- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/3] CVE-2024-35879
by Zhang Zekun 10 Sep '24

10 Sep '24

Fix CVE-2024-35879 Herve Codina (2): driver core: Introduce device_link_wait_removal() of: dynamic: Synchronize of_changeset_destroy() with the devlink removals Zhang Zekun (1): driver core: Fix kabi broken drivers/base/core.c | 26 +++++++++++++++++++++++--- drivers/of/dynamic.c | 11 +++++++++++ include/linux/of.h | 2 ++ 3 files changed, 36 insertions(+), 3 deletions(-) -- 2.17.1

2 4

[PATCH OLK-6.6] fs/netfs/fscache_cookie: add missing "n_accesses" check
by Long Li 09 Sep '24

09 Sep '24

From: Max Kellermann <max.kellermann(a)ionos.com> stable inclusion from stable-v6.6.47 commit dfaa39b05a6cf34a16c525a2759ee6ab26b5fef6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZM CVE: CVE-2024-45000 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit f71aa06398aabc2e3eaac25acdf3d62e0094ba70 upstream. This fixes a NULL pointer dereference bug due to a data race which looks like this: BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 33 PID: 16573 Comm: kworker/u97:799 Not tainted 6.8.7-cm4all1-hp+ #43 Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018 Workqueue: events_unbound netfs_rreq_write_to_cache_work RIP: 0010:cachefiles_prepare_write+0x30/0xa0 Code: 57 41 56 45 89 ce 41 55 49 89 cd 41 54 49 89 d4 55 53 48 89 fb 48 83 ec 08 48 8b 47 08 48 83 7f 10 00 48 89 34 24 48 8b 68 20 <48> 8b 45 08 4c 8b 38 74 45 49 8b 7f 50 e8 4e a9 b0 ff 48 8b 73 10 RSP: 0018:ffffb4e78113bde0 EFLAGS: 00010286 RAX: ffff976126be6d10 RBX: ffff97615cdb8438 RCX: 0000000000020000 RDX: ffff97605e6c4c68 RSI: ffff97605e6c4c60 RDI: ffff97615cdb8438 RBP: 0000000000000000 R08: 0000000000278333 R09: 0000000000000001 R10: ffff97605e6c4600 R11: 0000000000000001 R12: ffff97605e6c4c68 R13: 0000000000020000 R14: 0000000000000001 R15: ffff976064fe2c00 FS: 0000000000000000(0000) GS:ffff9776dfd40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000005942c002 CR4: 00000000001706f0 Call Trace: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x15d/0x440 ? search_module_extables+0xe/0x40 ? fixup_exception+0x22/0x2f0 ? exc_page_fault+0x5f/0x100 ? asm_exc_page_fault+0x22/0x30 ? cachefiles_prepare_write+0x30/0xa0 netfs_rreq_write_to_cache_work+0x135/0x2e0 process_one_work+0x137/0x2c0 worker_thread+0x2e9/0x400 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x30/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Modules linked in: CR2: 0000000000000008 ---[ end trace 0000000000000000 ]--- This happened because fscache_cookie_state_machine() was slow and was still running while another process invoked fscache_unuse_cookie(); this led to a fscache_cookie_lru_do_one() call, setting the FSCACHE_COOKIE_DO_LRU_DISCARD flag, which was picked up by fscache_cookie_state_machine(), withdrawing the cookie via cachefiles_withdraw_cookie(), clearing cookie->cache_priv. At the same time, yet another process invoked cachefiles_prepare_write(), which found a NULL pointer in this code line: struct cachefiles_object *object = cachefiles_cres_object(cres); The next line crashes, obviously: struct cachefiles_cache *cache = object->volume->cache; During cachefiles_prepare_write(), the "n_accesses" counter is non-zero (via fscache_begin_operation()). The cookie must not be withdrawn until it drops to zero. The counter is checked by fscache_cookie_state_machine() before switching to FSCACHE_COOKIE_STATE_RELINQUISHING and FSCACHE_COOKIE_STATE_WITHDRAWING (in "case FSCACHE_COOKIE_STATE_FAILED"), but not for FSCACHE_COOKIE_STATE_LRU_DISCARDING ("case FSCACHE_COOKIE_STATE_ACTIVE"). This patch adds the missing check. With a non-zero access counter, the function returns and the next fscache_end_cookie_access() call will queue another fscache_cookie_state_machine() call to handle the still-pending FSCACHE_COOKIE_DO_LRU_DISCARD. Fixes: 12bb21a29c19 ("fscache: Implement cookie user counting and resource pinning") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Signed-off-by: David Howells <dhowells(a)redhat.com> Link: https://lore.kernel.org/r/20240729162002.3436763-2-dhowells@redhat.com cc: Jeff Layton <jlayton(a)kernel.org> cc: netfs(a)lists.linux.dev cc: linux-fsdevel(a)vger.kernel.org cc: stable(a)vger.kernel.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/fscache/cookie.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c index bce2492186d0..d4d4b3a8b106 100644 --- a/fs/fscache/cookie.c +++ b/fs/fscache/cookie.c @@ -741,6 +741,10 @@ static void fscache_cookie_state_machine(struct fscache_cookie *cookie) spin_lock(&cookie->lock); } if (test_bit(FSCACHE_COOKIE_DO_LRU_DISCARD, &cookie->flags)) { + if (atomic_read(&cookie->n_accesses) != 0) + /* still being accessed: postpone it */ + break; + __fscache_set_cookie_state(cookie, FSCACHE_COOKIE_STATE_LRU_DISCARDING); wake = true; -- 2.39.2

