjie Ruan <ruanjinjie(a)huawei.com> :::::: CC: Jinjie Ruan <ruanjinjie(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2051/2051] drivers/platform/mpam/mpam_devices.c:247:11: error: incompatible types when assigning to type 'pgprot_t' {aka 'struct <anonymous>'} from type 'int'
by kernel test robot 23 Mar '25

23 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6f6f173b2b8fa65e1ef7ebc6e43b0b02c2a52759 commit: 3e9e723f3bf92a19e5e15dda89bbb136ce463294 [2051/2051] arm_mpam: Add probe/remove for mpam msc driver and kbuild boiler plate config: arm64-randconfig-r064-20250323 (https://download.01.org/0day-ci/archive/20250323/202503231208.7HZ1I0ac-lkp@…) compiler: aarch64-linux-gcc (GCC) 9.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250323/202503231208.7HZ1I0ac-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503231208.7HZ1I0ac-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from include/linux/mmzone.h:8, from include/linux/gfp.h:7, from include/linux/slab.h:16, from include/linux/resource_ext.h:11, from include/linux/acpi.h:13, from drivers/platform/mpam/mpam_devices.c:6: drivers/platform/mpam/mpam_devices.c: In function 'mpam_msc_drv_probe': drivers/platform/mpam/mpam_devices.c:212:24: error: 'struct mpam_msc' has no member named 'mon_sel_lock'; did you mean 'part_sel_lock'? 212 | spin_lock_init(&msc->mon_sel_lock); | ^~~~~~~~~~~~ include/linux/spinlock.h:335:38: note: in definition of macro 'spin_lock_init' 335 | __raw_spin_lock_init(spinlock_check(lock), \ | ^~~~ drivers/platform/mpam/mpam_devices.c:247:11: error: implicit declaration of function '__acpi_get_mem_attribute' [-Werror=implicit-function-declaration] 247 | prot = __acpi_get_mem_attribute(msc->pcc_chan->shmem_base_addr); | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/platform/mpam/mpam_devices.c:247:11: error: incompatible types when assigning to type 'pgprot_t' {aka 'struct <anonymous>'} from type 'int' cc1: some warnings being treated as errors vim +247 drivers/platform/mpam/mpam_devices.c 170 171 static int mpam_msc_drv_probe(struct platform_device *pdev) 172 { 173 int err; 174 pgprot_t prot; 175 void * __iomem io; 176 struct mpam_msc *msc; 177 struct resource *msc_res; 178 void *plat_data = pdev->dev.platform_data; 179 180 mutex_lock(&mpam_list_lock); 181 do { 182 msc = devm_kzalloc(&pdev->dev, sizeof(*msc), GFP_KERNEL); 183 if (!msc) { 184 err = -ENOMEM; 185 break; 186 } 187 188 INIT_LIST_HEAD_RCU(&msc->glbl_list); 189 msc->pdev = pdev; 190 191 err = device_property_read_u32(&pdev->dev, "arm,not-ready-us", 192 &msc->nrdy_usec); 193 if (err) { 194 /* This will prevent CSU monitors being usable */ 195 msc->nrdy_usec = 0; 196 } 197 198 err = get_msc_affinity(msc); 199 if (err) 200 break; 201 if (cpumask_empty(&msc->accessibility)) { 202 pr_err_once("msc:%u is not accessible from any CPU!", 203 msc->id); 204 err = -EINVAL; 205 break; 206 } 207 208 mutex_init(&msc->lock); 209 msc->id = mpam_num_msc++; 210 INIT_LIST_HEAD_RCU(&msc->ris); 211 spin_lock_init(&msc->part_sel_lock); 212 spin_lock_init(&msc->mon_sel_lock); 213 214 if (device_property_read_u32(&pdev->dev, "pcc-channel", 215 &msc->pcc_subspace_id)) 216 msc->iface = MPAM_IFACE_MMIO; 217 else 218 msc->iface = MPAM_IFACE_PCC; 219 220 if (msc->iface == MPAM_IFACE_MMIO) { 221 io = devm_platform_get_and_ioremap_resource(pdev, 0, 222 &msc_res); 223 if (IS_ERR(io)) { 224 pr_err("Failed to map MSC base address\n"); 225 devm_kfree(&pdev->dev, msc); 226 err = PTR_ERR(io); 227 break; 228 } 229 msc->mapped_hwpage_sz = msc_res->end - msc_res->start; 230 msc->mapped_hwpage = io; 231 } else if (msc->iface == MPAM_IFACE_PCC) { 232 msc->pcc_cl.dev = &pdev->dev; 233 msc->pcc_cl.rx_callback = mpam_pcc_rx_callback; 234 msc->pcc_cl.tx_block = false; 235 msc->pcc_cl.tx_tout = 1000; /* 1s */ 236 msc->pcc_cl.knows_txdone = false; 237 238 msc->pcc_chan = pcc_mbox_request_channel(&msc->pcc_cl, 239 msc->pcc_subspace_id); 240 if (IS_ERR(msc->pcc_chan)) { 241 pr_err("Failed to request MSC PCC channel\n"); 242 devm_kfree(&pdev->dev, msc); 243 err = PTR_ERR(msc->pcc_chan); 244 break; 245 } 246 > 247 prot = __acpi_get_mem_attribute(msc->pcc_chan->shmem_base_addr); 248 io = ioremap_prot(msc->pcc_chan->shmem_base_addr, 249 msc->pcc_chan->shmem_size, pgprot_val(prot)); 250 if (IS_ERR(io)) { 251 pr_err("Failed to map MSC base address\n"); 252 pcc_mbox_free_channel(msc->pcc_chan); 253 devm_kfree(&pdev->dev, msc); 254 err = PTR_ERR(io); 255 break; 256 } 257 258 /* TODO: issue a read to update the registers */ 259 260 msc->mapped_hwpage_sz = msc->pcc_chan->shmem_size; 261 msc->mapped_hwpage = io + sizeof(struct acpi_pcct_shared_memory); 262 } 263 264 list_add_rcu(&msc->glbl_list, &mpam_all_msc); 265 platform_set_drvdata(pdev, msc); 266 } while (0); 267 mutex_unlock(&mpam_list_lock); 268 269 if (!err) { 270 /* Create RIS entries described by firmware */ 271 if (!acpi_disabled) 272 err = acpi_mpam_parse_resources(msc, plat_data); 273 else 274 err = mpam_dt_parse_resources(msc, plat_data); 275 } 276 277 if (!err && fw_num_msc == mpam_num_msc) 278 mpam_discovery_complete(); 279 280 return err; 281 } 282 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2051/2051] include/linux/if_caqm.h:391:23: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 23 Mar '25

23 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6f6f173b2b8fa65e1ef7ebc6e43b0b02c2a52759 commit: 946747d4a52c34156031e41f9cb5cfb292747dcf [2051/2051] net: tcp: Add CAQM4TCP in the openeuler 6.6 kernel config: arm64-randconfig-r111-20250323 (https://download.01.org/0day-ci/archive/20250323/202503231154.d6j01UpO-lkp@…) compiler: aarch64-linux-gcc (GCC) 9.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250323/202503231154.d6j01UpO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503231154.d6j01UpO-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) net/core/gro.c: note: in included file: >> include/linux/if_caqm.h:391:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] caqm_hdr_info @@ got restricted __be16 [usertype] h_caqm_info @@ include/linux/if_caqm.h:391:23: sparse: expected unsigned short [usertype] caqm_hdr_info include/linux/if_caqm.h:391:23: sparse: got restricted __be16 [usertype] h_caqm_info -- net/ethernet/eth.c: note: in included file: >> include/linux/if_caqm.h:470:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] @@ got restricted __be16 [usertype] @@ include/linux/if_caqm.h:470:25: sparse: expected unsigned short [usertype] include/linux/if_caqm.h:470:25: sparse: got restricted __be16 [usertype] vim +391 include/linux/if_caqm.h 359 360 static inline void skb_gro_caqm_untag(struct sk_buff *skb) 361 { 362 #ifdef CONFIG_ETH_CAQM 363 struct caqm_hdr *chdr; 364 struct vlan_hdr *vlanhdr; 365 u16 caqm_hdr_info; 366 __be16 proto = skb->protocol; 367 u8 skip_time = 0; 368 int mac_len, meta_len; 369 void *meta; 370 struct caqm_hdr tmp_caqm_data; 371 372 if (!static_branch_unlikely(&sysctl_caqm_enable) || skb_shared(skb)) 373 return; 374 375 /* We may access the two bytes after caqm_hdr in caqm_set_encap_proto(). */ 376 if (unlikely(!pskb_may_pull(skb, VLAN_HLEN * 2 + CAQM_HLEN + sizeof(unsigned short)))) 377 return; 378 379 vlanhdr = (struct vlan_hdr *)(skb->data - VLAN_HLEN); 380 // Skip at most 2 vlan hdr 381 while (skip_time < 2 && eth_type_vlan(proto)) { 382 vlanhdr++; // chdr move a VLAN len 383 skip_time += 1; 384 proto = vlanhdr->h_vlan_encapsulated_proto; 385 } 386 // Look for vlan header, 2 times 387 if (!eth_type_caqm(proto) || skb_cow(skb, skb_headroom(skb)) < 0) 388 return; 389 390 chdr = (struct caqm_hdr *)(((void *)vlanhdr) + VLAN_HLEN); > 391 caqm_hdr_info = chdr->h_caqm_info; 392 __caqm_put_tag(skb, caqm_hdr_info); 393 394 if ((unsigned char *) chdr != skb->data) { 395 // adjust the caqm header before vlan header 396 // 1. Set the vlanhdr->proto as the next 397 vlanhdr->h_vlan_encapsulated_proto = chdr->h_caqm_encapsulated_proto; 398 // 2. Exchange caqm and vlan hdr 399 tmp_caqm_data = *chdr; 400 memmove(skb->data + CAQM_HLEN, skb->data, skip_time * VLAN_HLEN); 401 *(struct caqm_hdr *)(skb->data) = tmp_caqm_data; 402 } else 403 caqm_set_encap_proto(skb, chdr); 404 405 skb_pull_rcsum(skb, CAQM_HLEN); 406 407 mac_len = skb->data - skb_mac_header(skb); 408 if (likely(mac_len > CAQM_HLEN + ETH_TLEN)) { 409 memmove(skb_mac_header(skb) + CAQM_HLEN, skb_mac_header(skb), 410 mac_len - CAQM_HLEN - ETH_TLEN); 411 } 412 413 meta_len = skb_metadata_len(skb); 414 if (meta_len) { 415 meta = skb_metadata_end(skb) - meta_len; 416 memmove(meta + CAQM_HLEN, meta, meta_len); 417 } 418 419 skb->mac_header += CAQM_HLEN; 420 421 skb_reset_network_header(skb); 422 if (!skb_transport_header_was_set(skb)) 423 skb_reset_transport_header(skb); 424 skb_reset_mac_len(skb); 425 426 #endif 427 } 428 429 #ifdef CONFIG_ETH_CAQM 430 static inline __be16 caqm_get_protocol_and_depth(struct sk_buff *skb, 431 __be16 type, int *depth) 432 { 433 type = vlan_get_protocol_and_depth(skb, type, depth); 434 if (static_branch_unlikely(&sysctl_caqm_enable) && eth_type_caqm(type)) 435 return caqm_get_protocol_and_depth_after_vlan(skb, type, depth); 436 else 437 return type; 438 } 439 #endif 440 441 static inline void caqm_update_hint_in_gro(struct sk_buff *skb, struct sk_buff *p) 442 { 443 #ifdef CONFIG_ETH_CAQM 444 struct skb_caqm_info *cinfo_p = get_skb_caqm_info(p); 445 struct skb_caqm_info *cinfo_skb = get_skb_caqm_info(skb); 446 447 if (static_branch_unlikely(&sysctl_caqm_enable) && cinfo_p->recv_en && cinfo_skb->recv_en) { 448 cinfo_p->recv_hint += cinfo_skb->recv_hint; 449 cinfo_skb->recv_en = 0; 450 } 451 #endif 452 } 453 454 static inline int caqm_add_eth_header(struct sk_buff *skb, unsigned short *type, 455 struct net_device *dev) 456 { 457 #ifdef CONFIG_ETH_CAQM 458 struct skb_caqm_info *cinfo = get_skb_caqm_info(skb); 459 460 if (static_branch_unlikely(&sysctl_caqm_enable) && 461 (sysctl_caqm_filter_nics & (1UL << dev->ifindex)) == 0) 462 cinfo->send_en = 0; 463 if (static_branch_unlikely(&sysctl_caqm_enable) && cinfo->send_en) { 464 cinfo->send_en = 0; 465 if (unlikely(skb_headroom(skb) < ETH_HLEN + CAQM_HLEN)) 466 return -ETH_HLEN; 467 u16 *chdr = skb_push(skb, CAQM_HLEN); 468 469 chdr[0] = (cinfo->send_hdr); > 470 chdr[1] = htons(*type); 471 *type = (unsigned short)sysctl_caqm_tpid; 472 } 473 #endif 474 return 0; 475 } 476 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2051/2051] mm/memblock.c:1409:20: sparse: sparse: symbol 'memblock_alloc_range_nid_flags' was not declared. Should it be static?
by kernel test robot 23 Mar '25

23 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6f6f173b2b8fa65e1ef7ebc6e43b0b02c2a52759 commit: 64018b291c1f49622c4b23b303364d760306d662 [2051/2051] mm/memblock: Introduce ability to alloc memory from specify memory region config: loongarch-randconfig-r131-20250323 (https://download.01.org/0day-ci/archive/20250323/202503231106.ZSS1yt6E-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250323/202503231106.ZSS1yt6E-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503231106.ZSS1yt6E-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/memblock.c:1409:20: sparse: sparse: symbol 'memblock_alloc_range_nid_flags' was not declared. Should it be static? vim +/memblock_alloc_range_nid_flags +1409 mm/memblock.c 1386 1387 /** 1388 * memblock_alloc_range_nid_flags - allocate boot memory block with specify flag 1389 * @size: size of memory block to be allocated in bytes 1390 * @align: alignment of the region and block's size 1391 * @start: the lower bound of the memory region to allocate (phys address) 1392 * @end: the upper bound of the memory region to allocate (phys address) 1393 * @nid: nid of the free area to find, %NUMA_NO_NODE for any node 1394 * @exact_nid: control the allocation fall back to other nodes 1395 * @flags: alloc memory from specify memblock flag 1396 * 1397 * The allocation is performed from memory region limited by 1398 * memblock.current_limit if @end == %MEMBLOCK_ALLOC_ACCESSIBLE. 1399 * 1400 * If the specified node can not hold the requested memory and @exact_nid 1401 * is false, the allocation falls back to any node in the system. 1402 * 1403 * In addition, function sets the min_count to 0 using kmemleak_alloc_phys for 1404 * allocated boot memory block, so that it is never reported as leaks. 1405 * 1406 * Return: 1407 * Physical address of allocated memory block on success, %0 on failure. 1408 */ > 1409 phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, 1410 phys_addr_t align, phys_addr_t start, 1411 phys_addr_t end, int nid, 1412 bool exact_nid, 1413 enum memblock_flags flags) 1414 { 1415 phys_addr_t found; 1416 1417 if (WARN_ONCE(nid == MAX_NUMNODES, "Usage of MAX_NUMNODES is deprecated. Use NUMA_NO_NODE instead\n")) 1418 nid = NUMA_NO_NODE; 1419 1420 if (!align) { 1421 /* Can't use WARNs this early in boot on powerpc */ 1422 dump_stack(); 1423 align = SMP_CACHE_BYTES; 1424 } 1425 1426 again: 1427 found = memblock_find_in_range_node(size, align, start, end, nid, 1428 flags); 1429 if (found && !memblock_reserve(found, size)) 1430 goto done; 1431 1432 if (nid != NUMA_NO_NODE && !exact_nid) { 1433 found = memblock_find_in_range_node(size, align, start, 1434 end, NUMA_NO_NODE, 1435 flags); 1436 if (found && !memblock_reserve(found, size)) 1437 goto done; 1438 } 1439 1440 if (flags & MEMBLOCK_MIRROR) { 1441 flags &= ~MEMBLOCK_MIRROR; 1442 pr_warn_ratelimited("Could not allocate %pap bytes of mirrored memory\n", 1443 &size); 1444 goto again; 1445 } 1446 1447 return 0; 1448 1449 done: 1450 /* 1451 * Skip kmemleak for those places like kasan_init() and 1452 * early_pgtable_alloc() due to high volume. 1453 */ 1454 if (end != MEMBLOCK_ALLOC_NOLEAKTRACE) 1455 /* 1456 * Memblock allocated blocks are never reported as 1457 * leaks. This is because many of these blocks are 1458 * only referred via the physical address which is 1459 * not looked up by kmemleak. 1460 */ 1461 kmemleak_alloc_phys(found, size, 0); 1462 1463 /* 1464 * Some Virtual Machine platforms, such as Intel TDX or AMD SEV-SNP, 1465 * require memory to be accepted before it can be used by the 1466 * guest. 1467 * 1468 * Accept the memory of the allocated buffer. 1469 */ 1470 accept_memory(found, found + size); 1471 1472 return found; 1473 } 1474 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2051/2051] kernel/sched/core.c:11516:4: warning: format specifies type 'unsigned long long' but the argument has type 'int'
by kernel test robot 23 Mar '25

23 Mar '25

Hi Hui, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6f6f173b2b8fa65e1ef7ebc6e43b0b02c2a52759 commit: 6eb07f9925a906d81f328c808ba25f7800888dce [2051/2051] sched: Introduce smart grid scheduling strategy for cfs config: arm64-randconfig-r061-20250323 (https://download.01.org/0day-ci/archive/20250323/202503231038.JR2kOoEd-lkp@…) compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250323/202503231038.JR2kOoEd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503231038.JR2kOoEd-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/sched/core.c:11374:5: warning: no previous prototype for function 'tg_set_dynamic_affinity_mode' [-Wmissing-prototypes] int tg_set_dynamic_affinity_mode(struct task_group *tg, u64 mode) ^ kernel/sched/core.c:11374:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int tg_set_dynamic_affinity_mode(struct task_group *tg, u64 mode) ^ static kernel/sched/core.c:11415:5: warning: no previous prototype for function 'tg_set_affinity_period' [-Wmissing-prototypes] int tg_set_affinity_period(struct task_group *tg, u64 period_ms) ^ kernel/sched/core.c:11415:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int tg_set_affinity_period(struct task_group *tg, u64 period_ms) ^ static kernel/sched/core.c:11429:5: warning: no previous prototype for function 'tg_get_affinity_period' [-Wmissing-prototypes] u64 tg_get_affinity_period(struct task_group *tg) ^ kernel/sched/core.c:11429:1: note: declare 'static' if the function is not intended to be used outside of this translation unit u64 tg_get_affinity_period(struct task_group *tg) ^ static >> kernel/sched/core.c:11516:4: warning: format specifies type 'unsigned long long' but the argument has type 'int' [-Wformat] schedstat_val(ad->stay_cnt[i])); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/stats.h:100:32: note: expanded from macro 'schedstat_val' # define schedstat_val(var) 0 ^ 4 warnings generated. vim +11516 kernel/sched/core.c 11493 11494 static int cpu_affinity_stat_show(struct seq_file *sf, void *v) 11495 { 11496 struct task_group *tg = css_tg(seq_css(sf)); 11497 struct auto_affinity *auto_affi = tg->auto_affinity; 11498 struct affinity_domain *ad; 11499 int i; 11500 11501 /* No stat when dynamic affinity disabled */ 11502 if (!dynamic_affinity_enabled()) 11503 return -EPERM; 11504 11505 if (unlikely(!auto_affi)) 11506 return -EPERM; 11507 11508 ad = &auto_affi->ad; 11509 seq_printf(sf, "period_active %d\n", auto_affi->period_active); 11510 seq_printf(sf, "dcount %d\n", ad->dcount); 11511 seq_printf(sf, "domain_mask 0x%x\n", ad->domain_mask); 11512 seq_printf(sf, "curr_level %d\n", ad->curr_level); 11513 for (i = 0; i < ad->dcount; i++) 11514 seq_printf(sf, "sd_level %d, cpu list %*pbl, stay_cnt %llu\n", 11515 i, cpumask_pr_args(ad->domains[i]), 11516 schedstat_val(ad->stay_cnt[i])); 11517 11518 return 0; 11519 } 11520 #endif /* CONFIG_QOS_SCHED_SMART_GRID */ 11521 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2051/2051] drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: sparse: incorrect type in argument 1 (different base types)
by kernel test robot 23 Mar '25

23 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6f6f173b2b8fa65e1ef7ebc6e43b0b02c2a52759 commit: 9c1c9598010fbb9daa1e2a67d23830092fb6246a [2051/2051] net/hinic: Update Huawei Intelligent Network Card Driver: hinic config: arm64-randconfig-r111-20250323 (https://download.01.org/0day-ci/archive/20250323/202503231008.CBNqLNFq-lkp@…) compiler: aarch64-linux-gcc (GCC) 9.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250323/202503231008.CBNqLNFq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503231008.CBNqLNFq-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] value @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: expected unsigned int [usertype] value drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_hwif.c:592:29: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base @@ got void *cfg_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:592:29: sparse: expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:592:29: sparse: got void *cfg_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:593:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *intr_regs_base @@ got void *intr_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:593:30: sparse: expected unsigned char [noderef] [usertype] __iomem *intr_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:593:30: sparse: got void *intr_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:596:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *db_base @@ got void *db_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:596:23: sparse: expected unsigned char [noderef] [usertype] __iomem *db_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:596:23: sparse: got void *db_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:597:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __iomem *dwqe_mapping @@ got void *dwqe_mapping @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:597:28: sparse: expected void [noderef] __iomem *dwqe_mapping drivers/net/ethernet/huawei/hinic/hinic_hwif.c:597:28: sparse: got void *dwqe_mapping >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:64: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] gfp @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:64: sparse: expected restricted gfp_t [usertype] gfp drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:64: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:679:64: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] gfp @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:679:64: sparse: expected restricted gfp_t [usertype] gfp drivers/net/ethernet/huawei/hinic/hinic_hwif.c:679:64: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:984:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:984:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:984:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:984:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:984:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:984:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:993:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:993:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:993:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:993:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:993:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:993:17: sparse: sparse: cast to restricted __be32 vim +46 drivers/net/ethernet/huawei/hinic/hinic_hwif.c 36 37 /* For UEFI driver, this function can only read BAR0 */ 38 u32 hinic_hwif_read_reg(struct hinic_hwif *hwif, u32 reg) 39 { > 40 return be32_to_cpu(readl(hwif->cfg_regs_base + reg)); 41 } 42 43 /* For UEFI driver, this function can only write BAR0 */ 44 void hinic_hwif_write_reg(struct hinic_hwif *hwif, u32 reg, u32 val) 45 { > 46 writel(cpu_to_be32(val), hwif->cfg_regs_base + reg); 47 } 48 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2051/2051] include/linux/userfaultfd_k.h:66:45: sparse: sparse: restricted uffd_flags_t degrades to integer
by kernel test robot 23 Mar '25

23 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6f6f173b2b8fa65e1ef7ebc6e43b0b02c2a52759 commit: 0214feb8f616acf62f9a6a2a131f0a1479b2b8af [2051/2051] mm/userswap: introduce UFFDIO_COPY_MODE_DIRECT_MAP config: loongarch-randconfig-r131-20250323 (https://download.01.org/0day-ci/archive/20250323/202503231043.bCX9sPgT-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250323/202503231043.bCX9sPgT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503231043.bCX9sPgT-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/userfaultfd.c:136:9: sparse: sparse: context imbalance in 'mfill_atomic_install_pte' - unexpected unlock mm/userfaultfd.c:243:9: sparse: sparse: context imbalance in 'mfill_atomic_pte_zeropage' - unexpected unlock mm/userfaultfd.c:325:9: sparse: sparse: context imbalance in 'mfill_atomic_pte_poison' - unexpected unlock mm/userfaultfd.c: note: in included file: >> include/linux/userfaultfd_k.h:66:45: sparse: sparse: restricted uffd_flags_t degrades to integer >> include/linux/userfaultfd_k.h:67:32: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted uffd_flags_t [usertype] flags @@ got unsigned int enum mfill_atomic_mode mode @@ include/linux/userfaultfd_k.h:67:32: sparse: expected restricted uffd_flags_t [usertype] flags include/linux/userfaultfd_k.h:67:32: sparse: got unsigned int enum mfill_atomic_mode mode >> include/linux/userfaultfd_k.h:66:45: sparse: sparse: restricted uffd_flags_t degrades to integer >> include/linux/userfaultfd_k.h:67:32: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted uffd_flags_t [usertype] flags @@ got unsigned int enum mfill_atomic_mode mode @@ include/linux/userfaultfd_k.h:67:32: sparse: expected restricted uffd_flags_t [usertype] flags include/linux/userfaultfd_k.h:67:32: sparse: got unsigned int enum mfill_atomic_mode mode >> include/linux/userfaultfd_k.h:66:45: sparse: sparse: restricted uffd_flags_t degrades to integer >> include/linux/userfaultfd_k.h:67:32: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted uffd_flags_t [usertype] flags @@ got unsigned int enum mfill_atomic_mode mode @@ include/linux/userfaultfd_k.h:67:32: sparse: expected restricted uffd_flags_t [usertype] flags include/linux/userfaultfd_k.h:67:32: sparse: got unsigned int enum mfill_atomic_mode mode >> include/linux/userfaultfd_k.h:66:45: sparse: sparse: restricted uffd_flags_t degrades to integer >> include/linux/userfaultfd_k.h:67:32: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted uffd_flags_t [usertype] flags @@ got unsigned int enum mfill_atomic_mode mode @@ include/linux/userfaultfd_k.h:67:32: sparse: expected restricted uffd_flags_t [usertype] flags include/linux/userfaultfd_k.h:67:32: sparse: got unsigned int enum mfill_atomic_mode mode vim +66 include/linux/userfaultfd_k.h 63 64 static inline uffd_flags_t uffd_flags_set_mode(uffd_flags_t flags, enum mfill_atomic_mode mode) 65 { > 66 if (IS_ENABLED(CONFIG_USERSWAP) && (flags & MFILL_ATOMIC_DIRECT_MAP) && > 67 uffd_flags_mode_is(mode, MFILL_ATOMIC_COPY)) 68 mode = MFILL_ATOMIC_DIRECT_MAP; 69 70 flags &= ~MFILL_ATOMIC_MODE_MASK; 71 return flags | ((__force uffd_flags_t) mode); 72 } 73 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1512/1512] kernel/sched/grid/qos.c:84:31: error: 'struct mempolicy' has no member named 'v'
by kernel test robot 23 Mar '25

