- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] module: fix [e_shstrndx].sh_size=0 OOB access
by Xiangwei Li 15 Mar '25

15 Mar '25

From: Alexey Dobriyan <adobriyan(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit 391e982bfa632b8315235d8be9c0a81374c6a19c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP43S CVE: CVE-2022-49444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It is trivial to craft a module to trigger OOB access in this line: if (info->secstrings[strhdr->sh_size - 1] != '\0') { BUG: unable to handle page fault for address: ffffc90000aa0fff PGD 100000067 P4D 100000067 PUD 100066067 PMD 10436f067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 1215 Comm: insmod Not tainted 5.18.0-rc5-00007-g9bf578647087-dirty #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014 RIP: 0010:load_module+0x19b/0x2391 Fixes: ec2a29593c83 ("module: harden ELF info handling") Signed-off-by: Alexey Dobriyan <adobriyan(a)gmail.com> [rebased patch onto modules-next] Signed-off-by: Luis Chamberlain <mcgrof(a)kernel.org> Conflicts: kernel/module/main.c kernel/module.c [context conflict] Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- kernel/module.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/module.c b/kernel/module.c index e978debc93df..57b34c32a916 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -3053,6 +3053,10 @@ static int elf_validity_check(struct load_info *info) * strings in the section safe. */ info->secstrings = (void *)info->hdr + strhdr->sh_offset; + if (strhdr->sh_size == 0) { + pr_err("empty section name table\n"); + return -ENOEXEC; + } if (info->secstrings[strhdr->sh_size - 1] != '\0') return -ENOEXEC; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/4] Fix 4 CVEs in JFFS2
by Wang Zhaolong 15 Mar '25

15 Mar '25

CVE-2022-49381 CVE-2022-49277 CVE-2022-49276 CVE-2021-47656 Baokun Li (4): jffs2: fix use-after-free in jffs2_clear_xattr_subsystem jffs2: fix memory leak in jffs2_scan_medium jffs2: fix memory leak in jffs2_do_mount_fs jffs2: fix memory leak in jffs2_do_fill_super fs/jffs2/build.c | 4 +++- fs/jffs2/fs.c | 3 ++- fs/jffs2/scan.c | 6 ++++-- 3 files changed, 9 insertions(+), 4 deletions(-) -- 2.34.3

2 5

[openeuler:OLK-6.6 2034/2034] aarch64-linux-ld: Unexpected GOT/PLT entries detected!
by kernel test robot 15 Mar '25

15 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 304c7f18d674a3cbb439f7ee346622b2e6c5bc9e commit: b991780c836ceb9a479c6c6e385e914b487e353a [2034/2034] arm64: introduce copy_mc_to_kernel() implementation config: arm64-randconfig-001-20250314 (https://download.01.org/0day-ci/archive/20250315/202503151158.xNxBbX1r-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250315/202503151158.xNxBbX1r-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503151158.xNxBbX1r-lkp@intel.com/ All errors (new ones prefixed by >>): >> aarch64-linux-ld: Unexpected GOT/PLT entries detected! >> aarch64-linux-ld: Unexpected run-time procedure linkages detected! aarch64-linux-ld: mm/kasan/shadow.o: in function `memcpy_mc': mm/kasan/shadow.c:90:(.text+0x5d0): undefined reference to `__memcpy_mc' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] Fixes two CVEs of jffs2
by Wang Zhaolong 15 Mar '25

15 Mar '25

CVE-2022-49381 CVE-2021-47656 Baokun Li (2): jffs2: fix use-after-free in jffs2_clear_xattr_subsystem jffs2: fix memory leak in jffs2_do_fill_super fs/jffs2/fs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.3

2 3

[PATCH OLK-5.10] cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
by Wang Zhaolong 15 Mar '25

15 Mar '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBSSQA CVE: NA ---------------------------------------- If an error occurs when port 139 is used to mount the CIFS, the mount process may racy with the reconnect process. If the mount process first sets tcpStatus to CifsExiting and then the reconnect process sets tcpStatus to CifsNeedReconnect later, the cifs_reconnect() function enters an infinite loop and and the cifsd process cannot exit. mount.cifs cifsd ------------------------------------------------------------------ cifs_do_mount cifs_smb3_do_mount cifs_mount mount_get_conns cifs_get_smb_ses cifs_demultiplex_thread cifs_negotiate_protocol smb2_need_neg smb2_negotiate SMB2_negotiate cifs_send_recv compound_send_recv wait_for_response cifs_read_from_socket cifs_readv_from_socket cifs_readv_from_socket smb2_can_echo cifs_reconnect do { generic_ip_connect cifs_sync_mid_result DeleteMidQEntry _cifs_mid_q_entry_release cifs_small_buf_release cifs_put_tcp_session tcpStatus = CifsExiting; // The status will not be changed later in mount.cifs. ip_rfc1001_connect smb_send __smb_send_rqst tcpStatus = CifsNeedReconnect; // infinite loop } while (tcpStatus == CifsNeedReconnect) This patch adds a check in __smb_send_rqst() to not change tcpStatus to CifsNeedReconnect if tcpStatus is CifsExiting. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/transport.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index c6fd4223b3be..d634a7692e13 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -437,11 +437,14 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, /* * If we have only sent part of an SMB then the next SMB could * be taken as the remainder of this one. We need to kill the * socket so the server throws away the partial SMB */ - server->tcpStatus = CifsNeedReconnect; + spin_lock(&GlobalMid_Lock); + if (server->tcpStatus != CifsExiting) + server->tcpStatus = CifsNeedReconnect; + spin_unlock(&GlobalMid_Lock); trace_smb3_partial_send_reconnect(server->CurrentMid, server->hostname); } smbd_done: if (rc < 0 && rc != -EINTR) -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
by Wang Zhaolong 15 Mar '25

15 Mar '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBSSQA CVE: NA ---------------------------------------- If an error occurs when port 139 is used to mount the CIFS, the mount process may racy with the reconnect process. If the mount process first sets tcpStatus to CifsExiting and then the reconnect process sets tcpStatus to CifsNeedReconnect later, the cifs_reconnect() function enters an infinite loop and and the cifsd process cannot exit. mount.cifs cifsd ------------------------------------------------------------------ cifs_do_mount cifs_smb3_do_mount cifs_mount mount_get_conns cifs_get_smb_ses cifs_demultiplex_thread cifs_negotiate_protocol smb2_need_neg smb2_negotiate SMB2_negotiate cifs_send_recv compound_send_recv wait_for_response cifs_read_from_socket cifs_readv_from_socket cifs_readv_from_socket smb2_can_echo cifs_reconnect do { generic_ip_connect cifs_sync_mid_result DeleteMidQEntry _cifs_mid_q_entry_release cifs_small_buf_release cifs_put_tcp_session tcpStatus = CifsExiting; // The status will not be changed later in mount.cifs. ip_rfc1001_connect smb_send __smb_send_rqst tcpStatus = CifsNeedReconnect; // infinite loop } while (tcpStatus == CifsNeedReconnect) This patch adds a check in __smb_send_rqst() to not change tcpStatus to CifsNeedReconnect if tcpStatus is CifsExiting. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/transport.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index c74d6b577d95..7694056e5990 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -374,11 +374,14 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, /* * If we have only sent part of an SMB then the next SMB could * be taken as the remainder of this one. We need to kill the * socket so the server throws away the partial SMB */ - server->tcpStatus = CifsNeedReconnect; + spin_lock(&GlobalMid_Lock); + if (server->tcpStatus != CifsExiting) + server->tcpStatus = CifsNeedReconnect; + spin_unlock(&GlobalMid_Lock); trace_smb3_partial_send_reconnect(server->CurrentMid, server->hostname); } smbd_done: if (rc < 0 && rc != -EINTR) -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume
by Liu Chuang 14 Mar '25

14 Mar '25

From: Vinod Polimera <quic_vpolimer(a)quicinc.com> stable inclusion from stable-v4.19.247 commit aa4cb188988dc6f1b3f4917d4dbc452150a5d871 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP4BH CVE: CVE-2022-49489 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fa5186b279ecf44b14fb435540d2065be91cb1ed ] BUG: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6be3 Call trace: dpu_vbif_init_memtypes+0x40/0xb8 dpu_runtime_resume+0xcc/0x1c0 pm_generic_runtime_resume+0x30/0x44 __genpd_runtime_resume+0x68/0x7c genpd_runtime_resume+0x134/0x258 __rpm_callback+0x98/0x138 rpm_callback+0x30/0x88 rpm_resume+0x36c/0x49c __pm_runtime_resume+0x80/0xb0 dpu_core_irq_uninstall+0x30/0xb0 dpu_irq_uninstall+0x18/0x24 msm_drm_uninit+0xd8/0x16c Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Vinod Polimera <quic_vpolimer(a)quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/483255/ Link: https://lore.kernel.org/r/1650857213-30075-1-git-send-email-quic_vpolimer@q… [DB: fixed Fixes tag] Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c index 2d9b7b5fb49c..7c3b8c97434d 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c @@ -657,8 +657,10 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms) for (i = 0; i < dpu_kms->catalog->vbif_count; i++) { u32 vbif_idx = dpu_kms->catalog->vbif[i].id; - if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx]) + if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx]) { dpu_hw_vbif_destroy(dpu_kms->hw_vbif[vbif_idx]); + dpu_kms->hw_vbif[vbif_idx] = NULL; + } } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
by Liu Chuang 14 Mar '25

14 Mar '25

From: Gong Yuanjun <ruc_gongyuanjun(a)163.com> stable inclusion from stable-v4.19.247 commit 961ee8a6eeef4632a215d995d837b204f8c7c2d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2G2 CVE: CVE-2022-49324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------- [ Upstream commit 4107fa700f314592850e2c64608f6ede4c077476 ] Add the missing of_node_put() to release the refcount incremented by of_find_compatible_node(). Signed-off-by: Gong Yuanjun <ruc_gongyuanjun(a)163.com> Reviewed-by: Serge Semin <fancer.lancer(a)gmail.com> Signed-off-by: Thomas Bogendoerfer <tsbogend(a)alpha.franken.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- arch/mips/kernel/mips-cpc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/mips/kernel/mips-cpc.c b/arch/mips/kernel/mips-cpc.c index fcf9af492d60..cf46502c605e 100644 --- a/arch/mips/kernel/mips-cpc.c +++ b/arch/mips/kernel/mips-cpc.c @@ -31,6 +31,7 @@ phys_addr_t __weak mips_cpc_default_phys_base(void) cpc_node = of_find_compatible_node(of_root, NULL, "mti,mips-cpc"); if (cpc_node) { err = of_address_to_resource(cpc_node, 0, &res); + of_node_put(cpc_node); if (!err) return res.start; } -- 2.34.1

2 1

[openeuler:OLK-6.6 2033/2033] drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type
by kernel test robot 14 Mar '25