2 1

[PATCH OLK-6.6] tracefs: Use generic inode RCU for synchronizing freeing
by Long Li 09 Sep '24

09 Sep '24

From: Steven Rostedt <rostedt(a)goodmis.org> commit 0b6743bd60a56a701070b89fb80c327a44b7b3e2 upstream. With structure layout randomization enabled for 'struct inode' we need to avoid overlapping any of the RCU-used / initialized-only-once members, e.g. i_lru or i_sb_list to not corrupt related list traversals when making use of the rcu_head. For an unlucky structure layout of 'struct inode' we may end up with the following splat when running the ftrace selftests: [<...>] list_del corruption, ffff888103ee2cb0->next (tracefs_inode_cache+0x0/0x4e0 [slab object]) is NULL (prev is tracefs_inode_cache+0x78/0x4e0 [slab object]) [<...>] ------------[ cut here ]------------ [<...>] kernel BUG at lib/list_debug.c:54! [<...>] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [<...>] CPU: 3 PID: 2550 Comm: mount Tainted: G N 6.8.12-grsec+ #122 ed2f536ca62f28b087b90e3cc906a8d25b3ddc65 [<...>] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [<...>] RIP: 0010:[<ffffffff84656018>] __list_del_entry_valid_or_report+0x138/0x3e0 [<...>] Code: 48 b8 99 fb 65 f2 ff ff ff ff e9 03 5c d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff e9 33 5a d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff <0f> 0b 4c 89 e9 48 89 ea 48 89 ee 48 c7 c7 60 8f dd 89 31 c0 e8 2f [<...>] RSP: 0018:fffffe80416afaf0 EFLAGS: 00010283 [<...>] RAX: 0000000000000098 RBX: ffff888103ee2cb0 RCX: 0000000000000000 [<...>] RDX: ffffffff84655fe8 RSI: ffffffff89dd8b60 RDI: 0000000000000001 [<...>] RBP: ffff888103ee2cb0 R08: 0000000000000001 R09: fffffbd0082d5f25 [<...>] R10: fffffe80416af92f R11: 0000000000000001 R12: fdf99c16731d9b6d [<...>] R13: 0000000000000000 R14: ffff88819ad4b8b8 R15: 0000000000000000 [<...>] RBX: tracefs_inode_cache+0x0/0x4e0 [slab object] [<...>] RDX: __list_del_entry_valid_or_report+0x108/0x3e0 [<...>] RSI: __func__.47+0x4340/0x4400 [<...>] RBP: tracefs_inode_cache+0x0/0x4e0 [slab object] [<...>] RSP: process kstack fffffe80416afaf0+0x7af0/0x8000 [mount 2550 2550] [<...>] R09: kasan shadow of process kstack fffffe80416af928+0x7928/0x8000 [mount 2550 2550] [<...>] R10: process kstack fffffe80416af92f+0x792f/0x8000 [mount 2550 2550] [<...>] R14: tracefs_inode_cache+0x78/0x4e0 [slab object] [<...>] FS: 00006dcb380c1840(0000) GS:ffff8881e0600000(0000) knlGS:0000000000000000 [<...>] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [<...>] CR2: 000076ab72b30e84 CR3: 000000000b088004 CR4: 0000000000360ef0 shadow CR4: 0000000000360ef0 [<...>] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [<...>] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [<...>] ASID: 0003 [<...>] Stack: [<...>] ffffffff818a2315 00000000f5c856ee ffffffff896f1840 ffff888103ee2cb0 [<...>] ffff88812b6b9750 0000000079d714b6 fffffbfff1e9280b ffffffff8f49405f [<...>] 0000000000000001 0000000000000000 ffff888104457280 ffffffff8248b392 [<...>] Call Trace: [<...>] <TASK> [<...>] [<ffffffff818a2315>] ? lock_release+0x175/0x380 fffffe80416afaf0 [<...>] [<ffffffff8248b392>] list_lru_del+0x152/0x740 fffffe80416afb48 [<...>] [<ffffffff8248ba93>] list_lru_del_obj+0x113/0x280 fffffe80416afb88 [<...>] [<ffffffff8940fd19>] ? _atomic_dec_and_lock+0x119/0x200 fffffe80416afb90 [<...>] [<ffffffff8295b244>] iput_final+0x1c4/0x9a0 fffffe80416afbb8 [<...>] [<ffffffff8293a52b>] dentry_unlink_inode+0x44b/0xaa0 fffffe80416afbf8 [<...>] [<ffffffff8293fefc>] __dentry_kill+0x23c/0xf00 fffffe80416afc40 [<...>] [<ffffffff8953a85f>] ? __this_cpu_preempt_check+0x1f/0xa0 fffffe80416afc48 [<...>] [<ffffffff82949ce5>] ? shrink_dentry_list+0x1c5/0x760 fffffe80416afc70 [<...>] [<ffffffff82949b71>] ? shrink_dentry_list+0x51/0x760 fffffe80416afc78 [<...>] [<ffffffff82949da8>] shrink_dentry_list+0x288/0x760 fffffe80416afc80 [<...>] [<ffffffff8294ae75>] shrink_dcache_sb+0x155/0x420 fffffe80416afcc8 [<...>] [<ffffffff8953a7c3>] ? debug_smp_processor_id+0x23/0xa0 fffffe80416afce0 [<...