- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1306/1306] drivers/platform/x86/alienware-wmi.c:539:21: warning: 'output.pointer' is used uninitialized
by kernel test robot 26 Nov '24

26 Nov '24

Hi Mario, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 48fd60600c1344806a27e3bb33ab33ec5a9fea7c commit: ff0e9f26288d2daee4950f42b37a3d3d30d36ec1 [1306/1306] platform/x86: alienware-wmi: Correct a memory leak config: x86_64-randconfig-076-20241125 (https://download.01.org/0day-ci/archive/20241126/202411260425.gByrWNcz-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241126/202411260425.gByrWNcz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411260425.gByrWNcz-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/acpi.h:41, from drivers/platform/x86/alienware-wmi.c:20: include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'alienware_wmi_init': 'cold' [-Wmissing-attributes] 132 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ drivers/platform/x86/alienware-wmi.c:852:1: note: in expansion of macro 'module_init' 852 | module_init(alienware_wmi_init); | ^~~~~~~~~~~ drivers/platform/x86/alienware-wmi.c:785:19: note: 'init_module' target declared here 785 | static int __init alienware_wmi_init(void) | ^~~~~~~~~~~~~~~~~~ include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'alienware_wmi_exit': 'cold' [-Wmissing-attributes] 138 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ drivers/platform/x86/alienware-wmi.c:864:1: note: in expansion of macro 'module_exit' 864 | module_exit(alienware_wmi_exit); | ^~~~~~~~~~~ drivers/platform/x86/alienware-wmi.c:854:20: note: 'cleanup_module' target declared here 854 | static void __exit alienware_wmi_exit(void) | ^~~~~~~~~~~~~~~~~~ In function 'alienware_wmax_command', inlined from 'toggle_hdmi_source' at drivers/platform/x86/alienware-wmi.c:609:11: >> drivers/platform/x86/alienware-wmi.c:539:21: warning: 'output.pointer' is used uninitialized [-Wuninitialized] 539 | kfree(output.pointer); | ~~~~~~^~~~~~~~ drivers/platform/x86/alienware-wmi.c: In function 'toggle_hdmi_source': drivers/platform/x86/alienware-wmi.c:521:28: note: 'output' declared here 521 | struct acpi_buffer output; | ^~~~~~ In function 'alienware_wmax_command', inlined from 'toggle_deepsleep' at drivers/platform/x86/alienware-wmi.c:748:11: >> drivers/platform/x86/alienware-wmi.c:539:21: warning: 'output.pointer' is used uninitialized [-Wuninitialized] 539 | kfree(output.pointer); | ~~~~~~^~~~~~~~ drivers/platform/x86/alienware-wmi.c: In function 'toggle_deepsleep': drivers/platform/x86/alienware-wmi.c:521:28: note: 'output' declared here 521 | struct acpi_buffer output; | ^~~~~~ drivers/platform/x86/alienware-wmi.o: warning: objtool: show_hdmi_source()+0x80: sibling call from callable instruction with modified stack frame drivers/platform/x86/alienware-wmi.o: warning: objtool: show_hdmi_cable()+0x82: sibling call from callable instruction with modified stack frame drivers/platform/x86/alienware-wmi.o: warning: objtool: show_amplifier_status()+0x82: sibling call from callable instruction with modified stack frame drivers/platform/x86/alienware-wmi.o: warning: objtool: show_deepsleep_status()+0x82: sibling call from callable instruction with modified stack frame drivers/platform/x86/alienware-wmi.o: warning: objtool: alienware_update_led()+0x239: sibling call from callable instruction with modified stack frame drivers/platform/x86/alienware-wmi.o: warning: objtool: zone_set()+0xb0: sibling call from callable instruction with modified stack frame drivers/platform/x86/alienware-wmi.o: warning: objtool: global_led_set()+0x117: sibling call from callable instruction with modified stack frame drivers/platform/x86/alienware-wmi.o: warning: objtool: toggle_hdmi_source()+0x106: sibling call from callable instruction with modified stack frame drivers/platform/x86/alienware-wmi.o: warning: objtool: toggle_deepsleep()+0x103: sibling call from callable instruction with modified stack frame drivers/platform/x86/alienware-wmi.o: warning: objtool: show_hdmi_source.cold()+0x0: call without frame pointer save/setup drivers/platform/x86/alienware-wmi.o: warning: objtool: show_hdmi_cable.cold()+0x0: call without frame pointer save/setup drivers/platform/x86/alienware-wmi.o: warning: objtool: show_amplifier_status.cold()+0x0: call without frame pointer save/setup drivers/platform/x86/alienware-wmi.o: warning: objtool: show_deepsleep_status.cold()+0x0: call without frame pointer save/setup drivers/platform/x86/alienware-wmi.o: warning: objtool: alienware_update_led.cold()+0x0: call without frame pointer save/setup drivers/platform/x86/alienware-wmi.o: warning: objtool: zone_set.cold()+0x0: call without frame pointer save/setup drivers/platform/x86/alienware-wmi.o: warning: objtool: global_led_set.cold()+0x0: call without frame pointer save/setup drivers/platform/x86/alienware-wmi.o: warning: objtool: toggle_hdmi_source.cold()+0x0: call without frame pointer save/setup drivers/platform/x86/alienware-wmi.o: warning: objtool: toggle_deepsleep.cold()+0x0: call without frame pointer save/setup vim +539 drivers/platform/x86/alienware-wmi.c 514 515 static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args, 516 u32 command, int *out_data) 517 { 518 acpi_status status; 519 union acpi_object *obj; 520 struct acpi_buffer input; 521 struct acpi_buffer output; 522 523 input.length = (acpi_size) sizeof(*in_args); 524 input.pointer = in_args; 525 if (out_data != NULL) { 526 output.length = ACPI_ALLOCATE_BUFFER; 527 output.pointer = NULL; 528 status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0, 529 command, &input, &output); 530 } else 531 status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0, 532 command, &input, NULL); 533 534 if (ACPI_SUCCESS(status) && out_data != NULL) { 535 obj = (union acpi_object *)output.pointer; 536 if (obj && obj->type == ACPI_TYPE_INTEGER) 537 *out_data = (u32) obj->integer.value; 538 } > 539 kfree(output.pointer); 540 return status; 541 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2415/2415] kernel/watchdog_hld.c:502:12: sparse: sparse: symbol '__hardlockup_detector_perf_init' was not declared. Should it be static?
by kernel test robot 26 Nov '24

26 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 5d73ae1b79c0e467e87e2f0494211ff38732900d commit: 364de98eacea8dbfe4f926f62085aebf8534f403 [2415/2415] watchdog: Fix sleeping function called from atomic context config: x86_64-randconfig-121-20241111 (https://download.01.org/0day-ci/archive/20241126/202411260320.yKIJ0n9e-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241126/202411260320.yKIJ0n9e-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411260320.yKIJ0n9e-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/watchdog_hld.c:502:12: sparse: sparse: symbol '__hardlockup_detector_perf_init' was not declared. Should it be static? vim +/__hardlockup_detector_perf_init +502 kernel/watchdog_hld.c 501 > 502 int __init __hardlockup_detector_perf_init(void *not_used) 503 { 504 int ret = hardlockup_detector_event_create(); 505 506 if (ret) { 507 pr_info("Perf NMI watchdog permanently disabled\n"); 508 } else { 509 perf_event_release_kernel(this_cpu_read(watchdog_ev)); 510 this_cpu_write(watchdog_ev, NULL); 511 } 512 return ret; 513 } 514 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 48fd60600c1344806a27e3bb33ab33ec5a9fea7c
by kernel test robot 26 Nov '24

26 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 48fd60600c1344806a27e3bb33ab33ec5a9fea7c !13424 btrfs: reinitialize delayed ref list after deleting it from the list Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202411251710.OUFik4Mp-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411260043.JceIGmYJ-lkp@intel.com drivers/iommu/arm-smmu-v3.c:2896:41: error: 'pci_bus_type' undeclared (first use in this function); did you mean 'pci_pcie_type'? drivers/mailbox/phytium_mailbox.c:116:36: warning: 'phytium_mbox_acpi_match' defined but not used [-Wunused-const-variable=] kernel/sched/grid/qos.c:84:31: error: 'struct mempolicy' has no member named 'v' kernel/sched/grid/qos.c:95:31: error: 'struct task_struct' has no member named 'il_prev' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-randconfig-001-20241112 | |-- drivers-iommu-arm-smmu-v3.c:error:pci_bus_type-undeclared-(first-use-in-this-function) | |-- kernel-sched-grid-qos.c:error:struct-mempolicy-has-no-member-named-v | `-- kernel-sched-grid-qos.c:error:struct-task_struct-has-no-member-named-il_prev |-- arm64-randconfig-004-20241113 | `-- drivers-mailbox-phytium_mailbox.c:warning:phytium_mbox_acpi_match-defined-but-not-used |-- x86_64-buildonly-randconfig-002-20241117 | `-- block-.tmp_blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-003-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-004-20241125 | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-mailbox-qcom-apcs-ipc-mailbox.c:warning:apcs_clk_match_table-defined-but-not-used | |-- drivers-mtd-nand-bbt.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- fs-nilfs2-btree.c:warning:bh-may-be-used-uninitialized | `-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-005-20241125 | |-- block-.tmp_blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- crypto-.tmp_aegis128.o:warning:objtool:missing-symbol-for-section-.init.text | |-- crypto-.tmp_zstd.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-char-tpm-eventlog-.tmp_of.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-fpga-.tmp_machxo2-spi.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-bridge-.tmp_cdns-dsi.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-bridge-.tmp_thc63lvd1024.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-i2c-.tmp_tda9950.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-vkms-.tmp_vkms_drv.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-chemical-.tmp_bme680_i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-chemical-.tmp_bme680_spi.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-dac-.tmp_ad5696-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-light-.tmp_si1133.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-light-.tmp_tsl2772.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pinctrl-cirrus-.tmp_pinctrl-madera-core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-regulator-.tmp_sy8106a-regulator.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- lib-zstd-.tmp_decompress.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_fse_compress.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_huf_compress.o:warning:objtool:missing-symbol-for-section-.text | `-- lib-zstd-.tmp_huf_decompress.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-006-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-kexec | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-002-20241125 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-004-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-005-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-006-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-011-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-012-20241125 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-013-20241125 | |-- drivers-usb-host-ehci-hcd.o:warning:objtool:ehci_endpoint_disable:unreachable-instruction | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-015-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-016-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-072-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-073-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-074-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-076-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-101-20241125 | `-- drivers-usb-host-ehci-hcd.o:warning:objtool:ehci_endpoint_disable:unreachable-instruction |-- x86_64-randconfig-102-20241125 | |-- drivers-md-md.o:warning:objtool:md_seq_show:unreachable-instruction | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-103-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-104-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-161-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-9.4 | |-- drivers-net-can-usb-kvaser_usb-kvaser_usb_hydra.c:warning:new_state-may-be-used-uninitialized | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-9.4-func | `-- fs-ext4-inode.c:warning:unused-variable-sbi `-- x86_64-rhel-9.4-kselftests `-- fs-ext4-inode.c:warning:unused-variable-sbi elapsed time: 723m configs tested: 32 configs skipped: 137 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20241125 gcc-14.2.0 arm64 randconfig-002-20241125 gcc-14.2.0 arm64 randconfig-003-20241125 gcc-14.2.0 arm64 randconfig-004-20241125 gcc-14.2.0 x86_64 buildonly-randconfig-001-20241125 clang-19 x86_64 buildonly-randconfig-002-20241125 gcc-12 x86_64 buildonly-randconfig-003-20241125 clang-19 x86_64 buildonly-randconfig-004-20241125 gcc-12 x86_64 buildonly-randconfig-005-20241125 clang-19 x86_64 buildonly-randconfig-006-20241125 clang-19 x86_64 kexec clang-19 x86_64 randconfig-001-20241125 clang-19 x86_64 randconfig-002-20241125 clang-19 x86_64 randconfig-003-20241125 gcc-12 x86_64 randconfig-004-20241125 clang-19 x86_64 randconfig-005-20241125 gcc-12 x86_64 randconfig-006-20241125 clang-19 x86_64 randconfig-011-20241125 gcc-12 x86_64 randconfig-012-20241125 clang-19 x86_64 randconfig-013-20241125 clang-19 x86_64 randconfig-014-20241125 gcc-12 x86_64 randconfig-015-20241125 clang-19 x86_64 randconfig-016-20241125 clang-19 x86_64 randconfig-071-20241125 clang-19 x86_64 randconfig-072-20241125 gcc-12 x86_64 randconfig-073-20241125 clang-19 x86_64 randconfig-074-20241125 clang-19 x86_64 randconfig-075-20241125 clang-19 x86_64 randconfig-076-20241125 gcc-12 x86_64 rhel-9.4 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1291/1291] drivers/mailbox/phytium_mailbox.c:116:36: warning: 'phytium_mbox_acpi_match' defined but not used
by kernel test robot 26 Nov '24

26 Nov '24

Hi Chen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 48fd60600c1344806a27e3bb33ab33ec5a9fea7c commit: 1ae9436b02e93f1f2b9cfc10226812197fbfcd04 [1291/1291] mailbox: add phytium mailbox driver config: arm64-randconfig-004-20241113 (https://download.01.org/0day-ci/archive/20241126/202411260043.JceIGmYJ-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241126/202411260043.JceIGmYJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411260043.JceIGmYJ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/mailbox/phytium_mailbox.c:116:36: warning: 'phytium_mbox_acpi_match' defined but not used [-Wunused-const-variable=] 116 | static const struct acpi_device_id phytium_mbox_acpi_match[] = { | ^~~~~~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for HARDLOCKUP_DETECTOR Depends on [n]: DEBUG_KERNEL [=n] && !S390 && (HAVE_HARDLOCKUP_DETECTOR_PERF [=n] || HAVE_HARDLOCKUP_DETECTOR_ARCH [=y]) Selected by [y]: - SDEI_WATCHDOG [=y] && <choice> && ARM_SDE_INTERFACE [=y] && !HARDLOCKUP_CHECK_TIMESTAMP [=n] vim +/phytium_mbox_acpi_match +116 drivers/mailbox/phytium_mailbox.c 115 > 116 static const struct acpi_device_id phytium_mbox_acpi_match[] = { 117 { "PHYT0009", 0 }, 118 { }, 119 }; 120 MODULE_DEVICE_TABLE(acpi, phytium_mbox_acpi_match); 121 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1466/1466] arch/loongarch/kvm/exit.c:768:2-3: Unneeded semicolon
by kernel test robot 25 Nov '24

25 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e5f9cb08ccf02777d4bcc83a9bcdbba6434a7ab2 commit: 60f12ac296b9c755ff6f94fed1590a9ae2e6dfa7 [1466/1466] LoongArch: KVM: Add pv ipi support on kvm side config: loongarch-randconfig-r051-20241114 (https://download.01.org/0day-ci/archive/20241125/202411252036.xy4CfSQv-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411252036.xy4CfSQv-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> arch/loongarch/kvm/exit.c:768:2-3: Unneeded semicolon vim +768 arch/loongarch/kvm/exit.c 751 752 /* 753 * hypercall emulation always return to guest, Caller should check retval. 754 */ 755 static void kvm_handle_pv_service(struct kvm_vcpu *vcpu) 756 { 757 unsigned long func = vcpu->arch.gprs[LOONGARCH_GPR_A0]; 758 long ret; 759 760 switch (func) { 761 case KVM_HCALL_FUNC_PV_IPI: 762 kvm_pv_send_ipi(vcpu); 763 ret = KVM_HCALL_STATUS_SUCCESS; 764 break; 765 default: 766 ret = KVM_HCALL_INVALID_CODE; 767 break; > 768 }; 769 770 vcpu->arch.gprs[LOONGARCH_GPR_A0] = ret; 771 } 772 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v4 0/4] arm64: Add xcall/xint support
by Jinjie Ruan 25 Nov '24

25 Nov '24

Add xcall/xint support for arm64. Changes in v4: - Fix the missing Comma about check_xint_pre_kernel_entry. - When CONFIG_SECURITY_FEATURE_BYPASS not set, ret_to_user/kernel instead of "kernel_exit \el" for xcall/xint. Changes in v3: - Fix few typos in entry.S. Changes in v2: - Avoid enable xint without GICv3 enabled. - Fix cpucap KABI break. - Fix missing openeuler_defconfig update. - Correct the marco control for SECURITY_FEATURE_BYPASS in entry.S. - exit_to_user_mode_prepare_xcall() -> xcall_exit_to_user_mode_prepare(). Jinjie Ruan (2): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 64 ++++++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 ++++++++ arch/arm64/kernel/entry-common.c | 162 ++++++++++++++++++++++++ arch/arm64/kernel/entry.S | 168 ++++++++++++++++++++++++- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 123 ++++++++++++++++++ fs/proc/base.c | 112 +++++++++++++++++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 4 + kernel/fork.c | 17 +++ kernel/irq/debugfs.c | 33 +++++ kernel/irq/internals.h | 18 +++ kernel/irq/proc.c | 6 + kernel/softirq.c | 47 +++++++ 18 files changed, 834 insertions(+), 5 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 v4 0/4] arm64: Add xcall/xint support
by Jinjie Ruan 25 Nov '24

