- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1555/1555] drivers/iommu/dmar.o: warning: objtool: dmar_acpi_insert_dev_scope()+0xaf: unreachable instruction
by kernel test robot 03 Apr '25

03 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ecd01009a68c85a017e3ae2d2189eab81a6272a6 commit: 0f7d0c8b66a415734cbd2c8a7afc586c4a1d61cc [1555/1555] iommu/vt-d:Add support for detecting ACPI device in RMRR config: x86_64-buildonly-randconfig-005-20250402 (https://download.01.org/0day-ci/archive/20250403/202504031027.4sVPB11F-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250403/202504031027.4sVPB11F-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504031027.4sVPB11F-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/iommu/dmar.c:769:38: warning: arithmetic on a null pointer treated as a cast from integer to pointer is a GNU extension [-Wgnu-null-pointer-arithmetic] 769 | if (!ACPI_SUCCESS(acpi_get_handle(ACPI_ROOT_OBJECT, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~ 770 | andd->device_name, | ~~~~~~~~~~~~~~~~~~ 771 | &h))) { | ~~~~ include/acpi/actypes.h:458:56: note: expanded from macro 'ACPI_ROOT_OBJECT' 458 | #define ACPI_ROOT_OBJECT ((acpi_handle) ACPI_TO_POINTER (ACPI_MAX_PTR)) | ^ include/acpi/actypes.h:509:41: note: expanded from macro 'ACPI_TO_POINTER' 509 | #define ACPI_TO_POINTER(i) ACPI_ADD_PTR (void, (void *) 0, (acpi_size) (i)) | ^ include/acpi/actypes.h:503:84: note: expanded from macro 'ACPI_ADD_PTR' 503 | #define ACPI_ADD_PTR(t, a, b) ACPI_CAST_PTR (t, (ACPI_CAST_PTR (u8, (a)) + (acpi_size)(b))) | ^ include/acpi/actypes.h:501:66: note: expanded from macro 'ACPI_CAST_PTR' 501 | #define ACPI_CAST_PTR(t, p) ((t *) (acpi_uintptr_t) (p)) | ^ include/acpi/acexcep.h:57:44: note: expanded from macro 'ACPI_SUCCESS' 57 | #define ACPI_SUCCESS(a) (!(a)) | ^ 1 warning generated. drivers/iommu/dmar.c:391: warning: Function parameter or member 'header' not described in 'dmar_parse_one_drhd' drivers/iommu/dmar.c:391: warning: Function parameter or member 'arg' not described in 'dmar_parse_one_drhd' >> drivers/iommu/dmar.o: warning: objtool: dmar_acpi_insert_dev_scope()+0xaf: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] tracing/osnoise: Fix possible recursive locking for cpus_read_lock()
by Xiaomeng Zhang 03 Apr '25

03 Apr '25

From: Ran Xiaokai <ran.xiaokai(a)zte.com.cn> mainline inclusion from mainline-v6.15-rc1 commit 7e6b3fcc9c5294aeafed0dbe1a09a1bc899bd0f2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY77F Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Lockdep reports this deadlock log: osnoise: could not start sampling thread ============================================ WARNING: possible recursive locking detected -------------------------------------------- CPU0 ---- lock(cpu_hotplug_lock); lock(cpu_hotplug_lock); Call Trace: <TASK> print_deadlock_bug+0x282/0x3c0 __lock_acquire+0x1610/0x29a0 lock_acquire+0xcb/0x2d0 cpus_read_lock+0x49/0x120 stop_per_cpu_kthreads+0x7/0x60 start_kthread+0x103/0x120 osnoise_hotplug_workfn+0x5e/0x90 process_one_work+0x44f/0xb30 worker_thread+0x33e/0x5e0 kthread+0x206/0x3b0 ret_from_fork+0x31/0x50 ret_from_fork_asm+0x11/0x20 </TASK> This is the deadlock scenario: osnoise_hotplug_workfn() guard(cpus_read_lock)(); // first lock call start_kthread(cpu) if (IS_ERR(kthread)) { stop_per_cpu_kthreads(); { cpus_read_lock(); // second lock call. Cause the AA deadlock } } It is not necessary to call stop_per_cpu_kthreads() which stops osnoise kthread for every other CPUs in the system if a failure occurs during hotplug of a certain CPU. For start_per_cpu_kthreads(), if the start_kthread() call fails, this function calls stop_per_cpu_kthreads() to handle the error. Therefore, similarly, there is no need to call stop_per_cpu_kthreads() again within start_kthread(). So just remove stop_per_cpu_kthreads() from start_kthread to solve this issue. Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/20250321095249.2739397-1-ranxiaokai627@163.com Fixes: c8895e271f79 ("trace/osnoise: Support hotplug operations") Signed-off-by: Ran Xiaokai <ran.xiaokai(a)zte.com.cn> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace_osnoise.c [The conflicts were due to some minor issue.] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/trace/trace_osnoise.c | 1 - 1 file changed, 1 deletion(-) diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c index cc155590018f..5bd781359d38 100644 --- a/kernel/trace/trace_osnoise.c +++ b/kernel/trace/trace_osnoise.c @@ -2038,7 +2038,6 @@ static int start_kthread(unsigned int cpu) if (IS_ERR(kthread)) { pr_err(BANNER "could not start sampling thread\n"); - stop_per_cpu_kthreads(); return -ENOMEM; } -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Add tracepoints with null-able arguments
by Pu Lehui 03 Apr '25

03 Apr '25

From: Jiri Olsa <jolsa(a)kernel.org> mainline inclusion from mainline-v6.15-rc1 commit c83e2d970bae8616b94c40caa43d85f2f2c7d81e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY5DV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Some of the tracepoints slipped when we did the first scan, adding them now. Fixes: 838a10bd2ebf ("bpf: Augment raw_tp arguments with PTR_MAYBE_NULL") Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Link: https://lore.kernel.org/r/20250210175913.2893549-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/btf.c | 99 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 99 insertions(+) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index bbc99401b4e7..39fc33e6368f 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -5997,6 +5997,8 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = { /* rxrpc */ { "rxrpc_recvdata", 0x1 }, { "rxrpc_resend", 0x10 }, + { "rxrpc_tq", 0x10 }, + { "rxrpc_client", 0x1 }, /* sunrpc */ { "xs_stream_read_data", 0x1 }, /* ... from xprt_cong_event event class */ @@ -6017,6 +6019,103 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = { { "mr_integ_alloc", 0x2000 }, /* bpf_testmod */ { "bpf_testmod_test_read", 0x0 }, + /* amdgpu */ + { "amdgpu_vm_bo_map", 0x1 }, + { "amdgpu_vm_bo_unmap", 0x1 }, + /* netfs */ + { "netfs_folioq", 0x1 }, + /* xfs from xfs_defer_pending_class */ + { "xfs_defer_create_intent", 0x1 }, + { "xfs_defer_cancel_list", 0x1 }, + { "xfs_defer_pending_finish", 0x1 }, + { "xfs_defer_pending_abort", 0x1 }, + { "xfs_defer_relog_intent", 0x1 }, + { "xfs_defer_isolate_paused", 0x1 }, + { "xfs_defer_item_pause", 0x1 }, + { "xfs_defer_item_unpause", 0x1 }, + /* xfs from xfs_defer_pending_item_class */ + { "xfs_defer_add_item", 0x1 }, + { "xfs_defer_cancel_item", 0x1 }, + { "xfs_defer_finish_item", 0x1 }, + /* xfs from xfs_icwalk_class */ + { "xfs_ioc_free_eofblocks", 0x10 }, + { "xfs_blockgc_free_space", 0x10 }, + /* xfs from xfs_btree_cur_class */ + { "xfs_btree_updkeys", 0x100 }, + { "xfs_btree_overlapped_query_range", 0x100 }, + /* xfs from xfs_imap_class*/ + { "xfs_map_blocks_found", 0x10000 }, + { "xfs_map_blocks_alloc", 0x10000 }, + { "xfs_iomap_alloc", 0x1000 }, + { "xfs_iomap_found", 0x1000 }, + /* xfs from xfs_fs_class */ + { "xfs_inodegc_flush", 0x1 }, + { "xfs_inodegc_push", 0x1 }, + { "xfs_inodegc_start", 0x1 }, + { "xfs_inodegc_stop", 0x1 }, + { "xfs_inodegc_queue", 0x1 }, + { "xfs_inodegc_throttle", 0x1 }, + { "xfs_fs_sync_fs", 0x1 }, + { "xfs_blockgc_start", 0x1 }, + { "xfs_blockgc_stop", 0x1 }, + { "xfs_blockgc_worker", 0x1 }, + { "xfs_blockgc_flush_all", 0x1 }, + /* xfs_scrub */ + { "xchk_nlinks_live_update", 0x10 }, + /* xfs_scrub from xchk_metapath_class */ + { "xchk_metapath_lookup", 0x100 }, + /* nfsd */ + { "nfsd_dirent", 0x1 }, + { "nfsd_file_acquire", 0x1001 }, + { "nfsd_file_insert_err", 0x1 }, + { "nfsd_file_cons_err", 0x1 }, + /* nfs4 */ + { "nfs4_setup_sequence", 0x1 }, + { "pnfs_update_layout", 0x10000 }, + { "nfs4_inode_callback_event", 0x200 }, + { "nfs4_inode_stateid_callback_event", 0x200 }, + /* nfs from pnfs_layout_event */ + { "pnfs_mds_fallback_pg_init_read", 0x10000 }, + { "pnfs_mds_fallback_pg_init_write", 0x10000 }, + { "pnfs_mds_fallback_pg_get_mirror_count", 0x10000 }, + { "pnfs_mds_fallback_read_done", 0x10000 }, + { "pnfs_mds_fallback_write_done", 0x10000 }, + { "pnfs_mds_fallback_read_pagelist", 0x10000 }, + { "pnfs_mds_fallback_write_pagelist", 0x10000 }, + /* coda */ + { "coda_dec_pic_run", 0x10 }, + { "coda_dec_pic_done", 0x10 }, + /* cfg80211 */ + { "cfg80211_scan_done", 0x11 }, + { "rdev_set_coalesce", 0x10 }, + { "cfg80211_report_wowlan_wakeup", 0x100 }, + { "cfg80211_inform_bss_frame", 0x100 }, + { "cfg80211_michael_mic_failure", 0x10000 }, + /* cfg80211 from wiphy_work_event */ + { "wiphy_work_queue", 0x10 }, + { "wiphy_work_run", 0x10 }, + { "wiphy_work_cancel", 0x10 }, + { "wiphy_work_flush", 0x10 }, + /* hugetlbfs */ + { "hugetlbfs_alloc_inode", 0x10 }, + /* spufs */ + { "spufs_context", 0x10 }, + /* kvm_hv */ + { "kvm_page_fault_enter", 0x100 }, + /* dpu */ + { "dpu_crtc_setup_mixer", 0x100 }, + /* binder */ + { "binder_transaction", 0x100 }, + /* bcachefs */ + { "btree_path_free", 0x100 }, + /* hfi1_tx */ + { "hfi1_sdma_progress", 0x1000 }, + /* iptfs */ + { "iptfs_ingress_postq_event", 0x1000 }, + /* neigh */ + { "neigh_update", 0x10 }, + /* snd_firewire_lib */ + { "amdtp_packet", 0x100 }, }; bool btf_ctx_access(int off, int size, enum bpf_access_type type, -- 2.34.1

2 1

[PATCH OLK-5.10] bnxt: Do not read past the end of test names
by Liu Chuang 03 Apr '25

03 Apr '25

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.2-rc5 commit d3e599c090fc6977331150c5f0a69ab8ce87da21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVYG CVE: CVE-2023-53010 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------- Test names were being concatenated based on a offset beyond the end of the first name, which tripped the buffer overflow detection logic: detected buffer overflow in strnlen [...] Call Trace: bnxt_ethtool_init.cold+0x18/0x18 Refactor struct hwrm_selftest_qlist_output to use an actual array, and adjust the concatenation to use snprintf() rather than a series of strncat() calls. Reported-by: Niklas Cassel <Niklas.Cassel(a)wdc.com> Link: https://lore.kernel.org/lkml/Y8F%2F1w1AZTvLglFX@x1-carbon/ Tested-by: Niklas Cassel <Niklas.Cassel(a)wdc.com> Fixes: eb51365846bc ("bnxt_en: Add basic ethtool -t selftest support.") Cc: Michael Chan <michael.chan(a)broadcom.com> Cc: "David S. Miller" <davem(a)davemloft.net> Cc: Eric Dumazet <edumazet(a)google.com> Cc: Jakub Kicinski <kuba(a)kernel.org> Cc: Paolo Abeni <pabeni(a)redhat.com> Cc: netdev(a)vger.kernel.org Signed-off-by: Kees Cook <keescook(a)chromium.org> Reviewed-by: Michael Chan <michael.chan(a)broadcom.com> Reviewed-by: Niklas Cassel <niklas.cassel(a)wdc.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c [Conflicts due to context difference.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 13 ++++--------- drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h | 9 +-------- 2 files changed, 5 insertions(+), 17 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c index eacc39140d9f..2836f0ee1491 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c @@ -3885,7 +3885,7 @@ void bnxt_ethtool_init(struct bnxt *bp) test_info->timeout = HWRM_CMD_TIMEOUT; for (i = 0; i < bp->num_tests; i++) { char *str = test_info->string[i]; - char *fw_str = resp->test0_name + i * 32; + char *fw_str = resp->test_name[i]; if (i == BNXT_MACLPBK_TEST_IDX) { strcpy(str, "Mac loopback test (offline)"); @@ -3896,14 +3896,9 @@ void bnxt_ethtool_init(struct bnxt *bp) } else if (i == BNXT_IRQ_TEST_IDX) { strcpy(str, "Interrupt_test (offline)"); } else { - strlcpy(str, fw_str, ETH_GSTRING_LEN); - strncat(str, " test", ETH_GSTRING_LEN - strlen(str)); - if (test_info->offline_mask & (1 << i)) - strncat(str, " (offline)", - ETH_GSTRING_LEN - strlen(str)); - else - strncat(str, " (online)", - ETH_GSTRING_LEN - strlen(str)); + snprintf(str, ETH_GSTRING_LEN, "%s test (%s)", + fw_str, test_info->offline_mask & (1 << i) ? + "offline" : "online"); } } diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h index 2d3e962bdac3..fb8952f92df7 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h @@ -8543,14 +8543,7 @@ struct hwrm_selftest_qlist_output { u8 unused_0; __le16 test_timeout; u8 unused_1[2]; - char test0_name[32]; - char test1_name[32]; - char test2_name[32]; - char test3_name[32]; - char test4_name[32]; - char test5_name[32]; - char test6_name[32]; - char test7_name[32]; + char test_name[8][32]; u8 eyescope_target_BER_support; #define SELFTEST_QLIST_RESP_EYESCOPE_TARGET_BER_SUPPORT_BER_1E8_SUPPORTED 0x0UL #define SELFTEST_QLIST_RESP_EYESCOPE_TARGET_BER_SUPPORT_BER_1E9_SUPPORTED 0x1UL -- 2.34.1

2 1

[openeuler:OLK-5.10 2839/2839] drivers/dma/idxd/perfmon.o: warning: objtool: perfmon_init()+0x73: unreachable instruction
by kernel test robot 03 Apr '25

03 Apr '25

Hi Tom, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: faf7eef4adf1de1ce630b582ca245747042e43bd commit: bceacf8315c0518375a30a5f85eff25bbcdb380a [2839/2839] dmaengine: idxd: Add IDXD performance monitor support config: x86_64-buildonly-randconfig-005-20250402 (https://download.01.org/0day-ci/archive/20250403/202504030550.AkZJTxTF-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250403/202504030550.AkZJTxTF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504030550.AkZJTxTF-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/dma/idxd/perfmon.o: warning: objtool: perfmon_init()+0x73: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1555/1555] kernel/trace/trace_output.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7951fd324625a8af5097e1476cdc8c33c6009b48 commit: 31bf327231bb582ec7dca0490cc90c364b36e095 [1555/1555] tracing: Make sure trace_printk() can output as soon as it can be used config: x86_64-buildonly-randconfig-001-20250402 (https://download.01.org/0day-ci/archive/20250402/202504021912.9ieuHMMu-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021912.9ieuHMMu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021912.9ieuHMMu-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/trace/trace_output.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2077/2077] kernel/module/strict_rwx.c:36:6: warning: no previous prototype for 'module_disable_ro'
by kernel test robot 02 Apr '25

02 Apr '25

Hi Zheng, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 75db7d4fff188725f4adc2de1281daa5b8680603 commit: c8783f92771c891518257c9deb22cd91d4e1a212 [2077/2077] livepatch/core: Revert module_enable_ro and module_disable_ro config: x86_64-randconfig-161-20250402 (https://download.01.org/0day-ci/archive/20250402/202504021840.VgjrPfcw-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021840.VgjrPfcw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021840.VgjrPfcw-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/module/strict_rwx.c:36:6: warning: no previous prototype for 'module_disable_ro' [-Wmissing-prototypes] 36 | void module_disable_ro(const struct module *mod) | ^~~~~~~~~~~~~~~~~ vim +/module_disable_ro +36 kernel/module/strict_rwx.c 34 35 #ifdef CONFIG_LIVEPATCH_WO_FTRACE > 36 void module_disable_ro(const struct module *mod) 37 { 38 if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) 39 return; 40 #ifdef CONFIG_STRICT_MODULE_RWX 41 if (!rodata_enabled) 42 return; 43 #endif 44 45 module_set_memory(mod, MOD_TEXT, set_memory_rw); 46 module_set_memory(mod, MOD_INIT_TEXT, set_memory_rw); 47 module_set_memory(mod, MOD_RODATA, set_memory_rw); 48 module_set_memory(mod, MOD_INIT_RODATA, set_memory_rw); 49 } 50 #endif /* CONFIG_LIVEPATCH_WO_FTRACE */ 51 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1546/1546] include/linux/uaccess.h:115:17: warning: 'stats' may be used uninitialized
by kernel test robot 02 Apr '25

02 Apr '25

Hi Guillaume, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7951fd324625a8af5097e1476cdc8c33c6009b48 commit: 528534f0deda05c668756313a22974429a9df05a [1546/1546] l2tp: remove pppol2tp_tunnel_ioctl() config: arm64-randconfig-002-20250401 (https://download.01.org/0day-ci/archive/20250402/202504021807.twewxnJE-lkp@…) compiler: aarch64-linux-gcc (GCC) 12.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021807.twewxnJE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021807.twewxnJE-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): net/l2tp/l2tp_ppp.c: In function 'pppol2tp_ioctl': net/l2tp/l2tp_ppp.c:1122:13: warning: variable 'val' set but not used [-Wunused-but-set-variable] 1122 | int val; | ^~~ In file included from net/l2tp/l2tp_ppp.c:62: net/l2tp/l2tp_ppp.c: At top level: include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'pppol2tp_init': 'cold' [-Wmissing-attributes] 132 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ net/l2tp/l2tp_ppp.c:1802:1: note: in expansion of macro 'module_init' 1802 | module_init(pppol2tp_init); | ^~~~~~~~~~~ net/l2tp/l2tp_ppp.c:1754:19: note: 'init_module' target declared here 1754 | static int __init pppol2tp_init(void) | ^~~~~~~~~~~~~ include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'pppol2tp_exit': 'cold' [-Wmissing-attributes] 138 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ net/l2tp/l2tp_ppp.c:1803:1: note: in expansion of macro 'module_exit' 1803 | module_exit(pppol2tp_exit); | ^~~~~~~~~~~ net/l2tp/l2tp_ppp.c:1792:20: note: 'cleanup_module' target declared here 1792 | static void __exit pppol2tp_exit(void) | ^~~~~~~~~~~~~ In file included from net/l2tp/l2tp_ppp.c:65: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:147:7, inlined from 'pppol2tp_ioctl' at net/l2tp/l2tp_ppp.c:1163:8: >> include/linux/uaccess.h:115:17: warning: 'stats' may be used uninitialized [-Wmaybe-uninitialized] 115 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:246, from include/linux/kernel.h:10, from include/linux/list.h:9, from include/linux/module.h:9: include/linux/kasan-checks.h: In function 'pppol2tp_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ net/l2tp/l2tp_ppp.c:1120:35: note: 'stats' declared here 1120 | struct pppol2tp_ioc_stats stats; | ^~~~~ vim +/stats +115 include/linux/uaccess.h d597580d373774 Al Viro 2017-03-20 107 d597580d373774 Al Viro 2017-03-20 108 #ifdef INLINE_COPY_FROM_USER d597580d373774 Al Viro 2017-03-20 109 static inline unsigned long d597580d373774 Al Viro 2017-03-20 110 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 111 { d597580d373774 Al Viro 2017-03-20 112 unsigned long res = n; 9c5f6908de03a4 Al Viro 2017-06-29 113 might_fault(); 9c5f6908de03a4 Al Viro 2017-06-29 114 if (likely(access_ok(VERIFY_READ, from, n))) { 9c5f6908de03a4 Al Viro 2017-06-29 @115 kasan_check_write(to, n); d597580d373774 Al Viro 2017-03-20 116 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 117 } d597580d373774 Al Viro 2017-03-20 118 if (unlikely(res)) d597580d373774 Al Viro 2017-03-20 119 memset(to + (n - res), 0, res); d597580d373774 Al Viro 2017-03-20 120 return res; d597580d373774 Al Viro 2017-03-20 121 } d597580d373774 Al Viro 2017-03-20 122 #else d597580d373774 Al Viro 2017-03-20 123 extern unsigned long d597580d373774 Al Viro 2017-03-20 124 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774 Al Viro 2017-03-20 125 #endif d597580d373774 Al Viro 2017-03-20 126 :::::: The code at line 115 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] gpio: aggregator: protect driver attr handlers against module unload
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v5.10.235 commit fd6aa1f8cbe0979eb66ac32ebc231bf0b10a2117 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY441 CVE: CVE-2025-21943 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 12f65d1203507f7db3ba59930fe29a3b8eee9945 upstream. Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race conditions with module unload, a reference needs to be held. Add try_module_get() in these handlers. For new_device_store, this eliminates what appears to be the most dangerous scenario: if an id is allocated from gpio_aggregator_idr but platform_device_register has not yet been called or completed, a concurrent module unload could fail to unregister/delete the device, leaving behind a dangling platform device/GPIO forwarder. This can result in various issues. The following simple reproducer demonstrates these problems: #!/bin/bash while :; do # note: whether 'gpiochip0 0' exists or not does not matter. echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device done & while :; do modprobe gpio-aggregator modprobe -r gpio-aggregator done & wait Starting with the following warning, several kinds of warnings will appear and the system may become unstable: ------------[ cut here ]------------ list_del corruption, ffff888103e2e980->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120 [...] RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120 [...] Call Trace: <TASK> ? __list_del_entry_valid_or_report+0xa3/0x120 ? __warn.cold+0x93/0xf2 ? __list_del_entry_valid_or_report+0xa3/0x120 ? report_bug+0xe6/0x170 ? __irq_work_queue_local+0x39/0xe0 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? __list_del_entry_valid_or_report+0xa3/0x120 gpiod_remove_lookup_table+0x22/0x60 new_device_store+0x315/0x350 [gpio_aggregator] kernfs_fop_write_iter+0x137/0x1f0 vfs_write+0x262/0x430 ksys_write+0x60/0xd0 do_syscall_64+0x6c/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]--- Fixes: 828546e24280 ("gpio: Add GPIO Aggregator") Cc: stable(a)vger.kernel.org Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Link: https://lore.kernel.org/r/20250224143134.3024598-2-koichiro.den@canonical.c… Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/gpio/gpio-aggregator.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/gpio/gpio-aggregator.c b/drivers/gpio/gpio-aggregator.c index d5f25246404d..4017f132656a 100644 --- a/drivers/gpio/gpio-aggregator.c +++ b/drivers/gpio/gpio-aggregator.c @@ -173,10 +173,15 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, struct platform_device *pdev; int res, id; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + /* kernfs guarantees string termination, so count + 1 is safe */ aggr = kzalloc(sizeof(*aggr) + count + 1, GFP_KERNEL); - if (!aggr) - return -ENOMEM; + if (!aggr) { + res = -ENOMEM; + goto put_module; + } memcpy(aggr->args, buf, count + 1); @@ -215,6 +220,7 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, } aggr->pdev = pdev; + module_put(THIS_MODULE); return count; remove_table: @@ -229,6 +235,8 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, kfree(aggr->lookups); free_ga: kfree(aggr); +put_module: + module_put(THIS_MODULE); return res; } @@ -257,13 +265,19 @@ static ssize_t delete_device_store(struct device_driver *driver, if (error) return error; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + mutex_lock(&gpio_aggregator_lock); aggr = idr_remove(&gpio_aggregator_idr, id); mutex_unlock(&gpio_aggregator_lock); - if (!aggr) + if (!aggr) { + module_put(THIS_MODULE); return -ENOENT; + } gpio_aggregator_free(aggr); + module_put(THIS_MODULE); return count; } static DRIVER_ATTR_WO(delete_device); -- 2.25.1

2 1

[PATCH OLK-6.6] gpio: aggregator: protect driver attr handlers against module unload
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v6.6.83 commit d99dc8f7ea01ee1b21306e0eda8eb18a4af80db6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY441 CVE: CVE-2025-21943 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 12f65d1203507f7db3ba59930fe29a3b8eee9945 upstream. Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race conditions with module unload, a reference needs to be held. Add try_module_get() in these handlers. For new_device_store, this eliminates what appears to be the most dangerous scenario: if an id is allocated from gpio_aggregator_idr but platform_device_register has not yet been called or completed, a concurrent module unload could fail to unregister/delete the device, leaving behind a dangling platform device/GPIO forwarder. This can result in various issues. The following simple reproducer demonstrates these problems: #!/bin/bash while :; do # note: whether 'gpiochip0 0' exists or not does not matter. echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device done & while :; do modprobe gpio-aggregator modprobe -r gpio-aggregator done & wait Starting with the following warning, several kinds of warnings will appear and the system may become unstable: ------------[ cut here ]------------ list_del corruption, ffff888103e2e980->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120 [...] RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120 [...] Call Trace: <TASK> ? __list_del_entry_valid_or_report+0xa3/0x120 ? __warn.cold+0x93/0xf2 ? __list_del_entry_valid_or_report+0xa3/0x120 ? report_bug+0xe6/0x170 ? __irq_work_queue_local+0x39/0xe0 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? __list_del_entry_valid_or_report+0xa3/0x120 gpiod_remove_lookup_table+0x22/0x60 new_device_store+0x315/0x350 [gpio_aggregator] kernfs_fop_write_iter+0x137/0x1f0 vfs_write+0x262/0x430 ksys_write+0x60/0xd0 do_syscall_64+0x6c/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]--- Fixes: 828546e24280 ("gpio: Add GPIO Aggregator") Cc: stable(a)vger.kernel.org Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Link: https://lore.kernel.org/r/20250224143134.3024598-2-koichiro.den@canonical.c… Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/gpio/gpio-aggregator.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/gpio/gpio-aggregator.c b/drivers/gpio/gpio-aggregator.c index 38e0fff9afe7..cc6ee4334602 100644 --- a/drivers/gpio/gpio-aggregator.c +++ b/drivers/gpio/gpio-aggregator.c @@ -121,10 +121,15 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, struct platform_device *pdev; int res, id; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + /* kernfs guarantees string termination, so count + 1 is safe */ aggr = kzalloc(sizeof(*aggr) + count + 1, GFP_KERNEL); - if (!aggr) - return -ENOMEM; + if (!aggr) { + res = -ENOMEM; + goto put_module; + } memcpy(aggr->args, buf, count + 1); @@ -163,6 +168,7 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, } aggr->pdev = pdev; + module_put(THIS_MODULE); return count; remove_table: @@ -177,6 +183,8 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, kfree(aggr->lookups); free_ga: kfree(aggr); +put_module: + module_put(THIS_MODULE); return res; } @@ -205,13 +213,19 @@ static ssize_t delete_device_store(struct device_driver *driver, if (error) return error; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + mutex_lock(&gpio_aggregator_lock); aggr = idr_remove(&gpio_aggregator_idr, id); mutex_unlock(&gpio_aggregator_lock); - if (!aggr) + if (!aggr) { + module_put(THIS_MODULE); return -ENOENT; + } gpio_aggregator_free(aggr); + module_put(THIS_MODULE); return count; } static DRIVER_ATTR_WO(delete_device); -- 2.25.1

2 1

[PATCH OLK-5.10] [Backport] gpio: aggregator: protect driver attr handlers against module unload
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v5.10.235 commit fd6aa1f8cbe0979eb66ac32ebc231bf0b10a2117 category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 12f65d1203507f7db3ba59930fe29a3b8eee9945 upstream. Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race conditions with module unload, a reference needs to be held. Add try_module_get() in these handlers. For new_device_store, this eliminates what appears to be the most dangerous scenario: if an id is allocated from gpio_aggregator_idr but platform_device_register has not yet been called or completed, a concurrent module unload could fail to unregister/delete the device, leaving behind a dangling platform device/GPIO forwarder. This can result in various issues. The following simple reproducer demonstrates these problems: #!/bin/bash while :; do # note: whether 'gpiochip0 0' exists or not does not matter. echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device done & while :; do modprobe gpio-aggregator modprobe -r gpio-aggregator done & wait Starting with the following warning, several kinds of warnings will appear and the system may become unstable: ------------[ cut here ]------------ list_del corruption, ffff888103e2e980->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120 [...] RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120 [...] Call Trace: <TASK> ? __list_del_entry_valid_or_report+0xa3/0x120 ? __warn.cold+0x93/0xf2 ? __list_del_entry_valid_or_report+0xa3/0x120 ? report_bug+0xe6/0x170 ? __irq_work_queue_local+0x39/0xe0 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? __list_del_entry_valid_or_report+0xa3/0x120 gpiod_remove_lookup_table+0x22/0x60 new_device_store+0x315/0x350 [gpio_aggregator] kernfs_fop_write_iter+0x137/0x1f0 vfs_write+0x262/0x430 ksys_write+0x60/0xd0 do_syscall_64+0x6c/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]--- Fixes: 828546e24280 ("gpio: Add GPIO Aggregator") Cc: stable(a)vger.kernel.org Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Link: https://lore.kernel.org/r/20250224143134.3024598-2-koichiro.den@canonical.c… Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/gpio/gpio-aggregator.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/gpio/gpio-aggregator.c b/drivers/gpio/gpio-aggregator.c index d5f25246404d..4017f132656a 100644 --- a/drivers/gpio/gpio-aggregator.c +++ b/drivers/gpio/gpio-aggregator.c @@ -173,10 +173,15 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, struct platform_device *pdev; int res, id; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + /* kernfs guarantees string termination, so count + 1 is safe */ aggr = kzalloc(sizeof(*aggr) + count + 1, GFP_KERNEL); - if (!aggr) - return -ENOMEM; + if (!aggr) { + res = -ENOMEM; + goto put_module; + } memcpy(aggr->args, buf, count + 1); @@ -215,6 +220,7 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, } aggr->pdev = pdev; + module_put(THIS_MODULE); return count; remove_table: @@ -229,6 +235,8 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, kfree(aggr->lookups); free_ga: kfree(aggr); +put_module: + module_put(THIS_MODULE); return res; } @@ -257,13 +265,19 @@ static ssize_t delete_device_store(struct device_driver *driver, if (error) return error; + if (!try_module_get(THIS_MODULE)) + return -ENOENT; + mutex_lock(&gpio_aggregator_lock); aggr = idr_remove(&gpio_aggregator_idr, id); mutex_unlock(&gpio_aggregator_lock); - if (!aggr) + if (!aggr) { + module_put(THIS_MODULE); return -ENOENT; + } gpio_aggregator_free(aggr); + module_put(THIS_MODULE); return count; } static DRIVER_ATTR_WO(delete_device); -- 2.25.1

2 1

[PATCH OLK-5.10] bpf, sockmap: Fix race between element replace and close()
by Liu Jian 02 Apr '25

02 Apr '25

From: Michal Luczaj <mhal(a)rbox.co> mainline inclusion from mainline-v6.13-rc3 commit ed1fc5d76b81a4d681211333c026202cad4d5649 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMZ CVE: CVE-2024-56664 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Element replace (with a socket different from the one stored) may race with socket's close() link popping & unlinking. __sock_map_delete() unconditionally unrefs the (wrong) element: // set map[0] = s0 map_update_elem(map, 0, s0) // drop fd of s0 close(s0) sock_map_close() lock_sock(sk) (s0!) sock_map_remove_links(sk) link = sk_psock_link_pop() sock_map_unlink(sk, link) sock_map_delete_from_link // replace map[0] with s1 map_update_elem(map, 0, s1) sock_map_update_elem (s1!) lock_sock(sk) sock_map_update_common psock = sk_psock(sk) spin_lock(&stab->lock) osk = stab->sks[idx] sock_map_add_link(..., &stab->sks[idx]) sock_map_unref(osk, &stab->sks[idx]) psock = sk_psock(osk) sk_psock_put(sk, psock) if (refcount_dec_and_test(&psock)) sk_psock_drop(sk, psock) spin_unlock(&stab->lock) unlock_sock(sk) __sock_map_delete spin_lock(&stab->lock) sk = *psk // s1 replaced s0; sk == s1 if (!sk_test || sk_test == sk) // sk_test (s0) != sk (s1); no branch sk = xchg(psk, NULL) if (sk) sock_map_unref(sk, psk) // unref s1; sks[idx] will dangle psock = sk_psock(sk) sk_psock_put(sk, psock) if (refcount_dec_and_test()) sk_psock_drop(sk, psock) spin_unlock(&stab->lock) release_sock(sk) Then close(map) enqueues bpf_map_free_deferred, which finally calls sock_map_free(). This results in some refcount_t warnings along with a KASAN splat [1]. Fix __sock_map_delete(), do not allow sock_map_unref() on elements that may have been replaced. [1]: BUG: KASAN: slab-use-after-free in sock_map_free+0x10e/0x330 Write of size 4 at addr ffff88811f5b9100 by task kworker/u64:12/1063 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Not tainted 6.12.0+ #125 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred Call Trace: <TASK> dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 kasan_report+0xb9/0x190 kasan_check_range+0x10f/0x1e0 sock_map_free+0x10e/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1202: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 unix_create1+0x88/0x8a0 unix_create+0xc5/0x180 __sock_create+0x241/0x650 __sys_socketpair+0x1ce/0x420 __x64_sys_socketpair+0x92/0x100 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 46: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 sk_psock_destroy+0x73e/0xa50 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 The buggy address belongs to the object at ffff88811f5b9080 which belongs to the cache UNIX-STREAM of size 1984 The buggy address is located 128 bytes inside of freed 1984-byte region [ffff88811f5b9080, ffff88811f5b9840) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11f5b8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff888127d49401 flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) page_type: f5(slab) raw: 0017ffffc0000040 ffff8881042e4500 dead000000000122 0000000000000000 raw: 0000000000000000 00000000800f000f 00000001f5000000 ffff888127d49401 head: 0017ffffc0000040 ffff8881042e4500 dead000000000122 0000000000000000 head: 0000000000000000 00000000800f000f 00000001f5000000 ffff888127d49401 head: 0017ffffc0000003 ffffea00047d6e01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88811f5b9000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88811f5b9080: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811f5b9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811f5b9200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Disabling lock debugging due to kernel taint refcount_t: addition on 0; use-after-free. WARNING: CPU: 14 PID: 1063 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Tainted: G B 6.12.0+ #125 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred RIP: 0010:refcount_warn_saturate+0xce/0x150 Code: 34 73 eb 03 01 e8 82 53 ad fe 0f 0b eb b1 80 3d 27 73 eb 03 00 75 a8 48 c7 c7 80 bd 95 84 c6 05 17 73 eb 03 01 e8 62 53 ad fe <0f> 0b eb 91 80 3d 06 73 eb 03 00 75 88 48 c7 c7 e0 bd 95 84 c6 05 RSP: 0018:ffff88815c49fc70 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88811f5b9100 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: 0000000000000002 R08: 0000000000000001 R09: ffffed10bcde6349 R10: ffff8885e6f31a4b R11: 0000000000000000 R12: ffff88813be0b000 R13: ffff88811f5b9100 R14: ffff88811f5b9080 R15: ffff88813be0b024 FS: 0000000000000000(0000) GS:ffff8885e6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055dda99b0250 CR3: 000000015dbac000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> ? __warn.cold+0x5f/0x1ff ? refcount_warn_saturate+0xce/0x150 ? report_bug+0x1ec/0x390 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xce/0x150 sock_map_free+0x2e5/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> irq event stamp: 10741 hardirqs last enabled at (10741): [<ffffffff84400ec6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 hardirqs last disabled at (10740): [<ffffffff811e532d>] handle_softirqs+0x60d/0x770 softirqs last enabled at (10506): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 softirqs last disabled at (10301): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 refcount_t: underflow; use-after-free. WARNING: CPU: 14 PID: 1063 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Tainted: G B W 6.12.0+ #125 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred RIP: 0010:refcount_warn_saturate+0xee/0x150 Code: 17 73 eb 03 01 e8 62 53 ad fe 0f 0b eb 91 80 3d 06 73 eb 03 00 75 88 48 c7 c7 e0 bd 95 84 c6 05 f6 72 eb 03 01 e8 42 53 ad fe <0f> 0b e9 6e ff ff ff 80 3d e6 72 eb 03 00 0f 85 61 ff ff ff 48 c7 RSP: 0018:ffff88815c49fc70 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88811f5b9100 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: 0000000000000003 R08: 0000000000000001 R09: ffffed10bcde6349 R10: ffff8885e6f31a4b R11: 0000000000000000 R12: ffff88813be0b000 R13: ffff88811f5b9100 R14: ffff88811f5b9080 R15: ffff88813be0b024 FS: 0000000000000000(0000) GS:ffff8885e6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055dda99b0250 CR3: 000000015dbac000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> ? __warn.cold+0x5f/0x1ff ? refcount_warn_saturate+0xee/0x150 ? report_bug+0x1ec/0x390 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xee/0x150 sock_map_free+0x2d3/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> irq event stamp: 10741 hardirqs last enabled at (10741): [<ffffffff84400ec6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 hardirqs last disabled at (10740): [<ffffffff811e532d>] handle_softirqs+0x60d/0x770 softirqs last enabled at (10506): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 softirqs last disabled at (10301): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Michal Luczaj <mhal(a)rbox.co> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Reviewed-by: John Fastabend <john.fastabend(a)gmail.com> Link: https://lore.kernel.org/bpf/20241202-sockmap-replace-v1-3-1e88579e7bd5@rbox… Conflicts: net/core/sock_map.c [Did not backport 35d2b7ffffc1d.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/sock_map.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/net/core/sock_map.c b/net/core/sock_map.c index c3c7f4469c80..beb8768a9285 100644 --- a/net/core/sock_map.c +++ b/net/core/sock_map.c @@ -431,12 +431,11 @@ static void *sock_map_lookup_sys(struct bpf_map *map, void *key) static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, struct sock **psk) { - struct sock *sk; + struct sock *sk = NULL; int err = 0; raw_spin_lock_bh(&stab->lock); - sk = *psk; - if (!sk_test || sk_test == sk) + if (!sk_test || sk_test == *psk) sk = xchg(psk, NULL); if (likely(sk)) -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-56642
by Liu Jian 02 Apr '25

02 Apr '25

CVE-2024-56642 Eric Dumazet (1): tipc: fix NULL deref in cleanup_bearer() Kuniyuki Iwashima (1): tipc: Fix use-after-free of kernel socket in cleanup_bearer(). net/tipc/udp_media.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2024-57857
by Liu Jian 02 Apr '25

02 Apr '25

CVE-2024-57857 Bernard Metzler (1): RDMA/siw: Remove direct link to net_device Liu Jian (1): RDMA: Export ib_device_get_netdev() drivers/infiniband/core/device.c | 4 +++ drivers/infiniband/sw/siw/siw.h | 7 +++--- drivers/infiniband/sw/siw/siw_cm.c | 27 ++++++++++++++++----- drivers/infiniband/sw/siw/siw_main.c | 14 +---------- drivers/infiniband/sw/siw/siw_verbs.c | 35 ++++++++++++++++++--------- include/rdma/ib_verbs.h | 2 ++ 6 files changed, 55 insertions(+), 34 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] dmaengine: Fix double increment of client_count in dma_chan_get()
by Xiaomeng Zhang 02 Apr '25

02 Apr '25

From: Koba Ko <koba.ko(a)canonical.com> stable inclusion from stable-v4.19.272 commit c6221afe573413fd2981e291f7df4a58283e0654 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVX7 CVE: CVE-2022-49753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f3dc1b3b4750851a94212dba249703dd0e50bb20 ] The first time dma_chan_get() is called for a channel the channel client_count is incorrectly incremented twice for public channels, first in balance_ref_count(), and again prior to returning. This results in an incorrect client count which will lead to the channel resources not being freed when they should be. A simple test of repeated module load and unload of async_tx on a Dell Power Edge R7425 also shows this resulting in a kref underflow warning. [ 124.329662] async_tx: api initialized (async) [ 129.000627] async_tx: api initialized (async) [ 130.047839] ------------[ cut here ]------------ [ 130.052472] refcount_t: underflow; use-after-free. [ 130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 [ 130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr intel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm mgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si syscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops k10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat fat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul libahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas i40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash dm_log dm_mod [last unloaded: async_tx] [ 130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not tainted 5.14.0-185.el9.x86_64 #1 [ 130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS 1.18.0 01/17/2022 [ 130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110 [ 130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d 26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a bd 55 00 <0f> 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff 48 c7 [ 130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286 [ 130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000 [ 130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0 [ 130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff [ 130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970 [ 130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 130.198739] FS: 00007f646435c740(0000) GS:ffff9daf9de00000(0000) knlGS:0000000000000000 [ 130.206832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0 [ 130.219729] Call Trace: [ 130.222192] <TASK> [ 130.224305] dma_chan_put+0x10d/0x110 [ 130.227988] dmaengine_put+0x7a/0xa0 [ 130.231575] __do_sys_delete_module.constprop.0+0x178/0x280 [ 130.237157] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [ 130.242652] do_syscall_64+0x5c/0x90 [ 130.246240] ? exc_page_fault+0x62/0x150 [ 130.250178] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 130.255243] RIP: 0033:0x7f6463a3f5ab [ 130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 [ 130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab [ 130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8 [ 130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000 [ 130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8 [ 130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8 [ 130.320875] </TASK> [ 130.323081] ---[ end trace eff7156d56b5cf25 ]--- cat /sys/class/dma/dma0chan*/in_use would get the wrong result. 2 2 2 Fixes: d2f4f99db3e9 ("dmaengine: Rework dma_chan_get") Signed-off-by: Koba Ko <koba.ko(a)canonical.com> Reviewed-by: Jie Hai <haijie1(a)huawei.com> Test-by: Jie Hai <haijie1(a)huawei.com> Reviewed-by: Jerry Snitselaar <jsnitsel(a)redhat.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Tested-by: Joel Savitz <jsavitz(a)redhat.com> Link: https://lore.kernel.org/r/20221201030050.978595-1-koba.ko@canonical.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/dma/dmaengine.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index f1a441ab395d..450b1c4b2129 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -223,7 +223,8 @@ static int dma_chan_get(struct dma_chan *chan) /* The channel is already in use, update client count */ if (chan->client_count) { __module_get(owner); - goto out; + chan->client_count++; + return 0; } if (!try_module_get(owner)) @@ -236,11 +237,11 @@ static int dma_chan_get(struct dma_chan *chan) goto err_out; } + chan->client_count++; + if (!dma_has_cap(DMA_PRIVATE, chan->device->cap_mask)) balance_ref_count(chan); -out: - chan->client_count++; return 0; err_out: -- 2.34.1

2 1

[PATCH OLK-6.6] scsi: ufs: core: bsg: Fix crash when arpmb command fails
by Xiangwei Li 02 Apr '25

02 Apr '25

From: Arthur Simchaev <arthur.simchaev(a)sandisk.com> stable inclusion from stable-v6.6.81 commit 32fb5ec825f6f76bc28902181c65429a904a07fe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVSZ CVE: CVE-2025-21873 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f27a95845b01e86d67c8b014b4f41bd3327daa63 upstream. If the device doesn't support arpmb we'll crash due to copying user data in bsg_transport_sg_io_fn(). In the case where ufs_bsg_exec_advanced_rpmb_req() returns an error, do not set the job's reply_len. Memory crash backtrace: 3,1290,531166405,-;ufshcd 0000:00:12.5: ARPMB OP failed: error code -22 4,1308,531166555,-;Call Trace: 4,1309,531166559,-; <TASK> 4,1310,531166565,-; ? show_regs+0x6d/0x80 4,1311,531166575,-; ? die+0x37/0xa0 4,1312,531166583,-; ? do_trap+0xd4/0xf0 4,1313,531166593,-; ? do_error_trap+0x71/0xb0 4,1314,531166601,-; ? usercopy_abort+0x6c/0x80 4,1315,531166610,-; ? exc_invalid_op+0x52/0x80 4,1316,531166622,-; ? usercopy_abort+0x6c/0x80 4,1317,531166630,-; ? asm_exc_invalid_op+0x1b/0x20 4,1318,531166643,-; ? usercopy_abort+0x6c/0x80 4,1319,531166652,-; __check_heap_object+0xe3/0x120 4,1320,531166661,-; check_heap_object+0x185/0x1d0 4,1321,531166670,-; __check_object_size.part.0+0x72/0x150 4,1322,531166679,-; __check_object_size+0x23/0x30 4,1323,531166688,-; bsg_transport_sg_io_fn+0x314/0x3b0 Fixes: 6ff265fc5ef6 ("scsi: ufs: core: bsg: Add advanced RPMB support in ufs_bsg") Cc: stable(a)vger.kernel.org Reviewed-by: Bean Huo <beanhuo(a)micron.com> Signed-off-by: Arthur Simchaev <arthur.simchaev(a)sandisk.com> Link: https://lore.kernel.org/r/20250220142039.250992-1-arthur.simchaev@sandisk.c… Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- drivers/ufs/core/ufs_bsg.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c index 8fbd46cd8c2b..0043d69077b6 100644 --- a/drivers/ufs/core/ufs_bsg.c +++ b/drivers/ufs/core/ufs_bsg.c @@ -194,10 +194,12 @@ static int ufs_bsg_request(struct bsg_job *job) ufshcd_rpm_put_sync(hba); kfree(buff); bsg_reply->result = ret; - job->reply_len = !rpmb ? sizeof(struct ufs_bsg_reply) : sizeof(struct ufs_rpmb_reply); /* complete the job here only if no error */ - if (ret == 0) + if (ret == 0) { + job->reply_len = rpmb ? sizeof(struct ufs_rpmb_reply) : + sizeof(struct ufs_bsg_reply); bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len); + } return ret; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] EDAC/highbank: Fix memory leak in highbank_mc_probe()
by Xiangwei Li 02 Apr '25

02 Apr '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.272 commit 0db40e23b56d217eebd385bebb64057ef764b2c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVWI CVE: CVE-2022-49757 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e7a293658c20a7945014570e1921bf7d25d68a36 ] When devres_open_group() fails, it returns -ENOMEM without freeing memory allocated by edac_mc_alloc(). Call edac_mc_free() on the error handling path to avoid a memory leak. [ bp: Massage commit message. ] Fixes: a1b01edb2745 ("edac: add support for Calxeda highbank memory controller") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Andre Przywara <andre.przywara(a)arm.com> Link: https://lore.kernel.org/r/20221229054825.1361993-1-linmq006@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- drivers/edac/highbank_mc_edac.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/edac/highbank_mc_edac.c b/drivers/edac/highbank_mc_edac.c index 6092e61be605..bcf41601a977 100644 --- a/drivers/edac/highbank_mc_edac.c +++ b/drivers/edac/highbank_mc_edac.c @@ -185,8 +185,10 @@ static int highbank_mc_probe(struct platform_device *pdev) drvdata = mci->pvt_info; platform_set_drvdata(pdev, mci); - if (!devres_open_group(&pdev->dev, NULL, GFP_KERNEL)) - return -ENOMEM; + if (!devres_open_group(&pdev->dev, NULL, GFP_KERNEL)) { + res = -ENOMEM; + goto free; + } r = platform_get_resource(pdev, IORESOURCE_MEM, 0); if (!r) { @@ -254,6 +256,7 @@ static int highbank_mc_probe(struct platform_device *pdev) edac_mc_del_mc(&pdev->dev); err: devres_release_group(&pdev->dev, NULL); +free: edac_mc_free(mci); return res; } -- 2.25.1

2 1

[PATCH OLK-5.10] uprobes: Reject the shared zeropage in uprobe_write_opcode()
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Tong Tiangen <tongtiangen(a)huawei.com> mainline inclusion from mainline-v6.14-rc5 commit bddf10d26e6e5114e7415a0e442ec6f51a559468 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVTY CVE: CVE-2025-21881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We triggered the following crash in syzkaller tests: BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3 flags: 0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff) raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_unref_page_prepare+0x401/0x500 free_unref_page+0x6d/0x1b0 uprobe_write_opcode+0x460/0x8e0 install_breakpoint.part.0+0x51/0x80 register_for_each_vma+0x1d9/0x2b0 __uprobe_register+0x245/0x300 bpf_uprobe_multi_link_attach+0x29b/0x4f0 link_create+0x1e2/0x280 __sys_bpf+0x75f/0xac0 __x64_sys_bpf+0x1a/0x30 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2 BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1 The following syzkaller test case can be used to reproduce: r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000120000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40) The cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage() and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and old_folio's refcount. Therefore, two bugs are introduced: 1. The RSS count is incorrect, when process exit, the check_mm() report error "Bad rss-count". 2. The reserved folio (zero folio) is freed when folio->refcount is zero, then free_pages_prepare->free_page_is_bad() report error "Bad page state". There is more, the following warning could also theoretically be triggered: __replace_page() -> ... -> folio_remove_rmap_pte() -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio) Considering that uprobe hit on the zero folio is a very rare case, just reject zero old folio immediately after get_user_page_vma_remote(). [ mingo: Cleaned up the changelog ] Fixes: 7396fa818d62 ("uprobes/core: Make background page replacement logic account for rss_stat counters") Fixes: 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Oleg Nesterov <oleg(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Link: https://lore.kernel.org/r/20250224031149.1598949-1-tongtiangen@huawei.com Conflict: kernel/events/uprobes.c [c8070b787519 ('mm: Don't pin ZERO_PAGE in pin_user_pages()') is not merged, use is_zero_pfn instead of is_zero_page.] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/events/uprobes.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index e045b12662f1..8a6c5ee003c2 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -488,6 +488,11 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm, if (ret <= 0) goto put_old; + if (is_zero_pfn(page_to_pfn(old_page))) { + ret = -EINVAL; + goto put_old; + } + if (WARN(!is_register && PageCompound(old_page), "uprobe unregister should never work on compound page\n")) { ret = -EINVAL; -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] Fix kmemleak false positive
by Lin Yujun 02 Apr '25

02 Apr '25

Waiman Long (1): efi/arm64: Fix kmemleak false positive in arm64_efi_rt_init() arch/arm64/kernel/efi.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] Fix kmemleak false positive
by Lin Yujun 02 Apr '25

02 Apr '25

Waiman Long (1): efi/arm64: Fix kmemleak false positive in arm64_efi_rt_init() arch/arm64/kernel/efi.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10] powerpc: Fix save r13 on kprobe/ftrace entry
by Chen Zhongjin 02 Apr '25

02 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY4FQ -------------------------------- In kprobe and ftrace entry, r13 will be saved to stack and restored after handler. There is a period between entry and handler where the task can be scheduled, then the r13 for one cpu will be restored to another cpu, and cause the paca_ptrs wrong. Fix this by stop saving and restoring r13 in kprobe/ftrace entry. Fixes: 51c9c0843993 ("powerpc/kprobes: Implement Optprobes") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- arch/powerpc/kernel/optprobes_head.S | 10 ++++++---- arch/powerpc/kernel/trace/ftrace_64_mprofile.S | 10 ++++++---- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/arch/powerpc/kernel/optprobes_head.S b/arch/powerpc/kernel/optprobes_head.S index ff8ba4d3824d..9d803cc2392f 100644 --- a/arch/powerpc/kernel/optprobes_head.S +++ b/arch/powerpc/kernel/optprobes_head.S @@ -36,8 +36,9 @@ optprobe_template_entry: addi r0,r1,INT_FRAME_SIZE std r0,GPR1(r1) SAVE_10GPRS(2,r1) - SAVE_10GPRS(12,r1) - SAVE_10GPRS(22,r1) + SAVE_GPR(12,r1) + SAVE_10GPRS(14,r1) + SAVE_8GPRS(24,r1) /* Save SPRS */ mfmsr r5 std r5,_MSR(r1) @@ -119,8 +120,9 @@ optprobe_template_call_emulate: mtcr r5 REST_GPR(0,r1) REST_10GPRS(2,r1) - REST_10GPRS(12,r1) - REST_10GPRS(22,r1) + REST_GPR(12,r1) + REST_10GPRS(14,r1) + REST_8GPRS(24,r1) /* Restore the previous SP */ addi r1,r1,INT_FRAME_SIZE diff --git a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S index 0bc39ff53233..32e354d9ee9b 100644 --- a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S +++ b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S @@ -51,8 +51,9 @@ _GLOBAL(ftrace_regs_caller) cmpdi r3, 0 beq ftrace_no_trace - SAVE_10GPRS(12, r1) - SAVE_10GPRS(22, r1) + SAVE_GPR(12,r1) + SAVE_10GPRS(14,r1) + SAVE_8GPRS(24,r1) /* Save previous stack pointer (r1) */ addi r8, r1, SWITCH_FRAME_SIZE+STACK_FRAME_MIN_SIZE @@ -115,8 +116,9 @@ ftrace_regs_call: /* Restore gprs */ REST_GPR(0,r1) REST_10GPRS(2,r1) - REST_10GPRS(12,r1) - REST_10GPRS(22,r1) + REST_GPR(12,r1) + REST_10GPRS(14,r1) + REST_8GPRS(24,r1) /* Restore possibly modified LR */ ld r0, _LINK(r1) -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1537/1537] kernel/seccomp.o: warning: objtool: do_seccomp()+0xa8a: unreachable instruction
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7951fd324625a8af5097e1476cdc8c33c6009b48 commit: e5d58f5ee731b2ff4e5c801cb875c804c63593e4 [1537/1537] seccomp: Invalidate seccomp mode to catch death failures config: x86_64-buildonly-randconfig-004-20250331 (https://download.01.org/0day-ci/archive/20250402/202504021615.GKzmsAcB-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021615.GKzmsAcB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021615.GKzmsAcB-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/seccomp.c:190: warning: Function parameter or member 'ret' not described in 'ACTION_ONLY' kernel/seccomp.c:190: warning: Excess function parameter 'sd' description in 'ACTION_ONLY' kernel/seccomp.c:190: warning: Excess function parameter 'match' description in 'ACTION_ONLY' kernel/seccomp.c:320: warning: Function parameter or member 'flags' not described in 'seccomp_sync_threads' >> kernel/seccomp.o: warning: objtool: do_seccomp()+0xa8a: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.15-rc1 commit 2c118f50d7fd4d9aefc4533a26f83338b2906b7a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYAPJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit: 2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again") was intended to ensure alignment of the stack pointer; but it also moved the initialization of the "stack" variable down into the loop header. This was likely intended as a no-op cleanup, since the commit message does not mention it; however, this caused a behavioral change because the value of "regs" is different between the two places. Originally, get_stack_pointer() used the regs provided by the caller; after that commit, get_stack_pointer() instead uses the regs at the top of the stack frame the unwinder is looking at. Often, there are no such regs at all, and "regs" is NULL, causing get_stack_pointer() to fall back to the task's current stack pointer, which is not what we want here, but probably happens to mostly work. Other times, the original regs will point to another regs frame - in that case, the linear guess unwind logic in show_trace_log_lvl() will start unwinding too far up the stack, causing the first frame found by the proper unwinder to never be visited, resulting in a stack trace consisting purely of guess lines. Fix it by moving the "stack = " assignment back where it belongs. Fixes: 2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20250325-2025-03-unwind-fixes-v1-2-acd774364768@g… Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- arch/x86/kernel/dumpstack.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c index f18ca44c904b..52dc5839d1e8 100644 --- a/arch/x86/kernel/dumpstack.c +++ b/arch/x86/kernel/dumpstack.c @@ -195,6 +195,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, printk("%sCall Trace:\n", log_lvl); unwind_start(&state, task, regs, stack); + stack = stack ?: get_stack_pointer(task, regs); regs = unwind_get_entry_regs(&state, &partial); /* @@ -213,9 +214,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, * - hardirq stack * - entry stack */ - for (stack = stack ?: get_stack_pointer(task, regs); - stack; - stack = stack_info.next_sp) { + for (; stack; stack = stack_info.next_sp) { const char *stack_name; stack = PTR_ALIGN(stack, sizeof(long)); -- 2.25.1

2 1

[PATCH v3 OLK-6.6 0/6] Support the FEAT_HDBSS introduced in Armv9.5
by Zhenyu Ye 02 Apr '25

02 Apr '25

From: eillon <yezhenyu2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB103D CVE: NA ---------------------------------------------------------------------- This series of patches add support to the Hardware Dirty state tracking Structure(HDBSS) feature, which is introduced by the ARM architecture in the DDI0601(ID121123) version. The HDBSS feature is an extension to the architecture that enhances tracking translation table descriptors' dirty state, identified as FEAT_HDBSS. The goal of this feature is to reduce the cost of surveying for dirtied granules, with minimal effect on recording when a granule has been dirtied. The purpose of this feature is to make the execution overhead of live migration lower to both the guest and the host, compared to existing approaches (write-protect or search stage 2 tables). After these patches, users(such as qemu) can use the KVM_CAP_ARM_HW_DIRTY_STATE_TRACK ioctl to enable or disable the HDBSS feature before and after the live migration. Changes in v3: - fix kabi broken Changes in v2: - adapt the commit format See patches for details, Thanks. eillon (5): arm64/sysreg: add HDBSS related register information arm64/kvm: support set the DBM attr during memory abort arm64/kvm: using ioctl to enable/disable the HDBSS feature arm64/kvm: support to handle the HDBSSF event arm64/config: add config to control whether enable HDBSS feature arch/arm64/Kconfig | 12 ++++ arch/arm64/configs/openeuler_defconfig | 6 ++ arch/arm64/include/asm/cpufeature.h | 14 ++++ arch/arm64/include/asm/esr.h | 2 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 8 +++ arch/arm64/include/asm/kvm_mmu.h | 14 ++++ arch/arm64/include/asm/kvm_pgtable.h | 1 + arch/arm64/include/asm/sysreg.h | 14 ++++ arch/arm64/kvm/arm.c | 88 ++++++++++++++++++++++++++ arch/arm64/kvm/handle_exit.c | 50 +++++++++++++++ arch/arm64/kvm/hyp/pgtable.c | 12 ++++ arch/arm64/kvm/hyp/vhe/switch.c | 3 + arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 4 ++ arch/arm64/kvm/mmu.c | 17 ++++- arch/arm64/kvm/reset.c | 9 +++ arch/arm64/tools/sysreg | 28 ++++++++ include/linux/kvm_host.h | 3 + include/uapi/linux/kvm.h | 2 + tools/include/uapi/linux/kvm.h | 2 + 20 files changed, 289 insertions(+), 1 deletion(-) -- 2.39.3

2 7

[PATCH OLK-5.10] x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.15-rc1 commit 2c118f50d7fd4d9aefc4533a26f83338b2906b7a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYAPJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit: 2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again") was intended to ensure alignment of the stack pointer; but it also moved the initialization of the "stack" variable down into the loop header. This was likely intended as a no-op cleanup, since the commit message does not mention it; however, this caused a behavioral change because the value of "regs" is different between the two places. Originally, get_stack_pointer() used the regs provided by the caller; after that commit, get_stack_pointer() instead uses the regs at the top of the stack frame the unwinder is looking at. Often, there are no such regs at all, and "regs" is NULL, causing get_stack_pointer() to fall back to the task's current stack pointer, which is not what we want here, but probably happens to mostly work. Other times, the original regs will point to another regs frame - in that case, the linear guess unwind logic in show_trace_log_lvl() will start unwinding too far up the stack, causing the first frame found by the proper unwinder to never be visited, resulting in a stack trace consisting purely of guess lines. Fix it by moving the "stack = " assignment back where it belongs. Fixes: 2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20250325-2025-03-unwind-fixes-v1-2-acd774364768@g… Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- arch/x86/kernel/dumpstack.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c index b726174024da..d9cbcdbdf1e0 100644 --- a/arch/x86/kernel/dumpstack.c +++ b/arch/x86/kernel/dumpstack.c @@ -195,6 +195,7 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, printk("%sCall Trace:\n", log_lvl); unwind_start(&state, task, regs, stack); + stack = stack ?: get_stack_pointer(task, regs); regs = unwind_get_entry_regs(&state, &partial); /* @@ -213,9 +214,7 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, * - hardirq stack * - entry stack */ - for (stack = stack ?: get_stack_pointer(task, regs); - stack; - stack = stack_info.next_sp) { + for (; stack; stack = stack_info.next_sp) { const char *stack_name; stack = PTR_ALIGN(stack, sizeof(long)); -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] Sync two patches to olk
by Chen Zhongjin 02 Apr '25

02 Apr '25

See: https://gitee.com/openeuler/kernel/issues/IBY4FJ https://gitee.com/openeuler/kernel/issues/IBY4FQ Chen Zhongjin (2): kprobes: Fix deadlock when unwinding kretprobe_trampoline powerpc: Fix save r13 on kprobe/ftrace entry arch/powerpc/kernel/optprobes_head.S | 10 ++++++---- arch/powerpc/kernel/trace/ftrace_64_mprofile.S | 10 ++++++---- kernel/kprobes.c | 9 +++++++-- 3 files changed, 19 insertions(+), 10 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS V1 0/2] fix-CVE-2022-49538
by Cheng Yu 02 Apr '25

02 Apr '25

fix-CVE-2022-49538 Amadeusz Sławiński (1): ALSA: jack: Access input_dev under mutex Takashi Iwai (1): ALSA: jack: Fix mutex call in snd_jack_report() include/sound/jack.h | 1 + sound/core/jack.c | 39 +++++++++++++++++++++++++++++---------- 2 files changed, 30 insertions(+), 10 deletions(-) -- 2.25.1

2 3

[openeuler:OLK-5.10 2830/2830] fs/ext4/file.o: warning: objtool: ext4_file_write_iter()+0x893: unreachable instruction
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 1a6f72935307d39713f310345f6049fcc3058091 commit: 52c6fec939dd6f0de6d534d8b08ac06be8cfe5c4 [2830/2830] ext4: properly sync file size update after O_SYNC direct IO config: x86_64-buildonly-randconfig-004-20250331 (https://download.01.org/0day-ci/archive/20250402/202504021552.RjBa0DvI-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021552.RjBa0DvI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021552.RjBa0DvI-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/ext4/file.o: warning: objtool: ext4_file_write_iter()+0x893: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] perf/core: Fix pmus_lock vs. pmus_srcu ordering
by Luo Gengkun 02 Apr '25

02 Apr '25

From: Peter Zijlstra <peterz(a)infradead.org> stable inclusion from stable-v6.6.83 commit 7c823e4c30d6fdc16089e13924260086eaea76be category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBXQNU Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2565e42539b120b81a68a58da961ce5d1e34eac8 ] Commit a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") placed pmus_lock inside pmus_srcu, this makes perf_pmu_unregister() trip lockdep. Move the locking about such that only pmu_idr and pmus (list) are modified while holding pmus_lock. This avoids doing synchronize_srcu() while holding pmus_lock and all is well again. Fixes: a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20241104135517.679556858@infradead.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 0b9e703641d1..9b5d35c4a3ec 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -11670,6 +11670,8 @@ void perf_pmu_unregister(struct pmu *pmu) { mutex_lock(&pmus_lock); list_del_rcu(&pmu->entry); + idr_remove(&pmu_idr, pmu->type); + mutex_unlock(&pmus_lock); /* * We dereference the pmu list under both SRCU and regular RCU, so @@ -11679,7 +11681,6 @@ void perf_pmu_unregister(struct pmu *pmu) synchronize_rcu(); free_percpu(pmu->pmu_disable_count); - idr_remove(&pmu_idr, pmu->type); if (pmu_bus_running && pmu->dev && pmu->dev != PMU_NULL_DEV) { if (pmu->nr_addr_filters) device_remove_file(pmu->dev, &dev_attr_nr_addr_filters); @@ -11687,7 +11688,6 @@ void perf_pmu_unregister(struct pmu *pmu) put_device(pmu->dev); } free_pmu_context(pmu); - mutex_unlock(&pmus_lock); } EXPORT_SYMBOL_GPL(perf_pmu_unregister); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-21963 && CVE-2025-21964
by Li Lingfeng 02 Apr '25

02 Apr '25

CVE-2025-21963 && CVE-2025-21964 Murad Masimov (2): cifs: Fix integer overflow while processing acregmax mount option cifs: Fix integer overflow while processing acdirmax mount option fs/smb/client/fs_context.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- 2.31.1

2 3

[PATCH OLK-6.6] tracing: Fix bad hist from corrupting named_triggers list
by Tengda Wu 02 Apr '25

02 Apr '25

From: Steven Rostedt <rostedt(a)goodmis.org> stable inclusion from stable-v6.6.81 commit 43b254d46c740bf9dbe65709afa021dd726dfa99 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY44G CVE: CVE-2025-21899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e upstream. The following commands causes a crash: ~# cd /sys/kernel/tracing/events/rcu/rcu_callback ~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=bad:keys=common_pid' > trigger Because the following occurs: event_trigger_write() { trigger_process_regex() { event_hist_trigger_parse() { data = event_trigger_alloc(..); event_trigger_register(.., data) { cmd_ops->reg(.., data, ..) [hist_register_trigger()] { data->ops->init() [event_hist_trigger_init()] { save_named_trigger(name, data) { list_add(&data->named_list, &named_triggers); } } } } ret = create_actions(); (return -EINVAL) if (ret) goto out_unreg; [..] ret = hist_trigger_enable(data, ...) { list_add_tail_rcu(&data->list, &file->triggers); <<<---- SKIPPED!!! (this is important!) [..] out_unreg: event_hist_unregister(.., data) { cmd_ops->unreg(.., data, ..) [hist_unregister_trigger()] { list_for_each_entry(iter, &file->triggers, list) { if (!hist_trigger_match(data, iter, named_data, false)) <- never matches continue; [..] test = iter; } if (test && test->ops->free) <<<-- test is NULL test->ops->free(test) [event_hist_trigger_free()] { [..] if (data->name) del_named_trigger(data) { list_del(&data->named_list); <<<<-- NEVER gets removed! } } } } [..] kfree(data); <<<-- frees item but it is still on list The next time a hist with name is registered, it causes an u-a-f bug and the kernel can crash. Move the code around such that if event_trigger_register() succeeds, the next thing called is hist_trigger_enable() which adds it to the list. A bunch of actions is called if get_named_trigger_data() returns false. But that doesn't need to be called after event_trigger_register(), so it can be moved up, allowing event_trigger_register() to be called just before hist_trigger_enable() keeping them together and allowing the file->triggers to be properly populated. Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20250227163944.1c37f85f@gandalf.local.home Fixes: 067fe038e70f6 ("tracing: Add variable reference handling to hist triggers") Reported-by: Tomas Glozar <tglozar(a)redhat.com> Tested-by: Tomas Glozar <tglozar(a)redhat.com> Reviewed-by: Tom Zanussi <zanussi(a)kernel.org> Closes: https://lore.kernel.org/all/CAP4=nvTsxjckSBTz=Oe_UYh8keD9_sZC4i++4h72mJLic4… Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events_hist.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index dd16faf0d150..604d63380a90 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -6660,27 +6660,27 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops, if (existing_hist_update_only(glob, trigger_data, file)) goto out_free; - ret = event_trigger_register(cmd_ops, file, glob, trigger_data); - if (ret < 0) - goto out_free; + if (!get_named_trigger_data(trigger_data)) { - if (get_named_trigger_data(trigger_data)) - goto enable; + ret = create_actions(hist_data); + if (ret) + goto out_free; - ret = create_actions(hist_data); - if (ret) - goto out_unreg; + if (has_hist_vars(hist_data) || hist_data->n_var_refs) { + ret = save_hist_vars(hist_data); + if (ret) + goto out_free; + } - if (has_hist_vars(hist_data) || hist_data->n_var_refs) { - ret = save_hist_vars(hist_data); + ret = tracing_map_init(hist_data->map); if (ret) - goto out_unreg; + goto out_free; } - ret = tracing_map_init(hist_data->map); - if (ret) - goto out_unreg; -enable: + ret = event_trigger_register(cmd_ops, file, glob, trigger_data); + if (ret < 0) + goto out_free; + ret = hist_trigger_enable(trigger_data, file); if (ret) goto out_unreg; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
by Pu Lehui 02 Apr '25

02 Apr '25

From: Luis Gerhorst <gerhorst(a)cs.fau.de> stable inclusion from stable-v4.19.272 commit aae109414a57ab4164218f36e2e4a17f027fcaaa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVYS CVE: CVE-2023-53024 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e4f4db47794c9f474b184ee1418f42e6a07412b6 ] To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") inserts lfence instructions after 1) initializing a stack slot and 2) spilling a pointer to the stack. However, this does not cover cases where a stack slot is first initialized with a pointer (subject to sanitization) but then overwritten with a scalar (not subject to sanitization because the slot was already initialized). In this case, the second write may be subject to speculative store bypass (SSB) creating a speculative pointer-as-scalar type confusion. This allows the program to subsequently leak the numerical pointer value using, for example, a branch-based cache side channel. To fix this, also sanitize scalars if they write a stack slot that previously contained a pointer. Assuming that pointer-spills are only generated by LLVM on register-pressure, the performance impact on most real-world BPF programs should be small. The following unprivileged BPF bytecode drafts a minimal exploit and the mitigation: [...] // r6 = 0 or 1 (skalar, unknown user input) // r7 = accessible ptr for side channel // r10 = frame pointer (fp), to be leaked // r9 = r10 # fp alias to encourage ssb *(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked // lfence added here because of pointer spill to stack. // // Ommitted: Dummy bpf_ringbuf_output() here to train alias predictor // for no r9-r10 dependency. // *(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr // 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID, // store may be subject to SSB // // fix: also add an lfence when the slot contained a ptr // r8 = *(u64 *)(r9 - 8) // r8 = architecturally a scalar, speculatively a ptr // // leak ptr using branch-based cache side channel: r8 &= 1 // choose bit to leak if r8 == 0 goto SLOW // no mispredict // architecturally dead code if input r6 is 0, // only executes speculatively iff ptr bit is 1 r8 = *(u64 *)(r7 + 0) # encode bit in cache (0: slow, 1: fast) SLOW: [...] After running this, the program can time the access to *(r7 + 0) to determine whether the chosen pointer bit was 0 or 1. Repeat this 64 times to recover the whole address on amd64. In summary, sanitization can only be skipped if one scalar is overwritten with another scalar. Scalar-confusion due to speculative store bypass can not lead to invalid accesses because the pointer bounds deducted during verification are enforced using branchless logic. See 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic") for details. Do not make the mitigation depend on !env->allow_{uninit_stack,ptr_leaks} because speculative leaks are likely unexpected if these were enabled. For example, leaking the address to a protected log file may be acceptable while disabling the mitigation might unintentionally leak the address into the cached-state of a map that is accessible to unprivileged processes. Fixes: 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") Signed-off-by: Luis Gerhorst <gerhorst(a)cs.fau.de> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Henriette Hofmeier <henriette.hofmeier(a)rub.de> Link: https://lore.kernel.org/bpf/edc95bad-aada-9cfc-ffe2-fa9bb206583c@cs.fau.de Link: https://lore.kernel.org/bpf/20230109150544.41465-1-gerhorst@cs.fau.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index c3c592654cf1..e00cb52fb480 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -1013,7 +1013,9 @@ static int check_stack_write(struct bpf_verifier_env *env, bool sanitize = reg && is_spillable_regtype(reg->type); for (i = 0; i < size; i++) { - if (state->stack[spi].slot_type[i] == STACK_INVALID) { + u8 type = state->stack[spi].slot_type[i]; + + if (type != STACK_MISC && type != STACK_ZERO) { sanitize = true; break; } -- 2.34.1