14 Mar '25

Hi Zhou, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 9176bda54ce98dbe711ae84180a3968e9d1e4889 commit: 9c1c9598010fbb9daa1e2a67d23830092fb6246a [2033/2033] net/hinic: Update Huawei Intelligent Network Card Driver: hinic config: x86_64-buildonly-randconfig-005-20250314 (https://download.01.org/0day-ci/archive/20250314/202503141744.6L1UQKTr-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250314/202503141744.6L1UQKTr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503141744.6L1UQKTr-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/net/ethernet/huawei/hinic/hinic_tx.c:39: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_tx.c:913:5: warning: no previous prototype for 'hinic_setup_tx_wqe' [-Wmissing-prototypes] 913 | int hinic_setup_tx_wqe(struct hinic_txq *txq) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_tx.c:1100:5: warning: no previous prototype for 'hinic_stop_sq' [-Wmissing-prototypes] 1100 | int hinic_stop_sq(struct hinic_txq *txq) | ^~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/huawei/hinic/hinic_rx.c:39: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_rx.c:171:6: warning: no previous prototype for 'hinic_rx_free_buffers' [-Wmissing-prototypes] 171 | void hinic_rx_free_buffers(struct hinic_rxq *rxq) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_rx.c:513:5: warning: no previous prototype for 'recv_one_pkt' [-Wmissing-prototypes] 513 | int recv_one_pkt(struct hinic_rxq *rxq, struct hinic_rq_cqe *rx_cqe, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_rx.c:560:6: warning: no previous prototype for 'rx_pass_super_cqe' [-Wmissing-prototypes] 560 | void rx_pass_super_cqe(struct hinic_rxq *rxq, u32 index, u32 pkt_num, | ^~~~~~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/huawei/hinic/hinic_dcb.c:32: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:62:6: warning: no previous prototype for 'hinic_dcb_config_init' [-Wmissing-prototypes] 62 | void hinic_dcb_config_init(struct hinic_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:95:6: warning: no previous prototype for 'hinic_init_ieee_settings' [-Wmissing-prototypes] 95 | void hinic_init_ieee_settings(struct hinic_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/string.h:294, from include/linux/uuid.h:11, from include/linux/mod_devicetable.h:14, from include/linux/pci.h:27, from drivers/net/ethernet/huawei/hinic/hinic_dcb.c:18: drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_init_ieee_settings': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:103:33: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 103 | memset(ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:514:42: note: in definition of macro '__fortify_memset_chk' 514 | size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:103:9: note: in expansion of macro 'memset' 103 | memset(ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:104:54: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 104 | memset(&nic_dev->hinic_ieee_ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:514:42: note: in definition of macro '__fortify_memset_chk' 514 | size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:104:9: note: in expansion of macro 'memset' 104 | memset(&nic_dev->hinic_ieee_ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:515:65: warning: left-hand operand of comma expression has no effect [-Wunused-value] 515 | fortify_memset_chk(__fortify_size, p_size, p_size_field), \ | ^ include/linux/fortify-string.h:524:25: note: in expansion of macro '__fortify_memset_chk' 524 | #define memset(p, c, s) __fortify_memset_chk(p, c, s, \ | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:104:9: note: in expansion of macro 'memset' 104 | memset(&nic_dev->hinic_ieee_ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:105:12: error: invalid use of undefined type 'struct ieee_ets' 105 | ets->ets_cap = dcb_cfg->pg_tcs; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:108:20: error: invalid use of undefined type 'struct ieee_ets' 108 | ets->tc_tsa[i] = tc_attr->prio_type ? | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:110:20: error: invalid use of undefined type 'struct ieee_ets' 110 | ets->tc_tx_bw[i] = nic_dev->dcb_cfg.bw_pct[HINIC_DCB_CFG_TX][i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:111:20: error: invalid use of undefined type 'struct ieee_ets' 111 | ets->tc_rx_bw[i] = nic_dev->dcb_cfg.bw_pct[HINIC_DCB_CFG_RX][i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:112:20: error: invalid use of undefined type 'struct ieee_ets' 112 | ets->prio_tc[i] = hinic_dcb_get_tc(dcb_cfg, | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:115:54: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 115 | memcpy(&nic_dev->hinic_ieee_ets, ets, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:636:48: note: in definition of macro '__fortify_memcpy_chk' 636 | const size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:115:9: note: in expansion of macro 'memcpy' 115 | memcpy(&nic_dev->hinic_ieee_ets, ets, sizeof(struct ieee_ets)); | ^~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:117:33: error: invalid application of 'sizeof' to incomplete type 'struct ieee_pfc' 117 | memset(pfc, 0x0, sizeof(struct ieee_pfc)); | ^~~~~~ include/linux/fortify-string.h:514:42: note: in definition of macro '__fortify_memset_chk' 514 | size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:117:9: note: in expansion of macro 'memset' 117 | memset(pfc, 0x0, sizeof(struct ieee_pfc)); | ^~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:118:12: error: invalid use of undefined type 'struct ieee_pfc' 118 | pfc->pfc_cap = dcb_cfg->pfc_tcs; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:121:28: error: invalid use of undefined type 'struct ieee_pfc' 121 | pfc->pfc_en |= (u8)BIT(i); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcb_init': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:29: error: 'DCB_CAP_DCBX_HOST' undeclared (first use in this function) 244 | nic_dev->dcbx_cap = DCB_CAP_DCBX_HOST | DCB_CAP_DCBX_VER_CEE; | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:29: note: each undeclared identifier is reported only once for each function it appears in >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:49: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) 244 | nic_dev->dcbx_cap = DCB_CAP_DCBX_HOST | DCB_CAP_DCBX_VER_CEE; | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: At top level: drivers/net/ethernet/huawei/hinic/hinic_dcb.c:258:6: warning: no previous prototype for 'hinic_set_prio_tc_map' [-Wmissing-prototypes] 258 | void hinic_set_prio_tc_map(struct hinic_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_state': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:380:35: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) 380 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_CEE)) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_pg_tc_cfg_tx': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:475:21: error: 'DCB_ATTR_VALUE_UNDEFINED' undeclared (first use in this function) 475 | if (prio != DCB_ATTR_VALUE_UNDEFINED) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_pg_tc_cfg_rx': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:507:21: error: 'DCB_ATTR_VALUE_UNDEFINED' undeclared (first use in this function) 507 | if (prio != DCB_ATTR_VALUE_UNDEFINED) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_getcap': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:689:14: error: 'DCB_CAP_ATTR_PG' undeclared (first use in this function) 689 | case DCB_CAP_ATTR_PG: | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:692:14: error: 'DCB_CAP_ATTR_PFC' undeclared (first use in this function) 692 | case DCB_CAP_ATTR_PFC: | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:695:14: error: 'DCB_CAP_ATTR_UP2TC' undeclared (first use in this function) 695 | case DCB_CAP_ATTR_UP2TC: | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:698:14: error: 'DCB_CAP_ATTR_PG_TCS' undeclared (first use in this function) 698 | case DCB_CAP_ATTR_PG_TCS: | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:701:14: error: 'DCB_CAP_ATTR_PFC_TCS' undeclared (first use in this function) 701 | case DCB_CAP_ATTR_PFC_TCS: | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:704:14: error: 'DCB_CAP_ATTR_GSP' undeclared (first use in this function) 704 | case DCB_CAP_ATTR_GSP: | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:707:14: error: 'DCB_CAP_ATTR_BCN' undeclared (first use in this function) 707 | case DCB_CAP_ATTR_BCN: | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:710:14: error: 'DCB_CAP_ATTR_DCBX' undeclared (first use in this function) 710 | case DCB_CAP_ATTR_DCBX: | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function '__set_hw_ets': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1026:42: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) 1026 | if ((nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE)) { | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1027:44: error: invalid use of undefined type 'struct ieee_ets' 1027 | up_tc[cos] = my_ets->prio_tc[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1028:46: error: invalid use of undefined type 'struct ieee_ets' 1028 | up_pgid[cos] = my_ets->prio_tc[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1031:40: error: invalid use of undefined type 'struct ieee_ets' 1031 | (my_ets->tc_tsa[cos] == IEEE8021Q_TSA_STRICT) ? | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1049:42: error: invalid use of undefined type 'struct ieee_ets' 1049 | pg_bw[i] = my_ets->tc_tx_bw[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_df_ieee_cfg': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:16: error: variable 'pfc' has initializer but incomplete type 1126 | struct ieee_pfc pfc = {0}; | ^~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:32: warning: excess elements in struct initializer 1126 | struct ieee_pfc pfc = {0}; | ^ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:32: note: (near initialization for 'pfc') >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:25: error: storage size of 'pfc' isn't known 1126 | struct ieee_pfc pfc = {0}; | ^~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1131:35: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) 1131 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE)) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1134:48: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 1134 | if (memcmp(my_ets, ets_default, sizeof(struct ieee_ets))) | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1137:19: error: invalid use of undefined type 'struct ieee_pfc' 1137 | if (my_pfc->pfc_en) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1149:52: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 1149 | memcpy(my_ets, ets_default, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:636:48: note: in definition of macro '__fortify_memcpy_chk' 636 | const size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1149:17: note: in expansion of macro 'memcpy' 1149 | memcpy(my_ets, ets_default, sizeof(struct ieee_ets)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1153:23: error: invalid use of undefined type 'struct ieee_pfc' 1153 | my_pfc->pfc_en = 0; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:25: warning: unused variable 'pfc' [-Wunused-variable] 1126 | struct ieee_pfc pfc = {0}; | ^~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: At top level: drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1201:4: warning: no previous prototype for 'hinic_dcbnl_set_all' [-Wmissing-prototypes] 1201 | u8 hinic_dcbnl_set_all(struct net_device *netdev) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_all': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1208:35: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) 1208 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_CEE)) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_ieee_get_ets': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1279:12: error: invalid use of undefined type 'struct ieee_ets' 1279 | ets->ets_cap = my_ets->ets_cap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1279:30: error: invalid use of undefined type 'struct ieee_ets' 1279 | ets->ets_cap = my_ets->ets_cap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:59: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ include/linux/fortify-string.h:636:48: note: in definition of macro '__fortify_memcpy_chk' 636 | const size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:9: note: in expansion of macro 'memcpy' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:19: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ include/linux/fortify-string.h:637:34: note: in definition of macro '__fortify_memcpy_chk' 637 | const size_t __p_size = (p_size); \ | ^~~~~~ include/linux/fortify-string.h:694:17: note: in expansion of macro '__struct_size' 694 | __struct_size(p), __struct_size(q), \ | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:9: note: in expansion of macro 'memcpy' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:37: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ include/linux/fortify-string.h:638:34: note: in definition of macro '__fortify_memcpy_chk' 638 | const size_t __q_size = (q_size); \ | ^~~~~~ include/linux/fortify-string.h:694:35: note: in expansion of macro '__struct_size' 694 | __struct_size(p), __struct_size(q), \ | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:9: note: in expansion of macro 'memcpy' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:19: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ include/linux/fortify-string.h:639:40: note: in definition of macro '__fortify_memcpy_chk' 639 | const size_t __p_size_field = (p_size_field); \ | ^~~~~~~~~~~~ include/linux/fortify-string.h:695:17: note: in expansion of macro '__member_size' 695 | __member_size(p), __member_size(q), \ | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:9: note: in expansion of macro 'memcpy' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:37: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ include/linux/fortify-string.h:640:40: note: in definition of macro '__fortify_memcpy_chk' 640 | const size_t __q_size_field = (q_size_field); \ | ^~~~~~~~~~~~ include/linux/fortify-string.h:695:35: note: in expansion of macro '__member_size' 695 | __member_size(p), __member_size(q), \ | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:9: note: in expansion of macro 'memcpy' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:19: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); -- | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:9: note: in expansion of macro 'memcpy' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:22: error: invalid use of undefined type 'struct ieee_ets' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~ include/linux/fortify-string.h:639:40: note: in definition of macro '__fortify_memcpy_chk' 639 | const size_t __p_size_field = (p_size_field); \ | ^~~~~~~~~~~~ include/linux/fortify-string.h:695:17: note: in expansion of macro '__member_size' 695 | __member_size(p), __member_size(q), \ | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:9: note: in expansion of macro 'memcpy' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:35: error: invalid use of undefined type 'struct ieee_ets' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~ include/linux/fortify-string.h:640:40: note: in definition of macro '__fortify_memcpy_chk' 640 | const size_t __q_size_field = (q_size_field); \ | ^~~~~~~~~~~~ include/linux/fortify-string.h:695:35: note: in expansion of macro '__member_size' 695 | __member_size(p), __member_size(q), \ | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:9: note: in expansion of macro 'memcpy' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:22: error: invalid use of undefined type 'struct ieee_ets' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~ include/linux/fortify-string.h:648:27: note: in definition of macro '__fortify_memcpy_chk' 648 | __underlying_##op(p, q, __fortify_size); \ | ^ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:9: note: in expansion of macro 'memcpy' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:35: error: invalid use of undefined type 'struct ieee_ets' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~ include/linux/fortify-string.h:648:30: note: in definition of macro '__fortify_memcpy_chk' 648 | __underlying_##op(p, q, __fortify_size); \ | ^ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:9: note: in expansion of macro 'memcpy' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1336:58: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 1336 | memcpy(my_ets, &back_ets, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:636:48: note: in definition of macro '__fortify_memcpy_chk' 636 | const size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1336:25: note: in expansion of macro 'memcpy' 1336 | memcpy(my_ets, &back_ets, sizeof(struct ieee_ets)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1294:25: warning: unused variable 'back_ets' [-Wunused-variable] 1294 | struct ieee_ets back_ets; | ^~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_ieee_get_pfc': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1360:12: error: invalid use of undefined type 'struct ieee_pfc' 1360 | pfc->pfc_en = my_pfc->pfc_en; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1360:29: error: invalid use of undefined type 'struct ieee_pfc' 1360 | pfc->pfc_en = my_pfc->pfc_en; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1361:12: error: invalid use of undefined type 'struct ieee_pfc' 1361 | pfc->pfc_cap = my_pfc->pfc_cap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1361:30: error: invalid use of undefined type 'struct ieee_pfc' 1361 | pfc->pfc_cap = my_pfc->pfc_cap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_ieee_set_pfc': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1378:35: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) 1378 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE)) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1381:19: error: invalid use of undefined type 'struct ieee_pfc' 1381 | if (my_pfc->pfc_en == pfc->pfc_en) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1381:34: error: invalid use of undefined type 'struct ieee_pfc' 1381 | if (my_pfc->pfc_en == pfc->pfc_en) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1384:22: error: invalid use of undefined type 'struct ieee_pfc' 1384 | pfc_map = pfc->pfc_en & nic_dev->up_valid_bitmap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1385:30: error: invalid use of undefined type 'struct ieee_pfc' 1385 | outof_range_pfc = pfc->pfc_en & (~nic_dev->up_valid_bitmap); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1400:27: error: invalid use of undefined type 'struct ieee_ets' 1400 | if (my_ets->prio_tc[i] > max_tc) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1401:40: error: invalid use of undefined type 'struct ieee_ets' 1401 | max_tc = my_ets->prio_tc[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1415:15: error: invalid use of undefined type 'struct ieee_pfc' 1415 | my_pfc->pfc_en = pfc->pfc_en; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1415:29: error: invalid use of undefined type 'struct ieee_pfc' 1415 | my_pfc->pfc_en = pfc->pfc_en; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_getnumtcs': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1432:14: error: 'DCB_NUMTCS_ATTR_PG' undeclared (first use in this function) 1432 | case DCB_NUMTCS_ATTR_PG: | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1435:14: error: 'DCB_NUMTCS_ATTR_PFC' undeclared (first use in this function) 1435 | case DCB_NUMTCS_ATTR_PFC: | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_setdcbx': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1476:22: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) 1476 | if (((mode & DCB_CAP_DCBX_VER_IEEE) && (mode & DCB_CAP_DCBX_VER_CEE)) || | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1476:56: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) 1476 | if (((mode & DCB_CAP_DCBX_VER_IEEE) && (mode & DCB_CAP_DCBX_VER_CEE)) || | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1477:22: error: 'DCB_CAP_DCBX_LLD_MANAGED' undeclared (first use in this function) 1477 | ((mode & DCB_CAP_DCBX_LLD_MANAGED) && | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1478:23: error: 'DCB_CAP_DCBX_HOST' undeclared (first use in this function) 1478 | (!(mode & DCB_CAP_DCBX_HOST)))) { | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: At top level: >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1519:14: error: variable 'hinic_dcbnl_ops' has initializer but incomplete type 1519 | const struct dcbnl_rtnl_ops hinic_dcbnl_ops = { | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1521:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_getets' 1521 | .ieee_getets = hinic_dcbnl_ieee_get_ets, | ^~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1521:27: warning: excess elements in struct initializer 1521 | .ieee_getets = hinic_dcbnl_ieee_get_ets, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1521:27: note: (near initialization for 'hinic_dcbnl_ops') >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1522:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_setets' 1522 | .ieee_setets = hinic_dcbnl_ieee_set_ets, | ^~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1522:27: warning: excess elements in struct initializer 1522 | .ieee_setets = hinic_dcbnl_ieee_set_ets, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1522:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1523:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_getpfc' 1523 | .ieee_getpfc = hinic_dcbnl_ieee_get_pfc, | ^~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1523:27: warning: excess elements in struct initializer 1523 | .ieee_getpfc = hinic_dcbnl_ieee_get_pfc, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1523:27: note: (near initialization for 'hinic_dcbnl_ops') >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1524:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_setpfc' 1524 | .ieee_setpfc = hinic_dcbnl_ieee_set_pfc, | ^~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1524:27: warning: excess elements in struct initializer 1524 | .ieee_setpfc = hinic_dcbnl_ieee_set_pfc, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1524:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1527:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getstate' 1527 | .getstate = hinic_dcbnl_get_state, | ^~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1527:27: warning: excess elements in struct initializer 1527 | .getstate = hinic_dcbnl_get_state, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1527:27: note: (near initialization for 'hinic_dcbnl_ops') >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1528:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setstate' 1528 | .setstate = hinic_dcbnl_set_state, | ^~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1528:27: warning: excess elements in struct initializer 1528 | .setstate = hinic_dcbnl_set_state, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1528:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1529:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpermhwaddr' 1529 | .getpermhwaddr = hinic_dcbnl_get_perm_hw_addr, | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1529:27: warning: excess elements in struct initializer 1529 | .getpermhwaddr = hinic_dcbnl_get_perm_hw_addr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1529:27: note: (near initialization for 'hinic_dcbnl_ops') >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1530:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgtccfgtx' 1530 | .setpgtccfgtx = hinic_dcbnl_set_pg_tc_cfg_tx, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1530:27: warning: excess elements in struct initializer 1530 | .setpgtccfgtx = hinic_dcbnl_set_pg_tc_cfg_tx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1530:27: note: (near initialization for 'hinic_dcbnl_ops') >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1531:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgbwgcfgtx' 1531 | .setpgbwgcfgtx = hinic_dcbnl_set_pg_bwg_cfg_tx, | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1531:27: warning: excess elements in struct initializer 1531 | .setpgbwgcfgtx = hinic_dcbnl_set_pg_bwg_cfg_tx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1531:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1532:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgtccfgrx' 1532 | .setpgtccfgrx = hinic_dcbnl_set_pg_tc_cfg_rx, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1532:27: warning: excess elements in struct initializer 1532 | .setpgtccfgrx = hinic_dcbnl_set_pg_tc_cfg_rx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1532:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1533:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgbwgcfgrx' 1533 | .setpgbwgcfgrx = hinic_dcbnl_set_pg_bwg_cfg_rx, | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1533:27: warning: excess elements in struct initializer 1533 | .setpgbwgcfgrx = hinic_dcbnl_set_pg_bwg_cfg_rx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1533:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1534:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgtccfgtx' 1534 | .getpgtccfgtx = hinic_dcbnl_get_pg_tc_cfg_tx, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1534:27: warning: excess elements in struct initializer 1534 | .getpgtccfgtx = hinic_dcbnl_get_pg_tc_cfg_tx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1534:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1535:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgbwgcfgtx' 1535 | .getpgbwgcfgtx = hinic_dcbnl_get_pg_bwg_cfg_tx, | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1535:27: warning: excess elements in struct initializer 1535 | .getpgbwgcfgtx = hinic_dcbnl_get_pg_bwg_cfg_tx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1535:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1536:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgtccfgrx' 1536 | .getpgtccfgrx = hinic_dcbnl_get_pg_tc_cfg_rx, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1536:27: warning: excess elements in struct initializer 1536 | .getpgtccfgrx = hinic_dcbnl_get_pg_tc_cfg_rx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1536:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1537:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgbwgcfgrx' 1537 | .getpgbwgcfgrx = hinic_dcbnl_get_pg_bwg_cfg_rx, | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1537:27: warning: excess elements in struct initializer 1537 | .getpgbwgcfgrx = hinic_dcbnl_get_pg_bwg_cfg_rx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1537:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1538:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpfccfg' 1538 | .setpfccfg = hinic_dcbnl_set_pfc_cfg, | ^~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1538:27: warning: excess elements in struct initializer 1538 | .setpfccfg = hinic_dcbnl_set_pfc_cfg, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1538:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1539:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpfccfg' 1539 | .getpfccfg = hinic_dcbnl_get_pfc_cfg, | ^~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1539:27: warning: excess elements in struct initializer 1539 | .getpfccfg = hinic_dcbnl_get_pfc_cfg, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1539:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1540:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setall' 1540 | .setall = hinic_dcbnl_set_all, | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1540:27: warning: excess elements in struct initializer 1540 | .setall = hinic_dcbnl_set_all, | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1540:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1541:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getcap' 1541 | .getcap = hinic_dcbnl_getcap, | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1541:27: warning: excess elements in struct initializer 1541 | .getcap = hinic_dcbnl_getcap, | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1541:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1542:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getnumtcs' 1542 | .getnumtcs = hinic_dcbnl_getnumtcs, | ^~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1542:27: warning: excess elements in struct initializer 1542 | .getnumtcs = hinic_dcbnl_getnumtcs, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1542:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1543:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setnumtcs' 1543 | .setnumtcs = hinic_dcbnl_setnumtcs, | ^~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1543:27: warning: excess elements in struct initializer 1543 | .setnumtcs = hinic_dcbnl_setnumtcs, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1543:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1544:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpfcstate' 1544 | .getpfcstate = hinic_dcbnl_getpfcstate, | ^~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1544:27: warning: excess elements in struct initializer 1544 | .getpfcstate = hinic_dcbnl_getpfcstate, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1544:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1545:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpfcstate' 1545 | .setpfcstate = hinic_dcbnl_setpfcstate, | ^~~~~~~~~~~ .. vim +/hinic_ieee_ets_default +210 drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h 153 154 struct hinic_nic_dev { 155 struct pci_dev *pdev; 156 struct net_device *netdev; 157 void *hwdev; 158 159 int poll_weight; 160 161 unsigned long *vlan_bitmap; 162 163 u16 num_qps; 164 u16 max_qps; 165 166 u32 msg_enable; 167 unsigned long flags; 168 169 u16 sq_depth; 170 u16 rq_depth; 171 172 /* mapping from priority */ 173 u8 sq_cos_mapping[HINIC_DCB_UP_MAX]; 174 u8 default_cos_id; 175 struct hinic_txq *txqs; 176 struct hinic_rxq *rxqs; 177 178 struct nic_service_cap nic_cap; 179 180 struct irq_info *qps_irq_info; 181 struct hinic_irq *irq_cfg; 182 struct work_struct rx_mode_work; 183 struct delayed_work moderation_task; 184 struct workqueue_struct *workq; 185 186 struct list_head uc_filter_list; 187 struct list_head mc_filter_list; 188 unsigned long rx_mod_state; 189 int netdev_uc_cnt; 190 int netdev_mc_cnt; 191 int lb_test_rx_idx; 192 int lb_pkt_len; 193 u8 *lb_test_rx_buf; 194 195 u8 rss_tmpl_idx; 196 u16 num_rss; 197 u16 rss_limit; 198 u8 rss_hash_engine; 199 struct nic_rss_type rss_type; 200 u8 *rss_hkey_user; 201 /* hkey in big endian */ 202 u32 *rss_hkey_user_be; 203 u32 *rss_indir_user; 204 205 u8 dcbx_cap; 206 u32 dcb_changes; 207 u8 max_cos; 208 u8 up_valid_bitmap; 209 u8 up_cos[HINIC_DCB_UP_MAX]; > 210 struct ieee_ets hinic_ieee_ets_default; > 211 struct ieee_ets hinic_ieee_ets; 212 struct ieee_pfc hinic_ieee_pfc; 213 struct hinic_dcb_config dcb_cfg; 214 struct hinic_dcb_config tmp_dcb_cfg; 215 struct hinic_dcb_config save_dcb_cfg; 216 unsigned long dcb_flags; 217 int disable_port_cnt; 218 /* lock for disable or enable traffic flow */ 219 struct semaphore dcb_sem; 220 221 bool heart_status; 222 223 struct hinic_intr_coal_info *intr_coalesce; 224 unsigned long last_moder_jiffies; 225 u32 adaptive_rx_coal; 226 u8 intr_coal_set_flag; 227 u32 his_link_speed; 228 /* interrupt coalesce must be different in virtual machine */ 229 bool in_vm; 230 bool is_vm_slave; 231 int is_bm_slave; 232 struct hinic_nic_stats stats; 233 /* lock for nic resource */ 234 struct mutex nic_mutex; 235 bool force_port_disable; 236 struct semaphore port_state_sem; 237 u8 link_status; 238 239 struct hinic_environment_info env_info; 240 struct hinic_adaptive_cfg adaptive_cfg; 241 242 /* pangea cpu affinity setting */ 243 bool force_affinity; 244 cpumask_t affinity_mask; 245 246 u32 lro_replenish_thld; 247 u16 rx_buff_len; 248 u32 page_order; 249 }; 250 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v2 0/3] CVE-2025-21816
by Xiongfeng Wang 14 Mar '25