25 Nov '24

Add xcall/xint support for arm64. Changes in v4: - Fix the missing Comma about check_xint_pre_kernel_entry. - When CONFIG_SECURITY_FEATURE_BYPASS not set, ret_to_user/kernel instead of "kernel_exit \el" for xcall/xint. Changes in v3: - Fix few typos in entry.S. Changes in v2: - Avoid enable xint without GICv3 enabled. - Fix cpucap KABI break. - Fix missing openeuler_defconfig update. - Correct the marco control for SECURITY_FEATURE_BYPASS in entry.S. - exit_to_user_mode_prepare_xcall() -> xcall_exit_to_user_mode_prepare(). Jinjie Ruan (2): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 64 ++++++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 ++++++++ arch/arm64/kernel/entry-common.c | 162 ++++++++++++++++++++++++ arch/arm64/kernel/entry.S | 168 ++++++++++++++++++++++++- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 123 ++++++++++++++++++ fs/proc/base.c | 112 +++++++++++++++++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 4 + kernel/fork.c | 17 +++ kernel/irq/debugfs.c | 33 +++++ kernel/irq/internals.h | 18 +++ kernel/irq/proc.c | 6 + kernel/softirq.c | 47 +++++++ 18 files changed, 834 insertions(+), 5 deletions(-) -- 2.34.1

1 4

[PATCH OLK-6.6 v3 0/4] arm64: Add xcall/xint support
by Jinjie Ruan 25 Nov '24

25 Nov '24

Add xcall/xint support for arm64. Changes in v3: - Fix few typos in entry.S. Changes in v2: - Avoid enable xint without GICv3 enabled. - Fix cpucap KABI break. - Fix missing openeuler_defconfig update. - Correct the marco control for SECURITY_FEATURE_BYPASS in entry.S. - exit_to_user_mode_prepare_xcall() -> xcall_exit_to_user_mode_prepare(). Jinjie Ruan (2): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 64 ++++++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 ++++++++ arch/arm64/kernel/entry-common.c | 162 ++++++++++++++++++++++++ arch/arm64/kernel/entry.S | 164 ++++++++++++++++++++++++- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 123 +++++++++++++++++++ fs/proc/base.c | 112 +++++++++++++++++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 4 + kernel/fork.c | 17 +++ kernel/irq/debugfs.c | 33 +++++ kernel/irq/internals.h | 18 +++ kernel/irq/proc.c | 6 + kernel/softirq.c | 47 +++++++ 18 files changed, 830 insertions(+), 5 deletions(-) -- 2.34.1

2 9

[PATCH openEuler-1.0-LTS] tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
by Liu Jian 25 Nov '24

25 Nov '24

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> mainline inclusion from mainline-v6.12-rc4 commit e8c526f2bdf1845bedaf6a478816a3d06fa78b8f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2STS CVE: CVE-2024-50154 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler(). """ We are seeing a use-after-free from a bpf prog attached to trace_tcp_retransmit_synack. The program passes the req->sk to the bpf_sk_storage_get_tracing kernel helper which does check for null before using it. """ The commit 83fccfc3940c ("inet: fix potential deadlock in reqsk_queue_unlink()") added timer_pending() in reqsk_queue_unlink() not to call del_timer_sync() from reqsk_timer_handler(), but it introduced a small race window. Before the timer is called, expire_timers() calls detach_timer(timer, true) to clear timer->entry.pprev and marks it as not pending. If reqsk_queue_unlink() checks timer_pending() just after expire_timers() calls detach_timer(), TCP will miss del_timer_sync(); the reqsk timer will continue running and send multiple SYN+ACKs until it expires. The reported UAF could happen if req->sk is close()d earlier than the timer expiration, which is 63s by default. The scenario would be 1. inet_csk_complete_hashdance() calls inet_csk_reqsk_queue_drop(), but del_timer_sync() is missed 2. reqsk timer is executed and scheduled again 3. req->sk is accept()ed and reqsk_put() decrements rsk_refcnt, but reqsk timer still has another one, and inet_csk_accept() does not clear req->sk for non-TFO sockets 4. sk is close()d 5. reqsk timer is executed again, and BPF touches req->sk Let's not use timer_pending() by passing the caller context to __inet_csk_reqsk_queue_drop(). Note that reqsk timer is pinned, so the issue does not happen in most use cases. [1] [0] BUG: KFENCE: use-after-free read in bpf_sk_storage_get_tracing+0x2e/0x1b0 Use-after-free read at 0x00000000a891fb3a (in kfence-#1): bpf_sk_storage_get_tracing+0x2e/0x1b0 bpf_prog_5ea3e95db6da0438_tcp_retransmit_synack+0x1d20/0x1dda bpf_trace_run2+0x4c/0xc0 tcp_rtx_synack+0xf9/0x100 reqsk_timer_handler+0xda/0x3d0 run_timer_softirq+0x292/0x8a0 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 intel_idle_irq+0x5a/0xa0 cpuidle_enter_state+0x94/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb kfence-#1: 0x00000000a72cc7b6-0x00000000d97616d9, size=2376, cache=TCPv6 allocated by task 0 on cpu 9 at 260507.901592s: sk_prot_alloc+0x35/0x140 sk_clone_lock+0x1f/0x3f0 inet_csk_clone_lock+0x15/0x160 tcp_create_openreq_child+0x1f/0x410 tcp_v6_syn_recv_sock+0x1da/0x700 tcp_check_req+0x1fb/0x510 tcp_v6_rcv+0x98b/0x1420 ipv6_list_rcv+0x2258/0x26e0 napi_complete_done+0x5b1/0x2990 mlx5e_napi_poll+0x2ae/0x8d0 net_rx_action+0x13e/0x590 irq_exit_rcu+0xf5/0x320 common_interrupt+0x80/0x90 asm_common_interrupt+0x22/0x40 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb freed by task 0 on cpu 9 at 260507.927527s: rcu_core_si+0x4ff/0xf10 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb Fixes: 83fccfc3940c ("inet: fix potential deadlock in reqsk_queue_unlink()") Reported-by: Martin KaFai Lau <martin.lau(a)kernel.org> Closes: https://lore.kernel.org/netdev/eb6684d0-ffd9-4bdc-9196-33f690c25824@linux.d… Link: https://lore.kernel.org/netdev/b55e2ca0-42f2-4b7c-b445-6ffd87ca74a0@linux.d… [1] Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://patch.msgid.link/20241014223312.4254-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/inet_connection_sock.c [Did not backport c905dee62232, 5903123f662e, 9b13df3fb64e.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv4/inet_connection_sock.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index c1f90e08761c..ffa0f8b3f21f 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -718,21 +718,31 @@ static bool reqsk_queue_unlink(struct request_sock_queue *queue, found = __sk_nulls_del_node_init_rcu(req_to_sk(req)); spin_unlock(lock); } - if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer)) - reqsk_put(req); + return found; } -bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req) +static bool __inet_csk_reqsk_queue_drop(struct sock *sk, + struct request_sock *req, + bool from_timer) { bool unlinked = reqsk_queue_unlink(&inet_csk(sk)->icsk_accept_queue, req); + if (!from_timer && del_timer_sync(&req->rsk_timer)) + reqsk_put(req); + if (unlinked) { reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req); reqsk_put(req); } + return unlinked; } + +bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req) +{ + return __inet_csk_reqsk_queue_drop(sk, req, false); +} EXPORT_SYMBOL(inet_csk_reqsk_queue_drop); void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req) @@ -805,7 +815,8 @@ static void reqsk_timer_handler(struct timer_list *t) return; } drop: - inet_csk_reqsk_queue_drop_and_put(sk_listener, req); + __inet_csk_reqsk_queue_drop(sk_listener, req, true); + reqsk_put(req); } static void reqsk_queue_hash_req(struct request_sock *req, -- 2.34.1

2 1

[PATCH OLK-6.6 v2 0/4] arm64: Add xcall/xint support
by Jinjie Ruan 25 Nov '24

25 Nov '24

Add xcall/xint support for arm64. Changes in v2: - Avoid enable xint without GICv3 enabled. - Fix cpucap KABI break. - Fix missing openeuler_defconfig update. - Correct the marco control for SECURITY_FEATURE_BYPASS in entry.S - exit_to_user_mode_prepare_xcall() -> xcall_exit_to_user_mode_prepare() Jinjie Ruan (2): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 64 ++++++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 ++++++++ arch/arm64/kernel/entry-common.c | 162 ++++++++++++++++++++++++ arch/arm64/kernel/entry.S | 164 ++++++++++++++++++++++++- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 123 +++++++++++++++++++ fs/proc/base.c | 112 +++++++++++++++++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 4 + kernel/fork.c | 17 +++ kernel/irq/debugfs.c | 33 +++++ kernel/irq/internals.h | 18 +++ kernel/irq/proc.c | 6 + kernel/softirq.c | 47 +++++++ 18 files changed, 830 insertions(+), 5 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/2] net/hinic3: Support new NIC feature
by s00851154 25 Nov '24

25 Nov '24

From: zhuyikai <zhuyikai1(a)h-partners.com> Support new TX WQE offload format and new RX WQE type. zhuyikai (2): net/hinic3: Support new TX feature net/hinic3: Support new RX feature drivers/net/ethernet/huawei/hinic3/hinic3_main.c | 8 + drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h | 1 + drivers/net/ethernet/huawei/hinic3/hinic3_mt.h | 2 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.h | 1 + drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 1 + drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.c | 23 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h | 5 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_qp.h | 131 +++++++--- drivers/net/ethernet/huawei/hinic3/hinic3_rx.c | 162 ++++++++----- drivers/net/ethernet/huawei/hinic3/hinic3_rx.h | 10 +- drivers/net/ethernet/huawei/hinic3/hinic3_tx.c | 430 ++++++++++++++++++--------------- drivers/net/ethernet/huawei/hinic3/hinic3_tx.h | 10 +- 12 files changed, 498 insertions(+), 286 deletions(-) -- 2.45.1.windows.1

2 3

[PATCH OLK-6.6 0/2] Support new RX and TX feature
by s00851154 25 Nov '24

25 Nov '24

From: zhuyikai <zhuyikai1(a)h-partners.com> Support new TX WQE offload format and new RX WQE type. zhuyikai (2): net/hinic3: Support new TX feature net/hinic3: Support new RX feature drivers/net/ethernet/huawei/hinic3/hinic3_main.c | 8 + drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h | 1 + drivers/net/ethernet/huawei/hinic3/hinic3_mt.h | 2 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.h | 1 + drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 1 + drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.c | 23 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h | 5 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_qp.h | 131 +++++++--- drivers/net/ethernet/huawei/hinic3/hinic3_rx.c | 162 ++++++++----- drivers/net/ethernet/huawei/hinic3/hinic3_rx.h | 10 +- drivers/net/ethernet/huawei/hinic3/hinic3_tx.c | 430 ++++++++++++++++++--------------- drivers/net/ethernet/huawei/hinic3/hinic3_tx.h | 10 +- 12 files changed, 498 insertions(+), 286 deletions(-) -- 2.45.1.windows.1

2 3

[openeuler:openEuler-1.0-LTS 1290/1290] kernel/sched/grid/qos.c:84:31: error: 'struct mempolicy' has no member named 'v'
by kernel test robot 25 Nov '24

25 Nov '24

Hi Wang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 48fd60600c1344806a27e3bb33ab33ec5a9fea7c commit: ce35ded5d5774f055f6850b15032066ff4936414 [1290/1290] sched: smart grid: init sched_grid_qos structure on QOS purpose config: arm64-randconfig-001-20241112 (https://download.01.org/0day-ci/archive/20241125/202411251710.OUFik4Mp-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241125/202411251710.OUFik4Mp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411251710.OUFik4Mp-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/grid/qos.c:19: kernel/sched/grid/qos.c: In function 'sched_grid_preferred_interleave_nid': >> kernel/sched/grid/qos.c:84:31: error: 'struct mempolicy' has no member named 'v' 84 | if (nodes_equal(policy->v.nodes, *preferred_nmask)) | ^~ include/linux/nodemask.h:202:41: note: in definition of macro 'nodes_equal' 202 | __nodes_equal(&(src1), &(src2), MAX_NUMNODES) | ^~~~ kernel/sched/grid/qos.c:91:32: error: 'struct mempolicy' has no member named 'v' 91 | nodes_and(nmask, policy->v.nodes, *preferred_nmask); | ^~ include/linux/nodemask.h:162:47: note: in definition of macro 'nodes_and' 162 | __nodes_and(&(dst), &(src1), &(src2), MAX_NUMNODES) | ^~~~ >> kernel/sched/grid/qos.c:95:31: error: 'struct task_struct' has no member named 'il_prev' 95 | next = next_node_in(me->il_prev, nmask); | ^~ include/linux/nodemask.h:278:46: note: in definition of macro 'next_node_in' 278 | #define next_node_in(n, src) __next_node_in((n), &(src)) | ^ kernel/sched/grid/qos.c:97:19: error: 'struct task_struct' has no member named 'il_prev' 97 | me->il_prev = next; | ^~ In file included from kernel/sched/grid/qos.c:20: include/linux/mempolicy.h: At top level: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ vim +84 kernel/sched/grid/qos.c > 19 #include <linux/nodemask.h> 20 #include <linux/mempolicy.h> 21 #include <linux/slab.h> 22 #include <linux/sched.h> 23 #include <linux/sched/grid_qos.h> 24 #include "internal.h" 25 26 static int qos_affinity_set(struct task_struct *p) 27 { 28 int n; 29 struct sched_grid_qos_affinity *affinity = &p->grid_qos->affinity; 30 31 nodes_clear(affinity->mem_preferred_node_mask); 32 /* 33 * We want the memory allocation to be as close to the CPU 34 * as possible, and adjust after getting memory bandwidth usage. 35 */ 36 for (n = 0; n < nr_node_ids; n++) 37 if (cpumask_intersects(cpumask_of_node(n), p->prefer_cpus)) 38 node_set(n, affinity->mem_preferred_node_mask); 39 40 return 0; 41 } 42 43 int sched_grid_qos_fork(struct task_struct *p, struct task_struct *orig) 44 { 45 struct sched_grid_qos *qos; 46 47 qos = kzalloc(sizeof(*qos), GFP_KERNEL); 48 if (!qos) 49 return -ENOMEM; 50 51 qos_power_init(&qos->power); 52 qos_stat_init(&qos->stat); 53 54 nodes_clear(qos->affinity.mem_preferred_node_mask); 55 if (likely(orig->grid_qos)) 56 qos->affinity = orig->grid_qos->affinity; 57 qos->affinity_set = qos_affinity_set; 58 p->grid_qos = qos; 59 60 return 0; 61 } 62 63 void sched_grid_qos_free(struct task_struct *p) 64 { 65 kfree(p->grid_qos); 66 p->grid_qos = NULL; 67 } 68 69 /* dynamic select a more appropriate preferred interleave nid for process */ 70 int sched_grid_preferred_interleave_nid(struct mempolicy *policy) 71 { 72 nodemask_t nmask; 73 unsigned int next; 74 struct task_struct *me = current; 75 nodemask_t *preferred_nmask = NULL; 76 77 if (likely(me->grid_qos)) 78 preferred_nmask = 79 &me->grid_qos->affinity.mem_preferred_node_mask; 80 81 if (!preferred_nmask || !policy) 82 return NUMA_NO_NODE; 83 > 84 if (nodes_equal(policy->v.nodes, *preferred_nmask)) 85 return NUMA_NO_NODE; 86 /* 87 * We perceive the actual consumption of memory bandwidth 88 * in each node and post a preferred interleave nid in 89 * more appropriate range. 90 */ > 91 nodes_and(nmask, policy->v.nodes, *preferred_nmask); 92 if (nodes_empty(nmask)) 93 return NUMA_NO_NODE; 94 > 95 next = next_node_in(me->il_prev, nmask); 96 if (next < MAX_NUMNODES) 97 me->il_prev = next; 98 return next; 99 } 100 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] nilfs2: fix kernel bug due to missing clearing of checked flag
by Qi Xi 25 Nov '24

25 Nov '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.12-rc6 commit 41e192ad2779cae0102879612dfe46726e4396aa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AW CVE: CVE-2024-50230 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzbot reported that in directory operations after nilfs2 detects filesystem corruption and degrades to read-only, __block_write_begin_int(), which is called to prepare block writes, may fail the BUG_ON check for accesses exceeding the folio/page size, triggering a kernel bug. This was found to be because the "checked" flag of a page/folio was not cleared when it was discarded by nilfs2's own routine, which causes the sanity check of directory entries to be skipped when the directory page/folio is reloaded. So, fix that. This was necessary when the use of nilfs2's own page discard routine was applied to more than just metadata files. Link: https://lkml.kernel.org/r/20241017193359.5051-1-konishi.ryusuke@gmail.com Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+d6ca2daf692c7a82f959(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d6ca2daf692c7a82f959 Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/nilfs2/page.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- fs/nilfs2/page.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index 81992b9a219b..2a39b7485b99 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -403,6 +403,7 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) ClearPageUptodate(page); ClearPageMappedToDisk(page); + ClearPageChecked(page); if (page_has_buffers(page)) { struct buffer_head *bh, *head; -- 2.33.0