2 1

[PATCH OLK-6.6] HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
by Pu Lehui 02 Apr '25

02 Apr '25

From: Zhang Lixu <lixu.zhang(a)intel.com> stable inclusion from stable-v6.6.83 commit 560f4d1299342504a6ab8a47f575b5e6b8345ada category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY43Y CVE: CVE-2025-21928 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 07583a0010696a17fb0942e0b499a62785c5fc9f ] The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory. This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed. Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver") Signed-off-by: Zhang Lixu <lixu.zhang(a)intel.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/hid/intel-ish-hid/ishtp-hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.c b/drivers/hid/intel-ish-hid/ishtp-hid.c index 00c6f0ebf356..be2c62fc8251 100644 --- a/drivers/hid/intel-ish-hid/ishtp-hid.c +++ b/drivers/hid/intel-ish-hid/ishtp-hid.c @@ -261,12 +261,14 @@ int ishtp_hid_probe(unsigned int cur_hid_dev, */ void ishtp_hid_remove(struct ishtp_cl_data *client_data) { + void *data; int i; for (i = 0; i < client_data->num_hid_devices; ++i) { if (client_data->hid_sensor_hubs[i]) { - kfree(client_data->hid_sensor_hubs[i]->driver_data); + data = client_data->hid_sensor_hubs[i]->driver_data; hid_destroy_device(client_data->hid_sensor_hubs[i]); + kfree(data); client_data->hid_sensor_hubs[i] = NULL; } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] ALSA: jack: Access input_dev under mutex
by Cheng Yu 02 Apr '25

02 Apr '25

From: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> stable inclusion from stable-v4.19.247 commit c093b62c40027c21d649c5534ad7aa3605a99b00 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3KT CVE: CVE-2022-49538 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1b6a6fc5280e97559287b61eade2d4b363e836f2 ] It is possible when using ASoC that input_dev is unregistered while calling snd_jack_report, which causes NULL pointer dereference. In order to prevent this serialize access to input_dev using mutex lock. Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> Reviewed-by: Cezary Rojewski <cezary.rojewski(a)intel.com> Link: https://lore.kernel.org/r/20220412091628.3056922-1-amadeuszx.slawinski@linu… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: sound/core/jack.c [Context conflicts.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- include/sound/jack.h | 1 + sound/core/jack.c | 34 +++++++++++++++++++++++++++------- 2 files changed, 28 insertions(+), 7 deletions(-) diff --git a/include/sound/jack.h b/include/sound/jack.h index 1e84bfb553cf..4742f842b457 100644 --- a/include/sound/jack.h +++ b/include/sound/jack.h @@ -77,6 +77,7 @@ struct snd_jack { const char *id; #ifdef CONFIG_SND_JACK_INPUT_DEV struct input_dev *input_dev; + struct mutex input_dev_lock; int registered; int type; char name[100]; diff --git a/sound/core/jack.c b/sound/core/jack.c index 84c2a17c56ee..2f43fe667759 100644 --- a/sound/core/jack.c +++ b/sound/core/jack.c @@ -48,8 +48,11 @@ static int snd_jack_dev_disconnect(struct snd_device *device) #ifdef CONFIG_SND_JACK_INPUT_DEV struct snd_jack *jack = device->device_data; - if (!jack->input_dev) + mutex_lock(&jack->input_dev_lock); + if (!jack->input_dev) { + mutex_unlock(&jack->input_dev_lock); return 0; + } /* If the input device is registered with the input subsystem * then we need to use a different deallocator. */ @@ -58,6 +61,7 @@ static int snd_jack_dev_disconnect(struct snd_device *device) else input_free_device(jack->input_dev); jack->input_dev = NULL; + mutex_unlock(&jack->input_dev_lock); #endif /* CONFIG_SND_JACK_INPUT_DEV */ return 0; } @@ -93,8 +97,11 @@ static int snd_jack_dev_register(struct snd_device *device) snprintf(jack->name, sizeof(jack->name), "%s %s", card->shortname, jack->id); - if (!jack->input_dev) + mutex_lock(&jack->input_dev_lock); + if (!jack->input_dev) { + mutex_unlock(&jack->input_dev_lock); return 0; + } jack->input_dev->name = jack->name; @@ -119,6 +126,7 @@ static int snd_jack_dev_register(struct snd_device *device) if (err == 0) jack->registered = 1; + mutex_unlock(&jack->input_dev_lock); return err; } #endif /* CONFIG_SND_JACK_INPUT_DEV */ @@ -235,9 +243,11 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, jack->id = kstrdup(id, GFP_KERNEL); - /* don't creat input device for phantom jack */ - if (!phantom_jack) { #ifdef CONFIG_SND_JACK_INPUT_DEV + mutex_init(&jack->input_dev_lock); + + /* don't create input device for phantom jack */ + if (!phantom_jack) { int i; jack->input_dev = input_allocate_device(); @@ -255,8 +265,8 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, input_set_capability(jack->input_dev, EV_SW, jack_switch_types[i]); -#endif /* CONFIG_SND_JACK_INPUT_DEV */ } +#endif /* CONFIG_SND_JACK_INPUT_DEV */ err = snd_device_new(card, SNDRV_DEV_JACK, jack, &ops); if (err < 0) @@ -296,10 +306,14 @@ EXPORT_SYMBOL(snd_jack_new); void snd_jack_set_parent(struct snd_jack *jack, struct device *parent) { WARN_ON(jack->registered); - if (!jack->input_dev) + mutex_lock(&jack->input_dev_lock); + if (!jack->input_dev) { + mutex_unlock(&jack->input_dev_lock); return; + } jack->input_dev->dev.parent = parent; + mutex_unlock(&jack->input_dev_lock); } EXPORT_SYMBOL(snd_jack_set_parent); @@ -347,6 +361,8 @@ EXPORT_SYMBOL(snd_jack_set_key); /** * snd_jack_report - Report the current status of a jack + * Note: This function uses mutexes and should be called from a + * context which can sleep (such as a workqueue). * * @jack: The jack to report status for * @status: The current status of the jack @@ -366,8 +382,11 @@ void snd_jack_report(struct snd_jack *jack, int status) status & jack_kctl->mask_bits); #ifdef CONFIG_SND_JACK_INPUT_DEV - if (!jack->input_dev) + mutex_lock(&jack->input_dev_lock); + if (!jack->input_dev) { + mutex_unlock(&jack->input_dev_lock); return; + } for (i = 0; i < ARRAY_SIZE(jack->key); i++) { int testbit = SND_JACK_BTN_0 >> i; @@ -386,6 +405,7 @@ void snd_jack_report(struct snd_jack *jack, int status) } input_sync(jack->input_dev); + mutex_unlock(&jack->input_dev_lock); #endif /* CONFIG_SND_JACK_INPUT_DEV */ } EXPORT_SYMBOL(snd_jack_report); -- 2.25.1

2 1

[PATCH OLK-6.6] uprobes: Reject the shared zeropage in uprobe_write_opcode()
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Tong Tiangen <tongtiangen(a)huawei.com> stable inclusion from stable-v6.6.81 commit 0b6f19714588cf2366b0364234f97ba963688f63 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVTY CVE: CVE-2025-21881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit bddf10d26e6e5114e7415a0e442ec6f51a559468 ] We triggered the following crash in syzkaller tests: BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3 flags: 0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff) raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_unref_page_prepare+0x401/0x500 free_unref_page+0x6d/0x1b0 uprobe_write_opcode+0x460/0x8e0 install_breakpoint.part.0+0x51/0x80 register_for_each_vma+0x1d9/0x2b0 __uprobe_register+0x245/0x300 bpf_uprobe_multi_link_attach+0x29b/0x4f0 link_create+0x1e2/0x280 __sys_bpf+0x75f/0xac0 __x64_sys_bpf+0x1a/0x30 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2 BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1 The following syzkaller test case can be used to reproduce: r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000120000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40) The cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage() and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and old_folio's refcount. Therefore, two bugs are introduced: 1. The RSS count is incorrect, when process exit, the check_mm() report error "Bad rss-count". 2. The reserved folio (zero folio) is freed when folio->refcount is zero, then free_pages_prepare->free_page_is_bad() report error "Bad page state". There is more, the following warning could also theoretically be triggered: __replace_page() -> ... -> folio_remove_rmap_pte() -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio) Considering that uprobe hit on the zero folio is a very rare case, just reject zero old folio immediately after get_user_page_vma_remote(). [ mingo: Cleaned up the changelog ] Fixes: 7396fa818d62 ("uprobes/core: Make background page replacement logic account for rss_stat counters") Fixes: 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Oleg Nesterov <oleg(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Link: https://lore.kernel.org/r/20250224031149.1598949-1-tongtiangen@huawei.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/events/uprobes.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index a14b0059f177..c135c9704deb 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -483,6 +483,11 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm, if (ret <= 0) goto put_old; + if (is_zero_page(old_page)) { + ret = -EINVAL; + goto put_old; + } + if (WARN(!is_register && PageCompound(old_page), "uprobe unregister should never work on compound page\n")) { ret = -EINVAL; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS V1] ALSA: jack: Fix mutex call in snd_jack_report()
by Cheng Yu 02 Apr '25

02 Apr '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v4.19.291 commit 839f4e860eb6aff659ad05900963cf0410063eda category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3KT CVE: CVE-2022-49538 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 89dbb335cb6a627a4067bc42caa09c8bc3326d40 ] snd_jack_report() is supposed to be callable from an IRQ context, too, and it's indeed used in that way from virtsnd driver. The fix for input_dev race in commit 1b6a6fc5280e ("ALSA: jack: Access input_dev under mutex"), however, introduced a mutex lock in snd_jack_report(), and this resulted in a potential sleep-in-atomic. For addressing that problem, this patch changes the relevant code to use the object get/put and removes the mutex usage. That is, snd_jack_report(), it takes input_get_device() and leaves with input_put_device() for assuring the input_dev being assigned. Although the whole mutex could be reduced, we keep it because it can be still a protection for potential races between creation and deletion. Fixes: 1b6a6fc5280e ("ALSA: jack: Access input_dev under mutex") Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/cf95f7fe-a748-4990-8378-000491b40329@moroto.mount… Tested-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20230706155357.3470-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- sound/core/jack.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/sound/core/jack.c b/sound/core/jack.c index 2f43fe667759..0e26488d8db2 100644 --- a/sound/core/jack.c +++ b/sound/core/jack.c @@ -371,6 +371,7 @@ void snd_jack_report(struct snd_jack *jack, int status) { struct snd_jack_kctl *jack_kctl; #ifdef CONFIG_SND_JACK_INPUT_DEV + struct input_dev *idev; int i; #endif @@ -382,30 +383,28 @@ void snd_jack_report(struct snd_jack *jack, int status) status & jack_kctl->mask_bits); #ifdef CONFIG_SND_JACK_INPUT_DEV - mutex_lock(&jack->input_dev_lock); - if (!jack->input_dev) { - mutex_unlock(&jack->input_dev_lock); + idev = input_get_device(jack->input_dev); + if (!idev) return; - } for (i = 0; i < ARRAY_SIZE(jack->key); i++) { int testbit = SND_JACK_BTN_0 >> i; if (jack->type & testbit) - input_report_key(jack->input_dev, jack->key[i], + input_report_key(idev, jack->key[i], status & testbit); } for (i = 0; i < ARRAY_SIZE(jack_switch_types); i++) { int testbit = 1 << i; if (jack->type & testbit) - input_report_switch(jack->input_dev, + input_report_switch(idev, jack_switch_types[i], status & testbit); } - input_sync(jack->input_dev); - mutex_unlock(&jack->input_dev_lock); + input_sync(idev); + input_put_device(idev); #endif /* CONFIG_SND_JACK_INPUT_DEV */ } EXPORT_SYMBOL(snd_jack_report); -- 2.25.1

2 1

[PATCH OLK-5.10] uprobes: Reject the shared zeropage in uprobe_write_opcode()
by Chen Zhongjin 02 Apr '25

02 Apr '25

From: Tong Tiangen <tongtiangen(a)huawei.com> mainline inclusion from mainline-v6.14-rc5 commit bddf10d26e6e5114e7415a0e442ec6f51a559468 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVTY CVE: CVE-2025-21881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We triggered the following crash in syzkaller tests: BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3 flags: 0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff) raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_unref_page_prepare+0x401/0x500 free_unref_page+0x6d/0x1b0 uprobe_write_opcode+0x460/0x8e0 install_breakpoint.part.0+0x51/0x80 register_for_each_vma+0x1d9/0x2b0 __uprobe_register+0x245/0x300 bpf_uprobe_multi_link_attach+0x29b/0x4f0 link_create+0x1e2/0x280 __sys_bpf+0x75f/0xac0 __x64_sys_bpf+0x1a/0x30 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2 BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1 The following syzkaller test case can be used to reproduce: r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000120000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40) The cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage() and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and old_folio's refcount. Therefore, two bugs are introduced: 1. The RSS count is incorrect, when process exit, the check_mm() report error "Bad rss-count". 2. The reserved folio (zero folio) is freed when folio->refcount is zero, then free_pages_prepare->free_page_is_bad() report error "Bad page state". There is more, the following warning could also theoretically be triggered: __replace_page() -> ... -> folio_remove_rmap_pte() -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio) Considering that uprobe hit on the zero folio is a very rare case, just reject zero old folio immediately after get_user_page_vma_remote(). [ mingo: Cleaned up the changelog ] Fixes: 7396fa818d62 ("uprobes/core: Make background page replacement logic account for rss_stat counters") Fixes: 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Oleg Nesterov <oleg(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Link: https://lore.kernel.org/r/20250224031149.1598949-1-tongtiangen@huawei.com Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/events/uprobes.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index e045b12662f1..424b24dd029e 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -488,6 +488,11 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm, if (ret <= 0) goto put_old; + if (is_zero_page(old_page)) { + ret = -EINVAL; + goto put_old; + } + if (WARN(!is_register && PageCompound(old_page), "uprobe unregister should never work on compound page\n")) { ret = -EINVAL; -- 2.25.1

2 1

[PATCH v2 OLK-6.6 0/5] Support the FEAT_HDBSS introduced in Armv9.5
by Zhenyu Ye 02 Apr '25

02 Apr '25

From: eillon <yezhenyu2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB103D CVE: NA ---------------------------------------------------------------------- This series of patches add support to the Hardware Dirty state tracking Structure(HDBSS) feature, which is introduced by the ARM architecture in the DDI0601(ID121123) version. The HDBSS feature is an extension to the architecture that enhances tracking translation table descriptors' dirty state, identified as FEAT_HDBSS. The goal of this feature is to reduce the cost of surveying for dirtied granules, with minimal effect on recording when a granule has been dirtied. The purpose of this feature is to make the execution overhead of live migration lower to both the guest and the host, compared to existing approaches (write-protect or search stage 2 tables). After these patches, users(such as qemu) can use the KVM_CAP_ARM_HW_DIRTY_STATE_TRACK ioctl to enable or disable the HDBSS feature before and after the live migration. Changes in v2: - adapt the commit format See patches for details, Thanks. eillon (5): arm64/sysreg: add HDBSS related register information arm64/kvm: support set the DBM attr during memory abort arm64/kvm: using ioctl to enable/disable the HDBSS feature arm64/kvm: support to handle the HDBSSF event arm64/config: add config to control whether enable HDBSS feature arch/arm64/Kconfig | 12 ++++ arch/arm64/configs/openeuler_defconfig | 6 ++ arch/arm64/include/asm/cpufeature.h | 14 ++++ arch/arm64/include/asm/esr.h | 2 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 8 +++ arch/arm64/include/asm/kvm_mmu.h | 14 ++++ arch/arm64/include/asm/kvm_pgtable.h | 1 + arch/arm64/include/asm/sysreg.h | 14 ++++ arch/arm64/kvm/arm.c | 88 ++++++++++++++++++++++++++ arch/arm64/kvm/handle_exit.c | 50 +++++++++++++++ arch/arm64/kvm/hyp/pgtable.c | 12 ++++ arch/arm64/kvm/hyp/vhe/switch.c | 3 + arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 4 ++ arch/arm64/kvm/mmu.c | 17 ++++- arch/arm64/kvm/reset.c | 9 +++ arch/arm64/tools/sysreg | 28 ++++++++ include/linux/kvm_host.h | 3 + include/uapi/linux/kvm.h | 2 + tools/include/uapi/linux/kvm.h | 2 + 20 files changed, 289 insertions(+), 1 deletion(-) -- 2.39.3

2 6

[PATCH openEuler-1.0-LTS] ftrace: Avoid potential division by zero in function_stat_show()
by Pu Lehui 02 Apr '25

02 Apr '25

From: Nikolay Kuratov <kniv(a)yandex-team.ru> mainline inclusion from mainline-v6.14-rc5 commit a1a7eb89ca0b89dc1c326eeee2596f263291aca3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY5DV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Check whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64} produce zero and skip stddev computation in that case. For now don't care about rec->counter * rec->counter overflow because rec->time * rec->time overflow will likely happen earlier. Cc: stable(a)vger.kernel.org Cc: Wen Yang <wenyang(a)linux.alibaba.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20250206090156.1561783-1-kniv@yandex-team.ru Fixes: e31f7939c1c27 ("ftrace: Avoid potential division by zero in function profiler") Signed-off-by: Nikolay Kuratov <kniv(a)yandex-team.ru> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/ftrace.c [The conflicts were due to some minor issue] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/ftrace.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 36de4ab34431..8199571d9ab3 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -544,6 +544,7 @@ static int function_stat_show(struct seq_file *m, void *v) static struct trace_seq s; unsigned long long avg; unsigned long long stddev; + unsigned long long stddev_denom; #endif mutex_lock(&ftrace_profile_lock); @@ -565,23 +566,19 @@ static int function_stat_show(struct seq_file *m, void *v) #ifdef CONFIG_FUNCTION_GRAPH_TRACER seq_puts(m, " "); - /* Sample standard deviation (s^2) */ - if (rec->counter <= 1) - stddev = 0; - else { - /* - * Apply Welford's method: - * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) - */ + /* + * Variance formula: + * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) + * Maybe Welford's method is better here? + * Divide only by 1000 for ns^2 -> us^2 conversion. + * trace_print_graph_duration will divide by 1000 again. + */ + stddev = 0; + stddev_denom = rec->counter * (rec->counter - 1) * 1000; + if (stddev_denom) { stddev = rec->counter * rec->time_squared - rec->time * rec->time; - - /* - * Divide only 1000 for ns^2 -> us^2 conversion. - * trace_print_graph_duration will divide 1000 again. - */ - stddev = div64_ul(stddev, - rec->counter * (rec->counter - 1) * 1000); + stddev = div64_ul(stddev, stddev_denom); } trace_seq_init(&s); -- 2.34.1

2 1

[PATCH OLK-6.6] ftrace: Avoid potential division by zero in function_stat_show()
by Pu Lehui 02 Apr '25

02 Apr '25

From: Nikolay Kuratov <kniv(a)yandex-team.ru> stable inclusion from stable-v6.6.81 commit f58a3f8e284d0bdf94164a8e61cd4e70d337a1a3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY5DV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a1a7eb89ca0b89dc1c326eeee2596f263291aca3 upstream. Check whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64} produce zero and skip stddev computation in that case. For now don't care about rec->counter * rec->counter overflow because rec->time * rec->time overflow will likely happen earlier. Cc: stable(a)vger.kernel.org Cc: Wen Yang <wenyang(a)linux.alibaba.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20250206090156.1561783-1-kniv@yandex-team.ru Fixes: e31f7939c1c27 ("ftrace: Avoid potential division by zero in function profiler") Signed-off-by: Nikolay Kuratov <kniv(a)yandex-team.ru> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/ftrace.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 1043936b352d..fe26b58e753f 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -538,6 +538,7 @@ static int function_stat_show(struct seq_file *m, void *v) static struct trace_seq s; unsigned long long avg; unsigned long long stddev; + unsigned long long stddev_denom; #endif mutex_lock(&ftrace_profile_lock); @@ -559,23 +560,19 @@ static int function_stat_show(struct seq_file *m, void *v) #ifdef CONFIG_FUNCTION_GRAPH_TRACER seq_puts(m, " "); - /* Sample standard deviation (s^2) */ - if (rec->counter <= 1) - stddev = 0; - else { - /* - * Apply Welford's method: - * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) - */ + /* + * Variance formula: + * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) + * Maybe Welford's method is better here? + * Divide only by 1000 for ns^2 -> us^2 conversion. + * trace_print_graph_duration will divide by 1000 again. + */ + stddev = 0; + stddev_denom = rec->counter * (rec->counter - 1) * 1000; + if (stddev_denom) { stddev = rec->counter * rec->time_squared - rec->time * rec->time; - - /* - * Divide only 1000 for ns^2 -> us^2 conversion. - * trace_print_graph_duration will divide 1000 again. - */ - stddev = div64_ul(stddev, - rec->counter * (rec->counter - 1) * 1000); + stddev = div64_ul(stddev, stddev_denom); } trace_seq_init(&s); -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Add tracepoints with null-able arguments
by Pu Lehui 02 Apr '25

02 Apr '25

From: Jiri Olsa <jolsa(a)kernel.org> mainline inclusion from mainline-v6.15-rc1 commit c83e2d970bae8616b94c40caa43d85f2f2c7d81e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY5DV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Some of the tracepoints slipped when we did the first scan, adding them now. Fixes: 838a10bd2ebf ("bpf: Augment raw_tp arguments with PTR_MAYBE_NULL") Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Link: https://lore.kernel.org/r/20250210175913.2893549-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/btf.c | 99 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 99 insertions(+) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index bbc99401b4e7..39fc33e6368f 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -5997,6 +5997,8 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = { /* rxrpc */ { "rxrpc_recvdata", 0x1 }, { "rxrpc_resend", 0x10 }, + { "rxrpc_tq", 0x10 }, + { "rxrpc_client", 0x1 }, /* sunrpc */ { "xs_stream_read_data", 0x1 }, /* ... from xprt_cong_event event class */ @@ -6017,6 +6019,103 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = { { "mr_integ_alloc", 0x2000 }, /* bpf_testmod */ { "bpf_testmod_test_read", 0x0 }, + /* amdgpu */ + { "amdgpu_vm_bo_map", 0x1 }, + { "amdgpu_vm_bo_unmap", 0x1 }, + /* netfs */ + { "netfs_folioq", 0x1 }, + /* xfs from xfs_defer_pending_class */ + { "xfs_defer_create_intent", 0x1 }, + { "xfs_defer_cancel_list", 0x1 }, + { "xfs_defer_pending_finish", 0x1 }, + { "xfs_defer_pending_abort", 0x1 }, + { "xfs_defer_relog_intent", 0x1 }, + { "xfs_defer_isolate_paused", 0x1 }, + { "xfs_defer_item_pause", 0x1 }, + { "xfs_defer_item_unpause", 0x1 }, + /* xfs from xfs_defer_pending_item_class */ + { "xfs_defer_add_item", 0x1 }, + { "xfs_defer_cancel_item", 0x1 }, + { "xfs_defer_finish_item", 0x1 }, + /* xfs from xfs_icwalk_class */ + { "xfs_ioc_free_eofblocks", 0x10 }, + { "xfs_blockgc_free_space", 0x10 }, + /* xfs from xfs_btree_cur_class */ + { "xfs_btree_updkeys", 0x100 }, + { "xfs_btree_overlapped_query_range", 0x100 }, + /* xfs from xfs_imap_class*/ + { "xfs_map_blocks_found", 0x10000 }, + { "xfs_map_blocks_alloc", 0x10000 }, + { "xfs_iomap_alloc", 0x1000 }, + { "xfs_iomap_found", 0x1000 }, + /* xfs from xfs_fs_class */ + { "xfs_inodegc_flush", 0x1 }, + { "xfs_inodegc_push", 0x1 }, + { "xfs_inodegc_start", 0x1 }, + { "xfs_inodegc_stop", 0x1 }, + { "xfs_inodegc_queue", 0x1 }, + { "xfs_inodegc_throttle", 0x1 }, + { "xfs_fs_sync_fs", 0x1 }, + { "xfs_blockgc_start", 0x1 }, + { "xfs_blockgc_stop", 0x1 }, + { "xfs_blockgc_worker", 0x1 }, + { "xfs_blockgc_flush_all", 0x1 }, + /* xfs_scrub */ + { "xchk_nlinks_live_update", 0x10 }, + /* xfs_scrub from xchk_metapath_class */ + { "xchk_metapath_lookup", 0x100 }, + /* nfsd */ + { "nfsd_dirent", 0x1 }, + { "nfsd_file_acquire", 0x1001 }, + { "nfsd_file_insert_err", 0x1 }, + { "nfsd_file_cons_err", 0x1 }, + /* nfs4 */ + { "nfs4_setup_sequence", 0x1 }, + { "pnfs_update_layout", 0x10000 }, + { "nfs4_inode_callback_event", 0x200 }, + { "nfs4_inode_stateid_callback_event", 0x200 }, + /* nfs from pnfs_layout_event */ + { "pnfs_mds_fallback_pg_init_read", 0x10000 }, + { "pnfs_mds_fallback_pg_init_write", 0x10000 }, + { "pnfs_mds_fallback_pg_get_mirror_count", 0x10000 }, + { "pnfs_mds_fallback_read_done", 0x10000 }, + { "pnfs_mds_fallback_write_done", 0x10000 }, + { "pnfs_mds_fallback_read_pagelist", 0x10000 }, + { "pnfs_mds_fallback_write_pagelist", 0x10000 }, + /* coda */ + { "coda_dec_pic_run", 0x10 }, + { "coda_dec_pic_done", 0x10 }, + /* cfg80211 */ + { "cfg80211_scan_done", 0x11 }, + { "rdev_set_coalesce", 0x10 }, + { "cfg80211_report_wowlan_wakeup", 0x100 }, + { "cfg80211_inform_bss_frame", 0x100 }, + { "cfg80211_michael_mic_failure", 0x10000 }, + /* cfg80211 from wiphy_work_event */ + { "wiphy_work_queue", 0x10 }, + { "wiphy_work_run", 0x10 }, + { "wiphy_work_cancel", 0x10 }, + { "wiphy_work_flush", 0x10 }, + /* hugetlbfs */ + { "hugetlbfs_alloc_inode", 0x10 }, + /* spufs */ + { "spufs_context", 0x10 }, + /* kvm_hv */ + { "kvm_page_fault_enter", 0x100 }, + /* dpu */ + { "dpu_crtc_setup_mixer", 0x100 }, + /* binder */ + { "binder_transaction", 0x100 }, + /* bcachefs */ + { "btree_path_free", 0x100 }, + /* hfi1_tx */ + { "hfi1_sdma_progress", 0x1000 }, + /* iptfs */ + { "iptfs_ingress_postq_event", 0x1000 }, + /* neigh */ + { "neigh_update", 0x10 }, + /* snd_firewire_lib */ + { "amdtp_packet", 0x100 }, }; bool btf_ctx_access(int off, int size, enum bpf_access_type type, -- 2.34.1

2 1

[openeuler:OLK-5.10 2830/2830] fs/xfs/libxfs/xfs_da_btree.o: warning: objtool: xfs_da3_split()+0x787: unreachable instruction
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 411f2e6e24ad11083d85f2ab7324b1f77ad0d371 commit: f2c902d8c653f8021f9761092a27f7b9db42b662 [2830/2830] tracing: Make tracepoint lockdep check actually test something config: x86_64-buildonly-randconfig-004-20250331 (https://download.01.org/0day-ci/archive/20250402/202504021010.h7TdpCwx-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021010.h7TdpCwx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021010.h7TdpCwx-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/xfs/libxfs/xfs_da_btree.o: warning: objtool: xfs_da3_split()+0x787: unreachable instruction -- >> fs/xfs/libxfs/xfs_attr_leaf.o: warning: objtool: xfs_attr3_leaf_split()+0x2da: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] dmaengine: Fix double increment of client_count in dma_chan_get()
by Xiaomeng Zhang 02 Apr '25

02 Apr '25

From: Koba Ko <koba.ko(a)canonical.com> stable inclusion from stable-v4.19.272 commit c6221afe573413fd2981e291f7df4a58283e0654 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBWVX7 CVE: CVE-2022-49753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f3dc1b3b4750851a94212dba249703dd0e50bb20 ] The first time dma_chan_get() is called for a channel the channel client_count is incorrectly incremented twice for public channels, first in balance_ref_count(), and again prior to returning. This results in an incorrect client count which will lead to the channel resources not being freed when they should be. A simple test of repeated module load and unload of async_tx on a Dell Power Edge R7425 also shows this resulting in a kref underflow warning. [ 124.329662] async_tx: api initialized (async) [ 129.000627] async_tx: api initialized (async) [ 130.047839] ------------[ cut here ]------------ [ 130.052472] refcount_t: underflow; use-after-free. [ 130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 [ 130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr intel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm mgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si syscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops k10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat fat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul libahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas i40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash dm_log dm_mod [last unloaded: async_tx] [ 130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not tainted 5.14.0-185.el9.x86_64 #1 [ 130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS 1.18.0 01/17/2022 [ 130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110 [ 130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d 26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a bd 55 00 <0f> 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff 48 c7 [ 130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286 [ 130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000 [ 130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0 [ 130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff [ 130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970 [ 130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 130.198739] FS: 00007f646435c740(0000) GS:ffff9daf9de00000(0000) knlGS:0000000000000000 [ 130.206832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0 [ 130.219729] Call Trace: [ 130.222192] <TASK> [ 130.224305] dma_chan_put+0x10d/0x110 [ 130.227988] dmaengine_put+0x7a/0xa0 [ 130.231575] __do_sys_delete_module.constprop.0+0x178/0x280 [ 130.237157] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [ 130.242652] do_syscall_64+0x5c/0x90 [ 130.246240] ? exc_page_fault+0x62/0x150 [ 130.250178] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 130.255243] RIP: 0033:0x7f6463a3f5ab [ 130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 [ 130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab [ 130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8 [ 130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000 [ 130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8 [ 130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8 [ 130.320875] </TASK> [ 130.323081] ---[ end trace eff7156d56b5cf25 ]--- cat /sys/class/dma/dma0chan*/in_use would get the wrong result. 2 2 2 Fixes: d2f4f99db3e9 ("dmaengine: Rework dma_chan_get") Signed-off-by: Koba Ko <koba.ko(a)canonical.com> Reviewed-by: Jie Hai <haijie1(a)huawei.com> Test-by: Jie Hai <haijie1(a)huawei.com> Reviewed-by: Jerry Snitselaar <jsnitsel(a)redhat.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Tested-by: Joel Savitz <jsavitz(a)redhat.com> Link: https://lore.kernel.org/r/20221201030050.978595-1-koba.ko@canonical.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/dma/dmaengine.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index f1a441ab395d..450b1c4b2129 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -223,7 +223,8 @@ static int dma_chan_get(struct dma_chan *chan) /* The channel is already in use, update client count */ if (chan->client_count) { __module_get(owner); - goto out; + chan->client_count++; + return 0; } if (!try_module_get(owner)) @@ -236,11 +237,11 @@ static int dma_chan_get(struct dma_chan *chan) goto err_out; } + chan->client_count++; + if (!dma_has_cap(DMA_PRIVATE, chan->device->cap_mask)) balance_ref_count(chan); -out: - chan->client_count++; return 0; err_out: -- 2.34.1

2 1

[PATCH v2 OLK-6.6 0/5] Support the FEAT_HDBSS introduced in Armv9.5
by Zhenyu Ye 02 Apr '25

02 Apr '25

From: eillon <yezhenyu2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB103D CVE: NA This series of patches add support to the Hardware Dirty state tracking Structure(HDBSS) feature, which is introduced by the ARM architecture in the DDI0601(ID121123) version. The HDBSS feature is an extension to the architecture that enhances tracking translation table descriptors' dirty state, identified as FEAT_HDBSS. The goal of this feature is to reduce the cost of surveying for dirtied granules, with minimal effect on recording when a granule has been dirtied. The purpose of this feature is to make the execution overhead of live migration lower to both the guest and the host, compared to existing approaches (write-protect or search stage 2 tables). After these patches, users(such as qemu) can use the KVM_CAP_ARM_HW_DIRTY_STATE_TRACK ioctl to enable or disable the HDBSS feature before and after the live migration. See patches for details, Thanks. eillon (5): arm64/sysreg: add HDBSS related register information arm64/kvm: support set the DBM attr during memory abort arm64/kvm: using ioctl to enable/disable the HDBSS feature arm64/kvm: support to handle the HDBSSF event arm64/config: add config to control whether enable HDBSS feature arch/arm64/Kconfig | 12 ++++ arch/arm64/configs/openeuler_defconfig | 6 ++ arch/arm64/include/asm/cpufeature.h | 14 ++++ arch/arm64/include/asm/esr.h | 2 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 8 +++ arch/arm64/include/asm/kvm_mmu.h | 14 ++++ arch/arm64/include/asm/kvm_pgtable.h | 1 + arch/arm64/include/asm/sysreg.h | 14 ++++ arch/arm64/kvm/arm.c | 88 ++++++++++++++++++++++++++ arch/arm64/kvm/handle_exit.c | 50 +++++++++++++++ arch/arm64/kvm/hyp/pgtable.c | 12 ++++ arch/arm64/kvm/hyp/vhe/switch.c | 3 + arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 4 ++ arch/arm64/kvm/mmu.c | 17 ++++- arch/arm64/kvm/reset.c | 9 +++ arch/arm64/tools/sysreg | 28 ++++++++ include/linux/kvm_host.h | 3 + include/uapi/linux/kvm.h | 2 + tools/include/uapi/linux/kvm.h | 2 + 20 files changed, 289 insertions(+), 1 deletion(-) -- 2.39.3

2 6

[openeuler:openEuler-1.0-LTS 1537/1537] fs/f2fs/gc.o: warning: objtool: f2fs_gc()+0x1f3f: unreachable instruction
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 8b9ea9010139596e71aae4be5264c3dd901b13cb [1537/1537] pagecache: support percpu refcount to imporve performance config: x86_64-buildonly-randconfig-004-20250331 (https://download.01.org/0day-ci/archive/20250402/202504021020.oxRcBdkg-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021020.oxRcBdkg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021020.oxRcBdkg-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/f2fs/gc.o: warning: objtool: f2fs_gc()+0x1f3f: unreachable instruction -- >> fs/f2fs/file.o: warning: objtool: truncate_partial_data_page()+0x213: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] fix CVE-2025-21712
by Zheng Qixing 02 Apr '25

02 Apr '25

Patch 1 is to fix the UAF issue in CVE-2025-21712. Patch 2 is to fix status collection for external bitmaps. Yu Kuai (1): md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime Zheng Qixing (1): md/md-bitmap: fix stats collection for external bitmaps drivers/md/md-bitmap.c | 3 ++- drivers/md/md.c | 5 +++++ 2 files changed, 7 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[openeuler:OLK-5.10 2836/2836] arch/x86/kernel/fpu/core.c:452:15: warning: no previous prototype for 'get_fpu_registers_pos'
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 411f2e6e24ad11083d85f2ab7324b1f77ad0d371 commit: 0cd6fd52741f659d2a57501ca933ab33040cb911 [2836/2836] mm: Enhanced copy capabilities for Hygon processor config: x86_64-randconfig-101-20250402 (https://download.01.org/0day-ci/archive/20250402/202504020854.WbZXJEHJ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504020854.WbZXJEHJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504020854.WbZXJEHJ-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kernel/fpu/core.c:444:14: warning: no previous prototype for 'get_fpustate_free_space' [-Wmissing-prototypes] 444 | unsigned int get_fpustate_free_space(struct fpu *fpu) | ^~~~~~~~~~~~~~~~~~~~~~~ >> arch/x86/kernel/fpu/core.c:452:15: warning: no previous prototype for 'get_fpu_registers_pos' [-Wmissing-prototypes] 452 | unsigned long get_fpu_registers_pos(struct fpu *fpu, unsigned int off) | ^~~~~~~~~~~~~~~~~~~~~ arch/x86/kernel/fpu/core.c:533:6: warning: no previous prototype for 'save_fpregs_to_fpkernelstate' [-Wmissing-prototypes] 533 | void save_fpregs_to_fpkernelstate(struct fpu *kfpu) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/get_fpu_registers_pos +452 arch/x86/kernel/fpu/core.c 451 > 452 unsigned long get_fpu_registers_pos(struct fpu *fpu, unsigned int off) 453 { 454 unsigned long addr = 0; 455 456 if (fpu && (fpu_kernel_nonatomic_xstate_size > off)) { 457 addr = (unsigned long)&fpu->__fpstate.regs.__padding[0]; 458 addr += fpu_kernel_cfg.default_size + off; 459 } 460 return addr; 461 } 462 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1544/1544] mm/share_pool.c:4577:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared
by kernel test robot 02 Apr '25

02 Apr '25

Hi Zhou, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 0886320b818787f720824229f153f161c89faf70 [1544/1544] mm/sharepool: Charge Buddy hugepage to memcg config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250402/202504020332.I3Yx3nDu-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250402/202504020332.I3Yx3nDu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504020332.I3Yx3nDu-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c:1086:29: sparse: sparse: incompatible types for operation (<=): mm/share_pool.c:1086:29: sparse: int *num mm/share_pool.c:1086:29: sparse: int mm/share_pool.c:3299:21: sparse: sparse: undefined identifier 'huge_ptep_get' mm/share_pool.c:3299:34: sparse: sparse: invalid initializer mm/share_pool.c:4577:32: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c:4585:30: sparse: sparse: undefined identifier 'huge_pte_none' mm/share_pool.c:4606:23: sparse: sparse: undefined identifier 'huge_add_to_page_cache' mm/share_pool.c:4625:14: sparse: sparse: undefined identifier 'huge_pte_none' mm/share_pool.c:4631:9: sparse: sparse: undefined identifier 'set_huge_pte_at' mm/share_pool.c:4633:9: sparse: sparse: undefined identifier 'hugetlb_count_add' mm/share_pool.c:4797:24: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c: In function 'mg_sp_group_id_by_pid': mm/share_pool.c:1086:29: warning: ordered comparison of pointer with integer zero [-Wextra] 1086 | if (!spg_ids || num <= 0) | ^~ mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:3299:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 3299 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:3299:21: error: invalid initializer mm/share_pool.c: In function 'sharepool_no_page': mm/share_pool.c:4577:32: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 4577 | page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage >> mm/share_pool.c:4577:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared (first use in this function) 4577 | page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); | ^~~~~~~~~~~~~~~~~~~ mm/share_pool.c:4577:64: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:4585:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 4585 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock mm/share_pool.c:4606:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 4606 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache mm/share_pool.c:4631:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 4631 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at mm/share_pool.c:4633:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 4633 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:4797:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 4797 | page = hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE cc1: some warnings being treated as errors vim +/HUGETLB_ALLOC_BUDDY +4577 mm/share_pool.c 4541 4542 vm_fault_t sharepool_no_page(struct mm_struct *mm, 4543 struct vm_area_struct *vma, 4544 struct address_space *mapping, pgoff_t idx, 4545 unsigned long address, pte_t *ptep, unsigned int flags) 4546 { 4547 struct hstate *h = hstate_vma(vma); 4548 vm_fault_t ret = VM_FAULT_SIGBUS; 4549 unsigned long size; 4550 struct page *page; 4551 pte_t new_pte; 4552 spinlock_t *ptl; 4553 unsigned long haddr = address & huge_page_mask(h); 4554 bool new_page = false; 4555 int err; 4556 int node_id; 4557 struct sp_area *spa; 4558 bool charge_hpage = false; 4559 struct mem_cgroup *memcg; 4560 4561 spa = vma->vm_private_data; 4562 if (!spa) { 4563 pr_err("share pool: vma is invalid, not from sp mmap\n"); 4564 return ret; 4565 } 4566 node_id = spa->node_id; 4567 4568 retry: 4569 page = find_lock_page(mapping, idx); 4570 if (!page) { 4571 size = i_size_read(mapping->host) >> huge_page_shift(h); 4572 if (idx >= size) 4573 goto out; 4574 4575 page = alloc_huge_page(vma, haddr, 0); 4576 if (IS_ERR(page)) { > 4577 page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); 4578 if (!page) 4579 page = ERR_PTR(-ENOMEM); 4580 else if (!PageKmemcg(page)) 4581 charge_hpage = true; 4582 } 4583 if (IS_ERR(page)) { 4584 ptl = huge_pte_lock(h, mm, ptep); 4585 if (!huge_pte_none(huge_ptep_get(ptep))) { 4586 ret = 0; 4587 spin_unlock(ptl); 4588 goto out; 4589 } 4590 spin_unlock(ptl); 4591 ret = vmf_error(PTR_ERR(page)); 4592 goto out; 4593 } 4594 4595 if (charge_hpage && 4596 mem_cgroup_try_charge_delay(page, vma->vm_mm, GFP_KERNEL, &memcg, true)) { 4597 put_page(page); 4598 ret = vmf_error(-ENOMEM); 4599 goto out; 4600 } 4601 4602 __SetPageUptodate(page); 4603 new_page = true; 4604 4605 /* sharepool pages are all shared */ 4606 err = huge_add_to_page_cache(page, mapping, idx); 4607 if (err) { 4608 if (charge_hpage) { 4609 mem_cgroup_cancel_charge(page, memcg, true); 4610 charge_hpage = false; 4611 } 4612 put_page(page); 4613 if (err == -EEXIST) 4614 goto retry; 4615 goto out; 4616 } 4617 } 4618 4619 ptl = huge_pte_lock(h, mm, ptep); 4620 size = i_size_read(mapping->host) >> huge_page_shift(h); 4621 if (idx >= size) 4622 goto backout; 4623 4624 ret = 0; 4625 if (!huge_pte_none(huge_ptep_get(ptep))) 4626 goto backout; 4627 4628 page_dup_rmap(page, true); 4629 new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) 4630 && (vma->vm_flags & VM_SHARED))); 4631 set_huge_pte_at(mm, haddr, ptep, new_pte); 4632 4633 hugetlb_count_add(pages_per_huge_page(h), mm); 4634 4635 if (charge_hpage) 4636 mem_cgroup_commit_charge(page, memcg, false, true); 4637 4638 spin_unlock(ptl); 4639 4640 if (new_page) 4641 SetPagePrivate(&page[1]); 4642 4643 unlock_page(page); 4644 out: 4645 return ret; 4646 4647 backout: 4648 spin_unlock(ptl); 4649 unlock_page(page); 4650 if (charge_hpage) 4651 mem_cgroup_cancel_charge(page, memcg, true); 4652 put_page(page); 4653 goto out; 4654 } 4655 EXPORT_SYMBOL(sharepool_no_page); 4656 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1544/1544] mm/share_pool.c:2435:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'?
by kernel test robot 02 Apr '25

02 Apr '25

Hi Weilong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 4e851c2bb53e45d92e266c65cf0c203624e74710 [1544/1544] ascend: share_pool: Use sharepool_no_page to alloc hugepage config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250402/202504020010.TmMNnpc4-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250402/202504020010.TmMNnpc4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504020010.TmMNnpc4-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c:58:5: sparse: sparse: symbol 'enable_mdc_default_group' was not declared. Should it be static? mm/share_pool.c:1685:21: sparse: sparse: undefined identifier 'huge_ptep_get' mm/share_pool.c:1685:34: sparse: sparse: invalid initializer mm/share_pool.c:2435:30: sparse: sparse: undefined identifier 'huge_pte_none' mm/share_pool.c:2448:23: sparse: sparse: undefined identifier 'huge_add_to_page_cache' mm/share_pool.c:2464:14: sparse: sparse: undefined identifier 'huge_pte_none' mm/share_pool.c:2470:9: sparse: sparse: undefined identifier 'set_huge_pte_at' mm/share_pool.c:2472:9: sparse: sparse: undefined identifier 'hugetlb_count_add' mm/share_pool.c:2508:24: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:1685:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 1685 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:1685:21: error: invalid initializer mm/share_pool.c: In function 'sharepool_no_page': >> mm/share_pool.c:2435:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 2435 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock >> mm/share_pool.c:2448:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 2448 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache >> mm/share_pool.c:2470:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 2470 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at >> mm/share_pool.c:2472:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 2472 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:2508:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 2508 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage mm/share_pool.c:2508:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 2508 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:2508:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:2511:1: warning: control reaches end of non-void function [-Wreturn-type] 2511 | } | ^ cc1: some warnings being treated as errors vim +2435 mm/share_pool.c 2403 2404 vm_fault_t sharepool_no_page(struct mm_struct *mm, 2405 struct vm_area_struct *vma, 2406 struct address_space *mapping, pgoff_t idx, 2407 unsigned long address, pte_t *ptep, unsigned int flags) 2408 { 2409 struct hstate *h = hstate_vma(vma); 2410 vm_fault_t ret = VM_FAULT_SIGBUS; 2411 unsigned long size; 2412 struct page *page; 2413 pte_t new_pte; 2414 spinlock_t *ptl; 2415 unsigned long haddr = address & huge_page_mask(h); 2416 bool new_page = false; 2417 int err; 2418 2419 retry: 2420 page = find_lock_page(mapping, idx); 2421 if (!page) { 2422 size = i_size_read(mapping->host) >> huge_page_shift(h); 2423 if (idx >= size) 2424 goto out; 2425 2426 page = alloc_huge_page(vma, haddr, 0); 2427 if (IS_ERR(page)) { 2428 page = alloc_huge_page_node(hstate_file(vma->vm_file), 2429 numa_mem_id()); 2430 if (!page) 2431 page = ERR_PTR(-ENOMEM); 2432 } 2433 if (IS_ERR(page)) { 2434 ptl = huge_pte_lock(h, mm, ptep); > 2435 if (!huge_pte_none(huge_ptep_get(ptep))) { 2436 ret = 0; 2437 spin_unlock(ptl); 2438 goto out; 2439 } 2440 spin_unlock(ptl); 2441 ret = vmf_error(PTR_ERR(page)); 2442 goto out; 2443 } 2444 __SetPageUptodate(page); 2445 new_page = true; 2446 2447 /* sharepool pages are all shared */ > 2448 err = huge_add_to_page_cache(page, mapping, idx); 2449 if (err) { 2450 put_page(page); 2451 if (err == -EEXIST) 2452 goto retry; 2453 goto out; 2454 } 2455 } 2456 2457 2458 ptl = huge_pte_lock(h, mm, ptep); 2459 size = i_size_read(mapping->host) >> huge_page_shift(h); 2460 if (idx >= size) 2461 goto backout; 2462 2463 ret = 0; 2464 if (!huge_pte_none(huge_ptep_get(ptep))) 2465 goto backout; 2466 2467 page_dup_rmap(page, true); 2468 new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) 2469 && (vma->vm_flags & VM_SHARED))); > 2470 set_huge_pte_at(mm, haddr, ptep, new_pte); 2471 > 2472 hugetlb_count_add(pages_per_huge_page(h), mm); 2473 2474 spin_unlock(ptl); 2475 2476 if (new_page) { 2477 SetPagePrivate(&page[1]); 2478 } 2479 2480 unlock_page(page); 2481 out: 2482 return ret; 2483 2484 backout: 2485 spin_unlock(ptl); 2486 unlock_page(page); 2487 put_page(page); 2488 goto out; 2489 } 2490 EXPORT_SYMBOL(sharepool_no_page); 2491 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1544/1544] fs/proc/etmem_swap.c:86: undefined reference to `proc_swap_pages_operations'
by kernel test robot 01 Apr '25

01 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: fb3893e8dd62797b531a46bd3c49b2c14dc6eb27 [1544/1544] etmem: add etmem-swap feature config: x86_64-randconfig-r113-20250401 (https://download.01.org/0day-ci/archive/20250401/202504012235.IEGC6Idv-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250401/202504012235.IEGC6Idv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504012235.IEGC6Idv-lkp@intel.com/ All errors (new ones prefixed by >>): ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: .tmp_vmlinux1 has a LOAD segment with RWX permissions ld: fs/proc/etmem_scan.o: in function `page_scan_entry': fs/proc/etmem_scan.c:1031: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.c:1032: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.c:1031: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.c:1033: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.c:1032: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.o:fs/proc/etmem_scan.c:1034: more undefined references to `proc_page_scan_operations' follow ld: fs/proc/etmem_swap.o: in function `swap_pages_entry': >> fs/proc/etmem_swap.c:86: undefined reference to `proc_swap_pages_operations' >> ld: fs/proc/etmem_swap.c:87: undefined reference to `proc_swap_pages_operations' >> ld: fs/proc/etmem_swap.c:86: undefined reference to `proc_swap_pages_operations' ld: fs/proc/etmem_swap.c:88: undefined reference to `proc_swap_pages_operations' >> ld: fs/proc/etmem_swap.c:87: undefined reference to `proc_swap_pages_operations' ld: fs/proc/etmem_swap.o:fs/proc/etmem_swap.c:89: more undefined references to `proc_swap_pages_operations' follow vim +86 fs/proc/etmem_swap.c 83 84 static int swap_pages_entry(void) 85 { > 86 proc_swap_pages_operations.owner = THIS_MODULE; > 87 proc_swap_pages_operations.write = swap_pages_write; 88 proc_swap_pages_operations.open = swap_pages_open; 89 proc_swap_pages_operations.release = swap_pages_release; 90 91 return 0; 92 } 93 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH v1 OLK-6.6 0/5] Support the FEAT_HDBSS introduced in Armv9.5
by Zhenyu Ye 01 Apr '25

01 Apr '25

From: eillon <yezhenyu2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB103D CVE: NA This series of patches add support to the Hardware Dirty state tracking Structure(HDBSS) feature, which is introduced by the ARM architecture in the DDI0601(ID121123) version. The HDBSS feature is an extension to the architecture that enhances tracking translation table descriptors' dirty state, identified as FEAT_HDBSS. The goal of this feature is to reduce the cost of surveying for dirtied granules, with minimal effect on recording when a granule has been dirtied. The purpose of this feature is to make the execution overhead of live migration lower to both the guest and the host, compared to existing approaches (write-protect or search stage 2 tables). After these patches, users(such as qemu) can use the KVM_CAP_ARM_HW_DIRTY_STATE_TRACK ioctl to enable or disable the HDBSS feature before and after the live migration. See patches for details, Thanks. eillon (5): arm64/sysreg: add HDBSS related register information arm64/kvm: support set the DBM attr during memory abort arm64/kvm: using ioctl to enable/disable the HDBSS feature arm64/kvm: support to handle the HDBSSF event arm64/config: add config to control whether enable HDBSS feature arch/arm64/Kconfig | 12 ++++ arch/arm64/include/asm/cpufeature.h | 14 +++++ arch/arm64/include/asm/esr.h | 2 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 8 +++ arch/arm64/include/asm/kvm_mmu.h | 14 +++++ arch/arm64/include/asm/kvm_pgtable.h | 1 + arch/arm64/include/asm/sysreg.h | 14 +++++ arch/arm64/kvm/arm.c | 88 ++++++++++++++++++++++++++++ arch/arm64/kvm/handle_exit.c | 50 ++++++++++++++++ arch/arm64/kvm/hyp/pgtable.c | 12 ++++ arch/arm64/kvm/hyp/vhe/switch.c | 3 + arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 4 ++ arch/arm64/kvm/mmu.c | 17 +++++- arch/arm64/kvm/reset.c | 9 +++ arch/arm64/tools/sysreg | 28 +++++++++ include/linux/kvm_host.h | 3 + include/uapi/linux/kvm.h | 2 + tools/include/uapi/linux/kvm.h | 2 + 19 files changed, 283 insertions(+), 1 deletion(-) -- 2.39.3

2 6

[PATCH OLK-5.10] tracing: Fix use-after-free in print_graph_function_flags during tracer switching
by Tengda Wu 01 Apr '25

01 Apr '25

From: Tengda Wu <wutengda(a)huaweicloud.com> mainline inclusion from mainline-v6.15 commit 7f81f27b1093e4895e87b74143c59c055c3b1906 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBWWU7 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the following script: $ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tracer The root cause lies in the two calls to print_graph_function_flags within print_trace_line during each s_show(): * One through 'iter->trace->print_line()'; * Another through 'event->funcs->trace()', which is hidden in print_trace_fmt() before print_trace_line returns. Tracer switching only updates the former, while the latter continues to use the print_line function of the old tracer, which in the script above is print_graph_function_flags. Moreover, when switching from the 'function_graph' tracer to the 'timerlat' tracer, s_start only calls graph_trace_close of the 'function_graph' tracer to free 'iter->private', but does not set it to NULL. This provides an opportunity for 'event->funcs->trace()' to use an invalid 'iter->private'. To fix this issue, set 'iter->private' to NULL immediately after freeing it in graph_trace_close(), ensuring that an invalid pointer is not passed to other tracers. Additionally, clean up the unnecessary 'iter->private = NULL' during each 'cat trace' when using wakeup and irqsoff tracers. [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Zheng Yejian <zhengyejian1(a)huawei.com> Link: https://lore.kernel.org/20250320122137.23635-1-wutengda@huaweicloud.com Fixes: eecb91b9f98d ("tracing: Fix memleak due to race between current_tracer and trace") Closes: https://lore.kernel.org/all/CAMgjq7BW79KDSCyp+tZHjShSzHsScSiJxn5ffskp-QzVM0… Reported-by: Kairui Song <kasong(a)tencent.com> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_functions_graph.c | 1 + kernel/trace/trace_irqsoff.c | 2 -- kernel/trace/trace_sched_wakeup.c | 2 -- 3 files changed, 1 insertion(+), 4 deletions(-) diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c index 677538c3b9ec..591ca962cc9e 100644 --- a/kernel/trace/trace_functions_graph.c +++ b/kernel/trace/trace_functions_graph.c @@ -1244,6 +1244,7 @@ void graph_trace_close(struct trace_iterator *iter) if (data) { free_percpu(data->cpu_data); kfree(data); + iter->private = NULL; } } diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c index 4a11967c8daa..1dded26115b3 100644 --- a/kernel/trace/trace_irqsoff.c +++ b/kernel/trace/trace_irqsoff.c @@ -231,8 +231,6 @@ static void irqsoff_trace_open(struct trace_iterator *iter) { if (is_graph(iter->tr)) graph_trace_open(iter); - else - iter->private = NULL; } static void irqsoff_trace_close(struct trace_iterator *iter) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index c1f582e0e97f..f1c603358ff3 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -168,8 +168,6 @@ static void wakeup_trace_open(struct trace_iterator *iter) { if (is_graph(iter->tr)) graph_trace_open(iter); - else - iter->private = NULL; } static void wakeup_trace_close(struct trace_iterator *iter) -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1544/1544] block/blk-cgroup.c:478:19: sparse: sparse: incompatible types in comparison expression (different address spaces):
by kernel test robot 01 Apr '25

01 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 725ee753b5064f03287858bc346d883b8f39319a [1544/1544] bdi: fix use-after-free for the bdi device config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250401/202504012009.zDgdqz6W-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250401/202504012009.zDgdqz6W-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504012009.zDgdqz6W-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> block/blk-cgroup.c:478:19: sparse: sparse: incompatible types in comparison expression (different address spaces): block/blk-cgroup.c:478:19: sparse: struct rcu_device [noderef] __rcu * block/blk-cgroup.c:478:19: sparse: struct rcu_device * block/blk-cgroup.c:816:5: sparse: sparse: context imbalance in 'blkg_conf_prep' - wrong count at exit block/blk-cgroup.c:1794: warning: Function parameter or member 'q' not described in 'blkcg_schedule_throttle' block/blk-cgroup.c:1794: warning: Function parameter or member 'use_memdelay' not described in 'blkcg_schedule_throttle' block/blk-cgroup.c:1819: warning: Function parameter or member 'blkg' not described in 'blkcg_add_delay' block/blk-cgroup.c:1819: warning: Function parameter or member 'now' not described in 'blkcg_add_delay' block/blk-cgroup.c:1819: warning: Function parameter or member 'delta' not described in 'blkcg_add_delay' vim +478 block/blk-cgroup.c 472 473 const char *blkg_dev_name(struct blkcg_gq *blkg) 474 { 475 /* some drivers (floppy) instantiate a queue w/o disk registered */ 476 struct rcu_device *rcu_dev; 477 > 478 rcu_dev = rcu_dereference(blkg->q->backing_dev_info->rcu_dev); 479 if (rcu_dev) 480 return dev_name(&rcu_dev->dev); 481 return NULL; 482 } 483 EXPORT_SYMBOL_GPL(blkg_dev_name); 484 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2068/2068] drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:545:5: error: no previous prototype for 'ps3_pci_init'
by kernel test robot 01 Apr '25

01 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: af5900086b6f0256d261f2c36f7beca966875eb1 commit: 97a2bb6ece556f3882263ee8df2b77f10c511311 [2068/2068] SCSI: Linkdata: Supports Linkdata HBA/RAID Controllers config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20250401/202504012026.kzT6d2HZ-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250401/202504012026.kzT6d2HZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504012026.kzT6d2HZ-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/scsi/linkdata/ps3stor/ps3_ioc_manager.c:307:5: error: no previous prototype for 'ps3_hard_reset_to_ready' [-Werror=missing-prototypes] 307 | int ps3_hard_reset_to_ready(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:876:6: error: no previous prototype for 'ps3_set_task_manager_busy' [-Werror=missing-prototypes] 876 | void ps3_set_task_manager_busy(struct ps3_instance *instance, | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:1110:5: error: no previous prototype for 'ps3_wait_for_outstanding_complete' [-Werror=missing-prototypes] 1110 | int ps3_wait_for_outstanding_complete(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:131:6: error: no previous prototype for 'ps3_trigger_irq_poll' [-Werror=missing-prototypes] 131 | void ps3_trigger_irq_poll(struct ps3_irq *irq) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:243:5: error: no previous prototype for 'ps3_resp_status_convert' [-Werror=missing-prototypes] 243 | int ps3_resp_status_convert(unsigned int resp_status) | ^~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:211:1: error: no previous prototype for 'ps3_qos_cmd_waitq_get' [-Werror=missing-prototypes] 211 | ps3_qos_cmd_waitq_get(struct ps3_qos_tg_context *qos_tg_ctx, | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:335:15: error: no previous prototype for 'ps3_qos_vd_cmdword_get' [-Werror=missing-prototypes] 335 | unsigned char ps3_qos_vd_cmdword_get(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:351:15: error: no previous prototype for 'ps3_qos_exclusive_cmdword_get' [-Werror=missing-prototypes] 351 | unsigned char ps3_qos_exclusive_cmdword_get(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:363:15: error: no previous prototype for 'ps3_qos_tg_decision' [-Werror=missing-prototypes] 363 | unsigned char ps3_qos_tg_decision(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:749:15: error: no previous prototype for 'ps3_qos_all_pd_rc_get' [-Werror=missing-prototypes] 749 | unsigned char ps3_qos_all_pd_rc_get(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:876:6: error: no previous prototype for 'ps3_pd_quota_waitq_clear_all' [-Werror=missing-prototypes] 876 | void ps3_pd_quota_waitq_clear_all(struct ps3_qos_pd_mgr *qos_pd_mgr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:892:6: error: no previous prototype for 'ps3_pd_quota_waitq_clean' [-Werror=missing-prototypes] 892 | void ps3_pd_quota_waitq_clean(struct ps3_qos_pd_mgr *qos_pd_mgr, | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:1058:6: error: no previous prototype for 'ps3_qos_pd_waitq_ratio_update' [-Werror=missing-prototypes] 1058 | void ps3_qos_pd_waitq_ratio_update(struct ps3_qos_pd_mgr *qos_pd_mgr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2019:15: error: no previous prototype for 'ps3_hba_qos_decision' [-Werror=missing-prototypes] 2019 | unsigned char ps3_hba_qos_decision(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2040:6: error: no previous prototype for 'ps3_hba_qos_waitq_notify' [-Werror=missing-prototypes] 2040 | void ps3_hba_qos_waitq_notify(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2100:6: error: no previous prototype for 'ps3_cmd_waitq_abort' [-Werror=missing-prototypes] 2100 | bool ps3_cmd_waitq_abort(struct ps3_cmd *aborted_cmd) | ^~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2463:6: error: no previous prototype for 'ps3_hba_qos_waitq_clear_all' [-Werror=missing-prototypes] 2463 | void ps3_hba_qos_waitq_clear_all(struct ps3_instance *instance, int resp_status) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2827:6: error: no previous prototype for 'ps3_hba_qos_vd_init' [-Werror=missing-prototypes] 2827 | void ps3_hba_qos_vd_init(struct ps3_instance *instance, | ^~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2936:6: error: no previous prototype for 'ps3_hba_qos_vd_reset' [-Werror=missing-prototypes] 2936 | void ps3_hba_qos_vd_reset(struct ps3_instance *instance, unsigned short disk_id) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3023:6: error: no previous prototype for 'ps3_hba_qos_waitq_poll' [-Werror=missing-prototypes] 3023 | void ps3_hba_qos_waitq_poll(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3279:15: error: no previous prototype for 'ps3_raid_qos_decision' [-Werror=missing-prototypes] 3279 | unsigned char ps3_raid_qos_decision(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3334:6: error: no previous prototype for 'ps3_qos_mgrq_resend' [-Werror=missing-prototypes] 3334 | void ps3_qos_mgrq_resend(struct ps3_qos_softq_mgr *softq_mgr) | ^~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3478:6: error: no previous prototype for 'ps3_raid_qos_waitq_notify' [-Werror=missing-prototypes] 3478 | void ps3_raid_qos_waitq_notify(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:3821:15: error: no previous prototype for 'ps3_raid_qos_waitq_abort' [-Werror=missing-prototypes] 3821 | unsigned char ps3_raid_qos_waitq_abort(struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:4022:6: error: no previous prototype for 'ps3_raid_qos_waitq_clear_all' [-Werror=missing-prototypes] 4022 | void ps3_raid_qos_waitq_clear_all(struct ps3_instance *instance, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/linkdata/ps3stor/ps3_qos.c:4083:6: error: no previous prototype for 'ps3_raid_qos_waitq_poll' [-Werror=missing-prototypes] 4083 | void ps3_raid_qos_waitq_poll(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:85:6: error: no previous prototype for 'ps3_cmd_stat_content_clear' [-Werror=missing-prototypes] 85 | void ps3_cmd_stat_content_clear(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:403:6: error: no previous prototype for 'ps3_io_recv_ok_stat_inc' [-Werror=missing-prototypes] 403 | void ps3_io_recv_ok_stat_inc(struct ps3_instance *ins, | ^~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_ioctl.c:785:6: error: no previous prototype for 'ps3_clean_mgr_cmd' [-Werror=missing-prototypes] 785 | void ps3_clean_mgr_cmd(struct ps3_instance *instance) | ^~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:578:5: error: no previous prototype for 'ps3_r1x_hash_bit_check' [-Werror=missing-prototypes] 578 | int ps3_r1x_hash_bit_check(struct ps3_r1x_hash_bit_mgr *hash_mgr, | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:678:6: error: no previous prototype for 'ps3_r1x_conflict_queue_hash_bit_lock' [-Werror=missing-prototypes] 678 | void ps3_r1x_conflict_queue_hash_bit_lock(struct ps3_r1x_lock_mgr *mgr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:730:5: error: no previous prototype for 'ps3_r1x_hash_bit_lock' [-Werror=missing-prototypes] 730 | int ps3_r1x_hash_bit_lock(struct ps3_r1x_lock_mgr *mgr, struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:988:6: error: no previous prototype for 'ps3_r1x_hash_bit_unlock' [-Werror=missing-prototypes] 988 | void ps3_r1x_hash_bit_unlock(struct ps3_r1x_lock_mgr *mgr, struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1173:5: error: no previous prototype for 'ps3_range_check_and_insert' [-Werror=missing-prototypes] 1173 | int ps3_range_check_and_insert(struct ps3_range_tree_root *range_root, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1231:5: error: no previous prototype for 'ps3_r1x_hash_range_lock' [-Werror=missing-prototypes] 1231 | int ps3_r1x_hash_range_lock(struct ps3_r1x_lock_mgr *mgr, struct ps3_cmd *cmd) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1312:6: error: no previous prototype for 'ps3_r1x_hash_range_unlock' [-Werror=missing-prototypes] 1312 | void ps3_r1x_hash_range_unlock(struct ps3_r1x_lock_mgr *mgr, | ^~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_debug.c:883:5: error: no previous prototype for 'ps3_dump_dir_length' [-Werror=missing-prototypes] 883 | int ps3_dump_dir_length(const char *buf, size_t count) | ^~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_module_para.c:609:14: error: no previous prototype for 'ps3_cli_ver_query' [-Werror=missing-prototypes] 609 | unsigned int ps3_cli_ver_query(void) | ^~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_rb_tree.c:154:6: error: no previous prototype for 'rbtDelNodeDo' [-Werror=missing-prototypes] 154 | void rbtDelNodeDo(struct Ps3RbRoot *pRoot, struct Ps3RbNode *pNode) | ^~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/scsi/linkdata/ps3stor/ps3_device_manager.c:1581:5: error: no previous prototype for 'ps3_scsi_private_init_pd' [-Werror=missing-prototypes] 1581 | int ps3_scsi_private_init_pd(struct scsi_device *sdev) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_device_manager.c:1663:5: error: no previous prototype for 'ps3_scsi_private_init_vd' [-Werror=missing-prototypes] 1663 | int ps3_scsi_private_init_vd(struct scsi_device *sdev) | ^~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors .. vim +/ps3_pci_init +545 drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c 544 > 545 int ps3_pci_init(struct pci_dev *pdev, struct ps3_instance *instance) 546 { 547 resource_size_t base_addr = 0; 548 int ret = PS3_SUCCESS; 549 550 ret = pci_enable_device_mem(pdev); 551 if (ret != PS3_SUCCESS) { 552 LOG_ERROR("hno:%u pci id[%u] pci enable failed\n", 553 PS3_HOST(instance), pdev->dev.id); 554 goto l_pci_enable_device_mem_failed; 555 } 556 557 pci_set_master(pdev); 558 559 instance->reg_bar = PS3_REGISTER_BAR_INDEX; 560 ret = (pci_resource_flags(pdev, instance->reg_bar) & IORESOURCE_MEM); 561 if (!ret) { 562 LOG_ERROR("hno:%u Bar %lu isnot IORESOURCE_MEM\n", 563 PS3_HOST(instance), instance->reg_bar); 564 goto l_bar_check_failed; 565 } 566 ret = pci_request_selected_regions(pdev, 1 << instance->reg_bar, 567 "PS3 pci regions"); 568 if (ret != PS3_SUCCESS) { 569 LOG_ERROR("hno:%u IO memory region busy\n", PS3_HOST(instance)); 570 goto l_pci_request_selected_regions_failed; 571 } 572 #if defined(PS3_SUPPORT_PCIE_REPORT) 573 pci_enable_pcie_error_reporting(pdev); 574 #endif 575 if (instance->ioc_adpter->reg_set) { 576 instance->reg_set = 577 (struct Ps3Fifo __iomem *)instance->ioc_adpter->reg_set( 578 pdev, instance->reg_bar); 579 } else { 580 instance->reg_set = (struct Ps3Fifo __iomem *)ioremap( 581 pci_resource_start(pdev, instance->reg_bar), 582 PS3_REGISTER_SET_SIZE); 583 } 584 if (instance->reg_set == NULL) { 585 LOG_ERROR("hno:%u ioremap failed\n", PS3_HOST(instance)); 586 goto l_ioremap_failed; 587 } else { 588 pci_set_drvdata(pdev, instance); 589 } 590 591 ps3_atomic_set(&instance->watchdog_reg_read_fail_count, 0); 592 LOG_INFO( 593 "reg_bar_idx = %lu, bar_base_paddr = 0x%llx, reg_set_vaddr = 0x%p\n", 594 instance->reg_bar, (unsigned long long)base_addr, instance->reg_set); 595 596 return PS3_SUCCESS; 597 l_ioremap_failed: 598 pci_release_selected_regions(instance->pdev, 1 << instance->reg_bar); 599 #if defined(PS3_SUPPORT_PCIE_REPORT) 600 pci_disable_pcie_error_reporting(pdev); 601 #endif 602 l_pci_request_selected_regions_failed: 603 pci_disable_device(instance->pdev); 604 l_bar_check_failed: 605 l_pci_enable_device_mem_failed: 606 return -PS3_FAILED; 607 } 608 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS V1] drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
by Cheng Yu 01 Apr '25

01 Apr '25

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v4.19.247 commit 6ff986e057bf28e2f7690dad410768b2270f9453 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1K1 CVE: CVE-2022-49491 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8c242908ad15bbd604d3bcb54961b7d454c43f8 ] It will cause null-ptr-deref in resource_size(), if platform_get_resource() returns NULL, move calling resource_size() after devm_ioremap_resource() that will check 'res' to avoid null-ptr-deref. Fixes: 2048e3286f34 ("drm: rockchip: Add basic drm driver") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Heiko Stuebner <heiko(a)sntech.de> Link: https://patchwork.freedesktop.org/patch/msgid/20220422032854.2995175-1-yang… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c index 873624a11ce8..c0b647435974 100644 --- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c @@ -1595,10 +1595,10 @@ static int vop_bind(struct device *dev, struct device *master, void *data) vop_win_init(vop); res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - vop->len = resource_size(res); vop->regs = devm_ioremap_resource(dev, res); if (IS_ERR(vop->regs)) return PTR_ERR(vop->regs); + vop->len = resource_size(res); vop->regsbak = devm_kzalloc(dev, vop->len, GFP_KERNEL); if (!vop->regsbak) -- 2.25.1

2 1

[PATCH] perf/core: Fix pmus_lock vs. pmus_srcu ordering
by Luo Gengkun 01 Apr '25

01 Apr '25

From: Peter Zijlstra <peterz(a)infradead.org> stable inclusion from stable-v6.6.83 commit 7c823e4c30d6fdc16089e13924260086eaea76be category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBXQNU Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2565e42539b120b81a68a58da961ce5d1e34eac8 ] Commit a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") placed pmus_lock inside pmus_srcu, this makes perf_pmu_unregister() trip lockdep. Move the locking about such that only pmu_idr and pmus (list) are modified while holding pmus_lock. This avoids doing synchronize_srcu() while holding pmus_lock and all is well again. Fixes: a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20241104135517.679556858@infradead.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 0b9e703641d1..9b5d35c4a3ec 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -11670,6 +11670,8 @@ void perf_pmu_unregister(struct pmu *pmu) { mutex_lock(&pmus_lock); list_del_rcu(&pmu->entry); + idr_remove(&pmu_idr, pmu->type); + mutex_unlock(&pmus_lock); /* * We dereference the pmu list under both SRCU and regular RCU, so @@ -11679,7 +11681,6 @@ void perf_pmu_unregister(struct pmu *pmu) synchronize_rcu(); free_percpu(pmu->pmu_disable_count); - idr_remove(&pmu_idr, pmu->type); if (pmu_bus_running && pmu->dev && pmu->dev != PMU_NULL_DEV) { if (pmu->nr_addr_filters) device_remove_file(pmu->dev, &dev_attr_nr_addr_filters); @@ -11687,7 +11688,6 @@ void perf_pmu_unregister(struct pmu *pmu) put_device(pmu->dev); } free_pmu_context(pmu); - mutex_unlock(&pmus_lock); } EXPORT_SYMBOL_GPL(perf_pmu_unregister); -- 2.34.1

1 0

[PATCH OLK-6.6] ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
by Qi Xi 01 Apr '25