>] [<ffffffff8294ad20>] ? do_one_tree+0x140/0x140 fffffe80416afcf8 [<...>] [<ffffffff82997349>] ? do_remount+0x329/0xa00 fffffe80416afd18 [<...>] [<ffffffff83ebf7a1>] ? security_sb_remount+0x81/0x1c0 fffffe80416afd38 [<...>] [<ffffffff82892096>] reconfigure_super+0x856/0x14e0 fffffe80416afd70 [<...>] [<ffffffff815d1327>] ? ns_capable_common+0xe7/0x2a0 fffffe80416afd90 [<...>] [<ffffffff82997436>] do_remount+0x416/0xa00 fffffe80416afdd0 [<...>] [<ffffffff829b2ba4>] path_mount+0x5c4/0x900 fffffe80416afe28 [<...>] [<ffffffff829b25e0>] ? finish_automount+0x13a0/0x13a0 fffffe80416afe60 [<...>] [<ffffffff82903812>] ? user_path_at_empty+0xb2/0x140 fffffe80416afe88 [<...>] [<ffffffff829b2ff5>] do_mount+0x115/0x1c0 fffffe80416afeb8 [<...>] [<ffffffff829b2ee0>] ? path_mount+0x900/0x900 fffffe80416afed8 [<...>] [<ffffffff8272461c>] ? __kasan_check_write+0x1c/0xa0 fffffe80416afee0 [<...>] [<ffffffff829b31cf>] __do_sys_mount+0x12f/0x280 fffffe80416aff30 [<...>] [<ffffffff829b36cd>] __x64_sys_mount+0xcd/0x2e0 fffffe80416aff70 [<...>] [<ffffffff819f8818>] ? syscall_trace_enter+0x218/0x380 fffffe80416aff88 [<...>] [<ffffffff8111655e>] x64_sys_call+0x5d5e/0x6720 fffffe80416affa8 [<...>] [<ffffffff8952756d>] do_syscall_64+0xcd/0x3c0 fffffe80416affb8 [<...>] [<ffffffff8100119b>] entry_SYSCALL_64_safe_stack+0x4c/0x87 fffffe80416affe8 [<...>] </TASK> [<...>] <PTREGS> [<...>] RIP: 0033:[<00006dcb382ff66a>] vm_area_struct[mount 2550 2550 file 6dcb38225000-6dcb3837e000 22 55(read|exec|mayread|mayexec)]+0x0/0xb8 [userland map] [<...>] Code: 48 8b 0d 29 18 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d f6 17 0d 00 f7 d8 64 89 01 48 [<...>] RSP: 002b:0000763d68192558 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [<...>] RAX: ffffffffffffffda RBX: 00006dcb38433264 RCX: 00006dcb382ff66a [<...>] RDX: 000017c3e0d11210 RSI: 000017c3e0d1a5a0 RDI: 000017c3e0d1ae70 [<...>] RBP: 000017c3e0d10fb0 R08: 000017c3e0d11260 R09: 00006dcb383d1be0 [<...>] R10: 000000000020002e R11: 0000000000000246 R12: 0000000000000000 [<...>] R13: 000017c3e0d1ae70 R14: 000017c3e0d11210 R15: 000017c3e0d10fb0 [<...>] RBX: vm_area_struct[mount 2550 2550 file 6dcb38433000-6dcb38434000 5b 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RCX: vm_area_struct[mount 2550 2550 file 6dcb38225000-6dcb3837e000 22 55(read|exec|mayread|mayexec)]+0x0/0xb8 [userland map] [<...>] RDX: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RSI: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RDI: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RBP: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RSP: vm_area_struct[mount 2550 2550 anon 763d68173000-763d68195000 7ffffffdd 100133(read|write|mayread|maywrite|growsdown|account)]+0x0/0xb8 [userland map] [<...>] R08: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R09: vm_area_struct[mount 2550 2550 file 6dcb383d1000-6dcb383d3000 1cd 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R13: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R14: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R15: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] </PTREGS> [<...>] Modules linked in: [<...>] ---[ end trace 0000000000000000 ]--- The list debug message as well as RBX's symbolic value point out that the object in question was allocated from 'tracefs_inode_cache' and that the list's '->next' member is at offset 0. Dumping the layout of the relevant parts of 'struct tracefs_inode' gives the following: struct tracefs_inode { union { struct inode { struct list_head { struct list_head * next; /* 0 8 */ struct list_head * prev; /* 8 8 */ } i_lru; [...] } vfs_inode; struct callback_head { void (*func)(struct callback_head *); /* 0 8 */ struct callback_head * next; /* 8 8 */ } rcu; }; [...] }; Above shows that 'vfs_inode.i_lru' overlaps with 'rcu' which will destroy the 'i_lru' list as soon as the 'rcu' member gets used, e.g. in call_rcu() or later when calling the RCU callback. This will disturb concurrent list