2 1

[PATCH OLK-5.10] nilfs2: fix kernel bug due to missing clearing of checked flag
by Qi Xi 25 Nov '24

25 Nov '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.12-rc6 commit 41e192ad2779cae0102879612dfe46726e4396aa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AW CVE: CVE-2024-50230 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzbot reported that in directory operations after nilfs2 detects filesystem corruption and degrades to read-only, __block_write_begin_int(), which is called to prepare block writes, may fail the BUG_ON check for accesses exceeding the folio/page size, triggering a kernel bug. This was found to be because the "checked" flag of a page/folio was not cleared when it was discarded by nilfs2's own routine, which causes the sanity check of directory entries to be skipped when the directory page/folio is reloaded. So, fix that. This was necessary when the use of nilfs2's own page discard routine was applied to more than just metadata files. Link: https://lkml.kernel.org/r/20241017193359.5051-1-konishi.ryusuke@gmail.com Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+d6ca2daf692c7a82f959(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d6ca2daf692c7a82f959 Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/nilfs2/page.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- fs/nilfs2/page.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index 81992b9a219b..2a39b7485b99 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -403,6 +403,7 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) ClearPageUptodate(page); ClearPageMappedToDisk(page); + ClearPageChecked(page); if (page_has_buffers(page)) { struct buffer_head *bh, *head; -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS] nilfs2: fix kernel bug due to missing clearing of checked flag
by Qi Xi 25 Nov '24

25 Nov '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.12-rc6 commit 41e192ad2779cae0102879612dfe46726e4396aa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AW CVE: CVE-2024-50230 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzbot reported that in directory operations after nilfs2 detects filesystem corruption and degrades to read-only, __block_write_begin_int(), which is called to prepare block writes, may fail the BUG_ON check for accesses exceeding the folio/page size, triggering a kernel bug. This was found to be because the "checked" flag of a page/folio was not cleared when it was discarded by nilfs2's own routine, which causes the sanity check of directory entries to be skipped when the directory page/folio is reloaded. So, fix that. This was necessary when the use of nilfs2's own page discard routine was applied to more than just metadata files. Link: https://lkml.kernel.org/r/20241017193359.5051-1-konishi.ryusuke@gmail.com Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+d6ca2daf692c7a82f959(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d6ca2daf692c7a82f959 Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/nilfs2/page.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- fs/nilfs2/page.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index 81992b9a219b..2a39b7485b99 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -403,6 +403,7 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) ClearPageUptodate(page); ClearPageMappedToDisk(page); + ClearPageChecked(page); if (page_has_buffers(page)) { struct buffer_head *bh, *head; -- 2.33.0

2 1

[PATCH OLK-6.6] perf: Add PMCG platform information for HiSilicon HIP09A
by Yushan Wang 25 Nov '24

25 Nov '24

From: Qinxin Xia <xiaqinxin(a)huawei.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB5WVR CVE: NA ---------------------------------------------------------------------- Bugfix or Feature: Bugfix Description: HiSilicon HIP09A platforms using the same SMMU PMCG with HIP09 and thus suffers the same erratum. List them in the PMCG platform information list without introducing a new SMMU PMCG Model. Signed-off-by: Qinxin Xia <xiaqinxin(a)huawei.com> Signed-off-by: zhangqz <14294317+zhangqizhi3(a)user.noreply.gitee.com> --- Documentation/arch/arm64/silicon-errata.rst | 5 +++-- drivers/acpi/arm64/iort.c | 2 ++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst index ef58c86cd10b..bc1c1ba2fe56 100644 --- a/Documentation/arch/arm64/silicon-errata.rst +++ b/Documentation/arch/arm64/silicon-errata.rst @@ -202,8 +202,9 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | Hip08 SMMU PMCG | #162001800 | N/A | +----------------+-----------------+-----------------+-----------------------------+ -| Hisilicon | Hip{08,09,10,10C| #162001900 | N/A | -| | ,11} SMMU PMCG | | | +| Hisilicon | Hip{08,09,09A, | #162001900 | N/A | +| | 10,10C,11} | | | +| | SMMU PMCG | | | +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | LINXICORE9100 | #162100125 | HISILICON_ERRATUM_162100125 | +----------------+-----------------+-----------------+-----------------------------+ diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c index b1f483845bc0..c8d21e776342 100644 --- a/drivers/acpi/arm64/iort.c +++ b/drivers/acpi/arm64/iort.c @@ -1712,6 +1712,8 @@ static struct acpi_platform_list pmcg_plat_info[] __initdata = { /* HiSilicon Hip09 Platform */ {"HISI ", "HIP09 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, + {"HISI ", "HIP09A ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, /* HiSilicon Hip10/11 Platform uses the same SMMU IP with Hip09 */ {"HISI ", "HIP10 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, -- 2.33.0

2 1

[openeuler:OLK-6.6 1517/1517] drivers/mtd/nand/raw/nand.o: warning: objtool: hynix_nand_init+0x119f: unreachable instruction
by kernel test robot 25 Nov '24

25 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c9048e254addf0bdb1d8bb42407f462b06c5498c commit: 107e8e2d48f2014216a818314d4e1af591b39aed [1517/1517] cpu: Re-enable CPU mitigations by default for !X86 architectures config: x86_64-buildonly-randconfig-001-20241125 (https://download.01.org/0day-ci/archive/20241125/202411251538.z0jr4NG7-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241125/202411251538.z0jr4NG7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411251538.z0jr4NG7-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/mtd/nand/raw/nand.o: warning: objtool: hynix_nand_init+0x119f: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/4] arm64: Add xcall/xint support
by Jinjie Ruan 25 Nov '24

25 Nov '24

Add xcall/xint support for arm64. Jinjie Ruan (2): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 64 ++++++++++++ arch/arm64/Kconfig | 2 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 51 +++++++++ arch/arm64/kernel/entry-common.c | 162 +++++++++++++++++++++++++++++ arch/arm64/kernel/entry.S | 156 ++++++++++++++++++++++++++- arch/arm64/tools/cpucaps | 2 + drivers/irqchip/irq-gic-v3.c | 123 ++++++++++++++++++++++ fs/proc/base.c | 112 ++++++++++++++++++++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 +++ include/linux/sched.h | 4 + kernel/fork.c | 17 +++ kernel/irq/debugfs.c | 33 ++++++ kernel/irq/internals.h | 18 ++++ kernel/irq/proc.c | 6 ++ kernel/softirq.c | 47 +++++++++ 17 files changed, 815 insertions(+), 3 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 V1 0/4] add ebpf sched
by Cheng Yu 25 Nov '24

25 Nov '24

add ebpf sched Cheng Yu (1): sched/ebpf: Support task selection programmable Hui Tang (1): sched: Add kfunc to get cpu statistics Roman Gushchin (2): libbpf: add support for scheduler bpf programs bpftool: recognize scheduler programs include/linux/sched.h | 20 ++++ include/linux/sched_hook_defs.h | 4 + kernel/bpf/btf.c | 3 + kernel/sched/bpf_sched.c | 190 ++++++++++++++++++++++++++++++++ kernel/sched/fair.c | 14 +++ tools/lib/bpf/libbpf.c | 23 +++- tools/lib/bpf/libbpf.h | 2 + tools/lib/bpf/libbpf.map | 1 + 8 files changed, 256 insertions(+), 1 deletion(-) -- 2.25.1

2 5

[PATCH OLK-6.6] perf: Add PMCG platform information for HiSilicon HIP09A
by Yushan Wang 25 Nov '24

25 Nov '24

From: Qinxin Xia <xiaqinxin(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB5WVR CVE: NA ---------------------------------------------------------------------- Bugfix or Feature: Bugfix Description: HiSilicon HIP09A platforms using the same SMMU PMCG with HIP09 and thus suffers the same erratum. List them in the PMCG platform information list without introducing a new SMMU PMCG Model. Signed-off-by: Qinxin Xia <xiaqinxin(a)huawei.com> Signed-off-by: zhangqz <14294317+zhangqizhi3(a)user.noreply.gitee.com> --- Documentation/arch/arm64/silicon-errata.rst | 5 +++-- drivers/acpi/arm64/iort.c | 2 ++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst index ef58c86cd10b..bc1c1ba2fe56 100644 --- a/Documentation/arch/arm64/silicon-errata.rst +++ b/Documentation/arch/arm64/silicon-errata.rst @@ -202,8 +202,9 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | Hip08 SMMU PMCG | #162001800 | N/A | +----------------+-----------------+-----------------+-----------------------------+ -| Hisilicon | Hip{08,09,10,10C| #162001900 | N/A | -| | ,11} SMMU PMCG | | | +| Hisilicon | Hip{08,09,09A, | #162001900 | N/A | +| | 10,10C,11} | | | +| | SMMU PMCG | | | +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | LINXICORE9100 | #162100125 | HISILICON_ERRATUM_162100125 | +----------------+-----------------+-----------------+-----------------------------+ diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c index b1f483845bc0..c8d21e776342 100644 --- a/drivers/acpi/arm64/iort.c +++ b/drivers/acpi/arm64/iort.c @@ -1712,6 +1712,8 @@ static struct acpi_platform_list pmcg_plat_info[] __initdata = { /* HiSilicon Hip09 Platform */ {"HISI ", "HIP09 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, + {"HISI ", "HIP09A ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, /* HiSilicon Hip10/11 Platform uses the same SMMU IP with Hip09 */ {"HISI ", "HIP10 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1] pinctrl: ocelot: fix system hang on level based interrupts
by Zeng Heng 25 Nov '24

25 Nov '24

From: Sergey Matsievskiy <matsievskiysv(a)gmail.com> mainline inclusion from mainline-v6.12-rc4 commit 93b8ddc54507a227087c60a0013ed833b6ae7d3c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YX2 CVE: CVE-2024-50196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The current implementation only calls chained_irq_enter() and chained_irq_exit() if it detects pending interrupts. ``` for (i = 0; i < info->stride; i++) { uregmap_read(info->map, id_reg + 4 * i, &reg); if (!reg) continue; chained_irq_enter(parent_chip, desc); ``` However, in case of GPIO pin configured in level mode and the parent controller configured in edge mode, GPIO interrupt might be lowered by the hardware. In the result, if the interrupt is short enough, the parent interrupt is still pending while the GPIO interrupt is cleared; chained_irq_enter() never gets called and the system hangs trying to service the parent interrupt. Moving chained_irq_enter() and chained_irq_exit() outside the for loop ensures that they are called even when GPIO interrupt is lowered by the hardware. The similar code with chained_irq_enter() / chained_irq_exit() functions wrapping interrupt checking loop may be found in many other drivers: ``` grep -r -A 10 chained_irq_enter drivers/pinctrl ``` Cc: stable(a)vger.kernel.org Signed-off-by: Sergey Matsievskiy <matsievskiysv(a)gmail.com> Reviewed-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Link: https://lore.kernel.org/20241012105743.12450-2-matsievskiysv@gmail.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Conflicts: drivers/pinctrl/pinctrl-ocelot.c [Fix context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pinctrl/pinctrl-ocelot.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/pinctrl/pinctrl-ocelot.c b/drivers/pinctrl/pinctrl-ocelot.c index a4a1b00f7f0d..e8ee2ade5293 100644 --- a/drivers/pinctrl/pinctrl-ocelot.c +++ b/drivers/pinctrl/pinctrl-ocelot.c @@ -1097,22 +1097,21 @@ static void ocelot_irq_handler(struct irq_desc *desc) unsigned int reg = 0, irq, i; unsigned long irqs; + chained_irq_enter(parent_chip, desc); + for (i = 0; i < info->stride; i++) { regmap_read(info->map, id_reg + 4 * i, &reg); if (!reg) continue; - chained_irq_enter(parent_chip, desc); - irqs = reg; for_each_set_bit(irq, &irqs, min(32U, info->desc->npins - 32 * i)) generic_handle_irq(irq_linear_revmap(chip->irq.domain, irq + 32 * i)); - - chained_irq_exit(parent_chip, desc); } + chained_irq_exit(parent_chip, desc); } static int ocelot_gpiochip_register(struct platform_device *pdev, -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1291/1291] drivers/mmc/host/phytium-mci-pci.c:48:15: error: implicit declaration of function 'pcim_enable_device'; did you mean 'pci_enable_device'?
by kernel test robot 25 Nov '24

25 Nov '24

Hi Malloy, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 81e029d5dd0cae934243168eee37ef303ebcce38 commit: d65622e6edee11f7fcbd295bdb5aef86e12dfef3 [1291/1291] mmc: add support for Phytium MMC config: arm64-randconfig-003-20241113 (https://download.01.org/0day-ci/archive/20241125/202411251324.yzrltIBa-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241125/202411251324.yzrltIBa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411251324.yzrltIBa-lkp@intel.com/ All error/warnings (new ones prefixed by >>): drivers/mmc/host/phytium-mci-pci.c: In function 'phytium_mci_pci_probe': >> drivers/mmc/host/phytium-mci-pci.c:48:15: error: implicit declaration of function 'pcim_enable_device'; did you mean 'pci_enable_device'? [-Werror=implicit-function-declaration] 48 | ret = pcim_enable_device(pdev); | ^~~~~~~~~~~~~~~~~~ | pci_enable_device >> drivers/mmc/host/phytium-mci-pci.c:61:9: error: implicit declaration of function 'pci_enable_msi'; did you mean 'pci_enable_sriov'? [-Werror=implicit-function-declaration] 61 | pci_enable_msi(pdev); | ^~~~~~~~~~~~~~ | pci_enable_sriov drivers/mmc/host/phytium-mci-pci.c: At top level: >> drivers/mmc/host/phytium-mci-pci.c:180:1: warning: data definition has no type or storage class 180 | module_pci_driver(phytium_mci_pci_driver); | ^~~~~~~~~~~~~~~~~ >> drivers/mmc/host/phytium-mci-pci.c:180:1: error: type defaults to 'int' in declaration of 'module_pci_driver' [-Werror=implicit-int] >> drivers/mmc/host/phytium-mci-pci.c:180:1: warning: parameter names (without types) in function declaration [-Wdeclaration-missing-parameter-type] >> drivers/mmc/host/phytium-mci-pci.c:171:26: warning: 'phytium_mci_pci_driver' defined but not used [-Wunused-variable] 171 | static struct pci_driver phytium_mci_pci_driver = { | ^~~~~~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +48 drivers/mmc/host/phytium-mci-pci.c 40 41 static int 42 phytium_mci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *pid) 43 { 44 struct phytium_mci_host *host; 45 struct mmc_host *mmc; 46 int ret; 47 > 48 ret = pcim_enable_device(pdev); 49 50 if (ret) 51 return ret; 52 pci_set_master(pdev); 53 54 mmc = mmc_alloc_host(sizeof(struct phytium_mci_host), &pdev->dev); 55 56 if (!mmc) 57 return -ENOMEM; 58 59 host = mmc_priv(mmc); 60 > 61 pci_enable_msi(pdev); 62 63 host->irq = pdev->irq; 64 host->irq_flags = IRQF_SHARED; 65 host->dev = &pdev->dev; 66 ret = pcim_iomap_regions(pdev, 1 << PCI_BAR_NO, pci_name(pdev)); 67 68 if (ret) { 69 dev_err(&pdev->dev, "I/O memory remapping failed\n"); 70 goto host_free; 71 } 72 73 host->base = pcim_iomap_table(pdev)[PCI_BAR_NO]; 74 host->is_use_dma = 1; 75 host->is_device_x100 = 1; 76 77 if (pdev->devfn == 2) { 78 host->caps = emmc_caps; 79 host->caps2 = emmc_caps2; 80 } else { 81 host->caps = sd_caps; 82 host->caps2 = sd_caps2; 83 mmc->f_max = 25000000; /* stable frequency */ 84 } 85 86 host->mmc = mmc; 87 host->clk_rate = MCI_CLK; 88 89 dev_info(&pdev->dev, 90 "%s %d:[bar %d] addr:0x%llx size:0x%llx km:0x%llx devfn:%d\n", 91 __func__, __LINE__, PCI_BAR_NO, pci_resource_start(pdev, 0), 92 pci_resource_len(pdev, 0), (uint64_t)host->base, pdev->devfn); 93 94 dev_dbg(&pdev->dev, "%s %d:irq:0x%x\n", __func__, __LINE__, host->irq); 95 96 ret = phytium_mci_common_probe(host); 97 98 if (ret == MCI_REALEASE_MEM) { 99 ret = -ENOMEM; 100 goto release_mem; 101 } else if (ret) { 102 goto release; 103 } 104 pci_set_drvdata(pdev, mmc); 105 dev_info(&pdev->dev, 106 "%s %d: probe phytium mci successful.\n", __func__, __LINE__); 107 return 0; 108 109 release: 110 phytium_mci_deinit_hw(host); 111 release_mem: 112 113 if (host->dma.adma_table) { 114 dma_free_coherent(&pdev->dev, 115 MAX_BD_NUM * sizeof(struct phytium_adma2_64_desc), 116 host->dma.adma_table, host->dma.adma_addr); 117 } 118 host_free: 119 mmc_free_host(mmc); 120 pci_disable_device(pdev); 121 return ret; 122 } 123 124 static void phytium_mci_pci_remove(struct pci_dev *pdev) 125 { 126 struct phytium_mci_host *host; 127 struct mmc_host *mmc; 128 129 mmc = pci_get_drvdata(pdev); 130 if (!mmc) { 131 dev_info(&pdev->dev, 132 "%s %d: mmc is null.\n", __func__, __LINE__); 133 return; 134 } 135 host = mmc_priv(mmc); 136 if (!host) { 137 dev_info(&pdev->dev, 138 "%s %d: host is null.\n", __func__, __LINE__); 139 mmc_remove_host(mmc); 140 mmc_free_host(mmc); 141 return; 142 } 143 144 del_timer(&host->hotplug_timer); 145 146 mmc_remove_host(host->mmc); 147 148 if (host->dma.adma_table) { 149 dma_free_coherent(&pdev->dev, 150 MAX_BD_NUM * sizeof(struct phytium_adma2_64_desc), 151 host->dma.adma_table, host->dma.adma_addr); 152 } 153 phytium_mci_deinit_hw(host); 154 mmc_free_host(mmc); 155 pci_set_drvdata(pdev, NULL); 156 } 157 158 static const struct pci_device_id phytium_mci_pci_tbl[] = { 159 { 160 .vendor = 0x1DB7, 161 .device = 0xDC28, 162 .subvendor = PCI_ANY_ID, 163 .subdevice = PCI_ANY_ID, 164 .class = 0x5, 165 .class_mask = 0, 166 }, 167 {} 168 }; 169 MODULE_DEVICE_TABLE(pci, phytium_mci_pci_tbl); 170 > 171 static struct pci_driver phytium_mci_pci_driver = { 172 .name = "phytium-mci-pci", 173 .id_table = phytium_mci_pci_tbl, 174 .probe = phytium_mci_pci_probe, 175 .remove = phytium_mci_pci_remove, 176 .driver = { 177 .pm = &phytium_mci_dev_pm_ops, 178 } 179 }; > 180 module_pci_driver(phytium_mci_pci_driver); 181 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2415/2415] mm/memcontrol.c:5402:40: error: implicit declaration of function 'ksm_process_profit'
by kernel test robot 25 Nov '24