01 Apr '25

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> mainline inclusion from mainline-v6.14-rc1 commit 301c26a018acb94dd537a4418cefa0f654500c6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRED3 CVE: CVE-2024-58077 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc_pcm_ret(). It is used from many functions, ignoring -EINVAL is over-kill. The reason why -EINVAL was ignored was it really should only be used upon invalid parameters coming from userspace and in that case we don't want to log an error since we do not want to give userspace a way to do a denial-of-service attack on the syslog / diskspace. So don't use soc_pcm_ret() on .prepare callback is better idea. Link: https://lore.kernel.org/r/87v7vptzap.wl-kuninori.morimoto.gx@renesas.com Cc: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Link: https://patch.msgid.link/87bjxg8jju.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- sound/soc/soc-pcm.c | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 511446a30c05..60248a6820aa 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -38,7 +38,6 @@ static inline int _soc_pcm_ret(struct snd_soc_pcm_runtime *rtd, switch (ret) { case -EPROBE_DEFER: case -ENOTSUPP: - case -EINVAL: break; default: dev_err(rtd->dev, @@ -902,7 +901,13 @@ static int __soc_pcm_prepare(struct snd_soc_pcm_runtime *rtd, } out: - return soc_pcm_ret(rtd, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } /* PCM prepare ops for non-DPCM streams */ @@ -914,6 +919,13 @@ static int soc_pcm_prepare(struct snd_pcm_substream *substream) snd_soc_dpcm_mutex_lock(rtd); ret = __soc_pcm_prepare(rtd, substream); snd_soc_dpcm_mutex_unlock(rtd); + + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ return ret; } @@ -2461,7 +2473,13 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) be->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE; } - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) @@ -2501,7 +2519,13 @@ static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO); snd_soc_dpcm_mutex_unlock(fe); - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_run_update_shutdown(struct snd_soc_pcm_runtime *fe, int stream) -- 2.33.0

2 1

[openeuler:openEuler-1.0-LTS 1544/1544] mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'?
by kernel test robot 01 Apr '25

01 Apr '25

Hi Ding, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 4a280fac30d27ae2aff096f9f99aa12d50f83426 [1544/1544] ascend: share_pool: support share pool features for ascend platform config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250401/202504011702.UDJZ2vxB-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250401/202504011702.UDJZ2vxB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504011702.UDJZ2vxB-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c:55:5: sparse: sparse: symbol 'enable_mdc_default_group' was not declared. Should it be static? mm/share_pool.c:172:6: sparse: sparse: symbol 'host_svm_sp_enable' was not declared. Should it be static? mm/share_pool.c:1542:21: sparse: sparse: undefined identifier 'huge_ptep_get' mm/share_pool.c:1542:34: sparse: sparse: invalid initializer mm/share_pool.c:2263:24: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c:236:28: sparse: sparse: context imbalance in 'spa_dec_usage' - unexpected unlock mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:1542:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 1542 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:1542:21: error: invalid initializer mm/share_pool.c: In function 'sp_alloc_pages': >> mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage >> mm/share_pool.c:2263:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:2263:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:2266:1: warning: control reaches end of non-void function [-Wreturn-type] 2266 | } | ^ cc1: some warnings being treated as errors sparse warnings: (new ones prefixed by >>) mm/share_pool.c:55:5: sparse: sparse: symbol 'enable_mdc_default_group' was not declared. Should it be static? mm/share_pool.c:172:6: sparse: sparse: symbol 'host_svm_sp_enable' was not declared. Should it be static? mm/share_pool.c:1542:21: sparse: sparse: undefined identifier 'huge_ptep_get' >> mm/share_pool.c:1542:34: sparse: sparse: invalid initializer mm/share_pool.c:2263:24: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c:236:28: sparse: sparse: context imbalance in 'spa_dec_usage' - unexpected unlock mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:1542:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 1542 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:1542:21: error: invalid initializer mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage mm/share_pool.c:2263:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:2263:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:2266:1: warning: control reaches end of non-void function [-Wreturn-type] 2266 | } | ^ cc1: some warnings being treated as errors vim +2263 mm/share_pool.c 2257 2258 2259 struct page *sp_alloc_pages(struct vm_struct *area, gfp_t mask, 2260 unsigned int page_order, int node) 2261 { 2262 if (area->flags & VM_HUGE_PAGES) > 2263 return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); 2264 else 2265 return alloc_pages_node(node, mask, page_order); 2266 } 2267 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/5] Some mainline patches merged into drivers/hwmon
by Lifeng Zheng 01 Apr '25

01 Apr '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some mainline patches merged into drivers/hwmon Huisong Li (4): hwmon: (acpi_power_meter) Fix fail to load module on platform without _PMD method hwmon: (acpi_power_meter) Fix uninitialized variables hwmon: (acpi_power_meter) Fix update the power trip points on failure hwmon: (acpi_power_meter) Fix the fake power alarm reporting Kazuhiro Abe (1): hwmon: (acpi_power_meter) Fix a check for the return value of read_domain_devices(). drivers/hwmon/acpi_power_meter.c | 46 +++++++++++++++++++++++++------- 1 file changed, 36 insertions(+), 10 deletions(-) -- 2.33.0

2 6

[openeuler:openEuler-1.0-LTS 1544/1544] block/blk-cgroup.c:478:19: sparse: sparse: incompatible types in comparison expression (different address spaces):
by kernel test robot 01 Apr '25

01 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9866a4dd6fd198f871f6c1692e61ce7d10c96836 commit: 725ee753b5064f03287858bc346d883b8f39319a [1544/1544] bdi: fix use-after-free for the bdi device config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250401/202504011531.jatxCuOT-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250401/202504011531.jatxCuOT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504011531.jatxCuOT-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> block/blk-cgroup.c:478:19: sparse: sparse: incompatible types in comparison expression (different address spaces): block/blk-cgroup.c:478:19: sparse: struct rcu_device [noderef] __rcu * block/blk-cgroup.c:478:19: sparse: struct rcu_device * block/blk-cgroup.c:816:5: sparse: sparse: context imbalance in 'blkg_conf_prep' - wrong count at exit block/blk-cgroup.c:1794: warning: Function parameter or member 'q' not described in 'blkcg_schedule_throttle' block/blk-cgroup.c:1794: warning: Function parameter or member 'use_memdelay' not described in 'blkcg_schedule_throttle' block/blk-cgroup.c:1819: warning: Function parameter or member 'blkg' not described in 'blkcg_add_delay' block/blk-cgroup.c:1819: warning: Function parameter or member 'now' not described in 'blkcg_add_delay' block/blk-cgroup.c:1819: warning: Function parameter or member 'delta' not described in 'blkcg_add_delay' vim +478 block/blk-cgroup.c 472 473 const char *blkg_dev_name(struct blkcg_gq *blkg) 474 { 475 /* some drivers (floppy) instantiate a queue w/o disk registered */ 476 struct rcu_device *rcu_dev; 477 > 478 rcu_dev = rcu_dereference(blkg->q->backing_dev_info->rcu_dev); 479 if (rcu_dev) 480 return dev_name(&rcu_dev->dev); 481 return NULL; 482 } 483 EXPORT_SYMBOL_GPL(blkg_dev_name); 484 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1544/1544] fs/proc/etmem_scan.c:1031: undefined reference to `proc_page_scan_operations'
by kernel test robot 01 Apr '25

01 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9866a4dd6fd198f871f6c1692e61ce7d10c96836 commit: bad4d8833739acc8eef306e7ad5c7877f9f4f0fb [1544/1544] etmem: add etmem-scan feature config: x86_64-randconfig-r113-20250401 (https://download.01.org/0day-ci/archive/20250401/202504011440.KymThb7O-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250401/202504011440.KymThb7O-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504011440.KymThb7O-lkp@intel.com/ All errors (new ones prefixed by >>): ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: .tmp_vmlinux1 has a LOAD segment with RWX permissions ld: fs/proc/etmem_scan.o: in function `page_scan_entry': >> fs/proc/etmem_scan.c:1031: undefined reference to `proc_page_scan_operations' >> ld: fs/proc/etmem_scan.c:1032: undefined reference to `proc_page_scan_operations' >> ld: fs/proc/etmem_scan.c:1031: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.c:1033: undefined reference to `proc_page_scan_operations' >> ld: fs/proc/etmem_scan.c:1032: undefined reference to `proc_page_scan_operations' ld: fs/proc/etmem_scan.o:fs/proc/etmem_scan.c:1034: more undefined references to `proc_page_scan_operations' follow vim +1031 fs/proc/etmem_scan.c 1028 1029 static int page_scan_entry(void) 1030 { > 1031 proc_page_scan_operations.owner = THIS_MODULE; > 1032 proc_page_scan_operations.read = page_scan_read; 1033 proc_page_scan_operations.open = page_scan_open; 1034 proc_page_scan_operations.release = page_scan_release; 1035 return 0; 1036 } 1037 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] tty: xilinx_uartps: split sysrq handling
by Yi Yang 01 Apr '25

01 Apr '25

From: Sean Anderson <sean.anderson(a)linux.dev> stable inclusion from stable-v6.6.78 commit 8ea0e7b3d7b8f2f0fc9db491ff22a0abe120801c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLKD CVE: CVE-2025-21820 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b06f388994500297bb91be60ffaf6825ecfd2afe upstream. lockdep detects the following circular locking dependency: CPU 0 CPU 1 ========================== ============================ cdns_uart_isr() printk() uart_port_lock(port) console_lock() cdns_uart_console_write() if (!port->sysrq) uart_port_lock(port) uart_handle_break() port->sysrq = ... uart_handle_sysrq_char() printk() console_lock() The fixed commit attempts to avoid this situation by only taking the port lock in cdns_uart_console_write if port->sysrq unset. However, if (as shown above) cdns_uart_console_write runs before port->sysrq is set, then it will try to take the port lock anyway. This may result in a deadlock. Fix this by splitting sysrq handling into two parts. We use the prepare helper under the port lock and defer handling until we release the lock. Fixes: 74ea66d4ca06 ("tty: xuartps: Improve sysrq handling") Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Cc: stable(a)vger.kernel.org # c980248179d: serial: xilinx_uartps: Use port lock wrappers Acked-by: John Ogness <john.ogness(a)linutronix.de> Link: https://lore.kernel.org/r/20250110213822.2107462-1-sean.anderson@linux.dev Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/serial/xilinx_uartps.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c index 2e5e86a00a77..7f83d2780017 100644 --- a/drivers/tty/serial/xilinx_uartps.c +++ b/drivers/tty/serial/xilinx_uartps.c @@ -268,7 +268,7 @@ static void cdns_uart_handle_rx(void *dev_id, unsigned int isrstatus) continue; } - if (uart_handle_sysrq_char(port, data)) + if (uart_prepare_sysrq_char(port, data)) continue; if (is_rxbs_support) { @@ -369,7 +369,7 @@ static irqreturn_t cdns_uart_isr(int irq, void *dev_id) !(readl(port->membase + CDNS_UART_CR) & CDNS_UART_CR_RX_DIS)) cdns_uart_handle_rx(dev_id, isrstatus); - spin_unlock(&port->lock); + uart_unlock_and_check_sysrq(port); return IRQ_HANDLED; } @@ -1229,10 +1229,8 @@ static void cdns_uart_console_write(struct console *co, const char *s, unsigned int imr, ctrl; int locked = 1; - if (port->sysrq) - locked = 0; - else if (oops_in_progress) - locked = spin_trylock_irqsave(&port->lock, flags); + if (oops_in_progress) + locked = uart_port_trylock_irqsave(port, &flags); else spin_lock_irqsave(&port->lock, flags); -- 2.25.1

2 1

[PATCH OLK-6.6] can: etas_es58x: fix potential NULL pointer dereference on udev->serial
by Yi Yang 01 Apr '25

01 Apr '25

From: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> stable inclusion from stable-v6.6.79 commit 1590667a60753ee5a54871f2840ceefd4a7831fa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8Y CVE: CVE-2025-21773 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a1ad2109ce41c9e3912dadd07ad8a9c640064ffb upstream. The driver assumed that es58x_dev->udev->serial could never be NULL. While this is true on commercially available devices, an attacker could spoof the device identity providing a NULL USB serial number. That would trigger a NULL pointer dereference. Add a check on es58x_dev->udev->serial before accessing it. Reported-by: yan kang <kangyan91(a)outlook.com> Reported-by: yue sun <samsun1006219(a)gmail.com> Closes: https://lore.kernel.org/linux-can/SY8P300MB0421E0013C0EBD2AA46BA709A1F42@SY… Fixes: 9f06631c3f1f ("can: etas_es58x: export product information through devlink_ops::info_get()") Signed-off-by: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> Link: https://patch.msgid.link/20250204154859.9797-2-mailhol.vincent@wanadoo.fr Cc: stable(a)vger.kernel.org Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/net/can/usb/etas_es58x/es58x_devlink.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/usb/etas_es58x/es58x_devlink.c b/drivers/net/can/usb/etas_es58x/es58x_devlink.c index 635edeb8f68c..e763a9904bed 100644 --- a/drivers/net/can/usb/etas_es58x/es58x_devlink.c +++ b/drivers/net/can/usb/etas_es58x/es58x_devlink.c @@ -248,7 +248,11 @@ static int es58x_devlink_info_get(struct devlink *devlink, return ret; } - return devlink_info_serial_number_put(req, es58x_dev->udev->serial); + if (es58x_dev->udev->serial) + ret = devlink_info_serial_number_put(req, + es58x_dev->udev->serial); + + return ret; } const struct devlink_ops es58x_dl_ops = { -- 2.25.1

2 1

[PATCH] perf/core: Fix pmus_lock vs. pmus_srcu ordering
by Luo Gengkun 01 Apr '25

01 Apr '25

From: Peter Zijlstra <peterz(a)infradead.org> stable inclusion from stable-v6.6.83 commit 7c823e4c30d6fdc16089e13924260086eaea76be category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBXQNU Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2565e42539b120b81a68a58da961ce5d1e34eac8 ] Commit a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") placed pmus_lock inside pmus_srcu, this makes perf_pmu_unregister() trip lockdep. Move the locking about such that only pmu_idr and pmus (list) are modified while holding pmus_lock. This avoids doing synchronize_srcu() while holding pmus_lock and all is well again. Fixes: a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20241104135517.679556858@infradead.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 0b9e703641d1..9b5d35c4a3ec 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -11670,6 +11670,8 @@ void perf_pmu_unregister(struct pmu *pmu) { mutex_lock(&pmus_lock); list_del_rcu(&pmu->entry); + idr_remove(&pmu_idr, pmu->type); + mutex_unlock(&pmus_lock); /* * We dereference the pmu list under both SRCU and regular RCU, so @@ -11679,7 +11681,6 @@ void perf_pmu_unregister(struct pmu *pmu) synchronize_rcu(); free_percpu(pmu->pmu_disable_count); - idr_remove(&pmu_idr, pmu->type); if (pmu_bus_running && pmu->dev && pmu->dev != PMU_NULL_DEV) { if (pmu->nr_addr_filters) device_remove_file(pmu->dev, &dev_attr_nr_addr_filters); @@ -11687,7 +11688,6 @@ void perf_pmu_unregister(struct pmu *pmu) put_device(pmu->dev); } free_pmu_context(pmu); - mutex_unlock(&pmus_lock); } EXPORT_SYMBOL_GPL(perf_pmu_unregister); -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] ext4: avoid updating the superblock on a r/o mount if not needed
by Yongjian Sun 01 Apr '25

01 Apr '25

From: Theodore Ts'o <tytso(a)mit.edu> mainline inclusion from mainline-v6.5-rc1 commit 2ef6c32a914b85217b44a0a2418e830e520b085e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBXUAV CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ This was noticed by a user who noticied that the mtime of a file backing a loopback device was getting bumped when the loopback device is mounted read/only. Note: This doesn't show up when doing a loopback mount of a file directly, via "mount -o ro /tmp/foo.img /mnt", since the loop device is set read-only when mount automatically creates loop device. However, this is noticeable for a LUKS loop device like this: % cryptsetup luksOpen /tmp/foo.img test % mount -o ro /dev/loop0 /mnt ; umount /mnt or, if LUKS is not in use, if the user manually creates the loop device like this: % losetup /dev/loop0 /tmp/foo.img % mount -o ro /dev/loop0 /mnt ; umount /mnt The modified mtime causes rsync to do a rolling checksum scan of the file on the local and remote side, incrementally increasing the time to rsync the not-modified-but-touched image file. Fixes: eee00237fa5e ("ext4: commit super block if fs record error when journal record without error") Cc: stable(a)kernel.org Link: https://lore.kernel.org/r/ZIauBR7YiV3rVAHL@glitch Reported-by: Sean Greenslade <sean(a)seangreenslade.com> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/super.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 8761fe5037a6..db47f5acf629 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5160,19 +5160,27 @@ static int ext4_load_journal(struct super_block *sb, err = jbd2_journal_wipe(journal, !really_read_only); if (!err) { char *save = kmalloc(EXT4_S_ERR_LEN, GFP_KERNEL); + __le16 orig_state; + bool changed = false; if (save) memcpy(save, ((char *) es) + EXT4_S_ERR_START, EXT4_S_ERR_LEN); err = jbd2_journal_load(journal); - if (save) + if (save && memcmp(((char *) es) + EXT4_S_ERR_START, + save, EXT4_S_ERR_LEN)) { memcpy(((char *) es) + EXT4_S_ERR_START, save, EXT4_S_ERR_LEN); + changed = true; + } kfree(save); + orig_state = es->s_state; es->s_state |= cpu_to_le16(EXT4_SB(sb)->s_mount_state & EXT4_ERROR_FS); + if (orig_state != es->s_state) + changed = true; /* Write out restored error information to the superblock */ - if (!bdev_read_only(sb->s_bdev)) { + if (changed && !really_read_only) { int err2; err2 = ext4_commit_super(sb); err = err ? : err2; -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] Merge March mainline patch
by Luo Gengkun 01 Apr '25

01 Apr '25

Breno Leitao (1): perf/core: Add RCU read lock protection to perf_iterate_ctx() Peter Zijlstra (1): perf/core: Fix pmus_lock vs. pmus_srcu ordering kernel/events/core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/3] *** CVE-2025-21823 ***
by Zicheng Qu 01 Apr '25

01 Apr '25

*** BLURB HERE *** Andy Strohman (1): batman-adv: fix panic during interface removal Sven Eckelmann (2): batman-adv: Ignore neighbor throughput metrics in error case batman-adv: Drop unmanaged ELP metric worker net/batman-adv/bat_v.c | 2 - net/batman-adv/bat_v_elp.c | 122 ++++++++++++++++++++++++++----------- net/batman-adv/bat_v_elp.h | 2 - net/batman-adv/types.h | 3 - 4 files changed, 86 insertions(+), 43 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/5] *** CVE-2025-21823 ***
by Zicheng Qu 01 Apr '25

01 Apr '25

*** BLURB HERE *** Andy Strohman (1): batman-adv: fix panic during interface removal Sven Eckelmann (4): batman-adv: Add new include for min/max helpers batman-adv: Drop initialization of flexible ethtool_link_ksettings batman-adv: Ignore neighbor throughput metrics in error case batman-adv: Drop unmanaged ELP metric worker net/batman-adv/bat_v.c | 3 +- net/batman-adv/bat_v_elp.c | 124 ++++++++++++++++++++++---------- net/batman-adv/bat_v_elp.h | 2 - net/batman-adv/bat_v_ogm.c | 1 + net/batman-adv/fragmentation.c | 2 +- net/batman-adv/hard-interface.c | 1 + net/batman-adv/icmp_socket.c | 1 + net/batman-adv/main.c | 1 + net/batman-adv/netlink.c | 1 + net/batman-adv/tp_meter.c | 1 + net/batman-adv/types.h | 3 - 11 files changed, 95 insertions(+), 45 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6 0/9] CVE-2024-50102
by Qi Xi 01 Apr '25

01 Apr '25

David Gow (1): x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit David Laight (1): x86: fix off-by-one in access_ok() Linus Torvalds (5): runtime constants: deal with old decrepit linkers runtime constants: add x86 architecture support x86: fix whitespace in runtime-const assembler output x86/uaccess: Improve the 8-byte getuser() case x86: fix user address masking non-canonical speculation issue Stephen Brennan (1): dcache: keep dentry_hashtable or d_hash_shift even when not used Thomas Gleixner (1): x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() arch/x86/include/asm/runtime-const.h | 61 +++++++++++++++++++++ arch/x86/include/asm/uaccess_64.h | 49 ++++++++++------- arch/x86/kernel/cpu/common.c | 10 ++++ arch/x86/kernel/vmlinux.lds.S | 4 ++ arch/x86/lib/getuser.S | 80 ++++++++++------------------ fs/dcache.c | 9 +++- include/asm-generic/vmlinux.lds.h | 7 +++ 7 files changed, 149 insertions(+), 71 deletions(-) create mode 100644 arch/x86/include/asm/runtime-const.h -- 2.33.0

2 10

[PATCH OLK-6.6 v3 0/8] Add support for IPIv
by Jinqian Yang 01 Apr '25

01 Apr '25

Patch#1 Allocate VM table and save vpeid in it Patch#2 avoid sending multi-SGIs in IPIV Patch#3 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#4 Register ipiv exception interrupt Patch#5 Add interface KVM_CAP_ARM_IPIV_MODE Patch#6 Probe and configure IPIV capacity on HIP12 Patch#7 Pre-allocate vpe id for direct mode Patch#8 Add support for ipiv direct mode Jinqian Yang (1): KVM: arm64: avoid sending multi-SGIs in IPIV Xiang Chen (7): kvm: hisi_virt: Allocate VM table and save vpeid in it irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Register ipiv exception interrupt kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 kvm: hisi_virt: Pre-allocate vpe id for direct mode kvm: hisi_virt: Add support for ipiv direct mode .../admin-guide/kernel-parameters.txt | 8 ++ arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kvm/arm.c | 21 ++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 42 +++++++ arch/arm64/kvm/hisilicon/hisi_virt.h | 11 ++ arch/arm64/kvm/sys_regs.c | 44 +++++-- arch/arm64/kvm/vgic/vgic-init.c | 84 ++++++++++++- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 + drivers/irqchip/irq-gic-v3-its.c | 114 ++++++++++++++++-- drivers/irqchip/irq-gic-v3.c | 42 +++++++ include/kvm/arm_vgic.h | 2 + include/linux/irqchip/arm-gic-v3.h | 24 ++++ include/linux/irqchip/arm-gic-v4.h | 3 + include/uapi/linux/kvm.h | 2 + 14 files changed, 380 insertions(+), 20 deletions(-) -- 2.33.0

2 9

[PATCH OLK-6.6 0/5] Some mainline patches merged into drivers/hwmon
by Lifeng Zheng 01 Apr '25

01 Apr '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some mainline patches merged into drivers/hwmon Huisong Li (4): hwmon: (acpi_power_meter) Fix fail to load module on platform without _PMD method hwmon: (acpi_power_meter) Fix uninitialized variables hwmon: (acpi_power_meter) Fix update the power trip points on failure hwmon: (acpi_power_meter) Fix the fake power alarm reporting Kazuhiro Abe (1): hwmon: (acpi_power_meter) Fix a check for the return value of read_domain_devices(). drivers/hwmon/acpi_power_meter.c | 46 +++++++++++++++++++++++++------- 1 file changed, 36 insertions(+), 10 deletions(-) -- 2.33.0

2 6

[PATCH OLK-6.6 0/2] CVE-2024-52560
by Yongjian Sun 31 Mar '25

31 Mar '25

Konstantin Komarov (2): [Backport] fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr() [Backport] fs/ntfs3: Unify inode corruption marking with _ntfs_bad_inode() fs/ntfs3/attrib.c | 13 ++++---- fs/ntfs3/dir.c | 2 +- fs/ntfs3/frecord.c | 71 +++++++++++++++++++++++-------------------- fs/ntfs3/fsntfs.c | 6 +++- fs/ntfs3/index.c | 6 ++-- fs/ntfs3/inode.c | 3 ++ fs/ntfs3/ntfs_fs.h | 21 ++++++------- fs/ntfs3/record.c | 75 ++++++++++++++++++++++++---------------------- 8 files changed, 107 insertions(+), 90 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] phy: qcom-qmp: fix reset-controller leak on probe errors
by Ye Bin 31 Mar '25

31 Mar '25

From: Johan Hovold <johan+linaro(a)kernel.org> stable inclusion from stable-v4.19.247 commit a39d9eccb333b8c07c43ebea1c6dfda122378a0f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP74Q CVE: CVE-2022-49396 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------- commit 4d2900f20edfe541f75756a00deeb2ffe7c66bc1 upstream. Make sure to release the lane reset controller in case of a late probe error (e.g. probe deferral). Note that due to the reset controller being defined in devicetree in "lane" child nodes, devm_reset_control_get_exclusive() cannot be used directly. Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets") Cc: stable(a)vger.kernel.org # 4.12 Cc: Vivek Gautam <vivek.gautam(a)codeaurora.org> Reviewed-by: Philipp Zabel <p.zabel(a)pengutronix.de> Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org> Reviewed-by: Bjorn Andersson <bjorn.andersson(a)linaro.org> Link: https://lore.kernel.org/r/20220427063243.32576-3-johan+linaro@kernel.org Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/phy/qualcomm/phy-qcom-qmp.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/phy/qualcomm/phy-qcom-qmp.c b/drivers/phy/qualcomm/phy-qcom-qmp.c index 4c470104a0d6..ae1b2847b52d 100644 --- a/drivers/phy/qualcomm/phy-qcom-qmp.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp.c @@ -1424,6 +1424,11 @@ static const struct phy_ops qcom_qmp_phy_gen_ops = { .owner = THIS_MODULE, }; +static void qcom_qmp_reset_control_put(void *data) +{ + reset_control_put(data); +} + static int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id) { @@ -1488,6 +1493,10 @@ int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id) dev_err(dev, "failed to get lane%d reset\n", id); return PTR_ERR(qphy->lane_rst); } + ret = devm_add_action_or_reset(dev, qcom_qmp_reset_control_put, + qphy->lane_rst); + if (ret) + return ret; } generic_phy = devm_phy_create(dev, np, &qcom_qmp_phy_gen_ops); -- 2.34.1

2 1

[PATCH OLK-6.6 v2 0/8] Add support for IPIv
by Jinqian Yang 31 Mar '25

31 Mar '25

Patch#1 Allocate VM table and save vpeid in it Patch#2 avoid sending multi-SGIs in IPIV Patch#3 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#4 Register ipiv exception interrupt Patch#5 Add interface KVM_CAP_ARM_IPIV_MODE Patch#6 Probe and configure IPIV capacity on HIP12 Patch#7 Pre-allocate vpe id for direct mode Patch#8 Add support for ipiv direct mode Xiang Chen (7): kvm: hisi_virt: Allocate VM table and save vpeid in it irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Register ipiv exception interrupt kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 kvm: hisi_virt: Pre-allocate vpe id for direct mode kvm: hisi_virt: Add support for ipiv direct mode yangjinqian (1): KVM: arm64: avoid sending multi-SGIs in IPIV .../admin-guide/kernel-parameters.txt | 8 ++ arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kvm/arm.c | 21 ++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 42 +++++++ arch/arm64/kvm/hisilicon/hisi_virt.h | 11 ++ arch/arm64/kvm/sys_regs.c | 44 +++++-- arch/arm64/kvm/vgic/vgic-init.c | 84 ++++++++++++- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 + drivers/irqchip/irq-gic-v3-its.c | 114 ++++++++++++++++-- drivers/irqchip/irq-gic-v3.c | 42 +++++++ include/kvm/arm_vgic.h | 2 + include/linux/irqchip/arm-gic-v3.h | 24 ++++ include/linux/irqchip/arm-gic-v4.h | 3 + include/uapi/linux/kvm.h | 2 + 14 files changed, 380 insertions(+), 20 deletions(-) -- 2.33.0

2 9

[PATCH openEuler-testcase] TEST: add Dynamic Memory Bandwidth Regulator and Tracer
by Zeng Heng 31 Mar '25

31 Mar '25

Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- bw_dynamic.py | 184 ++++++++++++++++++++++++++++++++++++++++++++++ calc_cpu_usage.py | 27 +++++++ draw_bw.py | 105 ++++++++++++++++++++++++++ draw_cpu.py | 34 +++++++++ draw_llc.py | 66 +++++++++++++++++ pidcontroller.py | 35 +++++++++ 6 files changed, 451 insertions(+) create mode 100644 bw_dynamic.py create mode 100644 calc_cpu_usage.py create mode 100644 draw_bw.py create mode 100644 draw_cpu.py create mode 100644 draw_llc.py create mode 100644 pidcontroller.py diff --git a/bw_dynamic.py b/bw_dynamic.py new file mode 100644 index 000000000000..51509928aef0 --- /dev/null +++ b/bw_dynamic.py @@ -0,0 +1,184 @@ +import os, time, signal, json, sys +from pidcontroller import PIDController +from calc_cpu_usage import read_cpu_times, calculate_cpu_utilization + +numa_bw_limit = 80000 +lc_grp = "." +be_grp = "p1" + +bw_list = [] +llc_list = [] +set_list = [] +cpu_list = [] + +def read_bw(grp): + resctrl_mon_data_dir = '/sys/fs/resctrl/%s/mon_data/' % grp + mon_data_dirs = os.listdir(resctrl_mon_data_dir) + mon_MB_dirs = [dir for dir in mon_data_dirs if dir.startswith('mon_MB_')] + + vals = [] + for mb_dir in mon_MB_dirs: + with open(resctrl_mon_data_dir + mb_dir + '/mbm_total_bytes', 'r') as f: + line = f.readline() + vals.append(int(line.strip())) + + return vals + +def increase_bw(i, percent): + print("increase NUMA%d %d%%" % (i, percent)) + + resctrl_par_dir = '/sys/fs/resctrl/%s/schemata' % be_grp + with open(resctrl_par_dir, 'r') as f: + lines = f.readlines() + + for line in lines: + if "MB:" in line: + config = line.split(":") + config = config[1].split(";") + origin_p = int(config[i].split("=")[1]) + + new_p = (origin_p + percent) + if new_p > 100: + new_p = 100 + elif new_p < 8: + new_p = 8 + + # if percent < 0: + # cnt = "MBHDL:%d=1\n" % i + # with open(resctrl_par_dir, 'w+') as f: + # f.write(cnt) + + cnt = "MB:%d=%d" % (i, new_p) + print("%s<=%d" % (cnt, origin_p)) + if new_p == origin_p: + return origin_p + + with open(resctrl_par_dir, 'w+') as f: + f.write("%s\n" % cnt) + + return origin_p + +def gain_numa_bw(pid_ctl, adjust_enable, target_percent): + lc_val = read_bw(lc_grp) + be_val = read_bw(be_grp) + + numa_bw_state = [] + numa_set = [] + + for i in range(len(lc_val)): + bw_state = {"total_bw": {}, "lc_bw": {}, "be_bw": {}} + + bw_sum = lc_val[i] + be_val[i] + + bw_state["total_bw"] = bw_sum + bw_state["lc_bw"] = lc_val[i] + bw_state["be_bw"] = be_val[i] + numa_bw_state.append(bw_state) + + set_state = {"setting": {}, "delta": {}} + + if adjust_enable == True: + if bw_state["lc_bw"] < (0.04 * numa_bw_limit): + # enlarge BE load + diff = 5 + elif bw_state["lc_bw"] > (target_percent / 100 * numa_bw_limit): + # shutdown BE load + diff = -100 + else: + diff = pid_ctl[i].update(bw_sum * 100 // numa_bw_limit , 1) + else: + diff = 0 + + curr = increase_bw(i, diff) + set_state['setting'] = curr + set_state['delta'] = diff + + numa_set.append(set_state) + + bw_list.append(numa_bw_state) + set_list.append(numa_set) + return + +def read_llc(grp): + resctrl_mon_data_dir = '/sys/fs/resctrl/%s/mon_data/' % grp + mon_data_dirs = os.listdir(resctrl_mon_data_dir) + mon_MB_dirs = [dir for dir in mon_data_dirs if dir.startswith('mon_L3_')] + + vals = [] + for mb_dir in mon_MB_dirs: + with open(resctrl_mon_data_dir + mb_dir + '/llc_occupancy', 'r') as f: + line = f.readline() + vals.append(int(line.strip())) + + return vals + +def gain_numa_llc(): + lc_llc = read_llc(lc_grp) + be_llc = read_llc(be_grp) + + numa_llc_state = [] + + for i in range(len(lc_llc)): + llc_state = {"total_llc": {}, "lc_llc": {}, "be_llc": {}} + + total_llc = lc_llc[i] + be_llc[i] + llc_state["total_llc"] = total_llc + + llc_state["lc_llc"] = lc_llc[i] + llc_state["be_llc"] = be_llc[i] + numa_llc_state.append(llc_state) + + llc_list.append(numa_llc_state) + return + +def gain_cpu(time1, time2): + usage = calculate_cpu_utilization(time1, time2) + print(f"CPU usage: {usage:.2f}%") + cpu_list.append(usage) + return + +def save_file(sig, frame): + with open(f"ctrlgrp_bw.data", 'w') as fl: + json.dump(bw_list, fl) + + with open(f"schemata_set.data", 'w') as fl: + json.dump(set_list, fl) + + with open(f"ctrlgrp_llc.data", 'w') as fl: + json.dump(llc_list, fl) + + with open(f"cpu_usage.data", 'w') as fl: + json.dump(cpu_list, fl) + + exit(0) + +if __name__ == "__main__": + signal.signal(signal.SIGINT, save_file) + + enable = True + target_percent = 60 + + num_args = len(sys.argv) - 1 + if num_args == 1 and sys.argv[1].isdigit(): + target_percent = int(sys.argv[1]) + else: + enable = False + + pid_ctl = [] + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + + time1 = read_cpu_times() + + while True: + gain_numa_bw(pid_ctl, enable, target_percent) + gain_numa_llc() + + time2 = read_cpu_times() + gain_cpu(time1, time2) + time1 = time2 + + print("..........................") + time.sleep(1) diff --git a/calc_cpu_usage.py b/calc_cpu_usage.py new file mode 100644 index 000000000000..98fef7a2c1f5 --- /dev/null +++ b/calc_cpu_usage.py @@ -0,0 +1,27 @@ +import time + +def read_cpu_times(): + with open('/proc/stat', 'r') as f: + line = f.readline() + parts = line.split() + return list(map(int, parts[1:])) + +def calculate_cpu_utilization(times1, times2): + total1 = sum(times1) + idle1 = times1[3] + total2 = sum(times2) + idle2 = times2[3] + total_diff = total2 - total1 + idle_diff = idle2 - idle1 + return (total_diff - idle_diff) / total_diff * 100 + +# def gain_cpu(time1, time2): +# usage = calculate_cpu_utilization(time1, time2) +# print(f"CPU usage: {usage:.2f}%") +# return time2 + +# time1 = read_cpu_times() +# while True: +# time.sleep(1) +# time2 = read_cpu_times() +# time1 = gain_cpu(time1, time2) diff --git a/draw_bw.py b/draw_bw.py new file mode 100644 index 000000000000..17f28842cbcc --- /dev/null +++ b/draw_bw.py @@ -0,0 +1,105 @@ +import json +import matplotlib.pyplot as plt + +target_percent = 60 / 100 +bw_limit = target_percent * 80000 + +def get_all_bw(data_list, idx): + total = [] + lc = [] + be = [] + + for data in data_list: + total.append(data[idx]['total_bw']) + lc.append(data[idx]['lc_bw']) + be.append(data[idx]['be_bw']) + + return total, lc, be + +def get_all_set(set_list, idx): + setting = [] + delta = [] + + for data in set_list: + setting.append(data[idx]['setting']) + delta.append(data[idx]['delta']) + + return setting, delta + +def draw_data(bw_list, set_list, cpu_list): + fig = plt.figure() + x_arr = list(range(len(bw_list))) + + # numa_cnt = len(bw_list[0]) + # only draw numa1 + numa_cnt_display = 1 + numa_th = 1 + for cnt in range(numa_cnt_display): + ax1 = fig.add_subplot(numa_cnt_display * 2 + 1, 1, cnt * 2 + 1) + # total, lc, be = get_all_bw(bw_list, cnt) + total, lc, be = get_all_bw(bw_list, numa_th) + ref = [bw_limit] * len(bw_list) + + ax1.plot(x_arr, total, label='total bw') + ax1.plot(x_arr, lc, label='lc bw') + ax1.plot(x_arr, be, label='be bw') + ax1.plot(x_arr, ref, label='reference') + ax1.legend() + + ax2 = fig.add_subplot(numa_cnt_display * 2 + 1, 1, cnt * 2 + 2) + # setting, delta = get_all_set(set_list, cnt) + setting, delta = get_all_set(set_list, numa_th) + + ref = [0] * len(bw_list) + ax2.plot(x_arr, setting, label='setting') + ax2.plot(x_arr, delta, label='delta') + ax2.plot(x_arr, ref, label='reference') + ax2.legend() + + # ax3 = fig.add_subplot(5, 1, 3) + # total, lc, be = get_all_bw(bw_list, 1) + + # ax3.plot(x_arr, total, label='total bw') + # ax3.plot(x_arr, lc, label='lc bw') + # ax3.plot(x_arr, be, label='be bw') + # ax3.plot(x_arr, ref, label='reference') + # ax3.legend() + + # ax4 = fig.add_subplot(5, 1, 4) + # setting, delta = get_all_set(set_list, 1) + + # ax4.plot(x_arr, setting, label='setting') + # ax4.plot(x_arr, delta, label='delta') + # ax4.legend() + + ax5 = fig.add_subplot(numa_cnt_display * 2 + 1, 1, numa_cnt_display * 2 + 1) + + ax5.plot(x_arr, cpu_list, label='CPU usage') + ax5.legend() + + plt.tight_layout() + plt.show() + + return + +def get_data(file): + try: + with open(file, 'r') as f: + data_list = json.load(f) + except FileNotFoundError: + return None + + return data_list + +if __name__ == '__main__': + filename = 'ctrlgrp_bw.data' + bw_list = get_data(filename) + filename = 'schemata_set.data' + set_list = get_data(filename) + filename = 'cpu_usage.data' + cpu_list = get_data(filename) + + if bw_list and set_list: + draw_data(bw_list, set_list, cpu_list) + else: + print('FileNotFound') diff --git a/draw_cpu.py b/draw_cpu.py new file mode 100644 index 000000000000..02e5b0e48376 --- /dev/null +++ b/draw_cpu.py @@ -0,0 +1,34 @@ +import json +import matplotlib.pyplot as plt + +def draw_data(cpu_list): + fig = plt.figure() + x_arr = list(range(len(cpu_list))) + + ax1 = fig.add_subplot(1, 1, 1) + + ax1.plot(x_arr, cpu_list, label='CPU usage') + ax1.legend() + + plt.tight_layout() + plt.show() + + return + +def get_data(file): + try: + with open(file, 'r') as f: + cpu_list = json.load(f) + except FileNotFoundError: + return None + + return cpu_list + +if __name__ == '__main__': + filename = 'cpu_usage.data' + cpu_list = get_data(filename) + + if cpu_list: + draw_data(cpu_list) + else: + print('FileNotFound') diff --git a/draw_llc.py b/draw_llc.py new file mode 100644 index 000000000000..7538eac3925d --- /dev/null +++ b/draw_llc.py @@ -0,0 +1,66 @@ +import json +import matplotlib.pyplot as plt + +def get_all_llc(data_list, idx): + total = [] + lc = [] + be = [] + + for data in data_list: + total.append(data[idx]['total_llc'] / 1000) + lc.append(data[idx]['lc_llc'] / 1000) + be.append(data[idx]['be_llc'] / 1000) + + return total, lc, be + +def draw_data(llc_list, cpu_list): + fig = plt.figure() + x_arr = list(range(len(llc_list))) + + # only draw numa1 + numa_cnt_display = 1 + numa_th = 0 + for cnt in range(numa_cnt_display): + ax1 = fig.add_subplot(numa_cnt_display + 1, 1, cnt + 1) + total, lc, be = get_all_llc(llc_list, numa_th) + + ax1.plot(x_arr, total, label='total llc') + ax1.plot(x_arr, lc, label='lc llc') + ax1.plot(x_arr, be, label='be llc') + + ax1.set_ylabel(f"L3 Cache (kB)") + ax1.set_xlabel(f"Time (s)") + ax1.legend() + + ax2 = fig.add_subplot(numa_cnt_display + 1, 1, numa_cnt_display + 1) + ax2.plot(x_arr, cpu_list, label='CPU usage') + + ax2.set_ylabel(f"CPU Load (%)") + ax2.set_xlabel(f"Time (s)") + + ax2.legend() + + plt.tight_layout() + plt.show() + + return + +def get_data(file): + try: + with open(file, 'r') as f: + data_list = json.load(f) + except FileNotFoundError: + return None + + return data_list + +if __name__ == '__main__': + filename = 'ctrlgrp_llc.data' + llc_list = get_data(filename) + filename = 'cpu_usage.data' + cpu_list = get_data(filename) + + if llc_list: + draw_data(llc_list, cpu_list) + else: + print('FileNotFound') diff --git a/pidcontroller.py b/pidcontroller.py new file mode 100644 index 000000000000..4d03d2f28aa1 --- /dev/null +++ b/pidcontroller.py @@ -0,0 +1,35 @@ +class PIDController: + def __init__(self, kp, ki, kd, set_point): + self.kp = kp # 比例增益 + self.ki = ki # 积分增益 + self.kd = kd # 微分增益 + self.set_point = set_point # 设定值 + self.last_error = 0 # 上一次的误差 + self.integral = 0 # 积分项 + + self.max_output = 5 # 缓升 + self.min_output = -100 # 快降 + + def update(self, current_value, dt): + """ + 更新PID控制器的输出 + :param current_value: 当前系统的输出值 + :param dt: 时间间隔 + :return: 控制器的输出 + """ + error = self.set_point - current_value # 计算当前误差 + self.integral += error * dt # 更新积分项 + derivative = (error - self.last_error) / dt # 计算微分项 + + # 计算PID控制器的输出 + output = (self.kp * error) + (self.ki * self.integral) + (self.kd * derivative) + + self.last_error = error # 更新上一次的误差 + + # 限制输出范围 + if output > self.max_output: + output = self.max_output + elif output < self.min_output: + output = self.min_output + + return output -- 2.25.1

1 0

[openeuler:openEuler-1.0-LTS 1541/1541] kernel/trace/.tmp_trace_output.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 31 Mar '25

31 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c09d565ea3e651c408ca3d0e0c2499e5e90a77ae commit: 31bf327231bb582ec7dca0490cc90c364b36e095 [1541/1541] tracing: Make sure trace_printk() can output as soon as it can be used config: x86_64-buildonly-randconfig-003-20250331 (https://download.01.org/0day-ci/archive/20250331/202503312102.s1xJYVFA-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503312102.s1xJYVFA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503312102.s1xJYVFA-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/trace/.tmp_trace_output.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-testcase] TEST: add Dynamic Memory Bandwidth Regulator and Tracer
by Zeng Heng 31 Mar '25

31 Mar '25

Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- bw_dynamic.py | 184 ++++++++++++++++++++++++++++++++++++++++++++++ calc_cpu_usage.py | 27 +++++++ draw_bw.py | 105 ++++++++++++++++++++++++++ draw_cpu.py | 34 +++++++++ pidcontroller.py | 35 +++++++++ 5 files changed, 385 insertions(+) create mode 100644 bw_dynamic.py create mode 100644 calc_cpu_usage.py create mode 100644 draw_bw.py create mode 100644 draw_cpu.py create mode 100644 pidcontroller.py diff --git a/bw_dynamic.py b/bw_dynamic.py new file mode 100644 index 000000000000..fff0a389094a --- /dev/null +++ b/bw_dynamic.py @@ -0,0 +1,184 @@ +import os, time, signal, json, sys +from pidcontroller import PIDController +from calc_cpu_usage import read_cpu_times, calculate_cpu_utilization + +numa_bw_limit = 80000 +lc_grp = "." +be_grp = "p1" + +bw_list = [] +llc_list = [] +set_list = [] +cpu_list = [] + +def read_bw(grp): + resctrl_mon_data_dir = '/sys/fs/resctrl/%s/mon_data/' % grp + mon_data_dirs = os.listdir(resctrl_mon_data_dir) + mon_MB_dirs = [dir for dir in mon_data_dirs if dir.startswith('mon_MB_')] + + vals = [] + for mb_dir in mon_MB_dirs: + with open(resctrl_mon_data_dir + mb_dir + '/mbm_total_bytes', 'r') as f: + line = f.readline() + vals.append(int(line.strip())) + + return vals + +def increase_bw(i, percent): + print("increase NUMA%d %d%%" % (i, percent)) + + resctrl_par_dir = '/sys/fs/resctrl/%s/schemata' % be_grp + with open(resctrl_par_dir, 'r') as f: + lines = f.readlines() + + for line in lines: + if "MB:" in line: + config = line.split(":") + config = config[1].split(";") + origin_p = int(config[i].split("=")[1]) + + new_p = (origin_p + percent) + if new_p > 100: + new_p = 100 + elif new_p < 8: + new_p = 8 + + # if percent < 0: + # cnt = "MBHDL:%d=1\n" % i + # with open(resctrl_par_dir, 'w+') as f: + # f.write(cnt) + + cnt = "MB:%d=%d" % (i, new_p) + print("%s<=%d" % (cnt, origin_p)) + if new_p == origin_p: + return origin_p + + with open(resctrl_par_dir, 'w+') as f: + f.write("%s\n" % cnt) + + return origin_p + +def gain_numa_bw(pid_ctl, adjust_enable, target_percent): + lc_val = read_bw(lc_grp) + be_val = read_bw(be_grp) + + numa_bw_state = [] + numa_set = [] + + for i in range(len(lc_val)): + bw_state = {"total_bw": {}, "lc_bw": {}, "be_bw": {}} + + bw_sum = lc_val[i] + be_val[i] + + bw_state["total_bw"] = bw_sum + bw_state["lc_bw"] = lc_val[i] + bw_state["be_bw"] = be_val[i] + numa_bw_state.append(bw_state) + + set_state = {"setting": {}, "delta": {}} + + if adjust_enable == True: + if bw_state["lc_bw"] < (0.04 * numa_bw_limit): + # enlarge BE load + diff = 5 + elif bw_state["lc_bw"] > (target_percent / 100 * numa_bw_limit): + # shutdown BE load + diff = -100 + else: + diff = pid_ctl[i].update(bw_sum * 100 // numa_bw_limit , 1) + else: + diff = 0 + + curr = increase_bw(i, diff) + set_state['setting'] = curr + set_state['delta'] = diff + + numa_set.append(set_state) + + bw_list.append(numa_bw_state) + set_list.append(numa_set) + return + +def read_llc(grp): + resctrl_mon_data_dir = '/sys/fs/resctrl/%s/mon_data/' % grp + mon_data_dirs = os.listdir(resctrl_mon_data_dir) + mon_MB_dirs = [dir for dir in mon_data_dirs if dir.startswith('mon_L3_')] + + vals = [] + for mb_dir in mon_MB_dirs: + with open(resctrl_mon_data_dir + mb_dir + '/llc_occupancy', 'r') as f: + line = f.readline() + vals.append(int(line.strip())) + + return vals + +def gain_numa_llc(): + lc_llc = read_llc(lc_grp) + be_llc = read_llc(be_grp) + + numa_llc_state = [] + + for i in range(len(lc_llc)): + llc_state = {"total_llc": {}, "lc_llc": {}, "be_llc": {}} + + total_llc = lc_llc[i] + be_llc[i] + llc_state["total_llc"] = total_llc + + llc_state["lc_llc"] = lc_llc[i] + llc_state["be_llc"] = be_llc[i] + numa_llc_state.append(llc_state) + + llc_list.append(numa_llc_state) + return + +def gain_cpu(time1, time2): + usage = calculate_cpu_utilization(time1, time2) + print(f"CPU usage: {usage:.2f}%") + cpu_list.append(usage) + return + +def save_file(sig, frame): + with open(f"ctrlgrp_bw.data", 'w') as fl: + json.dump(bw_list, fl) + + with open(f"schemata_set.data", 'w') as fl: + json.dump(set_list, fl) + + with open(f"ctrlgrp_llc.data", 'w') as fl: + json.dump(llc_list, fl) + + with open(f"cpu_usage.data", 'w') as fl: + json.dump(cpu_list, fl) + + exit(0) + +if __name__ == "__main__": + signal.signal(signal.SIGINT, save_file) + + enable = True + target_percent = 60 + + num_args = len(sys.argv) - 1 + if num_args == 1 and sys.argv[1].isdigit(): + target_percent = int(sys.argv[1]) + else: + enable = False + + pid_ctl = [] + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + + time1 = read_cpu_times() + + while True: + gain_numa_bw(pid_ctl, enable, target_percent) + gain_numa_llc() + + time2 = read_cpu_times() + gain_cpu(time1, time2) + time1 = time2 + + print("..........................") + time.sleep(1) diff --git a/calc_cpu_usage.py b/calc_cpu_usage.py new file mode 100644 index 000000000000..98fef7a2c1f5 --- /dev/null +++ b/calc_cpu_usage.py @@ -0,0 +1,27 @@ +import time + +def read_cpu_times(): + with open('/proc/stat', 'r') as f: + line = f.readline() + parts = line.split() + return list(map(int, parts[1:])) + +def calculate_cpu_utilization(times1, times2): + total1 = sum(times1) + idle1 = times1[3] + total2 = sum(times2) + idle2 = times2[3] + total_diff = total2 - total1 + idle_diff = idle2 - idle1 + return (total_diff - idle_diff) / total_diff * 100 + +# def gain_cpu(time1, time2): +# usage = calculate_cpu_utilization(time1, time2) +# print(f"CPU usage: {usage:.2f}%") +# return time2 + +# time1 = read_cpu_times() +# while True: +# time.sleep(1) +# time2 = read_cpu_times() +# time1 = gain_cpu(time1, time2) diff --git a/draw_bw.py b/draw_bw.py new file mode 100644 index 000000000000..c2c309ea1fd9 --- /dev/null +++ b/draw_bw.py @@ -0,0 +1,105 @@ +import json +import matplotlib.pyplot as plt + +target_percent = 60 / 100 +bw_limit = target_percent * 80000 + +def get_all_bw(data_list, idx): + total = [] + lc = [] + be = [] + + for data in data_list: + total.append(data[idx]['total_bw']) + lc.append(data[idx]['lc_bw']) + be.append(data[idx]['be_bw']) + + return total, lc, be + +def get_all_set(set_list, idx): + setting = [] + delta = [] + + for data in set_list: + setting.append(data[idx]['setting']) + delta.append(data[idx]['delta']) + + return setting, delta + +def draw_data(bw_list, set_list, cpu_list): + fig = plt.figure() + x_arr = list(range(len(bw_list))) + + # numa_cnt = len(bw_list[0]) + # only draw numa1 + numa_cnt_display = 1 + numa_th = 1 + for cnt in range(numa_cnt_display): + ax1 = fig.add_subplot(numa_cnt_display * 2 + 1, 1, cnt * 2 + 1) + # total, lc, be = get_all_bw(bw_list, cnt) + total, lc, be = get_all_bw(bw_list, numa_th) + ref = [bw_limit] * len(bw_list) + + ax1.plot(x_arr, total, label='total bw') + ax1.plot(x_arr, lc, label='lc bw') + ax1.plot(x_arr, be, label='be bw') + ax1.plot(x_arr, ref, label='reference') + ax1.legend() + + ax2 = fig.add_subplot(numa_cnt_display * 2 + 1, 1, cnt * 2 + 2) + # setting, delta = get_all_set(set_list, cnt) + setting, delta = get_all_set(set_list, numa_th) + + ref = [0] * len(bw_list) + ax2.plot(x_arr, setting, label='setting') + ax2.plot(x_arr, delta, label='delta') + ax2.plot(x_arr, ref, label='reference') + ax2.legend() + + # ax3 = fig.add_subplot(5, 1, 3) + # total, lc, be = get_all_bw(bw_list, 1) + + # ax3.plot(x_arr, total, label='total bw') + # ax3.plot(x_arr, lc, label='lc bw') + # ax3.plot(x_arr, be, label='be bw') + # ax3.plot(x_arr, ref, label='reference') + # ax3.legend() + + # ax4 = fig.add_subplot(5, 1, 4) + # setting, delta = get_all_set(set_list, 1) + + # ax4.plot(x_arr, setting, label='setting') + # ax4.plot(x_arr, delta, label='delta') + # ax4.legend() + + ax5 = fig.add_subplot(numa_cnt_display * 2 + 1, 1, numa_cnt_display * 2 + 1) + + ax5.plot(x_arr, cpu_list, label='CPU usage') + ax5.legend() + + plt.tight_layout() + plt.show() + + return + +def get_data(file): + try: + with open(file, 'r') as f: + data_list = json.load(f) + except FileNotFoundError: + return None + + return data_list + +if __name__ == '__main__': + filename = 'ctrlgrp_bw.data' + bw_list = get_data(filename) + filename = 'schemata_set.data' + set_list = get_data(filename) + filename = 'cpu_usage.data' + cpu_list = get_data(filename) + + if bw_list and set_list: + draw_data(bw_list, set_list, cpu_list) + else: + print('FileNotFound') diff --git a/draw_cpu.py b/draw_cpu.py new file mode 100644 index 000000000000..e69cf24b6b08 --- /dev/null +++ b/draw_cpu.py @@ -0,0 +1,34 @@ +import json +import matplotlib.pyplot as plt + +def draw_data(cpu_list): + fig = plt.figure() + x_arr = list(range(len(cpu_list))) + + ax1 = fig.add_subplot(1, 1, 1) + + ax1.plot(x_arr, cpu_list, label='CPU usage') + ax1.legend() + + plt.tight_layout() + plt.show() + + return + +def get_data(file): + try: + with open(file, 'r') as f: + cpu_list = json.load(f) + except FileNotFoundError: + return None + + return cpu_list + +if __name__ == '__main__': + filename = 'cpu_usage.data' + cpu_list = get_data(filename) + + if cpu_list: + draw_data(cpu_list) + else: + print('FileNotFound') diff --git a/pidcontroller.py b/pidcontroller.py new file mode 100644 index 000000000000..d67f9d2ad10c --- /dev/null +++ b/pidcontroller.py @@ -0,0 +1,35 @@ +class PIDController: + def __init__(self, kp, ki, kd, set_point): + self.kp = kp # 比例增益 + self.ki = ki # 积分增益 + self.kd = kd # 微分增益 + self.set_point = set_point # 设定值 + self.last_error = 0 # 上一次的误差 + self.integral = 0 # 积分项 + + self.max_output = 5 # 缓升 + self.min_output = -100 # 快降 + + def update(self, current_value, dt): + """ + 更新PID控制器的输出 + :param current_value: 当前系统的输出值 + :param dt: 时间间隔 + :return: 控制器的输出 + """ + error = self.set_point - current_value # 计算当前误差 + self.integral += error * dt # 更新积分项 + derivative = (error - self.last_error) / dt # 计算微分项 + + # 计算PID控制器的输出 + output = (self.kp * error) + (self.ki * self.integral) + (self.kd * derivative) + + self.last_error = error # 更新上一次的误差 + + # 限制输出范围 + if output > self.max_output: + output = self.max_output + elif output < self.min_output: + output = self.min_output + + return output -- 2.25.1

1 0

[PATCH OLK-6.6] vhost/vdpa: Add support to bind, unbind, attach and detach iommufd
by frenkjason 31 Mar '25

31 Mar '25

From: frankyj915 <yangjieyj.yang(a)huawei.com> VHOST_VDPA_BIND_IOMMUFD, VHOST_VDPA_UNBIND_IOMMUFD, VHOST_VDPA_ATTACH_IOMMUFD_PT and VHOST_VDPA_DETACH_IOMMUFD_PT are introduced. Signed-off-by: frankyj915 <yangjieyj.yang(a)huawei.com> --- drivers/vhost/vdpa.c | 105 +++++++++++++++++++++++++++++++ include/uapi/linux/vhost.h | 28 +++++++++ include/uapi/linux/vhost_types.h | 5 ++ tools/include/uapi/linux/vhost.h | 28 +++++++++ 4 files changed, 166 insertions(+) diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index ef7009a9d5ec..6d18e8cca2f0 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -22,9 +22,12 @@ #include <linux/vdpa.h> #include <linux/nospec.h> #include <linux/vhost.h> +#include <linux/iommufd.h> #include "vhost.h" +MODULE_IMPORT_NS(IOMMUFD); + enum { VHOST_VDPA_BACKEND_FEATURES = (1ULL << VHOST_BACKEND_F_IOTLB_MSG_V2) | @@ -60,6 +63,8 @@ struct vhost_vdpa { int in_batch; struct vdpa_iova_range range; u32 batch_asid; + struct iommufd_device *iommufd_dev; + bool iommufd_attached; }; static DEFINE_IDA(vhost_vdpa_ida); @@ -569,6 +574,89 @@ static long vhost_vdpa_resume(struct vhost_vdpa *v) return ops->resume(vdpa); } +static long vhost_vdpa_bind_iommufd(struct vhost_vdpa *v, int __user *argp) +{ + struct vhost_vdpa_bind_iommufd bind; + struct iommufd_ctx *iommufd_ctx; + struct iommufd_device *idev; + struct device *dma_dev = vdpa_get_dma_dev(v->vdpa); + struct iommu_group *iommu_group = iommu_group_get(dma_dev); + int ret; + + if (copy_from_user(&bind, argp, sizeof(bind))) + return -EFAULT; + + iommufd_ctx = iommufd_ctx_from_fd(bind.iommufd); + if (IS_ERR(iommufd_ctx)) + return PTR_ERR(iommufd_ctx); + + if (v->domain) { + iommu_detach_device(v->domain, dma_dev); + iommu_domain_free(v->domain); + v->domain = NULL; + } + + // Default iommu domain is created when vdpa device driver probes. + // Unuse default domain first to avoid failure when claiming dma owner. + if (dma_dev->bus && dma_dev->bus->dma_cleanup) + dma_dev->bus->dma_cleanup(dma_dev); + ret = iommu_group_claim_dma_owner(iommu_group, iommufd_ctx); + if (ret) + return ret; + + idev = iommufd_device_bind(iommufd_ctx, dma_dev, &bind.out_devid); + if (IS_ERR(idev)) + return PTR_ERR(idev); + v->iommufd_dev = idev; + + if (copy_to_user(argp, &bind, sizeof(bind))) + return -EFAULT; + return 0; +} + +static long vhost_vdpa_attach_iommufd_pt(struct vhost_vdpa *v, u32 __user *argp) +{ + u32 pt_id = 0; + int ret; + + if (copy_from_user(&pt_id, argp, sizeof(pt_id))) + return -EFAULT; + + ret = iommufd_device_attach(v->iommufd_dev, &pt_id); + if (ret) + return ret; + v->iommufd_attached = true; + + if (copy_to_user(argp, &pt_id, sizeof(pt_id))) + return -EFAULT; + return 0; +} + +static void vhost_vdpa_detach_iommufd_pt(struct vhost_vdpa *v) +{ + if (WARN_ON(!v->iommufd_dev) || !v->iommufd_attached) + return; + + iommufd_device_detach(v->iommufd_dev); + v->iommufd_attached = false; +} + +static void vhost_vdpa_unbind_iommufd(struct vhost_vdpa *v) +{ + struct device *dma_dev = vdpa_get_dma_dev(v->vdpa); + struct iommu_group *iommu_group = iommu_group_get(dma_dev); + + if (!v->iommufd_dev) + return; + + vhost_vdpa_detach_iommufd_pt(v); + iommufd_device_unbind(v->iommufd_dev); + v->iommufd_dev = NULL; + iommu_group_release_dma_owner(iommu_group); + if (dma_dev->bus && dma_dev->bus->dma_configure) + dma_dev->bus->dma_configure(dma_dev); +} + #ifdef CONFIG_VHOST_VDPA_MIGRATION static int vhost_vdpa_get_dev_buffer_size(struct vhost_vdpa *v, uint32_t __user *argp) @@ -916,6 +1004,18 @@ static long vhost_vdpa_unlocked_ioctl(struct file *filep, case VHOST_VDPA_RESUME: r = vhost_vdpa_resume(v); break; + case VHOST_VDPA_BIND_IOMMUFD: + r = vhost_vdpa_bind_iommufd(v, argp); + break; + case VHOST_VDPA_UNBIND_IOMMUFD: + vhost_vdpa_unbind_iommufd(v); + break; + case VHOST_VDPA_ATTACH_IOMMUFD_PT: + r = vhost_vdpa_attach_iommufd_pt(v, argp); + break; + case VHOST_VDPA_DETACH_IOMMUFD_PT: + vhost_vdpa_detach_iommufd_pt(v); + break; #ifdef CONFIG_VHOST_VDPA_MIGRATION case VHOST_GET_DEV_BUFFER_SIZE: r = vhost_vdpa_get_dev_buffer_size(v, argp); @@ -1556,6 +1656,8 @@ static int vhost_vdpa_release(struct inode *inode, struct file *filep) struct vhost_vdpa *v = filep->private_data; struct vhost_dev *d = &v->vdev; + vhost_vdpa_unbind_iommufd(v); + mutex_lock(&d->mutex); filep->private_data = NULL; vhost_vdpa_clean_irq(v); @@ -1709,6 +1811,9 @@ static int vhost_vdpa_probe(struct vdpa_device *vdpa) for (i = 0; i < VHOST_VDPA_IOTLB_BUCKETS; i++) INIT_HLIST_HEAD(&v->as[i]); + v->iommufd_dev = NULL; + v->iommufd_attached = false; + return 0; err: diff --git a/include/uapi/linux/vhost.h b/include/uapi/linux/vhost.h index a54098c7b0bc..898cde933168 100644 --- a/include/uapi/linux/vhost.h +++ b/include/uapi/linux/vhost.h @@ -223,6 +223,34 @@ */ #define VHOST_VDPA_RESUME _IO(VHOST_VIRTIO, 0x7E) +/* Bind a vDPA device to the specified iommufd + * + * After the return of this ioctl the vDPA device is binded to the specified + * iommufd, and the device id is also returned. + */ +#define VHOST_VDPA_BIND_IOMMUFD _IO(VHOST_VIRTIO, 0x90) + +/* Unbind a vDPA device from the specified iommufd + * + * After the return of this ioctl the vDPA device is unbinded from the specified + * iommufd. + */ +#define VHOST_VDPA_UNBIND_IOMMUFD _IO(VHOST_VIRTIO, 0x91) + +/* Associate the vDPA device with an address space within the bound iommufd. + * + * After the return of this ioctl the vDPA device is attached to the bound + * iommufd. + */ +#define VHOST_VDPA_ATTACH_IOMMUFD_PT _IO(VHOST_VIRTIO, 0x92) + +/* Detach the vDPA device from an address space within the bound iommufd. + * + * After the return of this ioctl the vDPA device is detached from the address + * space within the bound iommufd. + */ +#define VHOST_VDPA_DETACH_IOMMUFD_PT _IO(VHOST_VIRTIO, 0x93) + /* set and get device buffer */ #define VHOST_GET_DEV_BUFFER _IOR(VHOST_VIRTIO, 0xb0, struct vhost_vdpa_config) #define VHOST_SET_DEV_BUFFER _IOW(VHOST_VIRTIO, 0xb1, struct vhost_vdpa_config) diff --git a/include/uapi/linux/vhost_types.h b/include/uapi/linux/vhost_types.h index c7f25b0f7645..450214d2ada5 100644 --- a/include/uapi/linux/vhost_types.h +++ b/include/uapi/linux/vhost_types.h @@ -163,6 +163,11 @@ struct vhost_vdpa_iova_range { __u64 last; }; +struct vhost_vdpa_bind_iommufd { + __s32 iommufd; + __u32 out_devid; +}; + /* vhost vdpa device migration statue */ enum { VHOST_VDPA_DEVICE_START, diff --git a/tools/include/uapi/linux/vhost.h b/tools/include/uapi/linux/vhost.h index f5c48b61ab62..679c7b137f75 100644 --- a/tools/include/uapi/linux/vhost.h +++ b/tools/include/uapi/linux/vhost.h @@ -219,4 +219,32 @@ */ #define VHOST_VDPA_RESUME _IO(VHOST_VIRTIO, 0x7E) +/* Bind a vDPA device to the specified iommufd + * + * After the return of this ioctl the vDPA device is binded to the specified + * iommufd, and the device id is also returned. + */ +#define VHOST_VDPA_BIND_IOMMUFD _IO(VHOST_VIRTIO, 0x90) + +/* Unbind a vDPA device from the specified iommufd + * + * After the return of this ioctl the vDPA device is unbinded from the specified + * iommufd. + */ +#define VHOST_VDPA_UNBIND_IOMMUFD _IO(VHOST_VIRTIO, 0x91) + +/* Associate the vDPA device with an address space within the bound iommufd. + * + * After the return of this ioctl the vDPA device is attached to the bound + * iommufd. + */ +#define VHOST_VDPA_ATTACH_IOMMUFD_PT _IO(VHOST_VIRTIO, 0x92) + +/* Detach the vDPA device from an address space within the bound iommufd. + * + * After the return of this ioctl the vDPA device is detached from the address + * space within the bound iommufd. + */ +#define VHOST_VDPA_DETACH_IOMMUFD_PT _IO(VHOST_VIRTIO, 0x93) + #endif -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS] nfc: nci: add flush_workqueue to prevent uaf
by Ye Bin 31 Mar '25

31 Mar '25

From: Lin Ma <linma(a)zju.edu.cn> stable inclusion from stable-v4.19.239 commit 1a1748d0dd0f0a98535c6baeef671c8722107639 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1G8 CVE: CVE-2022-49059 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ef27324e2cb7bb24542d6cb2571740eefe6b00dc ] Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism (timer and workqueue). The race can be demonstrated below: Thread-1 Thread-2 | nci_dev_up() | nci_open_device() | __nci_request(nci_reset_req) | nci_send_cmd | queue_work(cmd_work) nci_unregister_device() | nci_close_device() | ... del_timer_sync(cmd_timer)[1] | ... | Worker nci_free_device() | nci_cmd_work() kfree(ndev)[3] | mod_timer(cmd_timer)[2] In short, the cleanup routine thought that the cmd_timer has already been detached by [1] but the mod_timer can re-attach the timer [2], even it is already released [3], resulting in UAF. This UAF is easy to trigger, crash trace by POC is like below [ 66.703713] ================================================================== [ 66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490 [ 66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33 [ 66.703974] [ 66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5 [ 66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work [ 66.703974] Call Trace: [ 66.703974] <TASK> [ 66.703974] dump_stack_lvl+0x57/0x7d [ 66.703974] print_report.cold+0x5e/0x5db [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] kasan_report+0xbe/0x1c0 [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] enqueue_timer+0x448/0x490 [ 66.703974] __mod_timer+0x5e6/0xb80 [ 66.703974] ? mark_held_locks+0x9e/0xe0 [ 66.703974] ? try_to_del_timer_sync+0xf0/0xf0 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x17b/0x410 [ 66.703974] ? queue_work_on+0x61/0x80 [ 66.703974] ? lockdep_hardirqs_on+0xbf/0x130 [ 66.703974] process_one_work+0x8bb/0x1510 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 66.703974] ? pwq_dec_nr_in_flight+0x230/0x230 [ 66.703974] ? rwlock_bug.part.0+0x90/0x90 [ 66.703974] ? _raw_spin_lock_irq+0x41/0x50 [ 66.703974] worker_thread+0x575/0x1190 [ 66.703974] ? process_one_work+0x1510/0x1510 [ 66.703974] kthread+0x2a0/0x340 [ 66.703974] ? kthread_complete_and_exit+0x20/0x20 [ 66.703974] ret_from_fork+0x22/0x30 [ 66.703974] </TASK> [ 66.703974] [ 66.703974] Allocated by task 267: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] __kasan_kmalloc+0x81/0xa0 [ 66.703974] nci_allocate_device+0xd3/0x390 [ 66.703974] nfcmrvl_nci_register_dev+0x183/0x2c0 [ 66.703974] nfcmrvl_nci_uart_open+0xf2/0x1dd [ 66.703974] nci_uart_tty_ioctl+0x2c3/0x4a0 [ 66.703974] tty_ioctl+0x764/0x1310 [ 66.703974] __x64_sys_ioctl+0x122/0x190 [ 66.703974] do_syscall_64+0x3b/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 66.703974] [ 66.703974] Freed by task 406: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] kasan_set_track+0x21/0x30 [ 66.703974] kasan_set_free_info+0x20/0x30 [ 66.703974] __kasan_slab_free+0x108/0x170 [ 66.703974] kfree+0xb0/0x330 [ 66.703974] nfcmrvl_nci_unregister_dev+0x90/0xd0 [ 66.703974] nci_uart_tty_close+0xdf/0x180 [ 66.703974] tty_ldisc_kill+0x73/0x110 [ 66.703974] tty_ldisc_hangup+0x281/0x5b0 [ 66.703974] __tty_hangup.part.0+0x431/0x890 [ 66.703974] tty_release+0x3a8/0xc80 [ 66.703974] __fput+0x1f0/0x8c0 [ 66.703974] task_work_run+0xc9/0x170 [ 66.703974] exit_to_user_mode_prepare+0x194/0x1a0 [ 66.703974] syscall_exit_to_user_mode+0x19/0x50 [ 66.703974] do_syscall_64+0x48/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae To fix the UAF, this patch adds flush_workqueue() to ensure the nci_cmd_work is finished before the following del_timer_sync. This combination will promise the timer is actually detached. Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Signed-off-by: Lin Ma <linma(a)zju.edu.cn> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- net/nfc/nci/core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index e6f1530f64f9..dad961aaeb83 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -560,6 +560,10 @@ static int nci_close_device(struct nci_dev *ndev) mutex_lock(&ndev->req_lock); if (!test_and_clear_bit(NCI_UP, &ndev->flags)) { + /* Need to flush the cmd wq in case + * there is a queued/running cmd_work + */ + flush_workqueue(ndev->cmd_wq); del_timer_sync(&ndev->cmd_timer); del_timer_sync(&ndev->data_timer); mutex_unlock(&ndev->req_lock); -- 2.34.1

2 1

[openeuler:OLK-5.10 2829/2829] drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6057:62: sparse: sparse: incorrect type in argument 4 (different base types)
by kernel test robot 31 Mar '25