23 Mar '25

Hi Wang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: abf385ef625e6aeb4923da42fef9ebce788f4ecf commit: ce35ded5d5774f055f6850b15032066ff4936414 [1512/1512] sched: smart grid: init sched_grid_qos structure on QOS purpose config: arm64-randconfig-r061-20250323 (https://download.01.org/0day-ci/archive/20250323/202503230934.Ug2Wd8BQ-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250323/202503230934.Ug2Wd8BQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503230934.Ug2Wd8BQ-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/grid/qos.c:19: kernel/sched/grid/qos.c: In function 'sched_grid_preferred_interleave_nid': >> kernel/sched/grid/qos.c:84:31: error: 'struct mempolicy' has no member named 'v' 84 | if (nodes_equal(policy->v.nodes, *preferred_nmask)) | ^~ include/linux/nodemask.h:202:41: note: in definition of macro 'nodes_equal' 202 | __nodes_equal(&(src1), &(src2), MAX_NUMNODES) | ^~~~ kernel/sched/grid/qos.c:91:32: error: 'struct mempolicy' has no member named 'v' 91 | nodes_and(nmask, policy->v.nodes, *preferred_nmask); | ^~ include/linux/nodemask.h:162:47: note: in definition of macro 'nodes_and' 162 | __nodes_and(&(dst), &(src1), &(src2), MAX_NUMNODES) | ^~~~ >> kernel/sched/grid/qos.c:95:31: error: 'struct task_struct' has no member named 'il_prev' 95 | next = next_node_in(me->il_prev, nmask); | ^~ include/linux/nodemask.h:278:46: note: in definition of macro 'next_node_in' 278 | #define next_node_in(n, src) __next_node_in((n), &(src)) | ^ kernel/sched/grid/qos.c:97:19: error: 'struct task_struct' has no member named 'il_prev' 97 | me->il_prev = next; | ^~ In file included from kernel/sched/grid/qos.c:20: At top level: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ vim +84 kernel/sched/grid/qos.c > 19 #include <linux/nodemask.h> 20 #include <linux/mempolicy.h> 21 #include <linux/slab.h> 22 #include <linux/sched.h> 23 #include <linux/sched/grid_qos.h> 24 #include "internal.h" 25 26 static int qos_affinity_set(struct task_struct *p) 27 { 28 int n; 29 struct sched_grid_qos_affinity *affinity = &p->grid_qos->affinity; 30 31 nodes_clear(affinity->mem_preferred_node_mask); 32 /* 33 * We want the memory allocation to be as close to the CPU 34 * as possible, and adjust after getting memory bandwidth usage. 35 */ 36 for (n = 0; n < nr_node_ids; n++) 37 if (cpumask_intersects(cpumask_of_node(n), p->prefer_cpus)) 38 node_set(n, affinity->mem_preferred_node_mask); 39 40 return 0; 41 } 42 43 int sched_grid_qos_fork(struct task_struct *p, struct task_struct *orig) 44 { 45 struct sched_grid_qos *qos; 46 47 qos = kzalloc(sizeof(*qos), GFP_KERNEL); 48 if (!qos) 49 return -ENOMEM; 50 51 qos_power_init(&qos->power); 52 qos_stat_init(&qos->stat); 53 54 nodes_clear(qos->affinity.mem_preferred_node_mask); 55 if (likely(orig->grid_qos)) 56 qos->affinity = orig->grid_qos->affinity; 57 qos->affinity_set = qos_affinity_set; 58 p->grid_qos = qos; 59 60 return 0; 61 } 62 63 void sched_grid_qos_free(struct task_struct *p) 64 { 65 kfree(p->grid_qos); 66 p->grid_qos = NULL; 67 } 68 69 /* dynamic select a more appropriate preferred interleave nid for process */ 70 int sched_grid_preferred_interleave_nid(struct mempolicy *policy) 71 { 72 nodemask_t nmask; 73 unsigned int next; 74 struct task_struct *me = current; 75 nodemask_t *preferred_nmask = NULL; 76 77 if (likely(me->grid_qos)) 78 preferred_nmask = 79 &me->grid_qos->affinity.mem_preferred_node_mask; 80 81 if (!preferred_nmask || !policy) 82 return NUMA_NO_NODE; 83 > 84 if (nodes_equal(policy->v.nodes, *preferred_nmask)) 85 return NUMA_NO_NODE; 86 /* 87 * We perceive the actual consumption of memory bandwidth 88 * in each node and post a preferred interleave nid in 89 * more appropriate range. 90 */ > 91 nodes_and(nmask, policy->v.nodes, *preferred_nmask); 92 if (nodes_empty(nmask)) 93 return NUMA_NO_NODE; 94 > 95 next = next_node_in(me->il_prev, nmask); 96 if (next < MAX_NUMNODES) 97 me->il_prev = next; 98 return next; 99 } 100 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2051/2051] mm/mem_reliable.c:345:2: error: implicit declaration of function 'mem_reliable_ctrl_bit_disable' is invalid in C99
by kernel test robot 23 Mar '25

23 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6f6f173b2b8fa65e1ef7ebc6e43b0b02c2a52759 commit: 425771499c0742a996ab28df143d7a5123102686 [2051/2051] mm: mem_reliable: Introduce proc interface to disable memory reliable features config: arm64-randconfig-r061-20250323 (https://download.01.org/0day-ci/archive/20250323/202503230912.NNxJbHgI-lkp@…) compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250323/202503230912.NNxJbHgI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503230912.NNxJbHgI-lkp@intel.com/ All errors (new ones prefixed by >>): >> mm/mem_reliable.c:345:2: error: implicit declaration of function 'mem_reliable_ctrl_bit_disable' is invalid in C99 [-Werror,-Wimplicit-function-declaration] mem_reliable_ctrl_bit_disable(idx); ^ mm/mem_reliable.c:345:2: note: did you mean 'mem_reliable_ctrl_bit_disabled'? mm/mem_reliable.c:320:13: note: 'mem_reliable_ctrl_bit_disabled' declared here static void mem_reliable_ctrl_bit_disabled(int idx) {} ^ 1 error generated. vim +/mem_reliable_ctrl_bit_disable +345 mm/mem_reliable.c 322 323 static void mem_reliable_feature_disable(int idx) 324 { 325 char *str = NULL; 326 327 switch (idx) { 328 case MEM_RELIABLE_FALLBACK: 329 reliable_allow_fallback = false; 330 str = "fallback"; 331 break; 332 case MEM_RELIABLE_SHMEM: 333 shmem_reliable = false; 334 str = "shmem"; 335 break; 336 case MEM_RELIABLE_PAGECACHE: 337 pagecache_reliable = false; 338 str = "pagecache"; 339 break; 340 default: 341 pr_err("unknown index: %d", idx); 342 return; 343 } 344 > 345 mem_reliable_ctrl_bit_disable(idx); 346 pr_info("%s is disabled\n", str); 347 } 348 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2051/2051] mm/memcontrol.c:3147:6: warning: no previous prototype for 'hisi_oom_recover'
by kernel test robot 23 Mar '25

23 Mar '25

Hi Weilong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6f6f173b2b8fa65e1ef7ebc6e43b0b02c2a52759 commit: b498d9f1bacd40d583c0970cab02ad522127a7e7 [2051/2051] arm64/ascend: Add new enable_oom_killer interface for oom contrl config: arm64-randconfig-r111-20250323 (https://download.01.org/0day-ci/archive/20250323/202503230914.IDoSqyA4-lkp@…) compiler: aarch64-linux-gcc (GCC) 9.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250323/202503230914.IDoSqyA4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503230914.IDoSqyA4-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/memcontrol.c:3147:6: warning: no previous prototype for 'hisi_oom_recover' [-Wmissing-prototypes] 3147 | void hisi_oom_recover(struct obj_cgroup *objcg) | ^~~~~~~~~~~~~~~~ sparse warnings: (new ones prefixed by >>) >> mm/memcontrol.c:3147:6: sparse: sparse: symbol 'hisi_oom_recover' was not declared. Should it be static? mm/memcontrol.c:4228:21: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4228:21: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4228:21: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:4230:21: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4230:21: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4230:21: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:4386:9: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4386:9: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4386:9: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:4480:9: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4480:9: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4480:9: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:6198:23: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:6198:23: sparse: struct task_struct [noderef] __rcu * mm/memcontrol.c:6198:23: sparse: struct task_struct * mm/memcontrol.c:6415:52: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:6415:52: sparse: struct task_struct [noderef] __rcu * mm/memcontrol.c:6415:52: sparse: struct task_struct * mm/memcontrol.c:1320:18: sparse: sparse: context imbalance in 'folio_lruvec_lock' - wrong count at exit mm/memcontrol.c:1343:22: sparse: sparse: context imbalance in 'folio_lruvec_lock_irq' - wrong count at exit mm/memcontrol.c: note: in included file (through include/linux/spinlock.h, include/linux/wait.h, include/linux/pid.h, ...): include/linux/spinlock_api_smp.h:111:9: sparse: sparse: context imbalance in 'folio_lruvec_lock_irqsave' - wrong count at exit mm/memcontrol.c:2111:6: sparse: sparse: context imbalance in 'folio_memcg_lock' - wrong count at exit mm/memcontrol.c:2158:17: sparse: sparse: context imbalance in '__folio_memcg_unlock' - unexpected unlock mm/memcontrol.c:6058:9: sparse: sparse: context imbalance in 'mem_cgroup_count_precharge_pte_range' - unexpected unlock mm/memcontrol.c:6326:9: sparse: sparse: context imbalance in 'mem_cgroup_move_charge_pte_range' - unexpected unlock vim +/hisi_oom_recover +3147 mm/memcontrol.c 3145 3146 #ifdef CONFIG_ASCEND_OOM > 3147 void hisi_oom_recover(struct obj_cgroup *objcg) 3148 { 3149 struct mem_cgroup *memcg; 3150 3151 memcg = get_mem_cgroup_from_objcg(objcg); 3152 if (!mem_cgroup_is_root(memcg)) 3153 memcg_oom_recover(memcg); 3154 css_put(&memcg->css); 3155 } 3156 #else 3157 static inline void hisi_oom_recover(struct obj_cgroup *objcg) { } 3158 #endif 3159 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2050/2050] kernel/module/strict_rwx.c:36:6: warning: no previous prototype for function 'module_disable_ro'
by kernel test robot 23 Mar '25

23 Mar '25

Hi Zheng, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6f6f173b2b8fa65e1ef7ebc6e43b0b02c2a52759 commit: c8783f92771c891518257c9deb22cd91d4e1a212 [2050/2050] livepatch/core: Revert module_enable_ro and module_disable_ro config: x86_64-randconfig-161-20250322 (https://download.01.org/0day-ci/archive/20250323/202503230511.2940KCeN-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250323/202503230511.2940KCeN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503230511.2940KCeN-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/module/strict_rwx.c:9: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> kernel/module/strict_rwx.c:36:6: warning: no previous prototype for function 'module_disable_ro' [-Wmissing-prototypes] 36 | void module_disable_ro(const struct module *mod) | ^ kernel/module/strict_rwx.c:36:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 36 | void module_disable_ro(const struct module *mod) | ^ | static 2 warnings generated. vim +/module_disable_ro +36 kernel/module/strict_rwx.c 34 35 #ifdef CONFIG_LIVEPATCH_WO_FTRACE > 36 void module_disable_ro(const struct module *mod) 37 { 38 if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) 39 return; 40 #ifdef CONFIG_STRICT_MODULE_RWX 41 if (!rodata_enabled) 42 return; 43 #endif 44 45 module_set_memory(mod, MOD_TEXT, set_memory_rw); 46 module_set_memory(mod, MOD_INIT_TEXT, set_memory_rw); 47 module_set_memory(mod, MOD_RODATA, set_memory_rw); 48 module_set_memory(mod, MOD_INIT_RODATA, set_memory_rw); 49 } 50 #endif /* CONFIG_LIVEPATCH_WO_FTRACE */ 51 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1510/1510] mm/page_alloc.c:4648:27: sparse: sparse: invalid assignment: &=
by kernel test robot 22 Mar '25

22 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: abf385ef625e6aeb4923da42fef9ebce788f4ecf commit: 875ffd41499ee5a3512da409cbd4c2ffd32b3cfa [1510/1510] mm: Do limit checking after memory allocation for memory reliable config: arm64-randconfig-r132-20250322 (https://download.01.org/0day-ci/archive/20250322/202503222010.7VOhhbEu-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.3.0 reproduce: (https://download.01.org/0day-ci/archive/20250322/202503222010.7VOhhbEu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503222010.7VOhhbEu-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/page_alloc.c:140:1: sparse: sparse: symbol 'pcpu_drain_mutex' was not declared. Should it be static? mm/page_alloc.c: note: in included file (through include/linux/mm.h): include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer >> mm/page_alloc.c:4648:27: sparse: sparse: invalid assignment: &= mm/page_alloc.c:4648:27: sparse: left side has type restricted gfp_t mm/page_alloc.c:4648:27: sparse: right side has type int mm/page_alloc.c:1489:6: warning: no previous prototype for 'set_zone_contiguous' [-Wmissing-prototypes] 1489 | void set_zone_contiguous(struct zone *zone) | ^~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1511:6: warning: no previous prototype for 'clear_zone_contiguous' [-Wmissing-prototypes] 1511 | void clear_zone_contiguous(struct zone *zone) | ^~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c: In function 'mem_init_print_info': mm/page_alloc.c:7470:27: warning: comparison between two arrays [-Warray-compare] 7470 | if (start <= pos && pos < end && size > adj) 23- | ^~ mm/page_alloc.c:7474:9: note: in expansion of macro 'adj_init_size' 7474 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7470:27: note: use '&__init_begin[0] <= &_sinittext[0]' to compare the addresses 7470 | if (start <= pos && pos < end && size > adj) 29- | ^~ mm/page_alloc.c:7474:9: note: in expansion of macro 'adj_init_size' 7474 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7470:41: warning: comparison between two arrays [-Warray-compare] 7470 | if (start <= pos && pos < end && size > adj) 35- | ^ mm/page_alloc.c:7474:9: note: in expansion of macro 'adj_init_size' 7474 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7470:41: note: use '&_sinittext[0] < &__init_end[0]' to compare the addresses 7470 | if (start <= pos && pos < end && size > adj) 41- | ^ mm/page_alloc.c:7474:9: note: in expansion of macro 'adj_init_size' 7474 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7470:27: warning: comparison between two arrays [-Warray-compare] 7470 | if (start <= pos && pos < end && size > adj) 47- | ^~ mm/page_alloc.c:7476:9: note: in expansion of macro 'adj_init_size' 7476 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7470:27: note: use '&_stext[0] <= &_sinittext[0]' to compare the addresses 7470 | if (start <= pos && pos < end && size > adj) 53- | ^~ mm/page_alloc.c:7476:9: note: in expansion of macro 'adj_init_size' 7476 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7470:41: warning: comparison between two arrays [-Warray-compare] 7470 | if (start <= pos && pos < end && size > adj) 59- | ^ mm/page_alloc.c:7476:9: note: in expansion of macro 'adj_init_size' 7476 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7470:41: note: use '&_sinittext[0] < &_etext[0]' to compare the addresses 7470 | if (start <= pos && pos < end && size > adj) 65- | ^ mm/page_alloc.c:7476:9: note: in expansion of macro 'adj_init_size' 7476 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7470:27: warning: comparison between two arrays [-Warray-compare] 7470 | if (start <= pos && pos < end && size > adj) 71- | ^~ mm/page_alloc.c:7477:9: note: in expansion of macro 'adj_init_size' 7477 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7470:27: note: use '&_sdata[0] <= &__init_begin[0]' to compare the addresses 7470 | if (start <= pos && pos < end && size > adj) 77- | ^~ mm/page_alloc.c:7477:9: note: in expansion of macro 'adj_init_size' 7477 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7470:41: warning: comparison between two arrays [-Warray-compare] 7470 | if (start <= pos && pos < end && size > adj) 83- | ^ mm/page_alloc.c:7477:9: note: in expansion of macro 'adj_init_size' 7477 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7470:41: note: use '&__init_begin[0] < &_edata[0]' to compare the addresses 7470 | if (start <= pos && pos < end && size > adj) 89- | ^ mm/page_alloc.c:7477:9: note: in expansion of macro 'adj_init_size' 7477 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7470:27: warning: comparison between two arrays [-Warray-compare] 7470 | if (start <= pos && pos < end && size > adj) 95- | ^~ mm/page_alloc.c:7478:9: note: in expansion of macro 'adj_init_size' 7478 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7470:27: note: use '&_stext[0] <= &__start_rodata[0]' to compare the addresses 7470 | if (start <= pos && pos < end && size > adj) 101- | ^~ mm/page_alloc.c:7478:9: note: in expansion of macro 'adj_init_size' 7478 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7470:41: warning: comparison between two arrays [-Warray-compare] 7470 | if (start <= pos && pos < end && size > adj) 107- | ^ mm/page_alloc.c:7478:9: note: in expansion of macro 'adj_init_size' 7478 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7470:41: note: use '&__start_rodata[0] < &_etext[0]' to compare the addresses vim +4648 mm/page_alloc.c 4606 4607 /* 4608 * return true means memory allocation need retry and flag ___GFP_RELIABILITY 4609 * must be cleared. 4610 */ 4611 static inline bool check_after_alloc(gfp_t *gfp_mask, unsigned int order, 4612 int preferred_nid, nodemask_t *nodemask, 4613 struct page **_page) 4614 { 4615 if (!mem_reliable_is_enabled()) 4616 return false; 4617 4618 if (!(*gfp_mask & ___GFP_RELIABILITY)) 4619 return false; 4620 4621 if (!*_page) 4622 goto out_retry; 4623 4624 if (*gfp_mask & __GFP_NOFAIL) 4625 goto out; 4626 4627 /* check water mark, reserver mirrored mem for kernel */ 4628 if (!mem_reliable_watermark_ok(1 << order)) 4629 goto out_free_page; 4630 4631 /* percpu counter is not initialized, ignore limit check */ 4632 if (!mem_reliable_counter_initialized()) 4633 goto out; 4634 4635 /* spcial user task, systemd is limited by task_reliable_limit */ 4636 if (((current->flags & PF_RELIABLE) || is_global_init(current)) && 4637 !reliable_mem_limit_check(1 << order)) 4638 goto out_free_page; 4639 4640 goto out; 4641 4642 out_free_page: 4643 __free_pages(*_page, order); 4644 *_page = NULL; 4645 4646 out_retry: 4647 if (reliable_allow_fb_enabled() || is_global_init(current)) { > 4648 *gfp_mask &= ~___GFP_RELIABILITY; 4649 return true; 4650 } 4651 4652 if (*gfp_mask & (__GFP_NORETRY | __GFP_RETRY_MAYFAIL | __GFP_THISNODE)) 4653 goto out; 4654 4655 /* Coredumps can quickly deplete all memory reserves */ 4656 if (current->flags & PF_DUMPCORE) 4657 goto out; 4658 /* The OOM killer will not help higher order allocs */ 4659 if (order > PAGE_ALLOC_COSTLY_ORDER) 4660 goto out; 4661 4662 /* oom here */ 4663 mem_reliable_out_of_memory(*gfp_mask, order, preferred_nid, 4664 nodemask); 4665 out: 4666 return false; 4667 } 4668 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1510/1510] mm/maccess.c:64:6: sparse: sparse: symbol '__probe_user_read' was not declared. Should it be static?
by kernel test robot 22 Mar '25

22 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: abf385ef625e6aeb4923da42fef9ebce788f4ecf commit: 5c5bac1227aee80ee106ec07b32c981558049304 [1510/1510] uaccess: Add non-pagefault user-space read functions config: arm64-randconfig-r132-20250322 (https://download.01.org/0day-ci/archive/20250322/202503221848.AeSAEte6-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.3.0 reproduce: (https://download.01.org/0day-ci/archive/20250322/202503221848.AeSAEte6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503221848.AeSAEte6-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/maccess.c:64:6: sparse: sparse: symbol '__probe_user_read' was not declared. Should it be static? mm/maccess.c:64:6: warning: no previous prototype for '__probe_user_read' [-Wmissing-prototypes] 64 | long __probe_user_read(void *dst, const void __user *src, size_t size) | ^~~~~~~~~~~~~~~~~ vim +/__probe_user_read +64 mm/maccess.c 50 51 /** 52 * probe_user_read(): safely attempt to read from a user-space location 53 * @dst: pointer to the buffer that shall take the data 54 * @src: address to read from. This must be a user address. 55 * @size: size of the data chunk 56 * 57 * Safely read from user address @src to the buffer at @dst. If a kernel fault 58 * happens, handle that and return -EFAULT. 59 */ 60 61 long __weak probe_user_read(void *dst, const void __user *src, size_t size) 62 __attribute__((alias("__probe_user_read"))); 63 > 64 long __probe_user_read(void *dst, const void __user *src, size_t size) 65 { 66 long ret = -EFAULT; 67 mm_segment_t old_fs = get_fs(); 68 69 set_fs(USER_DS); 70 if (access_ok(src, size)) 71 ret = probe_read_common(dst, src, size); 72 set_fs(old_fs); 73 74 return ret; 75 } 76 EXPORT_SYMBOL_GPL(probe_user_read); 77 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1510/1510] include/linux/backing-dev.h:510:19: sparse: sparse: incompatible types in comparison expression (different address spaces):
by kernel test robot 22 Mar '25

22 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 8a7a3996f4b2078603a8346880dbf5935308a57f commit: de1b854e74d99da0917ef841500d597f75838dd2 [1510/1510] bdi: get device name under rcu protect config: arm64-randconfig-r132-20250322 (https://download.01.org/0day-ci/archive/20250322/202503221640.dSQdYk6c-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.3.0 reproduce: (https://download.01.org/0day-ci/archive/20250322/202503221640.dSQdYk6c-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503221640.dSQdYk6c-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) block/blk-core.c: note: in included file: >> include/linux/backing-dev.h:510:19: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/backing-dev.h:510:19: sparse: struct rcu_device [noderef] __rcu * include/linux/backing-dev.h:510:19: sparse: struct rcu_device * -- block/bfq-iosched.c: note: in included file: >> include/linux/backing-dev.h:510:19: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/backing-dev.h:510:19: sparse: struct rcu_device [noderef] __rcu * include/linux/backing-dev.h:510:19: sparse: struct rcu_device * vim +510 include/linux/backing-dev.h 502 503 static inline void bdi_get_dev_name(struct backing_dev_info *bdi, char *dname, 504 int len) 505 { 506 struct rcu_device *rcu_dev; 507 508 rcu_read_lock(); 509 > 510 rcu_dev = rcu_dereference(bdi->rcu_dev); 511 strlcpy(dname, rcu_dev ? dev_name(&rcu_dev->dev) : "(unknown)", len); 512 513 rcu_read_unlock(); 514 } 515 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1510/1510] block/blk-merge.c:688:16: sparse: sparse: symbol 'blk_try_req_merge' was not declared. Should it be static?
by kernel test robot 22 Mar '25