25 Nov '24

Hi Nanyong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c09bf9815abdd0805b9c0cd61353271d7ecf156f commit: 0f6fb3570be40b783d8c756d64297be1a8e3d2b3 [2415/2415] memcg: support ksm merge any mode per cgroup config: x86_64-buildonly-randconfig-004-20241111 (https://download.01.org/0day-ci/archive/20241125/202411251245.WgcEUBZC-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241125/202411251245.WgcEUBZC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411251245.WgcEUBZC-lkp@intel.com/ All errors (new ones prefixed by >>): mm/memcontrol.c: In function 'memory_ksm_show': >> mm/memcontrol.c:5402:40: error: implicit declaration of function 'ksm_process_profit' [-Werror=implicit-function-declaration] 5402 | ksm_process_profits += ksm_process_profit(mm); | ^~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/ksm_process_profit +5402 mm/memcontrol.c 5379 5380 static int memory_ksm_show(struct seq_file *m, void *v) 5381 { 5382 unsigned long ksm_merging_pages = 0; 5383 unsigned long ksm_rmap_items = 0; 5384 long ksm_process_profits = 0; 5385 unsigned int tasks = 0; 5386 struct task_struct *task; 5387 struct mm_struct *mm; 5388 struct css_task_iter it; 5389 struct mem_cgroup *memcg = mem_cgroup_from_seq(m); 5390 5391 css_task_iter_start(&memcg->css, CSS_TASK_ITER_PROCS, &it); 5392 while ((task = css_task_iter_next(&it))) { 5393 mm = get_task_mm(task); 5394 if (!mm) 5395 continue; 5396 5397 if (test_bit(MMF_VM_MERGE_ANY, &mm->flags)) 5398 tasks++; 5399 5400 ksm_rmap_items += mm->ksm_rmap_items; 5401 ksm_merging_pages += mm->ksm_merging_pages; > 5402 ksm_process_profits += ksm_process_profit(mm); 5403 mmput(mm); 5404 } 5405 css_task_iter_end(&it); 5406 5407 seq_printf(m, "merge any state: %d\n", READ_ONCE(memcg->ksm_merge_any)); 5408 seq_printf(m, "merge any tasks: %u\n", tasks); 5409 seq_printf(m, "ksm_rmap_items %lu\n", ksm_rmap_items); 5410 seq_printf(m, "ksm_merging_pages %lu\n", ksm_merging_pages); 5411 seq_printf(m, "ksm_process_profits %ld\n", ksm_process_profits); 5412 return 0; 5413 } 5414 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] pinctrl: ocelot: fix system hang on level based interrupts
by Zeng Heng 25 Nov '24

25 Nov '24

From: Sergey Matsievskiy <matsievskiysv(a)gmail.com> mainline inclusion from mainline-v6.12-rc4 commit 93b8ddc54507a227087c60a0013ed833b6ae7d3c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YX2 CVE: CVE-2024-50196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The current implementation only calls chained_irq_enter() and chained_irq_exit() if it detects pending interrupts. ``` for (i = 0; i < info->stride; i++) { uregmap_read(info->map, id_reg + 4 * i, &reg); if (!reg) continue; chained_irq_enter(parent_chip, desc); ``` However, in case of GPIO pin configured in level mode and the parent controller configured in edge mode, GPIO interrupt might be lowered by the hardware. In the result, if the interrupt is short enough, the parent interrupt is still pending while the GPIO interrupt is cleared; chained_irq_enter() never gets called and the system hangs trying to service the parent interrupt. Moving chained_irq_enter() and chained_irq_exit() outside the for loop ensures that they are called even when GPIO interrupt is lowered by the hardware. The similar code with chained_irq_enter() / chained_irq_exit() functions wrapping interrupt checking loop may be found in many other drivers: ``` grep -r -A 10 chained_irq_enter drivers/pinctrl ``` Cc: stable(a)vger.kernel.org Signed-off-by: Sergey Matsievskiy <matsievskiysv(a)gmail.com> Reviewed-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Link: https://lore.kernel.org/20241012105743.12450-2-matsievskiysv@gmail.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Conflicts: drivers/pinctrl/pinctrl-ocelot.c [Fix context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pinctrl/pinctrl-ocelot.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/pinctrl/pinctrl-ocelot.c b/drivers/pinctrl/pinctrl-ocelot.c index a4a1b00f7f0d..e8ee2ade5293 100644 --- a/drivers/pinctrl/pinctrl-ocelot.c +++ b/drivers/pinctrl/pinctrl-ocelot.c @@ -1097,22 +1097,21 @@ static void ocelot_irq_handler(struct irq_desc *desc) unsigned int reg = 0, irq, i; unsigned long irqs; + chained_irq_enter(parent_chip, desc); + for (i = 0; i < info->stride; i++) { regmap_read(info->map, id_reg + 4 * i, &reg); if (!reg) continue; - chained_irq_enter(parent_chip, desc); - irqs = reg; for_each_set_bit(irq, &irqs, min(32U, info->desc->npins - 32 * i)) generic_handle_irq(irq_linear_revmap(chip->irq.domain, irq + 32 * i)); - - chained_irq_exit(parent_chip, desc); } + chained_irq_exit(parent_chip, desc); } static int ocelot_gpiochip_register(struct platform_device *pdev, -- 2.25.1

2 1

[openeuler:OLK-6.6 1466/1466] loongson3-acpi-cpufreq.c:undefined reference to `acpi_processor_unregister_performance'
by kernel test robot 25 Nov '24

25 Nov '24

Hi liuyun, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e2e6e833f0e931accd24012488ed312ed9f63150 commit: 47a0b6f372d7f05822d021f86b21a34fd2142225 [1466/1466] cpufreq: Add cpufreq driver for LoongArch config: loongarch-randconfig-r053-20241114 (https://download.01.org/0day-ci/archive/20241125/202411251114.dtutDKWn-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241125/202411251114.dtutDKWn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411251114.dtutDKWn-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: drivers/cpufreq/loongson3-acpi-cpufreq.o: in function `loongson3_cpufreq_cpu_exit': >> loongson3-acpi-cpufreq.c:(.text+0x5b4): undefined reference to `acpi_processor_unregister_performance' loongarch64-linux-ld: drivers/cpufreq/loongson3-acpi-cpufreq.o: in function `.L231': >> loongson3-acpi-cpufreq.c:(.text+0x1ba8): undefined reference to `acpi_processor_register_performance' loongarch64-linux-ld: drivers/cpufreq/loongson3-acpi-cpufreq.o: in function `.L276': loongson3-acpi-cpufreq.c:(.text+0x225c): undefined reference to `acpi_processor_unregister_performance' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] media: av7110: fix a spectre vulnerability
by Li Huafei 25 Nov '24

25 Nov '24

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> mainline inclusion from mainline-v6.12-rc7 commit 458ea1c0be991573ec436aa0afa23baacfae101a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVC CVE: CVE-2024-50289 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As warned by smatch: drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110->ci_slot' [w] (local cap) There is a spectre-related vulnerability at the code. Fix it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Conflicts: drivers/media/pci/ttpci/av7110.h drivers/media/pci/ttpci/av7110_ca.c drivers/staging/media/av7110/av7110.h drivers/staging/media/av7110/av7110_ca.c Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/media/pci/ttpci/av7110.h | 4 +++- drivers/media/pci/ttpci/av7110_ca.c | 26 ++++++++++++++++++-------- 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/drivers/media/pci/ttpci/av7110.h b/drivers/media/pci/ttpci/av7110.h index 809d938ae166..f77766008b97 100644 --- a/drivers/media/pci/ttpci/av7110.h +++ b/drivers/media/pci/ttpci/av7110.h @@ -86,6 +86,8 @@ struct infrared { u32 ir_config; }; +#define MAX_CI_SLOTS 2 + /* place to store all the necessary device information */ struct av7110 { @@ -166,7 +168,7 @@ struct av7110 { /* CA */ - struct ca_slot_info ci_slot[2]; + struct ca_slot_info ci_slot[MAX_CI_SLOTS]; enum av7110_video_mode vidmode; struct dmxdev dmxdev; diff --git a/drivers/media/pci/ttpci/av7110_ca.c b/drivers/media/pci/ttpci/av7110_ca.c index c1338e074a3d..7216365331a6 100644 --- a/drivers/media/pci/ttpci/av7110_ca.c +++ b/drivers/media/pci/ttpci/av7110_ca.c @@ -18,6 +18,7 @@ #include <linux/timer.h> #include <linux/poll.h> #include <linux/gfp.h> +#include <linux/nospec.h> #include "av7110.h" #include "av7110_hw.h" @@ -26,23 +27,28 @@ void CI_handle(struct av7110 *av7110, u8 *data, u16 len) { + unsigned slot_num; + dprintk(8, "av7110:%p\n",av7110); if (len < 3) return; switch (data[0]) { case CI_MSG_CI_INFO: - if (data[2] != 1 && data[2] != 2) + if (data[2] != 1 && data[2] != MAX_CI_SLOTS) break; + + slot_num = array_index_nospec(data[2] - 1, MAX_CI_SLOTS); + switch (data[1]) { case 0: - av7110->ci_slot[data[2] - 1].flags = 0; + av7110->ci_slot[slot_num].flags = 0; break; case 1: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_PRESENT; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_PRESENT; break; case 2: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_READY; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_READY; break; } break; @@ -264,15 +270,19 @@ static int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg) case CA_GET_SLOT_INFO: { struct ca_slot_info *info=(struct ca_slot_info *)parg; + unsigned int slot_num; if (info->num < 0 || info->num > 1) { mutex_unlock(&av7110->ioctl_mutex); return -EINVAL; } - av7110->ci_slot[info->num].num = info->num; - av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? - CA_CI_LINK : CA_CI; - memcpy(info, &av7110->ci_slot[info->num], sizeof(struct ca_slot_info)); + slot_num = array_index_nospec(info->num, MAX_CI_SLOTS); + + av7110->ci_slot[slot_num].num = info->num; + av7110->ci_slot[slot_num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? + CA_CI_LINK : CA_CI; + memcpy(info, &av7110->ci_slot[slot_num], + sizeof(struct ca_slot_info)); break; } -- 2.25.1

2 1

[PATCH OLK-5.10] media: av7110: fix a spectre vulnerability
by Li Huafei 25 Nov '24

25 Nov '24

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> mainline inclusion from mainline-v6.12-rc7 commit 458ea1c0be991573ec436aa0afa23baacfae101a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVC CVE: CVE-2024-50289 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As warned by smatch: drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110->ci_slot' [w] (local cap) There is a spectre-related vulnerability at the code. Fix it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Conflicts: drivers/media/pci/ttpci/av7110.h drivers/media/pci/ttpci/av7110_ca.c drivers/staging/media/av7110/av7110.h drivers/staging/media/av7110/av7110_ca.c Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/media/pci/ttpci/av7110.h | 4 +++- drivers/media/pci/ttpci/av7110_ca.c | 26 ++++++++++++++++++-------- 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/drivers/media/pci/ttpci/av7110.h b/drivers/media/pci/ttpci/av7110.h index 809d938ae166..f77766008b97 100644 --- a/drivers/media/pci/ttpci/av7110.h +++ b/drivers/media/pci/ttpci/av7110.h @@ -86,6 +86,8 @@ struct infrared { u32 ir_config; }; +#define MAX_CI_SLOTS 2 + /* place to store all the necessary device information */ struct av7110 { @@ -166,7 +168,7 @@ struct av7110 { /* CA */ - struct ca_slot_info ci_slot[2]; + struct ca_slot_info ci_slot[MAX_CI_SLOTS]; enum av7110_video_mode vidmode; struct dmxdev dmxdev; diff --git a/drivers/media/pci/ttpci/av7110_ca.c b/drivers/media/pci/ttpci/av7110_ca.c index c1338e074a3d..7216365331a6 100644 --- a/drivers/media/pci/ttpci/av7110_ca.c +++ b/drivers/media/pci/ttpci/av7110_ca.c @@ -18,6 +18,7 @@ #include <linux/timer.h> #include <linux/poll.h> #include <linux/gfp.h> +#include <linux/nospec.h> #include "av7110.h" #include "av7110_hw.h" @@ -26,23 +27,28 @@ void CI_handle(struct av7110 *av7110, u8 *data, u16 len) { + unsigned slot_num; + dprintk(8, "av7110:%p\n",av7110); if (len < 3) return; switch (data[0]) { case CI_MSG_CI_INFO: - if (data[2] != 1 && data[2] != 2) + if (data[2] != 1 && data[2] != MAX_CI_SLOTS) break; + + slot_num = array_index_nospec(data[2] - 1, MAX_CI_SLOTS); + switch (data[1]) { case 0: - av7110->ci_slot[data[2] - 1].flags = 0; + av7110->ci_slot[slot_num].flags = 0; break; case 1: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_PRESENT; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_PRESENT; break; case 2: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_READY; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_READY; break; } break; @@ -264,15 +270,19 @@ static int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg) case CA_GET_SLOT_INFO: { struct ca_slot_info *info=(struct ca_slot_info *)parg; + unsigned int slot_num; if (info->num < 0 || info->num > 1) { mutex_unlock(&av7110->ioctl_mutex); return -EINVAL; } - av7110->ci_slot[info->num].num = info->num; - av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? - CA_CI_LINK : CA_CI; - memcpy(info, &av7110->ci_slot[info->num], sizeof(struct ca_slot_info)); + slot_num = array_index_nospec(info->num, MAX_CI_SLOTS); + + av7110->ci_slot[slot_num].num = info->num; + av7110->ci_slot[slot_num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? + CA_CI_LINK : CA_CI; + memcpy(info, &av7110->ci_slot[slot_num], + sizeof(struct ca_slot_info)); break; } -- 2.25.1

2 1

[PATCH OLK-6.6] media: av7110: fix a spectre vulnerability
by Li Huafei 25 Nov '24