14 Mar '25

Frederic Weisbecker (2): hrtimer: Report offline hrtimer enqueue hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Xiongfeng Wang (1): hrtimer: Fix kabi broken of struct hrtimer_cpu_base include/linux/hrtimer.h | 5 +- kernel/time/hrtimer.c | 105 ++++++++++++++++++++++++++++++++-------- 2 files changed, 90 insertions(+), 20 deletions(-) -- 2.20.1

2 4

[PATCH OLK-6.6 0/6] Add dp module in hibmc driver
by Yongbang Shi 14 Mar '25

14 Mar '25

From: Baihan Li <libaihan(a)huawei.com> Realizing the basic display function of DP cable for DP connector displaying. Add DP module in hibmc drm driver, which is for Hisilicon Hibmc SoC which used for Out-of-band management. Blow is the general hardware connection, both the Hibmc and the host CPU are on the same mother board. +----------+ +----------+ +----- ----+ +----------------+ | | PCIe | Hibmc | | | | | |host CPU( |<----->| display |<---->| dp kapi |<---->| dp aux moduel | |arm64,x86)| |subsystem | | moduel |<---->| dp link moduel | +----------+ +----------+ +----------+ +----------------+ Baihan Li (5): drm/hisilicon/hibmc: add dp aux in hibmc drivers drm/hisilicon/hibmc: add dp link moduel in hibmc drivers drm/hisilicon/hibmc: add dp hw moduel in hibmc driver drm/hisilicon/hibmc: refactored struct hibmc_drm_private drm/hisilicon/hibmc: add dp module in hibmc Jani Nikula (1): drm/hisilicon/hibmc: convert to struct drm_edid drivers/gpu/drm/hisilicon/hibmc/Makefile | 3 +- drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c | 164 +++++++++ drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h | 63 ++++ .../gpu/drm/hisilicon/hibmc/dp/dp_config.h | 19 + drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c | 220 ++++++++++++ drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h | 28 ++ drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c | 332 ++++++++++++++++++ drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h | 76 ++++ .../gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c | 118 +++++++ .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 14 + .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 19 +- .../gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c | 42 ++- .../gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 33 +- 13 files changed, 1085 insertions(+), 46 deletions(-) create mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c create mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h create mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_config.h create mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c create mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h create mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c create mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h create mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c -- 2.33.0

2 7

[PATCH openEuler-1.0-LTS] dlm: fix plock invalid read
by Xia Fukun 14 Mar '25

14 Mar '25

From: Alexander Aring <aahringo(a)redhat.com> stable inclusion from stable-v4.19.247 commit 5a1765adf9855cf0f6d3f7e0eb4b78ca66f70dee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3TG CVE: CVE-2022-49407 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 42252d0d2aa9b94d168241710a761588b3959019 upstream. This patch fixes an invalid read showed by KASAN. A unlock will allocate a "struct plock_op" and a followed send_op() will append it to a global send_list data structure. In some cases a followed dev_read() moves it to recv_list and dev_write() will cast it to "struct plock_xop" and access fields which are only available in those structures. At this point an invalid read happens by accessing those fields. To fix this issue the "callback" field is moved to "struct plock_op" to indicate that a cast to "plock_xop" is allowed and does the additional "plock_xop" handling if set. Example of the KASAN output which showed the invalid read: [ 2064.296453] ================================================================== [ 2064.304852] BUG: KASAN: slab-out-of-bounds in dev_write+0x52b/0x5a0 [dlm] [ 2064.306491] Read of size 8 at addr ffff88800ef227d8 by task dlm_controld/7484 [ 2064.308168] [ 2064.308575] CPU: 0 PID: 7484 Comm: dlm_controld Kdump: loaded Not tainted 5.14.0+ #9 [ 2064.310292] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 2064.311618] Call Trace: [ 2064.312218] dump_stack_lvl+0x56/0x7b [ 2064.313150] print_address_description.constprop.8+0x21/0x150 [ 2064.314578] ? dev_write+0x52b/0x5a0 [dlm] [ 2064.315610] ? dev_write+0x52b/0x5a0 [dlm] [ 2064.316595] kasan_report.cold.14+0x7f/0x11b [ 2064.317674] ? dev_write+0x52b/0x5a0 [dlm] [ 2064.318687] dev_write+0x52b/0x5a0 [dlm] [ 2064.319629] ? dev_read+0x4a0/0x4a0 [dlm] [ 2064.320713] ? bpf_lsm_kernfs_init_security+0x10/0x10 [ 2064.321926] vfs_write+0x17e/0x930 [ 2064.322769] ? __fget_light+0x1aa/0x220 [ 2064.323753] ksys_write+0xf1/0x1c0 [ 2064.324548] ? __ia32_sys_read+0xb0/0xb0 [ 2064.325464] do_syscall_64+0x3a/0x80 [ 2064.326387] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2064.327606] RIP: 0033:0x7f807e4ba96f [ 2064.328470] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 39 87 f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 7c 87 f8 ff 48 [ 2064.332902] RSP: 002b:00007ffd50cfe6e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 2064.334658] RAX: ffffffffffffffda RBX: 000055cc3886eb30 RCX: 00007f807e4ba96f [ 2064.336275] RDX: 0000000000000040 RSI: 00007ffd50cfe7e0 RDI: 0000000000000010 [ 2064.337980] RBP: 00007ffd50cfe7e0 R08: 0000000000000000 R09: 0000000000000001 [ 2064.339560] R10: 000055cc3886eb30 R11: 0000000000000293 R12: 000055cc3886eb80 [ 2064.341237] R13: 000055cc3886eb00 R14: 000055cc3886f590 R15: 0000000000000001 [ 2064.342857] [ 2064.343226] Allocated by task 12438: [ 2064.344057] kasan_save_stack+0x1c/0x40 [ 2064.345079] __kasan_kmalloc+0x84/0xa0 [ 2064.345933] kmem_cache_alloc_trace+0x13b/0x220 [ 2064.346953] dlm_posix_unlock+0xec/0x720 [dlm] [ 2064.348811] do_lock_file_wait.part.32+0xca/0x1d0 [ 2064.351070] fcntl_setlk+0x281/0xbc0 [ 2064.352879] do_fcntl+0x5e4/0xfe0 [ 2064.354657] __x64_sys_fcntl+0x11f/0x170 [ 2064.356550] do_syscall_64+0x3a/0x80 [ 2064.358259] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2064.360745] [ 2064.361511] Last potentially related work creation: [ 2064.363957] kasan_save_stack+0x1c/0x40 [ 2064.365811] __kasan_record_aux_stack+0xaf/0xc0 [ 2064.368100] call_rcu+0x11b/0xf70 [ 2064.369785] dlm_process_incoming_buffer+0x47d/0xfd0 [dlm] [ 2064.372404] receive_from_sock+0x290/0x770 [dlm] [ 2064.374607] process_recv_sockets+0x32/0x40 [dlm] [ 2064.377290] process_one_work+0x9a8/0x16e0 [ 2064.379357] worker_thread+0x87/0xbf0 [ 2064.381188] kthread+0x3ac/0x490 [ 2064.383460] ret_from_fork+0x22/0x30 [ 2064.385588] [ 2064.386518] Second to last potentially related work creation: [ 2064.389219] kasan_save_stack+0x1c/0x40 [ 2064.391043] __kasan_record_aux_stack+0xaf/0xc0 [ 2064.393303] call_rcu+0x11b/0xf70 [ 2064.394885] dlm_process_incoming_buffer+0x47d/0xfd0 [dlm] [ 2064.397694] receive_from_sock+0x290/0x770 [dlm] [ 2064.399932] process_recv_sockets+0x32/0x40 [dlm] [ 2064.402180] process_one_work+0x9a8/0x16e0 [ 2064.404388] worker_thread+0x87/0xbf0 [ 2064.406124] kthread+0x3ac/0x490 [ 2064.408021] ret_from_fork+0x22/0x30 [ 2064.409834] [ 2064.410599] The buggy address belongs to the object at ffff88800ef22780 [ 2064.410599] which belongs to the cache kmalloc-96 of size 96 [ 2064.416495] The buggy address is located 88 bytes inside of [ 2064.416495] 96-byte region [ffff88800ef22780, ffff88800ef227e0) [ 2064.422045] The buggy address belongs to the page: [ 2064.424635] page:00000000b6bef8bc refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xef22 [ 2064.428970] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 2064.432515] raw: 000fffffc0000200 ffffea0000d68b80 0000001400000014 ffff888001041780 [ 2064.436110] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 2064.439813] page dumped because: kasan: bad access detected [ 2064.442548] [ 2064.443310] Memory state around the buggy address: [ 2064.445988] ffff88800ef22680: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 2064.449444] ffff88800ef22700: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 2064.452941] >ffff88800ef22780: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 2064.456383] ^ [ 2064.459386] ffff88800ef22800: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 2064.462788] ffff88800ef22880: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 2064.466239] ================================================================== reproducer in python: import argparse import struct import fcntl import os parser = argparse.ArgumentParser() parser.add_argument('-f', '--file', help='file to use fcntl, must be on dlm lock filesystem e.g. gfs2') args = parser.parse_args() f = open(args.file, 'wb+') lockdata = struct.pack('hhllhh', fcntl.F_WRLCK,0,0,0,0,0) fcntl.fcntl(f, fcntl.F_SETLK, lockdata) lockdata = struct.pack('hhllhh', fcntl.F_UNLCK,0,0,0,0,0) fcntl.fcntl(f, fcntl.F_SETLK, lockdata) Fixes: 586759f03e2e ("gfs2: nfs lock support for gfs2") Cc: stable(a)vger.kernel.org Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Alexander Aring <aahringo(a)redhat.com> Signed-off-by: David Teigland <teigland(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- fs/dlm/plock.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/fs/dlm/plock.c b/fs/dlm/plock.c index c7d5a2ea3d03..e0c05e08d8bf 100644 --- a/fs/dlm/plock.c +++ b/fs/dlm/plock.c @@ -26,11 +26,11 @@ struct plock_op { struct list_head list; int done; struct dlm_plock_info info; + int (*callback)(struct file_lock *fl, int result); }; struct plock_xop { struct plock_op xop; - int (*callback)(struct file_lock *fl, int result); void *fl; void *file; struct file_lock flc; @@ -132,19 +132,18 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file, /* fl_owner is lockd which doesn't distinguish processes on the nfs client */ op->info.owner = (__u64) fl->fl_pid; - xop->callback = fl->fl_lmops->lm_grant; + op->callback = fl->fl_lmops->lm_grant; locks_init_lock(&xop->flc); locks_copy_lock(&xop->flc, fl); xop->fl = fl; xop->file = file; } else { op->info.owner = (__u64)(long) fl->fl_owner; - xop->callback = NULL; } send_op(op); - if (xop->callback == NULL) { + if (!op->callback) { rv = wait_event_interruptible(recv_wq, (op->done != 0)); if (rv == -ERESTARTSYS) { log_debug(ls, "dlm_posix_lock: wait killed %llx", @@ -206,7 +205,7 @@ static int dlm_plock_callback(struct plock_op *op) file = xop->file; flc = &xop->flc; fl = xop->fl; - notify = xop->callback; + notify = op->callback; if (op->info.rv) { notify(fl, op->info.rv); @@ -439,10 +438,9 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count, if (op->info.fsid == info.fsid && op->info.number == info.number && op->info.owner == info.owner) { - struct plock_xop *xop = (struct plock_xop *)op; list_del_init(&op->list); memcpy(&op->info, &info, sizeof(info)); - if (xop->callback) + if (op->callback) do_callback = 1; else op->done = 1; -- 2.34.1

2 1

[PATCH OLK-5.10 v2 0/3] CVE-2025-21816
by Xiongfeng Wang 14 Mar '25

14 Mar '25

Frederic Weisbecker (2): hrtimer: Report offline hrtimer enqueue hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Xiongfeng Wang (1): hrtimer: Fix kabi broken of struct hrtimer_cpu_base include/linux/hrtimer.h | 5 +- kernel/time/hrtimer.c | 105 ++++++++++++++++++++++++++++++++-------- 2 files changed, 90 insertions(+), 20 deletions(-) -- 2.20.1

2 4

[openeuler:OLK-5.10] BUILD SUCCESS c2f6be994ae124fea938cd77272722cffb1a3c26
by kernel test robot 14 Mar '25

14 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: c2f6be994ae124fea938cd77272722cffb1a3c26 !2893 igc: add default intel igc driver module support Unverified Warning (likely false positive, kindly check if interested): drivers/infiniband/hw/bnxt_re/ib_verbs.c:1026 bnxt_re_init_rq_attr() warn: can 'srq' even be NULL? drivers/infiniband/hw/bnxt_re/ib_verbs.c:1185 bnxt_re_init_qp_attr() warn: can 'cq' even be NULL? drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1245 ngbe_link_test() error: uninitialized symbol 'link_up'. drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1905 ngbe_diag_test() warn: inconsistent indenting drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:1222 ngbe_fc_autoneg() error: uninitialized symbol 'link_up'. drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4324 ngbe_write_ee_hostif32() warn: inconsistent indenting drivers/net/ethernet/netswift/ngbe/ngbe_main.c:1850 ngbe_request_msix_irqs() warn: 'entry->vector' from request_irq() not released on lines: 1850. drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3931 ngbe_setup_all_rx_resources() warn: inconsistent indenting drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5084 ngbe_reset_subtask() warn: inconsistent indenting drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1248 ngbe_phy_get_advertised_pause() error: uninitialized symbol 'value'. drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1260 ngbe_phy_get_advertised_pause_m88e1512() error: uninitialized symbol 'value'. drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1287 ngbe_phy_get_lp_advertised_pause() error: uninitialized symbol 'value'. drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1291 ngbe_phy_get_lp_advertised_pause() warn: mask and shift to zero: expr='value >> 10' drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1304 ngbe_phy_get_lp_advertised_pause_m88e1512() error: uninitialized symbol 'value'. Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-003-20250313 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250313 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250313 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250313 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250313 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250313 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250313 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-randconfig-101-20250314 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-randconfig-102-20250314 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-randconfig-103-20250314 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-randconfig-104-20250314 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-randconfig-161-20250313 | |-- drivers-infiniband-hw-bnxt_re-ib_verbs.c-bnxt_re_init_qp_attr()-warn:can-cq-even-be-NULL | |-- drivers-infiniband-hw-bnxt_re-ib_verbs.c-bnxt_re_init_rq_attr()-warn:can-srq-even-be-NULL | |-- drivers-net-ethernet-netswift-ngbe-ngbe_ethtool.c-ngbe_diag_test()-warn:inconsistent-indenting | |-- drivers-net-ethernet-netswift-ngbe-ngbe_ethtool.c-ngbe_link_test()-error:uninitialized-symbol-link_up-. | |-- drivers-net-ethernet-netswift-ngbe-ngbe_hw.c-ngbe_fc_autoneg()-error:uninitialized-symbol-link_up-. | |-- drivers-net-ethernet-netswift-ngbe-ngbe_hw.c-ngbe_write_ee_hostif32()-warn:inconsistent-indenting | |-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c-ngbe_request_msix_irqs()-warn:entry-vector-from-request_irq()-not-released-on-lines:. | |-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c-ngbe_reset_subtask()-warn:inconsistent-indenting | |-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c-ngbe_setup_all_rx_resources()-warn:inconsistent-indenting | |-- drivers-net-ethernet-netswift-ngbe-ngbe_phy.c-ngbe_phy_get_advertised_pause()-error:uninitialized-symbol-value-. | |-- drivers-net-ethernet-netswift-ngbe-ngbe_phy.c-ngbe_phy_get_advertised_pause_m88e1512()-error:uninitialized-symbol-value-. | |-- drivers-net-ethernet-netswift-ngbe-ngbe_phy.c-ngbe_phy_get_lp_advertised_pause()-error:uninitialized-symbol-value-. | |-- drivers-net-ethernet-netswift-ngbe-ngbe_phy.c-ngbe_phy_get_lp_advertised_pause()-warn:mask-and-shift-to-zero:expr-value | `-- drivers-net-ethernet-netswift-ngbe-ngbe_phy.c-ngbe_phy_get_lp_advertised_pause_m88e1512()-error:uninitialized-symbol-value-. `-- x86_64-randconfig-161-20250314 |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch elapsed time: 1458m configs tested: 16 configs skipped: 129 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250313 clang-18 arm64 randconfig-002-20250313 clang-16 arm64 randconfig-003-20250313 gcc-14.2.0 arm64 randconfig-004-20250313 clang-21 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250313 clang-19 x86_64 buildonly-randconfig-002-20250313 clang-19 x86_64 buildonly-randconfig-003-20250313 clang-19 x86_64 buildonly-randconfig-004-20250313 gcc-12 x86_64 buildonly-randconfig-005-20250313 clang-19 x86_64 buildonly-randconfig-006-20250313 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] CVE-2025-21816
by Xiongfeng Wang 14 Mar '25