22 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: db5f05c237bbdb9b4d5862fc59bdbdafa8f72a73 commit: 5f100bc6aabbe30e55cf20af8e163bb6dba3a3aa [1510/1510] block: fix the DISCARD request merge config: arm64-randconfig-r132-20250322 (https://download.01.org/0day-ci/archive/20250322/202503221140.40xnocXZ-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.3.0 reproduce: (https://download.01.org/0day-ci/archive/20250322/202503221140.40xnocXZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503221140.40xnocXZ-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> block/blk-merge.c:688:16: sparse: sparse: symbol 'blk_try_req_merge' was not declared. Should it be static? block/blk-merge.c:688:16: warning: no previous prototype for 'blk_try_req_merge' [-Wmissing-prototypes] 688 | enum elv_merge blk_try_req_merge(struct request *req, struct request *next) | ^~~~~~~~~~~~~~~~~ vim +/blk_try_req_merge +688 block/blk-merge.c 687 > 688 enum elv_merge blk_try_req_merge(struct request *req, struct request *next) 689 { 690 if (blk_discard_mergable(req)) 691 return ELEVATOR_DISCARD_MERGE; 692 else if (blk_rq_pos(req) + blk_rq_sectors(req) == blk_rq_pos(next)) 693 return ELEVATOR_BACK_MERGE; 694 695 return ELEVATOR_NO_MERGE; 696 } 697 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION a7973281031cedabf6c66de13ffc2c313a71695f
by kernel test robot 22 Mar '25

22 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: a7973281031cedabf6c66de13ffc2c313a71695f !15591 【olk 5.10】revert and backport a bugfix Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503211559.QGNruzVY-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503220351.uj1q69QX-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503220607.nbhzXKry-lkp@intel.com ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:102:21: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] ../lib/gcc/aarch64-linux/5.5.0/plugin/include/defaults.h:126:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:2556:18: error: 'is_gimple_reg' was not declared in this scope; did you mean 'is_gimple_assign'? ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:2790:10: error: 'gimple_call_addr_fndecl' was not declared in this scope; did you mean 'gimple_call_set_fndecl'? ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:283:22: error: field 'call_used' has incomplete type 'pt_solution' ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:284:22: error: field 'call_clobbered' has incomplete type 'pt_solution' drivers/scsi/linkdata/ps3stor/./linux/ps3_driver_log.c:41:19: error: unused function 'time_for_log' [-Werror,-Wunused-function] drivers/scsi/linkdata/ps3stor/./linux/ps3_driver_log.c:65:19: error: unused function 'time_for_file_name' [-Werror,-Wunused-function] drivers/scsi/linkdata/ps3stor/ps3_irq.c:22:27: error: unused variable 'PS3_INTERRUPT_CMD_DISABLE_ALL_MASK' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:23:27: error: unused variable 'PS3_INTERRUPT_CMD_ENABLE_MSIX' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:24:27: error: unused variable 'PS3_INTERRUPT_MASK_DISABLE' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:25:27: error: unused variable 'PS3_INTERRUPT_STATUS_EXIST_IRQ' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:26:27: error: unused variable 'PS3_INTERRUPT_CLEAR_IRQ' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:28:27: error: unused variable 'PS3_SSD_IOPS_MSIX_VECTORS' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:29:27: error: unused variable 'PS3_HDD_IOPS_MSIX_VECTORS' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3024:6: error: no previous prototype for function 'ps3_hba_qos_waitq_poll' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3280:15: error: no previous prototype for function 'ps3_raid_qos_decision' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3335:6: error: no previous prototype for function 'ps3_qos_mgrq_resend' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3479:6: error: no previous prototype for function 'ps3_raid_qos_waitq_notify' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3822:15: error: no previous prototype for function 'ps3_raid_qos_waitq_abort' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_scsih.c:1959:1: error: unused function 'ps3_scsih_dev_id_get' [-Werror,-Wunused-function] kismet: WARNING: unmet direct dependencies detected for CPPC_CPUFREQ_SYSFS_INTERFACE when selected by CPU_FREQ_GOV_SEEP Unverified Error/Warning (likely false positive, kindly check if interested): drivers/gpu/drm/amd/amdgpu/dce_v10_0.o: warning: objtool: dce_v10_0_bandwidth_update() falls through to next function dce_v10_0_vblank_get_counter() drivers/gpu/drm/amd/amdgpu/dce_v11_0.o: warning: objtool: dce_v11_0_bandwidth_update() falls through to next function dce_v11_0_vblank_get_counter() drivers/gpu/drm/amd/amdgpu/dce_v6_0.o: warning: objtool: dce_v6_0_program_watermarks() falls through to next function dce_v6_0_latency_watermark() drivers/gpu/drm/amd/amdgpu/dce_v8_0.o: warning: objtool: dce_v8_0_bandwidth_update() falls through to next function dce_v8_0_vblank_get_counter() drivers/gpu/drm/radeon/cik.o: warning: objtool: dce8_bandwidth_update() falls through to next function cik_get_gpu_clock_counter() drivers/gpu/drm/radeon/evergreen.o: warning: objtool: evergreen_program_watermarks() falls through to next function evergreen_mc_wait_for_idle() drivers/gpu/drm/radeon/si.o: warning: objtool: dce6_program_watermarks() falls through to next function si_fence_ring_emit() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-002-20250321 | |-- lib-gcc-aarch64-linux-..-plugin-include-config-elfos.h:warning:invalid-suffix-on-literal-C-requires-a-space-between-literal-and-string-macro | |-- lib-gcc-aarch64-linux-..-plugin-include-defaults.h:warning:invalid-suffix-on-literal-C-requires-a-space-between-literal-and-string-macro | |-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:field-call_clobbered-has-incomplete-type-pt_solution | |-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:field-call_used-has-incomplete-type-pt_solution | |-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:gimple_call_addr_fndecl-was-not-declared-in-this-scope | `-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:is_gimple_reg-was-not-declared-in-this-scope |-- x86_64-alldefconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-allnoconfig | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_file_name-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_log-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_HDD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CLEAR_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_ENABLE_MSIX-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_MASK_DISABLE-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_STATUS_EXIST_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_SSD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_mgrq_resend-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_notify-Werror-Wmissing-prototypes | `-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:error:unused-function-ps3_scsih_dev_id_get-Werror-Wunused-function |-- x86_64-buildonly-randconfig-001-20250321 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-002-20250321 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-003-20250321 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-004-20250321 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-005-20250321 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-006-20250321 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-101-20250322 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-102-20250322 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-104-20250322 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-gpu-drm-amd-amdgpu-dce_v10_0.o:warning:objtool:dce_v10_0_bandwidth_update-falls-through-to-next-function-dce_v10_0_vblank_get_counter() | |-- drivers-gpu-drm-amd-amdgpu-dce_v11_0.o:warning:objtool:dce_v11_0_bandwidth_update-falls-through-to-next-function-dce_v11_0_vblank_get_counter() | |-- drivers-gpu-drm-amd-amdgpu-dce_v8_0.o:warning:objtool:dce_v8_0_bandwidth_update-falls-through-to-next-function-dce_v8_0_vblank_get_counter() | |-- drivers-gpu-drm-radeon-cik.o:warning:objtool:dce8_bandwidth_update-falls-through-to-next-function-cik_get_gpu_clock_counter() | |-- drivers-gpu-drm-radeon-evergreen.o:warning:objtool:evergreen_program_watermarks-falls-through-to-next-function-evergreen_mc_wait_for_idle() | |-- drivers-gpu-drm-radeon-si.o:warning:objtool:dce6_program_watermarks-falls-through-to-next-function-si_fence_ring_emit() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-161-20250322 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset `-- x86_64-randconfig-r133-20250321 |-- drivers-gpu-drm-amd-amdgpu-dce_v10_0.o:warning:objtool:dce_v10_0_bandwidth_update-falls-through-to-next-function-dce_v10_0_vblank_get_counter() |-- drivers-gpu-drm-amd-amdgpu-dce_v11_0.o:warning:objtool:dce_v11_0_bandwidth_update-falls-through-to-next-function-dce_v11_0_vblank_get_counter() |-- drivers-gpu-drm-amd-amdgpu-dce_v6_0.o:warning:objtool:dce_v6_0_program_watermarks-falls-through-to-next-function-dce_v6_0_latency_watermark() |-- drivers-gpu-drm-amd-amdgpu-dce_v8_0.o:warning:objtool:dce_v8_0_bandwidth_update-falls-through-to-next-function-dce_v8_0_vblank_get_counter() |-- drivers-gpu-drm-radeon-cik.o:warning:objtool:dce8_bandwidth_update-falls-through-to-next-function-cik_get_gpu_clock_counter() |-- drivers-gpu-drm-radeon-evergreen.o:warning:objtool:evergreen_program_watermarks-falls-through-to-next-function-evergreen_mc_wait_for_idle() `-- drivers-gpu-drm-radeon-si.o:warning:objtool:dce6_program_watermarks-falls-through-to-next-function-si_fence_ring_emit() elapsed time: 1444m configs tested: 17 configs skipped: 127 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250321 gcc-5.5.0 arm64 randconfig-002-20250321 gcc-5.5.0 arm64 randconfig-003-20250321 clang-20 arm64 randconfig-004-20250321 clang-21 x86_64 alldefconfig gcc-12 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250321 clang-20 x86_64 buildonly-randconfig-002-20250321 clang-20 x86_64 buildonly-randconfig-003-20250321 gcc-12 x86_64 buildonly-randconfig-004-20250321 clang-20 x86_64 buildonly-randconfig-005-20250321 clang-20 x86_64 buildonly-randconfig-006-20250321 clang-20 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2050/2050] kismet: WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE when selected by ARM64
by kernel test robot 22 Mar '25

22 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f91bc9d0ae15025f6b0758053fb66480c3fec2ec commit: 6df2e969a6de3481167ace4fe42f69812a6c7fc8 [2050/2050] arm64: add config for cpuidle-haltpoll config: arm64-kismet-CONFIG_HALTPOLL_CPUIDLE-CONFIG_ARM64-0-0 (https://download.01.org/0day-ci/archive/20250322/202503220924.Uw2cwpZV-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20250322/202503220924.Uw2cwpZV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503220924.Uw2cwpZV-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE when selected by ARM64 WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE Depends on [n]: CPU_IDLE [=n] && ARCH_CPUIDLE_HALTPOLL [=y] && ARCH_HAS_OPTIMIZED_POLL [=y] Selected by [y]: - ARM64 [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2050/2050] kismet: WARNING: unmet direct dependencies detected for ACPI_HOTPLUG_IGNORE_OSC when selected by X86
by kernel test robot 22 Mar '25

22 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f91bc9d0ae15025f6b0758053fb66480c3fec2ec commit: 362f33cba6a04a09bcfc47ade55ace95e8a51c5b [2050/2050] ACPI: Add _OSC bits to advertise OS support for toggling CPU present/enabled config: x86_64-kismet-CONFIG_ACPI_HOTPLUG_IGNORE_OSC-CONFIG_X86-0-0 (https://download.01.org/0day-ci/archive/20250322/202503220823.mG13Rroz-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20250322/202503220823.mG13Rroz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503220823.mG13Rroz-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for ACPI_HOTPLUG_IGNORE_OSC when selected by X86 WARNING: unmet direct dependencies detected for ACPI_HOTPLUG_IGNORE_OSC Depends on [n]: ACPI [=y] && ACPI_HOTPLUG_PRESENT_CPU [=n] Selected by [y]: - X86 [=y] && ACPI [=y] && HOTPLUG_CPU [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1510/1510] kernel/livepatch/core.c:1013:12: warning: no previous prototype for function 'arch_klp_func_can_patch'
by kernel test robot 22 Mar '25

22 Mar '25

Hi Cheng, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: db5f05c237bbdb9b4d5862fc59bdbdafa8f72a73 commit: 7e2ab91ea07673f855f16b54b7c6e6853b2efc1c [1510/1510] livepatch/x86: support livepatch without ftrace config: x86_64-randconfig-161-20250322 (https://download.01.org/0day-ci/archive/20250322/202503220808.5u1Nsd2B-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250322/202503220808.5u1Nsd2B-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503220808.5u1Nsd2B-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/livepatch/core.c:75:16: warning: no previous prototype for function 'klp_check_patch_kprobed' [-Wmissing-prototypes] 75 | struct kprobe *klp_check_patch_kprobed(struct klp_patch *patch) | ^ kernel/livepatch/core.c:75:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 75 | struct kprobe *klp_check_patch_kprobed(struct klp_patch *patch) | ^ | static kernel/livepatch/core.c:402:5: warning: no previous prototype for function 'klp_try_disable_patch' [-Wmissing-prototypes] 402 | int klp_try_disable_patch(void *data) | ^ kernel/livepatch/core.c:402:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 402 | int klp_try_disable_patch(void *data) | ^ | static kernel/livepatch/core.c:441:13: warning: no previous prototype for function 'arch_klp_code_modify_prepare' [-Wmissing-prototypes] 441 | void __weak arch_klp_code_modify_prepare(void) | ^ kernel/livepatch/core.c:441:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 441 | void __weak arch_klp_code_modify_prepare(void) | ^ | static kernel/livepatch/core.c:445:13: warning: no previous prototype for function 'arch_klp_code_modify_post_process' [-Wmissing-prototypes] 445 | void __weak arch_klp_code_modify_post_process(void) | ^ kernel/livepatch/core.c:445:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 445 | void __weak arch_klp_code_modify_post_process(void) | ^ | static kernel/livepatch/core.c:617:5: warning: no previous prototype for function 'klp_try_enable_patch' [-Wmissing-prototypes] 617 | int klp_try_enable_patch(void *data) | ^ kernel/livepatch/core.c:617:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 617 | int klp_try_enable_patch(void *data) | ^ | static >> kernel/livepatch/core.c:1013:12: warning: no previous prototype for function 'arch_klp_func_can_patch' [-Wmissing-prototypes] 1013 | int __weak arch_klp_func_can_patch(struct klp_func *func) | ^ kernel/livepatch/core.c:1013:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1013 | int __weak arch_klp_func_can_patch(struct klp_func *func) | ^ | static 6 warnings generated. vim +/arch_klp_func_can_patch +1013 kernel/livepatch/core.c b700e7f03df5d92 Seth Jennings 2014-12-16 1011 453d38459f94417 Cheng Jian 2019-01-28 1012 #ifdef CONFIG_LIVEPATCH_WO_FTRACE 453d38459f94417 Cheng Jian 2019-01-28 @1013 int __weak arch_klp_func_can_patch(struct klp_func *func) 453d38459f94417 Cheng Jian 2019-01-28 1014 { 453d38459f94417 Cheng Jian 2019-01-28 1015 return 0; 453d38459f94417 Cheng Jian 2019-01-28 1016 } 453d38459f94417 Cheng Jian 2019-01-28 1017 #endif 453d38459f94417 Cheng Jian 2019-01-28 1018 :::::: The code at line 1013 was first introduced by commit :::::: 453d38459f94417d9d5db7b75ed181a932e34ffc livepatch/arm64: fix func size less than limit :::::: TO: Cheng Jian <cj.chengjian(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2816/2816] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3024:6: error: no previous prototype for function 'ps3_hba_qos_waitq_poll'
by kernel test robot 22 Mar '25

22 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: a7973281031cedabf6c66de13ffc2c313a71695f commit: 13f748eddc9dfdec8a18922ed601e1906dcb183a [2816/2816] [PATCH] SCSI: Linkdata: Supports Linkdata HBA/RAID Controllers config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20250322/202503220607.nbhzXKry-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250322/202503220607.nbhzXKry-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503220607.nbhzXKry-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/scsi/linkdata/ps3stor/ps3_qos.c:212:1: error: no previous prototype for function 'ps3_qos_cmd_waitq_get' [-Werror,-Wmissing-prototypes] 212 | ps3_qos_cmd_waitq_get(struct ps3_qos_tg_context *qos_tg_ctx, | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:211:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 211 | struct qos_wait_queue * | ^ | static drivers/scsi/linkdata/ps3stor/ps3_qos.c:336:15: error: no previous prototype for function 'ps3_qos_vd_cmdword_get' [-Werror,-Wmissing-prototypes] 336 | unsigned char ps3_qos_vd_cmdword_get(struct ps3_cmd *cmd) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:336:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 336 | unsigned char ps3_qos_vd_cmdword_get(struct ps3_cmd *cmd) | ^ | static drivers/scsi/linkdata/ps3stor/ps3_qos.c:352:15: error: no previous prototype for function 'ps3_qos_exclusive_cmdword_get' [-Werror,-Wmissing-prototypes] 352 | unsigned char ps3_qos_exclusive_cmdword_get(struct ps3_cmd *cmd) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:352:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 352 | unsigned char ps3_qos_exclusive_cmdword_get(struct ps3_cmd *cmd) | ^ | static drivers/scsi/linkdata/ps3stor/ps3_qos.c:364:15: error: no previous prototype for function 'ps3_qos_tg_decision' [-Werror,-Wmissing-prototypes] 364 | unsigned char ps3_qos_tg_decision(struct ps3_cmd *cmd) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:364:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 364 | unsigned char ps3_qos_tg_decision(struct ps3_cmd *cmd) | ^ | static drivers/scsi/linkdata/ps3stor/ps3_qos.c:750:15: error: no previous prototype for function 'ps3_qos_all_pd_rc_get' [-Werror,-Wmissing-prototypes] 750 | unsigned char ps3_qos_all_pd_rc_get(struct ps3_cmd *cmd) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:750:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 750 | unsigned char ps3_qos_all_pd_rc_get(struct ps3_cmd *cmd) | ^ | static drivers/scsi/linkdata/ps3stor/ps3_qos.c:877:6: error: no previous prototype for function 'ps3_pd_quota_waitq_clear_all' [-Werror,-Wmissing-prototypes] 877 | void ps3_pd_quota_waitq_clear_all(struct ps3_qos_pd_mgr *qos_pd_mgr, | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:877:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 877 | void ps3_pd_quota_waitq_clear_all(struct ps3_qos_pd_mgr *qos_pd_mgr, | ^ | static drivers/scsi/linkdata/ps3stor/ps3_qos.c:893:6: error: no previous prototype for function 'ps3_pd_quota_waitq_clean' [-Werror,-Wmissing-prototypes] 893 | void ps3_pd_quota_waitq_clean(struct ps3_qos_pd_mgr *qos_pd_mgr, | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:893:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 893 | void ps3_pd_quota_waitq_clean(struct ps3_qos_pd_mgr *qos_pd_mgr, | ^ | static drivers/scsi/linkdata/ps3stor/ps3_qos.c:1059:6: error: no previous prototype for function 'ps3_qos_pd_waitq_ratio_update' [-Werror,-Wmissing-prototypes] 1059 | void ps3_qos_pd_waitq_ratio_update(struct ps3_qos_pd_mgr *qos_pd_mgr) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:1059:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1059 | void ps3_qos_pd_waitq_ratio_update(struct ps3_qos_pd_mgr *qos_pd_mgr) | ^ | static drivers/scsi/linkdata/ps3stor/ps3_qos.c:2020:15: error: no previous prototype for function 'ps3_hba_qos_decision' [-Werror,-Wmissing-prototypes] 2020 | unsigned char ps3_hba_qos_decision(struct ps3_cmd *cmd) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:2020:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2020 | unsigned char ps3_hba_qos_decision(struct ps3_cmd *cmd) | ^ | static drivers/scsi/linkdata/ps3stor/ps3_qos.c:2041:6: error: no previous prototype for function 'ps3_hba_qos_waitq_notify' [-Werror,-Wmissing-prototypes] 2041 | void ps3_hba_qos_waitq_notify(struct ps3_instance *instance) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:2041:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2041 | void ps3_hba_qos_waitq_notify(struct ps3_instance *instance) | ^ | static drivers/scsi/linkdata/ps3stor/ps3_qos.c:2101:6: error: no previous prototype for function 'ps3_cmd_waitq_abort' [-Werror,-Wmissing-prototypes] 2101 | bool ps3_cmd_waitq_abort(struct ps3_cmd *aborted_cmd) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:2101:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2101 | bool ps3_cmd_waitq_abort(struct ps3_cmd *aborted_cmd) | ^ | static drivers/scsi/linkdata/ps3stor/ps3_qos.c:2464:6: error: no previous prototype for function 'ps3_hba_qos_waitq_clear_all' [-Werror,-Wmissing-prototypes] 2464 | void ps3_hba_qos_waitq_clear_all(struct ps3_instance *instance, int resp_status) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:2464:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2464 | void ps3_hba_qos_waitq_clear_all(struct ps3_instance *instance, int resp_status) | ^ | static drivers/scsi/linkdata/ps3stor/ps3_qos.c:2828:6: error: no previous prototype for function 'ps3_hba_qos_vd_init' [-Werror,-Wmissing-prototypes] 2828 | void ps3_hba_qos_vd_init(struct ps3_instance *instance, | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:2828:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2828 | void ps3_hba_qos_vd_init(struct ps3_instance *instance, | ^ | static drivers/scsi/linkdata/ps3stor/ps3_qos.c:2937:6: error: no previous prototype for function 'ps3_hba_qos_vd_reset' [-Werror,-Wmissing-prototypes] 2937 | void ps3_hba_qos_vd_reset(struct ps3_instance *instance, unsigned short disk_id) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:2937:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2937 | void ps3_hba_qos_vd_reset(struct ps3_instance *instance, unsigned short disk_id) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3024:6: error: no previous prototype for function 'ps3_hba_qos_waitq_poll' [-Werror,-Wmissing-prototypes] 3024 | void ps3_hba_qos_waitq_poll(struct ps3_instance *instance) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:3024:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3024 | void ps3_hba_qos_waitq_poll(struct ps3_instance *instance) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3280:15: error: no previous prototype for function 'ps3_raid_qos_decision' [-Werror,-Wmissing-prototypes] 3280 | unsigned char ps3_raid_qos_decision(struct ps3_cmd *cmd) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:3280:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3280 | unsigned char ps3_raid_qos_decision(struct ps3_cmd *cmd) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3335:6: error: no previous prototype for function 'ps3_qos_mgrq_resend' [-Werror,-Wmissing-prototypes] 3335 | void ps3_qos_mgrq_resend(struct ps3_qos_softq_mgr *softq_mgr) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:3335:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3335 | void ps3_qos_mgrq_resend(struct ps3_qos_softq_mgr *softq_mgr) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3479:6: error: no previous prototype for function 'ps3_raid_qos_waitq_notify' [-Werror,-Wmissing-prototypes] 3479 | void ps3_raid_qos_waitq_notify(struct ps3_instance *instance) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:3479:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3479 | void ps3_raid_qos_waitq_notify(struct ps3_instance *instance) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3822:15: error: no previous prototype for function 'ps3_raid_qos_waitq_abort' [-Werror,-Wmissing-prototypes] 3822 | unsigned char ps3_raid_qos_waitq_abort(struct ps3_cmd *cmd) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:3822:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3822 | unsigned char ps3_raid_qos_waitq_abort(struct ps3_cmd *cmd) | ^ | static fatal error: too many errors emitted, stopping now [-ferror-limit=] 20 errors generated. -- >> drivers/scsi/linkdata/ps3stor/ps3_scsih.c:1959:1: error: unused function 'ps3_scsih_dev_id_get' [-Werror,-Wunused-function] 1959 | ps3_scsih_dev_id_get(const struct scsi_cmnd *s_cmd) | ^~~~~~~~~~~~~~~~~~~~ 1 error generated. -- >> drivers/scsi/linkdata/ps3stor/ps3_irq.c:22:27: error: unused variable 'PS3_INTERRUPT_CMD_DISABLE_ALL_MASK' [-Werror,-Wunused-const-variable] 22 | static const unsigned int PS3_INTERRUPT_CMD_DISABLE_ALL_MASK = 0x02; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_irq.c:23:27: error: unused variable 'PS3_INTERRUPT_CMD_ENABLE_MSIX' [-Werror,-Wunused-const-variable] 23 | static const unsigned int PS3_INTERRUPT_CMD_ENABLE_MSIX = 0x01; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_irq.c:24:27: error: unused variable 'PS3_INTERRUPT_MASK_DISABLE' [-Werror,-Wunused-const-variable] 24 | static const unsigned int PS3_INTERRUPT_MASK_DISABLE = 0x00000002; | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_irq.c:25:27: error: unused variable 'PS3_INTERRUPT_STATUS_EXIST_IRQ' [-Werror,-Wunused-const-variable] 25 | static const unsigned int PS3_INTERRUPT_STATUS_EXIST_IRQ = 0x00000001; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_irq.c:26:27: error: unused variable 'PS3_INTERRUPT_CLEAR_IRQ' [-Werror,-Wunused-const-variable] 26 | static const unsigned int PS3_INTERRUPT_CLEAR_IRQ = 0x00000001; | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_irq.c:28:27: error: unused variable 'PS3_SSD_IOPS_MSIX_VECTORS' [-Werror,-Wunused-const-variable] 28 | static const unsigned int PS3_SSD_IOPS_MSIX_VECTORS = 8; | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_irq.c:29:27: error: unused variable 'PS3_HDD_IOPS_MSIX_VECTORS' [-Werror,-Wunused-const-variable] 29 | static const unsigned int PS3_HDD_IOPS_MSIX_VECTORS = 8; | ^~~~~~~~~~~~~~~~~~~~~~~~~ 7 errors generated. -- >> drivers/scsi/linkdata/ps3stor/./linux/ps3_driver_log.c:41:19: error: unused function 'time_for_log' [-Werror,-Wunused-function] 41 | static inline int time_for_log(char *buff, int buf_len) | ^~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/./linux/ps3_driver_log.c:65:19: error: unused function 'time_for_file_name' [-Werror,-Wunused-function] 65 | static inline int time_for_file_name(char *buff, int buf_len) | ^~~~~~~~~~~~~~~~~~ 2 errors generated. vim +/ps3_hba_qos_waitq_poll +3024 drivers/scsi/linkdata/ps3stor/ps3_qos.c 3023 > 3024 void ps3_hba_qos_waitq_poll(struct ps3_instance *instance) 3025 { 3026 if (!ps3_qos_tg_notify_timeout(instance)) { 3027 if (!ps3_qos_vd_notify_timeout(instance)) 3028 ps3_qos_pd_notify_timeout(instance); 3029 } 3030 } 3031 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2818/2818] kismet: WARNING: unmet direct dependencies detected for CPPC_CPUFREQ_SYSFS_INTERFACE when selected by CPU_FREQ_GOV_SEEP
by kernel test robot 22 Mar '25