25 Nov '24

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> mainline inclusion from mainline-v6.12-rc7 commit 458ea1c0be991573ec436aa0afa23baacfae101a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVC CVE: CVE-2024-50289 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As warned by smatch: drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110->ci_slot' [w] (local cap) There is a spectre-related vulnerability at the code. Fix it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Conflicts: drivers/staging/media/av7110/av7110.h drivers/staging/media/av7110/av7110_ca.c [ Context conflict caused by unmerged commit f6ed8943fb06 ('media: av7110: coding style fixes: logging'). ] Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/staging/media/av7110/av7110.h | 4 +++- drivers/staging/media/av7110/av7110_ca.c | 26 ++++++++++++++++-------- 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/drivers/staging/media/av7110/av7110.h b/drivers/staging/media/av7110/av7110.h index 809d938ae166..f77766008b97 100644 --- a/drivers/staging/media/av7110/av7110.h +++ b/drivers/staging/media/av7110/av7110.h @@ -86,6 +86,8 @@ struct infrared { u32 ir_config; }; +#define MAX_CI_SLOTS 2 + /* place to store all the necessary device information */ struct av7110 { @@ -166,7 +168,7 @@ struct av7110 { /* CA */ - struct ca_slot_info ci_slot[2]; + struct ca_slot_info ci_slot[MAX_CI_SLOTS]; enum av7110_video_mode vidmode; struct dmxdev dmxdev; diff --git a/drivers/staging/media/av7110/av7110_ca.c b/drivers/staging/media/av7110/av7110_ca.c index c1338e074a3d..7216365331a6 100644 --- a/drivers/staging/media/av7110/av7110_ca.c +++ b/drivers/staging/media/av7110/av7110_ca.c @@ -18,6 +18,7 @@ #include <linux/timer.h> #include <linux/poll.h> #include <linux/gfp.h> +#include <linux/nospec.h> #include "av7110.h" #include "av7110_hw.h" @@ -26,23 +27,28 @@ void CI_handle(struct av7110 *av7110, u8 *data, u16 len) { + unsigned slot_num; + dprintk(8, "av7110:%p\n",av7110); if (len < 3) return; switch (data[0]) { case CI_MSG_CI_INFO: - if (data[2] != 1 && data[2] != 2) + if (data[2] != 1 && data[2] != MAX_CI_SLOTS) break; + + slot_num = array_index_nospec(data[2] - 1, MAX_CI_SLOTS); + switch (data[1]) { case 0: - av7110->ci_slot[data[2] - 1].flags = 0; + av7110->ci_slot[slot_num].flags = 0; break; case 1: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_PRESENT; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_PRESENT; break; case 2: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_READY; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_READY; break; } break; @@ -264,15 +270,19 @@ static int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg) case CA_GET_SLOT_INFO: { struct ca_slot_info *info=(struct ca_slot_info *)parg; + unsigned int slot_num; if (info->num < 0 || info->num > 1) { mutex_unlock(&av7110->ioctl_mutex); return -EINVAL; } - av7110->ci_slot[info->num].num = info->num; - av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? - CA_CI_LINK : CA_CI; - memcpy(info, &av7110->ci_slot[info->num], sizeof(struct ca_slot_info)); + slot_num = array_index_nospec(info->num, MAX_CI_SLOTS); + + av7110->ci_slot[slot_num].num = info->num; + av7110->ci_slot[slot_num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? + CA_CI_LINK : CA_CI; + memcpy(info, &av7110->ci_slot[slot_num], + sizeof(struct ca_slot_info)); break; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Initialize denominators' default to 1
by dinglongwei 25 Nov '24

25 Nov '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v6.11.3 commit 7f8e93b862aba08d540f1e9e03e0ceb4d0cfd5fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRC8 CVE: CVE-2024-49899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b995c0a6de6c74656a0c39cd57a0626351b13e3c ] [WHAT & HOW] Variables used as denominators and maybe not assigned to other values, should not be 0. Change their default to 1 so they are never 0. This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Jerry Zuo <jerry.zuo(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared.c [Context conflicts: no dml2_core_shared.c file in current version, introduced in higher version] Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- .../gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c | 2 +- drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c index 799bae229e67..0c5186f01c45 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c @@ -78,7 +78,7 @@ static void calculate_ttu_cursor(struct display_mode_lib *mode_lib, static unsigned int get_bytes_per_element(enum source_format_class source_format, bool is_chroma) { - unsigned int ret_val = 0; + unsigned int ret_val = 1; if (source_format == dm_444_16) { if (!is_chroma) diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c b/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c index 414da64f5734..74fe5e6bb09d 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c @@ -39,7 +39,7 @@ static unsigned int get_bytes_per_element(enum source_format_class source_format, bool is_chroma) { - unsigned int ret_val = 0; + unsigned int ret_val = 1; if (source_format == dm_444_16) { if (!is_chroma) -- 2.17.1

2 1

[PATCH OLK-5.10] drm/amd/display: Initialize denominators' default to 1
by dinglongwei 25 Nov '24

25 Nov '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v6.11.3 commit 7f8e93b862aba08d540f1e9e03e0ceb4d0cfd5fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRC8 CVE: CVE-2024-49899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b995c0a6de6c74656a0c39cd57a0626351b13e3c ] [WHAT & HOW] Variables used as denominators and maybe not assigned to other values, should not be 0. Change their default to 1 so they are never 0. This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Jerry Zuo <jerry.zuo(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared.c [Context conflicts: no dml2_core_shared.c file in current version, introduced in higher version] Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- .../gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c | 2 +- drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c index 799bae229e67..0c5186f01c45 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c @@ -78,7 +78,7 @@ static void calculate_ttu_cursor(struct display_mode_lib *mode_lib, static unsigned int get_bytes_per_element(enum source_format_class source_format, bool is_chroma) { - unsigned int ret_val = 0; + unsigned int ret_val = 1; if (source_format == dm_444_16) { if (!is_chroma) diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c b/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c index 414da64f5734..74fe5e6bb09d 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c @@ -39,7 +39,7 @@ static unsigned int get_bytes_per_element(enum source_format_class source_format, bool is_chroma) { - unsigned int ret_val = 0; + unsigned int ret_val = 1; if (source_format == dm_444_16) { if (!is_chroma) -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] vfs: fix race between evice_inodes() and find_inode()&iput()
by Zizhi Wo 25 Nov '24

25 Nov '24

From: Julian Sun <sunjunchao2870(a)gmail.com> stable inclusion from stable-v4.19.322 commit 6cc13a80a26e6b48f78c725c01b91987d61563ef category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB6P4H Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 88b1afbf0f6b221f6c5bb66cc80cd3b38d696687 upstream. Hi, all Recently I noticed a bug[1] in btrfs, after digged it into and I believe it'a race in vfs. Let's assume there's a inode (ie ino 261) with i_count 1 is called by iput(), and there's a concurrent thread calling generic_shutdown_super(). cpu0: cpu1: iput() // i_count is 1 ->spin_lock(inode) ->dec i_count to 0 ->iput_final() generic_shutdown_super() ->__inode_add_lru() ->evict_inodes() // cause some reason[2] ->if (atomic_read(inode->i_count)) continue; // return before // inode 261 passed the above check // list_lru_add_obj() // and then schedule out ->spin_unlock() // note here: the inode 261 // was still at sb list and hash list, // and I_FREEING|I_WILL_FREE was not been set btrfs_iget() // after some function calls ->find_inode() // found the above inode 261 ->spin_lock(inode) // check I_FREEING|I_WILL_FREE // and passed ->__iget() ->spin_unlock(inode) // schedule back ->spin_lock(inode) // check (I_NEW|I_FREEING|I_WILL_FREE) flags, // passed and set I_FREEING iput() ->spin_unlock(inode) ->spin_lock(inode) ->evict() // dec i_count to 0 ->iput_final() ->spin_unlock() ->evict() Now, we have two threads simultaneously evicting the same inode, which may trigger the BUG(inode->i_state & I_CLEAR) statement both within clear_inode() and iput(). To fix the bug, recheck the inode->i_count after holding i_lock. Because in the most scenarios, the first check is valid, and the overhead of spin_lock() can be reduced. If there is any misunderstanding, please let me know, thanks. [1]: https://lore.kernel.org/linux-btrfs/000000000000eabe1d0619c48986@google.com/ [2]: The reason might be 1. SB_ACTIVE was removed or 2. mapping_shrinkable() return false when I reproduced the bug. Reported-by: syzbot+67ba3c42bcbb4665d3ad(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=67ba3c42bcbb4665d3ad CC: stable(a)vger.kernel.org Fixes: 63997e98a3be ("split invalidate_inodes()") Signed-off-by: Julian Sun <sunjunchao2870(a)gmail.com> Link: https://lore.kernel.org/r/20240823130730.658881-1-sunjunchao2870@gmail.com Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/inode.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/inode.c b/fs/inode.c index ae9d7b84caf3..399d79043a39 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -616,6 +616,10 @@ void evict_inodes(struct super_block *sb) continue; spin_lock(&inode->i_lock); + if (atomic_read(&inode->i_count)) { + spin_unlock(&inode->i_lock); + continue; + } if (inode->i_state & (I_NEW | I_FREEING | I_WILL_FREE)) { spin_unlock(&inode->i_lock); continue; -- 2.46.1

2 1

[PATCH OLK-6.6] drm/amd/display: Initialize denominators' default to 1
by dinglongwei 25 Nov '24

25 Nov '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v6.11.3 commit 7f8e93b862aba08d540f1e9e03e0ceb4d0cfd5fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRC8 CVE: CVE-2024-49899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b995c0a6de6c74656a0c39cd57a0626351b13e3c ] [WHAT & HOW] Variables used as denominators and maybe not assigned to other values, should not be 0. Change their default to 1 so they are never 0. This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Jerry Zuo <jerry.zuo(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared.c [Context conflicts: no dml2_core_shared.c file in current version, introduced in higher version] Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- .../gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c | 2 +- drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c index 548cdef8a8ad..543ce9a08cfd 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c @@ -78,7 +78,7 @@ static void calculate_ttu_cursor(struct display_mode_lib *mode_lib, static unsigned int get_bytes_per_element(enum source_format_class source_format, bool is_chroma) { - unsigned int ret_val = 0; + unsigned int ret_val = 1; if (source_format == dm_444_16) { if (!is_chroma) diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c b/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c index 3df559c591f8..70df992f859d 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c @@ -39,7 +39,7 @@ static unsigned int get_bytes_per_element(enum source_format_class source_format, bool is_chroma) { - unsigned int ret_val = 0; + unsigned int ret_val = 1; if (source_format == dm_444_16) { if (!is_chroma) -- 2.17.1

2 1

[PATCH OLK-6.6] drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw
by dinglongwei 25 Nov '24

25 Nov '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v6.10.14 commit f0454b3cb0584a6bf275aeb49be61a760fd546a2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9K CVE: CVE-2024-49915 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c395fd47d1565bd67671f45cca281b3acc2c31ef ] This commit addresses a potential null pointer dereference issue in the `dcn32_init_hw` function. The issue could occur when `dc->clk_mgr` is null. The fix adds a check to ensure `dc->clk_mgr` is not null before accessing its functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn32/dcn32_hwseq.c:961 dcn32_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 782) Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c [Context conflicts, the file of drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c has been moved to file drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c int v6.10.14] Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c index 2289c17f6ead..1a24fc8b5367 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c @@ -773,7 +773,7 @@ void dcn32_init_hw(struct dc *dc) int edp_num; uint32_t backlight = MAX_BACKLIGHT_LEVEL; - if (dc->clk_mgr && dc->clk_mgr->funcs->init_clocks) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->init_clocks) dc->clk_mgr->funcs->init_clocks(dc->clk_mgr); // Initialize the dccg @@ -950,10 +950,11 @@ void dcn32_init_hw(struct dc *dc) if (!dcb->funcs->is_accelerated_mode(dcb) && dc->res_pool->hubbub->funcs->init_watermarks) dc->res_pool->hubbub->funcs->init_watermarks(dc->res_pool->hubbub); - if (dc->clk_mgr->funcs->notify_wm_ranges) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->notify_wm_ranges) dc->clk_mgr->funcs->notify_wm_ranges(dc->clk_mgr); - if (dc->clk_mgr->funcs->set_hard_max_memclk && !dc->clk_mgr->dc_mode_softmax_enabled) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->set_hard_max_memclk && + !dc->clk_mgr->dc_mode_softmax_enabled) dc->clk_mgr->funcs->set_hard_max_memclk(dc->clk_mgr); if (dc->res_pool->hubbub->funcs->force_pstate_change_control) -- 2.17.1

2 1

[PATCH OLK-5.10] nilfs2: fix potential deadlock with newly created symlinks
by Xiang Yang 25 Nov '24

25 Nov '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.229 commit c72e0df0b56c1166736dc8eb62070ebb12591447 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB379T CVE: CVE-2024-50229 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b3a033e3ecd3471248d474ef263aadc0059e516a upstream. Syzbot reported that page_symlink(), called by nilfs_symlink(), triggers memory reclamation involving the filesystem layer, which can result in circular lock dependencies among the reader/writer semaphore nilfs->ns_segctor_sem, s_writers percpu_rwsem (intwrite) and the fs_reclaim pseudo lock. This is because after commit 21fc61c73c39 ("don't put symlink bodies in pagecache into highmem"), the gfp flags of the page cache for symbolic links are overwritten to GFP_KERNEL via inode_nohighmem(). This is not a problem for symlinks read from the backing device, because the __GFP_FS flag is dropped after inode_nohighmem() is called. However, when a new symlink is created with nilfs_symlink(), the gfp flags remain overwritten to GFP_KERNEL. Then, memory allocation called from page_symlink() etc. triggers memory reclamation including the FS layer, which may call nilfs_evict_inode() or nilfs_dirty_inode(). And these can cause a deadlock if they are called while nilfs->ns_segctor_sem is held: Fix this issue by dropping the __GFP_FS flag from the page cache GFP flags of newly created symlinks in the same way that nilfs_new_inode() and __nilfs_read_inode() do, as a workaround until we adopt nofs allocation scope consistently or improve the locking constraints. Link: https://lkml.kernel.org/r/20241020050003.4308-1-konishi.ryusuke@gmail.com Fixes: 21fc61c73c39 ("don't put symlink bodies in pagecache into highmem") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+9ef37ac20608f4836256(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9ef37ac20608f4836256 Tested-by: syzbot+9ef37ac20608f4836256(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- fs/nilfs2/namei.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c index a6ec7961d4f5..f88efb11845e 100644 --- a/fs/nilfs2/namei.c +++ b/fs/nilfs2/namei.c @@ -148,6 +148,9 @@ static int nilfs_symlink(struct inode *dir, struct dentry *dentry, /* slow symlink */ inode->i_op = &nilfs_symlink_inode_operations; inode_nohighmem(inode); + mapping_set_gfp_mask(inode->i_mapping, + mapping_gfp_constraint(inode->i_mapping, + ~__GFP_FS)); inode->i_mapping->a_ops = &nilfs_aops; err = page_symlink(inode, symname, l); if (err) -- 2.34.1

2 1

[PATCH OLK-5.10] bpf: Fix out-of-bounds write in trie_get_next_key()
by Xiaomeng Zhang 25 Nov '24

25 Nov '24

From: Byeonguk Jeong <jungbu2855(a)gmail.com> stable inclusion from stable-v5.10.229 commit 590976f921723d53ac199c01d5b7b73a94875e68 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB379Y CVE: CVE-2024-50262 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 13400ac8fb80c57c2bfb12ebd35ee121ce9b4d21 ] trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ... 0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with size 8. Fixes: b471f2f1de8b ("bpf: implement MAP_GET_NEXT_KEY command for LPM_TRIE map") Signed-off-by: Byeonguk Jeong <jungbu2855(a)gmail.com> Reviewed-by: Toke Høiland-Jørgensen <toke(a)kernel.org> Tested-by: Hou Tao <houtao1(a)huawei.com> Acked-by: Hou Tao <houtao1(a)huawei.com> Link: https://lore.kernel.org/r/Zxx384ZfdlFYnz6J@localhost.localdomain Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/bpf/lpm_trie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c index 3c2d8722d45b..8370b391f1d6 100644 --- a/kernel/bpf/lpm_trie.c +++ b/kernel/bpf/lpm_trie.c @@ -655,7 +655,7 @@ static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key) if (!key || key->prefixlen > trie->max_prefixlen) goto find_leftmost; - node_stack = kmalloc_array(trie->max_prefixlen, + node_stack = kmalloc_array(trie->max_prefixlen + 1, sizeof(struct lpm_trie_node *), GFP_ATOMIC | __GFP_NOWARN); if (!node_stack) -- 2.34.1

2 1

[PATCH OLK-5.10 0/4] CVE-2024-43817
by Zhang Changzhong 25 Nov '24

25 Nov '24

Felix Fietkau (1): udp: fix receiving fraglist GSO packets Willem de Bruijn (2): net: drop bad gso csum_start and offset in virtio_net_hdr net: tighten bad gso csum offset check in virtio_net_hdr Yan Zhai (1): gso: fix dodgy bit handling for GSO_UDP_L4 include/linux/virtio_net.h | 13 +++++++++++-- net/ipv4/tcp_offload.c | 3 +++ net/ipv4/udp_offload.c | 20 ++++++++++++++++---- 3 files changed, 30 insertions(+), 6 deletions(-) -- 2.9.5

2 5

[openeuler:OLK-5.10] BUILD REGRESSION c09bf9815abdd0805b9c0cd61353271d7ecf156f
by kernel test robot 24 Nov '24