14 Mar '25

Frederic Weisbecker (1): hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Xiongfeng Wang (1): hrtimer: Fix kabi broken of struct hrtimer_cpu_base include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 102 ++++++++++++++++++++++++++++++++-------- 2 files changed, 84 insertions(+), 19 deletions(-) -- 2.20.1

2 3

[PATCH OLK-6.6 0/2] CVE-2025-21816
by Xiongfeng Wang 14 Mar '25

14 Mar '25

Frederic Weisbecker (1): hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Xiongfeng Wang (1): hrtimer: Fix kabi broken of struct hrtimer_cpu_base include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 103 ++++++++++++++++++++++++++++++++-------- 2 files changed, 83 insertions(+), 21 deletions(-) -- 2.20.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49514
by Liu Shixin 14 Mar '25

14 Mar '25

Miaoqian Lin (1): ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe Tzung-Bi Shih (1): ASoC: mediatek: mt8173: fix device_node leak sound/soc/mediatek/mt8173/mt8173-max98090.c | 8 +++++++- sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c | 2 ++ sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c | 2 ++ sound/soc/mediatek/mt8173/mt8173-rt5650.c | 2 ++ 4 files changed, 13 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] mm: fix unexpected zeroed page mapping with zram swap
by Liu Shixin 14 Mar '25

14 Mar '25

From: Minchan Kim <minchan(a)kernel.org> stable inclusion from stable-v4.19.242 commit f86d55cf616199404c05f5b0c5c41b17351baa02 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP28G CVE: CVE-2022-49052 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e914d8f00391520ecc4495dd0ca0124538ab7119 upstream. Two processes under CLONE_VM cloning, user process can be corrupted by seeing zeroed page unexpectedly. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage valid data swap_slot_free_notify delete zram entry swap_readpage zeroed(invalid) data pte_lock map the *zero data* to userspace pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return and next refault will read zeroed data The swap_slot_free_notify is bogus for CLONE_VM case since it doesn't increase the refcount of swap slot at copy_mm so it couldn't catch up whether it's safe or not to discard data from backing device. In the case, only the lock it could rely on to synchronize swap slot freeing is page table lock. Thus, this patch gets rid of the swap_slot_free_notify function. With this patch, CPU A will see correct data. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage original data pte_lock map the original data swap_free swap_range_free bd_disk->fops->swap_slot_free_notify swap_readpage read zeroed data pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return on next refault will see mapped data by CPU B The concern of the patch would increase memory consumption since it could keep wasted memory with compressed form in zram as well as uncompressed form in address space. However, most of cases of zram uses no readahead and do_swap_page is followed by swap_free so it will free the compressed form from in zram quickly. Link: https://lkml.kernel.org/r/YjTVVxIAsnKAXjTd@google.com Fixes: 0bcac06f27d7 ("mm, swap: skip swapcache for swapin of synchronous device") Reported-by: Ivan Babrou <ivan(a)cloudflare.com> Tested-by: Ivan Babrou <ivan(a)cloudflare.com> Signed-off-by: Minchan Kim <minchan(a)kernel.org> Cc: Nitin Gupta <ngupta(a)vflare.org> Cc: Sergey Senozhatsky <senozhatsky(a)chromium.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: David Hildenbrand <david(a)redhat.com> Cc: <stable(a)vger.kernel.org> [4.14+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/page_io.c [ Context conflicts. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/page_io.c | 55 ---------------------------------------------------- 1 file changed, 55 deletions(-) diff --git a/mm/page_io.c b/mm/page_io.c index 17cff71a9304..9750f5580a91 100644 --- a/mm/page_io.c +++ b/mm/page_io.c @@ -71,55 +71,6 @@ void end_swap_bio_write(struct bio *bio) bio_put(bio); } -static void swap_slot_free_notify(struct page *page) -{ - struct swap_info_struct *sis; - struct gendisk *disk; - swp_entry_t entry; - - /* - * There is no guarantee that the page is in swap cache - the software - * suspend code (at least) uses end_swap_bio_read() against a non- - * swapcache page. So we must check PG_swapcache before proceeding with - * this optimization. - */ - if (unlikely(!PageSwapCache(page))) - return; - - sis = page_swap_info(page); - if (!(sis->flags & SWP_BLKDEV)) - return; - - /* - * The swap subsystem performs lazy swap slot freeing, - * expecting that the page will be swapped out again. - * So we can avoid an unnecessary write if the page - * isn't redirtied. - * This is good for real swap storage because we can - * reduce unnecessary I/O and enhance wear-leveling - * if an SSD is used as the as swap device. - * But if in-memory swap device (eg zram) is used, - * this causes a duplicated copy between uncompressed - * data in VM-owned memory and compressed data in - * zram-owned memory. So let's free zram-owned memory - * and make the VM-owned decompressed page *dirty*, - * so the page should be swapped out somewhere again if - * we again wish to reclaim it. - */ - disk = sis->bdev->bd_disk; - entry.val = page_private(page); - if (disk->fops->swap_slot_free_notify && - __swap_count(entry) == 1) { - unsigned long offset; - - offset = swp_offset(entry); - - SetPageDirty(page); - disk->fops->swap_slot_free_notify(sis->bdev, - offset); - } -} - static void end_swap_bio_read(struct bio *bio) { struct page *page = bio_first_page_all(bio); @@ -135,7 +86,6 @@ static void end_swap_bio_read(struct bio *bio) } SetPageUptodate(page); - swap_slot_free_notify(page); out: unlock_page(page); WRITE_ONCE(bio->bi_private, NULL); @@ -373,11 +323,6 @@ int swap_readpage(struct page *page, bool synchronous) ret = bdev_read_page(sis->bdev, map_swap_page(page, &sis->bdev), page); if (!ret) { - if (trylock_page(page)) { - swap_slot_free_notify(page); - unlock_page(page); - } - count_vm_event(PSWPIN); return 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] media: venus: hfi: avoid null dereference in deinit
by Liu Shixin 14 Mar '25

14 Mar '25

From: Luca Weiss <luca.weiss(a)fairphone.com> stable inclusion from stable-v4.19.247 commit a21d15dde21d7e8ae047eb8368677407db45d840 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6S3 CVE: CVE-2022-49527 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 86594f6af867b5165d2ba7b5a71fae3a5961e56c ] If venus_probe fails at pm_runtime_put_sync the error handling first calls hfi_destroy and afterwards hfi_core_deinit. As hfi_destroy sets core->ops to NULL, hfi_core_deinit cannot call the core_deinit function anymore. Avoid this null pointer derefence by skipping the call when necessary. Signed-off-by: Luca Weiss <luca.weiss(a)fairphone.com> Signed-off-by: Stanimir Varbanov <stanimir.varbanov(a)linaro.org> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/media/platform/qcom/venus/hfi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/platform/qcom/venus/hfi.c b/drivers/media/platform/qcom/venus/hfi.c index 24207829982f..8a99e2d8274a 100644 --- a/drivers/media/platform/qcom/venus/hfi.c +++ b/drivers/media/platform/qcom/venus/hfi.c @@ -113,6 +113,9 @@ int hfi_core_deinit(struct venus_core *core, bool blocking) mutex_lock(&core->lock); } + if (!core->ops) + goto unlock; + ret = core->ops->core_deinit(core); if (!ret) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected
by Liu Shixin 14 Mar '25

14 Mar '25

From: Jessica Zhang <quic_jesszhan(a)quicinc.com> stable inclusion from stable-v4.19.247 commit 1a5d1474026ea4f1a6f931075ca2adb884af39cf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP48W CVE: CVE-2022-49488 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ca75f6f7c6f89365e40f10f641b15981b1f07c31 ] There is a possibility for mdp5_get_global_state to return -EDEADLK when acquiring the modeset lock, but currently global_state in mdp5_mixer_release doesn't check for if an error is returned. To avoid a NULL dereference error, let's have mdp5_mixer_release check if an error is returned and propagate that error. Reported-by: Tomeu Vizoso <tomeu.vizoso(a)collabora.com> Signed-off-by: Jessica Zhang <quic_jesszhan(a)quicinc.com> Fixes: 7907a0d77cb4 ("drm/msm/mdp5: Use the new private_obj state") Reviewed-by: Rob Clark <robdclark(a)gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/485181/ Link: https://lore.kernel.org/r/20220505214051.155-2-quic_jesszhan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 10 ++++++++-- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c | 15 +++++++++++---- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h | 4 ++-- 3 files changed, 21 insertions(+), 8 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c index b1da9ce54379..f9179eb08e90 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c @@ -537,9 +537,15 @@ int mdp5_crtc_setup_pipeline(struct drm_crtc *crtc, if (ret) return ret; - mdp5_mixer_release(new_crtc_state->state, old_mixer); + ret = mdp5_mixer_release(new_crtc_state->state, old_mixer); + if (ret) + return ret; + if (old_r_mixer) { - mdp5_mixer_release(new_crtc_state->state, old_r_mixer); + ret = mdp5_mixer_release(new_crtc_state->state, old_r_mixer); + if (ret) + return ret; + if (!need_right_mixer) pipeline->r_mixer = NULL; } diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c index 113e6b569562..9c8275300b55 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c @@ -127,21 +127,28 @@ int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc, return 0; } -void mdp5_mixer_release(struct drm_atomic_state *s, struct mdp5_hw_mixer *mixer) +int mdp5_mixer_release(struct drm_atomic_state *s, struct mdp5_hw_mixer *mixer) { struct mdp5_global_state *global_state = mdp5_get_global_state(s); - struct mdp5_hw_mixer_state *new_state = &global_state->hwmixer; + struct mdp5_hw_mixer_state *new_state; if (!mixer) - return; + return 0; + + if (IS_ERR(global_state)) + return PTR_ERR(global_state); + + new_state = &global_state->hwmixer; if (WARN_ON(!new_state->hwmixer_to_crtc[mixer->idx])) - return; + return -EINVAL; DBG("%s: release from crtc %s", mixer->name, new_state->hwmixer_to_crtc[mixer->idx]->name); new_state->hwmixer_to_crtc[mixer->idx] = NULL; + + return 0; } void mdp5_mixer_destroy(struct mdp5_hw_mixer *mixer) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h index 9be94f567fbd..6bcb0b544665 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h @@ -41,7 +41,7 @@ void mdp5_mixer_destroy(struct mdp5_hw_mixer *lm); int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc, uint32_t caps, struct mdp5_hw_mixer **mixer, struct mdp5_hw_mixer **r_mixer); -void mdp5_mixer_release(struct drm_atomic_state *s, - struct mdp5_hw_mixer *mixer); +int mdp5_mixer_release(struct drm_atomic_state *s, + struct mdp5_hw_mixer *mixer); #endif /* __MDP5_LM_H__ */ -- 2.34.1

2 1

[PATCH OLK-5.10] orangefs: fix a oob in orangefs_debug_write
by Yifan Qiao 14 Mar '25

14 Mar '25

From: Mike Marshall <hubcap(a)omnibond.com> mainline inclusion from mainline-v6.14-rc1 commit f7c848431632598ff9bce57a659db6af60d75b39 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's suggestion and made this patch. Signed-off-by: Mike Marshall <hubcap(a)omnibond.com> Reported-by: syzbot+fc519d7875f2d9186c1f(a)syzkaller.appspotmail.com Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/orangefs/orangefs-debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c index 1b508f543384..fa41db088488 100644 --- a/fs/orangefs/orangefs-debugfs.c +++ b/fs/orangefs/orangefs-debugfs.c @@ -393,9 +393,9 @@ static ssize_t orangefs_debug_write(struct file *file, * Thwart users who try to jamb a ridiculous number * of bytes into the debug file... */ - if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) { + if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) { silly = count; - count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1; + count = ORANGEFS_MAX_DEBUG_STRING_LEN; } buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL); -- 2.39.2

2 1

[PATCH OLK-6.6 0/1] CVE-2024-58069
by Liao Chen 13 Mar '25

13 Mar '25

fix CVE-2024-58069 Oleksij Rempel (1): rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read drivers/rtc/rtc-pcf85063.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/2] CVE-2025-21816
by Xiongfeng Wang 13 Mar '25

13 Mar '25

Frederic Weisbecker (1): hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Xiongfeng Wang (1): hrtimer: Fix kabi broken of struct hrtimer_cpu_base include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 102 ++++++++++++++++++++++++++++++++-------- 2 files changed, 84 insertions(+), 19 deletions(-) -- 2.20.1

2 3

[PATCH OLK-5.10] PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: King Dix <kingdix10(a)qq.com> mainline inclusion from mainline-v6.14-rc1 commit 2d2da5a4c1b4509f6f7e5a8db015cd420144beb4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLK2 CVE: CVE-2025-21804 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region() macro to request a needed resource. A string variable that lives on the stack is then used to store a dynamically computed resource name, which is then passed on as one of the macro arguments. This can lead to undefined behavior. Depending on the current contents of the memory, the manifestations of errors may vary. One possible output may be as follows: $ cat /proc/iomem 30000000-37ffffff : 38000000-3fffffff : Sometimes, garbage may appear after the colon. In very rare cases, if no NULL-terminator is found in memory, the system might crash because the string iterator will overrun which can lead to access of unmapped memory above the stack. Thus, fix this by replacing outbound_name with the name of the previously requested resource. With the changes applied, the output will be as follows: $ cat /proc/iomem 30000000-37ffffff : memory2 38000000-3fffffff : memory3 Fixes: 2a6d0d63d999 ("PCI: rcar: Add endpoint mode support") Link: https://lore.kernel.org/r/tencent_DBDCC19D60F361119E76919ADAB25EC13C06@qq.c… Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> Signed-off-by: King Dix <kingdix10(a)qq.com> [kwilczynski: commit log] Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/pci/controller/pcie-rcar-ep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/controller/pcie-rcar-ep.c b/drivers/pci/controller/pcie-rcar-ep.c index c91d85b151290..fc85263797e91 100644 --- a/drivers/pci/controller/pcie-rcar-ep.c +++ b/drivers/pci/controller/pcie-rcar-ep.c @@ -110,7 +110,7 @@ static int rcar_pcie_parse_outbound_ranges(struct rcar_pcie_endpoint *ep, } if (!devm_request_mem_region(&pdev->dev, res->start, resource_size(res), - outbound_name)) { + res->name)) { dev_err(pcie->dev, "Cannot request memory region %s.\n", outbound_name); return -EIO; -- 2.20.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-21816
by Xiongfeng Wang 13 Mar '25

13 Mar '25

Frederic Weisbecker (1): hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Xiongfeng Wang (1): hrtimer: Fix kabi broken of struct hrtimer_cpu_base include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 103 ++++++++++++++++++++++++++++++++-------- 2 files changed, 83 insertions(+), 21 deletions(-) -- 2.20.1

2 3

[PATCH OLK-6.6] hrtimer: Fix kabi broken of struct hrtimer_cpu_base
by Xiongfeng Wang 13 Mar '25

13 Mar '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLI0 -------------------------------- Fix kabi broken caused by the following commit. Because the reserved size is not enough, and struct hrtimer_cpu_base is not contained by any other stucture, we use KABI_EXTEND to fix the kabi. Fixes: 14548083da37 ("[Backport] hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING") Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- include/linux/hrtimer.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h index 1ec9be2ce4be..623537ee5c48 100644 --- a/include/linux/hrtimer.h +++ b/include/linux/hrtimer.h @@ -244,10 +244,10 @@ struct hrtimer_cpu_base { ktime_t softirq_expires_next; struct hrtimer *softirq_next_timer; struct hrtimer_clock_base clock_base[HRTIMER_MAX_CLOCK_BASES]; - call_single_data_t csd; KABI_RESERVE(1) KABI_RESERVE(2) + KABI_EXTEND(call_single_data_t csd) } ____cacheline_aligned; static inline void hrtimer_set_expires(struct hrtimer *timer, ktime_t time) -- 2.20.1