31 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 2d7a642a3b89c993676c887941944d0f932d2052 commit: abd5078bcd21063944ed133282ee3fafdc92092c [2829/2829] net: wangxun: fix resolving ipv6 pakets extension header errors config: x86_64-randconfig-122-20250330 (https://download.01.org/0day-ci/archive/20250331/202503311730.Gkig2fxG-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503311730.Gkig2fxG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503311730.Gkig2fxG-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:177:6: sparse: sparse: symbol 'txgbe_service_event_schedule' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:940:40: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __be16 [usertype] vlan_proto @@ got unsigned short [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:940:40: sparse: expected restricted __be16 [usertype] vlan_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:940:40: sparse: got unsigned short [usertype] drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2647:6: sparse: sparse: symbol 'txgbe_disable_tx_queue' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2807:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2807:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2807:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2811:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2811:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2811:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2873:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2873:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2873:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2928:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2928:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2928:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3336:5: sparse: sparse: symbol 'txgbe_add_cloud_switcher' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3351:5: sparse: sparse: symbol 'txgbe_del_cloud_switcher' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3671:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3671:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3671:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3701:6: sparse: sparse: symbol 'txgbe_configure_isb' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3715:6: sparse: sparse: symbol 'txgbe_configure_port' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3964:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3964:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3964:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4291:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4291:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4291:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4368:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4368:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4368:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4386:5: sparse: sparse: symbol 'txgbe_init_shared_code' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4476:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4476:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4476:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4905:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4905:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4905:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5037:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5037:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5037:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6047:40: sparse: sparse: restricted __be16 degrades to integer >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6057:62: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6057:62: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6057:62: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6075:36: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6079:67: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6089:32: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6090:36: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6094:67: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6108:37: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6119:61: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6119:61: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6119:61: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6136:40: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6148:61: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6148:61: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6148:61: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6292:62: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6292:62: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6292:62: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6388:70: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6388:70: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6388:70: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6448:61: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6448:61: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6448:61: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6774:33: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6774:33: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6774:33: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6776:33: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6776:33: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6776:33: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6778:38: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6779:25: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6779:25: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6779:25: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6783:27: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6783:27: sparse: left side has type unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6783:27: sparse: right side has type restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6793:27: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6793:27: sparse: left side has type unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6793:27: sparse: right side has type restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6813:5: sparse: sparse: symbol 'txgbe_skb_pad_nonzero' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6855:30: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] protocol @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6855:30: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6855:30: sparse: got restricted __be16 [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6902:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6902:26: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6902:26: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6903:29: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6915:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6915:26: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6915:26: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6948:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] h_vlan_TCI @@ got unsigned short [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6948:42: sparse: expected restricted __be16 [usertype] h_vlan_TCI drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6948:42: sparse: got unsigned short [usertype] drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7327:23: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7393:46: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7395:37: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7403:47: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7405:37: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7497:26: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] type @@ got restricted __be16 [usertype] protocol @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7497:26: sparse: expected unsigned short [usertype] type drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7497:26: sparse: got restricted __be16 [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7513:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] type @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7513:22: sparse: expected unsigned short [usertype] type drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7513:22: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7540:35: sparse: sparse: incorrect type in initializer (incompatible argument 2 (different base types)) @@ expected int ( *ndo_vlan_rx_add_vid )( ... ) @@ got int ( * )( ... ) @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7540:35: sparse: expected int ( *ndo_vlan_rx_add_vid )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7540:35: sparse: got int ( * )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7541:35: sparse: sparse: incorrect type in initializer (incompatible argument 2 (different base types)) @@ expected int ( *ndo_vlan_rx_kill_vid )( ... ) @@ got int ( * )( ... ) @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7541:35: sparse: expected int ( *ndo_vlan_rx_kill_vid )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7541:35: sparse: got int ( * )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7698:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7698:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7698:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7901:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7901:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7901:17: sparse: int vim +6057 drivers/net/ethernet/netswift/txgbe/txgbe_main.c 6030 6031 static txgbe_dptype encode_tx_desc_ptype(const struct txgbe_tx_buffer *first) 6032 { 6033 struct sk_buff *skb = first->skb; 6034 u8 tun_prot = 0; 6035 u8 l4_prot = 0; 6036 u8 ptype = 0; 6037 unsigned char *exthdr; 6038 unsigned char *l4_hdr; 6039 __be16 frag_off; 6040 6041 if (skb->encapsulation) { 6042 union network_header hdr; 6043 6044 switch (first->protocol) { 6045 case __constant_htons(ETH_P_IP): 6046 tun_prot = ip_hdr(skb)->protocol; 6047 if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) 6048 goto encap_frag; 6049 ptype = TXGBE_PTYPE_TUN_IPV4; 6050 break; 6051 case __constant_htons(ETH_P_IPV6): 6052 l4_hdr = skb_transport_header(skb); 6053 exthdr = skb_network_header(skb) + sizeof(struct ipv6hdr); 6054 tun_prot = ipv6_hdr(skb)->nexthdr; 6055 if (l4_hdr != exthdr) 6056 ipv6_skip_exthdr(skb, exthdr - skb->data, > 6057 &tun_prot, &frag_off); 6058 if (tun_prot == NEXTHDR_FRAGMENT) 6059 goto encap_frag; 6060 ptype = TXGBE_PTYPE_TUN_IPV6; 6061 break; 6062 default: 6063 goto exit; 6064 } 6065 6066 if (tun_prot == IPPROTO_IPIP || 6067 tun_prot == IPPROTO_IPV6) { 6068 hdr.raw = (void *)inner_ip_hdr(skb); 6069 ptype |= TXGBE_PTYPE_PKT_IPIP; 6070 } else if (tun_prot == IPPROTO_UDP) { 6071 hdr.raw = (void *)inner_ip_hdr(skb); 6072 /* fixme: VXLAN-GPE neither ETHER nor IP */ 6073 6074 if (skb->inner_protocol_type != ENCAP_TYPE_ETHER || 6075 skb->inner_protocol != htons(ETH_P_TEB)) { 6076 ptype |= TXGBE_PTYPE_PKT_IG; 6077 } else { 6078 if (((struct ethhdr *) 6079 skb_inner_mac_header(skb))->h_proto 6080 == htons(ETH_P_8021Q)) { 6081 ptype |= TXGBE_PTYPE_PKT_IGMV; 6082 } else { 6083 ptype |= TXGBE_PTYPE_PKT_IGM; 6084 } 6085 } 6086 6087 } else if (tun_prot == IPPROTO_GRE) { 6088 hdr.raw = (void *)inner_ip_hdr(skb); 6089 if (skb->inner_protocol == htons(ETH_P_IP) || 6090 skb->inner_protocol == htons(ETH_P_IPV6)) { 6091 ptype |= TXGBE_PTYPE_PKT_IG; 6092 } else { 6093 if (((struct ethhdr *) 6094 skb_inner_mac_header(skb))->h_proto 6095 == htons(ETH_P_8021Q)) { 6096 ptype |= TXGBE_PTYPE_PKT_IGMV; 6097 } else { 6098 ptype |= TXGBE_PTYPE_PKT_IGM; 6099 } 6100 } 6101 } else { 6102 goto exit; 6103 } 6104 6105 switch (hdr.ipv4->version) { 6106 case IPVERSION: 6107 l4_prot = hdr.ipv4->protocol; 6108 if (hdr.ipv4->frag_off & htons(IP_MF | IP_OFFSET)) { 6109 ptype |= TXGBE_PTYPE_TYP_IPFRAG; 6110 goto exit; 6111 } 6112 break; 6113 case 6: 6114 l4_hdr = skb_inner_transport_header(skb); 6115 exthdr = skb_inner_network_header(skb) + sizeof(struct ipv6hdr); 6116 l4_prot = inner_ipv6_hdr(skb)->nexthdr; 6117 if (l4_hdr != exthdr) 6118 ipv6_skip_exthdr(skb, exthdr - skb->data, 6119 &l4_prot, &frag_off); 6120 ptype |= TXGBE_PTYPE_PKT_IPV6; 6121 if (l4_prot == NEXTHDR_FRAGMENT) { 6122 ptype |= TXGBE_PTYPE_TYP_IPFRAG; 6123 goto exit; 6124 } 6125 break; 6126 default: 6127 goto exit; 6128 } 6129 } else { 6130 encap_frag: 6131 6132 switch (first->protocol) { 6133 case __constant_htons(ETH_P_IP): 6134 l4_prot = ip_hdr(skb)->protocol; 6135 ptype = TXGBE_PTYPE_PKT_IP; 6136 if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) { 6137 ptype |= TXGBE_PTYPE_TYP_IPFRAG; 6138 goto exit; 6139 } 6140 break; 6141 #ifdef NETIF_F_IPV6_CSUM 6142 case __constant_htons(ETH_P_IPV6): 6143 l4_hdr = skb_transport_header(skb); 6144 exthdr = skb_network_header(skb) + sizeof(struct ipv6hdr); 6145 l4_prot = ipv6_hdr(skb)->nexthdr; 6146 if (l4_hdr != exthdr) 6147 ipv6_skip_exthdr(skb, exthdr - skb->data, 6148 &l4_prot, &frag_off); 6149 6150 ptype = TXGBE_PTYPE_PKT_IP | TXGBE_PTYPE_PKT_IPV6; 6151 if (l4_prot == NEXTHDR_FRAGMENT) { 6152 ptype |= TXGBE_PTYPE_TYP_IPFRAG; 6153 goto exit; 6154 } 6155 break; 6156 #endif /* NETIF_F_IPV6_CSUM */ 6157 case __constant_htons(ETH_P_1588): 6158 ptype = TXGBE_PTYPE_L2_TS; 6159 goto exit; 6160 case __constant_htons(ETH_P_FIP): 6161 ptype = TXGBE_PTYPE_L2_FIP; 6162 goto exit; 6163 case __constant_htons(TXGBE_ETH_P_LLDP): 6164 ptype = TXGBE_PTYPE_L2_LLDP; 6165 goto exit; 6166 case __constant_htons(TXGBE_ETH_P_CNM): 6167 ptype = TXGBE_PTYPE_L2_CNM; 6168 goto exit; 6169 case __constant_htons(ETH_P_PAE): 6170 ptype = TXGBE_PTYPE_L2_EAPOL; 6171 goto exit; 6172 case __constant_htons(ETH_P_ARP): 6173 ptype = TXGBE_PTYPE_L2_ARP; 6174 goto exit; 6175 default: 6176 ptype = TXGBE_PTYPE_L2_MAC; 6177 goto exit; 6178 } 6179 6180 } 6181 6182 switch (l4_prot) { 6183 case IPPROTO_TCP: 6184 ptype |= TXGBE_PTYPE_TYP_TCP; 6185 break; 6186 case IPPROTO_UDP: 6187 ptype |= TXGBE_PTYPE_TYP_UDP; 6188 break; 6189 case IPPROTO_SCTP: 6190 ptype |= TXGBE_PTYPE_TYP_SCTP; 6191 break; 6192 default: 6193 ptype |= TXGBE_PTYPE_TYP_IP; 6194 break; 6195 } 6196 6197 exit: 6198 return txgbe_decode_ptype(ptype); 6199 } 6200 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] media: uvcvideo: Fix double free in error path
by Gu Bowen 31 Mar '25

31 Mar '25

From: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> stable inclusion from stable-v6.6.76 commit 6c36dcd662ec5276782838660f8533a7cb26be49 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBDI CVE: CVE-2024-57980 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c6ef3a7fa97ec823a1e1af9085cf13db9f7b3bac upstream. If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. This results in the kfree() call in uvc_status_cleanup() trying to double-free the memory. Fix it by resetting the dev->status pointer to NULL after freeing it. Fixes: a31a4055473b ("V4L/DVB:usbvideo:don't use part of buffer for USB transfer #4") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20241107235130.31372-1-laurent.pinchart@ideasonbo… Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Reviewed by: Ricardo Ribalda <ribalda(a)chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/media/usb/uvc/uvc_status.c [Context conflicts due to commit adfd3910c27fb ("media: uvcvideo: Remove void casting for the status endpoint") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/media/usb/uvc/uvc_status.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/usb/uvc/uvc_status.c b/drivers/media/usb/uvc/uvc_status.c index 73725051cc16..6edf491dd873 100644 --- a/drivers/media/usb/uvc/uvc_status.c +++ b/drivers/media/usb/uvc/uvc_status.c @@ -269,6 +269,7 @@ int uvc_status_init(struct uvc_device *dev) dev->int_urb = usb_alloc_urb(0, GFP_KERNEL); if (dev->int_urb == NULL) { kfree(dev->status); + dev->status = NULL; return -ENOMEM; } -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] CVE-2022-49513
by Zhang Kunbo 31 Mar '25

31 Mar '25

*** BLURB HERE *** Kevin Hao (2): cpufreq: Move to_gov_attr_set() to cpufreq.h cpufreq: governor: Use kobject release() method to free dbs_data drivers/cpufreq/cpufreq_governor.c | 20 +++++++++++++------- drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cpufreq/cpufreq_governor_attr_set.c | 5 ----- include/linux/cpufreq.h | 5 +++++ 4 files changed, 19 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2022-49513
by Zhang Kunbo 31 Mar '25

31 Mar '25

*** BLURB HERE *** Kevin Hao (2): cpufreq: Move to_gov_attr_set() to cpufreq.h cpufreq: governor: Use kobject release() method to free dbs_data drivers/cpufreq/cpufreq_governor.c | 20 +++++++++++++------- drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cpufreq/cpufreq_governor_attr_set.c | 5 ----- include/linux/cpufreq.h | 5 +++++ 4 files changed, 19 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49370
by Xia Fukun 31 Mar '25

31 Mar '25

Fix CVE-2022-49370. Chen Zhongjin (1): firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle Miaoqian Lin (1): firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle drivers/firmware/dmi-sysfs.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 1424/1424] mm/page_alloc.c:1645:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type
by kernel test robot 31 Mar '25

31 Mar '25

Hi Daniel, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: eb761d6521c32c006a4987260394a61c6684fb35 [1424/1424] mm: parallelize deferred struct page initialization within each node config: x86_64-buildonly-randconfig-003-20250217 (https://download.01.org/0day-ci/archive/20250331/202503311145.7abslQzz-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503311145.7abslQzz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503311145.7abslQzz-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/page_alloc.c:1412:6: warning: no previous prototype for function 'set_zone_contiguous' [-Wmissing-prototypes] 1412 | void set_zone_contiguous(struct zone *zone) | ^ mm/page_alloc.c:1412:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1412 | void set_zone_contiguous(struct zone *zone) | ^ | static mm/page_alloc.c:1433:6: warning: no previous prototype for function 'clear_zone_contiguous' [-Wmissing-prototypes] 1433 | void clear_zone_contiguous(struct zone *zone) | ^ mm/page_alloc.c:1433:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1433 | void clear_zone_contiguous(struct zone *zone) | ^ | static >> mm/page_alloc.c:1645:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-mismatch] 1645 | DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1646 | KTASK_PTE_MINCHUNK); | ~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:139:3: note: expanded from macro 'DEFINE_KTASK_CTL' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: note: expanded from macro 'KTASK_CTL_INITIALIZER' 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1661:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-mismatch] 1661 | DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1662 | KTASK_PTE_MINCHUNK); | ~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:139:3: note: expanded from macro 'DEFINE_KTASK_CTL' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: note: expanded from macro 'KTASK_CTL_INITIALIZER' 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 4 warnings generated. vim +1645 mm/page_alloc.c 1587 1588 /* Initialise remaining memory on a node */ 1589 static int __init deferred_init_memmap(void *data) 1590 { 1591 pg_data_t *pgdat = data; 1592 int nid = pgdat->node_id; 1593 unsigned long start = jiffies; 1594 unsigned long nr_init = 0, nr_free = 0; 1595 unsigned long spfn, epfn, first_init_pfn, flags; 1596 phys_addr_t spa, epa; 1597 int zid; 1598 struct zone *zone; 1599 const struct cpumask *cpumask = cpumask_of_node(pgdat->node_id); 1600 u64 i; 1601 unsigned long nr_node_cpus; 1602 struct ktask_node kn; 1603 1604 /* Bind memory initialisation thread to a local node if possible */ 1605 if (!cpumask_empty(cpumask)) 1606 set_cpus_allowed_ptr(current, cpumask); 1607 1608 pgdat_resize_lock(pgdat, &flags); 1609 first_init_pfn = pgdat->first_deferred_pfn; 1610 if (first_init_pfn == ULONG_MAX) { 1611 pgdat_resize_unlock(pgdat, &flags); 1612 pgdat_init_report_one_done(); 1613 return 0; 1614 } 1615 1616 /* 1617 * We'd like to know the memory bandwidth of the chip to calculate the 1618 * most efficient number of threads to start, but we can't. In 1619 * testing, a good value for a variety of systems was a quarter of the 1620 * CPUs on the node. 1621 */ 1622 nr_node_cpus = DIV_ROUND_UP(cpumask_weight(cpumask), 4); 1623 1624 /* Sanity check boundaries */ 1625 BUG_ON(pgdat->first_deferred_pfn < pgdat->node_start_pfn); 1626 BUG_ON(pgdat->first_deferred_pfn > pgdat_end_pfn(pgdat)); 1627 pgdat->first_deferred_pfn = ULONG_MAX; 1628 1629 /* Only the highest zone is deferred so find it */ 1630 for (zid = 0; zid < MAX_NR_ZONES; zid++) { 1631 zone = pgdat->node_zones + zid; 1632 if (first_init_pfn < zone_end_pfn(zone)) 1633 break; 1634 } 1635 first_init_pfn = max(zone->zone_start_pfn, first_init_pfn); 1636 1637 /* 1638 * Initialize and free pages. We do it in two loops: first we initialize 1639 * struct page, than free to buddy allocator, because while we are 1640 * freeing pages we can access pages that are ahead (computing buddy 1641 * page in __free_one_page()). 1642 */ 1643 for_each_free_mem_range(i, nid, MEMBLOCK_NONE, &spa, &epa, NULL) { 1644 struct deferred_args args = { nid, zid, ATOMIC64_INIT(0) }; > 1645 DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, 1646 KTASK_PTE_MINCHUNK); 1647 ktask_ctl_set_max_threads(&ctl, nr_node_cpus); 1648 1649 spfn = max_t(unsigned long, first_init_pfn, PFN_UP(spa)); 1650 epfn = min_t(unsigned long, zone_end_pfn(zone), PFN_DOWN(epa)); 1651 1652 kn.kn_start = (void *)spfn; 1653 kn.kn_task_size = (spfn < epfn) ? epfn - spfn : 0; 1654 kn.kn_nid = nid; 1655 (void) ktask_run_numa(&kn, 1, &ctl); 1656 1657 nr_init += atomic64_read(&args.nr_pages); 1658 } 1659 for_each_free_mem_range(i, nid, MEMBLOCK_NONE, &spa, &epa, NULL) { 1660 struct deferred_args args = { nid, zid, ATOMIC64_INIT(0) }; 1661 DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, 1662 KTASK_PTE_MINCHUNK); 1663 ktask_ctl_set_max_threads(&ctl, nr_node_cpus); 1664 1665 spfn = max_t(unsigned long, first_init_pfn, PFN_UP(spa)); 1666 epfn = min_t(unsigned long, zone_end_pfn(zone), PFN_DOWN(epa)); 1667 1668 kn.kn_start = (void *)spfn; 1669 kn.kn_task_size = (spfn < epfn) ? epfn - spfn : 0; 1670 kn.kn_nid = nid; 1671 (void) ktask_run_numa(&kn, 1, &ctl); 1672 1673 nr_free += atomic64_read(&args.nr_pages); 1674 } 1675 pgdat_resize_unlock(pgdat, &flags); 1676 1677 /* Sanity check that the next zone really is unpopulated */ 1678 WARN_ON(++zid < MAX_NR_ZONES && populated_zone(++zone)); 1679 VM_BUG_ON(nr_init != nr_free); 1680 1681 zone->managed_pages += nr_free; 1682 1683 pr_info("node %d initialised, %lu pages in %ums\n", nid, nr_free, 1684 jiffies_to_msecs(jiffies - start)); 1685 1686 pgdat_init_report_one_done(); 1687 return 0; 1688 } 1689 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] drbd: Fix five use after free bugs in get_initial_state
by Xiaomeng Zhang 31 Mar '25

31 Mar '25

From: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> stable inclusion from stable-v5.10.111 commit 594205b4936771a250f9d141e7e0fff21c3dd2d9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6VU CVE: CVE-2022-49085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aadb22ba2f656581b2f733deb3a467c48cc618f6 ] In get_initial_state, it calls notify_initial_state_done(skb,..) if cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_done(), the skb will be freed by nlmsg_free(skb). Then get_initial_state will goto out and the freed skb will be used by return value skb->len, which is a uaf bug. What's worse, the same problem goes even further: skb can also be freed in the notify_*_state_change -> notify_*_state calls below. Thus 4 additional uaf bugs happened. My patch lets the problem callee functions: notify_initial_state_done and notify_*_state_change return an error code if errors happen. So that the error codes could be propagated and the uaf bugs can be avoid. v2 reports a compilation warning. This v3 fixed this warning and built successfully in my local environment with no additional warnings. v2: https://lore.kernel.org/patchwork/patch/1435218/ Fixes: a29728463b254 ("drbd: Backport the "events2" command") Signed-off-by: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder(a)linbit.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/block/drbd/drbd_int.h | 8 ++--- drivers/block/drbd/drbd_nl.c | 41 ++++++++++++++++---------- drivers/block/drbd/drbd_state.c | 18 +++++------ drivers/block/drbd/drbd_state_change.h | 8 ++--- 4 files changed, 42 insertions(+), 33 deletions(-) diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h index e35a234b0a8f..4f66cf6879fd 100644 --- a/drivers/block/drbd/drbd_int.h +++ b/drivers/block/drbd/drbd_int.h @@ -1688,22 +1688,22 @@ struct sib_info { }; void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib); -extern void notify_resource_state(struct sk_buff *, +extern int notify_resource_state(struct sk_buff *, unsigned int, struct drbd_resource *, struct resource_info *, enum drbd_notification_type); -extern void notify_device_state(struct sk_buff *, +extern int notify_device_state(struct sk_buff *, unsigned int, struct drbd_device *, struct device_info *, enum drbd_notification_type); -extern void notify_connection_state(struct sk_buff *, +extern int notify_connection_state(struct sk_buff *, unsigned int, struct drbd_connection *, struct connection_info *, enum drbd_notification_type); -extern void notify_peer_device_state(struct sk_buff *, +extern int notify_peer_device_state(struct sk_buff *, unsigned int, struct drbd_peer_device *, struct peer_device_info *, diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c index 5b15ffd0c7f5..5a80453be553 100644 --- a/drivers/block/drbd/drbd_nl.c +++ b/drivers/block/drbd/drbd_nl.c @@ -4598,7 +4598,7 @@ static int nla_put_notification_header(struct sk_buff *msg, return drbd_notification_header_to_skb(msg, &nh, true); } -void notify_resource_state(struct sk_buff *skb, +int notify_resource_state(struct sk_buff *skb, unsigned int seq, struct drbd_resource *resource, struct resource_info *resource_info, @@ -4640,16 +4640,17 @@ void notify_resource_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_device_state(struct sk_buff *skb, +int notify_device_state(struct sk_buff *skb, unsigned int seq, struct drbd_device *device, struct device_info *device_info, @@ -4689,16 +4690,17 @@ void notify_device_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_connection_state(struct sk_buff *skb, +int notify_connection_state(struct sk_buff *skb, unsigned int seq, struct drbd_connection *connection, struct connection_info *connection_info, @@ -4738,16 +4740,17 @@ void notify_connection_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_peer_device_state(struct sk_buff *skb, +int notify_peer_device_state(struct sk_buff *skb, unsigned int seq, struct drbd_peer_device *peer_device, struct peer_device_info *peer_device_info, @@ -4788,13 +4791,14 @@ void notify_peer_device_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } void notify_helper(enum drbd_notification_type type, @@ -4845,7 +4849,7 @@ void notify_helper(enum drbd_notification_type type, err, seq); } -static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) +static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq) { struct drbd_genlmsghdr *dh; int err; @@ -4859,11 +4863,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) if (nla_put_notification_header(skb, NOTIFY_EXISTS)) goto nla_put_failure; genlmsg_end(skb, dh); - return; + return 0; nla_put_failure: nlmsg_free(skb); pr_err("Error %d sending event. Event seq:%u\n", err, seq); + return err; } static void free_state_changes(struct list_head *list) @@ -4890,6 +4895,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) unsigned int seq = cb->args[2]; unsigned int n; enum drbd_notification_type flags = 0; + int err = 0; /* There is no need for taking notification_mutex here: it doesn't matter if the initial state events mix with later state chage @@ -4898,32 +4904,32 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) cb->args[5]--; if (cb->args[5] == 1) { - notify_initial_state_done(skb, seq); + err = notify_initial_state_done(skb, seq); goto out; } n = cb->args[4]++; if (cb->args[4] < cb->args[3]) flags |= NOTIFY_CONTINUES; if (n < 1) { - notify_resource_state_change(skb, seq, state_change->resource, + err = notify_resource_state_change(skb, seq, state_change->resource, NOTIFY_EXISTS | flags); goto next; } n--; if (n < state_change->n_connections) { - notify_connection_state_change(skb, seq, &state_change->connections[n], + err = notify_connection_state_change(skb, seq, &state_change->connections[n], NOTIFY_EXISTS | flags); goto next; } n -= state_change->n_connections; if (n < state_change->n_devices) { - notify_device_state_change(skb, seq, &state_change->devices[n], + err = notify_device_state_change(skb, seq, &state_change->devices[n], NOTIFY_EXISTS | flags); goto next; } n -= state_change->n_devices; if (n < state_change->n_devices * state_change->n_connections) { - notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], + err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], NOTIFY_EXISTS | flags); goto next; } @@ -4938,7 +4944,10 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) cb->args[4] = 0; } out: - return skb->len; + if (err) + return err; + else + return skb->len; } int drbd_adm_get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c index b452359b6aae..1474250f9440 100644 --- a/drivers/block/drbd/drbd_state.c +++ b/drivers/block/drbd/drbd_state.c @@ -1549,7 +1549,7 @@ int drbd_bitmap_io_from_worker(struct drbd_device *device, return rv; } -void notify_resource_state_change(struct sk_buff *skb, +int notify_resource_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_resource_state_change *resource_state_change, enum drbd_notification_type type) @@ -1562,10 +1562,10 @@ void notify_resource_state_change(struct sk_buff *skb, .res_susp_fen = resource_state_change->susp_fen[NEW], }; - notify_resource_state(skb, seq, resource, &resource_info, type); + return notify_resource_state(skb, seq, resource, &resource_info, type); } -void notify_connection_state_change(struct sk_buff *skb, +int notify_connection_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_connection_state_change *connection_state_change, enum drbd_notification_type type) @@ -1576,10 +1576,10 @@ void notify_connection_state_change(struct sk_buff *skb, .conn_role = connection_state_change->peer_role[NEW], }; - notify_connection_state(skb, seq, connection, &connection_info, type); + return notify_connection_state(skb, seq, connection, &connection_info, type); } -void notify_device_state_change(struct sk_buff *skb, +int notify_device_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_device_state_change *device_state_change, enum drbd_notification_type type) @@ -1589,10 +1589,10 @@ void notify_device_state_change(struct sk_buff *skb, .dev_disk_state = device_state_change->disk_state[NEW], }; - notify_device_state(skb, seq, device, &device_info, type); + return notify_device_state(skb, seq, device, &device_info, type); } -void notify_peer_device_state_change(struct sk_buff *skb, +int notify_peer_device_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_peer_device_state_change *p, enum drbd_notification_type type) @@ -1606,7 +1606,7 @@ void notify_peer_device_state_change(struct sk_buff *skb, .peer_resync_susp_dependency = p->resync_susp_dependency[NEW], }; - notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); + return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); } static void broadcast_state_change(struct drbd_state_change *state_change) @@ -1614,7 +1614,7 @@ static void broadcast_state_change(struct drbd_state_change *state_change) struct drbd_resource_state_change *resource_state_change = &state_change->resource[0]; bool resource_state_has_changed; unsigned int n_device, n_connection, n_peer_device, n_peer_devices; - void (*last_func)(struct sk_buff *, unsigned int, void *, + int (*last_func)(struct sk_buff *, unsigned int, void *, enum drbd_notification_type) = NULL; void *uninitialized_var(last_arg); diff --git a/drivers/block/drbd/drbd_state_change.h b/drivers/block/drbd/drbd_state_change.h index ba80f612d6ab..d5b0479bc9a6 100644 --- a/drivers/block/drbd/drbd_state_change.h +++ b/drivers/block/drbd/drbd_state_change.h @@ -44,19 +44,19 @@ extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_ extern void copy_old_to_new_state_change(struct drbd_state_change *); extern void forget_state_change(struct drbd_state_change *); -extern void notify_resource_state_change(struct sk_buff *, +extern int notify_resource_state_change(struct sk_buff *, unsigned int, struct drbd_resource_state_change *, enum drbd_notification_type type); -extern void notify_connection_state_change(struct sk_buff *, +extern int notify_connection_state_change(struct sk_buff *, unsigned int, struct drbd_connection_state_change *, enum drbd_notification_type type); -extern void notify_device_state_change(struct sk_buff *, +extern int notify_device_state_change(struct sk_buff *, unsigned int, struct drbd_device_state_change *, enum drbd_notification_type type); -extern void notify_peer_device_state_change(struct sk_buff *, +extern int notify_peer_device_state_change(struct sk_buff *, unsigned int, struct drbd_peer_device_state_change *, enum drbd_notification_type type); -- 2.34.1

2 1

[PATCH OLK-6.6 0/9] Some bug fix patches for RDMA/hns to olk-6.6
by Junxian Huang 31 Mar '25

31 Mar '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some bug fix patches for RDMA/hns to olk-6.6 Chengchang Tang (1): RDMA/hns: Fix a meaningless loop in free_buffer_pages_proc() Junxian Huang (7): RDMA/hns: Change mtr member to pointer in hns QP/CQ/MR/SRQ/EQ struct RDMA/hns: Move mtr_node into the mtr struct RDMA/hns: Fix delayed destruction of db not taking effect RDMA/hns: Fix delay-destruction mechanism not processing kernel db RDMA/hns: Fix mismatched kzalloc vs kvfree RDMA/hns: Fix DCA error path in alloc_wqe_buf() RDMA/hns: Reorder uctx deallocation Yuyu Li (1): RDMA/hns: Fix remove debugfs after device has been unregistered drivers/infiniband/hw/hns/hns_roce_bond.c | 2 +- drivers/infiniband/hw/hns/hns_roce_cq.c | 35 ++--- drivers/infiniband/hw/hns/hns_roce_db.c | 81 ++++++---- drivers/infiniband/hw/hns/hns_roce_dca.c | 8 +- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 10 +- drivers/infiniband/hw/hns/hns_roce_debugfs.h | 3 +- drivers/infiniband/hw/hns/hns_roce_device.h | 69 ++++----- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 81 +++++----- drivers/infiniband/hw/hns/hns_roce_main.c | 23 ++- drivers/infiniband/hw/hns/hns_roce_mr.c | 145 ++++++++---------- drivers/infiniband/hw/hns/hns_roce_qp.c | 40 ++--- drivers/infiniband/hw/hns/hns_roce_restrack.c | 4 +- drivers/infiniband/hw/hns/hns_roce_srq.c | 63 +++----- 13 files changed, 269 insertions(+), 295 deletions(-) -- 2.33.0

2 10

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 31 Mar '25

31 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250331/202503311140.R7DpzkNH-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503311140.R7DpzkNH-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v3 00/28] Add support for heterogeneous live migration
by Jinqian Yang 31 Mar '25

31 Mar '25

Patch#1 Allow userspace to get the writable masks for feature ID registers Patch#2 Document KVM_ARM_GET_REG_WRITABLE_MASKS Patch#3 Use guest ID register values for the sake of emulation Patch#4 Advertise selected DebugVer in DBGDIDR.Version Patch#5 Reject attempts to set invalid debug arch version Patch#6 Bump up the default KVM sanitised debug version to v8p8 Patch#7 Allow userspace to change ID_AA64ISAR{0-2}_EL1 Patch#8 Allow userspace to change ID_AA64MMFR{0-2}_EL1 Patch#9 Allow userspace to change ID_AA64PFR0_EL1 Patch#10 Allow userspace to change ID_AA64ZFR0_EL1 Patch#11 Document vCPU feature selection UAPIs Patch#12 Make the exposed feature bits in AA64DFR0_EL1 writable from userspace Patch#13 Disable MPAM visibility by default and ignore VMM writes Patch#14 Rename is_id_reg() to imply VM scope Patch#15 Reset VM feature ID regs from kvm_reset_sys_regs() Patch#16 Only reset vCPU-scoped feature ID regs once Patch#17 Use read-only helper for reading VM ID registers Patch#18 Add helper for writing ID regs Patch#19 Treat CTR_EL0 as a VM feature ID register Patch#20 Rename functions for invariant sys regs Patch#21 Make the L1Ip feature bits in CTR_EL0 writable from userspace Patch#22 Show writable masks for feature registers Patch#23 Make HCX writable from userspace Patch#24 Remove duplicated AA64MMFR1_EL1 XNX Patch#25 Add support for HIP09 Spectre-BHB mitigation Patch#26 add cnp verification on Hisilicon erratum 162100125 Patch#27 use KABI_EXTEND to revert struct kvm kabi change Patch#28 Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden James Morse (1): KVM: arm64: Disable MPAM visibility by default and ignore VMM writes Jing Zhang (5): KVM: arm64: Allow userspace to get the writable masks for feature ID registers KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS KVM: arm64: Use guest ID register values for the sake of emulation KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Marc Zyngier (1): KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden Oliver Upton (11): KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version KVM: arm64: Reject attempts to set invalid debug arch version KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 KVM: arm64: Document vCPU feature selection UAPIs KVM: arm64: Rename is_id_reg() to imply VM scope KVM: arm64: Reset VM feature ID regs from kvm_reset_sys_regs() KVM: arm64: Only reset vCPU-scoped feature ID regs once KVM: arm64: Use read-only helper for reading VM ID registers KVM: arm64: Add helper for writing ID regs Russell King (1): KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX Sebastian Ott (3): KVM: arm64: Treat CTR_EL0 as a VM feature ID register KVM: arm64: rename functions for invariant sys regs KVM: arm64: show writable masks for feature registers Shameer Kolothum (2): KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace yangjinqian (4): KVM: arm64: Make HCX writable from userspace arm64: Add support for HIP09 Spectre-BHB mitigation arm64: add cnp verification on Hisilicon erratum 162100125 KVM: arm64: use KABI_EXTEND to revert struct kvm kabi change Documentation/virt/kvm/api.rst | 52 +++ Documentation/virt/kvm/arm/index.rst | 1 + Documentation/virt/kvm/arm/vcpu-features.rst | 48 +++ arch/arm64/include/asm/cpufeature.h | 14 + arch/arm64/include/asm/kvm_emulate.h | 3 +- arch/arm64/include/asm/kvm_host.h | 24 ++ arch/arm64/include/uapi/asm/kvm.h | 32 ++ arch/arm64/kernel/cpu_errata.c | 13 +- arch/arm64/kernel/proton-pack.c | 1 + arch/arm64/kvm/arm.c | 15 +- arch/arm64/kvm/pmu-emul.c | 2 +- arch/arm64/kvm/sys_regs.c | 351 +++++++++++++++---- include/uapi/linux/kvm.h | 2 + 13 files changed, 475 insertions(+), 83 deletions(-) create mode 100644 Documentation/virt/kvm/arm/vcpu-features.rst -- 2.33.0

2 29

[openeuler:openEuler-1.0-LTS 1425/1425] kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats'
by kernel test robot 31 Mar '25

31 Mar '25

Hi Hui, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: ebca52abe099caa97d7669d0acc71209ea80cfec [1425/1425] sched: Add statistics for scheduler dynamic affinity config: x86_64-randconfig-103-20250219 (https://download.01.org/0day-ci/archive/20250331/202503310934.WNROVBec-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503310934.WNROVBec-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503310934.WNROVBec-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/sched/debug.c:815:6: warning: no previous prototype for function 'sysrq_sched_debug_tidy' [-Wmissing-prototypes] 815 | void sysrq_sched_debug_tidy(void) | ^ kernel/sched/debug.c:815:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 815 | void sysrq_sched_debug_tidy(void) | ^ | static >> kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:21:17: note: expanded from macro 'SEQ_printf' 21 | seq_printf(m, x); \ | ^ >> kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:23:11: note: expanded from macro 'SEQ_printf' 23 | pr_cont(x); \ | ^ include/linux/printk.h:362:26: note: expanded from macro 'pr_cont' 362 | printk(KERN_CONT fmt, ##__VA_ARGS__) | ^~~~~~~~~~~ >> kernel/sched/debug.c:991:17: error: no member named 'nr_wakeups_force_preferred_cpus' in 'struct dyn_affinity_stats' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:21:17: note: expanded from macro 'SEQ_printf' 21 | seq_printf(m, x); \ | ^ >> kernel/sched/debug.c:991:17: error: no member named 'nr_wakeups_force_preferred_cpus' in 'struct dyn_affinity_stats' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ~~~~~~~~ ^ kernel/sched/debug.c:939:48: note: expanded from macro '__P' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^ kernel/sched/debug.c:23:11: note: expanded from macro 'SEQ_printf' 23 | pr_cont(x); \ | ^ include/linux/printk.h:362:26: note: expanded from macro 'pr_cont' 362 | printk(KERN_CONT fmt, ##__VA_ARGS__) | ^~~~~~~~~~~ 1 warning and 4 errors generated. vim +990 kernel/sched/debug.c 814 > 815 void sysrq_sched_debug_tidy(void) 816 { 817 int cpu; 818 819 SEQ_printf(NULL, "Sched Debug Version: v0.11, %s %.*s\n", 820 init_utsname()->release, 821 (int)strcspn(init_utsname()->version, " "), 822 init_utsname()->version); 823 824 for_each_online_cpu(cpu) 825 print_cpu_tidy(NULL, cpu); 826 } 827 828 /* 829 * This itererator needs some explanation. 830 * It returns 1 for the header position. 831 * This means 2 is CPU 0. 832 * In a hotplugged system some CPUs, including CPU 0, may be missing so we have 833 * to use cpumask_* to iterate over the CPUs. 834 */ 835 static void *sched_debug_start(struct seq_file *file, loff_t *offset) 836 { 837 unsigned long n = *offset; 838 839 if (n == 0) 840 return (void *) 1; 841 842 n--; 843 844 if (n > 0) 845 n = cpumask_next(n - 1, cpu_online_mask); 846 else 847 n = cpumask_first(cpu_online_mask); 848 849 *offset = n + 1; 850 851 if (n < nr_cpu_ids) 852 return (void *)(unsigned long)(n + 2); 853 854 return NULL; 855 } 856 857 static void *sched_debug_next(struct seq_file *file, void *data, loff_t *offset) 858 { 859 (*offset)++; 860 return sched_debug_start(file, offset); 861 } 862 863 static void sched_debug_stop(struct seq_file *file, void *data) 864 { 865 } 866 867 static const struct seq_operations sched_debug_sops = { 868 .start = sched_debug_start, 869 .next = sched_debug_next, 870 .stop = sched_debug_stop, 871 .show = sched_debug_show, 872 }; 873 874 static int __init init_sched_debug_procfs(void) 875 { 876 if (!proc_create_seq("sched_debug", 0444, NULL, &sched_debug_sops)) 877 return -ENOMEM; 878 return 0; 879 } 880 881 __initcall(init_sched_debug_procfs); 882 883 #define __P(F) SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) 884 #define P(F) SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)p->F) 885 #define __PN(F) SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)F)) 886 #define PN(F) SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)p->F)) 887 888 889 #ifdef CONFIG_NUMA_BALANCING 890 void print_numa_stats(struct seq_file *m, int node, unsigned long tsf, 891 unsigned long tpf, unsigned long gsf, unsigned long gpf) 892 { 893 SEQ_printf(m, "numa_faults node=%d ", node); 894 SEQ_printf(m, "task_private=%lu task_shared=%lu ", tpf, tsf); 895 SEQ_printf(m, "group_private=%lu group_shared=%lu\n", gpf, gsf); 896 } 897 #endif 898 899 900 static void sched_show_numa(struct task_struct *p, struct seq_file *m) 901 { 902 #ifdef CONFIG_NUMA_BALANCING 903 struct mempolicy *pol; 904 905 if (p->mm) 906 P(mm->numa_scan_seq); 907 908 task_lock(p); 909 pol = p->mempolicy; 910 if (pol && !(pol->flags & MPOL_F_MORON)) 911 pol = NULL; 912 mpol_get(pol); 913 task_unlock(p); 914 915 P(numa_pages_migrated); 916 P(numa_preferred_nid); 917 P(total_numa_faults); 918 SEQ_printf(m, "current_node=%d, numa_group_id=%d\n", 919 task_node(p), task_numa_group_id(p)); 920 show_numa_stats(p, m); 921 mpol_put(pol); 922 #endif 923 } 924 925 void proc_sched_show_task(struct task_struct *p, struct pid_namespace *ns, 926 struct seq_file *m) 927 { 928 #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY 929 struct dyn_affinity_stats *dyn_affi = p->se.dyn_affi_stats; 930 #endif 931 unsigned long nr_switches; 932 933 SEQ_printf(m, "%s (%d, #threads: %d)\n", p->comm, task_pid_nr_ns(p, ns), 934 get_nr_threads(p)); 935 SEQ_printf(m, 936 "---------------------------------------------------------" 937 "----------\n"); 938 #define __P(F) \ > 939 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) 940 #define P(F) \ 941 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)p->F) 942 #define P_SCHEDSTAT(F) \ 943 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)schedstat_val(p->F)) 944 #define __PN(F) \ 945 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)F)) 946 #define PN(F) \ 947 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)p->F)) 948 #define PN_SCHEDSTAT(F) \ 949 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)schedstat_val(p->F))) 950 951 PN(se.exec_start); 952 PN(se.vruntime); 953 PN(se.sum_exec_runtime); 954 955 nr_switches = p->nvcsw + p->nivcsw; 956 957 P(se.nr_migrations); 958 959 if (schedstat_enabled()) { 960 u64 avg_atom, avg_per_cpu; 961 962 PN_SCHEDSTAT(se.statistics.sum_sleep_runtime); 963 PN_SCHEDSTAT(se.statistics.wait_start); 964 PN_SCHEDSTAT(se.statistics.sleep_start); 965 PN_SCHEDSTAT(se.statistics.block_start); 966 PN_SCHEDSTAT(se.statistics.sleep_max); 967 PN_SCHEDSTAT(se.statistics.block_max); 968 PN_SCHEDSTAT(se.statistics.exec_max); 969 PN_SCHEDSTAT(se.statistics.slice_max); 970 PN_SCHEDSTAT(se.statistics.wait_max); 971 PN_SCHEDSTAT(se.statistics.wait_sum); 972 P_SCHEDSTAT(se.statistics.wait_count); 973 PN_SCHEDSTAT(se.statistics.iowait_sum); 974 P_SCHEDSTAT(se.statistics.iowait_count); 975 P_SCHEDSTAT(se.statistics.nr_migrations_cold); 976 P_SCHEDSTAT(se.statistics.nr_failed_migrations_affine); 977 P_SCHEDSTAT(se.statistics.nr_failed_migrations_running); 978 P_SCHEDSTAT(se.statistics.nr_failed_migrations_hot); 979 P_SCHEDSTAT(se.statistics.nr_forced_migrations); 980 P_SCHEDSTAT(se.statistics.nr_wakeups); 981 P_SCHEDSTAT(se.statistics.nr_wakeups_sync); 982 P_SCHEDSTAT(se.statistics.nr_wakeups_migrate); 983 P_SCHEDSTAT(se.statistics.nr_wakeups_local); 984 P_SCHEDSTAT(se.statistics.nr_wakeups_remote); 985 P_SCHEDSTAT(se.statistics.nr_wakeups_affine); 986 P_SCHEDSTAT(se.statistics.nr_wakeups_affine_attempts); 987 P_SCHEDSTAT(se.statistics.nr_wakeups_passive); 988 P_SCHEDSTAT(se.statistics.nr_wakeups_idle); 989 #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY > 990 __P(dyn_affi->nr_wakeups_preferred_cpus); > 991 __P(dyn_affi->nr_wakeups_force_preferred_cpus); 992 #endif 993 994 avg_atom = p->se.sum_exec_runtime; 995 if (nr_switches) 996 avg_atom = div64_ul(avg_atom, nr_switches); 997 else 998 avg_atom = -1LL; 999 1000 avg_per_cpu = p->se.sum_exec_runtime; 1001 if (p->se.nr_migrations) { 1002 avg_per_cpu = div64_u64(avg_per_cpu, 1003 p->se.nr_migrations); 1004 } else { 1005 avg_per_cpu = -1LL; 1006 } 1007 1008 __PN(avg_atom); 1009 __PN(avg_per_cpu); 1010 } 1011 1012 __P(nr_switches); 1013 SEQ_printf(m, "%-45s:%21Ld\n", 1014 "nr_voluntary_switches", (long long)p->nvcsw); 1015 SEQ_printf(m, "%-45s:%21Ld\n", 1016 "nr_involuntary_switches", (long long)p->nivcsw); 1017 1018 P(se.load.weight); 1019 P(se.runnable_weight); 1020 #ifdef CONFIG_SMP 1021 P(se.avg.load_sum); 1022 P(se.avg.runnable_load_sum); 1023 P(se.avg.util_sum); 1024 P(se.avg.load_avg); 1025 P(se.avg.runnable_load_avg); 1026 P(se.avg.util_avg); 1027 P(se.avg.last_update_time); 1028 P(se.avg.util_est.ewma); 1029 P(se.avg.util_est.enqueued); 1030 #endif 1031 P(policy); 1032 P(prio); 1033 if (task_has_dl_policy(p)) { 1034 P(dl.runtime); 1035 P(dl.deadline); 1036 } 1037 #undef PN_SCHEDSTAT 1038 #undef PN 1039 #undef __PN 1040 #undef P_SCHEDSTAT 1041 #undef P 1042 #undef __P 1043 1044 { 1045 unsigned int this_cpu = raw_smp_processor_id(); 1046 u64 t0, t1; 1047 1048 t0 = cpu_clock(this_cpu); 1049 t1 = cpu_clock(this_cpu); 1050 SEQ_printf(m, "%-45s:%21Ld\n", 1051 "clock-delta", (long long)(t1-t0)); 1052 } 1053 1054 sched_show_numa(p, m); 1055 } 1056 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] f2fs: fix dereference of stale list iterator after loop body
by Wupeng Ma 31 Mar '25

31 Mar '25

From: Jakob Koschel <jakobkoschel(a)gmail.com> stable inclusion from stable-v4.19.247 commit 385edd3ce5b4b1e9d31f474a5e35a39779ec1110 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBP3SH CVE: CVE-2022-49425 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2aaf51dd39afb6d01d13f1e6fe20b684733b37d5 ] The list iterator variable will be a bogus pointer if no break was hit. Dereferencing it (cur->page in this case) could load an out-of-bounds/undefined value making it unsafe to use that in the comparision to determine if the specific element was found. Since 'cur->page' *can* be out-ouf-bounds it cannot be guaranteed that by chance (or intention of an attacker) it matches the value of 'page' even though the correct element was not found. This is fixed by using a separate list iterator variable for the loop and only setting the original variable if a suitable element was found. Then determing if the element was found is simply checking if the variable is set. Fixes: 8c242db9b8c0 ("f2fs: fix stale ATOMIC_WRITTEN_PAGE private pointer") Signed-off-by: Jakob Koschel <jakobkoschel(a)gmail.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- fs/f2fs/segment.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c index 0e3e590a250f..6fbf0471323e 100644 --- a/fs/f2fs/segment.c +++ b/fs/f2fs/segment.c @@ -354,16 +354,19 @@ void f2fs_drop_inmem_page(struct inode *inode, struct page *page) struct f2fs_sb_info *sbi = F2FS_I_SB(inode); struct list_head *head = &fi->inmem_pages; struct inmem_pages *cur = NULL; + struct inmem_pages *tmp; f2fs_bug_on(sbi, !IS_ATOMIC_WRITTEN_PAGE(page)); mutex_lock(&fi->inmem_lock); - list_for_each_entry(cur, head, list) { - if (cur->page == page) + list_for_each_entry(tmp, head, list) { + if (tmp->page == page) { + cur = tmp; break; + } } - f2fs_bug_on(sbi, list_empty(head) || cur->page != page); + f2fs_bug_on(sbi, !cur); list_del(&cur->list); mutex_unlock(&fi->inmem_lock); -- 2.43.0

2 1

[openeuler:OLK-5.10 2829/2829] drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2340: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2854: first defined here
by kernel test robot 31 Mar '25

31 Mar '25

Hi DuanqiangWen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0e7e8faca7062a439fd0a56574c2c3860ceb2088 commit: 3ddd74dceeba1f4ea8b20db59276ea3c6eded3d5 [2829/2829] openeuler: net: txgbe: Fix some known bugs, merge net-swift txgbe-1.2.3 out-of-tree config: x86_64-randconfig-122-20250330 (https://download.01.org/0day-ci/archive/20250331/202503310959.wgczfMA5-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503310959.wgczfMA5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503310959.wgczfMA5-lkp@intel.com/ All errors (new ones prefixed by >>): ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `fmgr_cmd_op': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2340: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2854: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `fmgr_usr_cmd_op': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2361: multiple definition of `fmgr_usr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2875: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_erase_chip': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2371: multiple definition of `flash_erase_chip'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2885: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_erase_sector': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2377: multiple definition of `flash_erase_sector'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2891: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_write_dword': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2393: multiple definition of `flash_write_dword'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2908: first defined here sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:625:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:625:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:625:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:1004:6: sparse: sparse: symbol 'txgbe_add_uc_addr' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:1138:6: sparse: sparse: symbol 'txgbe_set_mta' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2604:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2604:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2604:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2707:5: sparse: sparse: symbol 'txgbe_setup_mac_link_hostif' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2744:5: sparse: sparse: symbol 'txgbe_crc16_ccitt' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2897:5: sparse: sparse: symbol 'flash_read_dword' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2922:5: sparse: sparse: symbol 'txgbe_flash_write_cab' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2944:5: sparse: sparse: symbol 'txgbe_flash_read_cab' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2975:5: sparse: sparse: symbol 'txgbe_flash_write_unlock' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2998:5: sparse: sparse: symbol 'txgbe_flash_write_lock' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3451:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3451:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3451:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3496:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3496:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3496:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4396:5: sparse: sparse: symbol 'txgbe_enable_rx_adapter' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4417:5: sparse: sparse: symbol 'txgbe_set_sgmii_an37_ability' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4972:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4972:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4972:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:5345:5: sparse: sparse: symbol 'txgbe_reset_misc' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6426:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6426:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6426:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6428:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6428:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6428:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6593:5: sparse: sparse: symbol 'txgbe_read_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6642:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6642:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6642:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6724:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6724:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6724:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6737:5: sparse: sparse: symbol 'txgbe_write_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6847:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6847:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6847:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6890:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6890:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6890:9: sparse: int -- drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:132:5: sparse: sparse: symbol 'txgbe_poll_for_msg' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:162:5: sparse: sparse: symbol 'txgbe_poll_for_ack' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:263:5: sparse: sparse: symbol 'txgbe_read_v2p_mailbox' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:284:5: sparse: sparse: symbol 'txgbe_check_for_bit_vf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:300:5: sparse: sparse: symbol 'txgbe_check_for_msg_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:320:5: sparse: sparse: symbol 'txgbe_check_for_ack_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:340:5: sparse: sparse: symbol 'txgbe_check_for_rst_vf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:359:5: sparse: sparse: symbol 'txgbe_obtain_mbx_lock_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:387:5: sparse: sparse: symbol 'txgbe_write_mbx_vf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:425:5: sparse: sparse: symbol 'txgbe_read_mbx_vf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:483:5: sparse: sparse: symbol 'txgbe_check_for_bit_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:503:5: sparse: sparse: symbol 'txgbe_check_for_msg_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:525:5: sparse: sparse: symbol 'txgbe_check_for_ack_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:547:5: sparse: sparse: symbol 'txgbe_check_for_rst_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:572:5: sparse: sparse: symbol 'txgbe_obtain_mbx_lock_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:601:5: sparse: sparse: symbol 'txgbe_write_mbx_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:644:5: sparse: sparse: symbol 'txgbe_read_mbx_pf' was not declared. Should it be static? vim +2340 drivers/net/ethernet/netswift/ngbe/ngbe_hw.c a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2333 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2334 /** a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2335 * cmd_addr is used for some special command: a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2336 * 1. to be sector address, when implemented erase sector command a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2337 * 2. to be flash address when implemented read, write flash address a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2338 **/ a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2339 u8 fmgr_cmd_op(struct ngbe_hw *hw, u32 cmd, u32 cmd_addr) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2340 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2341 u32 cmd_val = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2342 u32 time_out = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2343 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2344 cmd_val = (cmd << SPI_CLK_CMD_OFFSET) | (SPI_CLK_DIV << SPI_CLK_DIV_OFFSET) | cmd_addr; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2345 wr32(hw, SPI_H_CMD_REG_ADDR, cmd_val); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2346 while (1) { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2347 if (rd32(hw, SPI_H_STA_REG_ADDR) & 0x1) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2348 break; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2349 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2350 if (time_out == SPI_TIME_OUT_VALUE) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2351 return 1; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2352 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2353 time_out = time_out + 1; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2354 udelay(10); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2355 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2356 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2357 return 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2358 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2359 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2360 u8 fmgr_usr_cmd_op(struct ngbe_hw *hw, u32 usr_cmd) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2361 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2362 u8 status = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2363 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2364 wr32(hw, SPI_H_USR_CMD_REG_ADDR, usr_cmd); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2365 status = fmgr_cmd_op(hw, SPI_CMD_USER_CMD, 0); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2366 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2367 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2368 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2369 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2370 u8 flash_erase_chip(struct ngbe_hw *hw) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2371 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2372 u8 status = fmgr_cmd_op(hw, SPI_CMD_ERASE_CHIP, 0); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2373 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2374 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2375 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2376 u8 flash_erase_sector(struct ngbe_hw *hw, u32 sec_addr) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2377 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2378 u8 status = fmgr_cmd_op(hw, SPI_CMD_ERASE_SECTOR, sec_addr); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2379 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2380 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2381 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2382 u32 ngbe_flash_read_dword(struct ngbe_hw *hw, u32 addr) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2383 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2384 u8 status = fmgr_cmd_op(hw, SPI_CMD_READ_DWORD, addr); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2385 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2386 if (status) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2387 return (u32)status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2388 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2389 return rd32(hw, SPI_H_DAT_REG_ADDR); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2390 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2391 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2392 u8 flash_write_dword(struct ngbe_hw *hw, u32 addr, u32 dword) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2393 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2394 u8 status = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2395 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2396 wr32(hw, SPI_H_DAT_REG_ADDR, dword); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2397 status = fmgr_cmd_op(hw, SPI_CMD_WRITE_DWORD, addr); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2398 if (status) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2399 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2400 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2401 if (dword != ngbe_flash_read_dword(hw, addr)) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2402 return 1; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2403 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2404 return 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2405 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2406 :::::: The code at line 2340 was first introduced by commit :::::: a5961b4bc6ce09a70902686ecc848a47493a9251 openeuler: net: ngbe: add ngbe module support :::::: TO: Duanqiang Wen <duanqiangwen(a)net-swift.com> :::::: CC: Duanqiang Wen <duanqiangwen(a)net-swift.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1327/1327] mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled'
by kernel test robot 31 Mar '25

31 Mar '25

Hi liubo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: 44983705e56ab22fda801d66e2a6bd0d1be7ca0b [1327/1327] etmem: add original kernel swap enabled options config: x86_64-buildonly-randconfig-005-20241216 (https://download.01.org/0day-ci/archive/20250331/202503310818.VmXexZb9-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503310818.VmXexZb9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503310818.VmXexZb9-lkp@intel.com/ All errors (new ones prefixed by >>): mm/vmscan.c:2734:17: warning: variable 'node_lru_pages' set but not used [-Wunused-but-set-variable] 2734 | unsigned long node_lru_pages = 0; | ^ >> mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] 3257 | if (sc != NULL && !kernel_swap_enabled()) | ^ mm/vmscan.c:3257:21: note: did you mean 'kernfs_ns_enabled'? include/linux/kernfs.h:309:20: note: 'kernfs_ns_enabled' declared here 309 | static inline bool kernfs_ns_enabled(struct kernfs_node *kn) | ^ 1 warning and 1 error generated. vim +/kernel_swap_enabled +3257 mm/vmscan.c 3250 3251 /* 3252 * Check if original kernel swap is enabled 3253 * turn off kernel swap,but leave page cache reclaim on 3254 */ 3255 static inline void kernel_swap_check(struct scan_control *sc) 3256 { > 3257 if (sc != NULL && !kernel_swap_enabled()) 3258 sc->may_swap = 0; 3259 } 3260 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2829/2829] drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:177:5: sparse: sparse: symbol 'txgbe_get_link_ksettings' was not declared. Should it be static?
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0e7e8faca7062a439fd0a56574c2c3860ceb2088 commit: 96c897d3a6cb76928d7981f60f832afba1bcc01b [2829/2829] openeuler: configs: delete txgbe/Kconfig, add txgbe_config to netswift/Kconfig config: x86_64-randconfig-122-20250330 (https://download.01.org/0day-ci/archive/20250330/202503302242.szHIIxdv-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503302242.szHIIxdv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503302242.szHIIxdv-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:177:5: sparse: sparse: symbol 'txgbe_get_link_ksettings' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:447:33: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:447:33: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:447:33: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1674:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1674:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1674:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1696:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1696:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1696:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1732:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1732:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1732:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1736:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1736:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:1736:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2089:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2089:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2089:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2424:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] psrc @@ got unsigned short [usertype] src_port @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2424:36: sparse: expected restricted __be16 [usertype] psrc drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2424:36: sparse: got unsigned short [usertype] src_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2425:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] psrc @@ got unsigned short [usertype] src_port @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2425:36: sparse: expected restricted __be16 [usertype] psrc drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2425:36: sparse: got unsigned short [usertype] src_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2426:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] pdst @@ got unsigned short [usertype] dst_port @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2426:36: sparse: expected restricted __be16 [usertype] pdst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2426:36: sparse: got unsigned short [usertype] dst_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2427:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] pdst @@ got unsigned short [usertype] dst_port @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2427:36: sparse: expected restricted __be16 [usertype] pdst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2427:36: sparse: got unsigned short [usertype] dst_port >> drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2428:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] ip4src @@ got unsigned int @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2428:38: sparse: expected restricted __be32 [usertype] ip4src drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2428:38: sparse: got unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2429:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] ip4src @@ got unsigned int @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2429:38: sparse: expected restricted __be32 [usertype] ip4src drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2429:38: sparse: got unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2430:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] ip4dst @@ got unsigned int @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2430:38: sparse: expected restricted __be32 [usertype] ip4dst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2430:38: sparse: got unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2431:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] ip4dst @@ got unsigned int @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2431:38: sparse: expected restricted __be32 [usertype] ip4dst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2431:38: sparse: got unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2432:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] vlan_etype @@ got unsigned short [usertype] flex_bytes @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2432:31: sparse: expected restricted __be16 [usertype] vlan_etype drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2432:31: sparse: got unsigned short [usertype] flex_bytes drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2433:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] vlan_etype @@ got unsigned short [usertype] flex_bytes @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2433:31: sparse: expected restricted __be16 [usertype] vlan_etype drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2433:31: sparse: got unsigned short [usertype] flex_bytes drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2434:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2434:28: sparse: expected restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2434:28: sparse: got unsigned int [usertype] drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2435:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2435:28: sparse: expected restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2435:28: sparse: got unsigned int [usertype] >> drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2703:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __be32 [usertype] ip4src @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2703:43: sparse: expected unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2703:43: sparse: got restricted __be32 [usertype] ip4src drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2704:34: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __be32 [usertype] ip4src @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2704:34: sparse: expected unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2704:34: sparse: got restricted __be32 [usertype] ip4src >> drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2705:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __be32 [usertype] ip4dst @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2705:43: sparse: expected unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2705:43: sparse: got restricted __be32 [usertype] ip4dst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2706:34: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __be32 [usertype] ip4dst @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2706:34: sparse: expected unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2706:34: sparse: got restricted __be32 [usertype] ip4dst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2707:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] src_port @@ got restricted __be16 [usertype] psrc @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2707:42: sparse: expected unsigned short [usertype] src_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2707:42: sparse: got restricted __be16 [usertype] psrc drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2708:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [addressable] [assigned] [usertype] src_port @@ got restricted __be16 [usertype] psrc @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2708:33: sparse: expected unsigned short [addressable] [assigned] [usertype] src_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2708:33: sparse: got restricted __be16 [usertype] psrc >> drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2709:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] dst_port @@ got restricted __be16 [usertype] pdst @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2709:42: sparse: expected unsigned short [usertype] dst_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2709:42: sparse: got restricted __be16 [usertype] pdst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2710:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [addressable] [assigned] [usertype] dst_port @@ got restricted __be16 [usertype] pdst @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2710:33: sparse: expected unsigned short [addressable] [assigned] [usertype] dst_port drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2710:33: sparse: got restricted __be16 [usertype] pdst drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2714:48: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2716:48: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2717:52: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] flex_bytes @@ got restricted __be16 [usertype] vlan_etype @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2717:52: sparse: expected unsigned short [usertype] flex_bytes drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2717:52: sparse: got restricted __be16 [usertype] vlan_etype drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2719:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [addressable] [assigned] [usertype] flex_bytes @@ got restricted __be16 [usertype] vlan_etype @@ drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2719:43: sparse: expected unsigned short [addressable] [assigned] [usertype] flex_bytes drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c:2719:43: sparse: got restricted __be16 [usertype] vlan_etype -- drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:132:5: sparse: sparse: symbol 'txgbe_poll_for_msg' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:162:5: sparse: sparse: symbol 'txgbe_poll_for_ack' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:185:5: sparse: sparse: symbol 'txgbe_check_for_bit_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:205:5: sparse: sparse: symbol 'txgbe_check_for_msg_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:227:5: sparse: sparse: symbol 'txgbe_check_for_ack_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:249:5: sparse: sparse: symbol 'txgbe_check_for_rst_pf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:274:5: sparse: sparse: symbol 'txgbe_obtain_mbx_lock_pf' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:303:5: sparse: sparse: symbol 'txgbe_write_mbx_pf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:346:5: sparse: sparse: symbol 'txgbe_read_mbx_pf' was not declared. Should it be static? -- drivers/net/ethernet/netswift/txgbe/txgbe_main.c:170:6: sparse: sparse: symbol 'txgbe_service_event_schedule' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:930:40: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __be16 [usertype] vlan_proto @@ got unsigned short [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:930:40: sparse: expected restricted __be16 [usertype] vlan_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:930:40: sparse: got unsigned short [usertype] drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2632:6: sparse: sparse: symbol 'txgbe_disable_tx_queue' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2777:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2777:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2777:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2781:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2781:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2781:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2858:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2858:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2858:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2913:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2913:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2913:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3297:5: sparse: sparse: symbol 'txgbe_add_cloud_switcher' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3312:5: sparse: sparse: symbol 'txgbe_del_cloud_switcher' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3632:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3632:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3632:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3662:6: sparse: sparse: symbol 'txgbe_configure_isb' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3672:6: sparse: sparse: symbol 'txgbe_configure_port' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3921:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3921:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3921:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4227:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4227:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4227:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4292:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4292:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4292:17: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4310:5: sparse: sparse: symbol 'txgbe_init_shared_code' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4392:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4392:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4392:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4821:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4821:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4821:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4953:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4953:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4953:17: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5952:40: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5974:36: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5978:67: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5988:32: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5989:36: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5993:67: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6007:37: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6031:40: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6643:33: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6643:33: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6643:33: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6645:33: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6645:33: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6645:33: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6647:38: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6648:25: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6648:25: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6648:25: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6652:27: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6652:27: sparse: left side has type unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6652:27: sparse: right side has type restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6662:27: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6662:27: sparse: left side has type unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6662:27: sparse: right side has type restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6682:5: sparse: sparse: symbol 'txgbe_skb_pad_nonzero' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6724:30: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] protocol @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6724:30: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6724:30: sparse: got restricted __be16 [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6770:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6770:26: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6770:26: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6771:29: sparse: sparse: cast from restricted __be16 >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6804:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] h_vlan_TCI @@ got unsigned short [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6804:42: sparse: expected restricted __be16 [usertype] h_vlan_TCI drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6804:42: sparse: got unsigned short [usertype] drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7209:25: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] port @@ got restricted __be16 [usertype] port @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7209:25: sparse: expected unsigned short [usertype] port drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7209:25: sparse: got restricted __be16 [usertype] port drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7275:46: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7277:37: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7285:47: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7287:37: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7379:26: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] type @@ got restricted __be16 [usertype] protocol @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7379:26: sparse: expected unsigned short [usertype] type drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7379:26: sparse: got restricted __be16 [usertype] protocol >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7395:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] type @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7395:22: sparse: expected unsigned short [usertype] type drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7395:22: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7422:35: sparse: sparse: incorrect type in initializer (incompatible argument 2 (different base types)) @@ expected int ( *ndo_vlan_rx_add_vid )( ... ) @@ got int ( * )( ... ) @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7422:35: sparse: expected int ( *ndo_vlan_rx_add_vid )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7422:35: sparse: got int ( * )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7423:35: sparse: sparse: incorrect type in initializer (incompatible argument 2 (different base types)) @@ expected int ( *ndo_vlan_rx_kill_vid )( ... ) @@ got int ( * )( ... ) @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7423:35: sparse: expected int ( *ndo_vlan_rx_kill_vid )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7423:35: sparse: got int ( * )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7583:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7583:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7583:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7786:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7786:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7786:17: sparse: int -- drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:645:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:645:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:645:9: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:1042:6: sparse: sparse: symbol 'txgbe_add_uc_addr' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:1186:6: sparse: sparse: symbol 'txgbe_set_mta' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2699:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2699:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2699:9: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2806:5: sparse: sparse: symbol 'txgbe_setup_mac_link_hostif' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2845:5: sparse: sparse: symbol 'txgbe_crc16_ccitt' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3297:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3297:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3297:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3342:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3342:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3342:17: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4238:5: sparse: sparse: symbol 'txgbe_enable_rx_adapter' was not declared. Should it be static? >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4259:5: sparse: sparse: symbol 'txgbe_set_sgmii_an37_ability' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4833:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4833:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4833:9: sparse: int >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:5239:5: sparse: sparse: symbol 'txgbe_reset_misc' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6345:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6345:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6345:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6347:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6347:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6347:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6520:5: sparse: sparse: symbol 'txgbe_read_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6572:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6572:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6572:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6656:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6656:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6656:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6669:5: sparse: sparse: symbol 'txgbe_write_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6712:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6712:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6712:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6757:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6757:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6757:9: sparse: int vim +/txgbe_get_link_ksettings +177 drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c a493f74ade8fe6 zhenpengzheng 2021-07-13 176 a493f74ade8fe6 zhenpengzheng 2021-07-13 @177 int txgbe_get_link_ksettings(struct net_device *netdev, a493f74ade8fe6 zhenpengzheng 2021-07-13 178 struct ethtool_link_ksettings *cmd) a493f74ade8fe6 zhenpengzheng 2021-07-13 179 { a493f74ade8fe6 zhenpengzheng 2021-07-13 180 struct txgbe_adapter *adapter = netdev_priv(netdev); a493f74ade8fe6 zhenpengzheng 2021-07-13 181 struct txgbe_hw *hw = &adapter->hw; a493f74ade8fe6 zhenpengzheng 2021-07-13 182 u32 supported_link; a493f74ade8fe6 zhenpengzheng 2021-07-13 183 u32 link_speed = 0; a493f74ade8fe6 zhenpengzheng 2021-07-13 184 bool autoneg = false; a493f74ade8fe6 zhenpengzheng 2021-07-13 185 u32 supported, advertising; a493f74ade8fe6 zhenpengzheng 2021-07-13 186 bool link_up; a493f74ade8fe6 zhenpengzheng 2021-07-13 187 a493f74ade8fe6 zhenpengzheng 2021-07-13 188 ethtool_convert_link_mode_to_legacy_u32(&supported, a493f74ade8fe6 zhenpengzheng 2021-07-13 189 cmd->link_modes.supported); a493f74ade8fe6 zhenpengzheng 2021-07-13 190 a493f74ade8fe6 zhenpengzheng 2021-07-13 191 TCALL(hw, mac.ops.get_link_capabilities, &supported_link, &autoneg); a493f74ade8fe6 zhenpengzheng 2021-07-13 192 a493f74ade8fe6 zhenpengzheng 2021-07-13 193 if ((hw->subsystem_device_id & 0xF0) == TXGBE_ID_KR_KX_KX4) a493f74ade8fe6 zhenpengzheng 2021-07-13 194 autoneg = adapter->backplane_an ? 1:0; a493f74ade8fe6 zhenpengzheng 2021-07-13 195 else if ((hw->subsystem_device_id & 0xF0) == TXGBE_ID_MAC_SGMII) a493f74ade8fe6 zhenpengzheng 2021-07-13 196 autoneg = adapter->an37?1:0; a493f74ade8fe6 zhenpengzheng 2021-07-13 197 a493f74ade8fe6 zhenpengzheng 2021-07-13 198 /* set the supported link speeds */ a493f74ade8fe6 zhenpengzheng 2021-07-13 199 if (supported_link & TXGBE_LINK_SPEED_10GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 200 supported |= (txgbe_isbackplane(hw->phy.media_type)) ? a493f74ade8fe6 zhenpengzheng 2021-07-13 201 txgbe_backplane_type(hw) : SUPPORTED_10000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 202 if (supported_link & TXGBE_LINK_SPEED_1GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 203 supported |= (txgbe_isbackplane(hw->phy.media_type)) ? a493f74ade8fe6 zhenpengzheng 2021-07-13 204 SUPPORTED_1000baseKX_Full : SUPPORTED_1000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 205 if (supported_link & TXGBE_LINK_SPEED_100_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 206 supported |= SUPPORTED_100baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 207 if (supported_link & TXGBE_LINK_SPEED_10_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 208 supported |= SUPPORTED_10baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 209 a493f74ade8fe6 zhenpengzheng 2021-07-13 210 /* default advertised speed if phy.autoneg_advertised isn't set */ a493f74ade8fe6 zhenpengzheng 2021-07-13 211 advertising = supported; a493f74ade8fe6 zhenpengzheng 2021-07-13 212 a493f74ade8fe6 zhenpengzheng 2021-07-13 213 /* set the advertised speeds */ a493f74ade8fe6 zhenpengzheng 2021-07-13 214 if (hw->phy.autoneg_advertised) { a493f74ade8fe6 zhenpengzheng 2021-07-13 215 if (hw->phy.autoneg_advertised & TXGBE_LINK_SPEED_100_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 216 advertising |= ADVERTISED_100baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 217 if (hw->phy.autoneg_advertised & TXGBE_LINK_SPEED_10GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 218 advertising |= (supported & ADVERTISED_MASK_10G); a493f74ade8fe6 zhenpengzheng 2021-07-13 219 if (hw->phy.autoneg_advertised & TXGBE_LINK_SPEED_1GB_FULL) { a493f74ade8fe6 zhenpengzheng 2021-07-13 220 if (supported & SUPPORTED_1000baseKX_Full) a493f74ade8fe6 zhenpengzheng 2021-07-13 221 advertising |= ADVERTISED_1000baseKX_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 222 else a493f74ade8fe6 zhenpengzheng 2021-07-13 223 advertising |= ADVERTISED_1000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 224 } a493f74ade8fe6 zhenpengzheng 2021-07-13 225 if (hw->phy.autoneg_advertised & TXGBE_LINK_SPEED_10_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 226 advertising |= ADVERTISED_10baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 227 } else { a493f74ade8fe6 zhenpengzheng 2021-07-13 228 /* default modes in case phy.autoneg_advertised isn't set */ a493f74ade8fe6 zhenpengzheng 2021-07-13 229 if (supported_link & TXGBE_LINK_SPEED_10GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 230 advertising |= ADVERTISED_10000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 231 if (supported_link & TXGBE_LINK_SPEED_1GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 232 advertising |= ADVERTISED_1000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 233 if (supported_link & TXGBE_LINK_SPEED_100_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 234 advertising |= ADVERTISED_100baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 235 if (hw->phy.multispeed_fiber && !autoneg) { a493f74ade8fe6 zhenpengzheng 2021-07-13 236 if (supported_link & TXGBE_LINK_SPEED_10GB_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 237 advertising = ADVERTISED_10000baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 238 } a493f74ade8fe6 zhenpengzheng 2021-07-13 239 if (supported_link & TXGBE_LINK_SPEED_10_FULL) a493f74ade8fe6 zhenpengzheng 2021-07-13 240 advertising |= ADVERTISED_10baseT_Full; a493f74ade8fe6 zhenpengzheng 2021-07-13 241 } a493f74ade8fe6 zhenpengzheng 2021-07-13 242 a493f74ade8fe6 zhenpengzheng 2021-07-13 243 if (autoneg) { a493f74ade8fe6 zhenpengzheng 2021-07-13 244 supported |= SUPPORTED_Autoneg; a493f74ade8fe6 zhenpengzheng 2021-07-13 245 advertising |= ADVERTISED_Autoneg; a493f74ade8fe6 zhenpengzheng 2021-07-13 246 cmd->base.autoneg = AUTONEG_ENABLE; a493f74ade8fe6 zhenpengzheng 2021-07-13 247 } else a493f74ade8fe6 zhenpengzheng 2021-07-13 248 cmd->base.autoneg = AUTONEG_DISABLE; a493f74ade8fe6 zhenpengzheng 2021-07-13 249 a493f74ade8fe6 zhenpengzheng 2021-07-13 250 /* Determine the remaining settings based on the PHY type. */ a493f74ade8fe6 zhenpengzheng 2021-07-13 251 switch (adapter->hw.phy.type) { a493f74ade8fe6 zhenpengzheng 2021-07-13 252 case txgbe_phy_tn: a493f74ade8fe6 zhenpengzheng 2021-07-13 253 case txgbe_phy_aq: a493f74ade8fe6 zhenpengzheng 2021-07-13 254 case txgbe_phy_cu_unknown: a493f74ade8fe6 zhenpengzheng 2021-07-13 255 supported |= SUPPORTED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 256 advertising |= ADVERTISED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 257 cmd->base.port = PORT_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 258 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 259 case txgbe_phy_qt: a493f74ade8fe6 zhenpengzheng 2021-07-13 260 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 261 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 262 cmd->base.port = PORT_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 263 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 264 case txgbe_phy_nl: a493f74ade8fe6 zhenpengzheng 2021-07-13 265 case txgbe_phy_sfp_passive_tyco: a493f74ade8fe6 zhenpengzheng 2021-07-13 266 case txgbe_phy_sfp_passive_unknown: a493f74ade8fe6 zhenpengzheng 2021-07-13 267 case txgbe_phy_sfp_ftl: a493f74ade8fe6 zhenpengzheng 2021-07-13 268 case txgbe_phy_sfp_avago: a493f74ade8fe6 zhenpengzheng 2021-07-13 269 case txgbe_phy_sfp_intel: a493f74ade8fe6 zhenpengzheng 2021-07-13 270 case txgbe_phy_sfp_unknown: a493f74ade8fe6 zhenpengzheng 2021-07-13 271 switch (adapter->hw.phy.sfp_type) { a493f74ade8fe6 zhenpengzheng 2021-07-13 272 /* SFP+ devices, further checking needed */ a493f74ade8fe6 zhenpengzheng 2021-07-13 273 case txgbe_sfp_type_da_cu: a493f74ade8fe6 zhenpengzheng 2021-07-13 274 case txgbe_sfp_type_da_cu_core0: a493f74ade8fe6 zhenpengzheng 2021-07-13 275 case txgbe_sfp_type_da_cu_core1: a493f74ade8fe6 zhenpengzheng 2021-07-13 276 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 277 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 278 cmd->base.port = PORT_DA; a493f74ade8fe6 zhenpengzheng 2021-07-13 279 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 280 case txgbe_sfp_type_sr: a493f74ade8fe6 zhenpengzheng 2021-07-13 281 case txgbe_sfp_type_lr: a493f74ade8fe6 zhenpengzheng 2021-07-13 282 case txgbe_sfp_type_srlr_core0: a493f74ade8fe6 zhenpengzheng 2021-07-13 283 case txgbe_sfp_type_srlr_core1: a493f74ade8fe6 zhenpengzheng 2021-07-13 284 case txgbe_sfp_type_1g_sx_core0: a493f74ade8fe6 zhenpengzheng 2021-07-13 285 case txgbe_sfp_type_1g_sx_core1: a493f74ade8fe6 zhenpengzheng 2021-07-13 286 case txgbe_sfp_type_1g_lx_core0: a493f74ade8fe6 zhenpengzheng 2021-07-13 287 case txgbe_sfp_type_1g_lx_core1: a493f74ade8fe6 zhenpengzheng 2021-07-13 288 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 289 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 290 cmd->base.port = PORT_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 291 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 292 case txgbe_sfp_type_not_present: a493f74ade8fe6 zhenpengzheng 2021-07-13 293 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 294 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 295 cmd->base.port = PORT_NONE; a493f74ade8fe6 zhenpengzheng 2021-07-13 296 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 297 case txgbe_sfp_type_1g_cu_core0: a493f74ade8fe6 zhenpengzheng 2021-07-13 298 case txgbe_sfp_type_1g_cu_core1: a493f74ade8fe6 zhenpengzheng 2021-07-13 299 supported |= SUPPORTED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 300 advertising |= ADVERTISED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 301 cmd->base.port = PORT_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 302 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 303 case txgbe_sfp_type_unknown: a493f74ade8fe6 zhenpengzheng 2021-07-13 304 default: a493f74ade8fe6 zhenpengzheng 2021-07-13 305 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 306 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 307 cmd->base.port = PORT_OTHER; a493f74ade8fe6 zhenpengzheng 2021-07-13 308 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 309 } a493f74ade8fe6 zhenpengzheng 2021-07-13 310 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 311 case txgbe_phy_xaui: a493f74ade8fe6 zhenpengzheng 2021-07-13 312 supported |= SUPPORTED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 313 advertising |= ADVERTISED_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 314 cmd->base.port = PORT_TP; a493f74ade8fe6 zhenpengzheng 2021-07-13 315 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 316 case txgbe_phy_unknown: a493f74ade8fe6 zhenpengzheng 2021-07-13 317 case txgbe_phy_generic: a493f74ade8fe6 zhenpengzheng 2021-07-13 318 case txgbe_phy_sfp_unsupported: a493f74ade8fe6 zhenpengzheng 2021-07-13 319 default: a493f74ade8fe6 zhenpengzheng 2021-07-13 320 supported |= SUPPORTED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 321 advertising |= ADVERTISED_FIBRE; a493f74ade8fe6 zhenpengzheng 2021-07-13 322 cmd->base.port = PORT_OTHER; a493f74ade8fe6 zhenpengzheng 2021-07-13 323 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 324 } a493f74ade8fe6 zhenpengzheng 2021-07-13 325 a493f74ade8fe6 zhenpengzheng 2021-07-13 326 if (!in_interrupt()) { a493f74ade8fe6 zhenpengzheng 2021-07-13 327 TCALL(hw, mac.ops.check_link, &link_speed, &link_up, false); a493f74ade8fe6 zhenpengzheng 2021-07-13 328 } else { a493f74ade8fe6 zhenpengzheng 2021-07-13 329 /* a493f74ade8fe6 zhenpengzheng 2021-07-13 330 * this case is a special workaround for RHEL5 bonding a493f74ade8fe6 zhenpengzheng 2021-07-13 331 * that calls this routine from interrupt context a493f74ade8fe6 zhenpengzheng 2021-07-13 332 */ a493f74ade8fe6 zhenpengzheng 2021-07-13 333 link_speed = adapter->link_speed; a493f74ade8fe6 zhenpengzheng 2021-07-13 334 link_up = adapter->link_up; a493f74ade8fe6 zhenpengzheng 2021-07-13 335 } a493f74ade8fe6 zhenpengzheng 2021-07-13 336 a493f74ade8fe6 zhenpengzheng 2021-07-13 337 supported |= SUPPORTED_Pause; a493f74ade8fe6 zhenpengzheng 2021-07-13 338 a493f74ade8fe6 zhenpengzheng 2021-07-13 339 switch (hw->fc.requested_mode) { a493f74ade8fe6 zhenpengzheng 2021-07-13 340 case txgbe_fc_full: a493f74ade8fe6 zhenpengzheng 2021-07-13 341 advertising |= ADVERTISED_Pause; a493f74ade8fe6 zhenpengzheng 2021-07-13 342 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 343 case txgbe_fc_rx_pause: a493f74ade8fe6 zhenpengzheng 2021-07-13 344 advertising |= ADVERTISED_Pause | a493f74ade8fe6 zhenpengzheng 2021-07-13 345 ADVERTISED_Asym_Pause; a493f74ade8fe6 zhenpengzheng 2021-07-13 346 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 347 case txgbe_fc_tx_pause: a493f74ade8fe6 zhenpengzheng 2021-07-13 348 advertising |= ADVERTISED_Asym_Pause; a493f74ade8fe6 zhenpengzheng 2021-07-13 349 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 350 default: a493f74ade8fe6 zhenpengzheng 2021-07-13 351 advertising &= ~(ADVERTISED_Pause | a493f74ade8fe6 zhenpengzheng 2021-07-13 352 ADVERTISED_Asym_Pause); a493f74ade8fe6 zhenpengzheng 2021-07-13 353 } a493f74ade8fe6 zhenpengzheng 2021-07-13 354 a493f74ade8fe6 zhenpengzheng 2021-07-13 355 if (link_up) { a493f74ade8fe6 zhenpengzheng 2021-07-13 356 switch (link_speed) { a493f74ade8fe6 zhenpengzheng 2021-07-13 357 case TXGBE_LINK_SPEED_10GB_FULL: a493f74ade8fe6 zhenpengzheng 2021-07-13 358 cmd->base.speed = SPEED_10000; a493f74ade8fe6 zhenpengzheng 2021-07-13 359 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 360 case TXGBE_LINK_SPEED_1GB_FULL: a493f74ade8fe6 zhenpengzheng 2021-07-13 361 cmd->base.speed = SPEED_1000; a493f74ade8fe6 zhenpengzheng 2021-07-13 362 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 363 case TXGBE_LINK_SPEED_100_FULL: a493f74ade8fe6 zhenpengzheng 2021-07-13 364 cmd->base.speed = SPEED_100; a493f74ade8fe6 zhenpengzheng 2021-07-13 365 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 366 case TXGBE_LINK_SPEED_10_FULL: a493f74ade8fe6 zhenpengzheng 2021-07-13 367 cmd->base.speed = SPEED_10; a493f74ade8fe6 zhenpengzheng 2021-07-13 368 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 369 default: a493f74ade8fe6 zhenpengzheng 2021-07-13 370 break; a493f74ade8fe6 zhenpengzheng 2021-07-13 371 } a493f74ade8fe6 zhenpengzheng 2021-07-13 372 cmd->base.duplex = DUPLEX_FULL; a493f74ade8fe6 zhenpengzheng 2021-07-13 373 } else { a493f74ade8fe6 zhenpengzheng 2021-07-13 374 cmd->base.speed = -1; a493f74ade8fe6 zhenpengzheng 2021-07-13 375 cmd->base.duplex = -1; a493f74ade8fe6 zhenpengzheng 2021-07-13 376 } a493f74ade8fe6 zhenpengzheng 2021-07-13 377 a493f74ade8fe6 zhenpengzheng 2021-07-13 378 ethtool_convert_legacy_u32_to_link_mode(cmd->link_modes.supported, a493f74ade8fe6 zhenpengzheng 2021-07-13 379 supported); a493f74ade8fe6 zhenpengzheng 2021-07-13 380 ethtool_convert_legacy_u32_to_link_mode(cmd->link_modes.advertising, a493f74ade8fe6 zhenpengzheng 2021-07-13 381 advertising); a493f74ade8fe6 zhenpengzheng 2021-07-13 382 return 0; a493f74ade8fe6 zhenpengzheng 2021-07-13 383 } a493f74ade8fe6 zhenpengzheng 2021-07-13 384 :::::: The code at line 177 was first introduced by commit :::::: a493f74ade8fe69f3446a65ddf7627fdf34c183c net: txgbe: Add support for Netswift 10G NIC :::::: TO: zhenpengzheng <zhenpengzheng(a)net-swift.com> :::::: CC: Zheng Zengkai <zhengzengkai(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] mm/swapfile.o: warning: objtool: free_swap_and_cache()+0x10f: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: 9b3ba7800bc02ca4f0e62d79b32edc22e24ca926 [1531/1531] mm: swap: fix race between free_swap_and_cache() and swapoff() config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503301931.DQUjzVBe-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301931.DQUjzVBe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301931.DQUjzVBe-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/swapfile.c:11: In file included from include/linux/hugetlb.h:45: include/linux/mempolicy.h:329:13: warning: unused function '__do_mbind' [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ 1 warning generated. >> mm/swapfile.o: warning: objtool: free_swap_and_cache()+0x10f: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] drivers/md/dm.o: warning: objtool: dm_process_bio()+0x2ec: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: 3830dbeebc54a74b56b8253c33857b38fae427fb [1531/1531] dm: revert partial fix for redundant bio-based IO accounting config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503301828.H3xVCQ5Q-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301828.H3xVCQ5Q-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301828.H3xVCQ5Q-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/md/dm.o: warning: objtool: dm_process_bio()+0x2ec: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 5b56c883c34a890a3f9ca7baa8aea426538c88a8
by kernel test robot 30 Mar '25