24 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: c09bf9815abdd0805b9c0cd61353271d7ecf156f !13379 fbdev: sisfb: Fix strbuf array overflow Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202411231910.K4RvYzKi-lkp@intel.com drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:5776:1: warning: unused label 'out_dbg_init' [-Wunused-label] drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:6088:1: warning: unused label 'err_init_guid_fail' [-Wunused-label] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-001-20241123 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | `-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm |-- arm64-randconfig-004-20241123 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | `-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm |-- x86_64-allnoconfig | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20241123 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-buildonly-randconfig-003-20241123 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-buildonly-randconfig-004-20241123 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | |-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-buildonly-randconfig-006-20241123 | |-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:warning:unused-label-err_init_guid_fail | `-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:warning:unused-label-out_dbg_init |-- x86_64-kexec | `-- kernel-trace-trace_uprobe.o:warning:objtool:__uprobe_perf_func:unreachable-instruction |-- x86_64-randconfig-072-20241123 | |-- drivers-gpu-drm-amd-amdgpu-amdgpu_object.o:warning:objtool:amdgpu_bo_release_notify:unreachable-instruction | |-- drivers-gpu-drm-i915-gt-uc-intel_guc_ct.o:warning:objtool:intel_guc_ct_event_handler:unreachable-instruction | |-- fs-buffer.o:warning:objtool:__breadahead_gfp:unreachable-instruction | `-- kernel-trace-trace_uprobe.o:warning:objtool:__uprobe_perf_func:unreachable-instruction |-- x86_64-randconfig-076-20241123 | |-- kernel-sched-core.o:warning:objtool:sched_set_fifo:unreachable-instruction | `-- kernel-trace-trace_uprobe.o:warning:objtool:__uprobe_perf_func:unreachable-instruction |-- x86_64-randconfig-101-20241123 | `-- arch-x86-kvm-mmu-mmu.o:warning:objtool:mmu_set_spte:unreachable-instruction |-- x86_64-randconfig-103-20241123 | |-- security-integrity-ima-ima.h:warning:declaration-of-struct-ima_digest-will-not-be-visible-outside-of-this-function | `-- security-integrity-ima-ima_main.c:error:too-few-arguments-to-function-call-expected-have |-- x86_64-randconfig-121-20241123 | |-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-sched_domain-assigned-top-got-struct-sched_domain-noderef-__rcu-parent | `-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-sched_domain-top_p-got-struct-sched_domain-noderef-__rcu-parent |-- x86_64-randconfig-122-20241123 | `-- drivers-vfio-pci-vfio_pci_rdwr.c:sparse:sparse:incompatible-types-in-conditional-expression-(different-address-spaces): |-- x86_64-randconfig-123-20241123 | |-- drivers-nvme-target-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-callback_head-head-got-struct-callback_head-noderef-__rcu | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-addr-got-unsigned-char-usertype | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-noderef-usertype-__iomem-db_base-got-unsigned-char-usertype | |-- drivers-scsi-huawei-hifc-hifc_cqm_main.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-unsigned-char-usertype-cmd | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void-buf_in | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-struct-ffm_record_info-ffm_rd | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-struct-pf_dev_info-dev_info | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-unsigned-short-usertype-out_size | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-void-ack | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-void-buf_out | |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-gfp_t-usertype-gfp-got-unsigned-int-flag | |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-noderef-usertype-__iomem-cfg_regs_base-got-void-cfg_reg_base | |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-noderef-usertype-__iomem-db_base-got-void-db_base | |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-noderef-usertype-__iomem-intr_regs_base-got-void-intr_reg_base | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-assigned-cfg_reg_base-got-void-noderef-__iomem-cfg_reg_base | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-assigned-db_base-got-void-noderef-__iomem-db_base | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-assigned-intr_reg_base-got-void-noderef-__iomem-intr_reg_base | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression | |-- drivers-scsi-huawei-hifc-hifc_tool.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void | |-- drivers-scsi-huawei-hifc-hifc_tool.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void-in_buff | |-- drivers-scsi-huawei-hifc-hifc_tool.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-void-out_buf | |-- drivers-scsi-huawei-hifc-hifc_tool_hw.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void | `-- fs-ext4-extents.c:sparse:sparse:Using-plain-integer-as-NULL-pointer `-- x86_64-randconfig-r111-20241123 |-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-sched_domain-assigned-top-got-struct-sched_domain-noderef-__rcu-parent |-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-sched_domain-top_p-got-struct-sched_domain-noderef-__rcu-parent `-- net-bluetooth-mgmt.c:sparse:sparse:restricted-__le16-degrades-to-integer elapsed time: 721m configs tested: 36 configs skipped: 136 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20241123 clang-20 arm64 randconfig-002-20241123 gcc-14.2.0 arm64 randconfig-003-20241123 gcc-14.2.0 arm64 randconfig-004-20241123 clang-20 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241123 gcc-12 x86_64 buildonly-randconfig-002-20241123 gcc-12 x86_64 buildonly-randconfig-003-20241123 gcc-11 x86_64 buildonly-randconfig-004-20241123 gcc-12 x86_64 buildonly-randconfig-005-20241123 gcc-12 x86_64 buildonly-randconfig-006-20241123 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241123 clang-19 x86_64 randconfig-002-20241123 gcc-12 x86_64 randconfig-003-20241123 clang-19 x86_64 randconfig-004-20241123 clang-19 x86_64 randconfig-005-20241123 gcc-12 x86_64 randconfig-006-20241123 clang-19 x86_64 randconfig-011-20241123 gcc-12 x86_64 randconfig-012-20241123 clang-19 x86_64 randconfig-013-20241123 gcc-12 x86_64 randconfig-014-20241123 clang-19 x86_64 randconfig-015-20241123 clang-19 x86_64 randconfig-016-20241123 gcc-12 x86_64 randconfig-071-20241123 clang-19 x86_64 randconfig-072-20241123 clang-19 x86_64 randconfig-073-20241123 gcc-12 x86_64 randconfig-074-20241123 clang-19 x86_64 randconfig-075-20241123 gcc-11 x86_64 randconfig-076-20241123 clang-19 x86_64 rhel-9.4 gcc-12 x86_64 rhel-9.4-func gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2469/2469] drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:5776:1: warning: unused label 'out_dbg_init'
by kernel test robot 23 Nov '24

23 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c09bf9815abdd0805b9c0cd61353271d7ecf156f commit: b0c148879a02ad602d4526521d88b0a274aabe8d [2469/2469] UNIC: The driver loading process is terminated when the guid fails to be obtained. config: x86_64-buildonly-randconfig-006-20241123 (https://download.01.org/0day-ci/archive/20241123/202411231910.K4RvYzKi-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241123/202411231910.K4RvYzKi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411231910.K4RvYzKi-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:4: In file included from include/linux/dma-mapping.h:10: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:1579: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:5776:1: warning: unused label 'out_dbg_init' [-Wunused-label] 5776 | out_dbg_init: | ^~~~~~~~~~~~~ >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:6088:1: warning: unused label 'err_init_guid_fail' [-Wunused-label] 6088 | err_init_guid_fail: | ^~~~~~~~~~~~~~~~~~~ 3 warnings generated. vim +/out_dbg_init +5776 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c 5757 5758 hns3_state_init(handle); 5759 5760 if (test_bit(HNAE3_DEV_SUPPORT_QB_B, ae_dev->caps)) 5761 set_bit(HNAE3_PFLAG_FD_QB_ENABLE, &handle->supported_pflags); 5762 5763 ret = register_netdev(netdev); 5764 if (ret) { 5765 dev_err(priv->dev, "probe register netdev fail!\n"); 5766 goto out_reg_netdev_fail; 5767 } 5768 5769 if (netif_msg_drv(handle)) 5770 hns3_info_show(priv); 5771 5772 return ret; 5773 5774 out_reg_netdev_fail: 5775 hns3_state_uninit(handle); > 5776 out_dbg_init: 5777 hns3_dbg_uninit(handle); 5778 hns3_client_stop(handle); 5779 out_client_start: 5780 hns3_free_rx_cpu_rmap(netdev); 5781 hns3_nic_uninit_irq(priv); 5782 out_init_irq_fail: 5783 hns3_uninit_phy(netdev); 5784 out_init_phy: 5785 hns3_uninit_all_ring(priv); 5786 out_init_ring: 5787 hns3_nic_uninit_vector_data(priv); 5788 out_init_vector_data: 5789 hns3_nic_dealloc_vector_data(priv); 5790 out_alloc_vector_data: 5791 priv->ring = NULL; 5792 out_get_ring_cfg: 5793 priv->ae_handle = NULL; 5794 free_netdev(netdev); 5795 return ret; 5796 } 5797 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
by Baokun Li 23 Nov '24

23 Nov '24

From: Andrew Kanner <andrew.kanner(a)gmail.com> stable inclusion from stable-v5.10.230 commit 6a7e6dcf90fe7721d0863067b6ca9a9442134692 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AW2 CVE: CVE-2024-50265 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0b63c0e01fba40e3992bc627272ec7b618ccaef7 upstream. Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove(): [ 57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12 [ 57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper. Leaking 1 clusters and removing the entry [ 57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 [...] [ 57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [...] [ 57.331328] Call Trace: [ 57.331477] <TASK> [...] [ 57.333511] ? do_user_addr_fault+0x3e5/0x740 [ 57.333778] ? exc_page_fault+0x70/0x170 [ 57.334016] ? asm_exc_page_fault+0x2b/0x30 [ 57.334263] ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10 [ 57.334596] ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [ 57.334913] ocfs2_xa_remove_entry+0x23/0xc0 [ 57.335164] ocfs2_xa_set+0x704/0xcf0 [ 57.335381] ? _raw_spin_unlock+0x1a/0x40 [ 57.335620] ? ocfs2_inode_cache_unlock+0x16/0x20 [ 57.335915] ? trace_preempt_on+0x1e/0x70 [ 57.336153] ? start_this_handle+0x16c/0x500 [ 57.336410] ? preempt_count_sub+0x50/0x80 [ 57.336656] ? _raw_read_unlock+0x20/0x40 [ 57.336906] ? start_this_handle+0x16c/0x500 [ 57.337162] ocfs2_xattr_block_set+0xa6/0x1e0 [ 57.337424] __ocfs2_xattr_set_handle+0x1fd/0x5d0 [ 57.337706] ? ocfs2_start_trans+0x13d/0x290 [ 57.337971] ocfs2_xattr_set+0xb13/0xfb0 [ 57.338207] ? dput+0x46/0x1c0 [ 57.338393] ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338665] ? ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338948] __vfs_removexattr+0x92/0xc0 [ 57.339182] __vfs_removexattr_locked+0xd5/0x190 [ 57.339456] ? preempt_count_sub+0x50/0x80 [ 57.339705] vfs_removexattr+0x5f/0x100 [...] Reproducer uses faultinject facility to fail ocfs2_xa_remove() -> ocfs2_xa_value_truncate() with -ENOMEM. In this case the comment mentions that we can return 0 if ocfs2_xa_cleanup_value_truncate() is going to wipe the entry anyway. But the following 'rc' check is wrong and execution flow do 'ocfs2_xa_remove_entry(loc);' twice: * 1st: in ocfs2_xa_cleanup_value_truncate(); * 2nd: returning back to ocfs2_xa_remove() instead of going to 'out'. Fix this by skipping the 2nd removal of the same entry and making syzkaller repro happy. Link: https://lkml.kernel.org/r/20241103193845.2940988-1-andrew.kanner@gmail.com Fixes: 399ff3a748cf ("ocfs2: Handle errors while setting external xattr values.") Signed-off-by: Andrew Kanner <andrew.kanner(a)gmail.com> Reported-by: syzbot+386ce9e60fa1b18aac5b(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/671e13ab.050a0220.2b8c0f.01d0.GAE@google.com/T/ Tested-by: syzbot+386ce9e60fa1b18aac5b(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ocfs2/xattr.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index 00ede36aeec9..051d91e230c4 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -2042,8 +2042,7 @@ static int ocfs2_xa_remove(struct ocfs2_xa_loc *loc, rc = 0; ocfs2_xa_cleanup_value_truncate(loc, "removing", orig_clusters); - if (rc) - goto out; + goto out; } } -- 2.46.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
by Baokun Li 23 Nov '24

23 Nov '24

From: Andrew Kanner <andrew.kanner(a)gmail.com> stable inclusion from stable-v5.10.230 commit 6a7e6dcf90fe7721d0863067b6ca9a9442134692 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AW2 CVE: CVE-2024-50265 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0b63c0e01fba40e3992bc627272ec7b618ccaef7 upstream. Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove(): [ 57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12 [ 57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper. Leaking 1 clusters and removing the entry [ 57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 [...] [ 57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [...] [ 57.331328] Call Trace: [ 57.331477] <TASK> [...] [ 57.333511] ? do_user_addr_fault+0x3e5/0x740 [ 57.333778] ? exc_page_fault+0x70/0x170 [ 57.334016] ? asm_exc_page_fault+0x2b/0x30 [ 57.334263] ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10 [ 57.334596] ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [ 57.334913] ocfs2_xa_remove_entry+0x23/0xc0 [ 57.335164] ocfs2_xa_set+0x704/0xcf0 [ 57.335381] ? _raw_spin_unlock+0x1a/0x40 [ 57.335620] ? ocfs2_inode_cache_unlock+0x16/0x20 [ 57.335915] ? trace_preempt_on+0x1e/0x70 [ 57.336153] ? start_this_handle+0x16c/0x500 [ 57.336410] ? preempt_count_sub+0x50/0x80 [ 57.336656] ? _raw_read_unlock+0x20/0x40 [ 57.336906] ? start_this_handle+0x16c/0x500 [ 57.337162] ocfs2_xattr_block_set+0xa6/0x1e0 [ 57.337424] __ocfs2_xattr_set_handle+0x1fd/0x5d0 [ 57.337706] ? ocfs2_start_trans+0x13d/0x290 [ 57.337971] ocfs2_xattr_set+0xb13/0xfb0 [ 57.338207] ? dput+0x46/0x1c0 [ 57.338393] ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338665] ? ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338948] __vfs_removexattr+0x92/0xc0 [ 57.339182] __vfs_removexattr_locked+0xd5/0x190 [ 57.339456] ? preempt_count_sub+0x50/0x80 [ 57.339705] vfs_removexattr+0x5f/0x100 [...] Reproducer uses faultinject facility to fail ocfs2_xa_remove() -> ocfs2_xa_value_truncate() with -ENOMEM. In this case the comment mentions that we can return 0 if ocfs2_xa_cleanup_value_truncate() is going to wipe the entry anyway. But the following 'rc' check is wrong and execution flow do 'ocfs2_xa_remove_entry(loc);' twice: * 1st: in ocfs2_xa_cleanup_value_truncate(); * 2nd: returning back to ocfs2_xa_remove() instead of going to 'out'. Fix this by skipping the 2nd removal of the same entry and making syzkaller repro happy. Link: https://lkml.kernel.org/r/20241103193845.2940988-1-andrew.kanner@gmail.com Fixes: 399ff3a748cf ("ocfs2: Handle errors while setting external xattr values.") Signed-off-by: Andrew Kanner <andrew.kanner(a)gmail.com> Reported-by: syzbot+386ce9e60fa1b18aac5b(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/671e13ab.050a0220.2b8c0f.01d0.GAE@google.com/T/ Tested-by: syzbot+386ce9e60fa1b18aac5b(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ocfs2/xattr.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index 42368577786e..5b56e10e510b 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -2042,8 +2042,7 @@ static int ocfs2_xa_remove(struct ocfs2_xa_loc *loc, rc = 0; ocfs2_xa_cleanup_value_truncate(loc, "removing", orig_clusters); - if (rc) - goto out; + goto out; } } -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
by Baokun Li 23 Nov '24

23 Nov '24

From: Andrew Kanner <andrew.kanner(a)gmail.com> stable inclusion from stable-v4.19.324 commit 38cbf13b2e7a31362babe411f7c2c3c52cd2734b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AW2 CVE: CVE-2024-50265 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0b63c0e01fba40e3992bc627272ec7b618ccaef7 upstream. Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove(): [ 57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12 [ 57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper. Leaking 1 clusters and removing the entry [ 57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 [...] [ 57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [...] [ 57.331328] Call Trace: [ 57.331477] <TASK> [...] [ 57.333511] ? do_user_addr_fault+0x3e5/0x740 [ 57.333778] ? exc_page_fault+0x70/0x170 [ 57.334016] ? asm_exc_page_fault+0x2b/0x30 [ 57.334263] ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10 [ 57.334596] ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [ 57.334913] ocfs2_xa_remove_entry+0x23/0xc0 [ 57.335164] ocfs2_xa_set+0x704/0xcf0 [ 57.335381] ? _raw_spin_unlock+0x1a/0x40 [ 57.335620] ? ocfs2_inode_cache_unlock+0x16/0x20 [ 57.335915] ? trace_preempt_on+0x1e/0x70 [ 57.336153] ? start_this_handle+0x16c/0x500 [ 57.336410] ? preempt_count_sub+0x50/0x80 [ 57.336656] ? _raw_read_unlock+0x20/0x40 [ 57.336906] ? start_this_handle+0x16c/0x500 [ 57.337162] ocfs2_xattr_block_set+0xa6/0x1e0 [ 57.337424] __ocfs2_xattr_set_handle+0x1fd/0x5d0 [ 57.337706] ? ocfs2_start_trans+0x13d/0x290 [ 57.337971] ocfs2_xattr_set+0xb13/0xfb0 [ 57.338207] ? dput+0x46/0x1c0 [ 57.338393] ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338665] ? ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338948] __vfs_removexattr+0x92/0xc0 [ 57.339182] __vfs_removexattr_locked+0xd5/0x190 [ 57.339456] ? preempt_count_sub+0x50/0x80 [ 57.339705] vfs_removexattr+0x5f/0x100 [...] Reproducer uses faultinject facility to fail ocfs2_xa_remove() -> ocfs2_xa_value_truncate() with -ENOMEM. In this case the comment mentions that we can return 0 if ocfs2_xa_cleanup_value_truncate() is going to wipe the entry anyway. But the following 'rc' check is wrong and execution flow do 'ocfs2_xa_remove_entry(loc);' twice: * 1st: in ocfs2_xa_cleanup_value_truncate(); * 2nd: returning back to ocfs2_xa_remove() instead of going to 'out'. Fix this by skipping the 2nd removal of the same entry and making syzkaller repro happy. Link: https://lkml.kernel.org/r/20241103193845.2940988-1-andrew.kanner@gmail.com Fixes: 399ff3a748cf ("ocfs2: Handle errors while setting external xattr values.") Signed-off-by: Andrew Kanner <andrew.kanner(a)gmail.com> Reported-by: syzbot+386ce9e60fa1b18aac5b(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/671e13ab.050a0220.2b8c0f.01d0.GAE@google.com/T/ Tested-by: syzbot+386ce9e60fa1b18aac5b(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ocfs2/xattr.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index c146e12a8601..410acc20c7c4 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -2041,8 +2041,7 @@ static int ocfs2_xa_remove(struct ocfs2_xa_loc *loc, rc = 0; ocfs2_xa_cleanup_value_truncate(loc, "removing", orig_clusters); - if (rc) - goto out; + goto out; } } -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
by Baokun Li 23 Nov '24