traversals as well as object reuse which assumes these list heads will keep their integrity. For reproduction, the following diff manually overlays 'i_lru' with 'rcu' as, otherwise, one would require some good portion of luck for gambling an unlucky RANDSTRUCT seed: --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -629,6 +629,7 @@ struct inode { umode_t i_mode; unsigned short i_opflags; kuid_t i_uid; + struct list_head i_lru; /* inode LRU list */ kgid_t i_gid; unsigned int i_flags; @@ -690,7 +691,6 @@ struct inode { u16 i_wb_frn_avg_time; u16 i_wb_frn_history; #endif - struct list_head i_lru; /* inode LRU list */ struct list_head i_sb_list; struct list_head i_wb_list; /* backing dev writeback list */ union { The tracefs inode does not need to supply its own RCU delayed destruction of its inode. The inode code itself offers both a "destroy_inode()" callback that gets called when the last reference of the inode is released, and the "free_inode()" which is called after a RCU synchronization period from the "destroy_inode()". The tracefs code can unlink the inode from its list in the destroy_inode() callback, and the simply free it from the free_inode() callback. This should provide the same protection. Link: https://lore.kernel.org/all/20240807115143.45927-3-minipli@grsecurity.net/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Ajay Kaher <ajay.kaher(a)broadcom.com> Cc: Ilkka =?utf-8?b?TmF1bGFww6TDpA==?= <digirigawa(a)gmail.com> Link: https://lore.kernel.org/20240807185402.61410544@gandalf.local.home Fixes: baa23a8d4360 ("tracefs: Reset permissions on remount if permissions are options") Reported-by: Mathias Krause <minipli(a)grsecurity.net> Reported-by: Brad Spengler <spender(a)grsecurity.net> Suggested-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: include/linux/fs.h [The patch which merged into stable-v6.6 has error, it shouldn't modify include/linux/fs.h] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/tracefs/inode.c | 10 ++++------ fs/tracefs/internal.h | 5 +---- 2 files changed, 5 insertions(+), 10 deletions(-) diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c index 859442b5371e..7d389dd5ed51 100644 --- a/fs/tracefs/inode.c +++ b/fs/tracefs/inode.c @@ -53,15 +53,14 @@ static struct inode *tracefs_alloc_inode(struct super_block *sb) return &ti->vfs_inode; } -static void tracefs_free_inode_rcu(struct rcu_head *rcu) +static void tracefs_free_inode(struct inode *inode) { - struct tracefs_inode *ti; + struct tracefs_inode *ti = get_tracefs(inode); - ti = container_of(rcu, struct tracefs_inode, rcu); kmem_cache_free(tracefs_inode_cachep, ti); } -static void tracefs_free_inode(struct inode *inode) +static void tracefs_destroy_inode(struct inode *inode) { struct tracefs_inode *ti = get_tracefs(inode); unsigned long flags; @@ -69,8 +68,6 @@ static void tracefs_free_inode(struct inode *inode) spin_lock_irqsave(&tracefs_inode_lock, flags); list_del_rcu(&ti->list); spin_unlock_irqrestore(&tracefs_inode_lock, flags); - - call_rcu(&ti->rcu, tracefs_free_inode_rcu); } static ssize_t default_read_file(struct file *file, char __user *buf, @@ -458,6 +455,7 @@ static int tracefs_drop_inode(struct inode *inode) static const struct super_operations tracefs_super_operations = { .alloc_inode = tracefs_alloc_inode, .free_inode = tracefs_free_inode, + .destroy_inode = tracefs_destroy_inode, .drop_inode = tracefs_drop_inode, .statfs = simple_statfs, .remount_fs = tracefs_remount, diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h index f704d8348357..d83c2a25f288 100644 --- a/fs/tracefs/internal.h +++ b/fs/tracefs/internal.h @@ -10,10 +10,7 @@ enum { }; struct tracefs_inode { - union { - struct inode vfs_inode; - struct rcu_head rcu; - }; + struct inode vfs_inode; /* The below gets initialized with memset_after(ti, 0, vfs_inode) */ struct list_head list; unsigned long flags; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] mptcp: pm: avoid possible UaF when selecting endp
by Liu Jian 09 Sep '24