2 1

[PATCH OLK-6.6] hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Frederic Weisbecker <frederic(a)kernel.org> mainline inclusion from mainline-v6.14-rc2 commit 53dac345395c0d2493cbc2f4c85fe38aef5b63f5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLI0 CVE: CVE-2025-21816 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- hrtimers are migrated away from the dying CPU to any online target at the CPUHP_AP_HRTIMERS_DYING stage in order not to delay bandwidth timers handling tasks involved in the CPU hotplug forward progress. However wakeups can still be performed by the outgoing CPU after CPUHP_AP_HRTIMERS_DYING. Those can result again in bandwidth timers being armed. Depending on several considerations (crystal ball power management based election, earliest timer already enqueued, timer migration enabled or not), the target may eventually be the current CPU even if offline. If that happens, the timer is eventually ignored. The most notable example is RCU which had to deal with each and every of those wake-ups by deferring them to an online CPU, along with related workarounds: _ e787644caf76 (rcu: Defer RCU kthreads wakeup when CPU is dying) _ 9139f93209d1 (rcu/nocb: Fix RT throttling hrtimer armed from offline CPU) _ f7345ccc62a4 (rcu/nocb: Fix rcuog wake-up from offline softirq) The problem isn't confined to RCU though as the stop machine kthread (which runs CPUHP_AP_HRTIMERS_DYING) reports its completion at the end of its work through cpu_stop_signal_done() and performs a wake up that eventually arms the deadline server timer: WARNING: CPU: 94 PID: 588 at kernel/time/hrtimer.c:1086 hrtimer_start_range_ns+0x289/0x2d0 CPU: 94 UID: 0 PID: 588 Comm: migration/94 Not tainted Stopper: multi_cpu_stop+0x0/0x120 <- stop_machine_cpuslocked+0x66/0xc0 RIP: 0010:hrtimer_start_range_ns+0x289/0x2d0 Call Trace: <TASK> start_dl_timer enqueue_dl_entity dl_server_start enqueue_task_fair enqueue_task ttwu_do_activate try_to_wake_up complete cpu_stopper_thread Instead of providing yet another bandaid to work around the situation, fix it in the hrtimers infrastructure instead: always migrate away a timer to an online target whenever it is enqueued from an offline CPU. This will also allow to revert all the above RCU disgraceful hacks. Fixes: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier") Reported-by: Vlad Poenaru <vlad.wing(a)gmail.com> Reported-by: Usama Arif <usamaarif642(a)gmail.com> Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org> Signed-off-by: Paul E. McKenney <paulmck(a)kernel.org> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Tested-by: Paul E. McKenney <paulmck(a)kernel.org> Link: https://lore.kernel.org/all/20250117232433.24027-1-frederic@kernel.org Closes: 20241213203739.1519801-1-usamaarif642(a)gmail.com Conflicts: include/linux/hrtimer_defs.h include/linux/hrtimer.h [wxf: fix conflicts because 'struct hrtimer_cpu_base' is moved to another file.] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 103 ++++++++++++++++++++++++++++++++-------- 2 files changed, 83 insertions(+), 21 deletions(-) diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h index 30df0b35aafe..1ec9be2ce4be 100644 --- a/include/linux/hrtimer.h +++ b/include/linux/hrtimer.h @@ -244,6 +244,7 @@ struct hrtimer_cpu_base { ktime_t softirq_expires_next; struct hrtimer *softirq_next_timer; struct hrtimer_clock_base clock_base[HRTIMER_MAX_CLOCK_BASES]; + call_single_data_t csd; KABI_RESERVE(1) KABI_RESERVE(2) diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c index 57e5cb36f1bc..a64c644df4ce 100644 --- a/kernel/time/hrtimer.c +++ b/kernel/time/hrtimer.c @@ -58,6 +58,8 @@ #define HRTIMER_ACTIVE_SOFT (HRTIMER_ACTIVE_HARD << MASK_SHIFT) #define HRTIMER_ACTIVE_ALL (HRTIMER_ACTIVE_SOFT | HRTIMER_ACTIVE_HARD) +static void retrigger_next_event(void *arg); + /* * The timer bases: * @@ -111,7 +113,8 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) = .clockid = CLOCK_TAI, .get_time = &ktime_get_clocktai, }, - } + }, + .csd = CSD_INIT(retrigger_next_event, NULL) }; static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = { @@ -124,6 +127,14 @@ static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = { [CLOCK_TAI] = HRTIMER_BASE_TAI, }; +static inline bool hrtimer_base_is_online(struct hrtimer_cpu_base *base) +{ + if (!IS_ENABLED(CONFIG_HOTPLUG_CPU)) + return true; + else + return likely(base->online); +} + /* * Functions and macros which are different for UP/SMP systems are kept in a * single place @@ -183,27 +194,54 @@ struct hrtimer_clock_base *lock_hrtimer_base(const struct hrtimer *timer, } /* - * We do not migrate the timer when it is expiring before the next - * event on the target cpu. When high resolution is enabled, we cannot - * reprogram the target cpu hardware and we would cause it to fire - * late. To keep it simple, we handle the high resolution enabled and - * disabled case similar. + * Check if the elected target is suitable considering its next + * event and the hotplug state of the current CPU. + * + * If the elected target is remote and its next event is after the timer + * to queue, then a remote reprogram is necessary. However there is no + * guarantee the IPI handling the operation would arrive in time to meet + * the high resolution deadline. In this case the local CPU becomes a + * preferred target, unless it is offline. + * + * High and low resolution modes are handled the same way for simplicity. * * Called with cpu_base->lock of target cpu held. */ -static int -hrtimer_check_target(struct hrtimer *timer, struct hrtimer_clock_base *new_base) +static bool hrtimer_suitable_target(struct hrtimer *timer, struct hrtimer_clock_base *new_base, + struct hrtimer_cpu_base *new_cpu_base, + struct hrtimer_cpu_base *this_cpu_base) { ktime_t expires; + /* + * The local CPU clockevent can be reprogrammed. Also get_target_base() + * guarantees it is online. + */ + if (new_cpu_base == this_cpu_base) + return true; + + /* + * The offline local CPU can't be the default target if the + * next remote target event is after this timer. Keep the + * elected new base. An IPI will we issued to reprogram + * it as a last resort. + */ + if (!hrtimer_base_is_online(this_cpu_base)) + return true; + expires = ktime_sub(hrtimer_get_expires(timer), new_base->offset); - return expires < new_base->cpu_base->expires_next; + + return expires >= new_base->cpu_base->expires_next; } -static inline -struct hrtimer_cpu_base *get_target_base(struct hrtimer_cpu_base *base, - int pinned) +static inline struct hrtimer_cpu_base *get_target_base(struct hrtimer_cpu_base *base, int pinned) { + if (!hrtimer_base_is_online(base)) { + int cpu = cpumask_any_and(cpu_online_mask, housekeeping_cpumask(HK_TYPE_TIMER)); + + return &per_cpu(hrtimer_bases, cpu); + } + #if defined(CONFIG_SMP) && defined(CONFIG_NO_HZ_COMMON) if (static_branch_likely(&timers_migration_enabled) && !pinned) return &per_cpu(hrtimer_bases, get_nohz_timer_target()); @@ -254,8 +292,8 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base, raw_spin_unlock(&base->cpu_base->lock); raw_spin_lock(&new_base->cpu_base->lock); - if (new_cpu_base != this_cpu_base && - hrtimer_check_target(timer, new_base)) { + if (!hrtimer_suitable_target(timer, new_base, new_cpu_base, + this_cpu_base)) { raw_spin_unlock(&new_base->cpu_base->lock); raw_spin_lock(&base->cpu_base->lock); new_cpu_base = this_cpu_base; @@ -264,8 +302,7 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base, } WRITE_ONCE(timer->base, new_base); } else { - if (new_cpu_base != this_cpu_base && - hrtimer_check_target(timer, new_base)) { + if (!hrtimer_suitable_target(timer, new_base, new_cpu_base, this_cpu_base)) { new_cpu_base = this_cpu_base; goto again; } @@ -730,8 +767,6 @@ static inline int hrtimer_is_hres_enabled(void) return hrtimer_hres_enabled; } -static void retrigger_next_event(void *arg); - /* * Switch to high resolution mode */ @@ -1218,6 +1253,7 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, u64 delta_ns, const enum hrtimer_mode mode, struct hrtimer_clock_base *base) { + struct hrtimer_cpu_base *this_cpu_base = this_cpu_ptr(&hrtimer_bases); struct hrtimer_clock_base *new_base; bool force_local, first; @@ -1229,9 +1265,15 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, * and enforce reprogramming after it is queued no matter whether * it is the new first expiring timer again or not. */ - force_local = base->cpu_base == this_cpu_ptr(&hrtimer_bases); + force_local = base->cpu_base == this_cpu_base; force_local &= base->cpu_base->next_timer == timer; + /* + * Don't force local queuing if this enqueue happens on a unplugged + * CPU after hrtimer_cpu_dying() has been invoked. + */ + force_local &= this_cpu_base->online; + /* * Remove an active timer from the queue. In case it is not queued * on the current CPU, make sure that remove_hrtimer() updates the @@ -1261,8 +1303,27 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, } first = enqueue_hrtimer(timer, new_base, mode); - if (!force_local) - return first; + if (!force_local) { + /* + * If the current CPU base is online, then the timer is + * never queued on a remote CPU if it would be the first + * expiring timer there. + */ + if (hrtimer_base_is_online(this_cpu_base)) + return first; + + /* + * Timer was enqueued remote because the current base is + * already offline. If the timer is the first to expire, + * kick the remote CPU to reprogram the clock event. + */ + if (first) { + struct hrtimer_cpu_base *new_cpu_base = new_base->cpu_base; + + smp_call_function_single_async(new_cpu_base->cpu, &new_cpu_base->csd); + } + return 0; + } /* * Timer was forced to stay on the current CPU to avoid -- 2.20.1

2 1

[PATCH OLK-6.6] PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: King Dix <kingdix10(a)qq.com> stable inclusion from stable-v6.6.76 commit 2c54b9fca1755e80a343ccfde0652dc5ea4744b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLK2 CVE: CVE-2025-21804 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2d2da5a4c1b4509f6f7e5a8db015cd420144beb4 ] The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region() macro to request a needed resource. A string variable that lives on the stack is then used to store a dynamically computed resource name, which is then passed on as one of the macro arguments. This can lead to undefined behavior. Depending on the current contents of the memory, the manifestations of errors may vary. One possible output may be as follows: $ cat /proc/iomem 30000000-37ffffff : 38000000-3fffffff : Sometimes, garbage may appear after the colon. In very rare cases, if no NULL-terminator is found in memory, the system might crash because the string iterator will overrun which can lead to access of unmapped memory above the stack. Thus, fix this by replacing outbound_name with the name of the previously requested resource. With the changes applied, the output will be as follows: $ cat /proc/iomem 30000000-37ffffff : memory2 38000000-3fffffff : memory3 Fixes: 2a6d0d63d999 ("PCI: rcar: Add endpoint mode support") Link: https://lore.kernel.org/r/tencent_DBDCC19D60F361119E76919ADAB25EC13C06@qq.c… Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> Signed-off-by: King Dix <kingdix10(a)qq.com> [kwilczynski: commit log] Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/pci/controller/pcie-rcar-ep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/controller/pcie-rcar-ep.c b/drivers/pci/controller/pcie-rcar-ep.c index f9682df1da61..209719fb6ddc 100644 --- a/drivers/pci/controller/pcie-rcar-ep.c +++ b/drivers/pci/controller/pcie-rcar-ep.c @@ -107,7 +107,7 @@ static int rcar_pcie_parse_outbound_ranges(struct rcar_pcie_endpoint *ep, } if (!devm_request_mem_region(&pdev->dev, res->start, resource_size(res), - outbound_name)) { + res->name)) { dev_err(pcie->dev, "Cannot request memory region %s.\n", outbound_name); return -EIO; -- 2.20.1

2 1

[PATCH OLK-6.6] LoongArch: Fix warnings during S3 suspend
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Huacai Chen <chenhuacai(a)loongson.cn> stable inclusion from stable-v6.6.76 commit d49ab6857d98266010f3446c9c2063014db5b654 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLK0 CVE: CVE-2025-21803 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 26c0a2d93af55d30a46d5f45d3e9c42cde730168 ] The enable_gpe_wakeup() function calls acpi_enable_all_wakeup_gpes(), and the later one may call the preempt_schedule_common() function, resulting in a thread switch and causing the CPU to be in an interrupt enabled state after the enable_gpe_wakeup() function returns, leading to the warnings as follow. [ C0] WARNING: ... at kernel/time/timekeeping.c:845 ktime_get+0xbc/0xc8 [ C0] ... [ C0] Call Trace: [ C0] [<90000000002243b4>] show_stack+0x64/0x188 [ C0] [<900000000164673c>] dump_stack_lvl+0x60/0x88 [ C0] [<90000000002687e4>] __warn+0x8c/0x148 [ C0] [<90000000015e9978>] report_bug+0x1c0/0x2b0 [ C0] [<90000000016478e4>] do_bp+0x204/0x3b8 [ C0] [<90000000025b1924>] exception_handlers+0x1924/0x10000 [ C0] [<9000000000343bbc>] ktime_get+0xbc/0xc8 [ C0] [<9000000000354c08>] tick_sched_timer+0x30/0xb0 [ C0] [<90000000003408e0>] __hrtimer_run_queues+0x160/0x378 [ C0] [<9000000000341f14>] hrtimer_interrupt+0x144/0x388 [ C0] [<9000000000228348>] constant_timer_interrupt+0x38/0x48 [ C0] [<90000000002feba4>] __handle_irq_event_percpu+0x64/0x1e8 [ C0] [<90000000002fed48>] handle_irq_event_percpu+0x20/0x80 [ C0] [<9000000000306b9c>] handle_percpu_irq+0x5c/0x98 [ C0] [<90000000002fd4a0>] generic_handle_domain_irq+0x30/0x48 [ C0] [<9000000000d0c7b0>] handle_cpu_irq+0x70/0xa8 [ C0] [<9000000001646b30>] handle_loongarch_irq+0x30/0x48 [ C0] [<9000000001646bc8>] do_vint+0x80/0xe0 [ C0] [<90000000002aea1c>] finish_task_switch.isra.0+0x8c/0x2a8 [ C0] [<900000000164e34c>] __schedule+0x314/0xa48 [ C0] [<900000000164ead8>] schedule+0x58/0xf0 [ C0] [<9000000000294a2c>] worker_thread+0x224/0x498 [ C0] [<900000000029d2f0>] kthread+0xf8/0x108 [ C0] [<9000000000221f28>] ret_from_kernel_thread+0xc/0xa4 [ C0] [ C0] ---[ end trace 0000000000000000 ]--- The root cause is acpi_enable_all_wakeup_gpes() uses a mutex to protect acpi_hw_enable_all_wakeup_gpes(), and acpi_ut_acquire_mutex() may cause a thread switch. Since there is no longer concurrent execution during loongarch_acpi_suspend(), we can call acpi_hw_enable_all_wakeup_gpes() directly in enable_gpe_wakeup(). The solution is similar to commit 22db06337f590d01 ("ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep()"). Fixes: 366bb35a8e48 ("LoongArch: Add suspend (ACPI S3) support") Signed-off-by: Qunqin Zhao <zhaoqunqin(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- arch/loongarch/power/platform.c | 2 +- drivers/acpi/acpica/achware.h | 2 -- include/acpi/acpixf.h | 1 + 3 files changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/loongarch/power/platform.c b/arch/loongarch/power/platform.c index 3ea8e07aa225..6c7735cda4d8 100644 --- a/arch/loongarch/power/platform.c +++ b/arch/loongarch/power/platform.c @@ -17,7 +17,7 @@ void enable_gpe_wakeup(void) if (acpi_gbl_reduced_hardware) return; - acpi_enable_all_wakeup_gpes(); + acpi_hw_enable_all_wakeup_gpes(); } void enable_pci_wakeup(void) diff --git a/drivers/acpi/acpica/achware.h b/drivers/acpi/acpica/achware.h index 79bbfe00d241..b8543a34caea 100644 --- a/drivers/acpi/acpica/achware.h +++ b/drivers/acpi/acpica/achware.h @@ -103,8 +103,6 @@ acpi_hw_get_gpe_status(struct acpi_gpe_event_info *gpe_event_info, acpi_status acpi_hw_enable_all_runtime_gpes(void); -acpi_status acpi_hw_enable_all_wakeup_gpes(void); - u8 acpi_hw_check_all_gpes(acpi_handle gpe_skip_device, u32 gpe_skip_number); acpi_status diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h index a3c9dd4a1ac3..7e9e7e769043 100644 --- a/include/acpi/acpixf.h +++ b/include/acpi/acpixf.h @@ -763,6 +763,7 @@ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status *event_status)) ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi_dispatch_gpe(acpi_handle gpe_device, u32 gpe_number)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_hw_disable_all_gpes(void)) +ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_hw_enable_all_wakeup_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_disable_all_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_runtime_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_wakeup_gpes(void)) -- 2.20.1

2 1

[PATCH OLK-6.6] wifi: wcn36xx: fix channel survey memory allocation size
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Barnabás Czémán <barnabas.czeman(a)mainlining.org> stable inclusion from stable-v6.6.76 commit e95f9c408ff8311f75eeabc8acf34a66670d8815 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBLV CVE: CVE-2024-57997 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6200d947f050efdba4090dfefd8a01981363d954 ] KASAN reported a memory allocation issue in wcn->chan_survey due to incorrect size calculation. This commit uses kcalloc to allocate memory for wcn->chan_survey, ensuring proper initialization and preventing the use of uninitialized values when there are no frames on the channel. Fixes: 29696e0aa413 ("wcn36xx: Track SNR and RSSI for each RX frame") Signed-off-by: Barnabás Czémán <barnabas.czeman(a)mainlining.org> Acked-by: Loic Poulain <loic.poulain(a)linaro.org> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> Link: https://patch.msgid.link/20241104-wcn36xx-memory-allocation-v1-1-5ec901cf37… Signed-off-by: Jeff Johnson <quic_jjohnson(a)quicinc.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/net/wireless/ath/wcn36xx/main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c index 2bd1163177f0..9bbbc86fd2d9 100644 --- a/drivers/net/wireless/ath/wcn36xx/main.c +++ b/drivers/net/wireless/ath/wcn36xx/main.c @@ -1586,7 +1586,10 @@ static int wcn36xx_probe(struct platform_device *pdev) } n_channels = wcn_band_2ghz.n_channels + wcn_band_5ghz.n_channels; - wcn->chan_survey = devm_kmalloc(wcn->dev, n_channels, GFP_KERNEL); + wcn->chan_survey = devm_kcalloc(wcn->dev, + n_channels, + sizeof(struct wcn36xx_chan_survey), + GFP_KERNEL); if (!wcn->chan_survey) { ret = -ENOMEM; goto out_wq; -- 2.20.1