22 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: a7973281031cedabf6c66de13ffc2c313a71695f commit: c3fe0dc62217d6faa76128ed26d64e421767919e [2818/2818] cpufreq: Add SEEP governor for hardware-managed P-states config: arm64-kismet-CONFIG_CPPC_CPUFREQ_SYSFS_INTERFACE-CONFIG_CPU_FREQ_GOV_SEEP-0-0 (https://download.01.org/0day-ci/archive/20250322/202503220351.uj1q69QX-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20250322/202503220351.uj1q69QX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503220351.uj1q69QX-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for CPPC_CPUFREQ_SYSFS_INTERFACE when selected by CPU_FREQ_GOV_SEEP WARNING: unmet direct dependencies detected for ARM64_ERRATUM_845719 Depends on [n]: AARCH32_EL0 [=n] Selected by [y]: - ARCH_MXC [=y] && COMPAT [=y] WARNING: unmet direct dependencies detected for CPPC_CPUFREQ_SYSFS_INTERFACE Depends on [n]: CPU_FREQ [=y] && (ARM || ARM64 [=y]) && ACPI_CPPC_CPUFREQ [=n] Selected by [y]: - CPU_FREQ_GOV_SEEP [=y] && CPU_FREQ [=y] && (ACPI_CPPC_CPUFREQ [=n] || ARM64 [=y]) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1510/1510] WARNING: vmlinux.o(__ex_table+0x18b4): Section mismatch in reference from the (unknown reference) (unknown) to the (unknown reference) .irqentry.text:(unknown)
by kernel test robot 22 Mar '25

22 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: db5f05c237bbdb9b4d5862fc59bdbdafa8f72a73 commit: 11c79b45694659ce6342c84d2e14ebb648c68060 [1510/1510] x86/apic: Always explicitly disarm TSC-deadline timer config: x86_64-buildonly-randconfig-004-20250321 (https://download.01.org/0day-ci/archive/20250322/202503220031.yoxWlnbp-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250322/202503220031.yoxWlnbp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503220031.yoxWlnbp-lkp@intel.com/ All warnings (new ones prefixed by >>): >> WARNING: vmlinux.o(__ex_table+0x18b4): Section mismatch in reference from the (unknown reference) (unknown) to the (unknown reference) .irqentry.text:(unknown) The relocation at __ex_table+0x18b4 references section ".irqentry.text" which is not in the list of authorized sections. If you're adding a new section and/or if this reference is valid, add ".irqentry.text" to the list of authorized sections to jump to on fault. This can be achieved by adding ".irqentry.text" to OTHER_TEXT_SECTIONS in scripts/mod/modpost.c. WARNING: vmlinux.o(__ex_table+0x18b8): Section mismatch in reference from the (unknown reference) (unknown) to the (unknown reference) .irqentry.text:(unknown) The relocation at __ex_table+0x18b8 references section ".irqentry.text" which is not in the list of authorized sections. If you're adding a new section and/or if this reference is valid, add ".irqentry.text" to the list of authorized sections to jump to on fault. This can be achieved by adding ".irqentry.text" to OTHER_TEXT_SECTIONS in scripts/mod/modpost.c. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list
by Luo Gengkun 21 Mar '25

21 Mar '25

From: Luo Gengkun <luogengkun(a)huaweicloud.com> stable inclusion from stable-v6.6.81 commit f0c3971405cef6892844016aa710121a02da3a23 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBUX7R Reference: https://git.kernel.org/stable/c/f0c3971405cef6892844016aa710121a02da3a23 -------------------------------- [ Upstream commit 2016066c66192a99d9e0ebf433789c490a6785a2 ] Syskaller triggers a warning due to prev_epc->pmu != next_epc->pmu in perf_event_swap_task_ctx_data(). vmcore shows that two lists have the same perf_event_pmu_context, but not in the same order. The problem is that the order of pmu_ctx_list for the parent is impacted by the time when an event/PMU is added. While the order for a child is impacted by the event order in the pinned_groups and flexible_groups. So the order of pmu_ctx_list in the parent and child may be different. To fix this problem, insert the perf_event_pmu_context to its proper place after iteration of the pmu_ctx_list. The follow testcase can trigger above warning: # perf record -e cycles --call-graph lbr -- taskset -c 3 ./a.out & # perf stat -e cpu-clock,cs -p xxx // xxx is the pid of a.out test.c void main() { int count = 0; pid_t pid; printf("%d running\n", getpid()); sleep(30); printf("running\n"); pid = fork(); if (pid == -1) { printf("fork error\n"); return; } if (pid == 0) { while (1) { count++; } } else { while (1) { count++; } } } The testcase first opens an LBR event, so it will allocate task_ctx_data, and then open tracepoint and software events, so the parent context will have 3 different perf_event_pmu_contexts. On inheritance, child ctx will insert the perf_event_pmu_context in another order and the warning will trigger. [ mingo: Tidied up the changelog. ] Fixes: bd2756811766 ("perf: Rewrite core context handling") Signed-off-by: Luo Gengkun <luogengkun(a)huaweicloud.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Kan Liang <kan.liang(a)linux.intel.com> Link: https://lore.kernel.org/r/20250122073356.1824736-1-luogengkun@huaweicloud.c… Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- kernel/events/core.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index ca4f20005586..c2b93f521497 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -4842,7 +4842,7 @@ static struct perf_event_pmu_context * find_get_pmu_context(struct pmu *pmu, struct perf_event_context *ctx, struct perf_event *event) { - struct perf_event_pmu_context *new = NULL, *epc; + struct perf_event_pmu_context *new = NULL, *pos = NULL, *epc; void *task_ctx_data = NULL; if (!ctx->task) { @@ -4899,12 +4899,19 @@ find_get_pmu_context(struct pmu *pmu, struct perf_event_context *ctx, atomic_inc(&epc->refcount); goto found_epc; } + /* Make sure the pmu_ctx_list is sorted by PMU type: */ + if (!pos && epc->pmu->type > pmu->type) + pos = epc; } epc = new; new = NULL; - list_add(&epc->pmu_ctx_entry, &ctx->pmu_ctx_list); + if (!pos) + list_add_tail(&epc->pmu_ctx_entry, &ctx->pmu_ctx_list); + else + list_add(&epc->pmu_ctx_entry, pos->pmu_ctx_entry.prev); + epc->ctx = ctx; found_epc: -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] add support DVMBM in HIP12
by yangjinqian 21 Mar '25

21 Mar '25

Patch#1 kvm: hisi_virt: fix kernel panic when enable DVMBM in nVHE Patch#2 kvm: hisi_virt: Update TLBI broadcast feature for hip12 Patch#3 KVM: arm64: Add new HiSi CPU type to support DVMBM Xiang Chen (1): kvm: hisi_virt: Update TLBI broadcast feature for hip12 yangjinqian (2): kvm: hisi_virt: fix kernel panic when enable DVMBM in nVHE KVM: arm64: Add new HiSi CPU type to support DVMBM arch/arm64/kvm/hisilicon/hisi_virt.c | 72 ++++++++++++++++++++++++++-- arch/arm64/kvm/hisilicon/hisi_virt.h | 22 +++++++++ 2 files changed, 90 insertions(+), 4 deletions(-) -- 2.33.0

2 4

[openeuler:OLK-5.10 2818/2818] ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:283:22: error: field 'call_used' has incomplete type 'pt_solution'
by kernel test robot 21 Mar '25

21 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: a7973281031cedabf6c66de13ffc2c313a71695f commit: f72cad446f70dd9383453a5ef36ada358c589f8f [2818/2818] gcc-plugins: Reorganize gimple includes for GCC 13 config: arm64-randconfig-002-20250321 (https://download.01.org/0day-ci/archive/20250321/202503211559.QGNruzVY-lkp@…) compiler: aarch64-linux-gcc (GCC) 5.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250321/202503211559.QGNruzVY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503211559.QGNruzVY-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:24, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gcc-plugin.h:31, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/plugin.h:23, from scripts/gcc-plugins/gcc-common.h:9, from scripts/gcc-plugins/sancov_plugin.c:22: ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:102:21: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 102 | fprintf ((FILE), "%s"HOST_WIDE_INT_PRINT_UNSIGNED"\n",\ | ^ In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:24, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gcc-plugin.h:31, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/plugin.h:23, from scripts/gcc-plugins/gcc-common.h:9, from scripts/gcc-plugins/randomize_layout_plugin.c:19: ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:102:21: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 102 | fprintf ((FILE), "%s"HOST_WIDE_INT_PRINT_UNSIGNED"\n",\ | ^ In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:24, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gcc-plugin.h:31, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/plugin.h:23, from scripts/gcc-plugins/gcc-common.h:9, from scripts/gcc-plugins/stackleak_plugin.c:30: ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:102:21: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 102 | fprintf ((FILE), "%s"HOST_WIDE_INT_PRINT_UNSIGNED"\n",\ | ^ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:170:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 170 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:170:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 170 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:170:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 170 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:41: ../lib/gcc/aarch64-linux/5.5.0/plugin/include/defaults.h:126:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 126 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:41: ../lib/gcc/aarch64-linux/5.5.0/plugin/include/defaults.h:126:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 126 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:41: ../lib/gcc/aarch64-linux/5.5.0/plugin/include/defaults.h:126:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 126 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ In file included from scripts/gcc-plugins/gcc-common.h:113: >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:283:22: error: field 'call_used' has incomplete type 'pt_solution' 283 | struct pt_solution call_used; | ^~~~~~~~~ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:283:10: note: forward declaration of 'struct pt_solution' 283 | struct pt_solution call_used; | ^~~~~~~~~~~ >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:284:22: error: field 'call_clobbered' has incomplete type 'pt_solution' 284 | struct pt_solution call_clobbered; | ^~~~~~~~~~~~~~ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:283:10: note: forward declaration of 'struct pt_solution' 283 | struct pt_solution call_used; | ^~~~~~~~~~~ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h: In function 'bool gimple_store_p(const_gimple)': >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:2556:18: error: 'is_gimple_reg' was not declared in this scope; did you mean 'is_gimple_assign'? 2556 | return lhs && !is_gimple_reg (lhs); | ^~~~~~~~~~~~~ | is_gimple_assign In file included from scripts/gcc-plugins/gcc-common.h:113: >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:283:22: error: field 'call_used' has incomplete type 'pt_solution' 283 | struct pt_solution call_used; | ^~~~~~~~~ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:283:10: note: forward declaration of 'struct pt_solution' 283 | struct pt_solution call_used; | ^~~~~~~~~~~ >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:284:22: error: field 'call_clobbered' has incomplete type 'pt_solution' 284 | struct pt_solution call_clobbered; | ^~~~~~~~~~~~~~ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:283:10: note: forward declaration of 'struct pt_solution' 283 | struct pt_solution call_used; | ^~~~~~~~~~~ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h: In function 'tree_node* gimple_call_fndecl(const_gimple)': >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:2790:10: error: 'gimple_call_addr_fndecl' was not declared in this scope; did you mean 'gimple_call_set_fndecl'? 2790 | return gimple_call_addr_fndecl (gimple_call_fn (gs)); | ^~~~~~~~~~~~~~~~~~~~~~~ | gimple_call_set_fndecl ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h: In function 'bool gimple_store_p(const_gimple)': >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:2556:18: error: 'is_gimple_reg' was not declared in this scope; did you mean 'is_gimple_assign'? 2556 | return lhs && !is_gimple_reg (lhs); | ^~~~~~~~~~~~~ | is_gimple_assign ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h: In function 'tree_node* gimple_call_fndecl(const_gimple)': >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:2790:10: error: 'gimple_call_addr_fndecl' was not declared in this scope; did you mean 'gimple_call_set_fndecl'? 2790 | return gimple_call_addr_fndecl (gimple_call_fn (gs)); | ^~~~~~~~~~~~~~~~~~~~~~~ | gimple_call_set_fndecl In file included from scripts/gcc-plugins/gcc-common.h:113: >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:283:22: error: field 'call_used' has incomplete type 'pt_solution' 283 | struct pt_solution call_used; | ^~~~~~~~~ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:283:10: note: forward declaration of 'struct pt_solution' 283 | struct pt_solution call_used; | ^~~~~~~~~~~ >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:284:22: error: field 'call_clobbered' has incomplete type 'pt_solution' 284 | struct pt_solution call_clobbered; | ^~~~~~~~~~~~~~ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:283:10: note: forward declaration of 'struct pt_solution' 283 | struct pt_solution call_used; | ^~~~~~~~~~~ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h: In function 'bool gimple_store_p(const_gimple)': >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:2556:18: error: 'is_gimple_reg' was not declared in this scope; did you mean 'is_gimple_assign'? 2556 | return lhs && !is_gimple_reg (lhs); | ^~~~~~~~~~~~~ | is_gimple_assign make[3]: *** [scripts/gcc-plugins/Makefile:47: scripts/gcc-plugins/sancov_plugin.so] Error 1 shuffle=1096673560 ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h: In function 'tree_node* gimple_call_fndecl(const_gimple)': >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gimple.h:2790:10: error: 'gimple_call_addr_fndecl' was not declared in this scope; did you mean 'gimple_call_set_fndecl'? 2790 | return gimple_call_addr_fndecl (gimple_call_fn (gs)); | ^~~~~~~~~~~~~~~~~~~~~~~ | gimple_call_set_fndecl make[3]: *** [scripts/gcc-plugins/Makefile:47: scripts/gcc-plugins/stackleak_plugin.so] Error 1 shuffle=1096673560 make[3]: *** [scripts/gcc-plugins/Makefile:47: scripts/gcc-plugins/randomize_layout_plugin.so] Error 1 shuffle=1096673560 make[3]: Target '__build' not remade because of errors. make[2]: *** [scripts/Makefile.build:503: scripts/gcc-plugins] Error 2 shuffle=1096673560 make[2]: Target '__build' not remade because of errors. make[1]: *** [Makefile:1235: scripts] Error 2 shuffle=1096673560 make[1]: Target 'prepare' not remade because of errors. make: *** [Makefile:194: __sub-make] Error 2 shuffle=1096673560 make: Target 'prepare' not remade because of errors. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] Fix instance dir use-after-free in tracefs
by Tengda Wu 21 Mar '25

21 Mar '25

This patch series is used to fix uaf in tracefs. Tengda Wu (2): tracing: Avoid use-after-free in tracing_open_file_tr() tracing: Fix illegal address access of trace_event_file in tracing_release_file_tr() kernel/trace/trace.c | 19 ++++++---- kernel/trace/trace_events.c | 32 +++++++++++++++++ kernel/trace/trace_events_hist.c | 62 +++++++++++++++++++++++++++----- 3 files changed, 99 insertions(+), 14 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
by Jinjiang Tu 21 Mar '25

21 Mar '25

mainline inclusion from mainline-v6.14-rc6 commit cb402bbdabcaa5a765068c5b8673bbfc1c264242 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBV73U CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- In dissolve_free_huge_page(), free huge pages are dissolved without adjusting surplus count. However, free huge pages may be accounted as surplus pages, and will lead to wrong surplus count. I reproduce this issue on qemu. The steps are: 1) Node1 is memory-less at first. Hot-add memory to node1 by executing the two commands in qemu monitor: object_add memory-backend-ram,id=mem1,size=1G device_add pc-dimm,id=dimm1,memdev=mem1,node=1 2) online one memory block of Node1 with： echo online_movable > /sys/devices/system/node/node1/memoryX/state 3) create 64 huge pages for node1 4) run a program to reserve (don't consume) all the huge pages 5) echo 0 > nr_huge_pages for node1. After this step, free huge pages in Node1 are surplus. 6) create 80 huge pages for node0 7) offline memory of node1, The memory range to offline contains the free surplus huge pages created in step3) ~ step5) echo offline > /sys/devices/system/node/node1/memoryX/state 8) kill the program in step 4) The result: Node0 Node1 total 80 0 free 80 0 surplus 0 61 To fix it, adjust surplus when destroying huge pages if the node has surplus pages in dissolve_free_hugetlb_folio(). The result with this patch: Node0 Node1 total 80 0 free 80 0 surplus 0 0 Link: https://lkml.kernel.org/r/20250304132106.2872754-1-tujinjiang@huawei.com Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> Acked-by: David Hildenbrand <david(a)redhat.com> Acked-by: Oscar Salvador <osalvador(a)suse.de> Cc: Jinjiang Tu <tujinjiang(a)huawei.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/hugetlb.c [Context conflicts, and HVO isn't introduced, so don't need to handle HVO err case.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/hugetlb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 69dd1e096a48..ac6f18afdf76 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -1823,6 +1823,7 @@ int dissolve_free_huge_page(struct page *page) if (!page_count(page)) { struct page *head = compound_head(page); struct hstate *h = page_hstate(head); + bool adjust_surplus = false; if (h->free_huge_pages - h->resv_huge_pages == 0) goto out; @@ -1853,7 +1854,9 @@ int dissolve_free_huge_page(struct page *page) SetPageHWPoison(page); ClearPageHWPoison(head); } - remove_hugetlb_page(h, head, false); + if (h->surplus_huge_pages_node[page_to_nid(head)]) + adjust_surplus = true; + remove_hugetlb_page(h, head, adjust_surplus); h->max_huge_pages--; spin_unlock_irq(&hugetlb_lock); update_and_free_page(h, head); -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS v3 0/2] rtc: Fix race when disable/enable UIE in rtc_set_time()
by Xiongfeng Wang 21 Mar '25

21 Mar '25

Yu Liao (2): rtc: Cleanup for UIE timer/polling emulation support rtc: Fix race when disable/enable UIE in rtc_set_time() drivers/rtc/interface.c | 58 +++++++++++++++++++++++------------------ include/linux/rtc.h | 1 + 2 files changed, 33 insertions(+), 26 deletions(-) -- 2.20.1

2 3

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION d54ba3f54612a8622df13d42bc1870048cb63d20
by kernel test robot 21 Mar '25

21 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: d54ba3f54612a8622df13d42bc1870048cb63d20 !15586 scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503201721.gZeymcpc-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503201839.XDDCG7DI-lkp@intel.com drivers/dma/pl330.c:2598:15: warning: 'dst' may be used uninitialized in this function [-Wmaybe-uninitialized] drivers/dma/pl330.c:2599:15: warning: 'src' may be used uninitialized in this function [-Wmaybe-uninitialized] drivers/mtd/nand/onenand/onenand_bbt.o: warning: objtool: onenand_isbad_bbt()+0xe7: can't find switch jump table drivers/scsi/qla1280.o: warning: objtool: qla1280_error_action()+0x3ab: can't find switch jump table net/netfilter/ipvs/ip_vs_ctl.c:2480:9: warning: 'ret' may be used uninitialized in this function [-Wmaybe-uninitialized] Unverified Error/Warning (likely false positive, kindly check if interested): drivers/gpu/drm/i915/i915_gem.o: warning: objtool: i915_gem_fault() falls through to next function i915_gem_object_ggtt_pin() drivers/gpu/drm/i915/intel_display.o: warning: objtool: _intel_adjust_tile_offset() falls through to next function rcu_lock_acquire() drivers/gpu/drm/i915/intel_display.o: warning: objtool: _intel_compute_tile_offset() falls through to next function skl_format_to_fourcc() drivers/gpu/drm/i915/intel_display.o: warning: objtool: skl_plane_stride() falls through to next function skl_plane_ctl() drivers/gpu/drm/i915/vlv_dsi_pll.o: warning: objtool: bxt_dsi_pll_enable() falls through to next function bxt_dsi_reset_clocks() fs/ext4/extents.c:3626:9: warning: 'zero_ex1.ee_start_hi' may be used uninitialized in this function [-Wmaybe-uninitialized] fs/ext4/extents.c:3626:9: warning: 'zero_ex1.ee_start_lo' may be used uninitialized in this function [-Wmaybe-uninitialized] fs/ext4/extents.c:3628:10: warning: 'zero_ex2.ee_start_hi' may be used uninitialized in this function [-Wmaybe-uninitialized] fs/ext4/extents.c:3628:10: warning: 'zero_ex2.ee_start_lo' may be used uninitialized in this function [-Wmaybe-uninitialized] net/netfilter/ipvs/ip_vs_core.c:2092:11: warning: 'iphdr.protocol' may be used uninitialized in this function [-Wmaybe-uninitialized] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250320 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250320 | |-- fs-ext4-extents.c:warning:zero_ex1.ee_start_hi-may-be-used-uninitialized-in-this-function | |-- fs-ext4-extents.c:warning:zero_ex1.ee_start_lo-may-be-used-uninitialized-in-this-function | |-- fs-ext4-extents.c:warning:zero_ex2.ee_start_hi-may-be-used-uninitialized-in-this-function | |-- fs-ext4-extents.c:warning:zero_ex2.ee_start_lo-may-be-used-uninitialized-in-this-function | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | |-- net-netfilter-ipvs-ip_vs_core.c:warning:iphdr.protocol-may-be-used-uninitialized-in-this-function | `-- net-netfilter-ipvs-ip_vs_ctl.c:warning:ret-may-be-used-uninitialized-in-this-function |-- arm64-randconfig-003-20250320 | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized-in-this-function | |-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized-in-this-function | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-lo | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-void-u64)-aka-int-(-const)(struct-bpf_map-void-void-long-long-unsigned-int)-to-u64-(-)(u64 | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-void-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-l | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250320 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-lo | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-void-u64)-aka-int-(-const)(struct-bpf_map-void-void-long-long-unsigned-int)-to-u64-(-)(u64 | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-void-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-l | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-052-20250320 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-054-20250320 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-r061-20250321 | `-- init-Kconfig:syntax-error |-- x86_64-allnoconfig | |-- Makefile:include-config-auto.conf.cmd:No-such-file-or-directory | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250320 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250320 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250320 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250320 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250320 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250320 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-defconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-101-20250321 | |-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-102-20250321 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-103-20250321 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-104-20250320 | |-- drivers-mtd-nand-onenand-onenand_bbt.o:warning:objtool:onenand_isbad_bbt:can-t-find-switch-jump-table | `-- drivers-scsi-qla1280.o:warning:objtool:qla1280_error_action:can-t-find-switch-jump-table |-- x86_64-randconfig-104-20250321 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-121-20250320 | |-- drivers-gpu-drm-i915-i915_gem.o:warning:objtool:i915_gem_fault-falls-through-to-next-function-i915_gem_object_ggtt_pin() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:_intel_adjust_tile_offset-falls-through-to-next-function-rcu_lock_acquire() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:_intel_compute_tile_offset-falls-through-to-next-function-skl_format_to_fourcc() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:skl_plane_stride-falls-through-to-next-function-skl_plane_ctl() | `-- drivers-gpu-drm-i915-vlv_dsi_pll.o:warning:objtool:bxt_dsi_pll_enable-falls-through-to-next-function-bxt_dsi_reset_clocks() `-- x86_64-randconfig-161-20250320 |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 1451m configs tested: 16 configs skipped: 128 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250320 gcc-10.5.0 arm64 randconfig-002-20250320 gcc-10.5.0 arm64 randconfig-003-20250320 gcc-10.5.0 arm64 randconfig-004-20250320 gcc-8.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250320 clang-20 x86_64 buildonly-randconfig-002-20250320 gcc-12 x86_64 buildonly-randconfig-003-20250320 clang-20 x86_64 buildonly-randconfig-004-20250320 clang-20 x86_64 buildonly-randconfig-005-20250320 clang-20 x86_64 buildonly-randconfig-006-20250320 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/6] Mainline patch merged into OLK-6.6
by Junxian Huang 21 Mar '25

21 Mar '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Mainline patch merged into OLK-6.6: Junxian Huang (6): RDMA/hns: Fix soft lockup during bt pages loop RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() RDMA/hns: Fix invalid sq params not being blocked RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() RDMA/hns: Fix wrong value of max_sge_rd RDMA/hns: Fix missing xa_destroy() drivers/infiniband/hw/hns/hns_roce_alloc.c | 4 +++- drivers/infiniband/hw/hns/hns_roce_cq.c | 1 + drivers/infiniband/hw/hns/hns_roce_hem.c | 16 +++++++++++++++- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 20 +++++++++++--------- 5 files changed, 31 insertions(+), 12 deletions(-) -- 2.33.0

2 7

[PATCH openEuler-1.0-LTS v2 0/2] Fix race when disable/enable UIE in rtc_set_time()
by Xiongfeng Wang 21 Mar '25