09 Sep '24

From: "Matthieu Baerts (NGI0)" <matttbe(a)kernel.org> mainline inclusion from mainline-v6.11-rc5 commit 48e50dcbcbaaf713d82bf2da5c16aeced94ad07d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY17 CVE: CVE-2024-44974 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free. A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with. Reported-by: Paolo Abeni <pabeni(a)redhat.com> Closes: https://lore.kernel.org/45cd30d3-7710-491c-ae4d-a1368c00beb1@redhat.com Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") Cc: stable(a)vger.kernel.org Reviewed-by: Mat Martineau <martineau(a)kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-14-38035d40de5… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/mptcp/pm_netlink.c [Did not backport 90d930882139 ("mptcp: constify a bunch of of helpers"), 85df533a787b ("mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set"), 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/mptcp/pm_netlink.c | 44 ++++++++++++++++++++++++------------------ 1 file changed, 25 insertions(+), 19 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index 0d6f3d912891..824420c4e8f9 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -128,11 +128,13 @@ static bool lookup_subflow_by_saddr(const struct list_head *list, return false; } -static struct mptcp_pm_addr_entry * +static bool select_local_address(const struct pm_nl_pernet *pernet, - struct mptcp_sock *msk) + struct mptcp_sock *msk, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; rcu_read_lock(); spin_lock_bh(&msk->join_list_lock); @@ -146,19 +148,23 @@ select_local_address(const struct pm_nl_pernet *pernet, if (entry->addr.family == ((struct sock *)msk)->sk_family && !lookup_subflow_by_saddr(&msk->conn_list, &entry->addr) && !lookup_subflow_by_saddr(&msk->join_list, &entry->addr)) { - ret = entry; + *new_entry = *entry; + found = true; break; } } spin_unlock_bh(&msk->join_list_lock); rcu_read_unlock(); - return ret; + + return found; } -static struct mptcp_pm_addr_entry * -select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) +static bool +select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; int i = 0; rcu_read_lock(); @@ -171,12 +177,14 @@ select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) if (!(entry->addr.flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) continue; if (i++ == pos) { - ret = entry; + *new_entry = *entry; + found = true; break; } } rcu_read_unlock(); - return ret; + + return found; } static void check_work_pending(struct mptcp_sock *msk) @@ -306,7 +314,7 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) { struct mptcp_addr_info remote = { 0 }; struct sock *sk = (struct sock *)msk; - struct mptcp_pm_addr_entry *local; + struct mptcp_pm_addr_entry local; struct pm_nl_pernet *pernet; pernet = net_generic(sock_net((struct sock *)msk), pm_nl_pernet_id); @@ -318,13 +326,12 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) /* check first for announce */ if (msk->pm.add_addr_signaled < msk->pm.add_addr_signal_max) { - local = select_signal_address(pernet, - msk->pm.add_addr_signaled); - if (local) { - if (mptcp_pm_alloc_anno_list(msk, local)) { + if (select_signal_address(pernet, + msk->pm.add_addr_signaled, &local)) { + if (mptcp_pm_alloc_anno_list(msk, &local)) { msk->pm.add_addr_signaled++; - mptcp_pm_announce_addr(msk, &local->addr, false); + mptcp_pm_announce_addr(msk, &local.addr, false); } } else { /* pick failed, avoid fourther attempts later */ @@ -339,13 +346,12 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) msk->pm.subflows < msk->pm.subflows_max) { remote_address((struct sock_common *)sk, &remote); - local = select_local_address(pernet, msk); - if (local) { + if (select_local_address(pernet, msk, &local)) { msk->pm.local_addr_used++; msk->pm.subflows++; check_work_pending(msk); spin_unlock_bh(&msk->pm.lock); - __mptcp_subflow_connect(sk, &local->addr, &remote); + __mptcp_subflow_connect(sk, &local.addr, &remote); spin_lock_bh(&msk->pm.lock); return; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
by Liu Jian 09 Sep '24

09 Sep '24

From: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> stable inclusion from stable-v5.10.224 commit b7b8d9f5e679af60c94251fd6728dde34be69a71 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYL CVE: CVE-2024-44971 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit e3862093ee93fcfbdadcb7957f5f8974fffa806a ] bcm_sf2_mdio_register() calls of_phy_find_device() and then phy_device_remove() in a loop to remove existing PHY devices. of_phy_find_device() eventually calls bus_find_device(), which calls get_device() on the returned struct device * to increment the refcount. The current implementation does not decrement the refcount, which causes memory leak. This commit adds the missing phy_device_free() call to decrement the refcount via put_device() to balance the refcount. Fixes: 771089c2a485 ("net: dsa: bcm_sf2: Ensure that MDIO diversion is used") Signed-off-by: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> Tested-by: Florian Fainelli <florian.fainelli(a)broadcom.com> Reviewed-by: Florian Fainelli <florian.fainelli(a)broadcom.com> Link: https://patch.msgid.link/20240806011327.3817861-1-joe@pf.is.s.u-tokyo.ac.jp Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/dsa/bcm_sf2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c index c6563d212476..7b8bdc34caa5 100644 --- a/drivers/net/dsa/bcm_sf2.c +++ b/drivers/net/dsa/bcm_sf2.c @@ -559,8 +559,10 @@ static int bcm_sf2_mdio_register(struct dsa_switch *ds) of_remove_property(child, prop); phydev = of_phy_find_device(child); - if (phydev) + if (phydev) { phy_device_remove(phydev); + phy_device_free(phydev); + } } err = mdiobus_register(priv->slave_mii_bus); -- 2.34.1

2 1

[openeuler:OLK-5.10 29989/30000] versioncheck: ./drivers/misc/sdma-dae/sdma_cdev.c: 9 linux/version.h not needed.
by kernel test robot 09 Sep '24