2 1

[PATCH OLK-6.6] OPP: add index check to assert to avoid buffer overflow in _read_freq()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Neil Armstrong <neil.armstrong(a)linaro.org> stable inclusion from stable-v6.6.76 commit eb6ffa0192ba83ece1a318b956265519c5c7dcec category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBNO CVE: CVE-2024-57998 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d659bc68ed489022ea33342cfbda2911a81e7a0d ] Pass the freq index to the assert function to make sure we do not read a freq out of the opp->rates[] table when called from the indexed variants: dev_pm_opp_find_freq_exact_indexed() or dev_pm_opp_find_freq_ceil/floor_indexed(). Add a secondary parameter to the assert function, unused for assert_single_clk() then add assert_clk_index() which will check for the clock index when called from the _indexed() find functions. Fixes: 142e17c1c2b4 ("OPP: Introduce dev_pm_opp_find_freq_{ceil/floor}_indexed() APIs") Fixes: a5893928bb17 ("OPP: Add dev_pm_opp_find_freq_exact_indexed()") Signed-off-by: Neil Armstrong <neil.armstrong(a)linaro.org> Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/opp/core.c | 42 +++++++++++++++++++++++++++--------------- 1 file changed, 27 insertions(+), 15 deletions(-) diff --git a/drivers/opp/core.c b/drivers/opp/core.c index bceb27b1baa1..3c26130dc75e 100644 --- a/drivers/opp/core.c +++ b/drivers/opp/core.c @@ -101,11 +101,21 @@ struct opp_table *_find_opp_table(struct device *dev) * representation in the OPP table and manage the clock configuration themselves * in an platform specific way. */ -static bool assert_single_clk(struct opp_table *opp_table) +static bool assert_single_clk(struct opp_table *opp_table, + unsigned int __always_unused index) { return !WARN_ON(opp_table->clk_count > 1); } +/* + * Returns true if clock table is large enough to contain the clock index. + */ +static bool assert_clk_index(struct opp_table *opp_table, + unsigned int index) +{ + return opp_table->clk_count > index; +} + /** * dev_pm_opp_get_voltage() - Gets the voltage corresponding to an opp * @opp: opp for which voltage has to be returned for @@ -499,12 +509,12 @@ static struct dev_pm_opp *_opp_table_find_key(struct opp_table *opp_table, unsigned long (*read)(struct dev_pm_opp *opp, int index), bool (*compare)(struct dev_pm_opp **opp, struct dev_pm_opp *temp_opp, unsigned long opp_key, unsigned long key), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { struct dev_pm_opp *temp_opp, *opp = ERR_PTR(-ERANGE); /* Assert that the requirement is met */ - if (assert && !assert(opp_table)) + if (assert && !assert(opp_table, index)) return ERR_PTR(-EINVAL); mutex_lock(&opp_table->lock); @@ -532,7 +542,7 @@ _find_key(struct device *dev, unsigned long *key, int index, bool available, unsigned long (*read)(struct dev_pm_opp *opp, int index), bool (*compare)(struct dev_pm_opp **opp, struct dev_pm_opp *temp_opp, unsigned long opp_key, unsigned long key), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { struct opp_table *opp_table; struct dev_pm_opp *opp; @@ -555,7 +565,7 @@ _find_key(struct device *dev, unsigned long *key, int index, bool available, static struct dev_pm_opp *_find_key_exact(struct device *dev, unsigned long key, int index, bool available, unsigned long (*read)(struct dev_pm_opp *opp, int index), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { /* * The value of key will be updated here, but will be ignored as the @@ -568,7 +578,7 @@ static struct dev_pm_opp *_find_key_exact(struct device *dev, static struct dev_pm_opp *_opp_table_find_key_ceil(struct opp_table *opp_table, unsigned long *key, int index, bool available, unsigned long (*read)(struct dev_pm_opp *opp, int index), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { return _opp_table_find_key(opp_table, key, index, available, read, _compare_ceil, assert); @@ -577,7 +587,7 @@ static struct dev_pm_opp *_opp_table_find_key_ceil(struct opp_table *opp_table, static struct dev_pm_opp *_find_key_ceil(struct device *dev, unsigned long *key, int index, bool available, unsigned long (*read)(struct dev_pm_opp *opp, int index), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { return _find_key(dev, key, index, available, read, _compare_ceil, assert); @@ -586,7 +596,7 @@ static struct dev_pm_opp *_find_key_ceil(struct device *dev, unsigned long *key, static struct dev_pm_opp *_find_key_floor(struct device *dev, unsigned long *key, int index, bool available, unsigned long (*read)(struct dev_pm_opp *opp, int index), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { return _find_key(dev, key, index, available, read, _compare_floor, assert); @@ -647,7 +657,8 @@ struct dev_pm_opp * dev_pm_opp_find_freq_exact_indexed(struct device *dev, unsigned long freq, u32 index, bool available) { - return _find_key_exact(dev, freq, index, available, _read_freq, NULL); + return _find_key_exact(dev, freq, index, available, _read_freq, + assert_clk_index); } EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_exact_indexed); @@ -707,7 +718,8 @@ struct dev_pm_opp * dev_pm_opp_find_freq_ceil_indexed(struct device *dev, unsigned long *freq, u32 index) { - return _find_key_ceil(dev, freq, index, true, _read_freq, NULL); + return _find_key_ceil(dev, freq, index, true, _read_freq, + assert_clk_index); } EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_ceil_indexed); @@ -760,7 +772,7 @@ struct dev_pm_opp * dev_pm_opp_find_freq_floor_indexed(struct device *dev, unsigned long *freq, u32 index) { - return _find_key_floor(dev, freq, index, true, _read_freq, NULL); + return _find_key_floor(dev, freq, index, true, _read_freq, assert_clk_index); } EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_floor_indexed); @@ -1676,7 +1688,7 @@ void dev_pm_opp_remove(struct device *dev, unsigned long freq) if (IS_ERR(opp_table)) return; - if (!assert_single_clk(opp_table)) + if (!assert_single_clk(opp_table, 0)) goto put_table; mutex_lock(&opp_table->lock); @@ -2027,7 +2039,7 @@ int _opp_add_v1(struct opp_table *opp_table, struct device *dev, unsigned long tol; int ret; - if (!assert_single_clk(opp_table)) + if (!assert_single_clk(opp_table, 0)) return -EINVAL; new_opp = _opp_allocate(opp_table); @@ -2889,7 +2901,7 @@ static int _opp_set_availability(struct device *dev, unsigned long freq, return r; } - if (!assert_single_clk(opp_table)) { + if (!assert_single_clk(opp_table, 0)) { r = -EINVAL; goto put_table; } @@ -2965,7 +2977,7 @@ int dev_pm_opp_adjust_voltage(struct device *dev, unsigned long freq, return r; } - if (!assert_single_clk(opp_table)) { + if (!assert_single_clk(opp_table, 0)) { r = -EINVAL; goto put_table; } -- 2.20.1

2 1

[PATCH OLK-6.6] iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Qasim Ijaz <qasdev00(a)gmail.com> stable inclusion from stable-v6.6.76 commit 38ac76fc06bc6826a3e4b12a98efbe98432380a9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBI4 CVE: CVE-2025-21724 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e24c1551059268b37f6f40639883eafb281b8b9c ] Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index() where shifting the constant "1" (of type int) by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior. The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63) the shift operation overflows, as the result cannot be represented in a 32-bit type. To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type to match the operand's type. Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support") Link: https://patch.msgid.link/r/20250113223820.10713-1-qasdev00@gmail.com Reported-by: syzbot <syzbot+85992ace37d5b7b51635(a)syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635 Signed-off-by: Qasim Ijaz <qasdev00(a)gmail.com> Reviewed-by: Joao Martins <joao.m.martins(a)oracle.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/iommu/iommufd/iova_bitmap.c drivers/vfio/iova_bitmap.c [Context conflicts] Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/iommu/iommufd/iova_bitmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/iommufd/iova_bitmap.c b/drivers/iommu/iommufd/iova_bitmap.c index ca5a1757adcd..9527db8d7ba1 100644 --- a/drivers/iommu/iommufd/iova_bitmap.c +++ b/drivers/iommu/iommufd/iova_bitmap.c @@ -130,7 +130,7 @@ struct iova_bitmap { static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap, unsigned long iova) { - unsigned long pgsize = 1 << bitmap->mapped.pgshift; + unsigned long pgsize = 1UL << bitmap->mapped.pgshift; return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize); } -- 2.20.1

2 1

[PATCH OLK-6.6] PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Niklas Cassel <cassel(a)kernel.org> mainline inclusion from mainline-v6.14-rc1 commit 3708acbd5f169ebafe1faa519cb28adc56295546 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC3J CVE: CVE-2024-58006 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In commit 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address") set_bar() was modified to support dynamically changing the backing physical address of a BAR that was already configured. This means that set_bar() can be called twice, without ever calling clear_bar() (as calling clear_bar() would clear the BAR's PCI address assigned by the host). This can only be done if the new BAR size/flags does not differ from the existing BAR configuration. Add these missing checks. If we allow set_bar() to set e.g. a new BAR size that differs from the existing BAR size, the new address translation range will be smaller than the BAR size already determined by the host, which would mean that a read past the new BAR size would pass the iATU untranslated, which could allow the host to read memory not belonging to the new struct pci_epf_bar. While at it, add comments which clarifies the support for dynamically changing the physical address of a BAR. (Which was also missing.) Fixes: 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address") Link: https://lore.kernel.org/r/20241213143301.4158431-10-cassel@kernel.org Signed-off-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Cc: stable(a)vger.kernel.org Conflicts: drivers/pci/controller/dwc/pcie-designware-ep.c [wxf: fix conflicts because of the following commit is not merged. commit 33a6938e0c337 "PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar()"] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- .../pci/controller/dwc/pcie-designware-ep.c | 22 ++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c index f2e5feba5526..7fd64ac2cea1 100644 --- a/drivers/pci/controller/dwc/pcie-designware-ep.c +++ b/drivers/pci/controller/dwc/pcie-designware-ep.c @@ -256,8 +256,28 @@ static int dw_pcie_ep_set_bar(struct pci_epc *epc, u8 func_no, u8 vfunc_no, if (ret) return ret; - if (ep->epf_bar[bar]) + /* + * Certain EPF drivers dynamically change the physical address of a BAR + * (i.e. they call set_bar() twice, without ever calling clear_bar(), as + * calling clear_bar() would clear the BAR's PCI address assigned by the + * host). + */ + if (ep->epf_bar[bar]) { + /* + * We can only dynamically change a BAR if the new BAR size and + * BAR flags do not differ from the existing configuration. + */ + if (ep->epf_bar[bar]->barno != bar || + ep->epf_bar[bar]->size != size || + ep->epf_bar[bar]->flags != flags) + return -EINVAL; + + /* + * When dynamically changing a BAR, skip writing the BAR reg, as + * that would clear the BAR's PCI address assigned by the host. + */ return 0; + } dw_pcie_dbi_ro_wr_en(pci); -- 2.20.1

2 1

[PATCH OLK-6.6] afs: Fix the maximum cell name length
by Qi Xi 13 Mar '25

13 Mar '25

From: David Howells <dhowells(a)redhat.com> mainline inclusion from mainline-v6.13-rc7 commit 8fd56ad6e7c90ac2bddb0741c6b248c8c5d56ac8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQQL CVE: CVE-2025-21646 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kafs filesystem limits the maximum length of a cell to 256 bytes, but a problem occurs if someone actually does that: kafs tries to create a directory under /proc/net/afs/ with the name of the cell, but that fails with a warning: WARNING: CPU: 0 PID: 9 at fs/proc/generic.c:405 because procfs limits the maximum filename length to 255. However, the DNS limits the maximum lookup length and, by extension, the maximum cell name, to 255 less two (length count and trailing NUL). Fix this by limiting the maximum acceptable cellname length to 253. This also allows us to be sure we can create the "/afs/.<cell>/" mountpoint too. Further, split the YFS VL record cell name maximum to be the 256 allowed by the protocol and ignore the record retrieved by YFSVL.GetCellName if it exceeds 253. Fixes: c3e9f888263b ("afs: Implement client support for the YFSVL.GetCellName RPC op") Reported-by: syzbot+7848fee1f1e5c53f912b(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/6776d25d.050a0220.3a8527.0048.GAE@google.com/ Signed-off-by: David Howells <dhowells(a)redhat.com> Link: https://lore.kernel.org/r/376236.1736180460@warthog.procyon.org.uk Tested-by: syzbot+7848fee1f1e5c53f912b(a)syzkaller.appspotmail.com cc: Marc Dionne <marc.dionne(a)auristor.com> cc: linux-afs(a)lists.infradead.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- fs/afs/afs.h | 2 +- fs/afs/afs_vl.h | 1 + fs/afs/vl_alias.c | 8 ++++++-- fs/afs/vlclient.c | 2 +- 4 files changed, 9 insertions(+), 4 deletions(-) diff --git a/fs/afs/afs.h b/fs/afs/afs.h index 81815724db6c..25c17100798b 100644 --- a/fs/afs/afs.h +++ b/fs/afs/afs.h @@ -10,7 +10,7 @@ #include <linux/in.h> -#define AFS_MAXCELLNAME 256 /* Maximum length of a cell name */ +#define AFS_MAXCELLNAME 253 /* Maximum length of a cell name (DNS limited) */ #define AFS_MAXVOLNAME 64 /* Maximum length of a volume name */ #define AFS_MAXNSERVERS 8 /* Maximum servers in a basic volume record */ #define AFS_NMAXNSERVERS 13 /* Maximum servers in a N/U-class volume record */ diff --git a/fs/afs/afs_vl.h b/fs/afs/afs_vl.h index 9c65ffb8a523..8da0899fbc08 100644 --- a/fs/afs/afs_vl.h +++ b/fs/afs/afs_vl.h @@ -13,6 +13,7 @@ #define AFS_VL_PORT 7003 /* volume location service port */ #define VL_SERVICE 52 /* RxRPC service ID for the Volume Location service */ #define YFS_VL_SERVICE 2503 /* Service ID for AuriStor upgraded VL service */ +#define YFS_VL_MAXCELLNAME 256 /* Maximum length of a cell name in YFS protocol */ enum AFSVL_Operations { VLGETENTRYBYID = 503, /* AFS Get VLDB entry by ID */ diff --git a/fs/afs/vl_alias.c b/fs/afs/vl_alias.c index f04a80e4f5c3..83cf1bfbe343 100644 --- a/fs/afs/vl_alias.c +++ b/fs/afs/vl_alias.c @@ -302,6 +302,7 @@ static char *afs_vl_get_cell_name(struct afs_cell *cell, struct key *key) static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key) { struct afs_cell *master; + size_t name_len; char *cell_name; cell_name = afs_vl_get_cell_name(cell, key); @@ -313,8 +314,11 @@ static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key) return 0; } - master = afs_lookup_cell(cell->net, cell_name, strlen(cell_name), - NULL, false); + name_len = strlen(cell_name); + if (!name_len || name_len > AFS_MAXCELLNAME) + master = ERR_PTR(-EOPNOTSUPP); + else + master = afs_lookup_cell(cell->net, cell_name, name_len, NULL, false); kfree(cell_name); if (IS_ERR(master)) return PTR_ERR(master); diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c index 00fca3c66ba6..16653f2ffe4f 100644 --- a/fs/afs/vlclient.c +++ b/fs/afs/vlclient.c @@ -671,7 +671,7 @@ static int afs_deliver_yfsvl_get_cell_name(struct afs_call *call) return ret; namesz = ntohl(call->tmp); - if (namesz > AFS_MAXCELLNAME) + if (namesz > YFS_VL_MAXCELLNAME) return afs_protocol_error(call, afs_eproto_cellname_len); paddedsz = (namesz + 3) & ~3; call->count = namesz; -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS] powerpc/pseries: Fix use after free in remove_phb_dynamic()
by Qi Xi 13 Mar '25

13 Mar '25

From: Michael Ellerman <mpe(a)ellerman.id.au> mainline inclusion from mainline-v5.18-rc1 commit fe2640bd7a62f1f7c3f55fbda31084085075bc30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1SK CVE: CVE-2022-49196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In remove_phb_dynamic() we use &phb->io_resource, after we've called device_unregister(&host_bridge->dev). But the unregister may have freed phb, because pcibios_free_controller_deferred() is the release function for the host_bridge. If there are no outstanding references when we call device_unregister() then phb will be freed out from under us. This has gone mainly unnoticed, but with slub_debug and page_poison enabled it can lead to a crash: PID: 7574 TASK: c0000000d492cb80 CPU: 13 COMMAND: "drmgr" #0 [c0000000e4f075a0] crash_kexec at c00000000027d7dc #1 [c0000000e4f075d0] oops_end at c000000000029608 #2 [c0000000e4f07650] __bad_page_fault at c0000000000904b4 #3 [c0000000e4f076c0] do_bad_slb_fault at c00000000009a5a8 #4 [c0000000e4f076f0] data_access_slb_common_virt at c000000000008b30 Data SLB Access [380] exception frame: R0: c000000000167250 R1: c0000000e4f07a00 R2: c000000002a46100 R3: c000000002b39ce8 R4: 00000000000000c0 R5: 00000000000000a9 R6: 3894674d000000c0 R7: 0000000000000000 R8: 00000000000000ff R9: 0000000000000100 R10: 6b6b6b6b6b6b6b6b R11: 0000000000008000 R12: c00000000023da80 R13: c0000009ffd38b00 R14: 0000000000000000 R15: 000000011c87f0f0 R16: 0000000000000006 R17: 0000000000000003 R18: 0000000000000002 R19: 0000000000000004 R20: 0000000000000005 R21: 000000011c87ede8 R22: 000000011c87c5a8 R23: 000000011c87d3a0 R24: 0000000000000000 R25: 0000000000000001 R26: c0000000e4f07cc8 R27: c00000004d1cc400 R28: c0080000031d00e8 R29: c00000004d23d800 R30: c00000004d1d2400 R31: c00000004d1d2540 NIP: c000000000167258 MSR: 8000000000009033 OR3: c000000000e9f474 CTR: 0000000000000000 LR: c000000000167250 XER: 0000000020040003 CCR: 0000000024088420 MQ: 0000000000000000 DAR: 6b6b6b6b6b6b6ba3 DSISR: c0000000e4f07920 Syscall Result: fffffffffffffff2 [NIP : release_resource+56] [LR : release_resource+48] #5 [c0000000e4f07a00] release_resource at c000000000167258 (unreliable) #6 [c0000000e4f07a30] remove_phb_dynamic at c000000000105648 #7 [c0000000e4f07ab0] dlpar_remove_slot at c0080000031a09e8 [rpadlpar_io] #8 [c0000000e4f07b50] remove_slot_store at c0080000031a0b9c [rpadlpar_io] #9 [c0000000e4f07be0] kobj_attr_store at c000000000817d8c #10 [c0000000e4f07c00] sysfs_kf_write at c00000000063e504 #11 [c0000000e4f07c20] kernfs_fop_write_iter at c00000000063d868 #12 [c0000000e4f07c70] new_sync_write at c00000000054339c #13 [c0000000e4f07d10] vfs_write at c000000000546624 #14 [c0000000e4f07d60] ksys_write at c0000000005469f4 #15 [c0000000e4f07db0] system_call_exception at c000000000030840 #16 [c0000000e4f07e10] system_call_vectored_common at c00000000000c168 To avoid it, we can take a reference to the host_bridge->dev until we're done using phb. Then when we drop the reference the phb will be freed. Fixes: 2dd9c11b9d4d ("powerpc/pseries: use pci_host_bridge.release_fn() to kfree(phb)") Reported-by: David Dai <zdai(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Tested-by: Sachin Sant <sachinp(a)linux.ibm.com> Link: https://lore.kernel.org/r/20220318034219.1188008-1-mpe@ellerman.id.au Conflicts: arch/powerpc/platforms/pseries/pci_dlpar.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/powerpc/platforms/pseries/pci_dlpar.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c index 561917fa54a8..bf4ca557c32d 100644 --- a/arch/powerpc/platforms/pseries/pci_dlpar.c +++ b/arch/powerpc/platforms/pseries/pci_dlpar.c @@ -89,6 +89,9 @@ int remove_phb_dynamic(struct pci_controller *phb) } } + /* Keep a reference so phb isn't freed yet */ + get_device(&host_bridge->dev); + /* Remove the PCI bus and unregister the bridge device from sysfs */ phb->bus = NULL; pci_remove_bus(b); @@ -111,6 +114,7 @@ int remove_phb_dynamic(struct pci_controller *phb) * the pcibios_free_controller_deferred() callback; * see pseries_root_bridge_prepare(). */ + put_device(&host_bridge->dev); return 0; } -- 2.33.0