23 Nov '24

From: Jens Axboe <axboe(a)kernel.dk> stable inclusion from stable-v5.10.230 commit 485d9232112b17f389b29497ff41b97b3189546b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQC CVE: CVE-2024-53052 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Commit 1d60d74e852647255bd8e76f5a22dc42531e4389 upstream. When io_uring starts a write, it'll call kiocb_start_write() to bump the super block rwsem, preventing any freezes from happening while that write is in-flight. The freeze side will grab that rwsem for writing, excluding any new writers from happening and waiting for existing writes to finish. But io_uring unconditionally uses kiocb_start_write(), which will block if someone is currently attempting to freeze the mount point. This causes a deadlock where freeze is waiting for previous writes to complete, but the previous writes cannot complete, as the task that is supposed to complete them is blocked waiting on starting a new write. This results in the following stuck trace showing that dependency with the write blocked starting a new write: task:fio state:D stack:0 pid:886 tgid:886 ppid:876 Call trace: __switch_to+0x1d8/0x348 __schedule+0x8e8/0x2248 schedule+0x110/0x3f0 percpu_rwsem_wait+0x1e8/0x3f8 __percpu_down_read+0xe8/0x500 io_write+0xbb8/0xff8 io_issue_sqe+0x10c/0x1020 io_submit_sqes+0x614/0x2110 __arm64_sys_io_uring_enter+0x524/0x1038 invoke_syscall+0x74/0x268 el0_svc_common.constprop.0+0x160/0x238 do_el0_svc+0x44/0x60 el0_svc+0x44/0xb0 el0t_64_sync_handler+0x118/0x128 el0t_64_sync+0x168/0x170 INFO: task fsfreeze:7364 blocked for more than 15 seconds. Not tainted 6.12.0-rc5-00063-g76aaf945701c #7963 with the attempting freezer stuck trying to grab the rwsem: task:fsfreeze state:D stack:0 pid:7364 tgid:7364 ppid:995 Call trace: __switch_to+0x1d8/0x348 __schedule+0x8e8/0x2248 schedule+0x110/0x3f0 percpu_down_write+0x2b0/0x680 freeze_super+0x248/0x8a8 do_vfs_ioctl+0x149c/0x1b18 __arm64_sys_ioctl+0xd0/0x1a0 invoke_syscall+0x74/0x268 el0_svc_common.constprop.0+0x160/0x238 do_el0_svc+0x44/0x60 el0_svc+0x44/0xb0 el0t_64_sync_handler+0x118/0x128 el0t_64_sync+0x168/0x170 Fix this by having the io_uring side honor IOCB_NOWAIT, and only attempt a blocking grab of the super block rwsem if it isn't set. For normal issue where IOCB_NOWAIT would always be set, this returns -EAGAIN which will have io_uring core issue a blocking attempt of the write. That will in turn also get completions run, ensuring forward progress. Since freezing requires CAP_SYS_ADMIN in the first place, this isn't something that can be triggered by a regular user. Cc: stable(a)vger.kernel.org # 5.10+ Reported-by: Peter Mann <peter.mann(a)sh.cz> Link: https://lore.kernel.org/io-uring/38c94aec-81c9-4f62-b44e-1d87f5597644@sh.cz Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/io_uring.c [Context differences.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/io_uring.c | 36 +++++++++++++++++++++++------------- 1 file changed, 23 insertions(+), 13 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 411b7491f3f5..96255b816d71 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3174,6 +3174,27 @@ static int io_write_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe, return io_rw_prep_async(req, WRITE, force_nonblock); } +static bool io_kiocb_start_write(struct io_kiocb *req, struct kiocb *kiocb) +{ + struct inode *inode; + bool ret; + + if (!(req->flags & REQ_F_ISREG)) + return true; + + inode = file_inode(kiocb->ki_filp); + if (!(kiocb->ki_flags & IOCB_NOWAIT)) { + __sb_start_write(inode->i_sb, SB_FREEZE_WRITE, true); + __sb_writers_release(inode->i_sb, SB_FREEZE_WRITE); + return true; + } + + ret = sb_start_write_trylock(inode->i_sb); + if (ret) + __sb_writers_release(inode->i_sb, SB_FREEZE_WRITE); + return ret; +} + static int io_write(struct io_kiocb *req, bool force_nonblock, struct io_comp_state *cs) { @@ -3209,19 +3230,8 @@ static int io_write(struct io_kiocb *req, bool force_nonblock, unsigned long nr_segs = iter.nr_segs; ssize_t ret2; - /* - * Open-code file_start_write here to grab freeze protection, - * which will be released by another thread in - * io_complete_rw(). Fool lockdep by telling it the lock got - * released so that it doesn't complain about the held lock when - * we return to userspace. - */ - if (req->flags & REQ_F_ISREG) { - __sb_start_write(file_inode(req->file)->i_sb, - SB_FREEZE_WRITE, true); - __sb_writers_release(file_inode(req->file)->i_sb, - SB_FREEZE_WRITE); - } + if (unlikely(!io_kiocb_start_write(req, kiocb))) + goto copy_iov; kiocb->ki_flags |= IOCB_WRITE; if (req->file->f_op->write_iter) -- 2.46.1

2 1

[PATCH OLK-5.10 0/4] io_uring: fix CVE-2024-53052
by Baokun Li 23 Nov '24

23 Nov '24

Amir Goldstein (3): io_uring: rename kiocb_end_write() local helper fs: create kiocb_{start,end}_write() helpers io_uring: use kiocb_{start,end}_write() helpers Jens Axboe (1): io_uring/rw: fix missing NOWAIT check for O_DIRECT start write include/linux/fs.h | 35 +++++++++++++++++++++++++++++++ io_uring/io_uring.c | 50 ++++++++++++++++++++++++--------------------- 2 files changed, 62 insertions(+), 23 deletions(-) -- 2.46.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/4] io_uring: fix CVE-2024-53052
by Baokun Li 23 Nov '24

23 Nov '24

Amir Goldstein (3): io_uring: rename kiocb_end_write() local helper fs: create kiocb_{start,end}_write() helpers io_uring: use kiocb_{start,end}_write() helpers Jens Axboe (1): io_uring/rw: fix missing NOWAIT check for O_DIRECT start write include/linux/fs.h | 35 +++++++++++++++++++++++++++++++ io_uring/io_uring.c | 50 ++++++++++++++++++++++++--------------------- 2 files changed, 62 insertions(+), 23 deletions(-) -- 2.46.1

2 5

[openeuler:openEuler-1.0-LTS 1297/1297] drivers/platform/x86/intel_speed_select_if/isst_if_mmio.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 23 Nov '24

23 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 81e029d5dd0cae934243168eee37ef303ebcce38 commit: 8453d1c1d4ecff553e6c5d7ef7671ab91a241f4a [1297/1297] Intel: platform/x86: ISST: Add Intel Speed Select mmio interface config: x86_64-buildonly-randconfig-004-20241117 (https://download.01.org/0day-ci/archive/20241123/202411230724.SOpvtlro-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241123/202411230724.SOpvtlro-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411230724.SOpvtlro-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/platform/x86/intel_speed_select_if/isst_if_mmio.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 8b9369980b29775e74086a1231967ca5dee388d5
by kernel test robot 23 Nov '24