09 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 3e6d44ea60eb8609ba59273c12276e3236cd76b2 commit: 1eb55075d727b4f06ceeb95a71670e2a0d7d026c [29989/30000] drivers:misc:sdma-dae: fix icsl code check problems reproduce: (https://download.01.org/0day-ci/archive/20240909/202409091107.diXxqb2W-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409091107.diXxqb2W-lkp@intel.com/ versioncheck warnings: (new ones prefixed by >>) INFO PATH=/opt/cross/rustc-1.58.0-bindgen-0.56.0/cargo/bin:/opt/cross/clang-18/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/timeout -k 100 3h /usr/bin/make KCFLAGS= -Wtautological-compare -Wno-error=return-type -Wreturn-type -Wcast-function-type -funsigned-char -Wundef -fstrict-flex-arrays=3 -Wformat-overflow -Wformat-truncation -Wenum-conversion W=1 --keep-going LLVM=1 -j32 ARCH=x86_64 versioncheck find ./* $ -name SCCS -o -name BitKeeper -o -name .svn -o -name CVS -o -name .pc -o -name .hg -o -name .git $ -prune -o \ -name '*.[hcS]' -type f -print | sort \ | xargs perl -w ./scripts/checkversion.pl ./arch/csky/include/asm/atomic.h: 6 linux/version.h not needed. ./arch/csky/include/asm/io.h: 9 linux/version.h not needed. ./arch/csky/include/asm/thread_info.h: 9 linux/version.h not needed. ./arch/csky/include/asm/uaccess.h: 15 linux/version.h not needed. ./arch/csky/kernel/process.c: 5 linux/version.h not needed. ./arch/csky/mm/dma-mapping.c: 12 linux/version.h not needed. ./arch/csky/mm/fault.c: 16 linux/version.h not needed. ./arch/s390/include/asm/setup.h: 183: need linux/version.h ./arch/um/drivers/vector_kern.c: 11 linux/version.h not needed. ./drivers/block/rsxx/rsxx_priv.h: 14 linux/version.h not needed. ./drivers/char/ipmi/ipmi_si_ls2k500.c: 19 linux/version.h not needed. ./drivers/crypto/cavium/cpt/cptpf_main.c: 13 linux/version.h not needed. ./drivers/crypto/cavium/zip/common.h: 59 linux/version.h not needed. ./drivers/crypto/ccree/cc_driver.h: 26 linux/version.h not needed. ./drivers/crypto/montage/tsse/tsse_vuart.c: 21 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c: 62 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c: 28 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c: 26 linux/version.h not needed. ./drivers/gpu/drm/inspur/inspur_drm_de.c: 513: need linux/version.h ./drivers/gpu/drm/inspur/inspur_drm_drv.c: 456: need linux/version.h ./drivers/gpu/drm/pl111/pl111_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/pl111/pl111_drv.c: 47 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_drv.c: 38 linux/version.h not needed. ./drivers/hv/hv.c: 16 linux/version.h not needed. ./drivers/i2c/busses/i2c-brcmstb.c: 25 linux/version.h not needed. ./drivers/i2c/busses/i2c-xgene-slimpro.c: 22 linux/version.h not needed. ./drivers/media/pci/cx25821/cx25821.h: 31 linux/version.h not needed. ./drivers/media/platform/s3c-camif/camif-core.c: 26 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-common.h: 16 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c: 31 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-dvb.c: 14 linux/version.h not needed. ./drivers/media/usb/uvc/uvc_driver.c: 18 linux/version.h not needed. >> ./drivers/misc/sdma-dae/sdma_cdev.c: 9 linux/version.h not needed. ./drivers/net/ethernet/3snic/sssnic/include/kernel/sss_linux_kernel.h: 12 linux/version.h not needed. ./drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c: 21 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h: 32 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c: 17 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h: 20 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic/ossl_knl.h: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h: 12 linux/version.h not needed. ./drivers/net/ethernet/mucse/rnpm/rnpm_common.h: 7 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/common.h: 12 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/txrx.c: 9 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede.h: 10 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_ethtool.c: 7 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_main.c: 10 linux/version.h not needed. ./drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h: 26 linux/version.h not needed. ./drivers/net/usb/lan78xx.c: 5 linux/version.h not needed. ./drivers/net/wireless/rsi/rsi_91x_ps.c: 19 linux/version.h not needed. ./drivers/scsi/cxgbi/libcxgbi.h: 27 linux/version.h not needed. ./drivers/scsi/hisi_raid/hiraid_main.c: 9 linux/version.h not needed. ./drivers/scsi/huawei/hifc/hifc_knl_adp.h: 23 linux/version.h not needed. ./drivers/scsi/qedf/qedf.h: 15 linux/version.h not needed. ./drivers/scsi/qedf/qedf_dbg.h: 13 linux/version.h not needed. ./drivers/scsi/qedi/qedi_dbg.h: 14 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_fw.c: 6 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_os.c: 6 linux/version.h not needed. ./drivers/soc/tegra/powergate-bpmp.c: 10 linux/version.h not needed. ./drivers/staging/media/atomisp/include/linux/atomisp.h: 23 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/drv_types.h: 17 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/ioctl_cfg80211.h: 10 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_cdev_file.c: 23 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_device.c: 33 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_genl.c: 26 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_genl_admin.c: 20 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_main.c: 28 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_tp.c: 26 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_umem.c: 26 linux/version.h not needed. ./drivers/ub/urma/uburma/uburma_main.c: 29 linux/version.h not needed. ./drivers/ub/urma/uburma/uburma_mmap.c: 21 linux/version.h not needed. ./drivers/watchdog/ziirave_wdt.c: 21 linux/version.h not needed. ./fs/eulerfs/euler.h: 20 linux/version.h not needed. ./fs/eulerfs/euler_common.h: 25 linux/version.h not needed. ./fs/proc/etmem_scan.c: 13 linux/version.h not needed. ./include/linux/qed/qed_ll2_if.h: 15 linux/version.h not needed. ./kernel/bpf/syscall.c: 20 linux/version.h not needed. ./samples/bpf/sampleip_kern.c: 7 linux/version.h not needed. ./samples/bpf/trace_event_kern.c: 8 linux/version.h not needed. ./sound/soc/codecs/cs35l35.c: 12 linux/version.h not needed. ./sound/soc/codecs/cs42l42.c: 14 linux/version.h not needed. ./tools/lib/bpf/libbpf_sched.h: 21 linux/version.h not needed. ./tools/perf/include/bpf/bpf.h: 70: need linux/version.h ./tools/perf/tests/bpf-script-example.c: 49: need linux/version.h ./tools/perf/tests/bpf-script-test-kbuild.c: 21: need linux/version.h ./tools/perf/tests/bpf-script-test-prologue.c: 47: need linux/version.h ./tools/perf/tests/bpf-script-test-relocation.c: 51: need linux/version.h ./tools/testing/selftests/bpf/progs/test_map_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_send_signal_kern.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_spin_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_tcp_estats.c: 37 linux/version.h not needed. ./tools/testing/selftests/wireguard/qemu/init.c: 25 linux/version.h not needed. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] mm/ksm: fix ksm_zero_pages accounting
by Kaixiong Yu 09 Sep '24