2 1

[PATCH OLK-6.6 v2 1/2] fuse: cleanup request queuing towards virtiofs
by Yang Erkun 13 Mar '25

13 Mar '25

From: Miklos Szeredi <mszeredi(a)redhat.com> mainline inclusion from mainline-v6.12-rc1 commit 5de8acb41c86f1d335d165e0a350441ea3a1f480 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBT4CQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Virtiofs has its own queuing mechanism, but still requests are first queued on fiq->pending to be immediately dequeued and queued onto the virtio queue. The queuing on fiq->pending is unnecessary and might even have some performance impact due to being a contention point. Forget requests are handled similarly. Move the queuing of requests and forgets into the fiq->ops->*. fuse_iqueue_ops are renamed to reflect the new semantics. Reviewed-by: Stefan Hajnoczi <stefanha(a)redhat.com> Fixed-by: Jingbo Xu <jefflexu(a)linux.alibaba.com> Reviewed-by: Jingbo Xu <jefflexu(a)linux.alibaba.com> Tested-by: Peter-Jan Gootzen <pgootzen(a)nvidia.com> Reviewed-by: Peter-Jan Gootzen <pgootzen(a)nvidia.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Conflicts: fs/fuse/dev.c fs/fuse/fuse_i.h fs/fuse/virtio_fs.c [Context conflicts] Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/fuse/dev.c | 157 ++++++++++++++++++++++++-------------------- fs/fuse/fuse_i.h | 19 ++---- fs/fuse/virtio_fs.c | 41 ++++-------- 3 files changed, 105 insertions(+), 112 deletions(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 8573d79ef29c..51330a688b17 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -192,11 +192,22 @@ unsigned int fuse_len_args(unsigned int numargs, struct fuse_arg *args) } EXPORT_SYMBOL_GPL(fuse_len_args); -u64 fuse_get_unique(struct fuse_iqueue *fiq) +static u64 fuse_get_unique_locked(struct fuse_iqueue *fiq) { fiq->reqctr += FUSE_REQ_ID_STEP; return fiq->reqctr; } + +u64 fuse_get_unique(struct fuse_iqueue *fiq) +{ + u64 ret; + + spin_lock(&fiq->lock); + ret = fuse_get_unique_locked(fiq); + spin_unlock(&fiq->lock); + + return ret; +} EXPORT_SYMBOL_GPL(fuse_get_unique); static unsigned int fuse_req_hash(u64 unique) @@ -215,22 +226,68 @@ __releases(fiq->lock) spin_unlock(&fiq->lock); } +static void fuse_dev_queue_forget(struct fuse_iqueue *fiq, struct fuse_forget_link *forget) +{ + spin_lock(&fiq->lock); + if (fiq->connected) { + fiq->forget_list_tail->next = forget; + fiq->forget_list_tail = forget; + fuse_dev_wake_and_unlock(fiq); + } else { + kfree(forget); + spin_unlock(&fiq->lock); + } +} + +static void fuse_dev_queue_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req) +{ + spin_lock(&fiq->lock); + if (list_empty(&req->intr_entry)) { + list_add_tail(&req->intr_entry, &fiq->interrupts); + /* + * Pairs with smp_mb() implied by test_and_set_bit() + * from fuse_request_end(). + */ + smp_mb(); + if (test_bit(FR_FINISHED, &req->flags)) { + list_del_init(&req->intr_entry); + spin_unlock(&fiq->lock); + } else { + fuse_dev_wake_and_unlock(fiq); + } + } else { + spin_unlock(&fiq->lock); + } +} + +static void fuse_dev_queue_req(struct fuse_iqueue *fiq, struct fuse_req *req) +{ + spin_lock(&fiq->lock); + if (fiq->connected) { + if (req->in.h.opcode != FUSE_NOTIFY_REPLY) + req->in.h.unique = fuse_get_unique_locked(fiq); + list_add_tail(&req->list, &fiq->pending); + fuse_dev_wake_and_unlock(fiq); + } else { + spin_unlock(&fiq->lock); + req->out.h.error = -ENOTCONN; + fuse_request_end(req); + } +} + const struct fuse_iqueue_ops fuse_dev_fiq_ops = { - .wake_forget_and_unlock = fuse_dev_wake_and_unlock, - .wake_interrupt_and_unlock = fuse_dev_wake_and_unlock, - .wake_pending_and_unlock = fuse_dev_wake_and_unlock, + .send_forget = fuse_dev_queue_forget, + .send_interrupt = fuse_dev_queue_interrupt, + .send_req = fuse_dev_queue_req, }; EXPORT_SYMBOL_GPL(fuse_dev_fiq_ops); -static void queue_request_and_unlock(struct fuse_iqueue *fiq, - struct fuse_req *req) -__releases(fiq->lock) +static void fuse_send_one(struct fuse_iqueue *fiq, struct fuse_req *req) { req->in.h.len = sizeof(struct fuse_in_header) + fuse_len_args(req->args->in_numargs, (struct fuse_arg *) req->args->in_args); - list_add_tail(&req->list, &fiq->pending); - fiq->ops->wake_pending_and_unlock(fiq); + fiq->ops->send_req(fiq, req); } void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget, @@ -241,15 +298,7 @@ void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget, forget->forget_one.nodeid = nodeid; forget->forget_one.nlookup = nlookup; - spin_lock(&fiq->lock); - if (fiq->connected) { - fiq->forget_list_tail->next = forget; - fiq->forget_list_tail = forget; - fiq->ops->wake_forget_and_unlock(fiq); - } else { - kfree(forget); - spin_unlock(&fiq->lock); - } + fiq->ops->send_forget(fiq, forget); } static void flush_bg_queue(struct fuse_conn *fc) @@ -263,9 +312,7 @@ static void flush_bg_queue(struct fuse_conn *fc) req = list_first_entry(&fc->bg_queue, struct fuse_req, list); list_del(&req->list); fc->active_background++; - spin_lock(&fiq->lock); - req->in.h.unique = fuse_get_unique(fiq); - queue_request_and_unlock(fiq, req); + fuse_send_one(fiq, req); } } @@ -335,29 +382,12 @@ static int queue_interrupt(struct fuse_req *req) { struct fuse_iqueue *fiq = &req->fm->fc->iq; - spin_lock(&fiq->lock); /* Check for we've sent request to interrupt this req */ - if (unlikely(!test_bit(FR_INTERRUPTED, &req->flags))) { - spin_unlock(&fiq->lock); + if (unlikely(!test_bit(FR_INTERRUPTED, &req->flags))) return -EINVAL; - } - if (list_empty(&req->intr_entry)) { - list_add_tail(&req->intr_entry, &fiq->interrupts); - /* - * Pairs with smp_mb() implied by test_and_set_bit() - * from fuse_request_end(). - */ - smp_mb(); - if (test_bit(FR_FINISHED, &req->flags)) { - list_del_init(&req->intr_entry); - spin_unlock(&fiq->lock); - return 0; - } - fiq->ops->wake_interrupt_and_unlock(fiq); - } else { - spin_unlock(&fiq->lock); - } + fiq->ops->send_interrupt(fiq, req); + return 0; } @@ -412,21 +442,15 @@ static void __fuse_request_send(struct fuse_req *req) struct fuse_iqueue *fiq = &req->fm->fc->iq; BUG_ON(test_bit(FR_BACKGROUND, &req->flags)); - spin_lock(&fiq->lock); - if (!fiq->connected) { - spin_unlock(&fiq->lock); - req->out.h.error = -ENOTCONN; - } else { - req->in.h.unique = fuse_get_unique(fiq); - /* acquire extra reference, since request is still needed - after fuse_request_end() */ - __fuse_get_request(req); - queue_request_and_unlock(fiq, req); - request_wait_answer(req); - /* Pairs with smp_wmb() in fuse_request_end() */ - smp_rmb(); - } + /* acquire extra reference, since request is still needed after + fuse_request_end() */ + __fuse_get_request(req); + fuse_send_one(fiq, req); + + request_wait_answer(req); + /* Pairs with smp_wmb() in fuse_request_end() */ + smp_rmb(); } static void fuse_adjust_compat(struct fuse_conn *fc, struct fuse_args *args) @@ -581,7 +605,6 @@ static int fuse_simple_notify_reply(struct fuse_mount *fm, { struct fuse_req *req; struct fuse_iqueue *fiq = &fm->fc->iq; - int err = 0; req = fuse_get_req(fm, false); if (IS_ERR(req)) @@ -592,16 +615,9 @@ static int fuse_simple_notify_reply(struct fuse_mount *fm, fuse_args_to_req(req, args); - spin_lock(&fiq->lock); - if (fiq->connected) { - queue_request_and_unlock(fiq, req); - } else { - err = -ENODEV; - spin_unlock(&fiq->lock); - fuse_put_request(req); - } + fuse_send_one(fiq, req); - return err; + return 0; } /* @@ -1076,9 +1092,9 @@ __releases(fiq->lock) return err ? err : reqsize; } -struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, - unsigned int max, - unsigned int *countp) +static struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, + unsigned int max, + unsigned int *countp) { struct fuse_forget_link *head = fiq->forget_list_head.next; struct fuse_forget_link **newhead = &head; @@ -1097,7 +1113,6 @@ struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, return head; } -EXPORT_SYMBOL(fuse_dequeue_forget); static int fuse_read_single_forget(struct fuse_iqueue *fiq, struct fuse_copy_state *cs, @@ -1112,7 +1127,7 @@ __releases(fiq->lock) struct fuse_in_header ih = { .opcode = FUSE_FORGET, .nodeid = forget->forget_one.nodeid, - .unique = fuse_get_unique(fiq), + .unique = fuse_get_unique_locked(fiq), .len = sizeof(ih) + sizeof(arg), }; @@ -1143,7 +1158,7 @@ __releases(fiq->lock) struct fuse_batch_forget_in arg = { .count = 0 }; struct fuse_in_header ih = { .opcode = FUSE_BATCH_FORGET, - .unique = fuse_get_unique(fiq), + .unique = fuse_get_unique_locked(fiq), .len = sizeof(ih) + sizeof(arg), }; diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index 1bb136bcbe9e..8d702f96b9e5 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -416,22 +416,19 @@ struct fuse_iqueue; */ struct fuse_iqueue_ops { /** - * Signal that a forget has been queued + * Send one forget */ - void (*wake_forget_and_unlock)(struct fuse_iqueue *fiq) - __releases(fiq->lock); + void (*send_forget)(struct fuse_iqueue *fiq, struct fuse_forget_link *link); /** - * Signal that an INTERRUPT request has been queued + * Send interrupt for request */ - void (*wake_interrupt_and_unlock)(struct fuse_iqueue *fiq) - __releases(fiq->lock); + void (*send_interrupt)(struct fuse_iqueue *fiq, struct fuse_req *req); /** - * Signal that a request has been queued + * Send one request */ - void (*wake_pending_and_unlock)(struct fuse_iqueue *fiq) - __releases(fiq->lock); + void (*send_req)(struct fuse_iqueue *fiq, struct fuse_req *req); /** * Clean up when fuse_iqueue is destroyed @@ -1019,10 +1016,6 @@ void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget, struct fuse_forget_link *fuse_alloc_forget(void); -struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, - unsigned int max, - unsigned int *countp); - /* * Initialize READ or READDIR request */ diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c index ba816b50c1d4..a6e31e68906a 100644 --- a/fs/fuse/virtio_fs.c +++ b/fs/fuse/virtio_fs.c @@ -1083,22 +1083,13 @@ static struct virtio_driver virtio_fs_driver = { #endif }; -static void virtio_fs_wake_forget_and_unlock(struct fuse_iqueue *fiq) -__releases(fiq->lock) +static void virtio_fs_send_forget(struct fuse_iqueue *fiq, struct fuse_forget_link *link) { - struct fuse_forget_link *link; struct virtio_fs_forget *forget; struct virtio_fs_forget_req *req; - struct virtio_fs *fs; - struct virtio_fs_vq *fsvq; - u64 unique; - - link = fuse_dequeue_forget(fiq, 1, NULL); - unique = fuse_get_unique(fiq); - - fs = fiq->priv; - fsvq = &fs->vqs[VQ_HIPRIO]; - spin_unlock(&fiq->lock); + struct virtio_fs *fs = fiq->priv; + struct virtio_fs_vq *fsvq = &fs->vqs[VQ_HIPRIO]; + u64 unique = fuse_get_unique(fiq); /* Allocate a buffer for the request */ forget = kmalloc(sizeof(*forget), GFP_NOFS | __GFP_NOFAIL); @@ -1118,8 +1109,7 @@ __releases(fiq->lock) kfree(link); } -static void virtio_fs_wake_interrupt_and_unlock(struct fuse_iqueue *fiq) -__releases(fiq->lock) +static void virtio_fs_send_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req) { /* * TODO interrupts. @@ -1128,7 +1118,6 @@ __releases(fiq->lock) * Exceptions are blocking lock operations; for example fcntl(F_SETLKW) * with shared lock between host and guest. */ - spin_unlock(&fiq->lock); } /* Count number of scatter-gather elements required */ @@ -1333,21 +1322,17 @@ static int virtio_fs_enqueue_req(struct virtio_fs_vq *fsvq, return ret; } -static void virtio_fs_wake_pending_and_unlock(struct fuse_iqueue *fiq) -__releases(fiq->lock) +static void virtio_fs_send_req(struct fuse_iqueue *fiq, struct fuse_req *req) { unsigned int queue_id; struct virtio_fs *fs; - struct fuse_req *req; struct virtio_fs_vq *fsvq; int ret; - WARN_ON(list_empty(&fiq->pending)); - req = list_last_entry(&fiq->pending, struct fuse_req, list); + if (req->in.h.opcode != FUSE_NOTIFY_REPLY) + req->in.h.unique = fuse_get_unique(fiq); + clear_bit(FR_PENDING, &req->flags); - list_del_init(&req->list); - WARN_ON(!list_empty(&fiq->pending)); - spin_unlock(&fiq->lock); fs = fiq->priv; queue_id = VQ_REQUEST + fs->mq_map[raw_smp_processor_id()]; @@ -1387,10 +1372,10 @@ __releases(fiq->lock) } static const struct fuse_iqueue_ops virtio_fs_fiq_ops = { - .wake_forget_and_unlock = virtio_fs_wake_forget_and_unlock, - .wake_interrupt_and_unlock = virtio_fs_wake_interrupt_and_unlock, - .wake_pending_and_unlock = virtio_fs_wake_pending_and_unlock, - .release = virtio_fs_fiq_release, + .send_forget = virtio_fs_send_forget, + .send_interrupt = virtio_fs_send_interrupt, + .send_req = virtio_fs_send_req, + .release = virtio_fs_fiq_release, }; static inline void virtio_fs_ctx_set_defaults(struct fuse_fs_context *ctx) -- 2.39.2

1 1

[PATCH OLK-6.6 0/3] some readahead improvement
by Tong Tiangen 13 Mar '25

13 Mar '25

Jan Kara (3): readahead: make sure sync readahead reads needed page readahead: don't shorten readahead window in read_pages() readahead: properly shorten readahead when falling back to do_page_cache_ra() mm/readahead.c | 29 +++++++++++++---------------- 1 file changed, 13 insertions(+), 16 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
by Guo Mengqi 13 Mar '25

13 Mar '25

From: James Smart <jsmart2021(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit 577a942df3de2666f6947bdd3a5c9e8d30073424 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6SH CVE: CVE-2022-49535 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 577a942df3de2666f6947bdd3a5c9e8d30073424 ] If lpfc_issue_els_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference. Similarly, when processing non-zero ELS PLOGI completion status in lpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference. Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling. Link: https://lore.kernel.org/r/20220412222008.126521-9-jsmart2021@gmail.com Co-developed-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: James Smart <jsmart2021(a)gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/lpfc/lpfc_els.c [Some contexts are not in this version] Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/scsi/lpfc/lpfc_els.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c index deb9202307a9..f659a4014da3 100644 --- a/drivers/scsi/lpfc/lpfc_els.c +++ b/drivers/scsi/lpfc/lpfc_els.c @@ -1484,10 +1484,12 @@ lpfc_initial_flogi(struct lpfc_vport *vport) } if (lpfc_issue_els_flogi(vport, ndlp, 0)) { - /* This decrement of reference count to node shall kick off - * the release of the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; @@ -1531,10 +1533,12 @@ lpfc_initial_fdisc(struct lpfc_vport *vport) } if (lpfc_issue_els_fdisc(vport, ndlp, 0)) { - /* decrement node reference count to trigger the release of - * the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; -- 2.22.0