21 Mar '25

Yu Liao (2): rtc: Cleanup for UIE timer/polling emulation support rtc: Fix race when disable/enable UIE in rtc_set_time() drivers/rtc/interface.c | 58 +++++++++++++++++++++++------------------ include/linux/rtc.h | 1 + 2 files changed, 33 insertions(+), 26 deletions(-) -- 2.20.1

2 3

[PATCH openEuler-1.0-LTS 0/2] Fix race when disable/enable UIE in rtc_set_time()
by Xiongfeng Wang 21 Mar '25

21 Mar '25

Yu Liao (2): rtc: Cleanup for UIE timer/polling emulation support rtc: Fix race when disable/enable UIE in rtc_set_time() drivers/rtc/interface.c | 58 +++++++++++++++++++++++------------------ include/linux/rtc.h | 1 + 2 files changed, 33 insertions(+), 26 deletions(-) -- 2.20.1

2 3

[PATCH openEuler-1.0-LTS] vfio/platform: check the bounds of read/write syscalls
by Tong Tiangen 21 Mar '25

21 Mar '25

From: Alex Williamson <alex.williamson(a)redhat.com> stable inclusion from stable-v5.10.234 commit d19a8650fd3d7aed8d1af1d9a77f979a8430eba1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBLDIK CVE: CVE-2025-21687 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit ce9ff21ea89d191e477a02ad7eabf4f996b80a69 upstream. count and offset are passed from user space and not checked, only offset is capped to 40 bits, which can be used to read/write out of bounds of the device. Fixes: 6e3f26456009 (“vfio/platform: read and write support for the device fd”) Cc: stable(a)vger.kernel.org Reported-by: Mostafa Saleh <smostafa(a)google.com> Reviewed-by: Eric Auger <eric.auger(a)redhat.com> Reviewed-by: Mostafa Saleh <smostafa(a)google.com> Tested-by: Mostafa Saleh <smostafa(a)google.com> Signed-off-by: Alex Williamson <alex.williamson(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/vfio/platform/vfio_platform_common.c [context conflict] Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- drivers/vfio/platform/vfio_platform_common.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c index bf06825d977e..f719185f83c0 100644 --- a/drivers/vfio/platform/vfio_platform_common.c +++ b/drivers/vfio/platform/vfio_platform_common.c @@ -413,6 +413,11 @@ static ssize_t vfio_platform_read_mmio(struct vfio_platform_region *reg, { unsigned int done = 0; + if (off >= reg->size) + return -EINVAL; + + count = min_t(size_t, count, reg->size - off); + if (!reg->ioaddr) { reg->ioaddr = ioremap_nocache(reg->addr, reg->size); @@ -490,6 +495,11 @@ static ssize_t vfio_platform_write_mmio(struct vfio_platform_region *reg, { unsigned int done = 0; + if (off >= reg->size) + return -EINVAL; + + count = min_t(size_t, count, reg->size - off); + if (!reg->ioaddr) { reg->ioaddr = ioremap_nocache(reg->addr, reg->size); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
by Jinjiang Tu 21 Mar '25

21 Mar '25

mainline inclusion from mainline-v6.14-rc6 commit cb402bbdabcaa5a765068c5b8673bbfc1c264242 category: bugfix bugzilla: 190517 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- In dissolve_free_huge_page(), free huge pages are dissolved without adjusting surplus count. However, free huge pages may be accounted as surplus pages, and will lead to wrong surplus count. I reproduce this issue on qemu. The steps are: 1) Node1 is memory-less at first. Hot-add memory to node1 by executing the two commands in qemu monitor: object_add memory-backend-ram,id=mem1,size=1G device_add pc-dimm,id=dimm1,memdev=mem1,node=1 2) online one memory block of Node1 with： echo online_movable > /sys/devices/system/node/node1/memoryX/state 3) create 64 huge pages for node1 4) run a program to reserve (don't consume) all the huge pages 5) echo 0 > nr_huge_pages for node1. After this step, free huge pages in Node1 are surplus. 6) create 80 huge pages for node0 7) offline memory of node1, The memory range to offline contains the free surplus huge pages created in step3) ~ step5) echo offline > /sys/devices/system/node/node1/memoryX/state 8) kill the program in step 4) The result: Node0 Node1 total 80 0 free 80 0 surplus 0 61 To fix it, adjust surplus when destroying huge pages if the node has surplus pages in dissolve_free_hugetlb_folio(). The result with this patch: Node0 Node1 total 80 0 free 80 0 surplus 0 0 Link: https://lkml.kernel.org/r/20250304132106.2872754-1-tujinjiang@huawei.com Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> Acked-by: David Hildenbrand <david(a)redhat.com> Acked-by: Oscar Salvador <osalvador(a)suse.de> Cc: Jinjiang Tu <tujinjiang(a)huawei.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/hugetlb.c [Context conflicts, and HVO isn't introduced, so don't need to handle HVO err case.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/hugetlb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 69dd1e096a48..ac6f18afdf76 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -1823,6 +1823,7 @@ int dissolve_free_huge_page(struct page *page) if (!page_count(page)) { struct page *head = compound_head(page); struct hstate *h = page_hstate(head); + bool adjust_surplus = false; if (h->free_huge_pages - h->resv_huge_pages == 0) goto out; @@ -1853,7 +1854,9 @@ int dissolve_free_huge_page(struct page *page) SetPageHWPoison(page); ClearPageHWPoison(head); } - remove_hugetlb_page(h, head, false); + if (h->surplus_huge_pages_node[page_to_nid(head)]) + adjust_surplus = true; + remove_hugetlb_page(h, head, adjust_surplus); h->max_huge_pages--; spin_unlock_irq(&hugetlb_lock); update_and_free_page(h, head); -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix race when disable/enable UIE in rtc_set_time()
by Xiongfeng Wang 21 Mar '25

21 Mar '25

Yu Liao (2): rtc: Cleanup for UIE timer/polling emulation support rtc: Fix race when disable/enable UIE in rtc_set_time() drivers/rtc/interface.c | 58 +++++++++++++++++++++++------------------ include/linux/rtc.h | 1 + 2 files changed, 33 insertions(+), 26 deletions(-) -- 2.20.1

2 3

[PATCH OLK-6.6 0/2] CVE-2025-21853
by Pu Lehui 21 Mar '25

21 Mar '25

Andrii Nakryiko (2): bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic bpf: avoid holding freeze_mutex during mmap operation kernel/bpf/ringbuf.c | 4 ---- kernel/bpf/syscall.c | 25 +++++++++++++++++-------- 2 files changed, 17 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] io_uring/kbuf: reallocate buf lists on upgrade
by Long Li 21 Mar '25

21 Mar '25

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v6.6.78 commit 146a185f6c05ee263db715f860620606303c4633 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRNOR CVE: CVE-2025-21836 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 8802766324e1f5d414a81ac43365c20142e85603 upstream. IORING_REGISTER_PBUF_RING can reuse an old struct io_buffer_list if it was created for legacy selected buffer and has been emptied. It violates the requirement that most of the field should stay stable after publish. Always reallocate it instead. Cc: stable(a)vger.kernel.org Reported-by: Pumpkin Chang <pumpkin(a)devco.re> Fixes: 2fcabce2d7d34 ("io_uring: disallow mixed provided buffer group registrations") Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/kbuf.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index 702c08c26cd4..b6fbae874f27 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -301,6 +301,12 @@ void io_destroy_buffers(struct io_ring_ctx *ctx) } } +static void io_destroy_bl(struct io_ring_ctx *ctx, struct io_buffer_list *bl) +{ + xa_erase(&ctx->io_bl_xa, bl->bgid); + io_put_bl(ctx, bl); +} + int io_remove_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf); @@ -642,12 +648,13 @@ int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg) /* if mapped buffer ring OR classic exists, don't allow */ if (bl->is_mapped || !list_empty(&bl->buf_list)) return -EEXIST; - } else { - free_bl = bl = kzalloc(sizeof(*bl), GFP_KERNEL); - if (!bl) - return -ENOMEM; + io_destroy_bl(ctx, bl); } + free_bl = bl = kzalloc(sizeof(*bl), GFP_KERNEL); + if (!bl) + return -ENOMEM; + if (!(reg.flags & IOU_PBUF_RING_MMAP)) ret = io_pin_pbuf_ring(&reg, bl); else -- 2.39.2

2 1

[PATCH OLK-5.10] io_uring: prevent opcode speculation
by Long Li 21 Mar '25

21 Mar '25

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 1e988c3fe1264708f4f92109203ac5b1d65de50b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSVZU CVE: CVE-2025-21863 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- sqe->opcode is used for different tables, make sure we santitise it against speculations. Cc: stable(a)vger.kernel.org Fixes: d3656344fea03 ("io_uring: add lookup table for various opcode needs") Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Reviewed-by: Li Zetao <lizetao1(a)huawei.com> Link: https://lore.kernel.org/r/7eddbf31c8ca0a3947f8ed98271acc2b4349c016.17395684… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/io_uring.c [Context conflict] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/io_uring.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 17a4e37a177f..883e2b74f82e 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -7196,6 +7196,8 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, if (!io_check_restriction(ctx, req, sqe_flags)) return -EACCES; + req->opcode = array_index_nospec(req->opcode, IORING_OP_LAST); + if ((sqe_flags & IOSQE_BUFFER_SELECT) && !io_op_defs[req->opcode].buffer_select) return -EOPNOTSUPP; -- 2.39.2

2 1

[openeuler:OLK-5.10 2816/2816] drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1
by kernel test robot 21 Mar '25

21 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 762816c3c07e052877c68911685e3700fe073298 commit: a0c5bfdbc099daf30cbadb9657803f0cb3f89d0b [2816/2816] drivers: support for rnpm drivers from Mucse Technology N10/N400 config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20250321/202503210356.tFg9vkJQ-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250321/202503210356.tFg9vkJQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503210356.tFg9vkJQ-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/mucse/rnpm/rnpm_common.c:12: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ 2 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:20: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1232:7: warning: variable 'autoneg_changed' set but not used [-Wunused-but-set-variable] 1232 | bool autoneg_changed = false, duplex_changed = false; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1232:32: warning: variable 'duplex_changed' set but not used [-Wunused-but-set-variable] 1232 | bool autoneg_changed = false, duplex_changed = false; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:2029:6: warning: variable 'dma_ch' set but not used [-Wunused-but-set-variable] 2029 | u32 dma_ch; | ^ 5 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnpm/rnpm_main.c:32: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:245:6: warning: no previous prototype for function 'rnpm_pf_service_event_schedule' [-Wmissing-prototypes] 245 | void rnpm_pf_service_event_schedule(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:245:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 245 | void rnpm_pf_service_event_schedule(struct rnpm_pf_adapter *pf_adapter) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1768:5: warning: no previous prototype for function 'rnpm_rx_ring_reinit' [-Wmissing-prototypes] 1768 | int rnpm_rx_ring_reinit(struct rnpm_adapter *adapter, struct rnpm_ring *rx_ring) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1768:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1768 | int rnpm_rx_ring_reinit(struct rnpm_adapter *adapter, struct rnpm_ring *rx_ring) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1957:7: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable] 1957 | bool xdp_xmit = false; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2142:6: warning: no previous prototype for function 'rnpm_write_eitr' [-Wmissing-prototypes] 2142 | void rnpm_write_eitr(struct rnpm_q_vector *q_vector, bool is_rxframe) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2142:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2142 | void rnpm_write_eitr(struct rnpm_q_vector *q_vector, bool is_rxframe) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2381:6: warning: variable 'packets' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 2381 | if (!ring_container->ring) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2387:7: note: uninitialized use occurs here 2387 | if (!packets) | ^~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2381:2: note: remove the 'if' if its condition is always true 2381 | if (!ring_container->ring) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ 2382 | 2383 | packets = ring_container->total_packets; drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2374:37: note: initialize the variable 'packets' to silence this warning 2374 | unsigned int avg_wire_size, packets, bytes; | ^ | = 0 drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2969:5: warning: no previous prototype for function 'rnpm_xmit_nop_frame_ring' [-Wmissing-prototypes] 2969 | int rnpm_xmit_nop_frame_ring(struct rnpm_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2969:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2969 | int rnpm_xmit_nop_frame_ring(struct rnpm_adapter *adapter, | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2985:5: warning: no previous prototype for function 'rnpm_xmit_nop_frame_ring_temp' [-Wmissing-prototypes] 2985 | int rnpm_xmit_nop_frame_ring_temp(struct rnpm_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2985:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2985 | int rnpm_xmit_nop_frame_ring_temp(struct rnpm_adapter *adapter, | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3851:6: warning: no previous prototype for function 'rnpm_vlan_stags_flag' [-Wmissing-prototypes] 3851 | void rnpm_vlan_stags_flag(struct rnpm_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3851:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3851 | void rnpm_vlan_stags_flag(struct rnpm_adapter *adapter) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3972:6: warning: no previous prototype for function 'control_mac_rx' [-Wmissing-prototypes] 3972 | void control_mac_rx(struct rnpm_adapter *adapter, bool on) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3972:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3972 | void control_mac_rx(struct rnpm_adapter *adapter, bool on) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5689:6: warning: no previous prototype for function 'rnpm_pf_service_timer' [-Wmissing-prototypes] 5689 | void rnpm_pf_service_timer(struct timer_list *t) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5689:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 5689 | void rnpm_pf_service_timer(struct timer_list *t) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5707:6: warning: no previous prototype for function 'rnpm_service_timer' [-Wmissing-prototypes] 5707 | void rnpm_service_timer(struct timer_list *t) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5707:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 5707 | void rnpm_service_timer(struct timer_list *t) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5853:21: warning: no previous prototype for function 'wait_all_port_resetting' [-Wmissing-prototypes] 5853 | __maybe_unused void wait_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5853:16: note: declare 'static' if the function is not intended to be used outside of this translation unit 5853 | __maybe_unused void wait_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5865:21: warning: no previous prototype for function 'clean_all_port_resetting' [-Wmissing-prototypes] 5865 | __maybe_unused void clean_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5865:16: note: declare 'static' if the function is not intended to be used outside of this translation unit 5865 | __maybe_unused void clean_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ | static -- In file included from drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:11: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:448:5: warning: no previous prototype for function 'rnpm_reset_pipeline_n10' [-Wmissing-prototypes] 448 | s32 rnpm_reset_pipeline_n10(struct rnpm_hw *hw) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:448:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 448 | s32 rnpm_reset_pipeline_n10(struct rnpm_hw *hw) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:503:6: warning: variable 'status' set but not used [-Wunused-but-set-variable] 503 | s32 status = 0; | ^ 4 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:10: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:14:24: warning: no previous prototype for function 'mbx_cookie_zalloc' [-Wmissing-prototypes] 14 | struct mbx_req_cookie *mbx_cookie_zalloc(int priv_len) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:14:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 14 | struct mbx_req_cookie *mbx_cookie_zalloc(int priv_len) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:28:5: warning: no previous prototype for function 'rnpm_mbx_write_posted_locked' [-Wmissing-prototypes] 28 | int rnpm_mbx_write_posted_locked(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:28:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 28 | int rnpm_mbx_write_posted_locked(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:81:6: warning: no previous prototype for function 'rnpm_link_stat_mark_disable' [-Wmissing-prototypes] 81 | void rnpm_link_stat_mark_disable(struct rnpm_hw *hw) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:81:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 81 | void rnpm_link_stat_mark_disable(struct rnpm_hw *hw) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:86:5: warning: no previous prototype for function 'rnpm_mbx_fw_post_req' [-Wmissing-prototypes] 86 | int rnpm_mbx_fw_post_req(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:86:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 86 | int rnpm_mbx_fw_post_req(struct rnpm_hw *hw, | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:153:5: warning: no previous prototype for function 'rnpm_fw_send_cmd_wait' [-Wmissing-prototypes] 153 | int rnpm_fw_send_cmd_wait(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:153:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 153 | int rnpm_fw_send_cmd_wait(struct rnpm_hw *hw, | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:633:5: warning: no previous prototype for function 'rnpm_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] 633 | int rnpm_mbx_lldp_all_ports_enable(struct rnpm_hw *hw, bool enable) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:633:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 633 | int rnpm_mbx_lldp_all_ports_enable(struct rnpm_hw *hw, bool enable) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:936:5: warning: no previous prototype for function 'rnpm_mbx_pluginout_evt_en' [-Wmissing-prototypes] 936 | int rnpm_mbx_pluginout_evt_en(struct rnpm_hw *hw, int in_dir, int enable) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:936:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 936 | int rnpm_mbx_pluginout_evt_en(struct rnpm_hw *hw, int in_dir, int enable) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:963:5: warning: no previous prototype for function 'rnpm_fw_get_capablity' [-Wmissing-prototypes] 963 | int rnpm_fw_get_capablity(struct rnpm_hw *hw, struct phy_abilities *abil) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:963:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 963 | int rnpm_fw_get_capablity(struct rnpm_hw *hw, struct phy_abilities *abil) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1153:6: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1153 | int err; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1188:6: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1188 | int value; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1184:5: warning: no previous prototype for function 'rnpm_fw_reg_read' [-Wmissing-prototypes] 1184 | int rnpm_fw_reg_read(struct rnpm_hw *hw, int addr, int sz) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1184:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1184 | int rnpm_fw_reg_read(struct rnpm_hw *hw, int addr, int sz) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1255:18: warning: variable 'hw' set but not used [-Wunused-but-set-variable] 1255 | struct rnpm_hw *hw; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1476:5: warning: no previous prototype for function 'rnpm_get_port_stats2' [-Wmissing-prototypes] 1476 | int rnpm_get_port_stats2(struct rnpm_hw *hw, int *pabs, int *pspeed, int *plink) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1476:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1476 | int rnpm_get_port_stats2(struct rnpm_hw *hw, int *pabs, int *pspeed, int *plink) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1528:9: warning: variable 'err' is uninitialized when used here [-Wuninitialized] 1528 | return err ? -err : 0; | ^~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1509:9: note: initialize the variable 'err' to silence this warning 1509 | int err; | ^ | = 0 16 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:17: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:263:5: warning: no previous prototype for function 'rnpm_mbx_get_pn_sn' [-Wmissing-prototypes] 263 | int rnpm_mbx_get_pn_sn(struct rnpm_hw *hw, char pn[33], char sn[33]) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:263:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 263 | int rnpm_mbx_get_pn_sn(struct rnpm_hw *hw, char pn[33], char sn[33]) | ^ | static 3 warnings generated. vim +/int +1137 drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h 1119 1120 static inline void 1121 build_link_set_loopback_req(struct mbx_fw_cmd_req *req, 1122 void *cookie, 1123 enum LOOPBACK_LEVEL level, 1124 enum LOOPBACK_FORCE_SPEED force_speed) 1125 { 1126 req->flags = 0; 1127 req->opcode = SET_LOOPBACK_MODE; 1128 req->datalen = sizeof(req->loopback); 1129 req->cookie = cookie; 1130 req->reply_lo = 0; 1131 req->reply_hi = 0; 1132 1133 req->loopback.loopback_level = level; 1134 req->loopback.loopback_type = LOOPBACK_TYPE_LOCAL; 1135 if (force_speed != LOOPBACK_FORCE_SPEED_NONE) { 1136 req->loopback.loopback_force_speed = force_speed; > 1137 req->loopback.loopback_force_speed_enable = 1; 1138 } 1139 } 1140 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] arm64: entry: Support hardware xint and xcall
by Jinjie Ruan 20 Mar '25

20 Mar '25

Support hardware xint and xcall. Jinjie Ruan (2): arm64: entry: Support hardware xint arm64: entry: Support hardware xcall arch/Kconfig | 14 ++--- arch/arm64/Kconfig | 12 ++++ arch/arm64/include/asm/sysreg.h | 7 +++ arch/arm64/kernel/cpufeature.c | 100 +++++++++++++++++++++++++++++++ arch/arm64/kernel/entry-common.c | 75 ++++++++++++++++++++--- arch/arm64/kernel/entry.S | 74 +++++++++++++++++++++-- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 36 ++++++++++- 8 files changed, 298 insertions(+), 24 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] io_uring: prevent opcode speculation
by Long Li 20 Mar '25

20 Mar '25

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 1e988c3fe1264708f4f92109203ac5b1d65de50b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSVZU CVE: CVE-2025-21863 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- sqe->opcode is used for different tables, make sure we santitise it against speculations. Cc: stable(a)vger.kernel.org Fixes: d3656344fea03 ("io_uring: add lookup table for various opcode needs") Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Reviewed-by: Li Zetao <lizetao1(a)huawei.com> Link: https://lore.kernel.org/r/7eddbf31c8ca0a3947f8ed98271acc2b4349c016.17395684… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/io_uring.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 833fd9b6a1f3..3aaac1023efb 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -2173,6 +2173,8 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, req->opcode = 0; return io_init_fail_req(req, -EINVAL); } + opcode = array_index_nospec(opcode, IORING_OP_LAST); + def = &io_issue_defs[opcode]; if (unlikely(sqe_flags & ~SQE_COMMON_FLAGS)) { /* enforce forwards compatibility on users */ -- 2.39.2

2 1

[openeuler:OLK-5.10 2816/2816] kernel/rcu/update.o: warning: objtool: synchronize_rcu_tasks_rude()+0xe0: unreachable instruction
by kernel test robot 20 Mar '25

20 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 762816c3c07e052877c68911685e3700fe073298 commit: 2509f2079e7247ed0d695bdb69c3d019a700a4b8 [2816/2816] rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug config: x86_64-buildonly-randconfig-003-20250320 (https://download.01.org/0day-ci/archive/20250320/202503202016.ACG7odcD-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250320/202503202016.ACG7odcD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503202016.ACG7odcD-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/rcu/update.o: warning: objtool: synchronize_rcu_tasks_rude()+0xe0: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2816/2816] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:898:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1
by kernel test robot 20 Mar '25