09 Sep '24

fix the bug from mainline inclusion commits e2942062e01d ("ksm: count all zero pages placed by KSM") and 6080d19f0704 ("ksm: add ksm zero pages for each process") Chengming Zhou (1): mm/ksm: fix ksm_zero_pages accounting Kaixiong Yu (1): mm_types: Fix kabi breakage in struct mm_struct fs/proc/base.c | 2 +- include/linux/ksm.h | 17 ++++++++++++++--- include/linux/mm_types.h | 3 ++- mm/ksm.c | 11 +++++------ 4 files changed, 22 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[openeuler:OLK-5.10 4121/30000] fs/xfs/xfs_icache.c:52 xfs_icwalk_tag() warn: unsigned 'goal' is never less than zero.
by kernel test robot 09 Sep '24

09 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 3e6d44ea60eb8609ba59273c12276e3236cd76b2 commit: b12b4a14e6dc13b75697ebc80f513fedd068345e [4121/30000] xfs: remove xfs_dqrele_all_inodes config: x86_64-randconfig-161-20240906 (https://download.01.org/0day-ci/archive/20240909/202409091024.XP4R6muy-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409091024.XP4R6muy-lkp@intel.com/ New smatch warnings: fs/xfs/xfs_icache.c:52 xfs_icwalk_tag() warn: unsigned 'goal' is never less than zero. Old smatch warnings: fs/xfs/xfs_icache.c:534 xfs_iget_cache_hit() warn: missing unwind goto? vim +/goal +52 fs/xfs/xfs_icache.c 656d89e710ffc0 Darrick J. Wong 2022-01-07 47 656d89e710ffc0 Darrick J. Wong 2022-01-07 48 /* Compute the inode radix tree tag for this goal. */ 656d89e710ffc0 Darrick J. Wong 2022-01-07 49 static inline unsigned int 656d89e710ffc0 Darrick J. Wong 2022-01-07 50 xfs_icwalk_tag(enum xfs_icwalk_goal goal) 656d89e710ffc0 Darrick J. Wong 2022-01-07 51 { 656d89e710ffc0 Darrick J. Wong 2022-01-07 @52 return goal < 0 ? XFS_ICWALK_NULL_TAG : goal; 656d89e710ffc0 Darrick J. Wong 2022-01-07 53 } 656d89e710ffc0 Darrick J. Wong 2022-01-07 54 :::::: The code at line 52 was first introduced by commit :::::: 656d89e710ffc01bc169a476208c84a0048cb554 xfs: pass the goal of the incore inode walk to xfs_inode_walk() :::::: TO: Darrick J. Wong <djwong(a)kernel.org> :::::: CC: Zheng Zengkai <zhengzengkai(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
by Liu Jian 09 Sep '24

09 Sep '24

From: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> stable inclusion from stable-v5.10.224 commit b7b8d9f5e679af60c94251fd6728dde34be69a71 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYL CVE: CVE-2024-44971 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit e3862093ee93fcfbdadcb7957f5f8974fffa806a ] bcm_sf2_mdio_register() calls of_phy_find_device() and then phy_device_remove() in a loop to remove existing PHY devices. of_phy_find_device() eventually calls bus_find_device(), which calls get_device() on the returned struct device * to increment the refcount. The current implementation does not decrement the refcount, which causes memory leak. This commit adds the missing phy_device_free() call to decrement the refcount via put_device() to balance the refcount. Fixes: 771089c2a485 ("net: dsa: bcm_sf2: Ensure that MDIO diversion is used") Signed-off-by: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> Tested-by: Florian Fainelli <florian.fainelli(a)broadcom.com> Reviewed-by: Florian Fainelli <florian.fainelli(a)broadcom.com> Link: https://patch.msgid.link/20240806011327.3817861-1-joe@pf.is.s.u-tokyo.ac.jp Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/dsa/bcm_sf2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c index a5849663f65c..d0f94a5fae5a 100644 --- a/drivers/net/dsa/bcm_sf2.c +++ b/drivers/net/dsa/bcm_sf2.c @@ -558,8 +558,10 @@ static int bcm_sf2_mdio_register(struct dsa_switch *ds) of_remove_property(child, prop); phydev = of_phy_find_device(child); - if (phydev) + if (phydev) { phy_device_remove(phydev); + phy_device_free(phydev); + } } err = mdiobus_register(priv->slave_mii_bus); -- 2.34.1

2 1

[PATCH OLK-5.10] mptcp: pm: avoid possible UaF when selecting endp
by Liu Jian 09 Sep '24