23 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 8b9369980b29775e74086a1231967ca5dee388d5 !13306 btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids() Unverified Error/Warning (likely false positive, kindly check if interested): fs/btrfs/extent_io.o: warning: objtool: read_extent_buffer() falls through to next function fiemap_find_last_extent_offset.isra.0() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-001-20241122 | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-002-20241122 | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-003-20241122 | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-004-20241122 | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_ATTR_VALUE_UNDEFINED-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_BCN-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_DCBX-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_GSP-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_PFC-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_PFC_TCS-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_PG-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_PG_TCS-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_UP2TC-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_DCBX_LLD_MANAGED-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_DCBX_VER_IEEE-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_NUMTCS_ATTR_PFC-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_NUMTCS_ATTR_PG-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getcap | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getdcbx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpermhwaddr | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpfcstate | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpgbwgcfgrx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpgbwgcfgtx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpgtccfgrx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpgtccfgtx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getstate | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-ieee_getpfc | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-ieee_setets | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-ieee_setpfc | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setall | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setdcbx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setnumtcs | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpfcstate | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpgbwgcfgrx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpgbwgcfgtx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpgtccfgrx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpgtccfgtx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setstate | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-application-of-sizeof-to-incomplete-type-struct-ieee_ets | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-use-of-undefined-type-struct-ieee_ets | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:storage-size-of-back_ets-isn-t-known | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:storage-size-of-hinic_dcbnl_ops-isn-t-known | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:storage-size-of-pfc-isn-t-known | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:variable-hinic_dcbnl_ops-has-initializer-but-incomplete-type | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:variable-pfc-has-initializer-but-incomplete-type | |-- drivers-net-ethernet-huawei-hinic-hinic_nic_dev.h:error:field-hinic_ieee_ets-has-incomplete-type | |-- drivers-net-ethernet-huawei-hinic-hinic_nic_dev.h:error:field-hinic_ieee_ets_default-has-incomplete-type | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-net_resource_mgt-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-netdev-set-but-not-used | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- security-integrity-ima-ima_main.c:warning:Function-parameter-or-member-bprm-not-described-in-ima_bprm_creds_for_exec | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_pcrread | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_calc_boot_aggregate | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_extend | `-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_init |-- arm64-randconfig-051-20241122 | |-- Documentation-devicetree-bindings-arm-arm-mpam-msc.yaml:error-string-value-is-redundantly-quoted-with-any-quotes-(quoted-strings) | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:Example-is-not-one-of-id-schema-title-description-examples-required-allOf-anyOf-oneOf-definitions-defs-additionalProperties-dependencies-dependent | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:id:Cannot-determine-base-path-from-id-relative-path-filename-doesn-t-match-actual-path-or-filename | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:ignoring-error-in-schema:properties:clocks:items | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:items:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:reg:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:warning-wrong-indentation:expected-but-found-(indentation) | |-- arch-arm64-boot-dts-rockchip-rk3318-a95x-z2.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-a1.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb::compatible:oneOf-conditional-failed-one-must-be-fixed: | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb::failed-to-match-any-schema-with-compatible:friendlyarm-nanopi-r2s-plus-rockchip-rk3328 | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb:ethernet-ff540000:Unevaluated-properties-are-not-allowed-(-snps-txpbl-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb:pwm-ff1b0030:interrupts-does-not-match-any-of-the-regexes:pinctrl | |-- arch-arm64-boot-dts-rockchip-rk3328-roc-cc.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-roc-pc.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | `-- arch-arm64-boot-dts-rockchip-rk3328-rock64.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) |-- arm64-randconfig-052-20241122 | |-- Documentation-devicetree-bindings-arm-arm-mpam-msc.yaml:error-string-value-is-redundantly-quoted-with-any-quotes-(quoted-strings) | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:Example-is-not-one-of-id-schema-title-description-examples-required-allOf-anyOf-oneOf-definitions-defs-additionalProperties-dependencies-dependent | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:id:Cannot-determine-base-path-from-id-relative-path-filename-doesn-t-match-actual-path-or-filename | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:ignoring-error-in-schema:properties:clocks:items | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:items:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:reg:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:warning-wrong-indentation:expected-but-found-(indentation) | |-- arch-arm64-boot-dts-rockchip-rk3318-a95x-z2.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-a1.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb::compatible:oneOf-conditional-failed-one-must-be-fixed: | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb::failed-to-match-any-schema-with-compatible:friendlyarm-nanopi-r2s-plus-rockchip-rk3328 | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb:ethernet-ff540000:Unevaluated-properties-are-not-allowed-(-snps-txpbl-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb:pwm-ff1b0030:interrupts-does-not-match-any-of-the-regexes:pinctrl | |-- arch-arm64-boot-dts-rockchip-rk3328-roc-cc.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-roc-pc.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | `-- arch-arm64-boot-dts-rockchip-rk3328-rock64.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) |-- arm64-randconfig-053-20241122 | |-- Documentation-devicetree-bindings-arm-arm-mpam-msc.yaml:error-string-value-is-redundantly-quoted-with-any-quotes-(quoted-strings) | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:Example-is-not-one-of-id-schema-title-description-examples-required-allOf-anyOf-oneOf-definitions-defs-additionalProperties-dependencies-dependent | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:id:Cannot-determine-base-path-from-id-relative-path-filename-doesn-t-match-actual-path-or-filename | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:ignoring-error-in-schema:properties:clocks:items | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:items:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:reg:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:warning-wrong-indentation:expected-but-found-(indentation) | |-- arch-arm64-boot-dts-rockchip-rk3318-a95x-z2.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-a1.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb::compatible:oneOf-conditional-failed-one-must-be-fixed: | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb::failed-to-match-any-schema-with-compatible:friendlyarm-nanopi-r2s-plus-rockchip-rk3328 | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb:ethernet-ff540000:Unevaluated-properties-are-not-allowed-(-snps-txpbl-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb:pwm-ff1b0030:interrupts-does-not-match-any-of-the-regexes:pinctrl | |-- arch-arm64-boot-dts-rockchip-rk3328-roc-cc.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-roc-pc.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | `-- arch-arm64-boot-dts-rockchip-rk3328-rock64.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) |-- arm64-randconfig-054-20241122 | |-- Documentation-devicetree-bindings-arm-arm-mpam-msc.yaml:error-string-value-is-redundantly-quoted-with-any-quotes-(quoted-strings) | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:Example-is-not-one-of-id-schema-title-description-examples-required-allOf-anyOf-oneOf-definitions-defs-additionalProperties-dependencies-dependent | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:id:Cannot-determine-base-path-from-id-relative-path-filename-doesn-t-match-actual-path-or-filename | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:ignoring-error-in-schema:properties:clocks:items | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:items:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:reg:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:warning-wrong-indentation:expected-but-found-(indentation) | |-- arch-arm64-boot-dts-rockchip-rk3318-a95x-z2.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-a1.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb::compatible:oneOf-conditional-failed-one-must-be-fixed: | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb::failed-to-match-any-schema-with-compatible:friendlyarm-nanopi-r2s-plus-rockchip-rk3328 | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb:ethernet-ff540000:Unevaluated-properties-are-not-allowed-(-snps-txpbl-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb:pwm-ff1b0030:interrupts-does-not-match-any-of-the-regexes:pinctrl | |-- arch-arm64-boot-dts-rockchip-rk3328-roc-cc.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-roc-pc.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | `-- arch-arm64-boot-dts-rockchip-rk3328-rock64.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) |-- arm64-randconfig-055-20241122 | |-- Documentation-devicetree-bindings-arm-arm-mpam-msc.yaml:error-string-value-is-redundantly-quoted-with-any-quotes-(quoted-strings) | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:Example-is-not-one-of-id-schema-title-description-examples-required-allOf-anyOf-oneOf-definitions-defs-additionalProperties-dependencies-dependent | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:id:Cannot-determine-base-path-from-id-relative-path-filename-doesn-t-match-actual-path-or-filename | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:ignoring-error-in-schema:properties:clocks:items | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:items:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:reg:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:warning-wrong-indentation:expected-but-found-(indentation) | |-- arch-arm64-boot-dts-rockchip-rk3318-a95x-z2.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-a1.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb::compatible:oneOf-conditional-failed-one-must-be-fixed: | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb::failed-to-match-any-schema-with-compatible:friendlyarm-nanopi-r2s-plus-rockchip-rk3328 | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb:ethernet-ff540000:Unevaluated-properties-are-not-allowed-(-snps-txpbl-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-nanopi-r2s-plus.dtb:pwm-ff1b0030:interrupts-does-not-match-any-of-the-regexes:pinctrl | |-- arch-arm64-boot-dts-rockchip-rk3328-roc-cc.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | |-- arch-arm64-boot-dts-rockchip-rk3328-roc-pc.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) | `-- arch-arm64-boot-dts-rockchip-rk3328-rock64.dtb:hdmi-ff3c0000:Unevaluated-properties-are-not-allowed-(-sound-dai-cells-was-unexpected) |-- loongarch-allmodconfig | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- security-integrity-ima-ima_main.c:warning:Function-parameter-or-member-bprm-not-described-in-ima_bprm_creds_for_exec | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_pcrread | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_calc_boot_aggregate | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_extend | `-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_init |-- loongarch-allnoconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allyesconfig | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- multiple-definition-of-debug-drivers-net-ethernet-huawei-bma-edma_drv-bma_pci.o:bma_pci.c:(.bss):first-defined-here | |-- security-integrity-ima-ima_main.c:warning:Function-parameter-or-member-bprm-not-described-in-ima_bprm_creds_for_exec | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_pcrread | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_calc_boot_aggregate | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_extend | `-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_init |-- loongarch-randconfig-001-20241122 | |-- fs-btrfs-extent_io.o:warning:objtool:read_extent_buffer-falls-through-to-next-function-fiemap_find_last_extent_offset() | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-002-20241122 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-051-20241122 | |-- Documentation-devicetree-bindings-arm-arm-mpam-msc.yaml:error-string-value-is-redundantly-quoted-with-any-quotes-(quoted-strings) | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:Example-is-not-one-of-id-schema-title-description-examples-required-allOf-anyOf-oneOf-definitions-defs-additionalProperties-dependencies-dependent | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:id:Cannot-determine-base-path-from-id-relative-path-filename-doesn-t-match-actual-path-or-filename | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:ignoring-error-in-schema:properties:clocks:items | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:items:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:reg:oneOf-conditional-failed-one-must-be-fixed: | `-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:warning-wrong-indentation:expected-but-found-(indentation) |-- loongarch-randconfig-052-20241122 | |-- Documentation-devicetree-bindings-arm-arm-mpam-msc.yaml:error-string-value-is-redundantly-quoted-with-any-quotes-(quoted-strings) | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:Example-is-not-one-of-id-schema-title-description-examples-required-allOf-anyOf-oneOf-definitions-defs-additionalProperties-dependencies-dependent | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:id:Cannot-determine-base-path-from-id-relative-path-filename-doesn-t-match-actual-path-or-filename | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:ignoring-error-in-schema:properties:clocks:items | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:items:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:reg:oneOf-conditional-failed-one-must-be-fixed: | `-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:warning-wrong-indentation:expected-but-found-(indentation) |-- x86_64-allnoconfig | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allyesconfig | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | |-- drivers-crypto-montage-tsse-tsse_ipc_api.c:warning:variable-device_handle-is-uninitialized-when-used-here | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-calcs-dcn_calc_auto.c:warning:stack-frame-size-()-exceeds-limit-()-in-mode_support_and_system_configuration | |-- drivers-infiniband-hw-xsc-main.c:warning:no-previous-prototype-for-function-xsc_ib_reboot_event_handler | |-- drivers-infiniband-hw-xsc-mr.c:warning:no-previous-prototype-for-function-xsc_get_mr_page_mode | |-- drivers-infiniband-hw-xsc-private_dev.c:warning:variable-char_dev-set-but-not-used | |-- drivers-infiniband-hw-xsc-qp.c:warning:variable-xsc_state-is-uninitialized-when-used-here | |-- drivers-net-ethernet-huawei-hinic3-adapter-sw_cmdq-sw_cmdq_ops.c:warning:expression-does-not-compute-the-number-of-elements-in-this-array-element-type-is-u16-(aka-unsigned-short-)-not-u32-(aka-unsigne | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-huawei-hinic3-hinic3_nic_io.c:warning:no-previous-prototype-for-function-hinic3_get_rq_wqe_type | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_channel-nbl_channel.c:warning:no-previous-prototype-for-function-nbl_chan_clean_queue_subtask | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_common-nbl_common.c:warning:variable-node_num-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-net_resource_mgt-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-netdev-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_flush_rx_queues | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_get_vf_base_vsi_id | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_pldmfw_op_pci_match_record | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_setup_queues | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_setup_rings | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_stop_rings | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:adding-int-to-a-string-does-not-append-to-the-string | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_insert_pp_ht | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_mgt_start_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_mgt_stop_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_remove_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_set_mt_input | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_setup_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_queue_mgt_init_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_queue_remove_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_queue_setup_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_res_queue_init_qid_map_table | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_res_queue_remove_qid_map_table_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_res_queue_setup_qid_map_table_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_txrx.c:warning:no-previous-prototype-for-function-nbl_alloc_tx_rings | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-set_feature_vlan_offload | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_net_reboot_event_handler | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_set_vf_link_state | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-anlt_fec_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-fpga_type_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-hps_ddr_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-ma_xbar_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-onchip_ft_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-pct_exp_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-pp_tbl_dma_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-rdma_icrc_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_hw_comm.c:warning:no-previous-prototype-for-function-xsc_hw_kernel_call | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_hw_comm.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-pci-main.c:warning:no-previous-prototype-for-function-xsc_pci_reboot_event_handler | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_dereg_mr_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_reg_mr_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_set_mpt_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_set_mtt_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-vport.c:warning:variable-i-is-uninitialized-when-used-here | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_add_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_create | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_destroy | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_remove_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_update_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_update_member_status | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_add_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_board_lag_reset | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_board_lag_set | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_add_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_remove_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_update_lag_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_update_lag_member_status | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_create_lag | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_destroy_lag | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_remove_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_update_lag_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_update_lag_member_status | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- security-integrity-ima-ima_main.c:warning:Function-parameter-or-member-bprm-not-described-in-ima_bprm_creds_for_exec | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-function-ima_pcrread | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-function-ima_tpm_calc_boot_aggregate | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-function-ima_tpm_extend | `-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-function-ima_tpm_init |-- x86_64-buildonly-randconfig-001-20241122 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- security-integrity-ima-ima_main.c:warning:Function-parameter-or-member-bprm-not-described-in-ima_bprm_creds_for_exec | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_pcrread | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_calc_boot_aggregate | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_extend | `-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_init |-- x86_64-buildonly-randconfig-002-20241122 | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-003-20241122 | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- security-integrity-ima-ima_main.c:warning:Function-parameter-or-member-bprm-not-described-in-ima_bprm_creds_for_exec | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_pcrread | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_calc_boot_aggregate | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_extend | `-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_init |-- x86_64-buildonly-randconfig-004-20241122 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- security-integrity-ima-ima_main.c:warning:Function-parameter-or-member-bprm-not-described-in-ima_bprm_creds_for_exec | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_pcrread | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_calc_boot_aggregate | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_extend | `-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_init |-- x86_64-buildonly-randconfig-005-20241122 | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-006-20241122 | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-defconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-kexec | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-001-20241122 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-kh40000_get_direct_dma_ops | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-net_resource_mgt-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-netdev-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-002-20241122 | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-function-kh40000_get_direct_dma_ops | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-003-20241122 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-kh40000_get_direct_dma_ops | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-004-20241122 | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-function-kh40000_get_direct_dma_ops | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- security-integrity-ima-ima_main.c:warning:Function-parameter-or-member-bprm-not-described-in-ima_bprm_creds_for_exec | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-function-ima_pcrread | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-function-ima_tpm_calc_boot_aggregate | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-function-ima_tpm_extend | `-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-function-ima_tpm_init |-- x86_64-randconfig-005-20241122 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-kh40000_get_direct_dma_ops | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-net_resource_mgt-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-netdev-set-but-not-used | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-006-20241122 | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-function-kh40000_get_direct_dma_ops | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-011-20241122 | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-function-kh40000_get_direct_dma_ops | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_channel-nbl_channel.c:warning:no-previous-prototype-for-function-nbl_chan_clean_queue_subtask | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_common-nbl_common.c:warning:variable-node_num-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-net_resource_mgt-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-netdev-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_flush_rx_queues | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_get_vf_base_vsi_id | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_pldmfw_op_pci_match_record | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_setup_queues | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_setup_rings | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_stop_rings | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:adding-int-to-a-string-does-not-append-to-the-string | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_insert_pp_ht | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_mgt_start_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_mgt_stop_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_remove_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_set_mt_input | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_setup_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_queue_mgt_init_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_queue_remove_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_queue_setup_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_res_queue_init_qid_map_table | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_res_queue_remove_qid_map_table_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_res_queue_setup_qid_map_table_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_txrx.c:warning:no-previous-prototype-for-function-nbl_alloc_tx_rings | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-012-20241122 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-kh40000_get_direct_dma_ops | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-net_resource_mgt-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-netdev-set-but-not-used | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-013-20241122 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-kh40000_get_direct_dma_ops | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-net_resource_mgt-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-netdev-set-but-not-used | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-014-20241122 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-kh40000_get_direct_dma_ops | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-net_resource_mgt-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-netdev-set-but-not-used | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-015-20241122 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-kh40000_get_direct_dma_ops | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-net_resource_mgt-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-netdev-set-but-not-used | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- security-integrity-ima-ima_main.c:warning:Function-parameter-or-member-bprm-not-described-in-ima_bprm_creds_for_exec | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_pcrread | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_calc_boot_aggregate | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_extend | `-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_init |-- x86_64-randconfig-016-20241122 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-kh40000_get_direct_dma_ops | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-071-20241122 | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-function-kh40000_get_direct_dma_ops | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-072-20241122 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-kh40000_get_direct_dma_ops | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-net_resource_mgt-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-netdev-set-but-not-used | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-rhel-9.4 | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-net_resource_mgt-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-netdev-set-but-not-used | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- security-integrity-ima-ima_main.c:warning:Function-parameter-or-member-bprm-not-described-in-ima_bprm_creds_for_exec | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_pcrread | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_calc_boot_aggregate | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_extend | `-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_init |-- x86_64-rhel-9.4-func | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-net_resource_mgt-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-netdev-set-but-not-used | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- security-integrity-ima-ima_main.c:warning:Function-parameter-or-member-bprm-not-described-in-ima_bprm_creds_for_exec | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_pcrread | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_calc_boot_aggregate | |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_extend | `-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_init `-- x86_64-rhel-9.4-kselftests |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-net_resource_mgt-set-but-not-used |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:variable-netdev-set-but-not-used |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- security-integrity-ima-ima_main.c:warning:Function-parameter-or-member-bprm-not-described-in-ima_bprm_creds_for_exec |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_pcrread |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_calc_boot_aggregate |-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_extend `-- security-integrity-ima-ima_tpm.c:warning:no-previous-prototype-for-ima_tpm_init elapsed time: 722m configs tested: 35 configs skipped: 123 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20241122 gcc-14.2.0 arm64 randconfig-002-20241122 gcc-14.2.0 arm64 randconfig-003-20241122 gcc-14.2.0 arm64 randconfig-004-20241122 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20241122 gcc-14.2.0 loongarch randconfig-002-20241122 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241122 gcc-12 x86_64 buildonly-randconfig-002-20241122 clang-19 x86_64 buildonly-randconfig-003-20241122 gcc-12 x86_64 buildonly-randconfig-004-20241122 gcc-12 x86_64 buildonly-randconfig-005-20241122 clang-19 x86_64 buildonly-randconfig-006-20241122 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241122 gcc-12 x86_64 randconfig-002-20241122 clang-19 x86_64 randconfig-003-20241122 gcc-12 x86_64 randconfig-004-20241122 clang-19 x86_64 randconfig-005-20241122 gcc-12 x86_64 randconfig-006-20241122 clang-19 x86_64 randconfig-011-20241122 clang-19 x86_64 randconfig-012-20241122 gcc-12 x86_64 randconfig-013-20241122 gcc-12 x86_64 randconfig-014-20241122 gcc-12 x86_64 randconfig-015-20241122 gcc-12 x86_64 randconfig-016-20241122 gcc-12 x86_64 randconfig-071-20241122 clang-19 x86_64 randconfig-072-20241122 gcc-12 x86_64 rhel-9.4 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 812485619c8bb60a69ba8b132dca7b435e9c74ed
by kernel test robot 22 Nov '24

22 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 812485619c8bb60a69ba8b132dca7b435e9c74ed !13303 v2 fix CVE-2024-50141 Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-002-20241122 | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-004-20241122 | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_ext.c:warning:implicit-conversion-from-enum-hclge_ext_opcode_type-to-enum-hclge_opcode_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_main.c:warning:implicit-conversion-from-enum-hclge_ext_opcode_type-to-enum-hclge_opcode_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_main.c:warning:implicit-conversion-from-enum-hnae3_reset_type-to-enum-hnae3_event_type_custom | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-hclge_mbx_set_vf_multi_tc | `-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-hclge_tm_vf_tc_dwrr_cfg |-- x86_64-allnoconfig | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | `-- ld.lld:error:duplicate-symbol:debug |-- x86_64-buildonly-randconfig-001-20241122 | |-- security-integrity-ima-ima.h:warning:struct-ima_digest-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | `-- security-integrity-ima-ima_main.c:error:too-few-arguments-to-function-ima_appraise_measurement |-- x86_64-buildonly-randconfig-002-20241122 | `-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE |-- x86_64-buildonly-randconfig-003-20241122 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | `-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn |-- x86_64-buildonly-randconfig-005-20241122 | `-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE |-- x86_64-buildonly-randconfig-006-20241122 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | `-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn |-- x86_64-kexec | `-- kernel-trace-trace_uprobe.o:warning:objtool:__uprobe_perf_func:unreachable-instruction |-- x86_64-rhel-9.4 | `-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-mcp251xfd_tx_obj_write_sync |-- x86_64-rhel-9.4-func | `-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-mcp251xfd_tx_obj_write_sync `-- x86_64-rhel-9.4-kselftests `-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-mcp251xfd_tx_obj_write_sync elapsed time: 728m configs tested: 23 configs skipped: 127 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20241122 gcc-14.2.0 arm64 randconfig-002-20241122 gcc-14.2.0 arm64 randconfig-003-20241122 gcc-14.2.0 arm64 randconfig-004-20241122 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241122 gcc-12 x86_64 buildonly-randconfig-002-20241122 clang-19 x86_64 buildonly-randconfig-003-20241122 gcc-12 x86_64 buildonly-randconfig-004-20241122 gcc-12 x86_64 buildonly-randconfig-005-20241122 clang-19 x86_64 buildonly-randconfig-006-20241122 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241122 gcc-12 x86_64 randconfig-002-20241122 clang-19 x86_64 randconfig-003-20241122 gcc-12 x86_64 randconfig-004-20241122 clang-19 x86_64 randconfig-005-20241122 gcc-12 x86_64 randconfig-006-20241122 clang-19 x86_64 rhel-9.4 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] bpf: Fix out-of-bounds write in trie_get_next_key()
by Xiaomeng Zhang 22 Nov '24

22 Nov '24

From: Byeonguk Jeong <jungbu2855(a)gmail.com> stable inclusion from stable-v5.10.229 commit 590976f921723d53ac199c01d5b7b73a94875e68 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB379Y CVE: CVE-2024-50262 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 13400ac8fb80c57c2bfb12ebd35ee121ce9b4d21 ] trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ... 0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with size 8. Fixes: b471f2f1de8b ("bpf: implement MAP_GET_NEXT_KEY command for LPM_TRIE map") Signed-off-by: Byeonguk Jeong <jungbu2855(a)gmail.com> Reviewed-by: Toke Høiland-Jørgensen <toke(a)kernel.org> Tested-by: Hou Tao <houtao1(a)huawei.com> Acked-by: Hou Tao <houtao1(a)huawei.com> Link: https://lore.kernel.org/r/Zxx384ZfdlFYnz6J@localhost.localdomain Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/bpf/lpm_trie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c index 3c2d8722d45b..8370b391f1d6 100644 --- a/kernel/bpf/lpm_trie.c +++ b/kernel/bpf/lpm_trie.c @@ -655,7 +655,7 @@ static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key) if (!key || key->prefixlen > trie->max_prefixlen) goto find_leftmost; - node_stack = kmalloc_array(trie->max_prefixlen, + node_stack = kmalloc_array(trie->max_prefixlen + 1, sizeof(struct lpm_trie_node *), GFP_ATOMIC | __GFP_NOWARN); if (!node_stack) -- 2.34.1

2 1

[PATCH OLK-5.10] bpf: Fix out-of-bounds write in trie_get_next_key()
by Xiaomeng Zhang 22 Nov '24

22 Nov '24

From: Byeonguk Jeong <jungbu2855(a)gmail.com> stable inclusion from stable-v5.10.229 commit 590976f921723d53ac199c01d5b7b73a94875e68 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB379Y CVE: CVE-2024-50262 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 13400ac8fb80c57c2bfb12ebd35ee121ce9b4d21 ] trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ... 0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with size 8. Fixes: b471f2f1de8b ("bpf: implement MAP_GET_NEXT_KEY command for LPM_TRIE map") Signed-off-by: Byeonguk Jeong <jungbu2855(a)gmail.com> Reviewed-by: Toke Høiland-Jørgensen <toke(a)kernel.org> Tested-by: Hou Tao <houtao1(a)huawei.com> Acked-by: Hou Tao <houtao1(a)huawei.com> Link: https://lore.kernel.org/r/Zxx384ZfdlFYnz6J@localhost.localdomain Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/bpf/lpm_trie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c index 3c2d8722d45b..8370b391f1d6 100644 --- a/kernel/bpf/lpm_trie.c +++ b/kernel/bpf/lpm_trie.c @@ -655,7 +655,7 @@ static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key) if (!key || key->prefixlen > trie->max_prefixlen) goto find_leftmost; - node_stack = kmalloc_array(trie->max_prefixlen, + node_stack = kmalloc_array(trie->max_prefixlen + 1, sizeof(struct lpm_trie_node *), GFP_ATOMIC | __GFP_NOWARN); if (!node_stack) -- 2.34.1

2 1