20 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 762816c3c07e052877c68911685e3700fe073298 commit: e53494b741272933726616122ea77143d9742631 [2816/2816] drivers: initial support for rnp drivers from Mucse Technology config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20250320/202503201925.S7VuFUSk-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250320/202503201925.S7VuFUSk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503201925.S7VuFUSk-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/mucse/rnp/rnp_main.c:34: In file included from drivers/net/ethernet/mucse/rnp/rnp_tc_u32_parse.h:6: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:20: In file included from drivers/net/ethernet/mucse/rnp/rnp_type.h:960: >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:898:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 898 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:1068:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1068 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ In file included from drivers/net/ethernet/mucse/rnp/rnp_main.c:34: In file included from drivers/net/ethernet/mucse/rnp/rnp_tc_u32_parse.h:6: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:21: drivers/net/ethernet/mucse/rnp/rnp_common.h:298:7: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:298:16: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:6: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:16: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:174:6: warning: no previous prototype for function 'rnp_unmap_and_free_tx_resource' [-Wmissing-prototypes] 174 | void rnp_unmap_and_free_tx_resource(struct rnp_ring *ring, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:174:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 174 | void rnp_unmap_and_free_tx_resource(struct rnp_ring *ring, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:669:5: warning: no previous prototype for function 'rnp_rx_ring_reinit' [-Wmissing-prototypes] 669 | int rnp_rx_ring_reinit(struct rnp_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:669:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 669 | int rnp_rx_ring_reinit(struct rnp_adapter *adapter, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:1777:7: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable] 1777 | bool xdp_xmit = false; | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:2012:6: warning: no previous prototype for function 'rnp_write_eitr_rx' [-Wmissing-prototypes] 2012 | void rnp_write_eitr_rx(struct rnp_q_vector *q_vector) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:2012:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2012 | void rnp_write_eitr_rx(struct rnp_q_vector *q_vector) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:2818:6: warning: variable 'rxctrl' set but not used [-Wunused-but-set-variable] 2818 | u32 rxctrl = 0, dma_axi_ctl; | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:3152:6: warning: no previous prototype for function 'rnp_vlan_stags_flag' [-Wmissing-prototypes] 3152 | void rnp_vlan_stags_flag(struct rnp_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:3152:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3152 | void rnp_vlan_stags_flag(struct rnp_adapter *adapter) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:3558:5: warning: no previous prototype for function 'rnp_xmit_nop_frame_ring' [-Wmissing-prototypes] 3558 | int rnp_xmit_nop_frame_ring(struct rnp_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:3558:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3558 | int rnp_xmit_nop_frame_ring(struct rnp_adapter *adapter, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:4811:6: warning: no previous prototype for function 'rnp_service_timer' [-Wmissing-prototypes] 4811 | void rnp_service_timer(struct timer_list *t) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:4811:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4811 | void rnp_service_timer(struct timer_list *t) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:4919:6: warning: no previous prototype for function 'rnp_service_task' [-Wmissing-prototypes] 4919 | void rnp_service_task(struct work_struct *work) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:4919:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4919 | void rnp_service_task(struct work_struct *work) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:5941:5: warning: no previous prototype for function 'rnp_delete_knode' [-Wmissing-prototypes] 5941 | int rnp_delete_knode(struct net_device *dev, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:5941:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 5941 | int rnp_delete_knode(struct net_device *dev, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:6030:5: warning: no previous prototype for function 'rnp_config_knode' [-Wmissing-prototypes] 6030 | int rnp_config_knode(struct net_device *dev, __be16 protocol, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:6030:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6030 | int rnp_config_knode(struct net_device *dev, __be16 protocol, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:6089:5: warning: no previous prototype for function 'rnp_setup_tc_cls_u32' [-Wmissing-prototypes] 6089 | int rnp_setup_tc_cls_u32(struct net_device *dev, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:6089:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6089 | int rnp_setup_tc_cls_u32(struct net_device *dev, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:6166:6: warning: no previous prototype for function 'rnp_do_reset' [-Wmissing-prototypes] 6166 | void rnp_do_reset(struct net_device *netdev) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:6166:1: note: declare 'static' if the function is not intended to be used outside of this translation unit -- In file included from drivers/net/ethernet/mucse/rnp/rnp_common.c:10: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:20: In file included from drivers/net/ethernet/mucse/rnp/rnp_type.h:960: >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:898:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 898 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:1068:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1068 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ In file included from drivers/net/ethernet/mucse/rnp/rnp_common.c:10: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:21: drivers/net/ethernet/mucse/rnp/rnp_common.h:298:7: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:298:16: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:6: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:16: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ 6 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnp/rnp_lib.c:4: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:20: In file included from drivers/net/ethernet/mucse/rnp/rnp_type.h:960: >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:898:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 898 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:1068:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1068 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ In file included from drivers/net/ethernet/mucse/rnp/rnp_lib.c:4: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:21: drivers/net/ethernet/mucse/rnp/rnp_common.h:298:7: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:298:16: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:6: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:16: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_lib.c:439:5: warning: no previous prototype for function 'rnp_acquire_msix_vectors' [-Wmissing-prototypes] 439 | int rnp_acquire_msix_vectors(struct rnp_adapter *adapter, int vectors) | ^ drivers/net/ethernet/mucse/rnp/rnp_lib.c:439:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 439 | int rnp_acquire_msix_vectors(struct rnp_adapter *adapter, int vectors) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_lib.c:985:6: warning: no previous prototype for function 'rnp_print_ring_info' [-Wmissing-prototypes] 985 | void rnp_print_ring_info(struct rnp_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnp/rnp_lib.c:985:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 985 | void rnp_print_ring_info(struct rnp_adapter *adapter) | ^ | static 8 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnp/rnp_n10.c:8: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:20: In file included from drivers/net/ethernet/mucse/rnp/rnp_type.h:960: >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:898:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 898 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:1068:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1068 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ In file included from drivers/net/ethernet/mucse/rnp/rnp_n10.c:8: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:21: drivers/net/ethernet/mucse/rnp/rnp_common.h:298:7: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:298:16: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:6: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:16: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:122:5: warning: no previous prototype for function 'rnp_eth_set_rar_n10' [-Wmissing-prototypes] 122 | s32 rnp_eth_set_rar_n10(struct rnp_eth_info *eth, u32 index, u8 *addr, | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:122:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 122 | s32 rnp_eth_set_rar_n10(struct rnp_eth_info *eth, u32 index, u8 *addr, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:179:5: warning: no previous prototype for function 'rnp_eth_clear_rar_n10' [-Wmissing-prototypes] 179 | s32 rnp_eth_clear_rar_n10(struct rnp_eth_info *eth, u32 index) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:179:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 179 | s32 rnp_eth_clear_rar_n10(struct rnp_eth_info *eth, u32 index) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:214:5: warning: no previous prototype for function 'rnp_eth_set_vmdq_n10' [-Wmissing-prototypes] 214 | s32 rnp_eth_set_vmdq_n10(struct rnp_eth_info *eth, u32 rar, u32 vmdq) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:214:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 214 | s32 rnp_eth_set_vmdq_n10(struct rnp_eth_info *eth, u32 rar, u32 vmdq) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:244:5: warning: no previous prototype for function 'rnp_eth_clear_vmdq_n10' [-Wmissing-prototypes] 244 | s32 rnp_eth_clear_vmdq_n10(struct rnp_eth_info *eth, u32 rar, u32 vmdq) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:244:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 244 | s32 rnp_eth_clear_vmdq_n10(struct rnp_eth_info *eth, u32 rar, u32 vmdq) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:328:5: warning: no previous prototype for function 'rnp_addr_list_itr' [-Wmissing-prototypes] 328 | u8 *rnp_addr_list_itr(struct rnp_hw __maybe_unused *hw, u8 **mc_addr_ptr) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:328:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 328 | u8 *rnp_addr_list_itr(struct rnp_hw __maybe_unused *hw, u8 **mc_addr_ptr) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:359:5: warning: no previous prototype for function 'rnp_eth_update_mc_addr_list_n10' [-Wmissing-prototypes] 359 | s32 rnp_eth_update_mc_addr_list_n10(struct rnp_eth_info *eth, | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:359:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 359 | s32 rnp_eth_update_mc_addr_list_n10(struct rnp_eth_info *eth, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:442:6: warning: no previous prototype for function 'rnp_eth_clr_mc_addr_n10' [-Wmissing-prototypes] 442 | void rnp_eth_clr_mc_addr_n10(struct rnp_eth_info *eth) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:442:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 442 | void rnp_eth_clr_mc_addr_n10(struct rnp_eth_info *eth) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:457:6: warning: no previous prototype for function 'rnp_eth_update_rss_key_n10' [-Wmissing-prototypes] 457 | void rnp_eth_update_rss_key_n10(struct rnp_eth_info *eth, bool sriov_flag) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:457:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 457 | void rnp_eth_update_rss_key_n10(struct rnp_eth_info *eth, bool sriov_flag) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:486:6: warning: no previous prototype for function 'rnp_eth_update_rss_table_n10' [-Wmissing-prototypes] 486 | void rnp_eth_update_rss_table_n10(struct rnp_eth_info *eth) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:486:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 486 | void rnp_eth_update_rss_table_n10(struct rnp_eth_info *eth) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:511:5: warning: no previous prototype for function 'rnp_eth_set_vfta_n10' [-Wmissing-prototypes] 511 | s32 rnp_eth_set_vfta_n10(struct rnp_eth_info *eth, u32 vlan, bool vlan_on) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:511:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 511 | s32 rnp_eth_set_vfta_n10(struct rnp_eth_info *eth, u32 vlan, bool vlan_on) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:551:6: warning: no previous prototype for function 'rnp_eth_clr_vfta_n10' [-Wmissing-prototypes] 551 | void rnp_eth_clr_vfta_n10(struct rnp_eth_info *eth) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:551:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 551 | void rnp_eth_clr_vfta_n10(struct rnp_eth_info *eth) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:577:5: warning: no previous prototype for function 'rnp_layer2_pritologic_n10' [-Wmissing-prototypes] 577 | u16 rnp_layer2_pritologic_n10(u16 hw_id) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:577:1: note: declare 'static' if the function is not intended to be used outside of this translation unit -- In file included from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:9: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:20: In file included from drivers/net/ethernet/mucse/rnp/rnp_type.h:960: >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:898:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 898 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:1068:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1068 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ In file included from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:9: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:21: drivers/net/ethernet/mucse/rnp/rnp_common.h:298:7: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:298:16: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:6: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:16: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1100:6: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1100 | int err; | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1140:6: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1140 | int value; | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1136:5: warning: no previous prototype for function 'rnp_fw_reg_read' [-Wmissing-prototypes] 1136 | int rnp_fw_reg_read(struct rnp_hw *hw, int addr, int sz) | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1136:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1136 | int rnp_fw_reg_read(struct rnp_hw *hw, int addr, int sz) | ^ | static 9 warnings generated. .. vim +/int +898 drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h 879 880 static inline void build_set_phy_reg(struct mbx_fw_cmd_req *req, 881 void *cookie, 882 enum PHY_INTERFACE phy_inf, 883 char nr_lane, int reg, int w_data, 884 int recall_qsfp_page) 885 { 886 req->flags = 0; 887 req->opcode = SET_PHY_REG; 888 req->datalen = sizeof(req->set_phy_reg); 889 req->cookie = cookie; 890 req->reply_lo = 0; 891 req->reply_hi = 0; 892 req->set_phy_reg.phy_interface = phy_inf; 893 req->set_phy_reg.nr_lane = nr_lane; 894 req->set_phy_reg.phy_reg_addr = reg; 895 req->set_phy_reg.phy_w_data = w_data; 896 897 if (recall_qsfp_page) > 898 req->set_phy_reg.recall_qsfp_page = 1; 899 else 900 req->set_phy_reg.recall_qsfp_page = 0; 901 } 902 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1509/1509] net/netfilter/ipvs/ip_vs_ctl.c:2480:9: warning: 'ret' may be used uninitialized in this function
by kernel test robot 20 Mar '25

20 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d54ba3f54612a8622df13d42bc1870048cb63d20 commit: 56ee6566622b8a8f58ec8d99e403d4ba9f29e693 [1509/1509] ipvs: Fix uninit-value in do_ip_vs_set_ctl() config: arm64-randconfig-002-20250320 (https://download.01.org/0day-ci/archive/20250320/202503201839.XDDCG7DI-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250320/202503201839.XDDCG7DI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503201839.XDDCG7DI-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): net/netfilter/ipvs/ip_vs_ctl.c: In function 'do_ip_vs_set_ctl': >> net/netfilter/ipvs/ip_vs_ctl.c:2480:9: warning: 'ret' may be used uninitialized in this function [-Wmaybe-uninitialized] 2480 | return ret; | ^~~ vim +/ret +2480 net/netfilter/ipvs/ip_vs_ctl.c c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2337 ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2338 static int ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2339 do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2340 { fc723250c9cb04 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-01-03 2341 struct net *net = sock_net(sk); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2342 int ret; 5fcf0cf6073d4a net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2014-09-03 2343 unsigned char arg[MAX_SET_ARGLEN]; c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2344 struct ip_vs_service_user *usvc_compat; c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2345 struct ip_vs_service_user_kern usvc; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2346 struct ip_vs_service *svc; c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2347 struct ip_vs_dest_user *udest_compat; c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2348 struct ip_vs_dest_user_kern udest; ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2349 struct netns_ipvs *ipvs = net_ipvs(net); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2350 5fcf0cf6073d4a net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2014-09-03 2351 BUILD_BUG_ON(sizeof(arg) > 255); df008c91f83583 net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2012-11-16 2352 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2353 return -EPERM; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2354 04bcef2a83f40c net/netfilter/ipvs/ip_vs_ctl.c Arjan van de Ven 2010-01-04 2355 if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX) 04bcef2a83f40c net/netfilter/ipvs/ip_vs_ctl.c Arjan van de Ven 2010-01-04 2356 return -EINVAL; 5fcf0cf6073d4a net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2014-09-03 2357 if (len != set_arglen[CMDID(cmd)]) { 5fcf0cf6073d4a net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2014-09-03 2358 IP_VS_DBG(1, "set_ctl: len %u != %u\n", 5fcf0cf6073d4a net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2014-09-03 2359 len, set_arglen[CMDID(cmd)]); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2360 return -EINVAL; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2361 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2362 ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2363 if (copy_from_user(arg, user, len) != 0) ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2364 return -EFAULT; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2365 ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2366 /* Handle daemons since they have another lock */ ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2367 if (cmd == IP_VS_SO_SET_STARTDAEMON || ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2368 cmd == IP_VS_SO_SET_STOPDAEMON) { ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2369 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg; ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2370 e0b26cc997d573 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2015-07-26 2371 if (cmd == IP_VS_SO_SET_STARTDAEMON) { e4ff67513096e6 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2015-07-26 2372 struct ipvs_sync_daemon_cfg cfg; e4ff67513096e6 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2015-07-26 2373 e4ff67513096e6 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2015-07-26 2374 memset(&cfg, 0, sizeof(cfg)); 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2375 ret = -EINVAL; 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2376 if (strscpy(cfg.mcast_ifn, dm->mcast_ifn, 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2377 sizeof(cfg.mcast_ifn)) <= 0) e2eda307807970 net/netfilter/ipvs/ip_vs_ctl.c Davide Caratti 2019-11-13 2378 return ret; e4ff67513096e6 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2015-07-26 2379 cfg.syncid = dm->syncid; 6ac121d710697c net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2380 ret = start_sync_thread(ipvs, &cfg, dm->state); e0b26cc997d573 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2015-07-26 2381 } else { b3cf3cbfb57c27 net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2382 ret = stop_sync_thread(ipvs, dm->state); e0b26cc997d573 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2015-07-26 2383 } e2eda307807970 net/netfilter/ipvs/ip_vs_ctl.c Davide Caratti 2019-11-13 2384 return ret; ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2385 } ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2386 7926dbfa4bc14e net/netfilter/ipvs/ip_vs_ctl.c Pablo Neira Ayuso 2014-07-31 2387 mutex_lock(&__ip_vs_mutex); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2388 if (cmd == IP_VS_SO_SET_FLUSH) { ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2389 /* Flush the virtual service */ ef7c599d91172d net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2390 ret = ip_vs_flush(ipvs, false); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2391 goto out_unlock; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2392 } else if (cmd == IP_VS_SO_SET_TIMEOUT) { ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2393 /* Set timeout values for (tcp tcpfin udp) */ f1faa1e7495445 net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2394 ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2395 goto out_unlock; 56ee6566622b8a net/netfilter/ipvs/ip_vs_ctl.c Peilin Ye 2020-11-04 2396 } else if (!len) { 56ee6566622b8a net/netfilter/ipvs/ip_vs_ctl.c Peilin Ye 2020-11-04 2397 /* No more commands with len == 0 below */ 56ee6566622b8a net/netfilter/ipvs/ip_vs_ctl.c Peilin Ye 2020-11-04 2398 ret = -EINVAL; 56ee6566622b8a net/netfilter/ipvs/ip_vs_ctl.c Peilin Ye 2020-11-04 2399 goto out_unlock; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2400 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2401 c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2402 usvc_compat = (struct ip_vs_service_user *)arg; c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2403 udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1); c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2404 c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2405 /* We only use the new structs internally, so copy userspace compat c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2406 * structs to extended internal versions */ c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2407 ip_vs_copy_usvc_compat(&usvc, usvc_compat); c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2408 ip_vs_copy_udest_compat(&udest, udest_compat); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2409 ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2410 if (cmd == IP_VS_SO_SET_ZERO) { ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2411 /* if no service address is set, zero counters in all */ c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2412 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) { c60856c687d601 net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2413 ret = ip_vs_zero_all(ipvs); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2414 goto out_unlock; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2415 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2416 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2417 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2418 if ((cmd == IP_VS_SO_SET_ADD || cmd == IP_VS_SO_SET_EDIT) && 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2419 strnlen(usvc.sched_name, IP_VS_SCHEDNAME_MAXLEN) == 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2420 IP_VS_SCHEDNAME_MAXLEN) { 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2421 ret = -EINVAL; 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2422 goto out_unlock; 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2423 } 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2424 2906f66a5682e5 net/netfilter/ipvs/ip_vs_ctl.c Venkata Mohan Reddy 2010-02-18 2425 /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */ 2906f66a5682e5 net/netfilter/ipvs/ip_vs_ctl.c Venkata Mohan Reddy 2010-02-18 2426 if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP && 2906f66a5682e5 net/netfilter/ipvs/ip_vs_ctl.c Venkata Mohan Reddy 2010-02-18 2427 usvc.protocol != IPPROTO_SCTP) { 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2428 pr_err("set_ctl: invalid protocol: %d %pI4:%d\n", 14d5e834f6b366 net/netfilter/ipvs/ip_vs_ctl.c Harvey Harrison 2008-10-31 2429 usvc.protocol, &usvc.addr.ip, 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2430 ntohs(usvc.port)); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2431 ret = -EFAULT; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2432 goto out_unlock; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2433 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2434 ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2435 /* Lookup the exact service by <protocol, addr, port> or fwmark */ ceec4c38168184 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2013-03-22 2436 rcu_read_lock(); c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2437 if (usvc.fwmark == 0) bb2e2a8c957fd1 net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2438 svc = __ip_vs_service_find(ipvs, usvc.af, usvc.protocol, b18610de9ec272 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2439 &usvc.addr, usvc.port); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2440 else 1ed8b947806155 net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2441 svc = __ip_vs_svc_fwm_find(ipvs, usvc.af, usvc.fwmark); ceec4c38168184 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2013-03-22 2442 rcu_read_unlock(); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2443 ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2444 if (cmd != IP_VS_SO_SET_ADD c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2445 && (svc == NULL || svc->protocol != usvc.protocol)) { ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2446 ret = -ESRCH; 26c15cfd291f8b net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2010-09-21 2447 goto out_unlock; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2448 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2449 ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2450 switch (cmd) { ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2451 case IP_VS_SO_SET_ADD: ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2452 if (svc != NULL) ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2453 ret = -EEXIST; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2454 else 5060bd8307fcfb net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2455 ret = ip_vs_add_service(ipvs, &usvc, &svc); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2456 break; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2457 case IP_VS_SO_SET_EDIT: c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2458 ret = ip_vs_edit_service(svc, &usvc); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2459 break; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2460 case IP_VS_SO_SET_DEL: ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2461 ret = ip_vs_del_service(svc); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2462 if (!ret) ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2463 goto out_unlock; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2464 break; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2465 case IP_VS_SO_SET_ZERO: ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2466 ret = ip_vs_zero_service(svc); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2467 break; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2468 case IP_VS_SO_SET_ADDDEST: c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2469 ret = ip_vs_add_dest(svc, &udest); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2470 break; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2471 case IP_VS_SO_SET_EDITDEST: c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2472 ret = ip_vs_edit_dest(svc, &udest); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2473 break; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2474 case IP_VS_SO_SET_DELDEST: c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2475 ret = ip_vs_del_dest(svc, &udest); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2476 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2477 ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2478 out_unlock: 14cc3e2b633bb6 net/ipv4/ipvs/ip_vs_ctl.c Ingo Molnar 2006-03-26 2479 mutex_unlock(&__ip_vs_mutex); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 @2480 return ret; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2481 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2482 :::::: The code at line 2480 was first introduced by commit :::::: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Linux-2.6.12-rc2 :::::: TO: Linus Torvalds <torvalds(a)ppc970.osdl.org> :::::: CC: Linus Torvalds <torvalds(a)ppc970.osdl.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1509/1509] drivers/dma/pl330.c:2599:15: warning: 'src' may be used uninitialized in this function
by kernel test robot 20 Mar '25

20 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d54ba3f54612a8622df13d42bc1870048cb63d20 commit: 0299853c014aa0eecf7fb85ac2f1ebd0a9a6ba73 [1509/1509] dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV config: arm64-randconfig-003-20250320 (https://download.01.org/0day-ci/archive/20250320/202503201721.gZeymcpc-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250320/202503201721.gZeymcpc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503201721.gZeymcpc-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): drivers/dma/pl330.c: In function 'pl330_prep_dma_cyclic': >> drivers/dma/pl330.c:2599:15: warning: 'src' may be used uninitialized in this function [-Wmaybe-uninitialized] 2599 | px->src_addr = src; | ~~~~~~~~~~~~~^~~~~ drivers/dma/pl330.c:2657:13: note: 'src' was declared here 2657 | dma_addr_t src; | ^~~ >> drivers/dma/pl330.c:2598:15: warning: 'dst' may be used uninitialized in this function [-Wmaybe-uninitialized] 2598 | px->dst_addr = dst; | ~~~~~~~~~~~~~^~~~~ drivers/dma/pl330.c:2656:13: note: 'dst' was declared here 2656 | dma_addr_t dst; | ^~~ drivers/dma/pl330.c:297: warning: cannot understand function prototype: 'struct pl330_reqcfg ' vim +/src +2599 drivers/dma/pl330.c b3040e40675ec2c Jassi Brar 2010-05-23 2593 b3040e40675ec2c Jassi Brar 2010-05-23 2594 static inline void fill_px(struct pl330_xfer *px, b3040e40675ec2c Jassi Brar 2010-05-23 2595 dma_addr_t dst, dma_addr_t src, size_t len) b3040e40675ec2c Jassi Brar 2010-05-23 2596 { b3040e40675ec2c Jassi Brar 2010-05-23 2597 px->bytes = len; b3040e40675ec2c Jassi Brar 2010-05-23 @2598 px->dst_addr = dst; b3040e40675ec2c Jassi Brar 2010-05-23 @2599 px->src_addr = src; b3040e40675ec2c Jassi Brar 2010-05-23 2600 } b3040e40675ec2c Jassi Brar 2010-05-23 2601 :::::: The code at line 2599 was first introduced by commit :::::: b3040e40675ec2c43542331cd30d4ee3dae797e8 DMA: PL330: Add dma api driver :::::: TO: Jassi Brar <jassi.brar(a)samsung.com> :::::: CC: Dan Williams <dan.j.williams(a)intel.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2045/2045] arch/arm64/kvm/virtcca_cvm.c:810:5: warning: no previous prototype for function 'virtcca_get_tmi_version'
by kernel test robot 20 Mar '25

20 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 961f596cd0017f5f254fb4b0ab9f5b9975177b84 commit: 86b9cab8c4752eb46e3ec038325aee5686805c69 [2045/2045] VirtCCA: an interface to retrieve the TMI version is added config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250320/202503201027.i8HE43EJ-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250320/202503201027.i8HE43EJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503201027.i8HE43EJ-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/arm64/kvm/virtcca_cvm.c:5: In file included from include/linux/kvm_host.h:16: In file included from include/linux/mm.h:2253: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/virtcca_cvm.c:810:5: warning: no previous prototype for function 'virtcca_get_tmi_version' [-Wmissing-prototypes] 810 | u64 virtcca_get_tmi_version(void) | ^ arch/arm64/kvm/virtcca_cvm.c:810:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 810 | u64 virtcca_get_tmi_version(void) | ^ | static arch/arm64/kvm/virtcca_cvm.c:1274:5: warning: no previous prototype for function 'cvm_arm_smmu_domain_set_kvm' [-Wmissing-prototypes] 1274 | int cvm_arm_smmu_domain_set_kvm(struct device *dev, void *data) | ^ arch/arm64/kvm/virtcca_cvm.c:1274:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1274 | int cvm_arm_smmu_domain_set_kvm(struct device *dev, void *data) | ^ | static 7 warnings generated. vim +/virtcca_get_tmi_version +810 arch/arm64/kvm/virtcca_cvm.c 809 > 810 u64 virtcca_get_tmi_version(void) 811 { 812 u64 res = tmi_version(); 813 814 if (res == SMCCC_RET_NOT_SUPPORTED) 815 return 0; 816 return res; 817 } 818 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2045/2045] drivers/coda/coda_pci.c:228: warning: Function parameter or member 'p' not described in 'virtcca_pci_get_rom_size'
by kernel test robot 20 Mar '25