30 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 !15508 scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503300608.WYcT007F-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503301024.26J3J3nq-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503301315.o2E2dF19-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503301602.HqBUoFWQ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503301705.3fAiYws1-lkp@intel.com block/blk-mq.o: warning: objtool: blk_mq_unfreeze_queue()+0x75: unreachable instruction drivers/dax/bus.o: warning: objtool: __dax_driver_register()+0xd5: unreachable instruction drivers/net/dsa/realtek-smi.c:465:34: warning: 'realtek_smi_of_match' defined but not used [-Wunused-const-variable=] drivers/nvdimm/claim.o: warning: objtool: nsio_rw_bytes()+0x368: unreachable instruction drivers/xen/events/events_base.o: warning: objtool: xen_test_irq_shared()+0xe1: unreachable instruction fs/btrfs/file.o: warning: objtool: btrfs_drop_extent_cache()+0x738: unreachable instruction kernel/trace/ring_buffer.o: warning: objtool: rb_get_reader_page()+0x4d2: unreachable instruction Unverified Error/Warning (likely false positive, kindly check if interested): 789 | eprintk("kgdbts: ERROR: beyond end of test on" 795 | eprintk("kgdbts: ERROR: put buffer overflow on" Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250329 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-tee-optee-core.c:warning:return-makes-integer-from-pointer-without-a-cast | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250329 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250329 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-004-20250329 | `-- init-Kconfig:syntax-error |-- x86_64-allnoconfig | |-- Makefile:include-config-auto.conf.cmd:No-such-file-or-directory | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-allyesconfig | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- crypto-aegis128.o:warning:objtool:missing-symbol-for-section-.init.text | |-- crypto-zstd.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-regulator-max8973-regulator.o:warning:objtool:max8973_probe:can-t-find-switch-jump-table | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- samples-vfio-mdev-mdpy-fb.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-002-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- eprintk(-kgdbts:ERROR:beyond-end-of-test-on | |-- eprintk(-kgdbts:ERROR:put-buffer-overflow-on | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_ext.o:warning:objtool:missing-symbol-for-section-.init.text | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_ext.o:warning:objtool:missing-symbol-for-section-.init.text | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-mq.o:warning:objtool:blk_mq_unfreeze_queue:unreachable-instruction | |-- drivers-dax-bus.o:warning:objtool:__dax_driver_register:unreachable-instruction | |-- drivers-fpga-dfl.o:warning:objtool:build_info_commit_dev:unreachable-instruction | |-- drivers-nvdimm-claim.o:warning:objtool:nsio_rw_bytes:unreachable-instruction | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-xen-events-events_base.o:warning:objtool:xen_test_irq_shared:unreachable-instruction | |-- fs-btrfs-file.o:warning:objtool:btrfs_drop_extent_cache:unreachable-instruction | |-- kernel-trace-ring_buffer.o:warning:objtool:rb_get_reader_page:unreachable-instruction | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-defconfig | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized-in-this-function | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-101-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-gpu-drm-i915-i915_gem.o:warning:objtool:i915_gem_fault-falls-through-to-next-function-i915_gem_object_ggtt_pin() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:_intel_adjust_tile_offset-falls-through-to-next-function-rcu_lock_acquire() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:_intel_compute_tile_offset-falls-through-to-next-function-skl_format_to_fourcc() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:skl_plane_stride-falls-through-to-next-function-skl_plane_ctl() | |-- drivers-gpu-drm-i915-vlv_dsi_pll.o:warning:objtool:bxt_dsi_pll_enable-falls-through-to-next-function-bxt_dsi_reset_clocks() | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-mmc-host-mtk-sd.o:warning:objtool:msdc_set_timeout-falls-through-to-next-function-get_best_delay() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-102-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-103-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-md-raid5.o:warning:objtool:raid5_compute_sector-falls-through-to-next-function-raid5_compute_blocknr() | |-- drivers-mmc-host-mtk-sd.o:warning:objtool:msdc_set_timeout-falls-through-to-next-function-get_best_delay() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-104-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- fs-debugfs-file.o:warning:objtool:full_proxy_open:unreachable-instruction | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-121-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-merge.c:sparse:sparse:symbol-blk_try_req_merge-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_issue-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_requeue-was-not-declared.-Should-it-be-static | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- include-linux-bpf-cgroup.h:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:invalid-assignment: | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-122-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-blk-merge.c:sparse:sparse:symbol-blk_try_req_merge-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_issue-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_requeue-was-not-declared.-Should-it-be-static | |-- drivers-net-wireless-ath-ath9k-htc_drv_txrx.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-restricted-__be16-usertype-rs_datalen-got-unsigned-short-usertype | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- include-linux-bpf-cgroup.h:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:invalid-assignment: | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-123-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-firewire-core-topology.o:warning:objtool:fw_core_handle_bus_reset:can-t-find-switch-jump-table | |-- drivers-input-mouse-elantech.o:warning:objtool:elantech_process_byte:can-t-find-switch-jump-table | |-- drivers-leds-leds-lm355x.o:warning:objtool:lm355x_control:can-t-find-switch-jump-table | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- fs-ext4-mballoc.o:warning:objtool:ext4_mb_complex_scan_group:unreachable-instruction | |-- fs-gfs2-glock.o:warning:objtool:finish_xmote:can-t-find-switch-jump-table | |-- fs-xfs-libxfs-xfs_rmap.o:warning:objtool:xfs_rmap_convert_shared:can-t-find-switch-jump-table | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-161-20250329 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() | |-- drivers-media-tuners-fc2580.o:warning:objtool:fc2580_set_params-falls-through-to-next-function-fc2580_standby() | |-- drivers-mmc-host-mtk-sd.o:warning:objtool:msdc_set_timeout-falls-through-to-next-function-get_best_delay() | |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-r052-20250330 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- drivers-net-dsa-realtek-smi.c:warning:realtek_smi_of_match-defined-but-not-used | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used `-- x86_64-randconfig-r053-20250330 |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. |-- drivers-base-regmap-regmap.o:warning:objtool:regmap_raw_read-falls-through-to-next-function-_regmap_raw_read() |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union |-- drivers-mmc-host-mtk-sd.o:warning:objtool:msdc_set_timeout-falls-through-to-next-function-get_best_delay() |-- drivers-net-ethernet-intel-e1000-e1000_main.o:warning:objtool:e1000_watchdog-falls-through-to-next-function-e1000_82547_tx_fifo_stall_task() |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 1445m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250329 gcc-7.5.0 arm64 randconfig-002-20250329 gcc-9.5.0 arm64 randconfig-003-20250329 gcc-5.5.0 arm64 randconfig-004-20250329 gcc-5.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250329 clang-20 x86_64 buildonly-randconfig-002-20250329 gcc-12 x86_64 buildonly-randconfig-003-20250329 gcc-12 x86_64 buildonly-randconfig-004-20250329 clang-20 x86_64 buildonly-randconfig-005-20250329 clang-20 x86_64 buildonly-randconfig-006-20250329 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1536/1536] drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: c3088bd9bdf90fcfc8a69046692d75c2b04563ba [1536/1536] ath9k_htc: Discard undersized packets config: x86_64-randconfig-122-20250330 (https://download.01.org/0day-ci/archive/20250330/202503301705.3fAiYws1-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301705.3fAiYws1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301705.3fAiYws1-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] rs_datalen @@ got unsigned short [usertype] @@ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: expected restricted __be16 [usertype] rs_datalen drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: got unsigned short [usertype] drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:988:13: sparse: sparse: restricted __be16 degrades to integer drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:1001:13: sparse: sparse: restricted __be16 degrades to integer In file included from drivers/net/wireless/ath/ath9k/htc.h:23, from drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:17: In function '__skb_queue_before', inlined from '__skb_queue_tail' at include/linux/skbuff.h:1886:2, inlined from 'ath9k_htc_tx_cleanup_queue' at drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:741:4: include/linux/skbuff.h:1852:9: warning: array subscript 'struct sk_buff[0]' is partly outside array bounds of 'struct sk_buff_head[1]' [-Warray-bounds] 1852 | __skb_insert(newsk, next->prev, next, list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c: In function 'ath9k_htc_tx_cleanup_queue': drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:733:29: note: object 'queue' of size 80 733 | struct sk_buff_head queue; | ^~~~~ vim +987 drivers/net/wireless/ath/ath9k/htc_drv_txrx.c 962 963 static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, 964 struct ath9k_htc_rxbuf *rxbuf, 965 struct ieee80211_rx_status *rx_status) 966 967 { 968 struct ieee80211_hdr *hdr; 969 struct ieee80211_hw *hw = priv->hw; 970 struct sk_buff *skb = rxbuf->skb; 971 struct ath_common *common = ath9k_hw_common(priv->ah); 972 struct ath_hw *ah = common->ah; 973 struct ath_htc_rx_status *rxstatus; 974 struct ath_rx_status rx_stats; 975 bool decrypt_error = false; 976 __be16 rs_datalen; 977 bool is_phyerr; 978 979 if (skb->len < HTC_RX_FRAME_HEADER_SIZE) { 980 ath_err(common, "Corrupted RX frame, dropping (len: %d)\n", 981 skb->len); 982 goto rx_next; 983 } 984 985 rxstatus = (struct ath_htc_rx_status *)skb->data; 986 > 987 rs_datalen = be16_to_cpu(rxstatus->rs_datalen); 988 if (unlikely(rs_datalen - 989 (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0)) { 990 ath_err(common, 991 "Corrupted RX data len, dropping (dlen: %d, skblen: %d)\n", 992 rs_datalen, skb->len); 993 goto rx_next; 994 } 995 996 is_phyerr = rxstatus->rs_status & ATH9K_RXERR_PHY; 997 /* 998 * Discard zero-length packets and packets smaller than an ACK 999 * which are not PHY_ERROR (short radar pulses have a length of 3) 1000 */ 1001 if (unlikely(!rs_datalen || (rs_datalen < 10 && !is_phyerr))) { 1002 ath_warn(common, 1003 "Short RX data len, dropping (dlen: %d)\n", 1004 rs_datalen); 1005 goto rx_next; 1006 } 1007 1008 /* Get the RX status information */ 1009 1010 memset(rx_status, 0, sizeof(struct ieee80211_rx_status)); 1011 1012 /* Copy everything from ath_htc_rx_status (HTC_RX_FRAME_HEADER). 1013 * After this, we can drop this part of skb. */ 1014 rx_status_htc_to_ath(&rx_stats, rxstatus); 1015 ath9k_htc_err_stat_rx(priv, &rx_stats); 1016 rx_status->mactime = be64_to_cpu(rxstatus->rs_tstamp); 1017 skb_pull(skb, HTC_RX_FRAME_HEADER_SIZE); 1018 1019 /* 1020 * everything but the rate is checked here, the rate check is done 1021 * separately to avoid doing two lookups for a rate for each frame. 1022 */ 1023 hdr = (struct ieee80211_hdr *)skb->data; 1024 1025 /* 1026 * Process PHY errors and return so that the packet 1027 * can be dropped. 1028 */ 1029 if (unlikely(is_phyerr)) { 1030 /* TODO: Not using DFS processing now. */ 1031 if (ath_cmn_process_fft(&priv->spec_priv, hdr, 1032 &rx_stats, rx_status->mactime)) { 1033 /* TODO: Code to collect spectral scan statistics */ 1034 } 1035 goto rx_next; 1036 } 1037 1038 if (!ath9k_cmn_rx_accept(common, hdr, rx_status, &rx_stats, 1039 &decrypt_error, priv->rxfilter)) 1040 goto rx_next; 1041 1042 ath9k_cmn_rx_skb_postprocess(common, skb, &rx_stats, 1043 rx_status, decrypt_error); 1044 1045 if (ath9k_cmn_process_rate(common, hw, &rx_stats, rx_status)) 1046 goto rx_next; 1047 1048 rx_stats.is_mybeacon = ath_is_mybeacon(common, hdr); 1049 ath9k_cmn_process_rssi(common, hw, &rx_stats, rx_status); 1050 1051 rx_status->band = ah->curchan->chan->band; 1052 rx_status->freq = ah->curchan->chan->center_freq; 1053 rx_status->antenna = rx_stats.rs_antenna; 1054 rx_status->flag |= RX_FLAG_MACTIME_END; 1055 1056 return true; 1057 rx_next: 1058 return false; 1059 } 1060 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] loongarch/cpu: Switch to arch_cpu_finalize_init()
by Hongchen Zhang 30 Mar '25

30 Mar '25

From: Thomas Gleixner <tglx(a)linutronix.de> mainline inclusion from mainline-v6.5-rc1 commit 9841c423164787feb8f1442f922b7d80a70c82f1 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBXCSJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- check_bugs() is about to be phased out. Switch over to the new arch_cpu_finalize_init() implementation. No functional change. Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Link: https://lore.kernel.org/r/20230613224545.195288218@linutronix.de Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> Signed-off-by: Juxin Gao <gaojuxin(a)loongson.cn> --- arch/loongarch/Kconfig | 1 + arch/loongarch/include/asm/bugs.h | 15 --------------- arch/loongarch/kernel/setup.c | 4 ++-- 3 files changed, 3 insertions(+), 17 deletions(-) delete mode 100644 arch/loongarch/include/asm/bugs.h diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig index 0b608275b4bb..ad5a6365dccb 100644 --- a/arch/loongarch/Kconfig +++ b/arch/loongarch/Kconfig @@ -10,6 +10,7 @@ config LOONGARCH select ARCH_ENABLE_MEMORY_HOTPLUG select ARCH_ENABLE_MEMORY_HOTREMOVE select ARCH_HAS_ACPI_TABLE_UPGRADE if ACPI + select ARCH_HAS_CPU_FINALIZE_INIT select ARCH_HAS_PHYS_TO_DMA select ARCH_HAS_PTE_SPECIAL select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST diff --git a/arch/loongarch/include/asm/bugs.h b/arch/loongarch/include/asm/bugs.h deleted file mode 100644 index 98396535163b..000000000000 --- a/arch/loongarch/include/asm/bugs.h +++ /dev/null @@ -1,15 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* - * This is included by init/main.c to check for architecture-dependent bugs. - * - * Copyright (C) 2020-2022 Loongson Technology Corporation Limited - */ -#ifndef _ASM_BUGS_H -#define _ASM_BUGS_H - -#include <asm/cpu.h> -#include <asm/cpu-info.h> - -extern void check_bugs(void); - -#endif /* _ASM_BUGS_H */ diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c index 5b6408296786..234bcbec6883 100644 --- a/arch/loongarch/kernel/setup.c +++ b/arch/loongarch/kernel/setup.c @@ -12,6 +12,7 @@ */ #include <linux/init.h> #include <linux/acpi.h> +#include <linux/cpu.h> #include <linux/dmi.h> #include <linux/efi.h> #include <linux/export.h> @@ -34,7 +35,6 @@ #include <asm/addrspace.h> #include <asm/alternative.h> #include <asm/bootinfo.h> -#include <asm/bugs.h> #include <asm/cache.h> #include <asm/cpu.h> #include <asm/dma.h> @@ -87,7 +87,7 @@ const char *get_system_type(void) return "generic-loongson-machine"; } -void __init check_bugs(void) +void __init arch_cpu_finalize_init(void) { alternative_instructions(); } -- 2.43.0

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 0e7e8faca7062a439fd0a56574c2c3860ceb2088
by kernel test robot 30 Mar '25

30 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 0e7e8faca7062a439fd0a56574c2c3860ceb2088 !15630 Fix CVE-2022-49553 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503292344.LYgqFDQe-lkp@intel.com drivers/gpu/drm/drm_atomic_helper.o: warning: objtool: drm_atomic_helper_commit_planes_on_crtc()+0x28b: unreachable instruction fs/notify/fanotify/fanotify.o: warning: objtool: fanotify_encode_fh()+0x1d6: unreachable instruction kernel/time/clocksource.o: warning: objtool: __clocksource_register_scale()+0x1c0: unreachable instruction Unverified Error/Warning (likely false positive, kindly check if interested): drivers/mtd/devices/mtd_dataflash.o: warning: objtool: dataflash_write() falls through to next function asan.module_ctor() sound/soc/fsl/fsl_easrc.o: warning: objtool: fsl_easrc_runtime_resume() falls through to next function asan.module_ctor() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-001-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-002-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-003-20250329 | |-- lib-gcc-aarch64-linux-..-plugin-include-config-elfos.h:warning:invalid-suffix-on-literal-C-requires-a-space-between-literal-and-string-macro | |-- lib-gcc-aarch64-linux-..-plugin-include-defaults.h:warning:invalid-suffix-on-literal-C-requires-a-space-between-literal-and-string-macro | |-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:field-call_clobbered-has-incomplete-type-pt_solution | |-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:field-call_used-has-incomplete-type-pt_solution | |-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:gimple_call_addr_fndecl-was-not-declared-in-this-scope | `-- lib-gcc-aarch64-linux-..-plugin-include-gimple.h:error:is_gimple_reg-was-not-declared-in-this-scope |-- x86_64-allnoconfig | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_file_name-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_log-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_HDD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CLEAR_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_ENABLE_MSIX-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_MASK_DISABLE-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_STATUS_EXIST_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_SSD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_mgrq_resend-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_notify-Werror-Wmissing-prototypes | `-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:error:unused-function-ps3_scsih_dev_id_get-Werror-Wunused-function |-- x86_64-buildonly-randconfig-001-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-002-20250329 | |-- arch-x86-kernel-paravirt.c:error:control-reaches-end-of-non-void-function | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-003-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-004-20250329 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-005-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-gpu-drm-drm_atomic_helper.o:warning:objtool:drm_atomic_helper_commit_planes_on_crtc:unreachable-instruction | |-- drivers-scsi-ufs-ufshcd.o:warning:objtool:ufshcd_queue_tmf:unreachable-instruction | |-- fs-notify-fanotify-fanotify.o:warning:objtool:fanotify_encode_fh:unreachable-instruction | |-- kernel-time-clocksource.o:warning:objtool:__clocksource_register_scale:unreachable-instruction | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-006-20250329 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-101-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-vmscan.o:warning:objtool:do_shrink_slab-falls-through-to-next-function-allow_direct_reclaim() | `-- sound-soc-fsl-fsl_easrc.o:warning:objtool:fsl_easrc_runtime_resume-falls-through-to-next-function-asanmodule_ctor() |-- x86_64-randconfig-102-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-103-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-video-fbdev-hyperv_fb.o:warning:objtool:synthvid_deferred_io-falls-through-to-next-function-hvfb_pci_stub_probe() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:bitmap_clear_bits-falls-through-to-next-function-free_bitmap() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- mm-vmscan.o:warning:objtool:do_shrink_slab-falls-through-to-next-function-allow_direct_reclaim() |-- x86_64-randconfig-104-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_thread_vid_cap_tick-falls-through-to-next-function-plane_vaddr() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-121-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-memcontrol.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__user-buffer | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-122-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-memcontrol.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__user-buffer | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20250330 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-mtd-devices-mtd_dataflash.o:warning:objtool:dataflash_write-falls-through-to-next-function-asanmodule_ctor() | |-- drivers-nvdimm-namespace_devs.o:warning:objtool:size_store-falls-through-to-next-function-nd_namespace_label_update() | |-- fs-ufs-balloc.o:warning:objtool:ufs_free_fragments-falls-through-to-next-function-ufs_clusteracct() | |-- fs-ufs-ialloc.o:warning:objtool:ufs_new_inode-falls-through-to-next-function-ufs2_init_inodes_chunk() | |-- fs-ufs-inode.o:warning:objtool:ufs_iget-falls-through-to-next-function-ufs_set_inode_ops() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- x86_64-randconfig-161-20250329 |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_thread_vid_cap_tick-falls-through-to-next-function-plane_vaddr() |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory elapsed time: 1445m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250329 gcc-7.5.0 arm64 randconfig-002-20250329 gcc-9.5.0 arm64 randconfig-003-20250329 gcc-5.5.0 arm64 randconfig-004-20250329 gcc-5.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250329 clang-20 x86_64 buildonly-randconfig-002-20250329 gcc-12 x86_64 buildonly-randconfig-003-20250329 gcc-12 x86_64 buildonly-randconfig-004-20250329 clang-20 x86_64 buildonly-randconfig-005-20250329 clang-20 x86_64 buildonly-randconfig-006-20250329 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] kernel/trace/ring_buffer.o: warning: objtool: rb_get_reader_page()+0x4d2: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: ac59b83e5b01ef06262e927dc7207adf8553c823 [1531/1531] ring-buffer: Fix race between reset page and reading page config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503301602.HqBUoFWQ-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301602.HqBUoFWQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301602.HqBUoFWQ-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/trace/ring_buffer.c:5013:6: warning: variable 'cnt' set but not used [-Wunused-but-set-variable] 5013 | int cnt; | ^ 1 warning generated. kernel/trace/ring_buffer.c:1116: warning: Function parameter or member 'cpu_buffer' not described in 'rb_check_list' kernel/trace/ring_buffer.c:1116: warning: Function parameter or member 'list' not described in 'rb_check_list' kernel/trace/ring_buffer.c:1356: warning: Function parameter or member 'key' not described in '__ring_buffer_alloc' kernel/trace/ring_buffer.c:2329: warning: Function parameter or member 'cpu_buffer' not described in 'rb_update_event' kernel/trace/ring_buffer.c:2329: warning: Function parameter or member 'info' not described in 'rb_update_event' kernel/trace/ring_buffer.c:2329: warning: Excess function parameter 'type' description in 'rb_update_event' kernel/trace/ring_buffer.c:2329: warning: Excess function parameter 'length' description in 'rb_update_event' kernel/trace/ring_buffer.c:4381: warning: Function parameter or member 'cpu' not described in 'ring_buffer_size' kernel/trace/ring_buffer.c:4560: warning: Function parameter or member 'cpu' not described in 'ring_buffer_swap_cpu' >> kernel/trace/ring_buffer.o: warning: objtool: rb_get_reader_page()+0x4d2: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION f030d5397b5940b1ca4edfc8a40b53c553814b40
by kernel test robot 30 Mar '25

30 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f030d5397b5940b1ca4edfc8a40b53c553814b40 !15686 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.76-6.6.78 LTS Patches Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-virtcca_get_tmi_version | |-- drivers-coda-coda_pci.c:warning:Excess-function-parameter-pdev-description-in-virtcca_pci_get_rom_size | |-- drivers-coda-coda_pci.c:warning:Function-parameter-or-member-p-not-described-in-virtcca_pci_get_rom_size | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_DRBG_CTR-when-selected-by-CRYPTO_DEV_HISI_TRNG | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-defconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-001-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-002-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allmodconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allnoconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allyesconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-defconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-001-20250329 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-002-20250329 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allyesconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250329 | |-- drivers-gpu-drm-sti-sti_dvo.c:error:implicit-declaration-of-function-devm_ioremap | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250329 | |-- drivers-gpu-drm-sti-sti_dvo.c:error:implicit-declaration-of-function-devm_ioremap | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250329 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size |-- x86_64-randconfig-101-20250330 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-102-20250330 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-103-20250330 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-104-20250330 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-121-20250330 | |-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:sparse:sparse:symbol-tdm_service_exit-was-not-declared.-Should-it-be-static | |-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:sparse:sparse:symbol-tdm_service_run-was-not-declared.-Should-it-be-static | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-122-20250330 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-123-20250330 | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used `-- x86_64-randconfig-161-20250329 |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used `-- mm-mm_init.c-deferred_init_mem_pfn_range_in_zone()-warn:iterator-j-not-incremented elapsed time: 1446m configs tested: 21 configs skipped: 124 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250329 gcc-7.5.0 arm64 randconfig-002-20250329 gcc-9.5.0 arm64 randconfig-003-20250329 gcc-5.5.0 arm64 randconfig-004-20250329 gcc-5.5.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250329 gcc-14.2.0 loongarch randconfig-002-20250329 gcc-14.2.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250329 clang-20 x86_64 buildonly-randconfig-002-20250329 gcc-12 x86_64 buildonly-randconfig-003-20250329 gcc-12 x86_64 buildonly-randconfig-004-20250329 clang-20 x86_64 buildonly-randconfig-005-20250329 clang-20 x86_64 buildonly-randconfig-006-20250329 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] drivers/dax/bus.o: warning: objtool: __dax_driver_register()+0xd5: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

Hi Dan, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: 9bb67bd58e6a7e3ef00793b4966be7bb0a346830 [1531/1531] Intel: device-dax: Add support for a dax override driver config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503301315.o2E2dF19-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301315.o2E2dF19-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301315.o2E2dF19-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/dax/bus.o: warning: objtool: __dax_driver_register()+0xd5: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] block/blk-mq.o: warning: objtool: blk_mq_unfreeze_queue()+0x75: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: cbd9fe6e727ed12c1e542f74514e6dd4419f1cf6 [1531/1531] blk-mq: fix hang caused by freeze/unfreeze sequence config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503301024.26J3J3nq-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503301024.26J3J3nq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503301024.26J3J3nq-lkp@intel.com/ All warnings (new ones prefixed by >>): block/blk-mq.c:600:44: warning: passing 8-byte aligned argument to 32-byte aligned parameter 2 of 'smp_call_function_single_async' may result in an unaligned pointer access [-Walign-mismatch] 600 | smp_call_function_single_async(ctx->cpu, &rq->csd); | ^ 1 warning generated. >> block/blk-mq.o: warning: objtool: blk_mq_unfreeze_queue()+0x75: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1531/1531] drivers/xen/events/events_base.o: warning: objtool: xen_test_irq_shared()+0xe1: unreachable instruction
by kernel test robot 30 Mar '25

30 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: fc0f59c16e93291923fcebd942b78c9bddfecc56 [1531/1531] xen/events: avoid removing an event channel while handling it config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250330/202503300608.WYcT007F-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250330/202503300608.WYcT007F-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503300608.WYcT007F-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/xen/events/events_base.c:1697:6: warning: no previous prototype for function 'xen_callback_vector' [-Wmissing-prototypes] 1697 | void xen_callback_vector(void) {} | ^ drivers/xen/events/events_base.c:1697:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1697 | void xen_callback_vector(void) {} | ^ | static 1 warning generated. >> drivers/xen/events/events_base.o: warning: objtool: xen_test_irq_shared()+0xe1: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2827/2827] kernel/time/clocksource.o: warning: objtool: __clocksource_register_scale()+0x1c0: unreachable instruction
by kernel test robot 29 Mar '25

29 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0e7e8faca7062a439fd0a56574c2c3860ceb2088 commit: 3e04146d67272c65eef5abc5a60c04cf8529ec71 [2827/2827] time: Add mechanism to recognize clocksource in time_get_snapshot config: x86_64-buildonly-randconfig-005-20250329 (https://download.01.org/0day-ci/archive/20250329/202503292344.LYgqFDQe-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250329/202503292344.LYgqFDQe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503292344.LYgqFDQe-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/time/clocksource.o: warning: objtool: __clocksource_register_scale()+0x1c0: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v3 00/28] Add support for heterogeneous live migration
by Jinqian Yang 29 Mar '25

29 Mar '25

Patch#1 Allow userspace to get the writable masks for feature ID registers Patch#2 Document KVM_ARM_GET_REG_WRITABLE_MASKS Patch#3 Use guest ID register values for the sake of emulation Patch#4 Advertise selected DebugVer in DBGDIDR.Version Patch#5 Reject attempts to set invalid debug arch version Patch#6 Bump up the default KVM sanitised debug version to v8p8 Patch#7 Allow userspace to change ID_AA64ISAR{0-2}_EL1 Patch#8 Allow userspace to change ID_AA64MMFR{0-2}_EL1 Patch#9 Allow userspace to change ID_AA64PFR0_EL1 Patch#10 Allow userspace to change ID_AA64ZFR0_EL1 Patch#11 Document vCPU feature selection UAPIs Patch#12 Make the exposed feature bits in AA64DFR0_EL1 writable from userspace Patch#13 Disable MPAM visibility by default and ignore VMM writes Patch#14 Rename is_id_reg() to imply VM scope Patch#15 Reset VM feature ID regs from kvm_reset_sys_regs() Patch#16 Only reset vCPU-scoped feature ID regs once Patch#17 Use read-only helper for reading VM ID registers Patch#18 Add helper for writing ID regs Patch#19 Treat CTR_EL0 as a VM feature ID register Patch#20 Rename functions for invariant sys regs Patch#21 Make the L1Ip feature bits in CTR_EL0 writable from userspace Patch#22 Show writable masks for feature registers Patch#23 Make HCX writable from userspace Patch#24 Remove duplicated AA64MMFR1_EL1 XNX Patch#25 Add support for HIP09 Spectre-BHB mitigation Patch#26 add cnp verification on Hisilicon erratum 162100125 Patch#27 use KABI_EXTEND to revert struct kvm kabi change Patch#28 Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden James Morse (1): KVM: arm64: Disable MPAM visibility by default and ignore VMM writes Jing Zhang (5): KVM: arm64: Allow userspace to get the writable masks for feature ID registers KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS KVM: arm64: Use guest ID register values for the sake of emulation KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Marc Zyngier (1): KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden Oliver Upton (11): KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version KVM: arm64: Reject attempts to set invalid debug arch version KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 KVM: arm64: Document vCPU feature selection UAPIs KVM: arm64: Rename is_id_reg() to imply VM scope KVM: arm64: Reset VM feature ID regs from kvm_reset_sys_regs() KVM: arm64: Only reset vCPU-scoped feature ID regs once KVM: arm64: Use read-only helper for reading VM ID registers KVM: arm64: Add helper for writing ID regs Russell King (1): KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX Sebastian Ott (3): KVM: arm64: Treat CTR_EL0 as a VM feature ID register KVM: arm64: rename functions for invariant sys regs KVM: arm64: show writable masks for feature registers Shameer Kolothum (2): KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace yangjinqian (4): KVM: arm64: Make HCX writable from userspace arm64: Add support for HIP09 Spectre-BHB mitigation arm64: add cnp verification on Hisilicon erratum 162100125 KVM: arm64: use KABI_EXTEND to revert struct kvm kabi change Documentation/virt/kvm/api.rst | 52 +++ Documentation/virt/kvm/arm/index.rst | 1 + Documentation/virt/kvm/arm/vcpu-features.rst | 48 +++ arch/arm64/include/asm/cpufeature.h | 14 + arch/arm64/include/asm/kvm_emulate.h | 3 +- arch/arm64/include/asm/kvm_host.h | 24 ++ arch/arm64/include/uapi/asm/kvm.h | 32 ++ arch/arm64/kernel/cpu_errata.c | 13 +- arch/arm64/kernel/proton-pack.c | 1 + arch/arm64/kvm/arm.c | 15 +- arch/arm64/kvm/pmu-emul.c | 2 +- arch/arm64/kvm/sys_regs.c | 351 +++++++++++++++---- include/uapi/linux/kvm.h | 2 + 13 files changed, 475 insertions(+), 83 deletions(-) create mode 100644 Documentation/virt/kvm/arm/vcpu-features.rst -- 2.33.0

2 29

[PATCH OLK-6.6] tracing: Fix use-after-free in print_graph_function_flags during tracer switching
by Tengda Wu 29 Mar '25

29 Mar '25

From: Tengda Wu <wutengda(a)huaweicloud.com> mainline inclusion from mainline-v6.15 commit 7f81f27b1093e4895e87b74143c59c055c3b1906 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBWWU7 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the following script: $ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tracer The root cause lies in the two calls to print_graph_function_flags within print_trace_line during each s_show(): * One through 'iter->trace->print_line()'; * Another through 'event->funcs->trace()', which is hidden in print_trace_fmt() before print_trace_line returns. Tracer switching only updates the former, while the latter continues to use the print_line function of the old tracer, which in the script above is print_graph_function_flags. Moreover, when switching from the 'function_graph' tracer to the 'timerlat' tracer, s_start only calls graph_trace_close of the 'function_graph' tracer to free 'iter->private', but does not set it to NULL. This provides an opportunity for 'event->funcs->trace()' to use an invalid 'iter->private'. To fix this issue, set 'iter->private' to NULL immediately after freeing it in graph_trace_close(), ensuring that an invalid pointer is not passed to other tracers. Additionally, clean up the unnecessary 'iter->private = NULL' during each 'cat trace' when using wakeup and irqsoff tracers. [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Zheng Yejian <zhengyejian1(a)huawei.com> Link: https://lore.kernel.org/20250320122137.23635-1-wutengda@huaweicloud.com Fixes: eecb91b9f98d ("tracing: Fix memleak due to race between current_tracer and trace") Closes: https://lore.kernel.org/all/CAMgjq7BW79KDSCyp+tZHjShSzHsScSiJxn5ffskp-QzVM0… Reported-by: Kairui Song <kasong(a)tencent.com> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_functions_graph.c | 1 + kernel/trace/trace_irqsoff.c | 2 -- kernel/trace/trace_sched_wakeup.c | 2 -- 3 files changed, 1 insertion(+), 4 deletions(-) diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c index c35fbaab2a47..4d4808186a0f 100644 --- a/kernel/trace/trace_functions_graph.c +++ b/kernel/trace/trace_functions_graph.c @@ -1317,6 +1317,7 @@ void graph_trace_close(struct trace_iterator *iter) if (data) { free_percpu(data->cpu_data); kfree(data); + iter->private = NULL; } } diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c index ba37f768e2f2..6c9db857fe0e 100644 --- a/kernel/trace/trace_irqsoff.c +++ b/kernel/trace/trace_irqsoff.c @@ -231,8 +231,6 @@ static void irqsoff_trace_open(struct trace_iterator *iter) { if (is_graph(iter->tr)) graph_trace_open(iter); - else - iter->private = NULL; } static void irqsoff_trace_close(struct trace_iterator *iter) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index 0469a04a355f..330aee1c1a49 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -168,8 +168,6 @@ static void wakeup_trace_open(struct trace_iterator *iter) { if (is_graph(iter->tr)) graph_trace_open(iter); - else - iter->private = NULL; } static void wakeup_trace_close(struct trace_iterator *iter) -- 2.34.1

2 1

[PATCH OLK-6.6] perf/core: Add RCU read lock protection to perf_iterate_ctx()
by Tengda Wu 29 Mar '25

29 Mar '25

From: Breno Leitao <leitao(a)debian.org> stable inclusion from stable-v6.6.81 commit f390c2eea571945f357a2d3b9fcb1c015767132e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVT2 CVE: CVE-2025-21889 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0fe8813baf4b2e865d3b2c735ce1a15b86002c74 upstream. The perf_iterate_ctx() function performs RCU list traversal but currently lacks RCU read lock protection. This causes lockdep warnings when running perf probe with unshare(1) under CONFIG_PROVE_RCU_LIST=y: WARNING: suspicious RCU usage kernel/events/core.c:8168 RCU-list traversed in non-reader section!! Call Trace: lockdep_rcu_suspicious ? perf_event_addr_filters_apply perf_iterate_ctx perf_event_exec begin_new_exec ? load_elf_phdrs load_elf_binary ? lock_acquire ? find_held_lock ? bprm_execve bprm_execve do_execveat_common.isra.0 __x64_sys_execve do_syscall_64 entry_SYSCALL_64_after_hwframe This protection was previously present but was removed in commit bd2756811766 ("perf: Rewrite core context handling"). Add back the necessary rcu_read_lock()/rcu_read_unlock() pair around perf_iterate_ctx() call in perf_event_exec(). [ mingo: Use scoped_guard() as suggested by Peter ] Fixes: bd2756811766 ("perf: Rewrite core context handling") Signed-off-by: Breno Leitao <leitao(a)debian.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20250117-fix_perf_rcu-v1-1-13cb9210fc6a@debian.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/events/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index c2b93f521497..0b9e703641d1 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -8124,7 +8124,8 @@ void perf_event_exec(void) perf_event_enable_on_exec(ctx); perf_event_remove_on_exec(ctx); - perf_iterate_ctx(ctx, perf_event_addr_filters_exec, NULL, true); + scoped_guard(rcu) + perf_iterate_ctx(ctx, perf_event_addr_filters_exec, NULL, true); perf_unpin_context(ctx); put_ctx(ctx); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] tracing: Make sure trace_printk() can output as soon as it can be used
by Tengda Wu 29 Mar '25

29 Mar '25

From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org> stable inclusion from stable-v4.19.272 commit b94d7c7654356860dd7719120c7d15ba38b6162a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVXX CVE: CVE-2023-53007 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3bb06eb6e9acf7c4a3e1b5bc87aed398ff8e2253 upstream. Currently trace_printk() can be used as soon as early_trace_init() is called from start_kernel(). But if a crash happens, and "ftrace_dump_on_oops" is set on the kernel command line, all you get will be: [ 0.456075] <idle>-0 0dN.2. 347519us : Unknown type 6 [ 0.456075] <idle>-0 0dN.2. 353141us : Unknown type 6 [ 0.456075] <idle>-0 0dN.2. 358684us : Unknown type 6 This is because the trace_printk() event (type 6) hasn't been registered yet. That gets done via an early_initcall(), which may be early, but not early enough. Instead of registering the trace_printk() event (and other ftrace events, which are not trace events) via an early_initcall(), have them registered at the same time that trace_printk() can be used. This way, if there is a crash before early_initcall(), then the trace_printk()s will actually be useful. Link: https://lkml.kernel.org/r/20230104161412.019f6c55@gandalf.local.home Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Fixes: e725c731e3bb1 ("tracing: Split tracing initialization into two for early initialization") Reported-by: "Joel Fernandes (Google)" <joel(a)joelfernandes.org> Tested-by: Joel Fernandes (Google) <joel(a)joelfernandes.org> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace.c | 2 ++ kernel/trace/trace.h | 1 + kernel/trace/trace_output.c | 3 +-- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 64fd3c3f84f2..161cd058662c 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -8648,6 +8648,8 @@ void __init early_trace_init(void) static_key_enable(&tracepoint_printk_key.key); } tracer_alloc_buffers(); + + init_events(); } void __init trace_init(void) diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h index d05230d21cf5..00e73361c65c 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h @@ -1509,6 +1509,7 @@ extern void trace_event_enable_cmd_record(bool enable); extern void trace_event_enable_tgid_record(bool enable); extern int event_trace_init(void); +extern int init_events(void); extern int event_trace_add_tracer(struct dentry *parent, struct trace_array *tr); extern int event_trace_del_tracer(struct trace_array *tr); diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c index 6e6cc64faa38..62015d62dd6f 100644 --- a/kernel/trace/trace_output.c +++ b/kernel/trace/trace_output.c @@ -1395,7 +1395,7 @@ static struct trace_event *events[] __initdata = { NULL }; -__init static int init_events(void) +__init int init_events(void) { struct trace_event *event; int i, ret; @@ -1413,4 +1413,3 @@ __init static int init_events(void) return 0; } -early_initcall(init_events); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] trace_events_hist: add check for return value of 'create_hist_field'
by Tengda Wu 29 Mar '25

29 Mar '25

From: Natalia Petrova <n.petrova(a)fintech.ru> stable inclusion from stable-v4.19.272 commit d2d1ada58e7cc100b8d7d6b082d19321ba4a700a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVXP CVE: CVE-2023-53005 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8b152e9150d07a885f95e1fd401fc81af202d9a4 upstream. Function 'create_hist_field' is called recursively at trace_events_hist.c:1954 and can return NULL-value that's why we have to check it to avoid null pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Link: https://lkml.kernel.org/r/20230111120409.4111-1-n.petrova@fintech.ru Cc: stable(a)vger.kernel.org Fixes: 30350d65ac56 ("tracing: Add variable support to hist triggers") Signed-off-by: Natalia Petrova <n.petrova(a)fintech.ru> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events_hist.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 2f57eb241ac9..af376cf4ba9a 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -2234,6 +2234,8 @@ static struct hist_field *create_hist_field(struct hist_trigger_data *hist_data, unsigned long fl = flags & ~HIST_FIELD_FL_LOG2; hist_field->fn = hist_field_log2; hist_field->operands[0] = create_hist_field(hist_data, field, fl, NULL); + if (!hist_field->operands[0]) + goto free; hist_field->size = hist_field->operands[0]->size; hist_field->type = kstrdup(hist_field->operands[0]->type, GFP_KERNEL); if (!hist_field->type) -- 2.34.1

2 1

[PATCH OLK-5.10] usb: gadget: f_tcm: Don't free command immediately
by Xiongfeng Wang 29 Mar '25

29 Mar '25

From: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> stable inclusion from stable-v5.10.235 commit 38229c35a6d7875697dfb293356407330cfcd23e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBREC7 CVE: CVE-2025-21816 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c225d006a31949d673e646d585d9569bc28feeb9 upstream. Don't prematurely free the command. Wait for the status completion of the sense status. It can be freed then. Otherwise we will double-free the command. Fixes: cff834c16d23 ("usb-gadget/tcm: Convert to TARGET_SCF_ACK_KREF I/O krefs") Cc: stable(a)vger.kernel.org Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Link: https://lore.kernel.org/r/ae919ac431f16275e05ec819bdffb3ac5f44cbe1.17338765… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/usb/gadget/function/f_tcm.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c index 5a2e9ce2bc352..caa23265fae4c 100644 --- a/drivers/usb/gadget/function/f_tcm.c +++ b/drivers/usb/gadget/function/f_tcm.c @@ -1068,7 +1068,6 @@ static void usbg_cmd_work(struct work_struct *work) out: transport_send_check_condition_and_sense(se_cmd, TCM_UNSUPPORTED_SCSI_OPCODE, 1); - transport_generic_free_cmd(&cmd->se_cmd, 0); } static struct usbg_cmd *usbg_get_cmd(struct f_uas *fu, @@ -1199,7 +1198,6 @@ static void bot_cmd_work(struct work_struct *work) out: transport_send_check_condition_and_sense(se_cmd, TCM_UNSUPPORTED_SCSI_OPCODE, 1); - transport_generic_free_cmd(&cmd->se_cmd, 0); } static int bot_submit_command(struct f_uas *fu, -- 2.20.1

2 1

[PATCH openEuler-1.0-LTS] drbd: Fix five use after free bugs in get_initial_state
by Xiaomeng Zhang 29 Mar '25

29 Mar '25

From: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> stable inclusion from stable-v5.10.111 commit 594205b4936771a250f9d141e7e0fff21c3dd2d9 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBX1EN Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aadb22ba2f656581b2f733deb3a467c48cc618f6 ] In get_initial_state, it calls notify_initial_state_done(skb,..) if cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_done(), the skb will be freed by nlmsg_free(skb). Then get_initial_state will goto out and the freed skb will be used by return value skb->len, which is a uaf bug. What's worse, the same problem goes even further: skb can also be freed in the notify_*_state_change -> notify_*_state calls below. Thus 4 additional uaf bugs happened. My patch lets the problem callee functions: notify_initial_state_done and notify_*_state_change return an error code if errors happen. So that the error codes could be propagated and the uaf bugs can be avoid. v2 reports a compilation warning. This v3 fixed this warning and built successfully in my local environment with no additional warnings. v2: https://lore.kernel.org/patchwork/patch/1435218/ Fixes: a29728463b254 ("drbd: Backport the "events2" command") Signed-off-by: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder(a)linbit.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/block/drbd/drbd_int.h | 8 ++--- drivers/block/drbd/drbd_nl.c | 41 ++++++++++++++++---------- drivers/block/drbd/drbd_state.c | 18 +++++------ drivers/block/drbd/drbd_state_change.h | 8 ++--- 4 files changed, 42 insertions(+), 33 deletions(-) diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h index e35a234b0a8f..4f66cf6879fd 100644 --- a/drivers/block/drbd/drbd_int.h +++ b/drivers/block/drbd/drbd_int.h @@ -1688,22 +1688,22 @@ struct sib_info { }; void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib); -extern void notify_resource_state(struct sk_buff *, +extern int notify_resource_state(struct sk_buff *, unsigned int, struct drbd_resource *, struct resource_info *, enum drbd_notification_type); -extern void notify_device_state(struct sk_buff *, +extern int notify_device_state(struct sk_buff *, unsigned int, struct drbd_device *, struct device_info *, enum drbd_notification_type); -extern void notify_connection_state(struct sk_buff *, +extern int notify_connection_state(struct sk_buff *, unsigned int, struct drbd_connection *, struct connection_info *, enum drbd_notification_type); -extern void notify_peer_device_state(struct sk_buff *, +extern int notify_peer_device_state(struct sk_buff *, unsigned int, struct drbd_peer_device *, struct peer_device_info *, diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c index 5b15ffd0c7f5..5a80453be553 100644 --- a/drivers/block/drbd/drbd_nl.c +++ b/drivers/block/drbd/drbd_nl.c @@ -4598,7 +4598,7 @@ static int nla_put_notification_header(struct sk_buff *msg, return drbd_notification_header_to_skb(msg, &nh, true); } -void notify_resource_state(struct sk_buff *skb, +int notify_resource_state(struct sk_buff *skb, unsigned int seq, struct drbd_resource *resource, struct resource_info *resource_info, @@ -4640,16 +4640,17 @@ void notify_resource_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_device_state(struct sk_buff *skb, +int notify_device_state(struct sk_buff *skb, unsigned int seq, struct drbd_device *device, struct device_info *device_info, @@ -4689,16 +4690,17 @@ void notify_device_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_connection_state(struct sk_buff *skb, +int notify_connection_state(struct sk_buff *skb, unsigned int seq, struct drbd_connection *connection, struct connection_info *connection_info, @@ -4738,16 +4740,17 @@ void notify_connection_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_peer_device_state(struct sk_buff *skb, +int notify_peer_device_state(struct sk_buff *skb, unsigned int seq, struct drbd_peer_device *peer_device, struct peer_device_info *peer_device_info, @@ -4788,13 +4791,14 @@ void notify_peer_device_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } void notify_helper(enum drbd_notification_type type, @@ -4845,7 +4849,7 @@ void notify_helper(enum drbd_notification_type type, err, seq); } -static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) +static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq) { struct drbd_genlmsghdr *dh; int err; @@ -4859,11 +4863,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) if (nla_put_notification_header(skb, NOTIFY_EXISTS)) goto nla_put_failure; genlmsg_end(skb, dh); - return; + return 0; nla_put_failure: nlmsg_free(skb); pr_err("Error %d sending event. Event seq:%u\n", err, seq); + return err; } static void free_state_changes(struct list_head *list) @@ -4890,6 +4895,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) unsigned int seq = cb->args[2]; unsigned int n; enum drbd_notification_type flags = 0; + int err = 0; /* There is no need for taking notification_mutex here: it doesn't matter if the initial state events mix with later state chage @@ -4898,32 +4904,32 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) cb->args[5]--; if (cb->args[5] == 1) { - notify_initial_state_done(skb, seq); + err = notify_initial_state_done(skb, seq); goto out; } n = cb->args[4]++; if (cb->args[4] < cb->args[3]) flags |= NOTIFY_CONTINUES; if (n < 1) { - notify_resource_state_change(skb, seq, state_change->resource, + err = notify_resource_state_change(skb, seq, state_change->resource, NOTIFY_EXISTS | flags); goto next; } n--; if (n < state_change->n_connections) { - notify_connection_state_change(skb, seq, &state_change->connections[n], + err = notify_connection_state_change(skb, seq, &state_change->connections[n], NOTIFY_EXISTS | flags); goto next; } n -= state_change->n_connections; if (n < state_change->n_devices) { - notify_device_state_change(skb, seq, &state_change->devices[n], + err = notify_device_state_change(skb, seq, &state_change->devices[n], NOTIFY_EXISTS | flags); goto next; } n -= state_change->n_devices; if (n < state_change->n_devices * state_change->n_connections) { - notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], + err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], NOTIFY_EXISTS | flags); goto next; } @@ -4938,7 +4944,10 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) cb->args[4] = 0; } out: - return skb->len; + if (err) + return err; + else + return skb->len; } int drbd_adm_get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c index b452359b6aae..1474250f9440 100644 --- a/drivers/block/drbd/drbd_state.c +++ b/drivers/block/drbd/drbd_state.c @@ -1549,7 +1549,7 @@ int drbd_bitmap_io_from_worker(struct drbd_device *device, return rv; } -void notify_resource_state_change(struct sk_buff *skb, +int notify_resource_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_resource_state_change *resource_state_change, enum drbd_notification_type type) @@ -1562,10 +1562,10 @@ void notify_resource_state_change(struct sk_buff *skb, .res_susp_fen = resource_state_change->susp_fen[NEW], }; - notify_resource_state(skb, seq, resource, &resource_info, type); + return notify_resource_state(skb, seq, resource, &resource_info, type); } -void notify_connection_state_change(struct sk_buff *skb, +int notify_connection_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_connection_state_change *connection_state_change, enum drbd_notification_type type) @@ -1576,10 +1576,10 @@ void notify_connection_state_change(struct sk_buff *skb, .conn_role = connection_state_change->peer_role[NEW], }; - notify_connection_state(skb, seq, connection, &connection_info, type); + return notify_connection_state(skb, seq, connection, &connection_info, type); } -void notify_device_state_change(struct sk_buff *skb, +int notify_device_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_device_state_change *device_state_change, enum drbd_notification_type type) @@ -1589,10 +1589,10 @@ void notify_device_state_change(struct sk_buff *skb, .dev_disk_state = device_state_change->disk_state[NEW], }; - notify_device_state(skb, seq, device, &device_info, type); + return notify_device_state(skb, seq, device, &device_info, type); } -void notify_peer_device_state_change(struct sk_buff *skb, +int notify_peer_device_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_peer_device_state_change *p, enum drbd_notification_type type) @@ -1606,7 +1606,7 @@ void notify_peer_device_state_change(struct sk_buff *skb, .peer_resync_susp_dependency = p->resync_susp_dependency[NEW], }; - notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); + return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); } static void broadcast_state_change(struct drbd_state_change *state_change) @@ -1614,7 +1614,7 @@ static void broadcast_state_change(struct drbd_state_change *state_change) struct drbd_resource_state_change *resource_state_change = &state_change->resource[0]; bool resource_state_has_changed; unsigned int n_device, n_connection, n_peer_device, n_peer_devices; - void (*last_func)(struct sk_buff *, unsigned int, void *, + int (*last_func)(struct sk_buff *, unsigned int, void *, enum drbd_notification_type) = NULL; void *uninitialized_var(last_arg); diff --git a/drivers/block/drbd/drbd_state_change.h b/drivers/block/drbd/drbd_state_change.h index ba80f612d6ab..d5b0479bc9a6 100644 --- a/drivers/block/drbd/drbd_state_change.h +++ b/drivers/block/drbd/drbd_state_change.h @@ -44,19 +44,19 @@ extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_ extern void copy_old_to_new_state_change(struct drbd_state_change *); extern void forget_state_change(struct drbd_state_change *); -extern void notify_resource_state_change(struct sk_buff *, +extern int notify_resource_state_change(struct sk_buff *, unsigned int, struct drbd_resource_state_change *, enum drbd_notification_type type); -extern void notify_connection_state_change(struct sk_buff *, +extern int notify_connection_state_change(struct sk_buff *, unsigned int, struct drbd_connection_state_change *, enum drbd_notification_type type); -extern void notify_device_state_change(struct sk_buff *, +extern int notify_device_state_change(struct sk_buff *, unsigned int, struct drbd_device_state_change *, enum drbd_notification_type type); -extern void notify_peer_device_state_change(struct sk_buff *, +extern int notify_peer_device_state_change(struct sk_buff *, unsigned int, struct drbd_peer_device_state_change *, enum drbd_notification_type type); -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] Push 2 self-developed patches to OLK-5.10
by Xiaomeng Zhang 29 Mar '25

29 Mar '25

*** BLURB HERE *** Xiaomeng Zhang (2): x86: reboot: Initialize the printk locks to avoid deadlock printk: Skip log flush in NMI context when logbuf_lock is held arch/x86/kernel/reboot.c | 1 + kernel/printk/printk_safe.c | 4 ++++ 2 files changed, 5 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] Push 2 self-developed patches to OLK-5.10
by Xiaomeng Zhang 29 Mar '25

29 Mar '25

*** BLURB HERE *** Xiaomeng Zhang (2): x86: reboot: Initialize the printk locks to avoid deadlock printk: Skip log flush in NMI context when logbuf_lock is held arch/x86/kernel/reboot.c | 1 + kernel/printk/printk_safe.c | 4 ++++ 2 files changed, 5 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6] fs/dcache: fix bad unlock balance in shrink_dentry_list()
by Baokun Li 29 Mar '25

29 Mar '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBW902 -------------------------------- Inside shrink_lock_dentry(), if we can't lock the parent, we unlock the dentry and wait for the parent lock. Once we get the parent lock, we lock the dentry again. After locking the dentry a second time, we only check d_lockref.count and don't see if d_inode changed. But during that lock gap, d_inode may be modified. If the inode changes, the inode in the dentry isn't locked. However, in dentry_unlink_inode(), we unlock the inode no matter what. Then, we will get the following Oops: ------------[ cut here ]------------ pvqspinlock: lock 0xff438c8e84836be0 has corrupted value 0x0! WARNING: CPU: 1 PID: 370 at kernel/locking/qspinlock_paravirt.h:498 CPU: 1 PID: 370 Comm: bash Not tainted 5.10.0 #2008 RIP: 0010:__pv_queued_spin_unlock_slowpath+0xbf/0xd0 Call Trace: __raw_callee_save___pv_queued_spin_unlock_slowpath+0x11/0x24 .slowpath+0x9/0x16 dentry_unlink_inode+0x91/0x120 __dentry_kill+0xf3/0x1c0 shrink_dentry_list+0x4b/0xe0 prune_dcache_sb+0x52/0x80 super_cache_scan+0x133/0x1f0 do_shrink_slab+0x14a/0x2f0 Here's how concurrency might trigger this issue: P1 | P2 --------------------------------------------- prune_dcache_sb shrink_dentry_list spin_lock(&dentry->d_lock) shrink_lock_dentry /* Negative dentry, therefore no inode to lock. ref 0 */ spin_trylock(&parent->d_lock) / try lock failed / spin_unlock(&dentry->d_lock) lookup_open __d_lookup spin_lock(&dentry->d_lock) dentry->d_lockref.count++ /* ref 1 */ spin_unlock(&dentry->d_lock) /* Negative dentry, just create the file */ xfs_generic_create d_instantiate spin_lock(&inode->i_lock) __d_instantiate spin_lock(&dentry->d_lock) __d_set_inode_and_type dentry->d_inode = inode spin_unlock(&dentry->d_lock) spin_unlock(&inode->i_lock) syscall_exit_to_user_mode /* Task exit. */ __fput dput fast_dput spin_lock(&dentry->d_lock) retain_dentry dentry->d_lockref.count-- /* ref 0 */ spin_unlock(&dentry->d_lock) spin_lock(&parent->d_lock) spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED) /* d_inode has been changed but is not locked. */ __dentry_kill dentry_unlink_inode spin_unlock(&dentry->d_lock) spin_unlock(&inode->i_lock) /* Attempt to unlock an unlocked inode. */ /* WARNING: bad unlock balance in dentry_unlink_inode */ Therefore, add the missing d_inode check to avoid this issue. Fixes: 3b3f09f48ba7 ("get rid of trylock loop in locking dentries on shrink list") Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/dcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/dcache.c b/fs/dcache.c index 3e0b9abbf4d8..fe9140b0d0eb 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -1238,7 +1238,7 @@ static bool shrink_lock_dentry(struct dentry *dentry) goto out; } spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); - if (likely(!dentry->d_lockref.count)) + if (likely(!dentry->d_lockref.count && inode == dentry->d_inode)) return true; spin_unlock(&parent->d_lock); out: -- 2.46.1

2 1

[PATCH OLK-5.10] fs/dcache: fix bad unlock balance in shrink_dentry_list()
by Baokun Li 29 Mar '25

29 Mar '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBW902 -------------------------------- Inside shrink_lock_dentry(), if we can't lock the parent, we unlock the dentry and wait for the parent lock. Once we get the parent lock, we lock the dentry again. After locking the dentry a second time, we only check d_lockref.count and don't see if d_inode changed. But during that lock gap, d_inode may be modified. If the inode changes, the inode in the dentry isn't locked. However, in dentry_unlink_inode(), we unlock the inode no matter what. Then, we will get the following Oops: ------------[ cut here ]------------ pvqspinlock: lock 0xff438c8e84836be0 has corrupted value 0x0! WARNING: CPU: 1 PID: 370 at kernel/locking/qspinlock_paravirt.h:498 CPU: 1 PID: 370 Comm: bash Not tainted 5.10.0 #2008 RIP: 0010:__pv_queued_spin_unlock_slowpath+0xbf/0xd0 Call Trace: __raw_callee_save___pv_queued_spin_unlock_slowpath+0x11/0x24 .slowpath+0x9/0x16 dentry_unlink_inode+0x91/0x120 __dentry_kill+0xf3/0x1c0 shrink_dentry_list+0x4b/0xe0 prune_dcache_sb+0x52/0x80 super_cache_scan+0x133/0x1f0 do_shrink_slab+0x14a/0x2f0 Here's how concurrency might trigger this issue: P1 | P2 --------------------------------------------- prune_dcache_sb shrink_dentry_list spin_lock(&dentry->d_lock) shrink_lock_dentry /* Negative dentry, therefore no inode to lock. ref 0 */ spin_trylock(&parent->d_lock) / try lock failed / spin_unlock(&dentry->d_lock) lookup_open __d_lookup spin_lock(&dentry->d_lock) dentry->d_lockref.count++ /* ref 1 */ spin_unlock(&dentry->d_lock) /* Negative dentry, just create the file */ xfs_generic_create d_instantiate spin_lock(&inode->i_lock) __d_instantiate spin_lock(&dentry->d_lock) __d_set_inode_and_type dentry->d_inode = inode spin_unlock(&dentry->d_lock) spin_unlock(&inode->i_lock) syscall_exit_to_user_mode /* Task exit. */ __fput dput fast_dput spin_lock(&dentry->d_lock) retain_dentry dentry->d_lockref.count-- /* ref 0 */ spin_unlock(&dentry->d_lock) spin_lock(&parent->d_lock) spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED) /* d_inode has been changed but is not locked. */ __dentry_kill dentry_unlink_inode spin_unlock(&dentry->d_lock) spin_unlock(&inode->i_lock) /* Attempt to unlock an unlocked inode. */ /* WARNING: bad unlock balance in dentry_unlink_inode */ Therefore, add the missing d_inode check to avoid this issue. Fixes: 3b3f09f48ba7 ("get rid of trylock loop in locking dentries on shrink list") Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/dcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/dcache.c b/fs/dcache.c index 5dccce5bc8c1..d36bb8fc2c41 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -1174,7 +1174,7 @@ static bool shrink_lock_dentry(struct dentry *dentry) goto out; } spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); - if (likely(!dentry->d_lockref.count)) + if (likely(!dentry->d_lockref.count && inode == dentry->d_inode)) return true; spin_unlock(&parent->d_lock); out: -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] fs/dcache: fix bad unlock balance in shrink_dentry_list()
by Baokun Li 29 Mar '25