2 1

[PATCH OLK-6-6 0/3] some readahead improvement
by Tong Tiangen 13 Mar '25

13 Mar '25

Jan Kara (3): readahead: make sure sync readahead reads needed page readahead: don't shorten readahead window in read_pages() readahead: properly shorten readahead when falling back to do_page_cache_ra() mm/readahead.c | 29 +++++++++++++---------------- 1 file changed, 13 insertions(+), 16 deletions(-) -- 2.25.1

1 3

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 724815180d512a9df6b3edce9151a312b76d891d
by kernel test robot 13 Mar '25

13 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 724815180d512a9df6b3edce9151a312b76d891d !15461 be2net: Fix buffer overflow in be_get_module_eeprom Error/Warning (recently discovered and may have been fixed): drivers/regulator/max8973-regulator.o: warning: objtool: max8973_probe()+0x111a: can't find switch jump table samples/vfio-mdev/mdpy-fb.o: warning: objtool: missing symbol for section .text Unverified Error/Warning (likely false positive, kindly check if interested): drivers/gpu/drm/ast/ast_fb.c:114:17: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c:323:26: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c:353:33: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/emxx_udc/emxx_udc.c:3235:24: sparse: sparse: cast removes address space '__iomem' of expression drivers/staging/emxx_udc/emxx_udc.c:73:28: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/emxx_udc/emxx_udc.c:80:29: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1280:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1341:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1343:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1360:29: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1408:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1411:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1427:27: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1476:19: sparse: sparse: incorrect type in assignment (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1479:29: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1484:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1487:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1521:16: sparse: sparse: incorrect type in assignment (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1523:26: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1528:27: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1560:45: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1564:59: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1566:45: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1568:45: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1577:23: sparse: sparse: incorrect type in assignment (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1580:26: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1611:29: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1616:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1641:14: sparse: sparse: incorrect type in assignment (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1646:29: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1651:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:463:66: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:766:58: sparse: sparse: incorrect type in argument 2 (different address spaces) sound/soc/sunxi/sun8i-codec-analog.c:915:18: sparse: sparse: incorrect type in argument 3 (different address spaces) Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250312 | |-- include-linux-uaccess.h:warning:ces32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:input-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:karg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rdwr_arg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rs485-may-be-used-uninitialized | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250312 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250312 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250312 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-r132-20250309 | |-- drivers-gpu-drm-ast-ast_fb.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-got-void | |-- drivers-net-ethernet-oki-semi-pch_gbe-pch_gbe_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-void-reg | |-- drivers-net-ethernet-oki-semi-pch_gbe-pch_gbe_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-reg-got-unsigned-int-noderef-__iomem | |-- drivers-staging-emxx_udc-emxx_udc.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression | |-- drivers-staging-emxx_udc-emxx_udc.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-void-address | |-- drivers-staging-emxx_udc-emxx_udc.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-addr-got-void-address | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-struct-VCHIQ_COMPLETION_DA | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-struct-vchiq_completion_da | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-struct-vchiq_dequeue_messa | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-struct-vchiq_element-const | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-struct-vchiq_get_config32 | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void-const | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-unsigned-int-enum-VCHIQ_BULK_MODE_ | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-unsigned-int-msgbufcount32 | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-void | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-void-msgbufptr | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-uptr-got-struct-vchiq_header_struct-usert | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-uptr-got-void-addressable-usertype-bulk_u | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-uptr-got-void-addressable-usertype-servic | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-VCHIQ_GET_CONFIG_T-usertype-args-got-void-noderef-__ | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-int-msgbufcount32-got-unsigned-int-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-msgbuf-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-msgbufptr-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-int-noderef-__user-got-int | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-VCHIQ_COMPLETION_DATA_T-usertype-got-void-noderef-_ | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-VCHIQ_COMPLETION_DATA_T-usertype-noderef-__user-got | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-vchiq_config_struct-usertype-got-void-noderef-__use | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-vchiq_config_struct-usertype-noderef-__user-got-str | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-vchiq_element-const-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-vchiq_element-const-noderef-__user-got-struct-vchiq | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-unsigned-int-enum-VCHIQ_BULK_MODE_T-noderef-__user-got-uns | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-unsigned-int-noderef-__user-got-unsigned-int | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-__pu_val-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-__user-got-void-const | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-noderef-__user-got-void | `-- sound-soc-sunxi-sun8i-codec-analog.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-bus_context-got-void-noderef-__iomem-assigned-base |-- x86_64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-shmem.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-swap.c:linux-memremap.h-is-included-more-than-once. | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250312 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250312 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20250312 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250312 | |-- drivers-regulator-max8973-regulator.o:warning:objtool:max8973_probe:can-t-find-switch-jump-table | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration | `-- samples-vfio-mdev-mdpy-fb.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-005-20250312 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250312 | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-defconfig |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 727m configs tested: 15 configs skipped: 100 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250312 gcc-14.2.0 arm64 randconfig-002-20250312 gcc-14.2.0 arm64 randconfig-003-20250312 gcc-14.2.0 arm64 randconfig-004-20250312 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250312 clang-19 x86_64 buildonly-randconfig-002-20250312 clang-19 x86_64 buildonly-randconfig-003-20250312 gcc-12 x86_64 buildonly-randconfig-004-20250312 clang-19 x86_64 buildonly-randconfig-005-20250312 clang-19 x86_64 buildonly-randconfig-006-20250312 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 203e3cc21c92f7c3289882030d699e95765e3e6b
by kernel test robot 13 Mar '25

13 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 203e3cc21c92f7c3289882030d699e95765e3e6b !15376 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.62-6.6.63 LTS Conflicts Patches Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allmodconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250312 | `-- include-linux-mmzone.h:error:error-Allocator-MAX_ORDER-exceeds-SECTION_SIZE |-- loongarch-randconfig-002-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allnoconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250312 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250312 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-defconfig |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 728m configs tested: 17 configs skipped: 104 tested configs: arm64 allmodconfig clang-18 arm64 randconfig-001-20250312 clang-21 arm64 randconfig-002-20250312 gcc-14.2.0 arm64 randconfig-003-20250312 gcc-14.2.0 arm64 randconfig-004-20250312 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch randconfig-001-20250312 gcc-14.2.0 loongarch randconfig-002-20250312 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250312 clang-19 x86_64 buildonly-randconfig-002-20250312 clang-19 x86_64 buildonly-randconfig-003-20250312 gcc-12 x86_64 buildonly-randconfig-004-20250312 clang-19 x86_64 buildonly-randconfig-005-20250312 clang-19 x86_64 buildonly-randconfig-006-20250312 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 4fd58a13ae6e747556d318770dc39c1a58e821d9
by kernel test robot 13 Mar '25

13 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 4fd58a13ae6e747556d318770dc39c1a58e821d9 !15460 v2 soc: hisilicon: Add checks against NULL pointer reference Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-003-20250312 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-004-20250312 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250312 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250312 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250312 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250312 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250312 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250312 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch `-- x86_64-defconfig |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch elapsed time: 765m configs tested: 14 configs skipped: 104 tested configs: arm64 allmodconfig clang-18 arm64 randconfig-001-20250312 clang-21 arm64 randconfig-002-20250312 gcc-14.2.0 arm64 randconfig-003-20250312 gcc-14.2.0 arm64 randconfig-004-20250312 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250312 clang-19 x86_64 buildonly-randconfig-002-20250312 clang-19 x86_64 buildonly-randconfig-003-20250312 gcc-12 x86_64 buildonly-randconfig-004-20250312 clang-19 x86_64 buildonly-randconfig-005-20250312 clang-19 x86_64 buildonly-randconfig-006-20250312 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] fs/lockd: convert comma to semicolon
by longguang.yue 12 Mar '25

12 Mar '25

From: Zheng Yongjun <zhengyongjun3(a)huawei.com> stable inclusion from linux-5.11.y commit 3316fb80a0b4c1fef03a3eb1a7f0651e2133c429 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBQKK6 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ----------------- Replace a comma between expression statements by a semicolon. Signed-off-by: Zheng Yongjun <zhengyongjun3(a)huawei.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: longguang.yue <yuelg(a)chinaunicom.cn> --- fs/lockd/host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/lockd/host.c b/fs/lockd/host.c index 771c289f6df7..f802223e71ab 100644 --- a/fs/lockd/host.c +++ b/fs/lockd/host.c @@ -163,7 +163,7 @@ static struct nlm_host *nlm_alloc_host(struct nlm_lookup_host_info *ni, host->h_nsmhandle = nsm; host->h_addrbuf = nsm->sm_addrbuf; host->net = ni->net; - host->h_cred = get_cred(ni->cred), + host->h_cred = get_cred(ni->cred); strlcpy(host->nodename, utsname()->nodename, sizeof(host->nodename)); out: -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
by Zeng Heng 12 Mar '25

12 Mar '25

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from stable-v4.19.247 commit 4bdcf32c965c27f55ccc4ee71c1927131115b0bb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP32T CVE: CVE-2022-49503 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2dc509305cf956381532792cb8dceef2b1504765 ] The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to ensure that it is within the bitmap. drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept() error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()' Fixes: 4ed1a8d4a257 ("ath9k_htc: use ath9k_cmn_rx_accept") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Acked-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/20220409061225.GA5447@kili Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/wireless/ath/ath9k/htc_drv_txrx.c [Fix context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c index 2bca38e39721..df16b3e1f793 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c @@ -1007,6 +1007,14 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, goto rx_next; } + if (rxstatus->rs_keyix >= ATH_KEYMAX && + rxstatus->rs_keyix != ATH9K_RXKEYIX_INVALID) { + ath_dbg(common, ANY, + "Invalid keyix, dropping (keyix: %d)\n", + rxstatus->rs_keyix); + goto rx_next; + } + /* Get the RX status information */ memset(rx_status, 0, sizeof(struct ieee80211_rx_status)); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net: mdio: unexport __init-annotated mdio_bus_init()
by Wenyu Huang 12 Mar '25

12 Mar '25

From: Masahiro Yamada <masahiroy(a)kernel.org> stable inclusion from stable-v4.19.247 commit 5534bcd7c40299862237c4a8fd9c5031b3db1538 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPK8Q CVE: CVE-2022-49350 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 35b42dce619701f1300fb8498dae82c9bb1f0263 ] EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. modpost used to detect it, but it has been broken for a decade. Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds. There are two ways to fix it: - Remove __init - Remove EXPORT_SYMBOL I chose the latter for this case because the only in-tree call-site, drivers/net/phy/phy_device.c is never compiled as modular. (CONFIG_PHYLIB is boolean) Fixes: 90eff9096c01 ("net: phy: Allow splitting MDIO bus/device support from PHYs") Reported-by: Stephen Rothwell <sfr(a)canb.auug.org.au> Signed-off-by: Masahiro Yamada <masahiroy(a)kernel.org> Reviewed-by: Florian Fainelli <f.fainelli(a)gmail.com> Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/net/phy/mdio_bus.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 82cc1983c09a..35937175c4e8 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -745,7 +745,6 @@ int __init mdio_bus_init(void) return ret; } -EXPORT_SYMBOL_GPL(mdio_bus_init); #if IS_ENABLED(CONFIG_PHYLIB) void mdio_bus_exit(void) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
by Zeng Heng 12 Mar '25

12 Mar '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.247 commit 9345122f5fb9f97a206f440f38bb656e53f46912 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3KL CVE: CVE-2022-49517 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 05654431a18fe24e5e46a375d98904134628a102 ] This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak. Fixes: 8625c1dbd876 ("ASoC: mediatek: Add mt2701-wm8960 machine driver") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Link: https://lore.kernel.org/r/20220404093526.30004-1-linmq006@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- sound/soc/mediatek/mt2701/mt2701-wm8960.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/sound/soc/mediatek/mt2701/mt2701-wm8960.c b/sound/soc/mediatek/mt2701/mt2701-wm8960.c index 89f34efd9747..a5ede216b795 100644 --- a/sound/soc/mediatek/mt2701/mt2701-wm8960.c +++ b/sound/soc/mediatek/mt2701/mt2701-wm8960.c @@ -118,7 +118,8 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) if (!codec_node) { dev_err(&pdev->dev, "Property 'audio-codec' missing or invalid\n"); - return -EINVAL; + ret = -EINVAL; + goto put_platform_node; } for (i = 0; i < card->num_links; i++) { if (mt2701_wm8960_dai_links[i].codec_name) @@ -129,7 +130,7 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) ret = snd_soc_of_parse_audio_routing(card, "audio-routing"); if (ret) { dev_err(&pdev->dev, "failed to parse audio-routing: %d\n", ret); - return ret; + goto put_codec_node; } ret = devm_snd_soc_register_card(&pdev->dev, card); @@ -137,6 +138,10 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", __func__, ret); +put_codec_node: + of_node_put(codec_node); +put_platform_node: + of_node_put(platform_node); return ret; } -- 2.25.1

2 1

[PATCH OLK-6-6 0/3] some readahead improvement
by Tong Tiangen 12 Mar '25

12 Mar '25

Jan Kara (3): readahead: make sure sync readahead reads needed page readahead: don't shorten readahead window in read_pages() readahead: properly shorten readahead when falling back to do_page_cache_ra() mm/readahead.c | 29 +++++++++++++---------------- 1 file changed, 13 insertions(+), 16 deletions(-) -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49490
by Zeng Heng 12 Mar '25

12 Mar '25

Jessica Zhang (1): drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected Rob Clark (1): drm/msm/mdp5: Fix global state lock backoff drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 18 +++++++++++++----- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- 3 files changed, 30 insertions(+), 10 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49490
by Zeng Heng 12 Mar '25

12 Mar '25

Jessica Zhang (1): drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected Rob Clark (1): drm/msm/mdp5: Fix global state lock backoff drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 18 +++++++++++++----- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- 3 files changed, 30 insertions(+), 10 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected
by Zeng Heng 12 Mar '25

12 Mar '25

From: Jessica Zhang <quic_jesszhan(a)quicinc.com> stable inclusion from stable-v4.19.247 commit 776f5c58bfe16cf322d71eeed3c5dda1eeac7e6b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1O4 CVE: CVE-2022-49490 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d59be579fa932c46b908f37509f319cbd4ca9a68 ] mdp5_get_global_state runs the risk of hitting a -EDEADLK when acquiring the modeset lock, but currently mdp5_pipe_release doesn't check for if an error is returned. Because of this, there is a possibility of mdp5_pipe_release hitting a NULL dereference error. To avoid this, let's have mdp5_pipe_release check if mdp5_get_global_state returns an error and propogate that error. Changes since v1: - Separated declaration and initialization of *new_state to avoid compiler warning - Fixed some spelling mistakes in commit message Changes since v2: - Return 0 in case where hwpipe is NULL as this is considered normal behavior - Added 2nd patch in series to fix a similar NULL dereference issue in mdp5_mixer_release Reported-by: Tomeu Vizoso <tomeu.vizoso(a)collabora.com> Signed-off-by: Jessica Zhang <quic_jesszhan(a)quicinc.com> Fixes: 7907a0d77cb4 ("drm/msm/mdp5: Use the new private_obj state") Reviewed-by: Rob Clark <robdclark(a)gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/485179/ Link: https://lore.kernel.org/r/20220505214051.155-1-quic_jesszhan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +++++++++++---- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- 3 files changed, 28 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c index 1ef26bc63163..88de12225582 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c @@ -130,18 +130,23 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, return 0; } -void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) +int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) { struct msm_drm_private *priv = s->dev->dev_private; struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms)); struct mdp5_global_state *state = mdp5_get_global_state(s); - struct mdp5_hw_pipe_state *new_state = &state->hwpipe; + struct mdp5_hw_pipe_state *new_state; if (!hwpipe) - return; + return 0; + + if (IS_ERR(state)) + return PTR_ERR(state); + + new_state = &state->hwpipe; if (WARN_ON(!new_state->hwpipe_to_plane[hwpipe->idx])) - return; + return -EINVAL; DBG("%s: release from plane %s", hwpipe->name, new_state->hwpipe_to_plane[hwpipe->idx]->name); @@ -152,6 +157,8 @@ void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) } new_state->hwpipe_to_plane[hwpipe->idx] = NULL; + + return 0; } void mdp5_pipe_destroy(struct mdp5_hw_pipe *hwpipe) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h index bb2b0ac7aa2b..072db6a99b85 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h @@ -48,7 +48,7 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, uint32_t caps, uint32_t blkcfg, struct mdp5_hw_pipe **hwpipe, struct mdp5_hw_pipe **r_hwpipe); -void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe); +int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe); struct mdp5_hw_pipe *mdp5_pipe_init(enum mdp5_pipe pipe, uint32_t reg_offset, uint32_t caps); diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c index 1ddf07514de6..85bbae26b17e 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c @@ -399,12 +399,24 @@ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state, mdp5_state->r_hwpipe = NULL; - mdp5_pipe_release(state->state, old_hwpipe); - mdp5_pipe_release(state->state, old_right_hwpipe); + ret = mdp5_pipe_release(state->state, old_hwpipe); + if (ret) + return ret; + + ret = mdp5_pipe_release(state->state, old_right_hwpipe); + if (ret) + return ret; + } } else { - mdp5_pipe_release(state->state, mdp5_state->hwpipe); - mdp5_pipe_release(state->state, mdp5_state->r_hwpipe); + ret = mdp5_pipe_release(state->state, mdp5_state->hwpipe); + if (ret) + return ret; + + ret = mdp5_pipe_release(state->state, mdp5_state->r_hwpipe); + if (ret) + return ret; + mdp5_state->hwpipe = mdp5_state->r_hwpipe = NULL; } -- 2.25.1

2 1