20 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 961f596cd0017f5f254fb4b0ab9f5b9975177b84 commit: 67773feaf933058b9e64a9089345b3c64f823acd [2045/2045] VirtCCA: cvm support UEFI boot config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250320/202503200858.XSvAPfQM-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250320/202503200858.XSvAPfQM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503200858.XSvAPfQM-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/coda/coda_pci.c:36: warning: expecting prototype for virtcca_pci_write_msi_msg(). Prototype was for virtcca_pci_write_msg_msi() instead >> drivers/coda/coda_pci.c:228: warning: Function parameter or member 'p' not described in 'virtcca_pci_get_rom_size' >> drivers/coda/coda_pci.c:228: warning: Excess function parameter 'pdev' description in 'virtcca_pci_get_rom_size' vim +228 drivers/coda/coda_pci.c 28 29 /** 30 * virtcca_pci_write_msi_msg - secure dev write msi msg 31 * @desc: MSI-X description 32 * @msg: Msg information 33 * 34 **/ 35 bool virtcca_pci_write_msg_msi(struct msi_desc *desc, struct msi_msg *msg) > 36 { 37 if (!is_virtcca_cvm_enable()) 38 return false; 39 40 void __iomem *base = pci_msix_desc_addr(desc); 41 u32 ctrl = desc->pci.msix_ctrl; 42 bool unmasked = !(ctrl & PCI_MSIX_ENTRY_CTRL_MASKBIT); 43 u64 pbase = mmio_va_to_pa(base); 44 struct pci_dev *pdev = (desc->dev != NULL && 45 dev_is_pci(desc->dev)) ? to_pci_dev(desc->dev) : NULL; 46 47 if (!is_cc_dev(pci_dev_id(pdev))) 48 return false; 49 50 u64 addr = (u64)msg->address_lo | ((u64)msg->address_hi << 32); 51 52 if (addr) { 53 /* Get the offset of the its register of a specific device */ 54 u64 offset = addr - CVM_MSI_ORIG_IOVA; 55 56 addr = get_g_cc_dev_msi_addr(pci_dev_id(pdev)); 57 addr += offset; 58 if (!addr) 59 return true; 60 } 61 tmi_mmio_write(pbase + PCI_MSIX_ENTRY_LOWER_ADDR, 62 lower_32_bits(addr), CVM_RW_32_BIT, pci_dev_id(pdev)); 63 tmi_mmio_write(pbase + PCI_MSIX_ENTRY_UPPER_ADDR, 64 upper_32_bits(addr), CVM_RW_32_BIT, pci_dev_id(pdev)); 65 tmi_mmio_write(pbase + PCI_MSIX_ENTRY_DATA, 66 msg->data, CVM_RW_32_BIT, pci_dev_id(pdev)); 67 68 if (unmasked) 69 pci_msix_write_vector_ctrl(desc, ctrl); 70 tmi_mmio_read(pbase + PCI_MSIX_ENTRY_DATA, 71 CVM_RW_32_BIT, pci_dev_id(pdev)); 72 73 return true; 74 } 75 76 void virtcca_msix_prepare_msi_desc(struct pci_dev *dev, 77 struct msi_desc *desc, void __iomem *addr) 78 { 79 desc->pci.msix_ctrl = tmi_mmio_read(mmio_va_to_pa(addr + PCI_MSIX_ENTRY_VECTOR_CTRL), 80 CVM_RW_32_BIT, pci_dev_id(dev)); 81 } 82 83 /* 84 * If it is a safety device, write vector ctrl need 85 * use tmi interface 86 */ 87 bool virtcca_pci_msix_write_vector_ctrl(struct msi_desc *desc, u32 ctrl) 88 { 89 if (!is_virtcca_cvm_enable()) 90 return false; 91 92 void __iomem *desc_addr = pci_msix_desc_addr(desc); 93 struct pci_dev *pdev = (desc->dev != NULL && 94 dev_is_pci(desc->dev)) ? to_pci_dev(desc->dev) : NULL; 95 96 if (pdev == NULL || !is_cc_dev(pci_dev_id(pdev))) 97 return false; 98 99 if (desc->pci.msi_attrib.can_mask) 100 tmi_mmio_write(mmio_va_to_pa(desc_addr + PCI_MSIX_ENTRY_VECTOR_CTRL), 101 ctrl, CVM_RW_32_BIT, pci_dev_id(pdev)); 102 return true; 103 } 104 105 /* 106 * If it is a safety device, read msix need 107 * use tmi interface 108 */ 109 bool virtcca_pci_msix_mask(struct msi_desc *desc) 110 { 111 if (!is_virtcca_cvm_enable()) 112 return false; 113 114 struct pci_dev *pdev = (desc->dev != NULL && 115 dev_is_pci(desc->dev)) ? to_pci_dev(desc->dev) : NULL; 116 117 if (pdev == NULL || !is_cc_dev(pci_dev_id(pdev))) 118 return false; 119 120 /* Flush write to device */ 121 tmi_mmio_read(mmio_va_to_pa(desc->pci.mask_base), CVM_RW_32_BIT, pci_dev_id(pdev)); 122 return true; 123 } 124 125 /** 126 * virtcca_msix_mask_all_cc - mask all secure dev msix c 127 * @dev: Pointer to the pci_dev data structure of MSI-X device function 128 * @base: Io address 129 * @tsize: Number of entry 130 * @dev_num: Dev number 131 * 132 * Returns: 133 * %0 if msix mask all cc device success 134 **/ 135 int virtcca_msix_mask_all_cc(struct pci_dev *dev, void __iomem *base, int tsize, u64 dev_num) 136 { 137 int i; 138 u16 rw_ctrl; 139 u32 ctrl = PCI_MSIX_ENTRY_CTRL_MASKBIT; 140 u64 pbase = mmio_va_to_pa(base); 141 142 if (pci_msi_ignore_mask) 143 goto out; 144 145 for (i = 0; i < tsize; i++, base += PCI_MSIX_ENTRY_SIZE) { 146 tmi_mmio_write(pbase + PCI_MSIX_ENTRY_VECTOR_CTRL, 147 ctrl, CVM_RW_32_BIT, dev_num); 148 } 149 150 out: 151 pci_read_config_word(dev, dev->msix_cap + PCI_MSIX_FLAGS, &rw_ctrl); 152 rw_ctrl &= ~PCI_MSIX_FLAGS_MASKALL; 153 rw_ctrl |= 0; 154 pci_write_config_word(dev, dev->msix_cap + PCI_MSIX_FLAGS, rw_ctrl); 155 156 pcibios_free_irq(dev); 157 return 0; 158 } 159 160 /* If device is secure dev, read config need transfer to tmm module */ 161 int virtcca_pci_generic_config_read(void __iomem *addr, unsigned char bus_num, 162 unsigned int devfn, int size, u32 *val) 163 { 164 u32 cvm_bit = size == 1 ? CVM_RW_8_BIT : size == 2 ? CVM_RW_16_BIT : CVM_RW_32_BIT; 165 166 *val = tmi_mmio_read(mmio_va_to_pa(addr), cvm_bit, PCI_DEVID(bus_num, devfn)); 167 return 0; 168 } 169 170 /* If device is secure dev, write config need transfer to tmm module */ 171 int virtcca_pci_generic_config_write(void __iomem *addr, unsigned char bus_num, 172 unsigned int devfn, int size, u32 val) 173 { 174 u32 cvm_bit = size == 1 ? CVM_RW_8_BIT : size == 2 ? CVM_RW_16_BIT : CVM_RW_32_BIT; 175 176 tmi_mmio_write(mmio_va_to_pa(addr), val, cvm_bit, PCI_DEVID(bus_num, devfn)); 177 return 0; 178 } 179 180 /* Judge startup virtcca_cvm_host is enable and device is secure or not */ 181 bool is_virtcca_pci_io_rw(struct vfio_pci_core_device *vdev) 182 { 183 if (!is_virtcca_cvm_enable()) 184 return false; 185 186 struct pci_dev *pdev = vdev->pdev; 187 bool cc_dev = pdev == NULL ? false : is_cc_dev(pci_dev_id(pdev)); 188 189 if (cc_dev) 190 return true; 191 192 return false; 193 } 194 EXPORT_SYMBOL_GPL(is_virtcca_pci_io_rw); 195 196 /* Transfer to tmm write io value */ 197 void virtcca_pci_io_write(struct vfio_pci_core_device *vdev, u64 val, 198 u64 size, void __iomem *io) 199 { 200 struct pci_dev *pdev = vdev->pdev; 201 202 WARN_ON(tmi_mmio_write(mmio_va_to_pa(io), val, size, pci_dev_id(pdev))); 203 } 204 EXPORT_SYMBOL_GPL(virtcca_pci_io_write); 205 206 /* Transfer to tmm read io value */ 207 u64 virtcca_pci_io_read(struct vfio_pci_core_device *vdev, 208 u64 size, void __iomem *io) 209 { 210 struct pci_dev *pdev = vdev->pdev; 211 212 return tmi_mmio_read(mmio_va_to_pa(io), size, pci_dev_id(pdev)); 213 } 214 EXPORT_SYMBOL_GPL(virtcca_pci_io_read); 215 216 /** 217 * virtcca_pci_get_rom_size - obtain the actual size of the ROM image 218 * @pdev: target PCI device 219 * @rom: kernel virtual pointer to image of ROM 220 * @size: size of PCI window 221 * return: size of actual ROM image 222 * 223 * Determine the actual length of the ROM image. 224 * The PCI window size could be much larger than the 225 * actual image size. 226 */ 227 size_t virtcca_pci_get_rom_size(void *p, void __iomem *rom, size_t size) > 228 { -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
by Guo Mengqi 19 Mar '25

19 Mar '25

From: James Smart <jsmart2021(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit 577a942df3de2666f6947bdd3a5c9e8d30073424 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6SH CVE: CVE-2022-49535 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 577a942df3de2666f6947bdd3a5c9e8d30073424 ] If lpfc_issue_els_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference. Similarly, when processing non-zero ELS PLOGI completion status in lpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference. Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling. Link: https://lore.kernel.org/r/20220412222008.126521-9-jsmart2021@gmail.com Co-developed-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: James Smart <jsmart2021(a)gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/lpfc/lpfc_els.c [Some contexts are not in this version] Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/scsi/lpfc/lpfc_els.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c index a6eae7c31bf3..fa1936ed3915 100644 --- a/drivers/scsi/lpfc/lpfc_els.c +++ b/drivers/scsi/lpfc/lpfc_els.c @@ -1408,10 +1408,12 @@ lpfc_initial_flogi(struct lpfc_vport *vport) } if (lpfc_issue_els_flogi(vport, ndlp, 0)) { - /* This decrement of reference count to node shall kick off - * the release of the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; @@ -1455,10 +1457,12 @@ lpfc_initial_fdisc(struct lpfc_vport *vport) } if (lpfc_issue_els_fdisc(vport, ndlp, 0)) { - /* decrement node reference count to trigger the release of - * the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; -- 2.22.0

2 1

[openEuler-1.0-LTS] scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
by Guo Mengqi 19 Mar '25

19 Mar '25

From: James Smart <jsmart2021(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit 577a942df3de2666f6947bdd3a5c9e8d30073424 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6SH CVE: CVE-2022-49535 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 577a942df3de2666f6947bdd3a5c9e8d30073424 ] If lpfc_issue_els_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference. Similarly, when processing non-zero ELS PLOGI completion status in lpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference. Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling. Link: https://lore.kernel.org/r/20220412222008.126521-9-jsmart2021@gmail.com Co-developed-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: James Smart <jsmart2021(a)gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/lpfc/lpfc_els.c [Some contexts are not in this version] Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/scsi/lpfc/lpfc_els.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c index a6eae7c31bf3..fa1936ed3915 100644 --- a/drivers/scsi/lpfc/lpfc_els.c +++ b/drivers/scsi/lpfc/lpfc_els.c @@ -1408,10 +1408,12 @@ lpfc_initial_flogi(struct lpfc_vport *vport) } if (lpfc_issue_els_flogi(vport, ndlp, 0)) { - /* This decrement of reference count to node shall kick off - * the release of the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; @@ -1455,10 +1457,12 @@ lpfc_initial_fdisc(struct lpfc_vport *vport) } if (lpfc_issue_els_fdisc(vport, ndlp, 0)) { - /* decrement node reference count to trigger the release of - * the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; -- 2.22.0

1 0

[openeuler:openEuler-1.0-LTS 1504/1504] drivers/tee/optee/core.c:618:10: warning: return makes integer from pointer without a cast
by kernel test robot 19 Mar '25

19 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5624ca70f4eb787c54115bc1e1eb09ea582fd9a4 commit: 595311cf7e49c781dd26782e4b45fd54bbfb3e40 [1504/1504] optee: model OP-TEE as a platform device/driver config: arm64-randconfig-002-20250319 (https://download.01.org/0day-ci/archive/20250319/202503191516.fZeE5He3-lkp@…) compiler: aarch64-linux-gcc (GCC) 7.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250319/202503191516.fZeE5He3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503191516.fZeE5He3-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/tee/optee/core.c: In function 'optee_probe': >> drivers/tee/optee/core.c:618:10: warning: return makes integer from pointer without a cast [-Wint-conversion] return ERR_PTR(-EINVAL); ^~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for UACCE Depends on [n]: IOMMU_API [=n] Selected by [m]: - CRYPTO_DEV_HISI_QM [=m] && CRYPTO [=y] && CRYPTO_HW [=y] && ARM64 [=y] && PCI [=y] vim +618 drivers/tee/optee/core.c 595311cf7e49c7 Ard Biesheuvel 2019-12-09 581 595311cf7e49c7 Ard Biesheuvel 2019-12-09 582 static int optee_probe(struct platform_device *pdev) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 583 { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 584 optee_invoke_fn *invoke_fn; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 585 struct tee_shm_pool *pool; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 586 struct optee *optee = NULL; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 587 void *memremaped_shm = NULL; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 588 struct tee_device *teedev; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 589 u32 sec_caps; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 590 int rc; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 591 595311cf7e49c7 Ard Biesheuvel 2019-12-09 592 invoke_fn = get_invoke_func(&pdev->dev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 593 if (IS_ERR(invoke_fn)) 595311cf7e49c7 Ard Biesheuvel 2019-12-09 594 return PTR_ERR(invoke_fn); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 595 4fb0a5eb364d23 Jens Wiklander 2015-04-14 596 if (!optee_msg_api_uid_is_optee_api(invoke_fn)) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 597 pr_warn("api uid mismatch\n"); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 598 return -EINVAL; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 599 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 600 5c5f80307ab27c Jérôme Forissier 2017-11-24 601 optee_msg_get_os_revision(invoke_fn); 5c5f80307ab27c Jérôme Forissier 2017-11-24 602 4fb0a5eb364d23 Jens Wiklander 2015-04-14 603 if (!optee_msg_api_revision_is_compatible(invoke_fn)) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 604 pr_warn("api revision mismatch\n"); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 605 return -EINVAL; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 606 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 607 4fb0a5eb364d23 Jens Wiklander 2015-04-14 608 if (!optee_msg_exchange_capabilities(invoke_fn, &sec_caps)) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 609 pr_warn("capabilities mismatch\n"); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 610 return -EINVAL; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 611 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 612 4fb0a5eb364d23 Jens Wiklander 2015-04-14 613 /* 4fb0a5eb364d23 Jens Wiklander 2015-04-14 614 * We have no other option for shared memory, if secure world 4fb0a5eb364d23 Jens Wiklander 2015-04-14 615 * doesn't have any reserved memory we can use we can't continue. 4fb0a5eb364d23 Jens Wiklander 2015-04-14 616 */ 4fb0a5eb364d23 Jens Wiklander 2015-04-14 617 if (!(sec_caps & OPTEE_SMC_SEC_CAP_HAVE_RESERVED_SHM)) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 @618 return ERR_PTR(-EINVAL); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 619 f58e236c9d665a Volodymyr Babchuk 2017-11-29 620 pool = optee_config_shm_memremap(invoke_fn, &memremaped_shm, sec_caps); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 621 if (IS_ERR(pool)) 595311cf7e49c7 Ard Biesheuvel 2019-12-09 622 return PTR_ERR(pool); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 623 4fb0a5eb364d23 Jens Wiklander 2015-04-14 624 optee = kzalloc(sizeof(*optee), GFP_KERNEL); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 625 if (!optee) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 626 rc = -ENOMEM; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 627 goto err; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 628 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 629 4fb0a5eb364d23 Jens Wiklander 2015-04-14 630 optee->invoke_fn = invoke_fn; d885cc5e0759fc Volodymyr Babchuk 2017-11-29 631 optee->sec_caps = sec_caps; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 632 4fb0a5eb364d23 Jens Wiklander 2015-04-14 633 teedev = tee_device_alloc(&optee_desc, NULL, pool, optee); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 634 if (IS_ERR(teedev)) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 635 rc = PTR_ERR(teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 636 goto err; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 637 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 638 optee->teedev = teedev; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 639 4fb0a5eb364d23 Jens Wiklander 2015-04-14 640 teedev = tee_device_alloc(&optee_supp_desc, NULL, pool, optee); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 641 if (IS_ERR(teedev)) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 642 rc = PTR_ERR(teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 643 goto err; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 644 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 645 optee->supp_teedev = teedev; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 646 4fb0a5eb364d23 Jens Wiklander 2015-04-14 647 rc = tee_device_register(optee->teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 648 if (rc) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 649 goto err; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 650 4fb0a5eb364d23 Jens Wiklander 2015-04-14 651 rc = tee_device_register(optee->supp_teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 652 if (rc) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 653 goto err; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 654 4fb0a5eb364d23 Jens Wiklander 2015-04-14 655 mutex_init(&optee->call_queue.mutex); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 656 INIT_LIST_HEAD(&optee->call_queue.waiters); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 657 optee_wait_queue_init(&optee->wait_queue); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 658 optee_supp_init(&optee->supp); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 659 optee->memremaped_shm = memremaped_shm; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 660 optee->pool = pool; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 661 4fb0a5eb364d23 Jens Wiklander 2015-04-14 662 optee_enable_shm_cache(optee); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 663 595311cf7e49c7 Ard Biesheuvel 2019-12-09 664 platform_set_drvdata(pdev, optee); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 665 4fb0a5eb364d23 Jens Wiklander 2015-04-14 666 pr_info("initialized driver\n"); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 667 return 0; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 668 err: 4fb0a5eb364d23 Jens Wiklander 2015-04-14 669 if (optee) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 670 /* 4fb0a5eb364d23 Jens Wiklander 2015-04-14 671 * tee_device_unregister() is safe to call even if the 4fb0a5eb364d23 Jens Wiklander 2015-04-14 672 * devices hasn't been registered with 4fb0a5eb364d23 Jens Wiklander 2015-04-14 673 * tee_device_register() yet. 4fb0a5eb364d23 Jens Wiklander 2015-04-14 674 */ 4fb0a5eb364d23 Jens Wiklander 2015-04-14 675 tee_device_unregister(optee->supp_teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 676 tee_device_unregister(optee->teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 677 kfree(optee); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 678 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 679 if (pool) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 680 tee_shm_pool_free(pool); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 681 if (memremaped_shm) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 682 memunmap(memremaped_shm); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 683 return rc; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 684 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 685 :::::: The code at line 618 was first introduced by commit :::::: 4fb0a5eb364d239722e745c02aef0dbd4e0f1ad2 tee: add OP-TEE driver :::::: TO: Jens Wiklander <jens.wiklander(a)linaro.org> :::::: CC: Jens Wiklander <jens.wiklander(a)linaro.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 1/2] bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic
by Pu Lehui 19 Mar '25

19 Mar '25

From: Andrii Nakryiko <andrii(a)kernel.org> stable inclusion from stable-v6.6.80 commit fc01ba097319ae2033f118da3075bd783f4a08e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSW0M CVE: CVE-2025-21853 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 98671a0fd1f14e4a518ee06b19037c20014900eb ] For all BPF maps we ensure that VM_MAYWRITE is cleared when memory-mapping BPF map contents as initially read-only VMA. This is because in some cases BPF verifier relies on the underlying data to not be modified afterwards by user space, so once something is mapped read-only, it shouldn't be re-mmap'ed as read-write. As such, it's not necessary to check VM_MAYWRITE in bpf_map_mmap() and map->ops->map_mmap() callbacks: VM_WRITE should be consistently set for read-write mappings, and if VM_WRITE is not set, there is no way for user space to upgrade read-only mapping to read-write one. This patch cleans up this VM_WRITE vs VM_MAYWRITE handling within bpf_map_mmap(), which is an entry point for any BPF map mmap()-ing logic. We also drop unnecessary sanitization of VM_MAYWRITE in BPF ringbuf's map_mmap() callback implementation, as it is already performed by common code in bpf_map_mmap(). Note, though, that in bpf_map_mmap_{open,close}() callbacks we can't drop VM_MAYWRITE use, because it's possible (and is outside of subsystem's control) to have initially read-write memory mapping, which is subsequently dropped to read-only by user space through mprotect(). In such case, from BPF verifier POV it's read-write data throughout the lifetime of BPF map, and is counted as "active writer". But its VMAs will start out as VM_WRITE|VM_MAYWRITE, then mprotect() can change it to just VM_MAYWRITE (and no VM_WRITE), so when its finally munmap()'ed and bpf_map_mmap_close() is called, vm_flags will be just VM_MAYWRITE, but we still need to decrement active writer count with bpf_map_write_active_dec() as it's still considered to be a read-write mapping by the rest of BPF subsystem. Similar reasoning applies to bpf_map_mmap_open(), which is called whenever mmap(), munmap(), and/or mprotect() forces mm subsystem to split original VMA into multiple discontiguous VMAs. Memory-mapping handling is a bit tricky, yes. Cc: Jann Horn <jannh(a)google.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/r/20250129012246.1515826-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Stable-dep-of: bc27c52eea18 ("bpf: avoid holding freeze_mutex during mmap operation") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/ringbuf.c | 4 ---- kernel/bpf/syscall.c | 10 ++++++++-- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index 00688545742f..6aff5ee483b6 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -268,8 +268,6 @@ static int ringbuf_map_mmap_kern(struct bpf_map *map, struct vm_area_struct *vma /* allow writable mapping for the consumer_pos only */ if (vma->vm_pgoff != 0 || vma->vm_end - vma->vm_start != PAGE_SIZE) return -EPERM; - } else { - vm_flags_clear(vma, VM_MAYWRITE); } /* remap_vmalloc_range() checks size and offset constraints */ return remap_vmalloc_range(vma, rb_map->rb, @@ -289,8 +287,6 @@ static int ringbuf_map_mmap_user(struct bpf_map *map, struct vm_area_struct *vma * position, and the ring buffer data itself. */ return -EPERM; - } else { - vm_flags_clear(vma, VM_MAYWRITE); } /* remap_vmalloc_range() checks size and offset constraints */ return remap_vmalloc_range(vma, rb_map->rb, vma->vm_pgoff + RINGBUF_PGOFF); diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index f8edda3bf396..f79b8915d8c8 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -913,15 +913,21 @@ static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma) vma->vm_ops = &bpf_map_default_vmops; vma->vm_private_data = map; vm_flags_clear(vma, VM_MAYEXEC); + /* If mapping is read-only, then disallow potentially re-mapping with + * PROT_WRITE by dropping VM_MAYWRITE flag. This VM_MAYWRITE clearing + * means that as far as BPF map's memory-mapped VMAs are concerned, + * VM_WRITE and VM_MAYWRITE and equivalent, if one of them is set, + * both should be set, so we can forget about VM_MAYWRITE and always + * check just VM_WRITE + */ if (!(vma->vm_flags & VM_WRITE)) - /* disallow re-mapping with PROT_WRITE */ vm_flags_clear(vma, VM_MAYWRITE); err = map->ops->map_mmap(map, vma); if (err) goto out; - if (vma->vm_flags & VM_MAYWRITE) + if (vma->vm_flags & VM_WRITE) bpf_map_write_active_inc(map); out: mutex_unlock(&map->freeze_mutex); -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] block: fix error unwinding in blk_register_queue
by Zheng Qixing 19 Mar '25

19 Mar '25

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.2-rc1 commit 40602997be26887bdfa3d58659c3acb4579099e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSG04 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ blk_register_queue fails to handle errors from blk_mq_sysfs_register, leaks various resources on errors and accidentally sets queue refs percpu refcount to percpu mode on kobject_add failure. Fix all that by properly unwinding on errors. Signed-off-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20221114042637.1009333-4-hch@lst.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-sysfs.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-sysfs.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index b23d82fbe736..05d8a5b236f5 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -961,15 +961,21 @@ int blk_register_queue(struct gendisk *disk) return ret; mutex_lock(&queue_to_wrapper(q)->sysfs_dir_lock); - ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue"); if (ret < 0) { blk_trace_remove_sysfs(dev); goto unlock; } - if (q->mq_ops) - __blk_mq_register_dev(dev, q); + if (q->mq_ops) { + ret = __blk_mq_register_dev(dev, q); + if (ret) { + blk_trace_remove_sysfs(dev); + kobject_del(&q->kobj); + kobject_put(&dev->kobj); + goto unlock; + } + } mutex_lock(&q->sysfs_lock); mutex_lock(&q->debugfs_mutex); -- 2.39.2

2 1

[openeuler:OLK-6.6 2041/2041] arch/loongarch/mm/cache.c:69:29: warning: variable 'way_size' set but not used
by kernel test robot 18 Mar '25

18 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 010e974aad58e203f1e68707107db00593fcf851 commit: 7bd845b17aab36ac5d381557b797845404aaeb57 [2041/2041] LoongArch: Update the flush cache policy config: loongarch-randconfig-001-20250318 (https://download.01.org/0day-ci/archive/20250318/202503182233.88LCSaAj-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250318/202503182233.88LCSaAj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503182233.88LCSaAj-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/loongarch/mm/cache.c: In function 'flush_cache_last_level': >> arch/loongarch/mm/cache.c:69:29: warning: variable 'way_size' set but not used [-Wunused-but-set-variable] 69 | int i, j, nr_nodes, way_size; | ^~~~~~~~ vim +/way_size +69 arch/loongarch/mm/cache.c 65 66 static void flush_cache_last_level(unsigned int leaf) 67 { 68 u64 addr; > 69 int i, j, nr_nodes, way_size; 70 struct cache_desc *cdesc = current_cpu_data.cache_leaves + leaf; 71 72 nr_nodes = loongson_sysconf.nr_nodes; 73 74 addr = CSR_DMW1_BASE; 75 iocsr_write8(0x1, 0x280); 76 way_size = cdesc->sets * cdesc->linesz; 77 do { 78 for (i = 0; i < (cdesc->ways * 3); i++) { 79 for (j = 0; j < (cdesc->sets); j++) { 80 READ_ONCE(*(u32 *)addr); 81 addr += cdesc->linesz; 82 } 83 } 84 addr += 0x100000000000; 85 } while (--nr_nodes > 0); 86 } 87 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49508
by Chen Ridong 18 Mar '25

18 Mar '25

CVE-2022-49508 Dinghao Liu (1): HID: elan: Fix memleak in elan_input_configured Miaoqian Lin (1): HID: elan: Fix potential double free in elan_input_configured drivers/hid/hid-elan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6] smb: client: Add check for next_buffer in receive_encrypted_standard()
by Li Lingfeng 18 Mar '25