29 Mar '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBW902 CVE: NA -------------------------------- Inside shrink_lock_dentry(), if we can't lock the parent, we unlock the dentry and wait for the parent lock. Once we get the parent lock, we lock the dentry again. After locking the dentry a second time, we only check d_lockref.count and don't see if d_inode changed. But during that lock gap, d_inode may be modified. If the inode changes, the inode in the dentry isn't locked. However, in dentry_unlink_inode(), we unlock the inode no matter what. Then, we will get the following Oops: ------------[ cut here ]------------ pvqspinlock: lock 0xff438c8e84836be0 has corrupted value 0x0! WARNING: CPU: 1 PID: 370 at kernel/locking/qspinlock_paravirt.h:498 CPU: 1 PID: 370 Comm: bash Not tainted 5.10.0 #2008 RIP: 0010:__pv_queued_spin_unlock_slowpath+0xbf/0xd0 Call Trace: __raw_callee_save___pv_queued_spin_unlock_slowpath+0x11/0x24 .slowpath+0x9/0x16 dentry_unlink_inode+0x91/0x120 __dentry_kill+0xf3/0x1c0 shrink_dentry_list+0x4b/0xe0 prune_dcache_sb+0x52/0x80 super_cache_scan+0x133/0x1f0 do_shrink_slab+0x14a/0x2f0 Here's how concurrency might trigger this issue: P1 | P2 --------------------------------------------- prune_dcache_sb shrink_dentry_list spin_lock(&dentry->d_lock) shrink_lock_dentry /* Negative dentry, therefore no inode to lock. ref 0 */ spin_trylock(&parent->d_lock) / try lock failed / spin_unlock(&dentry->d_lock) lookup_open __d_lookup spin_lock(&dentry->d_lock) dentry->d_lockref.count++ /* ref 1 */ spin_unlock(&dentry->d_lock) /* Negative dentry, just create the file */ xfs_generic_create d_instantiate spin_lock(&inode->i_lock) __d_instantiate spin_lock(&dentry->d_lock) __d_set_inode_and_type dentry->d_inode = inode spin_unlock(&dentry->d_lock) spin_unlock(&inode->i_lock) syscall_exit_to_user_mode /* Task exit. */ __fput dput fast_dput spin_lock(&dentry->d_lock) retain_dentry dentry->d_lockref.count-- /* ref 0 */ spin_unlock(&dentry->d_lock) spin_lock(&parent->d_lock) spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED) /* d_inode has been changed but is not locked. */ __dentry_kill dentry_unlink_inode spin_unlock(&dentry->d_lock) spin_unlock(&inode->i_lock) /* Attempt to unlock an unlocked inode. */ /* WARNING: bad unlock balance in dentry_unlink_inode */ Therefore, add the missing d_inode check to avoid this issue. Fixes: 3b3f09f48ba7 ("get rid of trylock loop in locking dentries on shrink list") Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/dcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/dcache.c b/fs/dcache.c index 926df08eeb0c..35f82d69d2b9 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -1118,7 +1118,7 @@ static bool shrink_lock_dentry(struct dentry *dentry) goto out; } spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); - if (likely(!dentry->d_lockref.count)) + if (likely(!dentry->d_lockref.count && inode == dentry->d_inode)) return true; spin_unlock(&parent->d_lock); out: -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] firmware: arm_scmi: Fix list protocols enumeration in the base protocol
by Gu Bowen 29 Mar '25

29 Mar '25

From: Cristian Marussi <cristian.marussi(a)arm.com> stable inclusion from stable-v4.19.247 commit 444a2d27fe9867d0da4b28fc45b793f32e099ab8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2JX CVE: CVE-2022-49451 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8009120e0354a67068e920eb10dce532391361d0 ] While enumerating protocols implemented by the SCMI platform using BASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is currently validated in an improper way since the check employs a sum between unsigned integers that could overflow and cause the check itself to be silently bypassed if the returned value 'loop_num_ret' is big enough. Fix the validation avoiding the addition. Link: https://lore.kernel.org/r/20220330150551.2573938-4-cristian.marussi@arm.com Fixes: b6f20ff8bd94 ("firmware: arm_scmi: add common infrastructure and support for base protocol") Signed-off-by: Cristian Marussi <cristian.marussi(a)arm.com> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/firmware/arm_scmi/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/arm_scmi/base.c b/drivers/firmware/arm_scmi/base.c index 204390297f4b..95d892db0dff 100644 --- a/drivers/firmware/arm_scmi/base.c +++ b/drivers/firmware/arm_scmi/base.c @@ -164,7 +164,7 @@ static int scmi_base_implementation_list_get(const struct scmi_handle *handle, break; loop_num_ret = le32_to_cpu(*num_ret); - if (tot_num_ret + loop_num_ret > MAX_PROTOCOLS_IMP) { + if (loop_num_ret > MAX_PROTOCOLS_IMP - tot_num_ret) { dev_err(dev, "No. of Protocol > MAX_PROTOCOLS_IMP"); break; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] rxrpc: Fix listen() setting the bar too high for the prealloc rings
by Gu Bowen 29 Mar '25

29 Mar '25

From: David Howells <dhowells(a)redhat.com> stable inclusion from stable-v4.19.247 commit 4a3a78b7918bdd723d8c7c9786522ca969bffcc4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2XB CVE: CVE-2022-49450 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 88e22159750b0d55793302eeed8ee603f5c1a95c ] AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump up the sysctl), but whilst the preallocation circular buffers have 32 slots in them, one of them has to be a dead slot because we're using CIRC_CNT(). This means that listen(rxrpc_sock, 32) will cause an oops when the socket is closed because rxrpc_service_prealloc_one() allocated one too many calls and rxrpc_discard_prealloc() won't then be able to get rid of them because it'll think the ring is empty. rxrpc_release_calls_on_socket() then tries to abort them, but oopses because call->peer isn't yet set. Fix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match the ring capacity. BUG: kernel NULL pointer dereference, address: 0000000000000086 ... RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc] Call Trace: <TASK> ? __wake_up_common_lock+0x7a/0x90 ? rxrpc_notify_socket+0x8e/0x140 [rxrpc] ? rxrpc_abort_call+0x4c/0x60 [rxrpc] rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc] rxrpc_release+0xc9/0x1c0 [rxrpc] __sock_release+0x37/0xa0 sock_close+0x11/0x20 __fput+0x89/0x240 task_work_run+0x59/0x90 do_exit+0x319/0xaa0 Fixes: 00e907127e6f ("rxrpc: Preallocate peers, conns and calls for incoming service requests") Reported-by: Marc Dionne <marc.dionne(a)auristor.com> Signed-off-by: David Howells <dhowells(a)redhat.com> cc: linux-afs(a)lists.infradead.org Link: https://lists.infradead.org/pipermail/linux-afs/2022-March/005079.html Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- net/rxrpc/sysctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/rxrpc/sysctl.c b/net/rxrpc/sysctl.c index d75bd15151e6..50f825f55c21 100644 --- a/net/rxrpc/sysctl.c +++ b/net/rxrpc/sysctl.c @@ -17,7 +17,7 @@ static struct ctl_table_header *rxrpc_sysctl_reg_table; static const unsigned int one = 1; static const unsigned int four = 4; -static const unsigned int thirtytwo = 32; +static const unsigned int max_backlog = RXRPC_BACKLOG_MAX - 1; static const unsigned int n_65535 = 65535; static const unsigned int n_max_acks = RXRPC_RXTX_BUFF_SIZE - 1; static const unsigned long one_jiffy = 1; @@ -111,7 +111,7 @@ static struct ctl_table rxrpc_sysctl_table[] = { .mode = 0644, .proc_handler = proc_dointvec_minmax, .extra1 = (void *)&four, - .extra2 = (void *)&thirtytwo, + .extra2 = (void *)&max_backlog, }, { .procname = "rx_window_size", -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] tty: fix deadlock caused by calling printk() under tty_port->lock
by Gu Bowen 29 Mar '25

29 Mar '25

From: Qi Zheng <zhengqi.arch(a)bytedance.com> stable inclusion from stable-v4.19.247 commit 04ee31678c128a6cc7bb057ea189a8624ba5a314 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2T9 CVE: CVE-2022-49441 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6b9dbedbe3499fef862c4dff5217cf91f34e43b3 ] pty_write() invokes kmalloc() which may invoke a normal printk() to print failure message. This can cause a deadlock in the scenario reported by syz-bot below: CPU0 CPU1 CPU2 ---- ---- ---- lock(console_owner); lock(&port_lock_key); lock(&port->lock); lock(&port_lock_key); lock(&port->lock); lock(console_owner); As commit dbdda842fe96 ("printk: Add console owner and waiter logic to load balance console writes") said, such deadlock can be prevented by using printk_deferred() in kmalloc() (which is invoked in the section guarded by the port->lock). But there are too many printk() on the kmalloc() path, and kmalloc() can be called from anywhere, so changing printk() to printk_deferred() is too complicated and inelegant. Therefore, this patch chooses to specify __GFP_NOWARN to kmalloc(), so that printk() will not be called, and this deadlock problem can be avoided. Syzbot reported the following lockdep error: ====================================================== WARNING: possible circular locking dependency detected 5.4.143-00237-g08ccc19a-dirty #10 Not tainted ------------------------------------------------------ syz-executor.4/29420 is trying to acquire lock: ffffffff8aedb2a0 (console_owner){....}-{0:0}, at: console_trylock_spinning kernel/printk/printk.c:1752 [inline] ffffffff8aedb2a0 (console_owner){....}-{0:0}, at: vprintk_emit+0x2ca/0x470 kernel/printk/printk.c:2023 but task is already holding lock: ffff8880119c9158 (&port->lock){-.-.}-{2:2}, at: pty_write+0xf4/0x1f0 drivers/tty/pty.c:120 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&port->lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 tty_port_tty_get drivers/tty/tty_port.c:288 [inline] <-- lock(&port->lock); tty_port_default_wakeup+0x1d/0xb0 drivers/tty/tty_port.c:47 serial8250_tx_chars+0x530/0xa80 drivers/tty/serial/8250/8250_port.c:1767 serial8250_handle_irq.part.0+0x31f/0x3d0 drivers/tty/serial/8250/8250_port.c:1854 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1827 [inline] <-- lock(&port_lock_key); serial8250_default_handle_irq+0xb2/0x220 drivers/tty/serial/8250/8250_port.c:1870 serial8250_interrupt+0xfd/0x200 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x109/0xa50 kernel/irq/handle.c:156 [...] -> #1 (&port_lock_key){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 serial8250_console_write+0x184/0xa40 drivers/tty/serial/8250/8250_port.c:3198 <-- lock(&port_lock_key); call_console_drivers kernel/printk/printk.c:1819 [inline] console_unlock+0x8cb/0xd00 kernel/printk/printk.c:2504 vprintk_emit+0x1b5/0x470 kernel/printk/printk.c:2024 <-- lock(console_owner); vprintk_func+0x8d/0x250 kernel/printk/printk_safe.c:394 printk+0xba/0xed kernel/printk/printk.c:2084 register_console+0x8b3/0xc10 kernel/printk/printk.c:2829 univ8250_console_init+0x3a/0x46 drivers/tty/serial/8250/8250_core.c:681 console_init+0x49d/0x6d3 kernel/printk/printk.c:2915 start_kernel+0x5e9/0x879 init/main.c:713 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241 -> #0 (console_owner){....}-{0:0}: [...] lock_acquire+0x127/0x340 kernel/locking/lockdep.c:4734 console_trylock_spinning kernel/printk/printk.c:1773 [inline] <-- lock(console_owner); vprintk_emit+0x307/0x470 kernel/printk/printk.c:2023 vprintk_func+0x8d/0x250 kernel/printk/printk_safe.c:394 printk+0xba/0xed kernel/printk/printk.c:2084 fail_dump lib/fault-inject.c:45 [inline] should_fail+0x67b/0x7c0 lib/fault-inject.c:144 __should_failslab+0x152/0x1c0 mm/failslab.c:33 should_failslab+0x5/0x10 mm/slab_common.c:1224 slab_pre_alloc_hook mm/slab.h:468 [inline] slab_alloc_node mm/slub.c:2723 [inline] slab_alloc mm/slub.c:2807 [inline] __kmalloc+0x72/0x300 mm/slub.c:3871 kmalloc include/linux/slab.h:582 [inline] tty_buffer_alloc+0x23f/0x2a0 drivers/tty/tty_buffer.c:175 __tty_buffer_request_room+0x156/0x2a0 drivers/tty/tty_buffer.c:273 tty_insert_flip_string_fixed_flag+0x93/0x250 drivers/tty/tty_buffer.c:318 tty_insert_flip_string include/linux/tty_flip.h:37 [inline] pty_write+0x126/0x1f0 drivers/tty/pty.c:122 <-- lock(&port->lock); n_tty_write+0xa7a/0xfc0 drivers/tty/n_tty.c:2356 do_tty_write drivers/tty/tty_io.c:961 [inline] tty_write+0x512/0x930 drivers/tty/tty_io.c:1045 __vfs_write+0x76/0x100 fs/read_write.c:494 [...] other info that might help us debug this: Chain exists of: console_owner --> &port_lock_key --> &port->lock Link: https://lkml.kernel.org/r/20220511061951.1114-2-zhengqi.arch@bytedance.com Link: https://lkml.kernel.org/r/20220510113809.80626-2-zhengqi.arch@bytedance.com Fixes: b6da31b2c07c ("tty: Fix data race in tty_insert_flip_string_fixed_flag") Signed-off-by: Qi Zheng <zhengqi.arch(a)bytedance.com> Acked-by: Jiri Slaby <jirislaby(a)kernel.org> Acked-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Akinobu Mita <akinobu.mita(a)gmail.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/tty/tty_buffer.c [Context conflicts.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/tty_buffer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c index 93f9f9dc09fc..823630c69ef5 100644 --- a/drivers/tty/tty_buffer.c +++ b/drivers/tty/tty_buffer.c @@ -168,7 +168,8 @@ static struct tty_buffer *tty_buffer_alloc(struct tty_port *port, size_t size) if (atomic_read(&port->buf.mem_used) > port->buf.mem_limit) return NULL; printk_safe_enter(); - p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC); + p = kmalloc(sizeof(struct tty_buffer) + 2 * size, + GFP_ATOMIC | __GFP_NOWARN); printk_safe_exit(); if (p == NULL) return NULL; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] media: uvcvideo: Fix double free in error path
by Gu Bowen 29 Mar '25

29 Mar '25

From: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> stable inclusion from stable-v6.6.76 commit 6c36dcd662ec5276782838660f8533a7cb26be49 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBDI CVE: CVE-2024-57980 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c6ef3a7fa97ec823a1e1af9085cf13db9f7b3bac upstream. If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. This results in the kfree() call in uvc_status_cleanup() trying to double-free the memory. Fix it by resetting the dev->status pointer to NULL after freeing it. Fixes: a31a4055473b ("V4L/DVB:usbvideo:don't use part of buffer for USB transfer #4") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20241107235130.31372-1-laurent.pinchart@ideasonbo… Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Reviewed by: Ricardo Ribalda <ribalda(a)chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/media/usb/uvc/uvc_status.c [Context conflicts due to commit adfd3910c27fb ("media: uvcvideo: Remove void casting for the status endpoint") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/media/usb/uvc/uvc_status.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/usb/uvc/uvc_status.c b/drivers/media/usb/uvc/uvc_status.c index 883e4cab45e7..a353b3c5c03a 100644 --- a/drivers/media/usb/uvc/uvc_status.c +++ b/drivers/media/usb/uvc/uvc_status.c @@ -272,6 +272,7 @@ int uvc_status_init(struct uvc_device *dev) dev->int_urb = usb_alloc_urb(0, GFP_KERNEL); if (dev->int_urb == NULL) { kfree(dev->status); + dev->status = NULL; return -ENOMEM; } -- 2.25.1

2 1

[PATCH OLK-5.10] net: rose: fix timer races against user threads
by Gu Bowen 29 Mar '25

29 Mar '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc1 commit 5de7665e0a0746b5ad7943554b34db8f8614a196 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBF2 CVE: CVE-2025-21718 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Rose timers only acquire the socket spinlock, without checking if the socket is owned by one user thread. Add a check and rearm the timers if needed. BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174 Read of size 2 at addr ffff88802f09b82a by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174 call_timer_fn+0x187/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430 run_timer_base kernel/time/timer.c:2439 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 </IRQ> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20250122180244.1861468-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- net/rose/rose_timer.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/net/rose/rose_timer.c b/net/rose/rose_timer.c index f06ddbed3fed..1525773e94aa 100644 --- a/net/rose/rose_timer.c +++ b/net/rose/rose_timer.c @@ -122,6 +122,10 @@ static void rose_heartbeat_expiry(struct timer_list *t) struct rose_sock *rose = rose_sk(sk); bh_lock_sock(sk); + if (sock_owned_by_user(sk)) { + sk_reset_timer(sk, &sk->sk_timer, jiffies + HZ/20); + goto out; + } switch (rose->state) { case ROSE_STATE_0: /* Magic here: If we listen() and a new link dies before it @@ -152,6 +156,7 @@ static void rose_heartbeat_expiry(struct timer_list *t) } rose_start_heartbeat(sk); +out: bh_unlock_sock(sk); sock_put(sk); } @@ -162,6 +167,10 @@ static void rose_timer_expiry(struct timer_list *t) struct sock *sk = &rose->sock; bh_lock_sock(sk); + if (sock_owned_by_user(sk)) { + sk_reset_timer(sk, &rose->timer, jiffies + HZ/20); + goto out; + } switch (rose->state) { case ROSE_STATE_1: /* T1 */ case ROSE_STATE_4: /* T2 */ @@ -182,6 +191,7 @@ static void rose_timer_expiry(struct timer_list *t) } break; } +out: bh_unlock_sock(sk); sock_put(sk); } @@ -192,6 +202,10 @@ static void rose_idletimer_expiry(struct timer_list *t) struct sock *sk = &rose->sock; bh_lock_sock(sk); + if (sock_owned_by_user(sk)) { + sk_reset_timer(sk, &rose->idletimer, jiffies + HZ/20); + goto out; + } rose_clear_queues(sk); rose_write_internal(sk, ROSE_CLEAR_REQUEST); @@ -207,6 +221,7 @@ static void rose_idletimer_expiry(struct timer_list *t) sk->sk_state_change(sk); sock_set_flag(sk, SOCK_DEAD); } +out: bh_unlock_sock(sk); sock_put(sk); } -- 2.25.1

2 1

[PATCH OLK-5.10] media: uvcvideo: Fix double free in error path
by Gu Bowen 29 Mar '25

29 Mar '25

From: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> stable inclusion from stable-v6.6.76 commit 6c36dcd662ec5276782838660f8533a7cb26be49 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBM4S5 CVE: CVE-2024-57980 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c6ef3a7fa97ec823a1e1af9085cf13db9f7b3bac upstream. If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. This results in the kfree() call in uvc_status_cleanup() trying to double-free the memory. Fix it by resetting the dev->status pointer to NULL after freeing it. Fixes: a31a4055473b ("V4L/DVB:usbvideo:don't use part of buffer for USB transfer #4") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20241107235130.31372-1-laurent.pinchart@ideasonbo… Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Reviewed by: Ricardo Ribalda <ribalda(a)chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/media/usb/uvc/uvc_status.c [Context conflicts due to commit adfd3910c27fb ("media: uvcvideo: Remove void casting for the status endpoint") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/media/usb/uvc/uvc_status.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/usb/uvc/uvc_status.c b/drivers/media/usb/uvc/uvc_status.c index 73725051cc16..6edf491dd873 100644 --- a/drivers/media/usb/uvc/uvc_status.c +++ b/drivers/media/usb/uvc/uvc_status.c @@ -269,6 +269,7 @@ int uvc_status_init(struct uvc_device *dev) dev->int_urb = usb_alloc_urb(0, GFP_KERNEL); if (dev->int_urb == NULL) { kfree(dev->status); + dev->status = NULL; return -ENOMEM; } -- 2.25.1

2 1

[openeuler:OLK-6.6 2064/2064] kismet: WARNING: unmet direct dependencies detected for CRYPTO_DRBG_CTR when selected by CRYPTO_DEV_HISI_TRNG
by kernel test robot 29 Mar '25

29 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 94d50befec22eea69046e558027594d630edb926 commit: e623afb45e58ded6b45cc4f0ac6c19b3736c96f9 [2064/2064] crypto: hisilicon/trng - support to obtain random numbers from soft algorithm config: arm64-kismet-CONFIG_CRYPTO_DRBG_CTR-CONFIG_CRYPTO_DEV_HISI_TRNG-0-0 (https://download.01.org/0day-ci/archive/20250329/202503290855.eVbc4pVd-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20250329/202503290855.eVbc4pVd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503290855.eVbc4pVd-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for CRYPTO_DRBG_CTR when selected by CRYPTO_DEV_HISI_TRNG WARNING: unmet direct dependencies detected for CRYPTO_DRBG_CTR Depends on [n]: CRYPTO [=y] && CRYPTO_DRBG_MENU [=n] Selected by [y]: - CRYPTO_DEV_HISI_TRNG [=y] && CRYPTO [=y] && CRYPTO_HW [=y] && ARM64 [=y] && ACPI [=y] WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] WARNING: unmet direct dependencies detected for RESCTRL_FS Depends on [n]: MISC_FILESYSTEMS [=n] && ARCH_HAS_CPU_RESCTRL [=y] Selected by [y]: - ARM64_MPAM [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1528/1528] drivers/fpga/dfl.o: warning: objtool: build_info_commit_dev()+0x5b: unreachable instruction
by kernel test robot 29 Mar '25

29 Mar '25

Hi Scott, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4d1e247486ffeef035a5a55a97f2659f68177357 commit: 99e28159a079ea6af5a5b789e83b68240d67f9ff [1528/1528] fpga: dfl: Add lockdep classes for pdata->lock config: x86_64-buildonly-randconfig-006-20250328 (https://download.01.org/0day-ci/archive/20250329/202503290119.FlNWiz0A-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250329/202503290119.FlNWiz0A-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503290119.FlNWiz0A-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/fpga/dfl.c:57: warning: cannot understand function prototype: 'struct dfl_dev_info ' drivers/fpga/dfl.c:77: warning: cannot understand function prototype: 'struct dfl_chardev_info ' >> drivers/fpga/dfl.o: warning: objtool: build_info_commit_dev()+0x5b: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1528/1528] drivers/crypto/.tmp_qcom-rng.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 29 Mar '25

29 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4d1e247486ffeef035a5a55a97f2659f68177357 commit: c5f5aeef9b55b362ad5a0e04e4b41cd63b208842 [1528/1528] Merge git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux config: x86_64-buildonly-randconfig-002-20250328 (https://download.01.org/0day-ci/archive/20250328/202503282324.X867QbB6-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250328/202503282324.X867QbB6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503282324.X867QbB6-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/.tmp_qcom-rng.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] usb: usbip: fix a refcount leak in stub_probe()
by Xia Fukun 28 Mar '25

28 Mar '25

From: Hangyu Hua <hbh25y(a)gmail.com> stable inclusion from stable-v4.19.325 commit 247d3809e45a34d9e1a3a2bb7012e31ed8b46031 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3SN CVE: CVE-2022-49389 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 9ec4cbf1cc55d126759051acfe328d489c5d6e60 ] usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails after that, usb_put_dev() needs to be called to release the reference. Fix this by moving usb_put_dev() to sdev_free error path handling. Find this by code review. Fixes: 3ff67445750a ("usbip: fix error handling in stub_probe()") Reviewed-by: Shuah Khan <skhan(a)linuxfoundation.org> Signed-off-by: Hangyu Hua <hbh25y(a)gmail.com> Link: https://lore.kernel.org/r/20220412020257.9767-1-hbh25y@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/usb/usbip/stub_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c index 93891d445c30..2650ef62757a 100644 --- a/drivers/usb/usbip/stub_dev.c +++ b/drivers/usb/usbip/stub_dev.c @@ -410,7 +410,6 @@ static int stub_probe(struct usb_device *udev) (struct usb_dev_state *) udev); err_port: dev_set_drvdata(&udev->dev, NULL); - usb_put_dev(udev); /* we already have busid_priv, just lock busid_lock */ spin_lock(&busid_priv->busid_lock); @@ -425,6 +424,7 @@ static int stub_probe(struct usb_device *udev) put_busid_priv(busid_priv); sdev_free: + usb_put_dev(udev); stub_device_free(sdev); return rc; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1528/1528] include/asm-generic/io.h:742:19: warning: 'reg' may be used uninitialized in this function
by kernel test robot 28 Mar '25

28 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4d1e247486ffeef035a5a55a97f2659f68177357 commit: e44716ed4262a467260fccb7814e4c89588f438d [1528/1528] arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY config: arm64-randconfig-003-20250328 (https://download.01.org/0day-ci/archive/20250328/202503281620.pNXaYE13-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250328/202503281620.pNXaYE13-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503281620.pNXaYE13-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c: In function 'nv40_fifo_dma_engine_init': drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c:111:37: warning: 'ctx' may be used uninitialized in this function [-Wmaybe-uninitialized] 111 | nvkm_wo32(imem->ramfc, chan->ramfc + ctx, inst); | ^ In file included from arch/arm64/include/asm/io.h:213, from include/linux/io.h:25, from include/linux/pci.h:34, from drivers/gpu/drm/nouveau/include/nvif/os.h:8, from drivers/gpu/drm/nouveau/include/nvkm/core/os.h:4, from drivers/gpu/drm/nouveau/include/nvkm/core/oclass.h:3, from drivers/gpu/drm/nouveau/include/nvkm/core/device.h:4, from drivers/gpu/drm/nouveau/include/nvkm/core/subdev.h:4, from drivers/gpu/drm/nouveau/include/nvkm/core/engine.h:5, from drivers/gpu/drm/nouveau/include/nvkm/engine/fifo.h:4, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/priv.h:5, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/chan.h:5, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/channv04.h:5, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c:24: >> include/asm-generic/io.h:742:19: warning: 'reg' may be used uninitialized in this function [-Wmaybe-uninitialized] 742 | #define iowrite32 iowrite32 | ^~~~~~~~~ drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c:97:12: note: 'reg' was declared here 97 | u32 inst, reg, ctx; | ^~~ drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c: In function 'nv40_fifo_dma_engine_fini': drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c:80:37: warning: 'ctx' may be used uninitialized in this function [-Wmaybe-uninitialized] 80 | nvkm_wo32(imem->ramfc, chan->ramfc + ctx, 0x00000000); | ^ In file included from arch/arm64/include/asm/io.h:213, from include/linux/io.h:25, from include/linux/pci.h:34, from drivers/gpu/drm/nouveau/include/nvif/os.h:8, from drivers/gpu/drm/nouveau/include/nvkm/core/os.h:4, from drivers/gpu/drm/nouveau/include/nvkm/core/oclass.h:3, from drivers/gpu/drm/nouveau/include/nvkm/core/device.h:4, from drivers/gpu/drm/nouveau/include/nvkm/core/subdev.h:4, from drivers/gpu/drm/nouveau/include/nvkm/core/engine.h:5, from drivers/gpu/drm/nouveau/include/nvkm/engine/fifo.h:4, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/priv.h:5, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/chan.h:5, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/channv04.h:5, from drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c:24: >> include/asm-generic/io.h:742:19: warning: 'reg' may be used uninitialized in this function [-Wmaybe-uninitialized] 742 | #define iowrite32 iowrite32 | ^~~~~~~~~ drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c:67:6: note: 'reg' was declared here 67 | u32 reg, ctx; | ^~~ vim +/reg +742 include/asm-generic/io.h 9216efafc52ff9 Thierry Reding 2014-10-01 740 9216efafc52ff9 Thierry Reding 2014-10-01 741 #ifndef iowrite32 9216efafc52ff9 Thierry Reding 2014-10-01 @742 #define iowrite32 iowrite32 9216efafc52ff9 Thierry Reding 2014-10-01 743 static inline void iowrite32(u32 value, volatile void __iomem *addr) 9216efafc52ff9 Thierry Reding 2014-10-01 744 { 9216efafc52ff9 Thierry Reding 2014-10-01 745 writel(value, addr); 9216efafc52ff9 Thierry Reding 2014-10-01 746 } 9216efafc52ff9 Thierry Reding 2014-10-01 747 #endif 9216efafc52ff9 Thierry Reding 2014-10-01 748 :::::: The code at line 742 was first introduced by commit :::::: 9216efafc52ff99e9351ef60de5fcafc2bc8adb6 asm-generic/io.h: Reconcile I/O accessor overrides :::::: TO: Thierry Reding <treding(a)nvidia.com> :::::: CC: Thierry Reding <treding(a)nvidia.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] drivers: usb: host: Fix deadlock in oxu_bus_suspend()
by Xia Fukun 28 Mar '25

28 Mar '25

From: Duoming Zhou <duoming(a)zju.edu.cn> stable inclusion from stable-v4.19.247 commit f8242044c91cafbba9e320b0fb31abf2429a3221 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3Z3 CVE: CVE-2022-49313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4d378f2ae58138d4c55684e1d274e7dd94aa6524 ] There is a deadlock in oxu_bus_suspend(), which is shown below: (Thread 1) | (Thread 2) | timer_action() oxu_bus_suspend() | mod_timer() spin_lock_irq() //(1) | (wait a time) ... | oxu_watchdog() del_timer_sync() | spin_lock_irq() //(2) (wait timer to stop) | ... We hold oxu->lock in position (1) of thread 1, and use del_timer_sync() to wait timer to stop, but timer handler also need oxu->lock in position (2) of thread 2. As a result, oxu_bus_suspend() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irq(), which could let timer handler to obtain the needed lock. Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Link: https://lore.kernel.org/r/20220417120305.64577-1-duoming@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/usb/host/oxu210hp-hcd.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c index c5e6e8d0b5ef..0402fa3b1ea2 100644 --- a/drivers/usb/host/oxu210hp-hcd.c +++ b/drivers/usb/host/oxu210hp-hcd.c @@ -3476,8 +3476,10 @@ static int oxu_bus_suspend(struct usb_hcd *hcd) } } + spin_unlock_irq(&oxu->lock); /* turn off now-idle HC */ del_timer_sync(&oxu->watchdog); + spin_lock_irq(&oxu->lock); ehci_halt(oxu); hcd->state = HC_STATE_SUSPENDED; -- 2.34.1

2 1

[PATCH OLK-6.6 V1] platform/x86: int3472: Check for adev == NULL
by Zicheng Qu 28 Mar '25

28 Mar '25

From: Hans de Goede <hdegoede(a)redhat.com> stable inclusion from stable-v6.6.78 commit f9c7cc44758f4930b41285a6d54afa8cbd9762b4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5Y CVE: CVE-2024-58011 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cd2fd6eab480dfc247b737cf7a3d6b009c4d0f1c ] Not all devices have an ACPI companion fwnode, so adev might be NULL. This can e.g. (theoretically) happen when a user manually binds one of the int3472 drivers to another i2c/platform device through sysfs. Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in skl_int3472_get_acpi_buffer(). Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Link: https://lore.kernel.org/r/20241209220522.25288-1-hdegoede@redhat.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/platform/x86/intel/int3472/discrete.c | 3 +++ drivers/platform/x86/intel/int3472/tps68470.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/drivers/platform/x86/intel/int3472/discrete.c b/drivers/platform/x86/intel/int3472/discrete.c index e33c2d75975c..d56f79043f5e 100644 --- a/drivers/platform/x86/intel/int3472/discrete.c +++ b/drivers/platform/x86/intel/int3472/discrete.c @@ -284,6 +284,9 @@ static int skl_int3472_discrete_probe(struct platform_device *pdev) struct int3472_cldb cldb; int ret; + if (!adev) + return -ENODEV; + ret = skl_int3472_fill_cldb(adev, &cldb); if (ret) { dev_err(&pdev->dev, "Couldn't fill CLDB structure\n"); diff --git a/drivers/platform/x86/intel/int3472/tps68470.c b/drivers/platform/x86/intel/int3472/tps68470.c index 1e107fd49f82..81ac4c691963 100644 --- a/drivers/platform/x86/intel/int3472/tps68470.c +++ b/drivers/platform/x86/intel/int3472/tps68470.c @@ -152,6 +152,9 @@ static int skl_int3472_tps68470_probe(struct i2c_client *client) int ret; int i; + if (!adev) + return -ENODEV; + n_consumers = skl_int3472_fill_clk_pdata(&client->dev, &clk_pdata); if (n_consumers < 0) return n_consumers; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-21726
by Zicheng Qu 28 Mar '25

28 Mar '25

Chen Ridong (2): padata: add pd get/put refcnt helper padata: avoid UAF for reorder_work kernel/padata.c | 37 +++++++++++++++++++++++++++++-------- 1 file changed, 29 insertions(+), 8 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2025-21726
by Zicheng Qu 28 Mar '25

28 Mar '25

Chen Ridong (2): padata: add pd get/put refcnt helper padata: avoid UAF for reorder_work kernel/padata.c | 37 +++++++++++++++++++++++++++++-------- 1 file changed, 29 insertions(+), 8 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 V1] padata: fix UAF in padata_reorder
by Zicheng Qu 28 Mar '25

28 Mar '25

From: Chen Ridong <chenridong(a)huawei.com> mainline inclusion from mainline-v6.14-rc1 commit e01780ea4661172734118d2a5f41bc9720765668 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBHS CVE: CVE-2025-21727 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206 CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+ Workqueue: pdecrypt_parallel padata_parallel_worker Call Trace: <TASK> dump_stack_lvl+0x32/0x50 print_address_description.constprop.0+0x6b/0x3d0 print_report+0xdd/0x2c0 kasan_report+0xa5/0xd0 padata_find_next+0x29/0x1a0 padata_reorder+0x131/0x220 padata_parallel_worker+0x3d/0xc0 process_one_work+0x2ec/0x5a0 If 'mdelay(10)' is added before calling 'padata_find_next' in the 'padata_reorder' function, this issue could be reproduced easily with ltp test (pcrypt_aead01). This can be explained as bellow: pcrypt_aead_encrypt ... padata_do_parallel refcount_inc(&pd->refcnt); // add refcnt ... padata_do_serial padata_reorder // pd while (1) { padata_find_next(pd, true); // using pd queue_work_on ... padata_serial_worker crypto_del_alg padata_put_pd_cnt // sub refcnt padata_free_shell padata_put_pd(ps->pd); // pd is freed // loop again, but pd is freed // call padata_find_next, UAF } In the padata_reorder function, when it loops in 'while', if the alg is deleted, the refcnt may be decreased to 0 before entering 'padata_find_next', which leads to UAF. As mentioned in [1], do_serial is supposed to be called with BHs disabled and always happen under RCU protection, to address this issue, add synchronize_rcu() in 'padata_free_shell' wait for all _do_serial calls to finish. [1] https://lore.kernel.org/all/20221028160401.cccypv4euxikusiq@parnassus.local… [2] https://lore.kernel.org/linux-kernel/jfjz5d7zwbytztackem7ibzalm5lnxldi2eofe… Fixes: b128a3040935 ("padata: allocate workqueue internally") Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Signed-off-by: Qu Zicheng <quzicheng(a)huawei.com> Acked-by: Daniel Jordan <daniel.m.jordan(a)oracle.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/padata.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/padata.c b/kernel/padata.c index 9bf77b58ee08..6567ec3a6658 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -1118,6 +1118,12 @@ void padata_free_shell(struct padata_shell *ps) if (!ps) return; + /* + * Wait for all _do_serial calls to finish to avoid touching + * freed pd's and ps's. + */ + synchronize_rcu(); + mutex_lock(&ps->pinst->lock); list_del(&ps->list); pd = rcu_dereference_protected(ps->pd, 1); -- 2.34.1

2 1

[PATCH OLK-5.10 V1] padata: fix UAF in padata_reorder
by Zicheng Qu 28 Mar '25

28 Mar '25

From: Chen Ridong <chenridong(a)huawei.com> mainline inclusion from mainline-v6.14-rc1 commit e01780ea4661172734118d2a5f41bc9720765668 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBHS CVE: CVE-2025-21727 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206 CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+ Workqueue: pdecrypt_parallel padata_parallel_worker Call Trace: <TASK> dump_stack_lvl+0x32/0x50 print_address_description.constprop.0+0x6b/0x3d0 print_report+0xdd/0x2c0 kasan_report+0xa5/0xd0 padata_find_next+0x29/0x1a0 padata_reorder+0x131/0x220 padata_parallel_worker+0x3d/0xc0 process_one_work+0x2ec/0x5a0 If 'mdelay(10)' is added before calling 'padata_find_next' in the 'padata_reorder' function, this issue could be reproduced easily with ltp test (pcrypt_aead01). This can be explained as bellow: pcrypt_aead_encrypt ... padata_do_parallel refcount_inc(&pd->refcnt); // add refcnt ... padata_do_serial padata_reorder // pd while (1) { padata_find_next(pd, true); // using pd queue_work_on ... padata_serial_worker crypto_del_alg padata_put_pd_cnt // sub refcnt padata_free_shell padata_put_pd(ps->pd); // pd is freed // loop again, but pd is freed // call padata_find_next, UAF } In the padata_reorder function, when it loops in 'while', if the alg is deleted, the refcnt may be decreased to 0 before entering 'padata_find_next', which leads to UAF. As mentioned in [1], do_serial is supposed to be called with BHs disabled and always happen under RCU protection, to address this issue, add synchronize_rcu() in 'padata_free_shell' wait for all _do_serial calls to finish. [1] https://lore.kernel.org/all/20221028160401.cccypv4euxikusiq@parnassus.local… [2] https://lore.kernel.org/linux-kernel/jfjz5d7zwbytztackem7ibzalm5lnxldi2eofe… Fixes: b128a3040935 ("padata: allocate workqueue internally") Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Signed-off-by: Qu Zicheng <quzicheng(a)huawei.com> Acked-by: Daniel Jordan <daniel.m.jordan(a)oracle.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/padata.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/padata.c b/kernel/padata.c index e24244c9c2cc..c27032595247 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -1120,6 +1120,12 @@ void padata_free_shell(struct padata_shell *ps) if (!ps) return; + /* + * Wait for all _do_serial calls to finish to avoid touching + * freed pd's and ps's. + */ + synchronize_rcu(); + mutex_lock(&ps->pinst->lock); list_del(&ps->list); pd = rcu_dereference_protected(ps->pd, 1); -- 2.34.1

2 1

[PATCH OLK-6.6 V1] kernel: be more careful about dup_mmap() failures and uprobe registering
by Zicheng Qu 28 Mar '25

28 Mar '25

From: "Liam R. Howlett" <Liam.Howlett(a)Oracle.com> mainline inclusion from mainline-v6.14-rc1 commit 64c37e134b120fb462fb4a80694bfb8e7be77b14 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBM0 CVE: CVE-2025-21709 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- If a memory allocation fails during dup_mmap(), the maple tree can be left in an unsafe state for other iterators besides the exit path. All the locks are dropped before the exit_mmap() call (in mm/mmap.c), but the incomplete mm_struct can be reached through (at least) the rmap finding the vmas which have a pointer back to the mm_struct. Up to this point, there have been no issues with being able to find an mm_struct that was only partially initialised. Syzbot was able to make the incomplete mm_struct fail with recent forking changes, so it has been proven unsafe to use the mm_struct that hasn't been initialised, as referenced in the link below. Although 8ac662f5da19f ("fork: avoid inappropriate uprobe access to invalid mm") fixed the uprobe access, it does not completely remove the race. This patch sets the MMF_OOM_SKIP to avoid the iteration of the vmas on the oom side (even though this is extremely unlikely to be selected as an oom victim in the race window), and sets MMF_UNSTABLE to avoid other potential users from using a partially initialised mm_struct. When registering vmas for uprobe, skip the vmas in an mm that is marked unstable. Modifying a vma in an unstable mm may cause issues if the mm isn't fully initialised. Link: https://lore.kernel.org/all/6756d273.050a0220.2477f.003d.GAE@google.com/ Link: https://lkml.kernel.org/r/20250127170221.1761366-1-Liam.Howlett@oracle.com Fixes: d24062914837 ("fork: use __mt_dup() to duplicate maple tree in dup_mmap()") Signed-off-by: Liam R. Howlett <Liam.Howlett(a)Oracle.com> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Oleg Nesterov <oleg(a)redhat.com> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Jann Horn <jannh(a)google.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Peng Zhang <zhangpeng.00(a)bytedance.com> Cc: Matthew Wilcox <willy(a)infradead.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: kernel/events/uprobes.c [The current version does not contain the following include code: include <linux/khugepaged.h> include <linux/rcupdate_trace.h> include <linux/workqueue.h> Upon verification, all three include can be ignore.] Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/events/uprobes.c | 4 ++++ kernel/fork.c | 17 ++++++++++++++--- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index a14b0059f177..e101416c64e5 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -26,6 +26,7 @@ #include <linux/task_work.h> #include <linux/shmem_fs.h> #include <linux/khugepaged.h> +#include <linux/oom.h> /* check_stable_address_space */ #include <linux/uprobes.h> @@ -1050,6 +1051,9 @@ register_for_each_vma(struct uprobe *uprobe, struct uprobe_consumer *new) goto free; mmap_write_lock(mm); + if (check_stable_address_space(mm)) + goto unlock; + vma = find_vma(mm, info->vaddr); if (!vma || !valid_vma(vma, is_register) || file_inode(vma->vm_file) != uprobe->inode) diff --git a/kernel/fork.c b/kernel/fork.c index f30b24c68442..ca12c40b2c4c 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -793,7 +793,8 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, mt_set_in_rcu(vmi.mas.tree); ksm_fork(mm, oldmm); khugepaged_fork(mm, oldmm); - } else if (mpnt) { + } else { + /* * The entire maple tree has already been duplicated. If the * mmap duplication fails, mark the failure point with @@ -801,8 +802,18 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, * stop releasing VMAs that have not been duplicated after this * point. */ - mas_set_range(&vmi.mas, mpnt->vm_start, mpnt->vm_end - 1); - mas_store(&vmi.mas, XA_ZERO_ENTRY); + if (mpnt) { + mas_set_range(&vmi.mas, mpnt->vm_start, mpnt->vm_end - 1); + mas_store(&vmi.mas, XA_ZERO_ENTRY); + /* Avoid OOM iterating a broken tree */ + set_bit(MMF_OOM_SKIP, &mm->flags); + } + /* + * The mm_struct is going to exit, but the locks will be dropped + * first. Set the mm_struct as unstable is advisable as it is + * not fully initialised. + */ + set_bit(MMF_UNSTABLE, &mm->flags); } out: mmap_write_unlock(mm); -- 2.34.1

2 1

[PATCH OLK-6.6 V1] scsi: ufs: core: Fix use-after free in init error and remove paths
by Zicheng Qu 28 Mar '25

28 Mar '25

From: André Draszik <andre.draszik(a)linaro.org> mainline inclusion from mainline-v6.14-rc2 commit f8fb2403ddebb5eea0033d90d9daae4c88749ada category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPCAA CVE: CVE-2025-21739 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- devm_blk_crypto_profile_init() registers a cleanup handler to run when the associated (platform-) device is being released. For UFS, the crypto private data and pointers are stored as part of the ufs_hba's data structure 'struct ufs_hba::crypto_profile'. This structure is allocated as part of the underlying ufshcd and therefore Scsi_host allocation. During driver release or during error handling in ufshcd_pltfrm_init(), this structure is released as part of ufshcd_dealloc_host() before the (platform-) device associated with the crypto call above is released. Once this device is released, the crypto cleanup code will run, using the just-released 'struct ufs_hba::crypto_profile'. This causes a use-after-free situation: Call trace: kfree+0x60/0x2d8 (P) kvfree+0x44/0x60 blk_crypto_profile_destroy_callback+0x28/0x70 devm_action_release+0x1c/0x30 release_nodes+0x6c/0x108 devres_release_all+0x98/0x100 device_unbind_cleanup+0x20/0x70 really_probe+0x218/0x2d0 In other words, the initialisation code flow is: platform-device probe ufshcd_pltfrm_init() ufshcd_alloc_host() scsi_host_alloc() allocation of struct ufs_hba creation of scsi-host devices devm_blk_crypto_profile_init() devm registration of cleanup handler using platform-device and during error handling of ufshcd_pltfrm_init() or during driver removal: ufshcd_dealloc_host() scsi_host_put() put_device(scsi-host) release of struct ufs_hba put_device(platform-device) crypto cleanup handler To fix this use-after free, change ufshcd_alloc_host() to register a devres action to automatically cleanup the underlying SCSI device on ufshcd destruction, without requiring explicit calls to ufshcd_dealloc_host(). This way: * the crypto profile and all other ufs_hba-owned resources are destroyed before SCSI (as they've been registered after) * a memleak is plugged in tc-dwc-g210-pci.c remove() as a side-effect * EXPORT_SYMBOL_GPL(ufshcd_dealloc_host) can be removed fully as it's not needed anymore * no future drivers using ufshcd_alloc_host() could ever forget adding the cleanup Fixes: cb77cb5abe1f ("blk-crypto: rename blk_keyslot_manager to blk_crypto_profile") Fixes: d76d9d7d1009 ("scsi: ufs: use devm_blk_ksm_init()") Cc: stable(a)vger.kernel.org Signed-off-by: André Draszik <andre.draszik(a)linaro.org> Link: https://lore.kernel.org/r/20250124-ufshcd-fix-v4-1-c5d0144aae59@linaro.org Reviewed-by: Bean Huo <beanhuo(a)micron.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Acked-by: Eric Biggers <ebiggers(a)kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/ufs/host/ufshcd-pltfrm.c include/ufs/ufshcd.h [For ufshcd-pltfrm.c, the main purpose is to remove the goto dealloc_host. However, in the current version, some parts that are intended to be removed do not exist, resulting in conflicts. For ufshcd.h, it aims to remove ufshcd_dealloc_host only, but in the mainline, it has more code (ufshcd_enable_irq, ufshcd_disable_irq) around ufshcd_dealloc_host, but they are not relevant to this patch.] Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/ufs/core/ufshcd.c | 31 +++++++++++++++++++++---------- drivers/ufs/host/ufshcd-pci.c | 2 -- drivers/ufs/host/ufshcd-pltfrm.c | 26 ++++++++------------------ include/ufs/ufshcd.h | 1 - 4 files changed, 29 insertions(+), 31 deletions(-) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index 84dac9050074..ffa5a3ac596e 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -10220,16 +10220,6 @@ int ufshcd_system_thaw(struct device *dev) EXPORT_SYMBOL_GPL(ufshcd_system_thaw); #endif /* CONFIG_PM_SLEEP */ -/** - * ufshcd_dealloc_host - deallocate Host Bus Adapter (HBA) - * @hba: pointer to Host Bus Adapter (HBA) - */ -void ufshcd_dealloc_host(struct ufs_hba *hba) -{ - scsi_host_put(hba->host); -} -EXPORT_SYMBOL_GPL(ufshcd_dealloc_host); - /** * ufshcd_set_dma_mask - Set dma mask based on the controller * addressing capability @@ -10248,12 +10238,26 @@ static int ufshcd_set_dma_mask(struct ufs_hba *hba) return dma_set_mask_and_coherent(hba->dev, DMA_BIT_MASK(32)); } +/** + * ufshcd_devres_release - devres cleanup handler, invoked during release of + * hba->dev + * @host: pointer to SCSI host + */ +static void ufshcd_devres_release(void *host) +{ + scsi_host_put(host); +} + /** * ufshcd_alloc_host - allocate Host Bus Adapter (HBA) * @dev: pointer to device handle * @hba_handle: driver private handle * * Return: 0 on success, non-zero value on failure. + * + * NOTE: There is no corresponding ufshcd_dealloc_host() because this function + * keeps track of its allocations using devres and deallocates everything on + * device removal automatically. */ int ufshcd_alloc_host(struct device *dev, struct ufs_hba **hba_handle) { @@ -10275,6 +10279,13 @@ int ufshcd_alloc_host(struct device *dev, struct ufs_hba **hba_handle) err = -ENOMEM; goto out_error; } + + err = devm_add_action_or_reset(dev, ufshcd_devres_release, + host); + if (err) + return dev_err_probe(dev, err, + "failed to add ufshcd dealloc action\n"); + host->nr_maps = HCTX_TYPE_POLL + 1; hba = shost_priv(host); hba->host = host; diff --git a/drivers/ufs/host/ufshcd-pci.c b/drivers/ufs/host/ufshcd-pci.c index 248a49e5e7f3..446c1d604cc6 100644 --- a/drivers/ufs/host/ufshcd-pci.c +++ b/drivers/ufs/host/ufshcd-pci.c @@ -516,7 +516,6 @@ static void ufshcd_pci_remove(struct pci_dev *pdev) pm_runtime_forbid(&pdev->dev); pm_runtime_get_noresume(&pdev->dev); ufshcd_remove(hba); - ufshcd_dealloc_host(hba); } /** @@ -561,7 +560,6 @@ ufshcd_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) err = ufshcd_init(hba, mmio_base, pdev->irq); if (err) { dev_err(&pdev->dev, "Initialization failed\n"); - ufshcd_dealloc_host(hba); return err; } diff --git a/drivers/ufs/host/ufshcd-pltfrm.c b/drivers/ufs/host/ufshcd-pltfrm.c index e99d89d00606..f6c645a62362 100644 --- a/drivers/ufs/host/ufshcd-pltfrm.c +++ b/drivers/ufs/host/ufshcd-pltfrm.c @@ -339,21 +339,17 @@ int ufshcd_pltfrm_init(struct platform_device *pdev, struct device *dev = &pdev->dev; mmio_base = devm_platform_ioremap_resource(pdev, 0); - if (IS_ERR(mmio_base)) { - err = PTR_ERR(mmio_base); - goto out; - } + if (IS_ERR(mmio_base)) + return PTR_ERR(mmio_base); irq = platform_get_irq(pdev, 0); - if (irq < 0) { - err = irq; - goto out; - } + if (irq < 0) + return irq; err = ufshcd_alloc_host(dev, &hba); if (err) { dev_err(dev, "Allocation failed\n"); - goto out; + return err; } hba->vops = vops; @@ -362,13 +358,13 @@ int ufshcd_pltfrm_init(struct platform_device *pdev, if (err) { dev_err(dev, "%s: clock parse failed %d\n", __func__, err); - goto dealloc_host; + return err; } err = ufshcd_parse_regulator_info(hba); if (err) { dev_err(dev, "%s: regulator init failed %d\n", __func__, err); - goto dealloc_host; + return err; } ufshcd_init_lanes_per_dir(hba); @@ -377,18 +373,13 @@ int ufshcd_pltfrm_init(struct platform_device *pdev, if (err) { dev_err_probe(dev, err, "Initialization failed with error %d\n", err); - goto dealloc_host; + return err; } pm_runtime_set_active(dev); pm_runtime_enable(dev); return 0; - -dealloc_host: - ufshcd_dealloc_host(hba); -out: - return err; } EXPORT_SYMBOL_GPL(ufshcd_pltfrm_init); @@ -402,7 +393,6 @@ void ufshcd_pltfrm_remove(struct platform_device *pdev) pm_runtime_get_sync(&pdev->dev); ufshcd_remove(hba); - ufshcd_dealloc_host(hba); pm_runtime_disable(&pdev->dev); pm_runtime_put_noidle(&pdev->dev); } diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h index f66a275bf8cc..1572cc677b8b 100644 --- a/include/ufs/ufshcd.h +++ b/include/ufs/ufshcd.h @@ -1237,7 +1237,6 @@ static inline void ufshcd_rmwl(struct ufs_hba *hba, u32 mask, u32 val, u32 reg) } int ufshcd_alloc_host(struct device *, struct ufs_hba **); -void ufshcd_dealloc_host(struct ufs_hba *); int ufshcd_hba_enable(struct ufs_hba *hba); int ufshcd_init(struct ufs_hba *, void __iomem *, unsigned int); int ufshcd_link_recovery(struct ufs_hba *hba); -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1525/1525] drivers/char/svm.c:366:43: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 28 Mar '25

28 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4d1e247486ffeef035a5a55a97f2659f68177357 commit: 51d0e1a742714b2599d54fd92a71bd2998b01084 [1525/1525] support multiple node for getting phys interface config: arm64-randconfig-r112-20250328 (https://download.01.org/0day-ci/archive/20250328/202503281546.GkxeQtL3-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250328/202503281546.GkxeQtL3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503281546.GkxeQtL3-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/char/svm.c:248:20: sparse: sparse: symbol 'svm_find_mem_reg_node' was not declared. Should it be static? drivers/char/svm.c:325:14: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct svm_va2pa_slot *slot @@ got void [noderef] __iomem * @@ drivers/char/svm.c:325:14: sparse: expected struct svm_va2pa_slot *slot drivers/char/svm.c:325:14: sparse: got void [noderef] __iomem * >> drivers/char/svm.c:366:43: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got struct svm_va2pa_slot *slots @@ drivers/char/svm.c:366:43: sparse: expected void volatile [noderef] __iomem *addr drivers/char/svm.c:366:43: sparse: got struct svm_va2pa_slot *slots drivers/char/svm.c:449:6: sparse: sparse: symbol 'sysrq_sched_debug_show_export' was not declared. Should it be static? drivers/char/svm.c:1272:35: sparse: sparse: Using plain integer as NULL pointer drivers/char/svm.c:248:21: warning: no previous prototype for 'svm_find_mem_reg_node' [-Wmissing-prototypes] 248 | struct device_node *svm_find_mem_reg_node(struct device *dev, const char *compat) | ^~~~~~~~~~~~~~~~~~~~~ drivers/char/svm.c:449:6: warning: no previous prototype for 'sysrq_sched_debug_show_export' [-Wmissing-prototypes] 449 | void sysrq_sched_debug_show_export(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/char/svm.c:1476:5: warning: no previous prototype for 'svm_get_pasid' [-Wmissing-prototypes] 1476 | int svm_get_pasid(pid_t vpid, int dev_id __maybe_unused) | ^~~~~~~~~~~~~ drivers/char/svm.c:2269:36: warning: 'svm_acpi_match' defined but not used [-Wunused-const-variable=] 2269 | static const struct acpi_device_id svm_acpi_match[] = { | ^~~~~~~~~~~~~~ In file included from arch/arm64/include/asm/atomic.h:34, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from include/asm-generic/bug.h:18, from arch/arm64/include/asm/bug.h:37, from arch/arm64/include/asm/memory.h:27, from arch/arm64/include/asm/esr.h:21, from drivers/char/svm.c:10: In function '__cmpxchg_case_mb_4', inlined from '__cmpxchg_mb' at arch/arm64/include/asm/cmpxchg.h:143:1, inlined from 'svm_proc_load_flag' at drivers/char/svm.c:1805:12: arch/arm64/include/asm/atomic_lse.h:492:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'atomic_t[1]' [-Warray-bounds=] 492 | asm volatile( 39- | ^~~ arch/arm64/include/asm/atomic_lse.h:523:1: note: in expansion of macro '__CMPXCHG_CASE' 523 | __CMPXCHG_CASE(w, , mb_4, al, "memory") | ^~~~~~~~~~~~~~ drivers/char/svm.c: In function 'svm_proc_load_flag': drivers/char/svm.c:1796:25: note: object 'l2buf_load_flag' of size 4 1796 | static atomic_t l2buf_load_flag = ATOMIC_INIT(0); | ^~~~~~~~~~~~~~~ In function '__cmpxchg_case_mb_4', inlined from '__cmpxchg_mb' at arch/arm64/include/asm/cmpxchg.h:143:1, inlined from 'svm_proc_load_flag' at drivers/char/svm.c:1805:12: arch/arm64/include/asm/atomic_lse.h:492:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'atomic_t[1]' [-Warray-bounds=] 492 | asm volatile( 52- | ^~~ arch/arm64/include/asm/atomic_lse.h:523:1: note: in expansion of macro '__CMPXCHG_CASE' 523 | __CMPXCHG_CASE(w, , mb_4, al, "memory") | ^~~~~~~~~~~~~~ drivers/char/svm.c: In function 'svm_proc_load_flag': drivers/char/svm.c:1796:25: note: object 'l2buf_load_flag' of size 4 1796 | static atomic_t l2buf_load_flag = ATOMIC_INIT(0); | ^~~~~~~~~~~~~~~ vim +366 drivers/char/svm.c 357 358 static void svm_remove_trunk(struct device *dev) 359 { 360 int count; 361 362 for (count = 0; count < SVM_VA2PA_TRUNK_COUNT_MAX; count++) { 363 if (!va2pa_trunk[count].base) 364 break; 365 > 366 iounmap(va2pa_trunk[count].slots); 367 kvfree(va2pa_trunk[count].bitmap); 368 va2pa_trunk[count].slots = NULL; 369 va2pa_trunk[count].bitmap = NULL; 370 } 371 } 372 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 V1] list: fix a data-race around ep->rdllist
by Zicheng Qu 28 Mar '25

28 Mar '25

From: Kuniyuki Iwashima <kuniyu(a)amazon.co.jp> stable inclusion from stable-v5.15.46 commit 5d5d993f16be15d124be7b8ec71b28ef7b7dc3af category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6RN CVE: CVE-2022-49443 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- [ Upstream commit d679ae94fdd5d3ab00c35078f5af5f37e068b03d ] ep_poll() first calls ep_events_available() with no lock held and checks if ep->rdllist is empty by list_empty_careful(), which reads rdllist->prev. Thus all accesses to it need some protection to avoid store/load-tearing. Note INIT_LIST_HEAD_RCU() already has the annotation for both prev and next. Commit bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") added the first lockless ep_events_available(), and commit c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epoll_wait()") made some ep_events_available() calls lockless and added single call under a lock, finally commit e59d3c64cba6 ("epoll: eliminate unnecessary lock for zero timeout") made the last ep_events_available() lockless. BUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0: INIT_LIST_HEAD include/linux/list.h:38 [inline] list_splice_init include/linux/list.h:492 [inline] ep_start_scan fs/eventpoll.c:622 [inline] ep_send_events fs/eventpoll.c:1656 [inline] ep_poll fs/eventpoll.c:1806 [inline] do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1: list_empty_careful include/linux/list.h:329 [inline] ep_events_available fs/eventpoll.c:381 [inline] ep_poll fs/eventpoll.c:1797 [inline] do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0xffff88810480c7d0 -> 0xffff888103c15098 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G W 5.17.0-rc7-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Link: https://lkml.kernel.org/r/20220322002653.33865-3-kuniyu@amazon.co.jp Fixes: e59d3c64cba6 ("epoll: eliminate unnecessary lock for zero timeout") Fixes: c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epoll_wait()") Fixes: bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.co.jp> Reported-by: syzbot+bdd6e38a1ed5ee58d8bd(a)syzkaller.appspotmail.com Cc: Al Viro <viro(a)zeniv.linux.org.uk>, Andrew Morton <akpm(a)linux-foundation.org> Cc: Kuniyuki Iwashima <kuniyu(a)amazon.co.jp> Cc: Kuniyuki Iwashima <kuni1840(a)gmail.com> Cc: "Soheil Hassas Yeganeh" <soheil(a)google.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: "Sridhar Samudrala" <sridhar.samudrala(a)intel.com> Cc: Alexander Duyck <alexander.h.duyck(a)intel.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: include/linux/list.h [This patch lacks the prerequisite patch for the list_is_head(). Therefore, only keep the current version of "next == head" as is and only modify the READ_ONCE() additions introduced by this patch.] Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- include/linux/list.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/include/linux/list.h b/include/linux/list.h index fa9f691f2553..aab9705902ed 100644 --- a/include/linux/list.h +++ b/include/linux/list.h @@ -33,7 +33,7 @@ static inline void INIT_LIST_HEAD(struct list_head *list) { WRITE_ONCE(list->next, list); - list->prev = list; + WRITE_ONCE(list->prev, list); } #ifdef CONFIG_DEBUG_LIST @@ -296,7 +296,7 @@ static inline int list_empty(const struct list_head *head) static inline void list_del_init_careful(struct list_head *entry) { __list_del_entry(entry); - entry->prev = entry; + WRITE_ONCE(entry->prev, entry); smp_store_release(&entry->next, entry); } @@ -316,7 +316,7 @@ static inline void list_del_init_careful(struct list_head *entry) static inline int list_empty_careful(const struct list_head *head) { struct list_head *next = smp_load_acquire(&head->next); - return (next == head) && (next == head->prev); + return (next == head) && (next == READ_ONCE(head->prev)); } /** -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
by Zicheng Qu 28 Mar '25

28 Mar '25

From: Hangyu Hua <hbh25y(a)gmail.com> stable inclusion from stable-v4.19.247 commit f8cd192752a1f613b14eee77783c6f0aebb49691 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1JW CVE: CVE-2022-49467 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 947a844bb3ebff0f4736d244d792ce129f6700d7 ] drm_gem_object_lookup will call drm_gem_object_get inside. So cursor_bo needs to be put when msm_gem_get_and_pin_iova fails. Fixes: e172d10a9c4a ("drm/msm/mdp5: Add hardware cursor support") Signed-off-by: Hangyu Hua <hbh25y(a)gmail.com> Link: https://lore.kernel.org/r/20220509061125.18585-1-hbh25y@gmail.com Signed-off-by: Rob Clark <robdclark(a)chromium.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c index b1da9ce54379..11d0e810b409 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c @@ -905,8 +905,10 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc, ret = msm_gem_get_iova(cursor_bo, kms->aspace, &mdp5_crtc->cursor.iova); - if (ret) + if (ret) { + drm_gem_object_put(cursor_bo); return -EINVAL; + } pm_runtime_get_sync(&pdev->dev); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
by Zicheng Qu 28 Mar '25

28 Mar '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.247 commit 984cfef0675ed7398814e14af2c5323911723e1c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP43Y CVE: CVE-2022-49481 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit afaa7b933ef00a2d3262f4d1252087613fb5c06d ] of_node_get() returns a node with refcount incremented. Calling of_node_put() to drop the reference when not needed anymore. Fixes: 3784b6d64dc5 ("regulator: pfuze100: add pfuze100 regulator driver") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Link: https://lore.kernel.org/r/20220511113506.45185-1-linmq006@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/regulator/pfuze100-regulator.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c index 69a377ab2604..3248c194624f 100644 --- a/drivers/regulator/pfuze100-regulator.c +++ b/drivers/regulator/pfuze100-regulator.c @@ -495,6 +495,7 @@ static int pfuze_parse_regulators_dt(struct pfuze_chip *chip) parent = of_get_child_by_name(np, "regulators"); if (!parent) { dev_err(dev, "regulators node not found\n"); + of_node_put(np); return -EINVAL; } @@ -524,6 +525,7 @@ static int pfuze_parse_regulators_dt(struct pfuze_chip *chip) } of_node_put(parent); + of_node_put(np); if (ret < 0) { dev_err(dev, "Error parsing regulator init data: %d\n", ret); -- 2.34.1

2 1

[PATCH OLK-5.10 V1] sched/fair: Optimize the dynamic smt
by Cheng Yu 28 Mar '25

28 Mar '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBWWUI CVE: NA -------------------------------- The optimizations are as follows: 1. A more reasonable algorithm for obtaining load values; 2. Limit the maximum value of sysctl_sched_util_ratio to 100; 3. If the value of sysctl_sched_util_ratio is 100, the other smt of the core will not be used. Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- arch/arm64/Kconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 - init/Kconfig | 7 +++++++ kernel/sched/fair.c | 7 +++++-- kernel/sysctl.c | 1 + 5 files changed, 14 insertions(+), 3 deletions(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 2591707024d4..93ced97f8c6c 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -78,6 +78,7 @@ config ARM64 select ARCH_SUPPORTS_ATOMIC_RMW select ARCH_SUPPORTS_INT128 if CC_HAS_INT128 && (GCC_VERSION >= 50000 || CC_IS_CLANG) select ARCH_SUPPORTS_NUMA_BALANCING + select ARCH_SUPPORTS_SCHED_KEEP_ON_CORE select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH select ARCH_WANT_COMPAT_IPC_PARSE_VERSION if COMPAT select ARCH_WANT_DEFAULT_BPF_JIT diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 20bd8ac25791..e008e119e7a4 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -194,7 +194,6 @@ CONFIG_USER_NS=y CONFIG_PID_NS=y CONFIG_NET_NS=y CONFIG_SCHED_STEAL=y -# CONFIG_SCHED_KEEP_ON_CORE is not set CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set diff --git a/init/Kconfig b/init/Kconfig index be284bca406c..3a6a14e66acd 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1370,8 +1370,15 @@ config SCHED_STEAL If unsure, say N here. +# +# For architectures that want to enable the support for SCHED_KEEP_ON_CORE +# +config ARCH_SUPPORTS_SCHED_KEEP_ON_CORE + bool + config SCHED_KEEP_ON_CORE bool "Prefer physical cores when migrating tasks" + depends on ARCH_SUPPORTS_SCHED_KEEP_ON_CORE depends on SCHED_SMT default n help diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index a518d636f07f..5fc8d6a25b9a 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7330,13 +7330,16 @@ static int select_idle_core(struct task_struct *p, int core, struct cpumask *cpu #ifdef CONFIG_SCHED_KEEP_ON_CORE int sysctl_sched_util_ratio = 100; -static int core_has_spare(int cpu) +static bool core_has_spare(int cpu) { int core_id = cpumask_first(cpu_smt_mask(cpu)); struct rq *rq = cpu_rq(core_id); - unsigned long util = rq->cfs.avg.util_avg; + unsigned long util = cpu_util(cpu); unsigned long capacity = rq->cpu_capacity; + if (sysctl_sched_util_ratio == 100) + return true; + return util * 100 < capacity * sysctl_sched_util_ratio; } #endif diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 0d4d83da4b30..b4b36f8a3149 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2828,6 +2828,7 @@ static struct ctl_table kern_table[] = { .mode = 0644, .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, + .extra2 = &one_hundred, }, #endif #ifdef CONFIG_SCHED_STEAL -- 2.25.1

2 1

[PATCH OLK-5.10] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Radu Rendec <rrendec(a)redhat.com> stable inclusion from stable-v5.10.235 commit e4fde33107351ec33f1a64188612fbc6ca659284 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBPC4K CVE: CVE-2025-21785 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2 ] The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level). Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information") Signed-off-by: Radu Rendec <rrendec(a)redhat.com> Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 97c42be71338..1510f457b615 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -87,16 +87,18 @@ int populate_cache_leaves(unsigned int cpu) unsigned int level, idx; enum cache_type type; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf = this_cpu_ci->info_list; + struct cacheinfo *infos = this_cpu_ci->info_list; for (idx = 0, level = 1; level <= this_cpu_ci->num_levels && - idx < this_cpu_ci->num_leaves; idx++, level++) { + idx < this_cpu_ci->num_leaves; level++) { type = get_cache_type(level); if (type == CACHE_TYPE_SEPARATE) { - ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); - ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); + if (idx + 1 >= this_cpu_ci->num_leaves) + break; + ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level); + ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level); } else { - ci_leaf_init(this_leaf++, type, level); + ci_leaf_init(&infos[idx++], type, level); } } return 0; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Radu Rendec <rrendec(a)redhat.com> stable inclusion from stable-v5.10.235 commit e4fde33107351ec33f1a64188612fbc6ca659284 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4K CVE: CVE-2025-21785 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2 ] The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level). Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information") Signed-off-by: Radu Rendec <rrendec(a)redhat.com> Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 0c0cd4d26b87..80a4ab1c43fd 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -96,16 +96,18 @@ static int __populate_cache_leaves(unsigned int cpu) unsigned int level, idx; enum cache_type type; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf = this_cpu_ci->info_list; + struct cacheinfo *infos = this_cpu_ci->info_list; for (idx = 0, level = 1; level <= this_cpu_ci->num_levels && - idx < this_cpu_ci->num_leaves; idx++, level++) { + idx < this_cpu_ci->num_leaves; level++) { type = get_cache_type(level); if (type == CACHE_TYPE_SEPARATE) { - ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); - ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); + if (idx + 1 >= this_cpu_ci->num_leaves) + break; + ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level); + ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level); } else { - ci_leaf_init(this_leaf++, type, level); + ci_leaf_init(&infos[idx++], type, level); } } return 0; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] PM / devfreq: rk3399_dmc: Disable edev on remove()
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Brian Norris <briannorris(a)chromium.org> stable inclusion from stable-v4.19.247 commit 664736e2cc09e504ce58ec61164d029d1f2651bb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6Y5 CVE: CVE-2022-49460 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2fccf9e6050e0e3b8b4cd275d41daf7f7fa22804 ] Otherwise we hit an unablanced enable-count when unbinding the DFI device: [ 1279.659119] ------------[ cut here ]------------ [ 1279.659179] WARNING: CPU: 2 PID: 5638 at drivers/devfreq/devfreq-event.c:360 devfreq_event_remove_edev+0x84/0x8c ... [ 1279.659352] Hardware name: Google Kevin (DT) [ 1279.659363] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO BTYPE=--) [ 1279.659371] pc : devfreq_event_remove_edev+0x84/0x8c [ 1279.659380] lr : devm_devfreq_event_release+0x1c/0x28 ... [ 1279.659571] Call trace: [ 1279.659582] devfreq_event_remove_edev+0x84/0x8c [ 1279.659590] devm_devfreq_event_release+0x1c/0x28 [ 1279.659602] release_nodes+0x1cc/0x244 [ 1279.659611] devres_release_all+0x44/0x60 [ 1279.659621] device_release_driver_internal+0x11c/0x1ac [ 1279.659629] device_driver_detach+0x20/0x2c [ 1279.659641] unbind_store+0x7c/0xb0 [ 1279.659650] drv_attr_store+0x2c/0x40 [ 1279.659663] sysfs_kf_write+0x44/0x58 [ 1279.659672] kernfs_fop_write_iter+0xf4/0x190 [ 1279.659684] vfs_write+0x2b0/0x2e4 [ 1279.659693] ksys_write+0x80/0xec [ 1279.659701] __arm64_sys_write+0x24/0x30 [ 1279.659714] el0_svc_common+0xf0/0x1d8 [ 1279.659724] do_el0_svc_compat+0x28/0x3c [ 1279.659738] el0_svc_compat+0x10/0x1c [ 1279.659746] el0_sync_compat_handler+0xa8/0xcc [ 1279.659758] el0_sync_compat+0x188/0x1c0 [ 1279.659768] ---[ end trace cec200e5094155b4 ]--- Signed-off-by: Brian Norris <briannorris(a)chromium.org> Signed-off-by: Chanwoo Choi <cw00.choi(a)samsung.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/devfreq/rk3399_dmc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/devfreq/rk3399_dmc.c b/drivers/devfreq/rk3399_dmc.c index e795ad2b3f6b..eefda6edc89c 100644 --- a/drivers/devfreq/rk3399_dmc.c +++ b/drivers/devfreq/rk3399_dmc.c @@ -411,6 +411,8 @@ static int rk3399_dmcfreq_remove(struct platform_device *pdev) { struct rk3399_dmcfreq *dmcfreq = dev_get_drvdata(&pdev->dev); + devfreq_event_disable_edev(dmcfreq->edev); + /* * Before remove the opp table we need to unregister the opp notifier. */ -- 2.43.0

2 1

[PATCH OLK-6.6] ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
by Yifan Qiao 28 Mar '25

28 Mar '25

From: Vasiliy Kovalev <kovalev(a)altlinux.org> mainline inclusion from mainline-v6.14-rc5 commit c84e125fff2615b4d9c259e762596134eddd2f27 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVT6 CVE: CVE-2025-21887 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still accessed in ovl_dentry_remote(). Move dput(upper) after its last use to prevent use-after-free. BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline] BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 ovl_dentry_remote fs/overlayfs/util.c:162 [inline] ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 ovl_link_up fs/overlayfs/copy_up.c:610 [inline] ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223 ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136 vfs_rename+0xf84/0x20a0 fs/namei.c:4893 ... </TASK> Fixes: b07d5cc93e1b ("ovl: update of dentry revalidate flags after copy up") Reported-by: syzbot+316db8a1191938280eb6(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=316db8a1191938280eb6 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Link: https://lore.kernel.org/r/20250214215148.761147-1-kovalev@altlinux.org Reviewed-by: Amir Goldstein <amir73il(a)gmail.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/overlayfs/copy_up.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c index 18e018cb1811..dbf7b3cd70ca 100644 --- a/fs/overlayfs/copy_up.c +++ b/fs/overlayfs/copy_up.c @@ -570,7 +570,6 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) err = PTR_ERR(upper); if (!IS_ERR(upper)) { err = ovl_do_link(ofs, ovl_dentry_upper(c->dentry), udir, upper); - dput(upper); if (!err) { /* Restore timestamps on parent (best effort) */ @@ -578,6 +577,7 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) ovl_dentry_set_upper_alias(c->dentry); ovl_dentry_update_reval(c->dentry, upper); } + dput(upper); } inode_unlock(udir); if (err) -- 2.39.2