18 Mar '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v6.6.80 commit 9e5d99a4cf2e23c716b44862975548415fae5391 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSVZD CVE: CVE-2025-21844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 860ca5e50f73c2a1cef7eefc9d39d04e275417f7 upstream. Add check for the return value of cifs_buf_get() and cifs_small_buf_get() in receive_encrypted_standard() to prevent null pointer dereference. Fixes: eec04ea11969 ("smb: client: fix OOB in receive_encrypted_standard()") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index fc6d00344c50..55269d3a8278 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4904,6 +4904,10 @@ receive_encrypted_standard(struct TCP_Server_Info *server, next_buffer = (char *)cifs_buf_get(); else next_buffer = (char *)cifs_small_buf_get(); + if (!next_buffer) { + cifs_server_dbg(VFS, "No memory for (large) SMB response\n"); + return -1; + } memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd); } -- 2.31.1

2 1

[PATCH OLK-6.6 0/2] two bugfixs
by Tong Tiangen 18 Mar '25

18 Mar '25

Brian Geffon (1): mm: fix finish_fault() handling for large folios Zi Yan (1): mm/migrate: fix shmem xarray update during migration mm/memory.c | 15 ++++++++++----- mm/migrate.c | 10 ++++------ 2 files changed, 14 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[PATCH olk-6.6 0/2] two bugfixs
by Tong Tiangen 18 Mar '25

18 Mar '25

Brian Geffon (1): mm: fix finish_fault() handling for large folios Zi Yan (1): mm/migrate: fix shmem xarray update during migration mm/memory.c | 15 ++++++++++----- mm/migrate.c | 10 ++++------ 2 files changed, 14 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] block: Fix handling of offline queues in blk_mq_alloc_request_hctx()
by Zheng Qixing 18 Mar '25

18 Mar '25

From: Bart Van Assche <bvanassche(a)acm.org> mainline inclusion from mainline-v5.19-rc3 commit 14dc7a18abbe4176f5626c13c333670da8e06aa1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1ZW CVE: CVE-2022-49720 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ This patch prevents that test nvme/004 triggers the following: UBSAN: array-index-out-of-bounds in block/blk-mq.h:135:9 index 512 is out of range for type 'long unsigned int [512]' Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e dump_stack+0x10/0x12 ubsan_epilogue+0x9/0x3b __ubsan_handle_out_of_bounds.cold+0x44/0x49 blk_mq_alloc_request_hctx+0x304/0x310 __nvme_submit_sync_cmd+0x70/0x200 [nvme_core] nvmf_connect_io_queue+0x23e/0x2a0 [nvme_fabrics] nvme_loop_connect_io_queues+0x8d/0xb0 [nvme_loop] nvme_loop_create_ctrl+0x58e/0x7d0 [nvme_loop] nvmf_create_ctrl+0x1d7/0x4d0 [nvme_fabrics] nvmf_dev_write+0xae/0x111 [nvme_fabrics] vfs_write+0x144/0x560 ksys_write+0xb7/0x140 __x64_sys_write+0x42/0x50 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Cc: Christoph Hellwig <hch(a)lst.de> Cc: Ming Lei <ming.lei(a)redhat.com> Fixes: 20e4d8139319 ("blk-mq: simplify queue mapping & schedule with each possisble CPU") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20220615210004.1031820-1-bvanassche@acm.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-mq.c [Due to not merging commit a5ea5811058d ("blk-mq: move the call to blk_queue_enter_live out of blk_mq_get_request").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-mq.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/block/blk-mq.c b/block/blk-mq.c index 0392b014ac89..e1253b18516b 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -515,6 +515,10 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q, return ERR_PTR(-EXDEV); } cpu = cpumask_first_and(alloc_data.hctx->cpumask, cpu_online_mask); + if (cpu >= nr_cpu_ids) { + blk_queue_exit(q); + return ERR_PTR(-EXDEV); + } alloc_data.ctx = __blk_mq_get_ctx(q, cpu); rq = blk_mq_get_request(q, NULL, op, &alloc_data); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] scsi: target: tcmu: Fix possible page UAF
by Zheng Qixing 18 Mar '25

18 Mar '25

From: Xiaoguang Wang <xiaoguang.wang(a)linux.alibaba.com> stable inclusion from stable-v4.19.239 commit e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6TV CVE: CVE-2022-49053 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit a6968f7a367f128d120447360734344d5a3d5336 ] tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned page may have been freed by tcmu_blocks_release(). We need to get_page() under cmdr_lock to avoid concurrent tcmu_blocks_release(). Link: https://lore.kernel.org/r/20220311132206.24515-1-xiaoguang.wang@linux.aliba… Reviewed-by: Bodo Stroesser <bostroesser(a)gmail.com> Signed-off-by: Xiaoguang Wang <xiaoguang.wang(a)linux.alibaba.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/target/target_core_user.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c index de27014685ac..eed2d8e1c92f 100644 --- a/drivers/target/target_core_user.c +++ b/drivers/target/target_core_user.c @@ -1528,6 +1528,7 @@ static struct page *tcmu_try_get_block_page(struct tcmu_dev *udev, uint32_t dbi) mutex_lock(&udev->cmdr_lock); page = tcmu_get_block_page(udev, dbi); if (likely(page)) { + get_page(page); mutex_unlock(&udev->cmdr_lock); return page; } @@ -1566,6 +1567,7 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf) /* For the vmalloc()ed cmd area pages */ addr = (void *)(unsigned long)info->mem[mi].addr + offset; page = vmalloc_to_page(addr); + get_page(page); } else { uint32_t dbi; @@ -1576,7 +1578,6 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf) return VM_FAULT_SIGBUS; } - get_page(page); vmf->page = page; return 0; } -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 1501/1501] lib/ubsan.c:195:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_add_overflow'; expected 'void *'
by kernel test robot 18 Mar '25

18 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a304375c0bb304fd38fa85987919aff3d831cf9b commit: d2e5767132d657577127f1d35764bb4721dd3cc5 [1501/1501] ubsan: Fix nasty -Wbuiltin-declaration-mismatch GCC-9 warnings config: arm64-randconfig-001-20250318 (https://download.01.org/0day-ci/archive/20250318/202503181741.vcHyKenV-lkp@…) compiler: aarch64-linux-gcc (GCC) 9.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250318/202503181741.vcHyKenV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503181741.vcHyKenV-lkp@intel.com/ All warnings (new ones prefixed by >>): >> lib/ubsan.c:195:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_add_overflow'; expected 'void *' [-Wbuiltin-declaration-mismatch] 195 | void __ubsan_handle_add_overflow(struct overflow_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:203:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_sub_overflow'; expected 'void *' [-Wbuiltin-declaration-mismatch] 203 | void __ubsan_handle_sub_overflow(struct overflow_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:210:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_mul_overflow'; expected 'void *' [-Wbuiltin-declaration-mismatch] 210 | void __ubsan_handle_mul_overflow(struct overflow_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:217:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_negate_overflow'; expected 'void *' [-Wbuiltin-declaration-mismatch] 217 | void __ubsan_handle_negate_overflow(struct overflow_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:238:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_divrem_overflow'; expected 'void *' [-Wbuiltin-declaration-mismatch] 238 | void __ubsan_handle_divrem_overflow(struct overflow_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ lib/ubsan.c:323:6: warning: no previous prototype for '__ubsan_handle_type_mismatch' [-Wmissing-prototypes] 323 | void __ubsan_handle_type_mismatch(struct type_mismatch_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:337:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_type_mismatch_v1'; expected 'void *' [-Wbuiltin-declaration-mismatch] 337 | void __ubsan_handle_type_mismatch_v1(struct type_mismatch_data_v1 *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:352:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_vla_bound_not_positive'; expected 'void *' [-Wbuiltin-declaration-mismatch] 352 | void __ubsan_handle_vla_bound_not_positive(struct vla_bound_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:370:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_out_of_bounds'; expected 'void *' [-Wbuiltin-declaration-mismatch] 370 | void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:387:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_shift_out_of_bounds'; expected 'void *' [-Wbuiltin-declaration-mismatch] 387 | void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ lib/ubsan.c:427:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_builtin_unreachable'; expected 'void *' [-Wbuiltin-declaration-mismatch] 427 | void __ubsan_handle_builtin_unreachable(struct unreachable_data *data) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:438:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_load_invalid_value'; expected 'void *' [-Wbuiltin-declaration-mismatch] 438 | void __ubsan_handle_load_invalid_value(struct invalid_value_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +195 lib/ubsan.c c6d308534aef6c Andrey Ryabinin 2016-01-20 194 c6d308534aef6c Andrey Ryabinin 2016-01-20 @195 void __ubsan_handle_add_overflow(struct overflow_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 196 void *lhs, void *rhs) c6d308534aef6c Andrey Ryabinin 2016-01-20 197 { c6d308534aef6c Andrey Ryabinin 2016-01-20 198 c6d308534aef6c Andrey Ryabinin 2016-01-20 199 handle_overflow(data, lhs, rhs, '+'); c6d308534aef6c Andrey Ryabinin 2016-01-20 200 } c6d308534aef6c Andrey Ryabinin 2016-01-20 201 EXPORT_SYMBOL(__ubsan_handle_add_overflow); c6d308534aef6c Andrey Ryabinin 2016-01-20 202 c6d308534aef6c Andrey Ryabinin 2016-01-20 @203 void __ubsan_handle_sub_overflow(struct overflow_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 204 void *lhs, void *rhs) c6d308534aef6c Andrey Ryabinin 2016-01-20 205 { c6d308534aef6c Andrey Ryabinin 2016-01-20 206 handle_overflow(data, lhs, rhs, '-'); c6d308534aef6c Andrey Ryabinin 2016-01-20 207 } c6d308534aef6c Andrey Ryabinin 2016-01-20 208 EXPORT_SYMBOL(__ubsan_handle_sub_overflow); c6d308534aef6c Andrey Ryabinin 2016-01-20 209 c6d308534aef6c Andrey Ryabinin 2016-01-20 @210 void __ubsan_handle_mul_overflow(struct overflow_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 211 void *lhs, void *rhs) c6d308534aef6c Andrey Ryabinin 2016-01-20 212 { c6d308534aef6c Andrey Ryabinin 2016-01-20 213 handle_overflow(data, lhs, rhs, '*'); c6d308534aef6c Andrey Ryabinin 2016-01-20 214 } c6d308534aef6c Andrey Ryabinin 2016-01-20 215 EXPORT_SYMBOL(__ubsan_handle_mul_overflow); c6d308534aef6c Andrey Ryabinin 2016-01-20 216 c6d308534aef6c Andrey Ryabinin 2016-01-20 @217 void __ubsan_handle_negate_overflow(struct overflow_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 218 void *old_val) c6d308534aef6c Andrey Ryabinin 2016-01-20 219 { c6d308534aef6c Andrey Ryabinin 2016-01-20 220 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 221 char old_val_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 222 c6d308534aef6c Andrey Ryabinin 2016-01-20 223 if (suppress_report(&data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 224 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 225 c6d308534aef6c Andrey Ryabinin 2016-01-20 226 ubsan_prologue(&data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 227 c6d308534aef6c Andrey Ryabinin 2016-01-20 228 val_to_string(old_val_str, sizeof(old_val_str), data->type, old_val); c6d308534aef6c Andrey Ryabinin 2016-01-20 229 c6d308534aef6c Andrey Ryabinin 2016-01-20 230 pr_err("negation of %s cannot be represented in type %s:\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 231 old_val_str, data->type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 232 c6d308534aef6c Andrey Ryabinin 2016-01-20 233 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 234 } c6d308534aef6c Andrey Ryabinin 2016-01-20 235 EXPORT_SYMBOL(__ubsan_handle_negate_overflow); c6d308534aef6c Andrey Ryabinin 2016-01-20 236 c6d308534aef6c Andrey Ryabinin 2016-01-20 237 c6d308534aef6c Andrey Ryabinin 2016-01-20 @238 void __ubsan_handle_divrem_overflow(struct overflow_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 239 void *lhs, void *rhs) c6d308534aef6c Andrey Ryabinin 2016-01-20 240 { c6d308534aef6c Andrey Ryabinin 2016-01-20 241 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 242 char rhs_val_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 243 c6d308534aef6c Andrey Ryabinin 2016-01-20 244 if (suppress_report(&data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 245 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 246 c6d308534aef6c Andrey Ryabinin 2016-01-20 247 ubsan_prologue(&data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 248 c6d308534aef6c Andrey Ryabinin 2016-01-20 249 val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs); c6d308534aef6c Andrey Ryabinin 2016-01-20 250 c6d308534aef6c Andrey Ryabinin 2016-01-20 251 if (type_is_signed(data->type) && get_signed_val(data->type, rhs) == -1) c6d308534aef6c Andrey Ryabinin 2016-01-20 252 pr_err("division of %s by -1 cannot be represented in type %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 253 rhs_val_str, data->type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 254 else c6d308534aef6c Andrey Ryabinin 2016-01-20 255 pr_err("division by zero\n"); c6d308534aef6c Andrey Ryabinin 2016-01-20 256 c6d308534aef6c Andrey Ryabinin 2016-01-20 257 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 258 } c6d308534aef6c Andrey Ryabinin 2016-01-20 259 EXPORT_SYMBOL(__ubsan_handle_divrem_overflow); c6d308534aef6c Andrey Ryabinin 2016-01-20 260 42440c1f9911b4 Andrey Ryabinin 2018-02-06 261 static void handle_null_ptr_deref(struct type_mismatch_data_common *data) c6d308534aef6c Andrey Ryabinin 2016-01-20 262 { c6d308534aef6c Andrey Ryabinin 2016-01-20 263 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 264 42440c1f9911b4 Andrey Ryabinin 2018-02-06 265 if (suppress_report(data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 266 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 267 42440c1f9911b4 Andrey Ryabinin 2018-02-06 268 ubsan_prologue(data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 269 c6d308534aef6c Andrey Ryabinin 2016-01-20 270 pr_err("%s null pointer of type %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 271 type_check_kinds[data->type_check_kind], c6d308534aef6c Andrey Ryabinin 2016-01-20 272 data->type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 273 c6d308534aef6c Andrey Ryabinin 2016-01-20 274 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 275 } c6d308534aef6c Andrey Ryabinin 2016-01-20 276 42440c1f9911b4 Andrey Ryabinin 2018-02-06 277 static void handle_misaligned_access(struct type_mismatch_data_common *data, c6d308534aef6c Andrey Ryabinin 2016-01-20 278 unsigned long ptr) c6d308534aef6c Andrey Ryabinin 2016-01-20 279 { c6d308534aef6c Andrey Ryabinin 2016-01-20 280 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 281 42440c1f9911b4 Andrey Ryabinin 2018-02-06 282 if (suppress_report(data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 283 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 284 42440c1f9911b4 Andrey Ryabinin 2018-02-06 285 ubsan_prologue(data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 286 c6d308534aef6c Andrey Ryabinin 2016-01-20 287 pr_err("%s misaligned address %p for type %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 288 type_check_kinds[data->type_check_kind], c6d308534aef6c Andrey Ryabinin 2016-01-20 289 (void *)ptr, data->type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 290 pr_err("which requires %ld byte alignment\n", data->alignment); c6d308534aef6c Andrey Ryabinin 2016-01-20 291 c6d308534aef6c Andrey Ryabinin 2016-01-20 292 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 293 } c6d308534aef6c Andrey Ryabinin 2016-01-20 294 42440c1f9911b4 Andrey Ryabinin 2018-02-06 295 static void handle_object_size_mismatch(struct type_mismatch_data_common *data, c6d308534aef6c Andrey Ryabinin 2016-01-20 296 unsigned long ptr) c6d308534aef6c Andrey Ryabinin 2016-01-20 297 { c6d308534aef6c Andrey Ryabinin 2016-01-20 298 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 299 42440c1f9911b4 Andrey Ryabinin 2018-02-06 300 if (suppress_report(data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 301 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 302 42440c1f9911b4 Andrey Ryabinin 2018-02-06 303 ubsan_prologue(data->location, &flags); 901d805c33fc4c Nicolas Iooss 2016-08-02 304 pr_err("%s address %p with insufficient space\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 305 type_check_kinds[data->type_check_kind], c6d308534aef6c Andrey Ryabinin 2016-01-20 306 (void *) ptr); c6d308534aef6c Andrey Ryabinin 2016-01-20 307 pr_err("for an object of type %s\n", data->type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 308 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 309 } c6d308534aef6c Andrey Ryabinin 2016-01-20 310 42440c1f9911b4 Andrey Ryabinin 2018-02-06 311 static void ubsan_type_mismatch_common(struct type_mismatch_data_common *data, c6d308534aef6c Andrey Ryabinin 2016-01-20 312 unsigned long ptr) c6d308534aef6c Andrey Ryabinin 2016-01-20 313 { c6d308534aef6c Andrey Ryabinin 2016-01-20 314 c6d308534aef6c Andrey Ryabinin 2016-01-20 315 if (!ptr) c6d308534aef6c Andrey Ryabinin 2016-01-20 316 handle_null_ptr_deref(data); c6d308534aef6c Andrey Ryabinin 2016-01-20 317 else if (data->alignment && !IS_ALIGNED(ptr, data->alignment)) b8fe1120b4ba34 Andrew Morton 2018-02-06 318 handle_misaligned_access(data, ptr); c6d308534aef6c Andrey Ryabinin 2016-01-20 319 else c6d308534aef6c Andrey Ryabinin 2016-01-20 320 handle_object_size_mismatch(data, ptr); c6d308534aef6c Andrey Ryabinin 2016-01-20 321 } 42440c1f9911b4 Andrey Ryabinin 2018-02-06 322 42440c1f9911b4 Andrey Ryabinin 2018-02-06 323 void __ubsan_handle_type_mismatch(struct type_mismatch_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 324 void *ptr) 42440c1f9911b4 Andrey Ryabinin 2018-02-06 325 { 42440c1f9911b4 Andrey Ryabinin 2018-02-06 326 struct type_mismatch_data_common common_data = { 42440c1f9911b4 Andrey Ryabinin 2018-02-06 327 .location = &data->location, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 328 .type = data->type, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 329 .alignment = data->alignment, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 330 .type_check_kind = data->type_check_kind 42440c1f9911b4 Andrey Ryabinin 2018-02-06 331 }; 42440c1f9911b4 Andrey Ryabinin 2018-02-06 332 d2e5767132d657 Andrey Ryabinin 2019-05-13 333 ubsan_type_mismatch_common(&common_data, (unsigned long)ptr); 42440c1f9911b4 Andrey Ryabinin 2018-02-06 334 } c6d308534aef6c Andrey Ryabinin 2016-01-20 335 EXPORT_SYMBOL(__ubsan_handle_type_mismatch); c6d308534aef6c Andrey Ryabinin 2016-01-20 336 42440c1f9911b4 Andrey Ryabinin 2018-02-06 @337 void __ubsan_handle_type_mismatch_v1(struct type_mismatch_data_v1 *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 338 void *ptr) 42440c1f9911b4 Andrey Ryabinin 2018-02-06 339 { 42440c1f9911b4 Andrey Ryabinin 2018-02-06 340 42440c1f9911b4 Andrey Ryabinin 2018-02-06 341 struct type_mismatch_data_common common_data = { 42440c1f9911b4 Andrey Ryabinin 2018-02-06 342 .location = &data->location, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 343 .type = data->type, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 344 .alignment = 1UL << data->log_alignment, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 345 .type_check_kind = data->type_check_kind 42440c1f9911b4 Andrey Ryabinin 2018-02-06 346 }; 42440c1f9911b4 Andrey Ryabinin 2018-02-06 347 d2e5767132d657 Andrey Ryabinin 2019-05-13 348 ubsan_type_mismatch_common(&common_data, (unsigned long)ptr); 42440c1f9911b4 Andrey Ryabinin 2018-02-06 349 } 42440c1f9911b4 Andrey Ryabinin 2018-02-06 350 EXPORT_SYMBOL(__ubsan_handle_type_mismatch_v1); 42440c1f9911b4 Andrey Ryabinin 2018-02-06 351 c6d308534aef6c Andrey Ryabinin 2016-01-20 @352 void __ubsan_handle_vla_bound_not_positive(struct vla_bound_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 353 void *bound) c6d308534aef6c Andrey Ryabinin 2016-01-20 354 { c6d308534aef6c Andrey Ryabinin 2016-01-20 355 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 356 char bound_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 357 c6d308534aef6c Andrey Ryabinin 2016-01-20 358 if (suppress_report(&data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 359 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 360 c6d308534aef6c Andrey Ryabinin 2016-01-20 361 ubsan_prologue(&data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 362 c6d308534aef6c Andrey Ryabinin 2016-01-20 363 val_to_string(bound_str, sizeof(bound_str), data->type, bound); c6d308534aef6c Andrey Ryabinin 2016-01-20 364 pr_err("variable length array bound value %s <= 0\n", bound_str); c6d308534aef6c Andrey Ryabinin 2016-01-20 365 c6d308534aef6c Andrey Ryabinin 2016-01-20 366 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 367 } c6d308534aef6c Andrey Ryabinin 2016-01-20 368 EXPORT_SYMBOL(__ubsan_handle_vla_bound_not_positive); c6d308534aef6c Andrey Ryabinin 2016-01-20 369 d2e5767132d657 Andrey Ryabinin 2019-05-13 @370 void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index) c6d308534aef6c Andrey Ryabinin 2016-01-20 371 { c6d308534aef6c Andrey Ryabinin 2016-01-20 372 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 373 char index_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 374 c6d308534aef6c Andrey Ryabinin 2016-01-20 375 if (suppress_report(&data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 376 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 377 c6d308534aef6c Andrey Ryabinin 2016-01-20 378 ubsan_prologue(&data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 379 c6d308534aef6c Andrey Ryabinin 2016-01-20 380 val_to_string(index_str, sizeof(index_str), data->index_type, index); c6d308534aef6c Andrey Ryabinin 2016-01-20 381 pr_err("index %s is out of range for type %s\n", index_str, c6d308534aef6c Andrey Ryabinin 2016-01-20 382 data->array_type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 383 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 384 } c6d308534aef6c Andrey Ryabinin 2016-01-20 385 EXPORT_SYMBOL(__ubsan_handle_out_of_bounds); c6d308534aef6c Andrey Ryabinin 2016-01-20 386 c6d308534aef6c Andrey Ryabinin 2016-01-20 @387 void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 388 void *lhs, void *rhs) c6d308534aef6c Andrey Ryabinin 2016-01-20 389 { c6d308534aef6c Andrey Ryabinin 2016-01-20 390 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 391 struct type_descriptor *rhs_type = data->rhs_type; c6d308534aef6c Andrey Ryabinin 2016-01-20 392 struct type_descriptor *lhs_type = data->lhs_type; c6d308534aef6c Andrey Ryabinin 2016-01-20 393 char rhs_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 394 char lhs_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 395 c6d308534aef6c Andrey Ryabinin 2016-01-20 396 if (suppress_report(&data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 397 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 398 c6d308534aef6c Andrey Ryabinin 2016-01-20 399 ubsan_prologue(&data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 400 c6d308534aef6c Andrey Ryabinin 2016-01-20 401 val_to_string(rhs_str, sizeof(rhs_str), rhs_type, rhs); c6d308534aef6c Andrey Ryabinin 2016-01-20 402 val_to_string(lhs_str, sizeof(lhs_str), lhs_type, lhs); c6d308534aef6c Andrey Ryabinin 2016-01-20 403 c6d308534aef6c Andrey Ryabinin 2016-01-20 404 if (val_is_negative(rhs_type, rhs)) c6d308534aef6c Andrey Ryabinin 2016-01-20 405 pr_err("shift exponent %s is negative\n", rhs_str); c6d308534aef6c Andrey Ryabinin 2016-01-20 406 c6d308534aef6c Andrey Ryabinin 2016-01-20 407 else if (get_unsigned_val(rhs_type, rhs) >= c6d308534aef6c Andrey Ryabinin 2016-01-20 408 type_bit_width(lhs_type)) c6d308534aef6c Andrey Ryabinin 2016-01-20 409 pr_err("shift exponent %s is too large for %u-bit type %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 410 rhs_str, c6d308534aef6c Andrey Ryabinin 2016-01-20 411 type_bit_width(lhs_type), c6d308534aef6c Andrey Ryabinin 2016-01-20 412 lhs_type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 413 else if (val_is_negative(lhs_type, lhs)) c6d308534aef6c Andrey Ryabinin 2016-01-20 414 pr_err("left shift of negative value %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 415 lhs_str); c6d308534aef6c Andrey Ryabinin 2016-01-20 416 else c6d308534aef6c Andrey Ryabinin 2016-01-20 417 pr_err("left shift of %s by %s places cannot be" c6d308534aef6c Andrey Ryabinin 2016-01-20 418 " represented in type %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 419 lhs_str, rhs_str, c6d308534aef6c Andrey Ryabinin 2016-01-20 420 lhs_type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 421 c6d308534aef6c Andrey Ryabinin 2016-01-20 422 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 423 } c6d308534aef6c Andrey Ryabinin 2016-01-20 424 EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds); c6d308534aef6c Andrey Ryabinin 2016-01-20 425 c6d308534aef6c Andrey Ryabinin 2016-01-20 426 :::::: The code at line 195 was first introduced by commit :::::: c6d308534aef6c99904bf5862066360ae067abc4 UBSAN: run-time undefined behavior sanity checker :::::: TO: Andrey Ryabinin <aryabinin(a)virtuozzo.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0