2 1

[PATCH OLK-5.10] ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
by Yifan Qiao 28 Mar '25

28 Mar '25

From: Vasiliy Kovalev <kovalev(a)altlinux.org> mainline inclusion from mainline-v6.14-rc5 commit c84e125fff2615b4d9c259e762596134eddd2f27 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVT6 CVE: CVE-2025-21887 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still accessed in ovl_dentry_remote(). Move dput(upper) after its last use to prevent use-after-free. BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline] BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 ovl_dentry_remote fs/overlayfs/util.c:162 [inline] ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 ovl_link_up fs/overlayfs/copy_up.c:610 [inline] ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223 ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136 vfs_rename+0xf84/0x20a0 fs/namei.c:4893 ... </TASK> Fixes: b07d5cc93e1b ("ovl: update of dentry revalidate flags after copy up") Reported-by: syzbot+316db8a1191938280eb6(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=316db8a1191938280eb6 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Link: https://lore.kernel.org/r/20250214215148.761147-1-kovalev@altlinux.org Reviewed-by: Amir Goldstein <amir73il(a)gmail.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/overlayfs/copy_up.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c index 65ac504595ba..a1ec45fc77d8 100644 --- a/fs/overlayfs/copy_up.c +++ b/fs/overlayfs/copy_up.c @@ -469,7 +469,6 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) err = PTR_ERR(upper); if (!IS_ERR(upper)) { err = ovl_do_link(ovl_dentry_upper(c->dentry), udir, upper); - dput(upper); if (!err) { /* Restore timestamps on parent (best effort) */ @@ -477,6 +476,7 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) ovl_dentry_set_upper_alias(c->dentry); ovl_dentry_update_reval(c->dentry, upper); } + dput(upper); } inode_unlock(udir); if (err) -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 1525/1525] drivers/char/svm.c:249:20: sparse: sparse: symbol 'svm_find_mem_reg_node' was not declared. Should it be static?
by kernel test robot 28 Mar '25

28 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3f8283040b83a49bdad8dc3dd4ccd3f50910af28 commit: 9469d1759c2905dcef49df7e6240ad5c32b66296 [1525/1525] ascend: share_pool: enable svm to use share pool memory config: arm64-randconfig-r112-20250328 (https://download.01.org/0day-ci/archive/20250328/202503281257.212dRYe6-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250328/202503281257.212dRYe6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503281257.212dRYe6-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/char/svm.c:240:24: sparse: sparse: symbol 'va2pa_trunk' was not declared. Should it be static? >> drivers/char/svm.c:249:20: sparse: sparse: symbol 'svm_find_mem_reg_node' was not declared. Should it be static? >> drivers/char/svm.c:320:14: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct svm_va2pa_slot *slot @@ got void [noderef] __iomem * @@ drivers/char/svm.c:320:14: sparse: expected struct svm_va2pa_slot *slot drivers/char/svm.c:320:14: sparse: got void [noderef] __iomem * drivers/char/svm.c:338:28: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got struct svm_va2pa_slot *[addressable] [assigned] [toplevel] slots @@ drivers/char/svm.c:338:28: sparse: expected void volatile [noderef] __iomem *addr drivers/char/svm.c:338:28: sparse: got struct svm_va2pa_slot *[addressable] [assigned] [toplevel] slots drivers/char/svm.c:419:6: sparse: sparse: symbol 'sysrq_sched_debug_show_export' was not declared. Should it be static? drivers/char/svm.c:1242:35: sparse: sparse: Using plain integer as NULL pointer drivers/char/svm.c:1502:5: sparse: sparse: symbol '__svm_get_mpam' was not declared. Should it be static? drivers/char/svm.c:249:21: warning: no previous prototype for 'svm_find_mem_reg_node' [-Wmissing-prototypes] 249 | struct device_node *svm_find_mem_reg_node(struct device *dev, const char *compat) | ^~~~~~~~~~~~~~~~~~~~~ drivers/char/svm.c:419:6: warning: no previous prototype for 'sysrq_sched_debug_show_export' [-Wmissing-prototypes] 419 | void sysrq_sched_debug_show_export(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/char/svm.c:1429:5: warning: no previous prototype for 'svm_get_pasid' [-Wmissing-prototypes] 1429 | int svm_get_pasid(pid_t vpid, int dev_id __maybe_unused) | ^~~~~~~~~~~~~ drivers/char/svm.c:1502:5: warning: no previous prototype for '__svm_get_mpam' [-Wmissing-prototypes] 1502 | int __svm_get_mpam(struct svm_mpam *mpam) | ^~~~~~~~~~~~~~ drivers/char/svm.c:2437:36: warning: 'svm_acpi_match' defined but not used [-Wunused-const-variable=] 2437 | static const struct acpi_device_id svm_acpi_match[] = { | ^~~~~~~~~~~~~~ In file included from arch/arm64/include/asm/atomic.h:34, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from include/asm-generic/bug.h:18, from arch/arm64/include/asm/bug.h:37, from arch/arm64/include/asm/memory.h:27, from arch/arm64/include/asm/esr.h:21, from drivers/char/svm.c:10: In function '__cmpxchg_case_mb_4', inlined from '__cmpxchg_mb' at arch/arm64/include/asm/cmpxchg.h:143:1, inlined from 'svm_proc_load_flag' at drivers/char/svm.c:1967:12: arch/arm64/include/asm/atomic_lse.h:492:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'atomic_t[1]' [-Warray-bounds=] 492 | asm volatile( 44- | ^~~ arch/arm64/include/asm/atomic_lse.h:523:1: note: in expansion of macro '__CMPXCHG_CASE' 523 | __CMPXCHG_CASE(w, , mb_4, al, "memory") | ^~~~~~~~~~~~~~ drivers/char/svm.c: In function 'svm_proc_load_flag': drivers/char/svm.c:1958:25: note: object 'l2buf_load_flag' of size 4 1958 | static atomic_t l2buf_load_flag = ATOMIC_INIT(0); | ^~~~~~~~~~~~~~~ In function '__cmpxchg_case_mb_4', inlined from '__cmpxchg_mb' at arch/arm64/include/asm/cmpxchg.h:143:1, inlined from 'svm_proc_load_flag' at drivers/char/svm.c:1967:12: arch/arm64/include/asm/atomic_lse.h:492:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'atomic_t[1]' [-Warray-bounds=] 492 | asm volatile( 57- | ^~~ arch/arm64/include/asm/atomic_lse.h:523:1: note: in expansion of macro '__CMPXCHG_CASE' 523 | __CMPXCHG_CASE(w, , mb_4, al, "memory") | ^~~~~~~~~~~~~~ drivers/char/svm.c: In function 'svm_proc_load_flag': drivers/char/svm.c:1958:25: note: object 'l2buf_load_flag' of size 4 1958 | static atomic_t l2buf_load_flag = ATOMIC_INIT(0); | ^~~~~~~~~~~~~~~ vim +/svm_find_mem_reg_node +249 drivers/char/svm.c 248 > 249 struct device_node *svm_find_mem_reg_node(struct device *dev, const char *compat) 250 { 251 int index = 0; 252 struct device_node *tmp = NULL; 253 struct device_node *np = dev->of_node; 254 255 for (; ; index++) { 256 tmp = of_parse_phandle(np, "memory-region", index); 257 if (!tmp) 258 break; 259 260 if (of_device_is_compatible(tmp, compat)) 261 return tmp; 262 263 of_node_put(tmp); 264 } 265 266 return NULL; 267 } 268 269 static int svm_parse_trunk_memory(struct device *dev, phys_addr_t *base, unsigned long *size) 270 { 271 int err; 272 struct resource r; 273 struct device_node *trunk = NULL; 274 275 trunk = svm_find_mem_reg_node(dev, SVM_MEM_REG); 276 if (!trunk) { 277 dev_err(dev, "Didn't find reserved memory\n"); 278 return -EINVAL; 279 } 280 281 err = of_address_to_resource(trunk, 0, &r); 282 of_node_put(trunk); 283 if (err) { 284 dev_err(dev, "Couldn't address to resource for reserved memory\n"); 285 return -ENOMEM; 286 } 287 288 *base = r.start; 289 *size = resource_size(&r); 290 291 return 0; 292 } 293 294 static int svm_setup_trunk(struct device *dev, phys_addr_t base, unsigned long size) 295 { 296 int slot_total; 297 unsigned long *bitmap = NULL; 298 struct svm_va2pa_slot *slot = NULL; 299 300 if (!IS_ALIGNED(base, SVM_VA2PA_MEMORY_ALIGN)) { 301 dev_err(dev, "Didn't aligned to %u\n", SVM_VA2PA_MEMORY_ALIGN); 302 return -EINVAL; 303 } 304 305 if ((size == 0) || (size > SVM_VA2PA_TRUNK_SIZE_MAX)) { 306 dev_err(dev, "Size of reserved memory is not right\n"); 307 return -EINVAL; 308 } 309 310 slot_total = size / SVM_VA2PA_SLOT_SIZE; 311 if (slot_total < BITS_PER_LONG) 312 return -EINVAL; 313 314 bitmap = kvcalloc(slot_total / BITS_PER_LONG, sizeof(unsigned long), GFP_KERNEL); 315 if (!bitmap) { 316 dev_err(dev, "alloc memory failed\n"); 317 return -ENOMEM; 318 } 319 > 320 slot = ioremap(base, size); 321 if (!slot) { 322 kvfree(bitmap); 323 dev_err(dev, "Ioremap trunk failed\n"); 324 return -ENXIO; 325 } 326 327 va2pa_trunk.slots = slot; 328 va2pa_trunk.slot_used = 0; 329 va2pa_trunk.slot_total = slot_total; 330 va2pa_trunk.bitmap = bitmap; 331 mutex_init(&va2pa_trunk.mutex); 332 333 return 0; 334 } 335 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

Kernel SIG双周例会
by openEuler conference 28 Mar '25

28 Mar '25

您好！ Kernel 邀请您参加 2025-03-28 14:00 召开的WeLink会议(自动录制) 会议主题：Kernel SIG双周例会会议链接：https://meeting.huaweicloud.com:36443/#/j/964258324 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2025-03-28 14:00, The subject of the conference is Kernel SIG双周例会 You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/964258324 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[openeuler:OLK-6.6] BUILD REGRESSION b28aab59b06935f0d1c9bce8f013f25b4094764d
by kernel test robot 28 Mar '25

28 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: b28aab59b06935f0d1c9bce8f013f25b4094764d !15593 io_uring: prevent opcode speculation Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503280313.olFyEFIT-lkp@intel.com https://lore.kernel.org/oe-kbuild/202503271832.WycjTkRa-lkp@intel.com clang: warning: -Wl,-soname=linux-ilp32-vdso.so.1: 'linker' input unused [-Wunused-command-line-argument] error: unknown target ABI 'ilp32' Unverified Error/Warning (likely false positive, kindly check if interested): drivers/hid/hid-thrustmaster.c:178 thrustmaster_interrupts() warn: possible memory leak of 'send_buf' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-virtcca_get_tmi_version | |-- drivers-coda-coda_pci.c:warning:Excess-function-parameter-pdev-description-in-virtcca_pci_get_rom_size | |-- drivers-coda-coda_pci.c:warning:Function-parameter-or-member-p-not-described-in-virtcca_pci_get_rom_size | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-defconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-002-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-003-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-004-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-r112-20250328 | |-- clang:warning:Wl-soname-linux-ilp32-vdso.so.:linker-input-unused | `-- error:unknown-target-ABI-ilp32 |-- loongarch-allmodconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allnoconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allyesconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-defconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-002-20250327 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-r061-20250327 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allyesconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250327 | |-- drivers-gpu-drm-sti-sti_dvo.c:error:implicit-declaration-of-function-devm_ioremap | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250327 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size |-- x86_64-randconfig-101-20250328 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-102-20250328 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-103-20250328 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-104-20250328 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-121-20250328 | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-122-20250328 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-123-20250328 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-161-20250326 | `-- drivers-hid-hid-thrustmaster.c-thrustmaster_interrupts()-warn:possible-memory-leak-of-send_buf `-- x86_64-randconfig-161-20250327 `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used elapsed time: 1448m configs tested: 21 configs skipped: 124 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250327 gcc-5.5.0 arm64 randconfig-002-20250327 clang-21 arm64 randconfig-003-20250327 clang-21 arm64 randconfig-004-20250327 clang-21 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250327 gcc-14.2.0 loongarch randconfig-002-20250327 gcc-14.2.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250327 gcc-12 x86_64 buildonly-randconfig-002-20250327 gcc-12 x86_64 buildonly-randconfig-003-20250327 clang-20 x86_64 buildonly-randconfig-004-20250327 clang-20 x86_64 buildonly-randconfig-005-20250327 gcc-12 x86_64 buildonly-randconfig-006-20250327 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Radu Rendec <rrendec(a)redhat.com> stable inclusion from stable-v5.10.235 commit e4fde33107351ec33f1a64188612fbc6ca659284 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4K CVE: CVE-2025-21785 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2 ] The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level). Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information") Signed-off-by: Radu Rendec <rrendec(a)redhat.com> Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 0c0cd4d26b87..80a4ab1c43fd 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -96,16 +96,18 @@ static int __populate_cache_leaves(unsigned int cpu) unsigned int level, idx; enum cache_type type; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf = this_cpu_ci->info_list; + struct cacheinfo *infos = this_cpu_ci->info_list; for (idx = 0, level = 1; level <= this_cpu_ci->num_levels && - idx < this_cpu_ci->num_leaves; idx++, level++) { + idx < this_cpu_ci->num_leaves; level++) { type = get_cache_type(level); if (type == CACHE_TYPE_SEPARATE) { - ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); - ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); + if (idx + 1 >= this_cpu_ci->num_leaves) + break; + ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level); + ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level); } else { - ci_leaf_init(this_leaf++, type, level); + ci_leaf_init(&infos[idx++], type, level); } } return 0; -- 2.43.0

2 1

[PATCH OLK-5.10] arm64: mm: add mc support for __buffer_migrate_page
by Wupeng Ma 28 Mar '25

28 Mar '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB0OV7 -------------------------------- During our test, panic happens when kernel try to read a user page in __buffer_migrate_page with the following trace: Internal error: synchronous external abort: ffffffff96000410 [#1] SMP pstate: 00401009 (nzcv daif +PAN -UAO -TCO BTYPE=--) pc : copy_page+0x40/0xbc lr : copy_highpage+0x3c/0x60 sp : ffff8040de1caec0 Call trace: copy_page+0x40/0xbc migrate_page_copy+0x44/0xd0 __buffer_migrate_page.part.0+0x288/0x3f0 buffer_migrate_page+0x28/0x60 move_to_new_page+0x68/0x274 __unmap_and_move+0x424/0x574 unmap_and_move+0x84/0x67c migrate_pages+0x160/0x540 compact_zone+0x1d8/0x5b4 compact_zone_order+0xa4/0xfc try_to_compact_pages+0xb0/0x2a0 __alloc_pages_direct_compact+0x9c/0x210 __alloc_pages+0x844/0x1214 alloc_pages_vma+0x388/0x3e0 do_huge_pmd_anonymous_page+0x170/0x574 __handle_mm_fault+0x374/0x3ac handle_mm_fault+0xf4/0x260 __get_user_pages+0x218/0x42c __gup_longterm_locked+0x94/0x2c0 internal_get_user_pages_fast+0x140/0x240 pin_user_pages_fast+0x24/0x50 __ib_umem_get.part.0+0x22c/0x4e0 [ib_uverbs] ib_umem_get+0x90/0xc0 [ib_uverbs] hns_roce_mtr_create+0x78/0x334 [hns_roce_hw_v2] alloc_mr_pbl+0xe4/0x18c [hns_roce_hw_v2] hns_roce_reg_user_mr+0xf4/0x1a0 [hns_roce_hw_v2] ib_uverbs_reg_mr+0x120/0x2c0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xe4/0x180 [ib_uverbs] ib_uverbs_run_method+0x33c/0x3d4 [ib_uverbs] ib_uverbs_cmd_verbs+0x128/0x1dc [ib_uverbs] ib_uverbs_ioctl+0xfc/0x1d0 [ib_uverbs] __arm64_sys_ioctl+0xb0/0x110 invoke_syscall+0x50/0x134 el0_svc_common.constprop.0+0x10c/0x12c do_el0_svc+0x34/0xe0 el0_svc+0x20/0x30 el0_sync_handler+0xb8/0xc0 el0_sync+0x160/0x180 Code: 91020021 f2402c1f d503201f a8300c02 (a9400c22) ---[ end trace ccd629679fc3e8d1 ]--- To fix this, Use migrate_page_mc_extra to replace migrate_page_copy in __buffer_migrate_page to add mc support for this function. Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/migrate.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/mm/migrate.c b/mm/migrate.c index cf8c05ea821e..0d79382f9697 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -820,6 +820,7 @@ static int __buffer_migrate_page(struct address_space *mapping, struct buffer_head *bh, *head; int rc; int expected_count; + bool copy_done = false; if (!page_has_buffers(page)) return migrate_page(mapping, newpage, page, mode); @@ -860,7 +861,13 @@ static int __buffer_migrate_page(struct address_space *mapping, } } - rc = migrate_page_move_mapping(mapping, newpage, page, 0); + if (IS_ENABLED(CONFIG_ARM64) && IS_ENABLED(CONFIG_ARCH_HAS_COPY_MC) && + (mode != MIGRATE_SYNC_NO_COPY)) { + rc = migrate_page_mc_extra(mapping, newpage, page, mode, 0); + copy_done = true; + } else { + rc = migrate_page_move_mapping(mapping, newpage, page, 0); + } if (rc != MIGRATEPAGE_SUCCESS) goto unlock_buffers; @@ -873,6 +880,9 @@ static int __buffer_migrate_page(struct address_space *mapping, } while (bh != head); + if (copy_done) + goto unlock_buffers; + if (mode != MIGRATE_SYNC_NO_COPY) migrate_page_copy(newpage, page); else -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Radu Rendec <rrendec(a)redhat.com> stable inclusion from stable-v5.10.235 commit e4fde33107351ec33f1a64188612fbc6ca659284 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4K CVE: CVE-2025-21785 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2 ] The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level). Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information") Signed-off-by: Radu Rendec <rrendec(a)redhat.com> Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 0c0cd4d26b87..80a4ab1c43fd 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -96,16 +96,18 @@ static int __populate_cache_leaves(unsigned int cpu) unsigned int level, idx; enum cache_type type; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf = this_cpu_ci->info_list; + struct cacheinfo *infos = this_cpu_ci->info_list; for (idx = 0, level = 1; level <= this_cpu_ci->num_levels && - idx < this_cpu_ci->num_leaves; idx++, level++) { + idx < this_cpu_ci->num_leaves; level++) { type = get_cache_type(level); if (type == CACHE_TYPE_SEPARATE) { - ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); - ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); + if (idx + 1 >= this_cpu_ci->num_leaves) + break; + ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level); + ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level); } else { - ci_leaf_init(this_leaf++, type, level); + ci_leaf_init(&infos[idx++], type, level); } } return 0; -- 2.43.0

2 1

[PATCH OLK-5.10] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Radu Rendec <rrendec(a)redhat.com> [ Upstream commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2 ] The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level). Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information") Signed-off-by: Radu Rendec <rrendec(a)redhat.com> Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 97c42be71338..1510f457b615 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -87,16 +87,18 @@ int populate_cache_leaves(unsigned int cpu) unsigned int level, idx; enum cache_type type; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf = this_cpu_ci->info_list; + struct cacheinfo *infos = this_cpu_ci->info_list; for (idx = 0, level = 1; level <= this_cpu_ci->num_levels && - idx < this_cpu_ci->num_leaves; idx++, level++) { + idx < this_cpu_ci->num_leaves; level++) { type = get_cache_type(level); if (type == CACHE_TYPE_SEPARATE) { - ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); - ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); + if (idx + 1 >= this_cpu_ci->num_leaves) + break; + ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level); + ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level); } else { - ci_leaf_init(this_leaf++, type, level); + ci_leaf_init(&infos[idx++], type, level); } } return 0; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] PM / devfreq: rk3399_dmc: Disable edev on remove()
by Wupeng Ma 28 Mar '25

28 Mar '25

From: Brian Norris <briannorris(a)chromium.org> stable inclusion from stable-v4.19.247 commit 664736e2cc09e504ce58ec61164d029d1f2651bb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6Y5 CVE: CVE-2022-49460 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2fccf9e6050e0e3b8b4cd275d41daf7f7fa22804 ] Otherwise we hit an unablanced enable-count when unbinding the DFI device: [ 1279.659119] ------------[ cut here ]------------ [ 1279.659179] WARNING: CPU: 2 PID: 5638 at drivers/devfreq/devfreq-event.c:360 devfreq_event_remove_edev+0x84/0x8c ... [ 1279.659352] Hardware name: Google Kevin (DT) [ 1279.659363] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO BTYPE=--) [ 1279.659371] pc : devfreq_event_remove_edev+0x84/0x8c [ 1279.659380] lr : devm_devfreq_event_release+0x1c/0x28 ... [ 1279.659571] Call trace: [ 1279.659582] devfreq_event_remove_edev+0x84/0x8c [ 1279.659590] devm_devfreq_event_release+0x1c/0x28 [ 1279.659602] release_nodes+0x1cc/0x244 [ 1279.659611] devres_release_all+0x44/0x60 [ 1279.659621] device_release_driver_internal+0x11c/0x1ac [ 1279.659629] device_driver_detach+0x20/0x2c [ 1279.659641] unbind_store+0x7c/0xb0 [ 1279.659650] drv_attr_store+0x2c/0x40 [ 1279.659663] sysfs_kf_write+0x44/0x58 [ 1279.659672] kernfs_fop_write_iter+0xf4/0x190 [ 1279.659684] vfs_write+0x2b0/0x2e4 [ 1279.659693] ksys_write+0x80/0xec [ 1279.659701] __arm64_sys_write+0x24/0x30 [ 1279.659714] el0_svc_common+0xf0/0x1d8 [ 1279.659724] do_el0_svc_compat+0x28/0x3c [ 1279.659738] el0_svc_compat+0x10/0x1c [ 1279.659746] el0_sync_compat_handler+0xa8/0xcc [ 1279.659758] el0_sync_compat+0x188/0x1c0 [ 1279.659768] ---[ end trace cec200e5094155b4 ]--- Signed-off-by: Brian Norris <briannorris(a)chromium.org> Signed-off-by: Chanwoo Choi <cw00.choi(a)samsung.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/devfreq/rk3399_dmc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/devfreq/rk3399_dmc.c b/drivers/devfreq/rk3399_dmc.c index e795ad2b3f6b..eefda6edc89c 100644 --- a/drivers/devfreq/rk3399_dmc.c +++ b/drivers/devfreq/rk3399_dmc.c @@ -411,6 +411,8 @@ static int rk3399_dmcfreq_remove(struct platform_device *pdev) { struct rk3399_dmcfreq *dmcfreq = dev_get_drvdata(&pdev->dev); + devfreq_event_disable_edev(dmcfreq->edev); + /* * Before remove the opp table we need to unregister the opp notifier. */ -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2024-57976
by Zizhi Wo 28 Mar '25

28 Mar '25

*** BLURB HERE *** Naohiro Aota (1): btrfs: zoned: fix extent range end unlock in cow_file_range() Qu Wenruo (1): btrfs: do proper folio cleanup when cow_file_range() failed fs/btrfs/inode.c | 63 ++++++++++++++++++++++++++---------------------- 1 file changed, 34 insertions(+), 29 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 1/2] btrfs: do proper folio cleanup when cow_file_range() failed
by Zizhi Wo 28 Mar '25

28 Mar '25

From: Qu Wenruo <wqu(a)suse.com> stable inclusion from stable-v6.13.2 commit 692cf71173bb41395c855acbbbe197d3aedfa5d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBJV CVE: CVE-2024-57976 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 06f364284794f149d2abc167c11d556cf20c954b upstream. [BUG] When testing with COW fixup marked as BUG_ON() (this is involved with the new pin_user_pages*() change, which should not result new out-of-band dirty pages), I hit a crash triggered by the BUG_ON() from hitting COW fixup path. This BUG_ON() happens just after a failed btrfs_run_delalloc_range(): BTRFS error (device dm-2): failed to run delalloc range, root 348 ino 405 folio 65536 submit_bitmap 6-15 start 90112 len 106496: -28 ------------[ cut here ]------------ kernel BUG at fs/btrfs/extent_io.c:1444! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 0 UID: 0 PID: 434621 Comm: kworker/u24:8 Tainted: G OE 6.12.0-rc7-custom+ #86 Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs] pc : extent_writepage_io+0x2d4/0x308 [btrfs] lr : extent_writepage_io+0x2d4/0x308 [btrfs] Call trace: extent_writepage_io+0x2d4/0x308 [btrfs] extent_writepage+0x218/0x330 [btrfs] extent_write_cache_pages+0x1d4/0x4b0 [btrfs] btrfs_writepages+0x94/0x150 [btrfs] do_writepages+0x74/0x190 filemap_fdatawrite_wbc+0x88/0xc8 start_delalloc_inodes+0x180/0x3b0 [btrfs] btrfs_start_delalloc_roots+0x174/0x280 [btrfs] shrink_delalloc+0x114/0x280 [btrfs] flush_space+0x250/0x2f8 [btrfs] btrfs_async_reclaim_data_space+0x180/0x228 [btrfs] process_one_work+0x164/0x408 worker_thread+0x25c/0x388 kthread+0x100/0x118 ret_from_fork+0x10/0x20 Code: aa1403e1 9402f3ef aa1403e0 9402f36f (d4210000) ---[ end trace 0000000000000000 ]--- [CAUSE] That failure is mostly from cow_file_range(), where we can hit -ENOSPC. Although the -ENOSPC is already a bug related to our space reservation code, let's just focus on the error handling. For example, we have the following dirty range [0, 64K) of an inode, with 4K sector size and 4K page size: 0 16K 32K 48K 64K |///////////////////////////////////////| |#######################################| Where |///| means page are still dirty, and |###| means the extent io tree has EXTENT_DELALLOC flag. - Enter extent_writepage() for page 0 - Enter btrfs_run_delalloc_range() for range [0, 64K) - Enter cow_file_range() for range [0, 64K) - Function btrfs_reserve_extent() only reserved one 16K extent So we created extent map and ordered extent for range [0, 16K) 0 16K 32K 48K 64K |////////|//////////////////////////////| |<- OE ->|##############################| And range [0, 16K) has its delalloc flag cleared. But since we haven't yet submit any bio, involved 4 pages are still dirty. - Function btrfs_reserve_extent() returns with -ENOSPC Now we have to run error cleanup, which will clear all EXTENT_DELALLOC* flags and clear the dirty flags for the remaining ranges: 0 16K 32K 48K 64K |////////| | | | | Note that range [0, 16K) still has its pages dirty. - Some time later, writeback is triggered again for the range [0, 16K) since the page range still has dirty flags. - btrfs_run_delalloc_range() will do nothing because there is no EXTENT_DELALLOC flag. - extent_writepage_io() finds page 0 has no ordered flag Which falls into the COW fixup path, triggering the BUG_ON(). Unfortunately this error handling bug dates back to the introduction of btrfs. Thankfully with the abuse of COW fixup, at least it won't crash the kernel. [FIX] Instead of immediately unlocking the extent and folios, we keep the extent and folios locked until either erroring out or the whole delalloc range finished. When the whole delalloc range finished without error, we just unlock the whole range with PAGE_SET_ORDERED (and PAGE_UNLOCK for !keep_locked cases), with EXTENT_DELALLOC and EXTENT_LOCKED cleared. And the involved folios will be properly submitted, with their dirty flags cleared during submission. For the error path, it will be a little more complex: - The range with ordered extent allocated (range (1)) We only clear the EXTENT_DELALLOC and EXTENT_LOCKED, as the remaining flags are cleaned up by btrfs_mark_ordered_io_finished()->btrfs_finish_one_ordered(). For folios we finish the IO (clear dirty, start writeback and immediately finish the writeback) and unlock the folios. - The range with reserved extent but no ordered extent (range(2)) - The range we never touched (range(3)) For both range (2) and range(3) the behavior is not changed. Now even if cow_file_range() failed halfway with some successfully reserved extents/ordered extents, we will keep all folios clean, so there will be no future writeback triggered on them. CC: stable(a)vger.kernel.org Fixes: 524272607e88 ("btrfs: Handle delalloc error correctly to avoid ordered extent hang") Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/btrfs/inode.c [Some context conflicts are encountered when adapting: 1. ram_size -> cur_size: 5599f39356c6 ("btrfs: simplify range tracking in cow_file_range()"), just simplify the process and do not affect the logic. 2. There is no lock_extent related code: 0ab540995ae0 ("btrfs: push lock_extent into cow_file_range_inline")\a0766d8f35d8 ("btrfs: push extent lock into cow_file_range"), this is to narrow the scope of lock, but does not affect this patch. 3. extent_clear_unlock_delalloc() missed a parameter named "cached": 6b0a63a4fa31 ("btrfs: add a cached state to extent_clear_unlock_delalloc"), does not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/btrfs/inode.c | 54 ++++++++++++++++++++++++------------------------ 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 71902110c2fe..862cc8703bf0 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -1356,6 +1356,17 @@ static noinline int cow_file_range(struct btrfs_inode *inode, alloc_hint = get_extent_allocation_hint(inode, start, num_bytes); + /* + * We're not doing compressed IO, don't unlock the first page (which + * the caller expects to stay locked), don't clear any dirty bits and + * don't set any writeback bits. + * + * Do set the Ordered (Private2) bit so we know this page was properly + * setup for writepage. + */ + page_ops = (keep_locked ? 0 : PAGE_UNLOCK); + page_ops |= PAGE_SET_ORDERED; + /* * Relocation relies on the relocated extents to have exactly the same * size as the original extents. Normally writeback for relocation data @@ -1456,21 +1467,6 @@ static noinline int cow_file_range(struct btrfs_inode *inode, btrfs_dec_block_group_reservations(fs_info, ins.objectid); - /* - * We're not doing compressed IO, don't unlock the first page - * (which the caller expects to stay locked), don't clear any - * dirty bits and don't set any writeback bits - * - * Do set the Ordered (Private2) bit so we know this page was - * properly setup for writepage. - */ - page_ops = (keep_locked ? 0 : PAGE_UNLOCK); - page_ops |= PAGE_SET_ORDERED; - - extent_clear_unlock_delalloc(inode, start, start + ram_size - 1, - locked_page, - EXTENT_LOCKED | EXTENT_DELALLOC, - page_ops); if (num_bytes < cur_alloc_size) num_bytes = 0; else @@ -1487,6 +1483,8 @@ static noinline int cow_file_range(struct btrfs_inode *inode, if (ret) goto out_unlock; } + extent_clear_unlock_delalloc(inode, orig_start, end, locked_page, + EXTENT_LOCKED | EXTENT_DELALLOC, page_ops); done: if (done_offset) *done_offset = end; @@ -1507,29 +1505,31 @@ static noinline int cow_file_range(struct btrfs_inode *inode, * We process each region below. */ - clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | - EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV; - page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; - /* * For the range (1). We have already instantiated the ordered extents * for this region. They are cleaned up by * btrfs_cleanup_ordered_extents() in e.g, - * btrfs_run_delalloc_range(). EXTENT_LOCKED | EXTENT_DELALLOC are - * already cleared in the above loop. And, EXTENT_DELALLOC_NEW | - * EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV are handled by the cleanup - * function. + * btrfs_run_delalloc_range(). + * EXTENT_DELALLOC_NEW | EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV + * are also handled by the cleanup function. * - * However, in case of @keep_locked, we still need to unlock the pages - * (except @locked_page) to ensure all the pages are unlocked. + * So here we only clear EXTENT_LOCKED and EXTENT_DELALLOC flag, and + * finish the writeback of the involved folios, which will be never submitted. */ - if (keep_locked && orig_start < start) { + if (orig_start < start) { + clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC; + page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; + if (!locked_page) mapping_set_error(inode->vfs_inode.i_mapping, ret); extent_clear_unlock_delalloc(inode, orig_start, start - 1, - locked_page, 0, page_ops); + locked_page, clear_bits, page_ops); } + clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | + EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV; + page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; + /* * For the range (2). If we reserved an extent for our delalloc range * (or a subrange) and failed to create the respective ordered extent, -- 2.39.2

2 3

[openeuler:OLK-5.10] BUILD REGRESSION 8c45ad1b4135b7bbeb7c208ce99391363bd666f7
by kernel test robot 28 Mar '25

28 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 8c45ad1b4135b7bbeb7c208ce99391363bd666f7 !15595 io_uring: prevent opcode speculation Unverified Error/Warning (likely false positive, kindly check if interested): drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.o: warning: objtool: st_lsm6dsx_shub_wait_complete() falls through to next function st_lsm6dsx_shub_read_output() drivers/media/test-drivers/vivid/vivid-kthread-cap.o: warning: objtool: vivid_copy_buffer() falls through to next function scale_line() drivers/media/test-drivers/vivid/vivid-kthread-cap.o: warning: objtool: vivid_thread_vid_cap_tick() falls through to next function plane_vaddr() fs/btrfs/free-space-cache.o: warning: objtool: add_bytes_to_bitmap() falls through to next function tree_insert_offset() fs/btrfs/free-space-tree.o: warning: objtool: update_free_space_extent_count() falls through to next function alloc_bitmap() fs/ufs/balloc.o: warning: objtool: ufs_free_fragments() falls through to next function ufs_clusteracct() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-alldefconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-allnoconfig | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-allnoconfig | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_file_name-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_log-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_HDD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CLEAR_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_ENABLE_MSIX-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_MASK_DISABLE-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_STATUS_EXIST_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_SSD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_mgrq_resend-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_notify-Werror-Wmissing-prototypes | `-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:error:unused-function-ps3_scsih_dev_id_get-Werror-Wunused-function |-- x86_64-buildonly-randconfig-001-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-003-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-004-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-005-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-101-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-media-tuners-e4000.o:warning:objtool:e4000_set_params-falls-through-to-next-function-e4000_standby() | |-- drivers-nvdimm-namespace_devs.o:warning:objtool:size_store-falls-through-to-next-function-nd_namespace_label_update() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:bitmap_clear_bits-falls-through-to-next-function-free_bitmap() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-102-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-103-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-104-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- fs-ufs-ialloc.o:warning:objtool:ufs_new_inode-falls-through-to-next-function-ufs2_init_inodes_chunk() | |-- fs-ufs-inode.o:warning:objtool:ufs_iget-falls-through-to-next-function-ufs_set_inode_ops() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-121-20250326 | |-- drivers-iio-imu-st_lsm6dsx-st_lsm6dsx_shub.o:warning:objtool:st_lsm6dsx_shub_wait_complete-falls-through-to-next-function-st_lsm6dsx_shub_read_output() | |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_copy_buffer-falls-through-to-next-function-scale_line() | |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_thread_vid_cap_tick-falls-through-to-next-function-plane_vaddr() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-tree_insert_offset() | `-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-alloc_bitmap() |-- x86_64-randconfig-121-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-122-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-memcontrol.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__user-buffer | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static `-- x86_64-randconfig-161-20250327 |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- drivers-gpu-drm-bridge-tc358768.o:warning:objtool:tc358768_bridge_pre_enable-falls-through-to-next-function-tc358768_bridge_enable() |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() |-- fs-btrfs-free-space-cache.o:warning:objtool:bitmap_clear_bits-falls-through-to-next-function-free_bitmap() |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() |-- fs-ufs-balloc.o:warning:objtool:ufs_free_fragments-falls-through-to-next-function-ufs_clusteracct() |-- fs-ufs-ialloc.o:warning:objtool:ufs_new_inode-falls-through-to-next-function-ufs2_init_inodes_chunk() |-- fs-ufs-inode.o:warning:objtool:ufs_iget-falls-through-to-next-function-ufs_set_inode_ops() |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- net-ceph-striper.o:warning:objtool:ceph_calc_file_object_mapping-falls-through-to-next-function-ceph_file_to_extents() elapsed time: 1455m configs tested: 17 configs skipped: 128 tested configs: arm64 alldefconfig gcc-14.2.0 arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250327 gcc-5.5.0 arm64 randconfig-002-20250327 clang-21 arm64 randconfig-003-20250327 clang-21 arm64 randconfig-004-20250327 clang-21 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250327 gcc-12 x86_64 buildonly-randconfig-002-20250327 gcc-12 x86_64 buildonly-randconfig-003-20250327 clang-20 x86_64 buildonly-randconfig-004-20250327 clang-20 x86_64 buildonly-randconfig-005-20250327 gcc-12 x86_64 buildonly-randconfig-006-20250327 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1525/1525] drivers/char/svm.c:353:35: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 28 Mar '25

28 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3f8283040b83a49bdad8dc3dd4ccd3f50910af28 commit: b8c0480a3eba11ee6616019a3aaa75ee38f06f02 [1525/1525] svm: serach dts to init children device config: arm64-randconfig-r112-20250328 (https://download.01.org/0day-ci/archive/20250328/202503280904.ByoMg5CF-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250328/202503280904.ByoMg5CF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503280904.ByoMg5CF-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/char/svm.c:353:35: sparse: sparse: Using plain integer as NULL pointer vim +353 drivers/char/svm.c 221 222 static int svm_init_core(struct svm_device *sdev) 223 { 224 int err = 0; 225 struct device *dev = sdev->dev; 226 struct acpi_device *adev = ACPI_COMPANION(sdev->dev); 227 struct acpi_device *cdev = NULL; 228 int id = 0; 229 230 down_write(&svm_sem); 231 if (!svm_bus_type.iommu_ops) { 232 err = bus_register(&svm_bus_type); 233 if (err) { 234 up_write(&svm_sem); 235 dev_err(dev, "failed to register svm_bus_type\n"); 236 return err; 237 } 238 239 err = bus_set_iommu(&svm_bus_type, dev->bus->iommu_ops); 240 if (err) { 241 up_write(&svm_sem); 242 dev_err(dev, "failed to set iommu for svm_bus_type\n"); 243 goto err_unregister_bus; 244 } 245 } else if (svm_bus_type.iommu_ops != dev->bus->iommu_ops) { 246 err = -EBUSY; 247 up_write(&svm_sem); 248 dev_err(dev, "iommu_ops configured, but changed!\n"); 249 goto err_unregister_bus; 250 } 251 up_write(&svm_sem); 252 253 list_for_each_entry(cdev, &adev->children, node) { 254 err = svm_acpi_add_core(sdev, cdev, id++); 255 if (err) 256 device_for_each_child(dev, NULL, svm_remove_core); 257 } 258 259 return err; 260 261 err_unregister_bus: 262 bus_unregister(&svm_bus_type); 263 264 return err; 265 } 266 #else 267 static int svm_of_add_core(struct svm_device *sdev, struct device_node *np) 268 { 269 int err; 270 struct resource res; 271 struct core_device *cdev = NULL; 272 char *name = NULL; 273 274 name = devm_kasprintf(sdev->dev, GFP_KERNEL, "svm%llu_%s", 275 sdev->id, np->name); 276 if (name == NULL) 277 return -ENOMEM; 278 279 cdev = kzalloc(sizeof(*cdev), GFP_KERNEL); 280 if (cdev == NULL) 281 return -ENOMEM; 282 283 cdev->dev.of_node = np; 284 cdev->dev.parent = sdev->dev; 285 cdev->dev.bus = &svm_bus_type; 286 cdev->dev.release = cdev_device_release; 287 cdev->smmu_bypass = of_property_read_bool(np, "hisi,smmu_bypass"); 288 dev_set_name(&cdev->dev, "%s", name); 289 290 err = device_register(&cdev->dev); 291 if (err) { 292 dev_info(&cdev->dev, "core_device register failed\n"); 293 put_device(&cdev->dev); 294 kfree(cdev); 295 return err; 296 } 297 298 err = of_dma_configure(&cdev->dev, np, true); 299 if (err) { 300 dev_dbg(&cdev->dev, "of_dma_configure failed\n"); 301 goto err_unregister_dev; 302 } 303 304 err = of_address_to_resource(np, 0, &res); 305 if (err) { 306 dev_info(&cdev->dev, "no reg, FW should install the sid\n"); 307 } else { 308 /* If the reg specified, install sid for the core */ 309 void __iomem *core_base = NULL; 310 int sid = cdev->dev.iommu_fwspec->ids[0]; 311 312 core_base = ioremap(res.start, resource_size(&res)); 313 if (core_base == NULL) { 314 err = -ENOMEM; 315 dev_err(&cdev->dev, "ioremap failed\n"); 316 goto err_unregister_dev; 317 } 318 319 writel_relaxed(sid, core_base + CORE_SID); 320 iounmap(core_base); 321 } 322 323 /* If core device is smmu bypass, request direct map. */ 324 if (cdev->smmu_bypass) { 325 err = iommu_request_dm_for_dev(&cdev->dev); 326 if (err) 327 goto err_unregister_dev; 328 329 return 0; 330 } 331 332 cdev->group = iommu_group_get(&cdev->dev); 333 if (IS_ERR_OR_NULL(cdev->group)) { 334 err = -ENXIO; 335 dev_err(&cdev->dev, "smmu is not right configured\n"); 336 goto err_unregister_dev; 337 } 338 339 cdev->domain = iommu_domain_alloc(sdev->dev->bus); 340 if (cdev->domain == NULL) { 341 err = -ENOMEM; 342 dev_info(&cdev->dev, "failed to alloc domain\n"); 343 goto err_unregister_dev; 344 } 345 346 err = iommu_attach_group(cdev->domain, cdev->group); 347 if (err) { 348 dev_err(&cdev->dev, "failed group to domain\n"); 349 goto err_free_domain; 350 } 351 352 err = iommu_sva_device_init(&cdev->dev, IOMMU_SVA_FEAT_IOPF, > 353 UINT_MAX, 0); 354 if (err) { 355 dev_err(&cdev->dev, "failed to init sva device\n"); 356 goto err_detach_group; 357 } 358 359 return 0; 360 361 err_detach_group: 362 iommu_detach_group(cdev->domain, cdev->group); 363 err_free_domain: 364 iommu_domain_free(cdev->domain); 365 err_unregister_dev: 366 device_unregister(&cdev->dev); 367 368 return err; 369 } 370 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2063/2063] error: unknown target ABI 'ilp32'
by kernel test robot 28 Mar '25

28 Mar '25

Hi Andrew, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b28aab59b06935f0d1c9bce8f013f25b4094764d commit: f9b54a6714445cde83aeff0318cf767b3b81229d [2063/2063] arm64:ilp32: add ARM64_ILP32 to Kconfig config: arm64-randconfig-r112-20250328 (https://download.01.org/0day-ci/archive/20250328/202503280313.olFyEFIT-lkp@…) compiler: clang version 21.0.0git (https://github.com/llvm/llvm-project c2692afc0a92cd5da140dfcdfff7818a5b8ce997) reproduce: (https://download.01.org/0day-ci/archive/20250328/202503280313.olFyEFIT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503280313.olFyEFIT-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from arch/arm64/kernel/asm-offsets.c:12: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2168: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ 4 warnings generated. arch/arm64/kernel/vdso-ilp32/Makefile:84: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:87: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:90: FORCE prerequisite is missing >> clang: warning: -Wl,-soname=linux-ilp32-vdso.so.1: 'linker' input unused [-Wunused-command-line-argument] >> error: unknown target ABI 'ilp32' >> error: unknown target ABI 'ilp32' make[3]: *** [scripts/Makefile.build:373: arch/arm64/kernel/vdso-ilp32/vdso-ilp32.lds] Error 1 make[3]: *** [arch/arm64/kernel/vdso-ilp32/Makefile:84: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o] Error 1 >> error: error: unknown target ABI 'ilp32' unknown target ABI 'ilp32' make[3]: *** [arch/arm64/kernel/vdso-ilp32/Makefile:87: arch/arm64/kernel/vdso-ilp32/note-ilp32.o] Error 1 make[3]: *** [arch/arm64/kernel/vdso-ilp32/Makefile:90: arch/arm64/kernel/vdso-ilp32/sigreturn-ilp32.o] Error 1 make[3]: Target 'include/generated/vdso-ilp32-offsets.h' not remade because of errors. make[2]: *** [arch/arm64/Makefile:201: vdso_prepare] Error 2 make[2]: Target 'prepare' not remade because of errors. make[1]: *** [Makefile:234: __sub-make] Error 2 make[1]: Target 'prepare' not remade because of errors. make: *** [Makefile:234: __sub-make] Error 2 make: Target 'prepare' not remade because of errors. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2025-21858
by Zhang Changzhong 27 Mar '25

27 Mar '25

Kuniyuki Iwashima (2): geneve: Fix use-after-free in geneve_find_dev(). geneve: Suppress list corruption splat in geneve_destroy_tunnels(). drivers/net/geneve.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) -- 2.9.5

2 3

[openeuler:openEuler-1.0-LTS 1523/1523] fs/.tmp_select.o: warning: objtool: poll_select_finish()+0x1aa: can't find switch jump table
by kernel test robot 27 Mar '25

27 Mar '25

Hi Oleg, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: 44ae3d3e5f1f99c0fd5f040e4da88b0c5b3ec76b [1523/1523] select: shift restore_saved_sigmask_unless() into poll_select_copy_remaining() config: x86_64-buildonly-randconfig-004-20250327 (https://download.01.org/0day-ci/archive/20250327/202503272038.iOCRCuV8-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503272038.iOCRCuV8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503272038.iOCRCuV8-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/.tmp_select.o: warning: objtool: poll_select_finish()+0x1aa: can't find switch jump table -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ARM: versatile: Add missing of_node_put in dcscb_init
by Peng Zhang 27 Mar '25

27 Mar '25

From: Peng Wu <wupeng58(a)huawei.com> stable inclusion from stable-v4.19.247 commit a0fc05cd17617e63fc13ad0c01f3f0afd890d8ec category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP128 CVE: CVE-2022-49457 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------- [ Upstream commit 23b44f9c649bbef10b45fa33080cd8b4166800ae ] The device_node pointer is returned by of_find_compatible_node with refcount incremented. We should use of_node_put() to avoid the refcount leak. Signed-off-by: Peng Wu <wupeng58(a)huawei.com> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Link: https://lore.kernel.org/r/20220428230356.69418-1-linus.walleij@linaro.org' Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- arch/arm/mach-vexpress/dcscb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/mach-vexpress/dcscb.c b/arch/arm/mach-vexpress/dcscb.c index ee2a0faafaa1..aaade91f6551 100644 --- a/arch/arm/mach-vexpress/dcscb.c +++ b/arch/arm/mach-vexpress/dcscb.c @@ -146,6 +146,7 @@ static int __init dcscb_init(void) if (!node) return -ENODEV; dcscb_base = of_iomap(node, 0); + of_node_put(node); if (!dcscb_base) return -EADDRNOTAVAIL; cfg = readl_relaxed(dcscb_base + DCS_CFG_R); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
by Peng Zhang 27 Mar '25

27 Mar '25

From: Dafna Hirschfeld <dafna.hirschfeld(a)collabora.com> stable inclusion from stable-v4.19.238 commit f04a520a422222fc921bf035dc67414c500a286a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3SR CVE: CVE-2022-49247 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------- [ Upstream commit fbe04b49a54e31f4321d632270207f0e6304cd16 ] If the callback 'start_streaming' fails, then all queued buffers in the driver should be returned with state 'VB2_BUF_STATE_QUEUED'. Currently, they are returned with 'VB2_BUF_STATE_ERROR' which is wrong. Fix this. This also fixes the warning: [ 65.583633] WARNING: CPU: 5 PID: 593 at drivers/media/common/videobuf2/videobuf2-core.c:1612 vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.585027] Modules linked in: snd_usb_audio snd_hwdep snd_usbmidi_lib snd_rawmidi snd_soc_hdmi_codec dw_hdmi_i2s_audio saa7115 stk1160 videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc crct10dif_ce panfrost snd_soc_simple_card snd_soc_audio_graph_card snd_soc_spdif_tx snd_soc_simple_card_utils gpu_sched phy_rockchip_pcie snd_soc_rockchip_i2s rockchipdrm analogix_dp dw_mipi_dsi dw_hdmi cec drm_kms_helper drm rtc_rk808 rockchip_saradc industrialio_triggered_buffer kfifo_buf rockchip_thermal pcie_rockchip_host ip_tables x_tables ipv6 [ 65.589383] CPU: 5 PID: 593 Comm: v4l2src0:src Tainted: G W 5.16.0-rc4-62408-g32447129cb30-dirty #14 [ 65.590293] Hardware name: Radxa ROCK Pi 4B (DT) [ 65.590696] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 65.591304] pc : vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.591850] lr : vb2_start_streaming+0x6c/0x160 [videobuf2_common] [ 65.592395] sp : ffff800012bc3ad0 [ 65.592685] x29: ffff800012bc3ad0 x28: 0000000000000000 x27: ffff800012bc3cd8 [ 65.593312] x26: 0000000000000000 x25: ffff00000d8a7800 x24: 0000000040045612 [ 65.593938] x23: ffff800011323000 x22: ffff800012bc3cd8 x21: ffff00000908a8b0 [ 65.594562] x20: ffff00000908a8c8 x19: 00000000fffffff4 x18: ffffffffffffffff [ 65.595188] x17: 000000040044ffff x16: 00400034b5503510 x15: ffff800011323f78 [ 65.595813] x14: ffff000013163886 x13: ffff000013163885 x12: 00000000000002ce [ 65.596439] x11: 0000000000000028 x10: 0000000000000001 x9 : 0000000000000228 [ 65.597064] x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff726c5e78 [ 65.597690] x5 : ffff800012bc3990 x4 : 0000000000000000 x3 : ffff000009a34880 [ 65.598315] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000007cd99f0 [ 65.598940] Call trace: [ 65.599155] vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.599672] vb2_core_streamon+0x17c/0x1a8 [videobuf2_common] [ 65.600179] vb2_streamon+0x54/0x88 [videobuf2_v4l2] [ 65.600619] vb2_ioctl_streamon+0x54/0x60 [videobuf2_v4l2] [ 65.601103] v4l_streamon+0x3c/0x50 [videodev] [ 65.601521] __video_do_ioctl+0x1a4/0x428 [videodev] [ 65.601977] video_usercopy+0x320/0x828 [videodev] [ 65.602419] video_ioctl2+0x3c/0x58 [videodev] [ 65.602830] v4l2_ioctl+0x60/0x90 [videodev] [ 65.603227] __arm64_sys_ioctl+0xa8/0xe0 [ 65.603576] invoke_syscall+0x54/0x118 [ 65.603911] el0_svc_common.constprop.3+0x84/0x100 [ 65.604332] do_el0_svc+0x34/0xa0 [ 65.604625] el0_svc+0x1c/0x50 [ 65.604897] el0t_64_sync_handler+0x88/0xb0 [ 65.605264] el0t_64_sync+0x16c/0x170 [ 65.605587] ---[ end trace 578e0ba07742170d ]--- Fixes: 8ac456495a33d ("[media] stk1160: Stop device and unqueue buffers when start_streaming() fails") Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld(a)collabora.com> Reviewed-by: Ezequiel Garcia <ezequiel(a)vanguardiasur.com.ar> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/media/usb/stk1160/stk1160-core.c | 2 +- drivers/media/usb/stk1160/stk1160-v4l.c | 10 +++++----- drivers/media/usb/stk1160/stk1160.h | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c index 468f5ccf4ae6..685872f8b306 100644 --- a/drivers/media/usb/stk1160/stk1160-core.c +++ b/drivers/media/usb/stk1160/stk1160-core.c @@ -413,7 +413,7 @@ static void stk1160_disconnect(struct usb_interface *interface) /* Here is the only place where isoc get released */ stk1160_uninit_isoc(dev); - stk1160_clear_queue(dev); + stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); video_unregister_device(&dev->vdev); v4l2_device_disconnect(&dev->v4l2_dev); diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c index 504e413edcd2..381f9f189bb7 100644 --- a/drivers/media/usb/stk1160/stk1160-v4l.c +++ b/drivers/media/usb/stk1160/stk1160-v4l.c @@ -269,7 +269,7 @@ static int stk1160_start_streaming(struct stk1160 *dev) stk1160_uninit_isoc(dev); out_stop_hw: usb_set_interface(dev->udev, 0, 0); - stk1160_clear_queue(dev); + stk1160_clear_queue(dev, VB2_BUF_STATE_QUEUED); mutex_unlock(&dev->v4l_lock); @@ -317,7 +317,7 @@ static int stk1160_stop_streaming(struct stk1160 *dev) stk1160_stop_hw(dev); - stk1160_clear_queue(dev); + stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); stk1160_dbg("streaming stopped\n"); @@ -762,7 +762,7 @@ static const struct video_device v4l_template = { /********************************************************************/ /* Must be called with both v4l_lock and vb_queue_lock hold */ -void stk1160_clear_queue(struct stk1160 *dev) +void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state) { struct stk1160_buffer *buf; unsigned long flags; @@ -773,7 +773,7 @@ void stk1160_clear_queue(struct stk1160 *dev) buf = list_first_entry(&dev->avail_bufs, struct stk1160_buffer, list); list_del(&buf->list); - vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); + vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); stk1160_dbg("buffer [%p/%d] aborted\n", buf, buf->vb.vb2_buf.index); } @@ -783,7 +783,7 @@ void stk1160_clear_queue(struct stk1160 *dev) buf = dev->isoc_ctl.buf; dev->isoc_ctl.buf = NULL; - vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); + vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); stk1160_dbg("buffer [%p/%d] aborted\n", buf, buf->vb.vb2_buf.index); } diff --git a/drivers/media/usb/stk1160/stk1160.h b/drivers/media/usb/stk1160/stk1160.h index acd1c811db08..54a046aacd33 100644 --- a/drivers/media/usb/stk1160/stk1160.h +++ b/drivers/media/usb/stk1160/stk1160.h @@ -177,7 +177,7 @@ struct regval { int stk1160_vb2_setup(struct stk1160 *dev); int stk1160_video_register(struct stk1160 *dev); void stk1160_video_unregister(struct stk1160 *dev); -void stk1160_clear_queue(struct stk1160 *dev); +void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state); /* Provided by stk1160-video.c */ int stk1160_alloc_isoc(struct stk1160 *dev); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
by Peng Zhang 27 Mar '25

27 Mar '25

From: Zekun Shen <bruceshenzk(a)gmail.com> stable inclusion from stable-v4.19.238 commit 25efc5d03455c3839249bc77fce5e29ecb54677e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP5YP CVE: CVE-2021-47633 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------- [ Upstream commit 564d4eceb97eaf381dd6ef6470b06377bb50c95a ] The bug was found during fuzzing. Stacktrace locates it in ath5k_eeprom_convert_pcal_info_5111. When none of the curve is selected in the loop, idx can go up to AR5K_EEPROM_N_PD_CURVES. The line makes pd out of bound. pd = &chinfo[pier].pd_curves[idx]; There are many OOB writes using pd later in the code. So I added a sanity check for idx. Checks for other loops involving AR5K_EEPROM_N_PD_CURVES are not needed as the loop index is not used outside the loops. The patch is NOT tested with real device. The following is the fuzzing report BUG: KASAN: slab-out-of-bounds in ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] Write of size 1 at addr ffff8880174a4d60 by task modprobe/214 CPU: 0 PID: 214 Comm: modprobe Not tainted 5.6.0 #1 Call Trace: dump_stack+0x76/0xa0 print_address_description.constprop.0+0x16/0x200 ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] __kasan_report.cold+0x37/0x7c ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] kasan_report+0xe/0x20 ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] ? apic_timer_interrupt+0xa/0x20 ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k] ? ath5k_pci_eeprom_read+0x228/0x3c0 [ath5k] ath5k_eeprom_init+0x2513/0x6290 [ath5k] ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k] ? usleep_range+0xb8/0x100 ? apic_timer_interrupt+0xa/0x20 ? ath5k_eeprom_read_pcal_info_2413+0x2f20/0x2f20 [ath5k] ath5k_hw_init+0xb60/0x1970 [ath5k] ath5k_init_ah+0x6fe/0x2530 [ath5k] ? kasprintf+0xa6/0xe0 ? ath5k_stop+0x140/0x140 [ath5k] ? _dev_notice+0xf6/0xf6 ? apic_timer_interrupt+0xa/0x20 ath5k_pci_probe.cold+0x29a/0x3d6 [ath5k] ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k] ? mutex_lock+0x89/0xd0 ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k] local_pci_probe+0xd3/0x160 pci_device_probe+0x23f/0x3e0 ? pci_device_remove+0x280/0x280 ? pci_device_remove+0x280/0x280 really_probe+0x209/0x5d0 Reported-by: Brendan Dolan-Gavitt <brendandg(a)nyu.edu> Signed-off-by: Zekun Shen <bruceshenzk(a)gmail.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/YckvDdj3mtCkDRIt@a-10-27-26-18.dynapool.vpn.nyu.e… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/net/wireless/ath/ath5k/eeprom.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c index 94d34ee02265..01163b333945 100644 --- a/drivers/net/wireless/ath/ath5k/eeprom.c +++ b/drivers/net/wireless/ath/ath5k/eeprom.c @@ -746,6 +746,9 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode, } } + if (idx == AR5K_EEPROM_N_PD_CURVES) + goto err_out; + ee->ee_pd_gains[mode] = 1; pd = &chinfo[pier].pd_curves[idx]; -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1523/1523] ERROR: "ata_dev_same_device" [drivers/scsi/libsas/libsas.ko] undefined!
by kernel test robot 27 Mar '25

27 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: d856ec500c97835c591ffacc005f514509f1a931 [1523/1523] scsi: libsas: check if the same sata device when flutter config: x86_64-buildonly-randconfig-005-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271838.22rCFdNn-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271838.22rCFdNn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271838.22rCFdNn-lkp@intel.com/ All errors (new ones prefixed by >>): >> ERROR: "ata_dev_same_device" [drivers/scsi/libsas/libsas.ko] undefined! -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1520/1520] arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.
by kernel test robot 27 Mar '25

27 Mar '25

Hi Peter, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: 3acbac72baea337e0ac79801a8ba4b81e3b67014 [1520/1520] x86/speculation: Change FILL_RETURN_BUFFER to work with objtool config: x86_64-randconfig-161-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271858.j6vJ9Bhc-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271858.j6vJ9Bhc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271858.j6vJ9Bhc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1e1: unsupported intra-function call >> arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 V2 0/3] add support DVMBM in HIP12
by Jinqian Yang 27 Mar '25

27 Mar '25

Patch#1 kvm: hisi_virt: fix kernel panic when enable DVMBM in nVHE Patch#2 kvm: hisi_virt: Update TLBI broadcast feature for hip12 Patch#3 KVM: arm64: Add new HiSi CPU type to support DVMBM Xiang Chen (1): kvm: hisi_virt: Update TLBI broadcast feature for hip12 yangjinqian (2): kvm: hisi_virt: fix kernel panic when enable DVMBM in nVHE KVM: arm64: Add new HiSi CPU type to support DVMBM arch/arm64/kvm/hisilicon/hisi_virt.c | 72 ++++++++++++++++++++++++++-- arch/arm64/kvm/hisilicon/hisi_virt.h | 8 ++++ 2 files changed, 76 insertions(+), 4 deletions(-) -- 2.33.0

2 4

[openeuler:openEuler-1.0-LTS 1523/1523] drivers/edac/skx_common.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 27 Mar '25

27 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: e34047f6dc606c123911c6db8fa424bb4a035262 [1523/1523] EDAC, skx_edac: Delete duplicated code config: x86_64-buildonly-randconfig-002-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271455.zeSbmwpC-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271455.zeSbmwpC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271455.zeSbmwpC-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/edac/skx_common.c: In function 'skx_mce_output_error': drivers/edac/skx_common.c:470:15: warning: variable 'type' set but not used [-Wunused-but-set-variable] 470 | char *type, *optype; | ^~~~ >> drivers/edac/skx_common.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
by Qi Xi 27 Mar '25

27 Mar '25

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> mainline inclusion from mainline-v6.14-rc1 commit 301c26a018acb94dd537a4418cefa0f654500c6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRED3 CVE: CVE-2024-58077 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc_pcm_ret(). It is used from many functions, ignoring -EINVAL is over-kill. The reason why -EINVAL was ignored was it really should only be used upon invalid parameters coming from userspace and in that case we don't want to log an error since we do not want to give userspace a way to do a denial-of-service attack on the syslog / diskspace. So don't use soc_pcm_ret() on .prepare callback is better idea. Link: https://lore.kernel.org/r/87v7vptzap.wl-kuninori.morimoto.gx@renesas.com Cc: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Link: https://patch.msgid.link/87bjxg8jju.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- sound/soc/soc-pcm.c | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 511446a30c05..60248a6820aa 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -38,7 +38,6 @@ static inline int _soc_pcm_ret(struct snd_soc_pcm_runtime *rtd, switch (ret) { case -EPROBE_DEFER: case -ENOTSUPP: - case -EINVAL: break; default: dev_err(rtd->dev, @@ -902,7 +901,13 @@ static int __soc_pcm_prepare(struct snd_soc_pcm_runtime *rtd, } out: - return soc_pcm_ret(rtd, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } /* PCM prepare ops for non-DPCM streams */ @@ -914,6 +919,13 @@ static int soc_pcm_prepare(struct snd_pcm_substream *substream) snd_soc_dpcm_mutex_lock(rtd); ret = __soc_pcm_prepare(rtd, substream); snd_soc_dpcm_mutex_unlock(rtd); + + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ return ret; } @@ -2461,7 +2473,13 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) be->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE; } - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) @@ -2501,7 +2519,13 @@ static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO); snd_soc_dpcm_mutex_unlock(fe); - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_run_update_shutdown(struct snd_soc_pcm_runtime *fe, int stream) -- 2.33.0

2 1

[openeuler:openEuler-1.0-LTS 1523/1523] net/netfilter/nft_nat.c:165:23: warning: 'alen' may be used uninitialized in this function
by kernel test robot 27 Mar '25

27 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: 1a53a31cdd778dfc49a1bf495394238cb9de9bef [1523/1523] netfilter: nft_nat: allow to specify layer 4 protocol NAT only config: arm64-randconfig-004-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271418.7nn4LU8p-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271418.7nn4LU8p-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271418.7nn4LU8p-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): net/netfilter/nft_nat.c: In function 'nft_nat_init': >> net/netfilter/nft_nat.c:165:23: warning: 'alen' may be used uninitialized in this function [-Wmaybe-uninitialized] 165 | err = nft_validate_register_load(priv->sreg_addr_min, alen); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/alen +165 net/netfilter/nft_nat.c 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 116 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 117 static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 118 const struct nlattr * const tb[]) 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 119 { 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 120 struct nft_nat *priv = nft_expr_priv(expr); d07db9884a5fba Patrick McHardy 2015-04-11 121 unsigned int alen, plen; 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 122 u32 family; 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 123 int err; 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 124 5c819a39753d6a Pablo Neira Ayuso 2014-10-16 125 if (tb[NFTA_NAT_TYPE] == NULL || 5c819a39753d6a Pablo Neira Ayuso 2014-10-16 126 (tb[NFTA_NAT_REG_ADDR_MIN] == NULL && 5c819a39753d6a Pablo Neira Ayuso 2014-10-16 127 tb[NFTA_NAT_REG_PROTO_MIN] == NULL)) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 128 return -EINVAL; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 129 eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 130 switch (ntohl(nla_get_be32(tb[NFTA_NAT_TYPE]))) { eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 131 case NFT_NAT_SNAT: eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 132 priv->type = NF_NAT_MANIP_SRC; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 133 break; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 134 case NFT_NAT_DNAT: eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 135 priv->type = NF_NAT_MANIP_DST; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 136 break; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 137 default: cc8272882c3dad Pablo Neira Ayuso 2020-09-22 138 return -EOPNOTSUPP; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 139 } eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 140 eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 141 if (tb[NFTA_NAT_FAMILY] == NULL) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 142 return -EINVAL; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 143 a4c2e8beba8432 Patrick McHardy 2014-03-07 144 family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY])); 36596dadf54a92 Pablo Neira Ayuso 2018-01-09 145 if (family != ctx->family) a4c2e8beba8432 Patrick McHardy 2014-03-07 146 return -EOPNOTSUPP; d07db9884a5fba Patrick McHardy 2015-04-11 147 d07db9884a5fba Patrick McHardy 2015-04-11 148 switch (family) { d07db9884a5fba Patrick McHardy 2015-04-11 149 case NFPROTO_IPV4: d07db9884a5fba Patrick McHardy 2015-04-11 150 alen = FIELD_SIZEOF(struct nf_nat_range, min_addr.ip); d07db9884a5fba Patrick McHardy 2015-04-11 151 break; d07db9884a5fba Patrick McHardy 2015-04-11 152 case NFPROTO_IPV6: d07db9884a5fba Patrick McHardy 2015-04-11 153 alen = FIELD_SIZEOF(struct nf_nat_range, min_addr.ip6); d07db9884a5fba Patrick McHardy 2015-04-11 154 break; d07db9884a5fba Patrick McHardy 2015-04-11 155 default: 1a53a31cdd778d Pablo Neira Ayuso 2021-10-25 156 if (tb[NFTA_NAT_REG_ADDR_MIN]) d07db9884a5fba Patrick McHardy 2015-04-11 157 return -EAFNOSUPPORT; 1a53a31cdd778d Pablo Neira Ayuso 2021-10-25 158 break; d07db9884a5fba Patrick McHardy 2015-04-11 159 } a4c2e8beba8432 Patrick McHardy 2014-03-07 160 priv->family = family; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 161 eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 162 if (tb[NFTA_NAT_REG_ADDR_MIN]) { 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 163 priv->sreg_addr_min = b1c96ed37ceeef Patrick McHardy 2015-04-11 164 nft_parse_register(tb[NFTA_NAT_REG_ADDR_MIN]); d07db9884a5fba Patrick McHardy 2015-04-11 @165 err = nft_validate_register_load(priv->sreg_addr_min, alen); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 166 if (err < 0) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 167 return err; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 168 eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 169 if (tb[NFTA_NAT_REG_ADDR_MAX]) { 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 170 priv->sreg_addr_max = b1c96ed37ceeef Patrick McHardy 2015-04-11 171 nft_parse_register(tb[NFTA_NAT_REG_ADDR_MAX]); 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 172 d07db9884a5fba Patrick McHardy 2015-04-11 173 err = nft_validate_register_load(priv->sreg_addr_max, d07db9884a5fba Patrick McHardy 2015-04-11 174 alen); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 175 if (err < 0) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 176 return err; 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 177 } else { eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 178 priv->sreg_addr_max = priv->sreg_addr_min; 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 179 } 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 180 } eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 181 d07db9884a5fba Patrick McHardy 2015-04-11 182 plen = FIELD_SIZEOF(struct nf_nat_range, min_addr.all); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 183 if (tb[NFTA_NAT_REG_PROTO_MIN]) { 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 184 priv->sreg_proto_min = b1c96ed37ceeef Patrick McHardy 2015-04-11 185 nft_parse_register(tb[NFTA_NAT_REG_PROTO_MIN]); 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 186 d07db9884a5fba Patrick McHardy 2015-04-11 187 err = nft_validate_register_load(priv->sreg_proto_min, plen); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 188 if (err < 0) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 189 return err; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 190 eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 191 if (tb[NFTA_NAT_REG_PROTO_MAX]) { 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 192 priv->sreg_proto_max = b1c96ed37ceeef Patrick McHardy 2015-04-11 193 nft_parse_register(tb[NFTA_NAT_REG_PROTO_MAX]); 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 194 d07db9884a5fba Patrick McHardy 2015-04-11 195 err = nft_validate_register_load(priv->sreg_proto_max, d07db9884a5fba Patrick McHardy 2015-04-11 196 plen); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 197 if (err < 0) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 198 return err; 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 199 } else { eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 200 priv->sreg_proto_max = priv->sreg_proto_min; 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 201 } 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 202 } eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 203 e42eff8a32f8b7 Arturo Borrero 2014-09-04 204 if (tb[NFTA_NAT_FLAGS]) { e42eff8a32f8b7 Arturo Borrero 2014-09-04 205 priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS])); e42eff8a32f8b7 Arturo Borrero 2014-09-04 206 if (priv->flags & ~NF_NAT_RANGE_MASK) cc8272882c3dad Pablo Neira Ayuso 2020-09-22 207 return -EOPNOTSUPP; e42eff8a32f8b7 Arturo Borrero 2014-09-04 208 } e42eff8a32f8b7 Arturo Borrero 2014-09-04 209 20afd423976ef3 Florian Westphal 2016-11-15 210 return nf_ct_netns_get(ctx->net, family); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 211 } eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 212 :::::: The code at line 165 was first introduced by commit :::::: d07db9884a5fba8c8020166c86183c79a18d066a netfilter: nf_tables: introduce nft_validate_register_load() :::::: TO: Patrick McHardy <kaber(a)trash.net> :::::: CC: Pablo Neira Ayuso <pablo(a)netfilter.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1523/1523] include/asm-generic/atomic-instrumented.h:33:9: warning: 'wait_req' may be used uninitialized
by kernel test robot 27 Mar '25

27 Mar '25

Hi Ryusuke, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: 6741506ca02825b90e77088e8fce01c3d02edfdd [1523/1523] nilfs2: fix unexpected freezing of nilfs_segctor_sync() config: x86_64-buildonly-randconfig-001-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271341.WPxyfHvo-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271341.WPxyfHvo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271341.WPxyfHvo-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from arch/x86/include/asm/atomic.h:265, from include/linux/atomic.h:7, from arch/x86/include/asm/thread_info.h:54, from include/linux/thread_bits.h:22, from include/linux/thread_info.h:14, from arch/x86/include/asm/preempt.h:7, from include/linux/preempt.h:81, from include/linux/spinlock.h:51, from include/linux/mmzone.h:9, from include/linux/gfp.h:6, from include/linux/mm.h:11, from include/linux/pagemap.h:8, from fs/nilfs2/segment.c:11: In function 'atomic_set', inlined from 'nilfs_segctor_sync' at fs/nilfs2/segment.c:2175:2: >> include/asm-generic/atomic-instrumented.h:33:9: warning: 'wait_req' may be used uninitialized [-Wmaybe-uninitialized] 33 | kasan_check_write(v, sizeof(*v)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:265, from include/asm-generic/bug.h:5, from arch/x86/include/asm/bug.h:83, from include/linux/bug.h:5, from include/linux/mmdebug.h:5, from include/linux/mm.h:10: include/linux/kasan-checks.h: In function 'nilfs_segctor_sync': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ fs/nilfs2/segment.c:2170:43: note: 'wait_req' declared here 2170 | struct nilfs_segctor_wait_request wait_req; | ^~~~~~~~ vim +/wait_req +33 include/asm-generic/atomic-instrumented.h b06ed71a624ba0 Dmitry Vyukov 2018-01-29 30 b06ed71a624ba0 Dmitry Vyukov 2018-01-29 31 static __always_inline void atomic_set(atomic_t *v, int i) b06ed71a624ba0 Dmitry Vyukov 2018-01-29 32 { a35353bb9eb199 Dmitry Vyukov 2018-01-29 @33 kasan_check_write(v, sizeof(*v)); b06ed71a624ba0 Dmitry Vyukov 2018-01-29 34 arch_atomic_set(v, i); b06ed71a624ba0 Dmitry Vyukov 2018-01-29 35 } b06ed71a624ba0 Dmitry Vyukov 2018-01-29 36 :::::: The code at line 33 was first introduced by commit :::::: a35353bb9eb1990a44a0d7585f99e9589bcdb682 locking/atomic, asm-generic: Add KASAN instrumentation to atomic operations :::::: TO: Dmitry Vyukov <dvyukov(a)google.com> :::::: CC: Ingo Molnar <mingo(a)kernel.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] cifs: Revert two patches to prevent statistics leakage on the lo device.
by Wang Zhaolong 26 Mar '25

26 Mar '25

Wang Zhaolong (2): Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" Revert "smb: client: fix TCP timers deadlock after rmmod" fs/cifs/connect.c | 33 +++++++++------------------------ 1 file changed, 9 insertions(+), 24 deletions(-) -- 2.39.2

2 3

[openeuler:OLK-5.10] BUILD REGRESSION 0d616a77cb5f7198cca524a24f717f59ad51b41b
by kernel test robot 26 Mar '25

26 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 0d616a77cb5f7198cca524a24f717f59ad51b41b !15379 bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503252017.UYNRpRjt-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503252115.VoLdAs0Z-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503260202.467f83vo-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503260613.Q2n0VF4Y-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503260949.1ZCW1y7H-lkp@intel.com arch/x86/kernel/paravirt.c:68:1: error: control reaches end of non-void function [-Werror=return-type] block/bio.o: warning: objtool: bvec_alloc()+0xf5: unreachable instruction drivers/media/pci/intel/ipu3/ipu3-cio2.o: warning: objtool: cio2_subdev_get_fmt()+0x8a: unreachable instruction drivers/pci/endpoint/functions/pci-epf-test.o: warning: objtool: pci_epf_test_cmd_handler()+0x429: unreachable instruction io_uring/io_uring.o: warning: objtool: __io_uring_free()+0x69: unreachable instruction kernel/rcu/tree.o: warning: objtool: rcu_iw_handler()+0x9e: unreachable instruction mm/slab_common.o: warning: objtool: kmalloc_slab()+0x63: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-001-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-003-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-allnoconfig | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_file_name-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_log-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_HDD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CLEAR_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_ENABLE_MSIX-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_MASK_DISABLE-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_STATUS_EXIST_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_SSD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_mgrq_resend-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_notify-Werror-Wmissing-prototypes | `-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:error:unused-function-ps3_scsih_dev_id_get-Werror-Wunused-function |-- x86_64-buildonly-randconfig-001-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-002-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-003-20250325 | |-- arch-x86-kernel-paravirt.c:error:control-reaches-end-of-non-void-function | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-005-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-bio.o:warning:objtool:bvec_alloc:unreachable-instruction | |-- drivers-media-pci-intel-ipu3-ipu3-cio2.o:warning:objtool:cio2_subdev_get_fmt:unreachable-instruction | |-- drivers-pci-endpoint-functions-pci-epf-test.o:warning:objtool:pci_epf_test_cmd_handler:unreachable-instruction | |-- io_uring-io_uring.o:warning:objtool:__io_uring_free:unreachable-instruction | |-- kernel-rcu-tree.o:warning:objtool:rcu_iw_handler:unreachable-instruction | |-- kernel-rcu-update.o:warning:objtool:synchronize_rcu_tasks_rude:unreachable-instruction | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- mm-slab_common.o:warning:objtool:kmalloc_slab:unreachable-instruction |-- x86_64-buildonly-randconfig-006-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-102-20250326 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-121-20250326 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-media-tuners-e4000.o:warning:objtool:e4000_set_params-falls-through-to-next-function-e4000_standby() | |-- drivers-mtd-nand-raw-cadence-nand-controller.o:warning:objtool:cadence_nand_setup_interface-falls-through-to-next-function-cadence_nand_read_page() | |-- drivers-net-virtio_net.o:warning:objtool:virtnet_set_affinity-falls-through-to-next-function-virtnet_clean_affinity() | |-- drivers-nvdimm-namespace_devs.o:warning:objtool:size_store-falls-through-to-next-function-nd_namespace_label_update() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- mm-vmscan.o:warning:objtool:do_shrink_slab-falls-through-to-next-function-allow_direct_reclaim() |-- x86_64-randconfig-122-20250326 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20250325 | `-- net-core-sock_map.c:sparse:sparse:symbol-sock_map_prog_lookup-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20250326 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static `-- x86_64-randconfig-161-20250325 `-- mm-memcontrol.c-uncharge_page()-error:uninitialized-symbol-objcg-. elapsed time: 1462m configs tested: 16 configs skipped: 128 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250325 gcc-9.5.0 arm64 randconfig-002-20250325 clang-18 arm64 randconfig-003-20250325 gcc-7.5.0 arm64 randconfig-004-20250325 clang-20 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250325 gcc-12 x86_64 buildonly-randconfig-002-20250325 clang-20 x86_64 buildonly-randconfig-003-20250325 gcc-12 x86_64 buildonly-randconfig-004-20250325 gcc-12 x86_64 buildonly-randconfig-005-20250325 clang-20 x86_64 buildonly-randconfig-006-20250325 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
by Gu Bowen 26 Mar '25

26 Mar '25

From: Pavel Skripkin <paskripkin(a)gmail.com> stable inclusion from stable-v4.19.247 commit a3660e06675bccec4bf149c7229ea1d491ba10d7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6VC CVE: CVE-2022-49478 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 471bec68457aaf981add77b4f590d65dd7da1059 ] Syzbot reported that -1 is used as array index. The problem was in missing validation check. hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that. hdw->workpoll initialization moved upper to prevent warning in __flush_work. Reported-and-tested-by: syzbot+1a247e36149ffd709a9b(a)syzkaller.appspotmail.com Fixes: d855497edbfb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18") Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c index fcb201a40920..3fb2cfe583e8 100644 --- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c @@ -2561,6 +2561,11 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf, } while (0); mutex_unlock(&pvr2_unit_mtx); + INIT_WORK(&hdw->workpoll, pvr2_hdw_worker_poll); + + if (hdw->unit_number == -1) + goto fail; + cnt1 = 0; cnt2 = scnprintf(hdw->name+cnt1,sizeof(hdw->name)-cnt1,"pvrusb2"); cnt1 += cnt2; @@ -2572,8 +2577,6 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf, if (cnt1 >= sizeof(hdw->name)) cnt1 = sizeof(hdw->name)-1; hdw->name[cnt1] = 0; - INIT_WORK(&hdw->workpoll,pvr2_hdw_worker_poll); - pvr2_trace(PVR2_TRACE_INIT,"Driver unit number is %d, name is %s", hdw->unit_number,hdw->name); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] tty: goldfish: Fix free_irq() on remove
by Gu Bowen 26 Mar '25

26 Mar '25

From: Vincent Whitchurch <vincent.whitchurch(a)axis.com> stable inclusion from stable-v4.19.249 commit c83a1d40dc624070a203eb383ef9fb60eb634136 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP33Y CVE: CVE-2022-49724 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 499e13aac6c762e1e828172b0f0f5275651d6512 ] Pass the correct dev_id to free_irq() to fix this splat when the driver is unbound: WARNING: CPU: 0 PID: 30 at kernel/irq/manage.c:1895 free_irq Trying to free already-free IRQ 65 Call Trace: warn_slowpath_fmt free_irq goldfish_tty_remove platform_remove device_remove device_release_driver_internal device_driver_detach unbind_store drv_attr_store ... Fixes: 465893e18878e119 ("tty: goldfish: support platform_device with id -1") Signed-off-by: Vincent Whitchurch <vincent.whitchurch(a)axis.com> Link: https://lore.kernel.org/r/20220609141704.1080024-1-vincent.whitchurch@axis.… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/tty/goldfish.c [Context conflicts.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/goldfish.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c index ed0f3a7b8fe5..48ea55beaf43 100644 --- a/drivers/tty/goldfish.c +++ b/drivers/tty/goldfish.c @@ -427,7 +427,7 @@ static int goldfish_tty_remove(struct platform_device *pdev) tty_unregister_device(goldfish_tty_driver, qtty->console.index); iounmap(qtty->base); qtty->base = NULL; - free_irq(qtty->irq, pdev); + free_irq(qtty->irq, qtty); goldfish_tty_current_line_count--; if (goldfish_tty_current_line_count == 0) goldfish_tty_delete_driver(); -- 2.25.1

2 1

[PATCH OLK-5.10 0/3] bpf: unify array->elem_size usage in arraymap.c and add inner_array_lookup.c selftest
by Xiaomeng Zhang 26 Mar '25

26 Mar '25

Andrii Nakryiko (1): bpf: make uniform use of array->elem_size everywhere in arraymap.c Rhys Rustad-Elliott (2): bpf: Fix elem_size not being set for inner maps selftests/bpf: Add access_inner_map selftest kernel/bpf/arraymap.c | 14 +++--- kernel/bpf/map_in_map.c | 8 +++- .../bpf/prog_tests/inner_array_lookup.c | 31 +++++++++++++ .../selftests/bpf/progs/inner_array_lookup.c | 45 +++++++++++++++++++ 4 files changed, 90 insertions(+), 8 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c create mode 100644 tools/testing/selftests/bpf/progs/inner_array_lookup.c -- 2.34.1

2 4

[PATCH] arm64_mpam: Add prefetch option
by Zeng Heng 26 Mar '25

26 Mar '25

Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/include/asm/mpam.h | 15 +++++ arch/arm64/include/asm/thread_info.h | 4 ++ fs/resctrl/internal.h | 1 + fs/resctrl/rdtgroup.c | 84 ++++++++++++++++++++++++++++ 4 files changed, 104 insertions(+) diff --git a/arch/arm64/include/asm/mpam.h b/arch/arm64/include/asm/mpam.h index 9abe1fe58c34..ac7b6250250c 100644 --- a/arch/arm64/include/asm/mpam.h +++ b/arch/arm64/include/asm/mpam.h @@ -143,16 +143,31 @@ static inline void resctrl_arch_set_rmid(struct task_struct *tsk, u32 rmid) #endif } +#define setbit(x, y) (x |= (1<<y)) +#define clrbit(x, y) (x &= ~(1<<y)) + static inline void mpam_thread_switch(struct task_struct *tsk) { u64 oldregval; int cpu = smp_processor_id(); u64 regval = mpam_get_regval(tsk); + u64 val, val1; if (!IS_ENABLED(CONFIG_ARM64_MPAM) || !static_branch_likely(&mpam_enabled)) return; + asm volatile("mrs %0, S3_1_c15_c6_4" : "=r" (val)); + val1 = val; + + if (task_thread_info(tsk)->prefetch_dis) + setbit(val1, 0); + else + clrbit(val1, 0); + + if (val1 != val) + asm volatile("msr S3_1_c15_c6_4, %0" : : "r"(val1)); + if (regval == READ_ONCE(mpam_resctrl_default_group)) regval = READ_ONCE(per_cpu(arm64_mpam_default, cpu)); diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h index 379d24059f5b..a996caebb08e 100644 --- a/arch/arm64/include/asm/thread_info.h +++ b/arch/arm64/include/asm/thread_info.h @@ -48,7 +48,11 @@ struct thread_info { #endif u32 cpu; +#ifdef CONFIG_ARM64_MPAM + KABI_USE(1, u32 prefetch_dis) +#else KABI_RESERVE(1) +#endif KABI_RESERVE(2) }; diff --git a/fs/resctrl/internal.h b/fs/resctrl/internal.h index fb620beba958..fbc76efa06d9 100644 --- a/fs/resctrl/internal.h +++ b/fs/resctrl/internal.h @@ -173,6 +173,7 @@ struct rdtgroup { struct mongroup mon; enum rdtgrp_mode mode; struct pseudo_lock_region *plr; + u32 prefetch_dis; }; /* List of all resource groups */ diff --git a/fs/resctrl/rdtgroup.c b/fs/resctrl/rdtgroup.c index 9776b4e2834c..bdf75b75b695 100644 --- a/fs/resctrl/rdtgroup.c +++ b/fs/resctrl/rdtgroup.c @@ -822,6 +822,80 @@ static int rdtgroup_tasks_show(struct kernfs_open_file *of, return ret; } +#ifdef CONFIG_ARM64_MPAM +static void update_prefetch_tasks(struct rdtgroup *r, u32 prefetch_dis) +{ + struct task_struct *p, *t; + + rcu_read_lock(); + + for_each_process_thread(p, t) { + if (is_closid_match(t, r) || is_rmid_match(t, r)) { + WRITE_ONCE(task_thread_info(t)->prefetch_dis, prefetch_dis); + /* Update task_struct and will send IPI to target cpu */ + smp_mb(); + update_task_closid_rmid(t); + } + } + + rcu_read_unlock(); +} + +static ssize_t rdtgroup_prefetch_write(struct kernfs_open_file *of, + char *buf, size_t nbytes, loff_t off) +{ + struct rdtgroup *rdtgrp; + int ret = 0; + u32 prefetch_dis; + + rdtgrp = rdtgroup_kn_lock_live(of->kn); + if (!rdtgrp) { + rdtgroup_kn_unlock(of->kn); + return -ENOENT; + } + rdt_last_cmd_clear(); + + if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED || + rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) { + ret = -EINVAL; + rdt_last_cmd_puts("Pseudo-locking in progress\n"); + goto unlock; + } + + if (kstrtou32(buf, 0, &prefetch_dis)) { + rdt_last_cmd_printf("Task list parsing error prefetch %s\n", buf); + ret = -EINVAL; + goto unlock; + } + + if (rdtgrp->prefetch_dis != prefetch_dis) { + rdtgrp->prefetch_dis = prefetch_dis; + update_prefetch_tasks(rdtgrp, prefetch_dis); + } + +unlock: + rdtgroup_kn_unlock(of->kn); + + return ret ?: nbytes; +} + +static int rdtgroup_prefetch_show(struct kernfs_open_file *of, + struct seq_file *s, void *v) +{ + struct rdtgroup *rdtgrp; + int ret = 0; + + rdtgrp = rdtgroup_kn_lock_live(of->kn); + if (rdtgrp) + seq_printf(s, "%u\n", rdtgrp->prefetch_dis); + else + ret = -ENOENT; + rdtgroup_kn_unlock(of->kn); + + return ret; +} +#endif + static int rdtgroup_closid_show(struct kernfs_open_file *of, struct seq_file *s, void *v) { @@ -1891,6 +1965,16 @@ static struct rftype res_common_files[] = { .seq_show = rdtgroup_tasks_show, .fflags = RFTYPE_BASE, }, +#ifdef CONFIG_ARM64_MPAM + { + .name = "prefetch_dis", + .mode = 0644, + .kf_ops = &rdtgroup_kf_single_ops, + .write = rdtgroup_prefetch_write, + .seq_show = rdtgroup_prefetch_show, + .fflags = RFTYPE_BASE, + }, +#endif { .name = "mon_hw_id", .mode = 0444, -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] media: uvcvideo: Remove dangling pointers
by Zhao Yipeng 26 Mar '25

26 Mar '25

From: Ricardo Ribalda <ribalda(a)chromium.org> mainline inclusion from mainline-v6.14-rc1 commit 221cd51efe4565501a3dbf04cc011b537dcce7fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8W CVE: CVE-2024-58002 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the device is done. Which could be anytime in the future. If the user closes that file descriptor, its structure will be freed, and there will be one dangling pointer per pending async control, that the driver will try to use. Clean all the dangling pointers during release(). To avoid adding a performance penalty in the most common case (no async operation), a counter has been introduced with some logic to make sure that it is properly handled. Cc: stable(a)vger.kernel.org Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives") Reviewed-by: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Link: https://lore.kernel.org/r/20241203-uvc-fix-async-v6-3-26c867231118@chromium… Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Conflicts: drivers/media/usb/uvc/uvc_ctrl.c drivers/media/usb/uvc/uvc_v4l2.c drivers/media/usb/uvc/uvcvideo.h [The guard() function is not introduced. 'for' loop initial declaration are only allowed in C99 or C11 mode. And other conflicts are contextual due to the commits d9fecd096f67, 9e56380ae625 and d9c8763e6129 not being merged.] Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- drivers/media/usb/uvc/uvc_ctrl.c | 64 +++++++++++++++++++++++++++++++- drivers/media/usb/uvc/uvc_v4l2.c | 2 + drivers/media/usb/uvc/uvcvideo.h | 9 ++++- 3 files changed, 72 insertions(+), 3 deletions(-) diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index f2854337cdca..fc02bbcd6245 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -1276,6 +1276,40 @@ static void uvc_ctrl_send_slave_event(struct uvc_video_chain *chain, uvc_ctrl_send_event(chain, handle, ctrl, mapping, val, changes); } +static void uvc_ctrl_set_handle(struct uvc_fh *handle, struct uvc_control *ctrl, + struct uvc_fh *new_handle) +{ + lockdep_assert_held(&handle->chain->ctrl_mutex); + + if (new_handle) { + if (ctrl->handle) + dev_warn_ratelimited(&handle->stream->dev->udev->dev, + "UVC non compliance: Setting an async control with a pending operation."); + + if (new_handle == ctrl->handle) + return; + + if (ctrl->handle) { + WARN_ON(!ctrl->handle->pending_async_ctrls); + if (ctrl->handle->pending_async_ctrls) + ctrl->handle->pending_async_ctrls--; + } + + ctrl->handle = new_handle; + handle->pending_async_ctrls++; + return; + } + + /* Cannot clear the handle for a control not owned by us.*/ + if (WARN_ON(ctrl->handle != handle)) + return; + + ctrl->handle = NULL; + if (WARN_ON(!handle->pending_async_ctrls)) + return; + handle->pending_async_ctrls--; +} + static void uvc_ctrl_status_event_work(struct work_struct *work) { struct uvc_device *dev = container_of(work, struct uvc_device, @@ -1291,7 +1325,8 @@ static void uvc_ctrl_status_event_work(struct work_struct *work) mutex_lock(&chain->ctrl_mutex); handle = ctrl->handle; - ctrl->handle = NULL; + if (handle) + uvc_ctrl_set_handle(handle, ctrl, NULL); list_for_each_entry(mapping, &ctrl->info.mappings, list) { s32 value = __uvc_ctrl_get_value(mapping, w->data); @@ -1684,7 +1719,7 @@ int uvc_ctrl_set(struct uvc_fh *handle, uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT)); if (ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS) - ctrl->handle = handle; + uvc_ctrl_set_handle(handle, ctrl, handle); ctrl->dirty = 1; ctrl->modified = 1; @@ -2330,6 +2365,31 @@ int uvc_ctrl_init_device(struct uvc_device *dev) return 0; } +void uvc_ctrl_cleanup_fh(struct uvc_fh *handle) +{ + struct uvc_entity *entity; + + mutex_lock(&handle->chain->ctrl_mutex); + + if (!handle->pending_async_ctrls) { + mutex_unlock(&handle->chain->ctrl_mutex); + return; + } + + list_for_each_entry(entity, &handle->chain->dev->entities, list) { + unsigned int i; + + for (i = 0; i < entity->ncontrols; ++i) { + if (entity->controls[i].handle != handle) + continue; + uvc_ctrl_set_handle(handle, &entity->controls[i], NULL); + } + } + + WARN_ON(handle->pending_async_ctrls); + mutex_unlock(&handle->chain->ctrl_mutex); +} + /* * Cleanup device controls. */ diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index 18a7384b50ee..34b9843cec3a 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -563,6 +563,8 @@ static int uvc_v4l2_release(struct file *file) uvc_trace(UVC_TRACE_CALLS, "uvc_v4l2_release\n"); + uvc_ctrl_cleanup_fh(handle); + /* Only free resources if this is a privileged handle. */ if (uvc_has_privileges(handle)) uvc_queue_release(&stream->queue); diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h index a738486fd9d6..243caeb4a6d7 100644 --- a/drivers/media/usb/uvc/uvcvideo.h +++ b/drivers/media/usb/uvc/uvcvideo.h @@ -434,7 +434,11 @@ struct uvc_video_chain { struct uvc_entity *processing; /* Processing unit */ struct uvc_entity *selector; /* Selector unit */ - struct mutex ctrl_mutex; /* Protects ctrl.info */ + struct mutex ctrl_mutex; /* + * Protects ctrl.info, + * ctrl.handle and + * uvc_fh.pending_async_ctrls + */ struct v4l2_prio_state prio; /* V4L2 priority state */ u32 caps; /* V4L2 chain-wide caps */ @@ -626,6 +630,7 @@ struct uvc_fh { struct uvc_video_chain *chain; struct uvc_streaming *stream; enum uvc_handle_state state; + unsigned int pending_async_ctrls; }; struct uvc_driver { @@ -792,6 +797,8 @@ int uvc_ctrl_set(struct uvc_fh *handle, struct v4l2_ext_control *xctrl); int uvc_xu_ctrl_query(struct uvc_video_chain *chain, struct uvc_xu_control_query *xqry); +void uvc_ctrl_cleanup_fh(struct uvc_fh *handle); + /* Utility functions */ void uvc_simplify_fraction(u32 *numerator, u32 *denominator, unsigned int n_terms, unsigned int threshold); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] nilfs2: do not force clear folio if buffer is referenced
by Liu Chuang 26 Mar '25

26 Mar '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.14-rc1 commit ca76bb226bf47ff04c782cacbd299f12ddee1ec1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBK0 CVE: CVE-2025-21722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------- Patch series "nilfs2: protect busy buffer heads from being force-cleared". This series fixes the buffer head state inconsistency issues reported by syzbot that occurs when the filesystem is corrupted and falls back to read-only, and the associated buffer head use-after-free issue. This patch (of 2): Syzbot has reported that after nilfs2 detects filesystem corruption and falls back to read-only, inconsistencies in the buffer state may occur. One of the inconsistencies is that when nilfs2 calls mark_buffer_dirty() to set a data or metadata buffer as dirty, but it detects that the buffer is not in the uptodate state: WARNING: CPU: 0 PID: 6049 at fs/buffer.c:1177 mark_buffer_dirty+0x2e5/0x520 fs/buffer.c:1177 ... Call Trace: <TASK> nilfs_palloc_commit_alloc_entry+0x4b/0x160 fs/nilfs2/alloc.c:598 nilfs_ifile_create_inode+0x1dd/0x3a0 fs/nilfs2/ifile.c:73 nilfs_new_inode+0x254/0x830 fs/nilfs2/inode.c:344 nilfs_mkdir+0x10d/0x340 fs/nilfs2/namei.c:218 vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257 do_mkdirat+0x264/0x3a0 fs/namei.c:4280 __do_sys_mkdirat fs/namei.c:4295 [inline] __se_sys_mkdirat fs/namei.c:4293 [inline] __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The other is when nilfs_btree_propagate(), which propagates the dirty state to the ancestor nodes of a b-tree that point to a dirty buffer, detects that the origin buffer is not dirty, even though it should be: WARNING: CPU: 0 PID: 5245 at fs/nilfs2/btree.c:2089 nilfs_btree_propagate+0xc79/0xdf0 fs/nilfs2/btree.c:2089 ... Call Trace: <TASK> nilfs_bmap_propagate+0x75/0x120 fs/nilfs2/bmap.c:345 nilfs_collect_file_data+0x4d/0xd0 fs/nilfs2/segment.c:587 nilfs_segctor_apply_buffers+0x184/0x340 fs/nilfs2/segment.c:1006 nilfs_segctor_scan_file+0x28c/0xa50 fs/nilfs2/segment.c:1045 nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1216 [inline] nilfs_segctor_collect fs/nilfs2/segment.c:1540 [inline] nilfs_segctor_do_construct+0x1c28/0x6b90 fs/nilfs2/segment.c:2115 nilfs_segctor_construct+0x181/0x6b0 fs/nilfs2/segment.c:2479 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2587 [inline] nilfs_segctor_thread+0x69e/0xe80 fs/nilfs2/segment.c:2701 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Both of these issues are caused by the callbacks that handle the page/folio write requests, forcibly clear various states, including the working state of the buffers they hold, at unexpected times when they detect read-only fallback. Fix these issues by checking if the buffer is referenced before clearing the page/folio state, and skipping the clear if it is. Link: https://lkml.kernel.org/r/20250107200202.6432-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20250107200202.6432-2-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b2b14916b77acf8626d7 Reported-by: syzbot+d98fd19acd08b36ff422(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d98fd19acd08b36ff422 Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") Tested-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/nilfs2/page.c [Due to previous commits not merged.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- fs/nilfs2/page.c | 36 +++++++++++++++++++++++++++++++----- 1 file changed, 31 insertions(+), 5 deletions(-) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index cc3308d1c61d..78661186c360 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -383,6 +383,11 @@ void nilfs_clear_dirty_pages(struct address_space *mapping, bool silent) * nilfs_clear_dirty_page - discard dirty page * @page: dirty page that will be discarded * @silent: suppress [true] or print [false] warning messages + * + * nilfs_clear_dirty_page() clears working states including dirty state for + * the page and its buffers. If the page has buffers, clear only if it is + * confirmed that none of the buffer heads are busy (none have valid + * references and none are locked). */ void nilfs_clear_dirty_page(struct page *page, bool silent) { @@ -396,18 +401,35 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) "discard dirty page: offset=%lld, ino=%lu", page_offset(page), inode->i_ino); - ClearPageUptodate(page); - ClearPageMappedToDisk(page); - ClearPageChecked(page); - if (page_has_buffers(page)) { struct buffer_head *bh, *head; const unsigned long clear_bits = (BIT(BH_Uptodate) | BIT(BH_Dirty) | BIT(BH_Mapped) | BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) | BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected)); + bool busy, invalidated = false; - bh = head = page_buffers(page); + head = page_buffers(page); + +recheck_buffers: + busy = false; + bh = head; + do { + if (atomic_read(&bh->b_count) | buffer_locked(bh)) { + busy = true; + break; + } + } while (bh = bh->b_this_page, bh != head); + + if (busy) { + if (invalidated) + return; + invalidate_bh_lrus(); + invalidated = true; + goto recheck_buffers; + } + + bh = head; do { lock_buffer(bh); if (!silent) @@ -420,6 +442,10 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) } while (bh = bh->b_this_page, bh != head); } + ClearPageUptodate(page); + ClearPageMappedToDisk(page); + ClearPageChecked(page); + __nilfs_clear_page_dirty(page); } -- 2.34.1

2 1

[PATCH OLK-5.10] nilfs2: do not force clear folio if buffer is referenced
by Liu Chuang 26 Mar '25

26 Mar '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.14-rc1 commit ca76bb226bf47ff04c782cacbd299f12ddee1ec1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBK0 CVE: CVE-2025-21722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------- Patch series "nilfs2: protect busy buffer heads from being force-cleared". This series fixes the buffer head state inconsistency issues reported by syzbot that occurs when the filesystem is corrupted and falls back to read-only, and the associated buffer head use-after-free issue. This patch (of 2): Syzbot has reported that after nilfs2 detects filesystem corruption and falls back to read-only, inconsistencies in the buffer state may occur. One of the inconsistencies is that when nilfs2 calls mark_buffer_dirty() to set a data or metadata buffer as dirty, but it detects that the buffer is not in the uptodate state: WARNING: CPU: 0 PID: 6049 at fs/buffer.c:1177 mark_buffer_dirty+0x2e5/0x520 fs/buffer.c:1177 ... Call Trace: <TASK> nilfs_palloc_commit_alloc_entry+0x4b/0x160 fs/nilfs2/alloc.c:598 nilfs_ifile_create_inode+0x1dd/0x3a0 fs/nilfs2/ifile.c:73 nilfs_new_inode+0x254/0x830 fs/nilfs2/inode.c:344 nilfs_mkdir+0x10d/0x340 fs/nilfs2/namei.c:218 vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257 do_mkdirat+0x264/0x3a0 fs/namei.c:4280 __do_sys_mkdirat fs/namei.c:4295 [inline] __se_sys_mkdirat fs/namei.c:4293 [inline] __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The other is when nilfs_btree_propagate(), which propagates the dirty state to the ancestor nodes of a b-tree that point to a dirty buffer, detects that the origin buffer is not dirty, even though it should be: WARNING: CPU: 0 PID: 5245 at fs/nilfs2/btree.c:2089 nilfs_btree_propagate+0xc79/0xdf0 fs/nilfs2/btree.c:2089 ... Call Trace: <TASK> nilfs_bmap_propagate+0x75/0x120 fs/nilfs2/bmap.c:345 nilfs_collect_file_data+0x4d/0xd0 fs/nilfs2/segment.c:587 nilfs_segctor_apply_buffers+0x184/0x340 fs/nilfs2/segment.c:1006 nilfs_segctor_scan_file+0x28c/0xa50 fs/nilfs2/segment.c:1045 nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1216 [inline] nilfs_segctor_collect fs/nilfs2/segment.c:1540 [inline] nilfs_segctor_do_construct+0x1c28/0x6b90 fs/nilfs2/segment.c:2115 nilfs_segctor_construct+0x181/0x6b0 fs/nilfs2/segment.c:2479 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2587 [inline] nilfs_segctor_thread+0x69e/0xe80 fs/nilfs2/segment.c:2701 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Both of these issues are caused by the callbacks that handle the page/folio write requests, forcibly clear various states, including the working state of the buffers they hold, at unexpected times when they detect read-only fallback. Fix these issues by checking if the buffer is referenced before clearing the page/folio state, and skipping the clear if it is. Link: https://lkml.kernel.org/r/20250107200202.6432-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20250107200202.6432-2-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b2b14916b77acf8626d7 Reported-by: syzbot+d98fd19acd08b36ff422(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d98fd19acd08b36ff422 Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") Tested-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/nilfs2/page.c [Conflicts due to previous commits not merged.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- fs/nilfs2/page.c | 34 +++++++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 5 deletions(-) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index d2d6d5c761e8..3b97d2f51ec9 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -390,6 +390,11 @@ void nilfs_clear_dirty_pages(struct address_space *mapping, bool silent) * nilfs_clear_dirty_page - discard dirty page * @page: dirty page that will be discarded * @silent: suppress [true] or print [false] warning messages + * + * nilfs_clear_dirty_page() clears working states including dirty state for + * the page and its buffers. If the page has buffers, clear only if it is + * confirmed that none of the buffer heads are busy (none have valid + * references and none are locked). */ void nilfs_clear_dirty_page(struct page *page, bool silent) { @@ -402,10 +407,6 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) nilfs_warn(sb, "discard dirty page: offset=%lld, ino=%lu", page_offset(page), inode->i_ino); - ClearPageUptodate(page); - ClearPageMappedToDisk(page); - ClearPageChecked(page); - if (page_has_buffers(page)) { struct buffer_head *bh, *head; const unsigned long clear_bits = @@ -413,8 +414,28 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) | BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected) | BIT(BH_Delay)); + bool busy, invalidated = false; - bh = head = page_buffers(page); + head = page_buffers(page); +recheck_buffers: + busy = false; + bh = head; + do { + if (atomic_read(&bh->b_count) | buffer_locked(bh)) { + busy = true; + break; + } + } while (bh = bh->b_this_page, bh != head); + + if (busy) { + if (invalidated) + return; + invalidate_bh_lrus(); + invalidated = true; + goto recheck_buffers; + } + + bh = head; do { lock_buffer(bh); if (!silent) @@ -427,6 +448,9 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) } while (bh = bh->b_this_page, bh != head); } + ClearPageUptodate(page); + ClearPageMappedToDisk(page); + ClearPageChecked(page); __nilfs_clear_page_dirty(page); } -- 2.34.1

2 1

[PATCH OLK-6.6] nilfs2: do not force clear folio if buffer is referenced
by Liu Chuang 26 Mar '25

26 Mar '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.14-rc1 commit ca76bb226bf47ff04c782cacbd299f12ddee1ec1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBK0 CVE: CVE-2025-21722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------- Patch series "nilfs2: protect busy buffer heads from being force-cleared". This series fixes the buffer head state inconsistency issues reported by syzbot that occurs when the filesystem is corrupted and falls back to read-only, and the associated buffer head use-after-free issue. This patch (of 2): Syzbot has reported that after nilfs2 detects filesystem corruption and falls back to read-only, inconsistencies in the buffer state may occur. One of the inconsistencies is that when nilfs2 calls mark_buffer_dirty() to set a data or metadata buffer as dirty, but it detects that the buffer is not in the uptodate state: WARNING: CPU: 0 PID: 6049 at fs/buffer.c:1177 mark_buffer_dirty+0x2e5/0x520 fs/buffer.c:1177 ... Call Trace: <TASK> nilfs_palloc_commit_alloc_entry+0x4b/0x160 fs/nilfs2/alloc.c:598 nilfs_ifile_create_inode+0x1dd/0x3a0 fs/nilfs2/ifile.c:73 nilfs_new_inode+0x254/0x830 fs/nilfs2/inode.c:344 nilfs_mkdir+0x10d/0x340 fs/nilfs2/namei.c:218 vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257 do_mkdirat+0x264/0x3a0 fs/namei.c:4280 __do_sys_mkdirat fs/namei.c:4295 [inline] __se_sys_mkdirat fs/namei.c:4293 [inline] __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The other is when nilfs_btree_propagate(), which propagates the dirty state to the ancestor nodes of a b-tree that point to a dirty buffer, detects that the origin buffer is not dirty, even though it should be: WARNING: CPU: 0 PID: 5245 at fs/nilfs2/btree.c:2089 nilfs_btree_propagate+0xc79/0xdf0 fs/nilfs2/btree.c:2089 ... Call Trace: <TASK> nilfs_bmap_propagate+0x75/0x120 fs/nilfs2/bmap.c:345 nilfs_collect_file_data+0x4d/0xd0 fs/nilfs2/segment.c:587 nilfs_segctor_apply_buffers+0x184/0x340 fs/nilfs2/segment.c:1006 nilfs_segctor_scan_file+0x28c/0xa50 fs/nilfs2/segment.c:1045 nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1216 [inline] nilfs_segctor_collect fs/nilfs2/segment.c:1540 [inline] nilfs_segctor_do_construct+0x1c28/0x6b90 fs/nilfs2/segment.c:2115 nilfs_segctor_construct+0x181/0x6b0 fs/nilfs2/segment.c:2479 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2587 [inline] nilfs_segctor_thread+0x69e/0xe80 fs/nilfs2/segment.c:2701 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Both of these issues are caused by the callbacks that handle the page/folio write requests, forcibly clear various states, including the working state of the buffers they hold, at unexpected times when they detect read-only fallback. Fix these issues by checking if the buffer is referenced before clearing the page/folio state, and skipping the clear if it is. Link: https://lkml.kernel.org/r/20250107200202.6432-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20250107200202.6432-2-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b2b14916b77acf8626d7 Reported-by: syzbot+d98fd19acd08b36ff422(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d98fd19acd08b36ff422 Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") Tested-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/nilfs2/page.c [Conflicts due to previous commits not merged.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- fs/nilfs2/page.c | 34 +++++++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 5 deletions(-) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index d2d6d5c761e8..3b97d2f51ec9 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -390,6 +390,11 @@ void nilfs_clear_dirty_pages(struct address_space *mapping, bool silent) * nilfs_clear_dirty_page - discard dirty page * @page: dirty page that will be discarded * @silent: suppress [true] or print [false] warning messages + * + * nilfs_clear_dirty_page() clears working states including dirty state for + * the page and its buffers. If the page has buffers, clear only if it is + * confirmed that none of the buffer heads are busy (none have valid + * references and none are locked). */ void nilfs_clear_dirty_page(struct page *page, bool silent) { @@ -402,10 +407,6 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) nilfs_warn(sb, "discard dirty page: offset=%lld, ino=%lu", page_offset(page), inode->i_ino); - ClearPageUptodate(page); - ClearPageMappedToDisk(page); - ClearPageChecked(page); - if (page_has_buffers(page)) { struct buffer_head *bh, *head; const unsigned long clear_bits = @@ -413,8 +414,28 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) | BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected) | BIT(BH_Delay)); + bool busy, invalidated = false; - bh = head = page_buffers(page); + head = page_buffers(page); +recheck_buffers: + busy = false; + bh = head; + do { + if (atomic_read(&bh->b_count) | buffer_locked(bh)) { + busy = true; + break; + } + } while (bh = bh->b_this_page, bh != head); + + if (busy) { + if (invalidated) + return; + invalidate_bh_lrus(); + invalidated = true; + goto recheck_buffers; + } + + bh = head; do { lock_buffer(bh); if (!silent) @@ -427,6 +448,9 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) } while (bh = bh->b_this_page, bh != head); } + ClearPageUptodate(page); + ClearPageMappedToDisk(page); + ClearPageChecked(page); __nilfs_clear_page_dirty(page); } -- 2.34.1

2 1

[PATCH OLK-6.6] ata: libata-sff: Ensure that we cannot write outside the allocated buffer
by Zheng Qixing 26 Mar '25

26 Mar '25

From: Niklas Cassel <cassel(a)kernel.org> stable inclusion from stable-v6.6.78 commit d5e6e3000309359eae2a17117aa6e3c44897bf6c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5G CVE: CVE-2025-21738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit 6e74e53b34b6dec5a50e1404e2680852ec6768d2 upstream. reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len set to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to ATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to write outside the allocated buffer, overwriting random memory. While a ATA device is supposed to abort a ATA_NOP command, there does seem to be a bug either in libata-sff or QEMU, where either this status is not set, or the status is cleared before read by ata_sff_hsm_move(). Anyway, that is most likely a separate bug. Looking at __atapi_pio_bytes(), it already has a safety check to ensure that __atapi_pio_bytes() cannot write outside the allocated buffer. Add a similar check to ata_pio_sector(), such that also ata_pio_sector() cannot write outside the allocated buffer. Cc: stable(a)vger.kernel.org Reported-by: reveliofuzzing <reveliofuzzing(a)gmail.com> Closes: https://lore.kernel.org/linux-ide/CA+-ZZ_jTgxh3bS7m+KX07_EWckSnW3N2adX3KV63… Link: https://lore.kernel.org/r/20250127154303.15567-2-cassel@kernel.org Signed-off-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/ata/libata-sff.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c index 8fcc622fcb3d..9b6529f2dfcb 100644 --- a/drivers/ata/libata-sff.c +++ b/drivers/ata/libata-sff.c @@ -602,7 +602,7 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) { struct ata_port *ap = qc->ap; struct page *page; - unsigned int offset; + unsigned int offset, count; if (!qc->cursg) { qc->curbytes = qc->nbytes; @@ -618,25 +618,27 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) page = nth_page(page, (offset >> PAGE_SHIFT)); offset %= PAGE_SIZE; - trace_ata_sff_pio_transfer_data(qc, offset, qc->sect_size); + /* don't overrun current sg */ + count = min(qc->cursg->length - qc->cursg_ofs, qc->sect_size); + + trace_ata_sff_pio_transfer_data(qc, offset, count); /* * Split the transfer when it splits a page boundary. Note that the * split still has to be dword aligned like all ATA data transfers. */ WARN_ON_ONCE(offset % 4); - if (offset + qc->sect_size > PAGE_SIZE) { + if (offset + count > PAGE_SIZE) { unsigned int split_len = PAGE_SIZE - offset; ata_pio_xfer(qc, page, offset, split_len); - ata_pio_xfer(qc, nth_page(page, 1), 0, - qc->sect_size - split_len); + ata_pio_xfer(qc, nth_page(page, 1), 0, count - split_len); } else { - ata_pio_xfer(qc, page, offset, qc->sect_size); + ata_pio_xfer(qc, page, offset, count); } - qc->curbytes += qc->sect_size; - qc->cursg_ofs += qc->sect_size; + qc->curbytes += count; + qc->cursg_ofs += count; if (qc->cursg_ofs == qc->cursg->length) { qc->cursg = sg_next(qc->cursg); -- 2.39.2

2 1

[PATCH OLK-5.10 0/3] Sidecarless
by Xiaomeng Zhang 26 Mar '25

26 Mar '25

Andrii Nakryiko (1): bpf: make uniform use of array->elem_size everywhere in arraymap.c Rhys Rustad-Elliott (2): bpf: Fix elem_size not being set for inner maps selftests/bpf: Add access_inner_map selftest kernel/bpf/arraymap.c | 14 +++--- kernel/bpf/map_in_map.c | 8 +++- .../bpf/prog_tests/inner_array_lookup.c | 31 +++++++++++++ .../selftests/bpf/progs/inner_array_lookup.c | 45 +++++++++++++++++++ 4 files changed, 90 insertions(+), 8 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c create mode 100644 tools/testing/selftests/bpf/progs/inner_array_lookup.c -- 2.34.1

2 4

[PATCH OLK-6.6] block: don't revert iter for -EIOCBQUEUED
by Zheng Qixing 26 Mar '25

26 Mar '25

From: Jens Axboe <axboe(a)kernel.dk> stable inclusion from stable-v6.6.78 commit 84671b0630ccb46ae9f1f99a45c7d63ffcd6a474 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRECT CVE: CVE-2025-21832 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit b13ee668e8280ca5b07f8ce2846b9957a8a10853 upstream. blkdev_read_iter() has a few odd checks, like gating the position and count adjustment on whether or not the result is bigger-than-or-equal to zero (where bigger than makes more sense), and not checking the return value of blkdev_direct_IO() before doing an iov_iter_revert(). The latter can lead to attempting to revert with a negative value, which when passed to iov_iter_revert() as an unsigned value will lead to throwing a WARN_ON() because unroll is bigger than MAX_RW_COUNT. Be sane and don't revert for -EIOCBQUEUED, like what is done in other spots. Cc: stable(a)vger.kernel.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/fops.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/block/fops.c b/block/fops.c index 33b724b1d963..cda9978ebf67 100644 --- a/block/fops.c +++ b/block/fops.c @@ -730,11 +730,12 @@ static ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to) file_accessed(iocb->ki_filp); ret = blkdev_direct_IO(iocb, to); - if (ret >= 0) { + if (ret > 0) { iocb->ki_pos += ret; count -= ret; } - iov_iter_revert(to, count - iov_iter_count(to)); + if (ret != -EIOCBQUEUED) + iov_iter_revert(to, count - iov_iter_count(to)); if (ret < 0 || !count) goto reexpand; } -- 2.39.2

2 1

[PATCH OLK-5.10 0/3] Sidecarless
by Xiaomeng Zhang 26 Mar '25

26 Mar '25

Andrii Nakryiko (1): bpf: make uniform use of array->elem_size everywhere in arraymap.c Rhys Rustad-Elliott (2): bpf: Fix elem_size not being set for inner maps selftests/bpf: Add access_inner_map selftest kernel/bpf/arraymap.c | 14 +++--- kernel/bpf/map_in_map.c | 8 +++- .../bpf/prog_tests/inner_array_lookup.c | 31 +++++++++++++ .../selftests/bpf/progs/inner_array_lookup.c | 45 +++++++++++++++++++ 4 files changed, 90 insertions(+), 8 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c create mode 100644 tools/testing/selftests/bpf/progs/inner_array_lookup.c -- 2.34.1

2 4

[openeuler:OLK-5.10 2821/2821] block/bio.o: warning: objtool: bvec_alloc()+0xf5: unreachable instruction
by kernel test robot 26 Mar '25

26 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0d616a77cb5f7198cca524a24f717f59ad51b41b commit: 958384da6a734ebe7a49d0fafcea86968390e9d9 [2821/2821] block: use bi_max_vecs to find the bvec pool config: x86_64-buildonly-randconfig-005-20250325 (https://download.01.org/0day-ci/archive/20250326/202503260949.1ZCW1y7H-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250326/202503260949.1ZCW1y7H-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503260949.1ZCW1y7H-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/bio.o: warning: objtool: bvec_alloc()+0xf5: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49374
by Wang Liang 26 Mar '25

26 Mar '25

Hoang Le (2): tipc: add extack messages for bearer/media failure tipc: check attribute length for bearer name net/tipc/bearer.c | 53 ++++++++++++++++++++++++++++++++++++----------- 1 file changed, 41 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] net_sched: sch_sfq: don't allow 1 packet limit
by Wang Liang 26 Mar '25

26 Mar '25

From: Octavian Purdila <tavip(a)google.com> mainline inclusion from mainline-v6.14-rc1 commit 10685681bafce6febb39770f3387621bf5d67d0b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBVH45 CVE: CVE-2024-57996 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The current implementation does not work correctly with a limit of 1. iproute2 actually checks for this and this patch adds the check in kernel as well. This fixes the following syzkaller reported crash: UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:210:6 index 65535 is out of range for type 'struct sfq_head[128]' CPU: 0 PID: 2569 Comm: syz-executor101 Not tainted 5.10.0-smp-DEV #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x125/0x19f lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:148 [inline] __ubsan_handle_out_of_bounds+0xed/0x120 lib/ubsan.c:347 sfq_link net/sched/sch_sfq.c:210 [inline] sfq_dec+0x528/0x600 net/sched/sch_sfq.c:238 sfq_dequeue+0x39b/0x9d0 net/sched/sch_sfq.c:500 sfq_reset+0x13/0x50 net/sched/sch_sfq.c:525 qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026 tbf_reset+0x3d/0x100 net/sched/sch_tbf.c:319 qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026 dev_reset_queue+0x8c/0x140 net/sched/sch_generic.c:1296 netdev_for_each_tx_queue include/linux/netdevice.h:2350 [inline] dev_deactivate_many+0x6dc/0xc20 net/sched/sch_generic.c:1362 __dev_close_many+0x214/0x350 net/core/dev.c:1468 dev_close_many+0x207/0x510 net/core/dev.c:1506 unregister_netdevice_many+0x40f/0x16b0 net/core/dev.c:10738 unregister_netdevice_queue+0x2be/0x310 net/core/dev.c:10695 unregister_netdevice include/linux/netdevice.h:2893 [inline] __tun_detach+0x6b6/0x1600 drivers/net/tun.c:689 tun_detach drivers/net/tun.c:705 [inline] tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3640 __fput+0x203/0x840 fs/file_table.c:280 task_work_run+0x129/0x1b0 kernel/task_work.c:185 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0x5ce/0x2200 kernel/exit.c:931 do_group_exit+0x144/0x310 kernel/exit.c:1046 __do_sys_exit_group kernel/exit.c:1057 [inline] __se_sys_exit_group kernel/exit.c:1055 [inline] __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1055 do_syscall_64+0x6c/0xd0 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fe5e7b52479 Code: Unable to access opcode bytes at RIP 0x7fe5e7b5244f. RSP: 002b:00007ffd3c800398 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe5e7b52479 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 00007fe5e7bcd2d0 R08: ffffffffffffffb8 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe5e7bcd2d0 R13: 0000000000000000 R14: 00007fe5e7bcdd20 R15: 00007fe5e7b24270 The crash can be also be reproduced with the following (with a tc recompiled to allow for sfq limits of 1): tc qdisc add dev dummy0 handle 1: root tbf rate 1Kbit burst 100b lat 1s ../iproute2-6.9.0/tc/tc qdisc add dev dummy0 handle 2: parent 1:10 sfq limit 1 ifconfig dummy0 up ping -I dummy0 -f -c2 -W0.1 8.8.8.8 sleep 1 Scenario that triggers the crash: * the first packet is sent and queued in TBF and SFQ; qdisc qlen is 1 * TBF dequeues: it peeks from SFQ which moves the packet to the gso_skb list and keeps qdisc qlen set to 1. TBF is out of tokens so it schedules itself for later. * the second packet is sent and TBF tries to queues it to SFQ. qdisc qlen is now 2 and because the SFQ limit is 1 the packet is dropped by SFQ. At this point qlen is 1, and all of the SFQ slots are empty, however q->tail is not NULL. At this point, assuming no more packets are queued, when sch_dequeue runs again it will decrement the qlen for the current empty slot causing an underflow and the subsequent out of bounds access. Reported-by: syzbot <syzkaller(a)googlegroups.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Octavian Purdila <tavip(a)google.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241204030520.2084663-2-tavip@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/sched/sch_sfq.c [conflicts due to not merge e4650d7ae425 ("net_sched: sch_sfq: handle bigger packets")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sched/sch_sfq.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c index 74f697c4a4d3..9fb5ee64834a 100644 --- a/net/sched/sch_sfq.c +++ b/net/sched/sch_sfq.c @@ -658,6 +658,9 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) if (!p) return -ENOMEM; } + if (ctl->limit == 1) + return -EINVAL; + sch_tree_lock(sch); if (ctl->quantum) { q->quantum = ctl->quantum; -- 2.34.1

2 1

[openeuler:OLK-5.10 2821/2821] io_uring/io_uring.o: warning: objtool: __io_uring_free()+0x69: unreachable instruction
by kernel test robot 26 Mar '25

26 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0d616a77cb5f7198cca524a24f717f59ad51b41b commit: 2c4dc5d73facd120aab1305ec14eef4f9a524812 [2821/2821] io_uring/tctx: work around xa_store() allocation error issue config: x86_64-buildonly-randconfig-005-20250325 (https://download.01.org/0day-ci/archive/20250326/202503260613.Q2n0VF4Y-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250326/202503260613.Q2n0VF4Y-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503260613.Q2n0VF4Y-lkp@intel.com/ All warnings (new ones prefixed by >>): >> io_uring/io_uring.o: warning: objtool: __io_uring_free()+0x69: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2821/2821] kernel/rcu/tree.o: warning: objtool: rcu_iw_handler()+0x9e: unreachable instruction
by kernel test robot 26 Mar '25

26 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0d616a77cb5f7198cca524a24f717f59ad51b41b commit: 44a47613c5cbb589453938cf7bf355d8043fa53f [2821/2821] irq_work: Cleanup config: x86_64-buildonly-randconfig-005-20250325 (https://download.01.org/0day-ci/archive/20250326/202503260202.467f83vo-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250326/202503260202.467f83vo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503260202.467f83vo-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/rcu/tree.o: warning: objtool: rcu_iw_handler()+0x9e: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1514/1514] mm/memory.c:4489:43: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a0f7a942ef42e73c8748687d469ed61f380bf0cf commit: ae0cd4d46ced733c522f2cc6da2d380d69123fc4 [1514/1514] mm: parallelize clear_gigantic_page config: x86_64-randconfig-121-20250325 (https://download.01.org/0day-ci/archive/20250325/202503252231.BsBQmABZ-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503252231.BsBQmABZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503252231.BsBQmABZ-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/memory.c:4489:43: sparse: sparse: Using plain integer as NULL pointer mm/memory.c:4560:22: sparse: sparse: cast removes address space '__user' of expression mm/memory.c:833:17: sparse: sparse: context imbalance in 'copy_pte_range' - different lock contexts for basic block mm/memory.c:1436:16: sparse: sparse: context imbalance in '__get_locked_pte' - different lock contexts for basic block mm/memory.c:1478:9: sparse: sparse: context imbalance in 'insert_page' - different lock contexts for basic block mm/memory.c:1579:9: sparse: sparse: context imbalance in 'insert_pfn' - different lock contexts for basic block mm/memory.c:1746:17: sparse: sparse: context imbalance in 'remap_pte_range' - different lock contexts for basic block mm/memory.c:1975:17: sparse: sparse: context imbalance in 'apply_to_pte_range' - unexpected unlock mm/memory.c:2422:17: sparse: sparse: context imbalance in 'wp_pfn_shared' - unexpected unlock mm/memory.c:2484:19: sparse: sparse: context imbalance in 'do_wp_page' - different lock contexts for basic block mm/memory.c:3055:19: sparse: sparse: context imbalance in 'pte_alloc_one_map' - different lock contexts for basic block mm/memory.c:3295:17: sparse: sparse: context imbalance in 'finish_fault' - unexpected unlock mm/memory.c:3409:9: sparse: sparse: context imbalance in 'do_fault_around' - unexpected unlock mm/memory.c:4062:12: sparse: sparse: context imbalance in '__follow_pte_pmd' - different lock contexts for basic block mm/memory.c:4146:16: sparse: sparse: context imbalance in 'follow_pte_pmd' - different lock contexts for basic block mm/memory.c:4206:9: sparse: sparse: context imbalance in 'follow_phys' - unexpected unlock In file included from mm/memory.c:72: mm/memory.c: In function 'clear_huge_page': include/linux/ktask.h:123:35: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct cgp_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] 123 | .kc_thread_func = (ktask_thread_func)(thread_func), 22- | ^ include/linux/ktask.h:139:17: note: in expansion of macro 'KTASK_CTL_INITIALIZER' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) 25- | ^~~~~~~~~~~~~~~~~~~~~ mm/memory.c:4491:17: note: in expansion of macro 'DEFINE_KTASK_CTL' 4491 | DEFINE_KTASK_CTL(ctl, clear_gigantic_page_chunk, &args, | ^~~~~~~~~~~~~~~~ vim +4489 mm/memory.c 4480 4481 void clear_huge_page(struct page *page, 4482 unsigned long addr_hint, unsigned int pages_per_huge_page) 4483 { 4484 unsigned long addr = addr_hint & 4485 ~(((unsigned long)pages_per_huge_page << PAGE_SHIFT) - 1); 4486 4487 if (unlikely(pages_per_huge_page > MAX_ORDER_NR_PAGES)) { 4488 struct cgp_args args = {page, addr}; > 4489 struct ktask_node node = {0, pages_per_huge_page, 4490 page_to_nid(page)}; 4491 DEFINE_KTASK_CTL(ctl, clear_gigantic_page_chunk, &args, 4492 KTASK_MEM_CHUNK); 4493 4494 ktask_run_numa(&node, 1, &ctl); 4495 return; 4496 } 4497 4498 process_huge_page(addr_hint, pages_per_huge_page, clear_subpage, page); 4499 } 4500 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1514/1514] include/linux/bpf-cgroup.h:274:41: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a0f7a942ef42e73c8748687d469ed61f380bf0cf commit: f42ee093be2980f2689ea7a170d580364820f48b [1514/1514] bpf/test_run: support cgroup local storage config: x86_64-randconfig-122-20250325 (https://download.01.org/0day-ci/archive/20250325/202503252213.JKA9UxCh-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503252213.JKA9UxCh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503252213.JKA9UxCh-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) net/bpf/test_run.c: note: in included file (through include/linux/cgroup-defs.h, include/linux/cgroup.h, include/net/netprio_cgroup.h, ...): >> include/linux/bpf-cgroup.h:274:41: sparse: sparse: Using plain integer as NULL pointer vim +274 include/linux/bpf-cgroup.h fdb5c4531c1e0e Sean Young 2018-06-19 267 aa0ad5b0391e26 Roman Gushchin 2018-08-02 268 static inline void bpf_cgroup_storage_set(struct bpf_cgroup_storage *storage) {} de9cbbaadba5ad Roman Gushchin 2018-08-02 269 static inline int bpf_cgroup_storage_assign(struct bpf_prog *prog, de9cbbaadba5ad Roman Gushchin 2018-08-02 270 struct bpf_map *map) { return 0; } de9cbbaadba5ad Roman Gushchin 2018-08-02 271 static inline void bpf_cgroup_storage_release(struct bpf_prog *prog, de9cbbaadba5ad Roman Gushchin 2018-08-02 272 struct bpf_map *map) {} de9cbbaadba5ad Roman Gushchin 2018-08-02 273 static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc( de9cbbaadba5ad Roman Gushchin 2018-08-02 @274 struct bpf_prog *prog) { return 0; } de9cbbaadba5ad Roman Gushchin 2018-08-02 275 static inline void bpf_cgroup_storage_free( de9cbbaadba5ad Roman Gushchin 2018-08-02 276 struct bpf_cgroup_storage *storage) {} de9cbbaadba5ad Roman Gushchin 2018-08-02 277 :::::: The code at line 274 was first introduced by commit :::::: de9cbbaadba5adf88a19e46df61f7054000838f6 bpf: introduce cgroup storage maps :::::: TO: Roman Gushchin <guro(a)fb.com> :::::: CC: Daniel Borkmann <daniel(a)iogearbox.net> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2820/2820] net/core/sock_map.c:1501:5: sparse: sparse: symbol 'sock_map_prog_lookup' was not declared. Should it be static?
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0d616a77cb5f7198cca524a24f717f59ad51b41b commit: 050383882de382969e4fb8362235749b232cccae [2820/2820] bpf: support BPF_PROG_QUERY for progs attached to sockmap config: x86_64-randconfig-123-20250325 (https://download.01.org/0day-ci/archive/20250325/202503252115.VoLdAs0Z-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503252115.VoLdAs0Z-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503252115.VoLdAs0Z-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> net/core/sock_map.c:1501:5: sparse: sparse: symbol 'sock_map_prog_lookup' was not declared. Should it be static? vim +/sock_map_prog_lookup +1501 net/core/sock_map.c 1500 > 1501 int sock_map_prog_lookup(struct bpf_map *map, struct bpf_prog ***pprog, 1502 u32 which) 1503 { 1504 struct sk_psock_progs *progs = sock_map_progs(map); 1505 1506 if (!progs) 1507 return -EOPNOTSUPP; 1508 1509 switch (which) { 1510 case BPF_SK_MSG_VERDICT: 1511 *pprog = &progs->msg_parser; 1512 break; 1513 case BPF_SK_SKB_STREAM_PARSER: 1514 *pprog = &progs->skb_parser; 1515 break; 1516 case BPF_SK_SKB_STREAM_VERDICT: 1517 *pprog = &progs->skb_verdict; 1518 break; 1519 default: 1520 return -EOPNOTSUPP; 1521 } 1522 return 0; 1523 } 1524 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2821/2821] arch/x86/kernel/paravirt.c:68:1: error: control reaches end of non-void function
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0d616a77cb5f7198cca524a24f717f59ad51b41b commit: 822da186955cbcd69b4715b8a307053e6c756f30 [2821/2821] x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() config: x86_64-buildonly-randconfig-003-20250325 (https://download.01.org/0day-ci/archive/20250325/202503252017.UYNRpRjt-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503252017.UYNRpRjt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503252017.UYNRpRjt-lkp@intel.com/ All errors (new ones prefixed by >>): arch/x86/kernel/paravirt.c: In function 'paravirt_patch_call': arch/x86/kernel/paravirt.c:65:9: error: implicit declaration of function '__text_gen_insn' [-Werror=implicit-function-declaration] 65 | __text_gen_insn(insn_buff, CALL_INSN_OPCODE, | ^~~~~~~~~~~~~~~ arch/x86/kernel/paravirt.c:65:36: error: 'CALL_INSN_OPCODE' undeclared (first use in this function) 65 | __text_gen_insn(insn_buff, CALL_INSN_OPCODE, | ^~~~~~~~~~~~~~~~ arch/x86/kernel/paravirt.c:65:36: note: each undeclared identifier is reported only once for each function it appears in arch/x86/kernel/paravirt.c:66:47: error: 'CALL_INSN_SIZE' undeclared (first use in this function) 66 | (void *)addr, target, CALL_INSN_SIZE); | ^~~~~~~~~~~~~~ >> arch/x86/kernel/paravirt.c:68:1: error: control reaches end of non-void function [-Werror=return-type] 68 | } | ^ cc1: some warnings being treated as errors vim +68 arch/x86/kernel/paravirt.c 19d36ccdc34f5e arch/i386/kernel/paravirt.c Andi Kleen 2007-07-22 61 1fc654cf6e04b4 arch/x86/kernel/paravirt.c Ingo Molnar 2019-04-25 62 static unsigned paravirt_patch_call(void *insn_buff, const void *target, abc745f85c1193 arch/x86/kernel/paravirt.c Juergen Gross 2018-08-28 63 unsigned long addr, unsigned len) 63f70270ccd981 arch/i386/kernel/paravirt.c Jeremy Fitzhardinge 2007-05-02 64 { 822da186955cbc arch/x86/kernel/paravirt.c Peter Zijlstra 2022-03-08 65 __text_gen_insn(insn_buff, CALL_INSN_OPCODE, 822da186955cbc arch/x86/kernel/paravirt.c Peter Zijlstra 2022-03-08 66 (void *)addr, target, CALL_INSN_SIZE); 822da186955cbc arch/x86/kernel/paravirt.c Peter Zijlstra 2022-03-08 67 return CALL_INSN_SIZE; 63f70270ccd981 arch/i386/kernel/paravirt.c Jeremy Fitzhardinge 2007-05-02 @68 } 63f70270ccd981 arch/i386/kernel/paravirt.c Jeremy Fitzhardinge 2007-05-02 69 :::::: The code at line 68 was first introduced by commit :::::: 63f70270ccd981ce40a8ff58c03a8c2e97e368be [PATCH] i386: PARAVIRT: add common patching machinery :::::: TO: Jeremy Fitzhardinge <jeremy(a)goop.org> :::::: CC: Andi Kleen <andi(a)basil.nowhere.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 3e8e3ea77f0dd528b080f91d615144093b741003
by kernel test robot 25 Mar '25

25 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 3e8e3ea77f0dd528b080f91d615144093b741003 !15582 CVE-2022-49508 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503251400.xG2WACIP-lkp@intel.com crypto/aegis128.o: warning: objtool: missing symbol for section .init.text mm/page_ext.o: warning: objtool: missing symbol for section .init.text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250324 | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-lo | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-void-u64)-aka-int-(-const)(struct-bpf_map-void-void-long-long-unsigned-int)-to-u64-(-)(u64 | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-void-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-l | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250324 | |-- drivers-soc-qcom-llcc-slice.c:warning:ret-may-be-used-uninitialized-in-this-function | |-- include-scsi-scsi_cmnd.h:warning:scsi_cmnd-may-be-used-uninitialized-in-this-function | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250324 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250324 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-051-20250324 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-055-20250324 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-r111-20250325 | `-- init-Kconfig:syntax-error |-- x86_64-allnoconfig | |-- Makefile:include-config-auto.conf.cmd:No-such-file-or-directory | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250324 | |-- Section-mismatch-in-reference-from-the-(unknown-reference)-(unknown)-to-the-(unknown-reference)-.irqentry.text:(unknown) | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250324 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250324 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250324 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration | `-- samples-vfio-mdev-mdpy-fb.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-005-20250324 | |-- crypto-aegis128.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_ext.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250324 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-defconfig | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized-in-this-function | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-101-20250325 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-102-20250325 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-103-20250325 | |-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-104-20250325 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-121-20250325 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:invalid-assignment: | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-122-20250325 | |-- block-blk-merge.c:sparse:sparse:symbol-blk_try_req_merge-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_issue-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_requeue-was-not-declared.-Should-it-be-static | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:invalid-assignment: | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-123-20250325 | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:invalid-assignment: | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used `-- x86_64-randconfig-161-20250325 |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 1444m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250324 gcc-8.5.0 arm64 randconfig-002-20250324 gcc-10.5.0 arm64 randconfig-003-20250324 gcc-14.2.0 arm64 randconfig-004-20250324 gcc-6.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250324 clang-20 x86_64 buildonly-randconfig-002-20250324 gcc-12 x86_64 buildonly-randconfig-003-20250324 clang-20 x86_64 buildonly-randconfig-004-20250324 clang-20 x86_64 buildonly-randconfig-005-20250324 clang-20 x86_64 buildonly-randconfig-006-20250324 clang-20 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2059/2059] drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:5: sparse: sparse: symbol 'tdm_service_run' was not declared. Should it be static?
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0278be80a99934144f0e708459f3475248f280c4 commit: 3ad98583441f7c8a2553e1e8d6340ed4397033e2 [2059/2059] crypto: tdm: Support dynamic protection for SCT and IDT by HYGON TDM config: x86_64-randconfig-121-20250325 (https://download.01.org/0day-ci/archive/20250325/202503251859.zDW2wWzp-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503251859.zDW2wWzp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503251859.zDW2wWzp-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:5: sparse: sparse: symbol 'tdm_service_run' was not declared. Should it be static? >> drivers/crypto/ccp/hygon/tdm-kernel-guard.c:212:5: sparse: sparse: symbol 'tdm_service_exit' was not declared. Should it be static? vim +/tdm_service_run +151 drivers/crypto/ccp/hygon/tdm-kernel-guard.c 150 > 151 int tdm_service_run(struct tdm_security_enhance *data) 152 { 153 int ret = 0; 154 struct addr_range_info *addr_range = NULL; 155 156 // Allocate memory for addr_range 157 addr_range = kzalloc(sizeof(struct addr_range_info) + sizeof(struct addr_info), GFP_KERNEL); 158 if (!addr_range) { 159 ret = -DYN_ERR_MEM; 160 pr_err("addr_range kzalloc memory failed\n"); 161 goto end; 162 } 163 164 // Fill in addr_range 165 addr_range->count = 1; 166 addr_range->addr[0].addr_start = data->vaddr; 167 addr_range->addr[0].length = data->size; 168 data->mem_range = addr_range; 169 170 // Context configuration 171 data->context |= TASK_CREATE_VADDR; 172 173 // Allocate memory for authcode 174 data->authcode = kzalloc(sizeof(struct authcode_2b) + AUTHCODE_MAX, GFP_KERNEL); 175 if (!data->authcode) { 176 ret = -DYN_ERR_MEM; 177 pr_err("authcode_2b kzalloc memory failed\n"); 178 goto free_addr_range_info; 179 } 180 181 data->authcode->len = AUTHCODE_MAX; 182 183 // Measurement data configuration 184 data->mdata.hash_algo = HASH_ALGO_SM3; 185 data->mdata.period_ms = 0; 186 ret = calc_expected_hash((uint8_t *)data->vaddr, data->size, 187 data->mdata.expected_measurement); 188 if (ret) { 189 pr_err("calculate expected hash failed!\n"); 190 goto free_authcode; 191 } 192 193 // Create and start tdm task 194 ret = tdm_task_create_and_run(data); 195 if (ret) { 196 pr_err("tdm_task_create_and_run failed!\n"); 197 goto free_authcode; 198 } 199 200 return ret; 201 202 free_authcode: 203 kfree(data->authcode); 204 data->authcode = NULL; 205 free_addr_range_info: 206 kfree(data->mem_range); 207 data->mem_range = NULL; 208 end: 209 return ret; 210 } 211 > 212 int tdm_service_exit(struct tdm_security_enhance *data) 213 { 214 int ret = 0; 215 int task_status = 0; 216 217 task_status = psp_startstop_measure_task(data->task_id, data->authcode, false); 218 if (task_status < 0) { 219 ret = task_status; 220 pr_err("task_id %d stop failed with 0x%x\n", data->task_id, ret); 221 goto end; 222 } 223 224 // Waiting for the task to end 225 msleep(40); 226 227 psp_destroy_measure_task(data->task_id, data->authcode); 228 229 kfree(data->authcode); 230 data->authcode = NULL; 231 kfree(data->mem_range); 232 data->mem_range = NULL; 233 end: 234 return ret; 235 } 236 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS 0278be80a99934144f0e708459f3475248f280c4
by kernel test robot 25 Mar '25

25 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 0278be80a99934144f0e708459f3475248f280c4 !15477 PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region() Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-virtcca_get_tmi_version | |-- drivers-coda-coda_pci.c:warning:Excess-function-parameter-pdev-description-in-virtcca_pci_get_rom_size | |-- drivers-coda-coda_pci.c:warning:Function-parameter-or-member-p-not-described-in-virtcca_pci_get_rom_size | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-defconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-001-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-002-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-003-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-052-20250324 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-053-20250324 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-054-20250324 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- loongarch-allmodconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allnoconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allyesconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-defconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-001-20250324 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-002-20250324 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allyesconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size |-- x86_64-randconfig-101-20250325 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-102-20250325 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-103-20250325 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size |-- x86_64-randconfig-104-20250325 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-121-20250325 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-122-20250325 | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-123-20250325 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used `-- x86_64-randconfig-161-20250324 |-- mm-kasan-kasan_test.c-rcu_uaf_reclaim()-error:dereferencing-freed-memory-fp-(line-) `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used elapsed time: 1445m configs tested: 21 configs skipped: 123 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250324 gcc-8.5.0 arm64 randconfig-002-20250324 clang-14 arm64 randconfig-003-20250324 clang-21 arm64 randconfig-004-20250324 gcc-6.5.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250324 gcc-14.2.0 loongarch randconfig-002-20250324 gcc-14.2.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250324 clang-20 x86_64 buildonly-randconfig-002-20250324 gcc-12 x86_64 buildonly-randconfig-003-20250324 clang-20 x86_64 buildonly-randconfig-004-20250324 clang-20 x86_64 buildonly-randconfig-005-20250324 clang-20 x86_64 buildonly-randconfig-006-20250324 clang-20 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ALSA: oss: Fix PCM OSS buffer allocation overflow
by Jinjiang Tu 25 Mar '25

25 Mar '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v4.19.237 commit a63af1baf0a5e11827db60e3127f87e437cab6e5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1SP CVE: CVE-2022-49292 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit efb6402c3c4a7c26d97c92d70186424097b6e366 upstream. We've got syzbot reports hitting INT_MAX overflow at vmalloc() allocation that is called from snd_pcm_plug_alloc(). Although we apply the restrictions to input parameters, it's based only on the hw_params of the underlying PCM device. Since the PCM OSS layer allocates a temporary buffer for the data conversion, the size may become unexpectedly large when more channels or higher rates is given; in the reported case, it went over INT_MAX, hence it hits WARN_ON(). This patch is an attempt to avoid such an overflow and an allocation for too large buffers. First off, it adds the limit of 1MB as the upper bound for period bytes. This must be large enough for all use cases, and we really don't want to handle a larger temporary buffer than this size. The size check is performed at two places, where the original period bytes is calculated and where the plugin buffer size is calculated. In addition, the driver uses array_size() and array3_size() for multiplications to catch overflows for the converted period size and buffer bytes. Reported-by: syzbot+72732c532ac1454eeee9(a)syzkaller.appspotmail.com Suggested-by: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/00000000000085b1b305da5a66f3@google.com Link: https://lore.kernel.org/r/20220318082036.29699-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- sound/core/oss/pcm_oss.c | 12 ++++++++---- sound/core/oss/pcm_plugin.c | 5 ++++- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index 7f434a37d860..f22d239eebe4 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -789,6 +789,11 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream, if (oss_period_size < 16) return -EINVAL; + + /* don't allocate too large period; 1MB period must be enough */ + if (oss_period_size > 1024 * 1024) + return -ENOMEM; + runtime->oss.period_bytes = oss_period_size; runtime->oss.period_frames = 1; runtime->oss.periods = oss_periods; @@ -1053,10 +1058,9 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) goto failure; } #endif - oss_period_size *= oss_frame_size; - - oss_buffer_size = oss_period_size * runtime->oss.periods; - if (oss_buffer_size < 0) { + oss_period_size = array_size(oss_period_size, oss_frame_size); + oss_buffer_size = array_size(oss_period_size, runtime->oss.periods); + if (oss_buffer_size <= 0) { err = -EINVAL; goto failure; } diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c index 31cb2acf8afc..624aca32fe69 100644 --- a/sound/core/oss/pcm_plugin.c +++ b/sound/core/oss/pcm_plugin.c @@ -61,7 +61,10 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t } if ((width = snd_pcm_format_physical_width(format->format)) < 0) return width; - size = frames * format->channels * width; + size = array3_size(frames, format->channels, width); + /* check for too large period size once again */ + if (size > 1024 * 1024) + return -ENOMEM; if (snd_BUG_ON(size % 8)) return -ENXIO; size /= 8; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
by Jinjiang Tu 25 Mar '25

25 Mar '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.238 commit b0c56a0071116a37c24df998166c22a7e4684626 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3W0 CVE: CVE-2022-49243 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f590797fa3c1bccdd19e55441592a23b46aef449 ] This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak. Fixes: 531f67e41dcd ("ASoC: at91sam9g20ek-wm8731: convert to dt support") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Reviewed-by: Codrin Ciubotariu <codrin.ciubotariu(a)microchip.com> Link: https://lore.kernel.org/r/20220307124539.1743-1-linmq006@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- sound/soc/atmel/sam9g20_wm8731.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c index 98f93e79c654..5041f43ee5f7 100644 --- a/sound/soc/atmel/sam9g20_wm8731.c +++ b/sound/soc/atmel/sam9g20_wm8731.c @@ -225,6 +225,7 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev) cpu_np = of_parse_phandle(np, "atmel,ssc-controller", 0); if (!cpu_np) { dev_err(&pdev->dev, "dai and pcm info missing\n"); + of_node_put(codec_np); return -EINVAL; } at91sam9g20ek_dai.cpu_of_node = cpu_np; -- 2.43.0

2 1