09 Sep '24

From: "Matthieu Baerts (NGI0)" <matttbe(a)kernel.org> mainline inclusion from mainline-v6.11-rc5 commit 48e50dcbcbaaf713d82bf2da5c16aeced94ad07d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY17 CVE: CVE-2024-44974 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free. A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with. Reported-by: Paolo Abeni <pabeni(a)redhat.com> Closes: https://lore.kernel.org/45cd30d3-7710-491c-ae4d-a1368c00beb1@redhat.com Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") Cc: stable(a)vger.kernel.org Reviewed-by: Mat Martineau <martineau(a)kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-14-38035d40de5… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/mptcp/pm_netlink.c [Did not backport 90d930882139 ("mptcp: constify a bunch of of helpers"), 85df533a787b ("mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set"), 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/mptcp/pm_netlink.c | 44 ++++++++++++++++++++++++------------------ 1 file changed, 25 insertions(+), 19 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index 0d6f3d912891..824420c4e8f9 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -128,11 +128,13 @@ static bool lookup_subflow_by_saddr(const struct list_head *list, return false; } -static struct mptcp_pm_addr_entry * +static bool select_local_address(const struct pm_nl_pernet *pernet, - struct mptcp_sock *msk) + struct mptcp_sock *msk, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; rcu_read_lock(); spin_lock_bh(&msk->join_list_lock); @@ -146,19 +148,23 @@ select_local_address(const struct pm_nl_pernet *pernet, if (entry->addr.family == ((struct sock *)msk)->sk_family && !lookup_subflow_by_saddr(&msk->conn_list, &entry->addr) && !lookup_subflow_by_saddr(&msk->join_list, &entry->addr)) { - ret = entry; + *new_entry = *entry; + found = true; break; } } spin_unlock_bh(&msk->join_list_lock); rcu_read_unlock(); - return ret; + + return found; } -static struct mptcp_pm_addr_entry * -select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) +static bool +select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; int i = 0; rcu_read_lock(); @@ -171,12 +177,14 @@ select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) if (!(entry->addr.flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) continue; if (i++ == pos) { - ret = entry; + *new_entry = *entry; + found = true; break; } } rcu_read_unlock(); - return ret; + + return found; } static void check_work_pending(struct mptcp_sock *msk) @@ -306,7 +314,7 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) { struct mptcp_addr_info remote = { 0 }; struct sock *sk = (struct sock *)msk; - struct mptcp_pm_addr_entry *local; + struct mptcp_pm_addr_entry local; struct pm_nl_pernet *pernet; pernet = net_generic(sock_net((struct sock *)msk), pm_nl_pernet_id); @@ -318,13 +326,12 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) /* check first for announce */ if (msk->pm.add_addr_signaled < msk->pm.add_addr_signal_max) { - local = select_signal_address(pernet, - msk->pm.add_addr_signaled); - if (local) { - if (mptcp_pm_alloc_anno_list(msk, local)) { + if (select_signal_address(pernet, + msk->pm.add_addr_signaled, &local)) { + if (mptcp_pm_alloc_anno_list(msk, &local)) { msk->pm.add_addr_signaled++; - mptcp_pm_announce_addr(msk, &local->addr, false); + mptcp_pm_announce_addr(msk, &local.addr, false); } } else { /* pick failed, avoid fourther attempts later */ @@ -339,13 +346,12 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) msk->pm.subflows < msk->pm.subflows_max) { remote_address((struct sock_common *)sk, &remote); - local = select_local_address(pernet, msk); - if (local) { + if (select_local_address(pernet, msk, &local)) { msk->pm.local_addr_used++; msk->pm.subflows++; check_work_pending(msk); spin_unlock_bh(&msk->pm.lock); - __mptcp_subflow_connect(sk, &local->addr, &remote); + __mptcp_subflow_connect(sk, &local.addr, &remote); spin_lock_bh(&msk->pm.lock); return; } -- 2.34.1

2 1

[PATCH OLK-6.6] bnxt_en: Fix double DMA unmapping for XDP_REDIRECT
by Liu Jian 09 Sep '24

09 Sep '24

From: Somnath Kotur <somnath.kotur(a)broadcom.com> stable inclusion from stable-v6.6.48 commit fa4e6ae38574d0fc5596272bee64727d8ab7052b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZU CVE: CVE-2024-44984 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 8baeef7616d5194045c5a6b97fd1246b87c55b13 ] Remove the dma_unmap_page_attrs() call in the driver's XDP_REDIRECT code path. This should have been removed when we let the page pool handle the DMA mapping. This bug causes the warning: WARNING: CPU: 7 PID: 59 at drivers/iommu/dma-iommu.c:1198 iommu_dma_unmap_page+0xd5/0x100 CPU: 7 PID: 59 Comm: ksoftirqd/7 Tainted: G W 6.8.0-1010-gcp #11-Ubuntu Hardware name: Dell Inc. PowerEdge R7525/0PYVT1, BIOS 2.15.2 04/02/2024 RIP: 0010:iommu_dma_unmap_page+0xd5/0x100 Code: 89 ee 48 89 df e8 cb f2 69 ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff 45 31 c0 e9 ab 17 71 00 <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 RSP: 0018:ffffab1fc0597a48 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff99ff838280c8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffab1fc0597a78 R08: 0000000000000002 R09: ffffab1fc0597c1c R10: ffffab1fc0597cd3 R11: ffff99ffe375acd8 R12: 00000000e65b9000 R13: 0000000000000050 R14: 0000000000001000 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffff9a06efb80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000565c34c37210 CR3: 00000005c7e3e000 CR4: 0000000000350ef0 ? show_regs+0x6d/0x80 ? __warn+0x89/0x150 ? iommu_dma_unmap_page+0xd5/0x100 ? report_bug+0x16a/0x190 ? handle_bug+0x51/0xa0 ? exc_invalid_op+0x18/0x80 ? iommu_dma_unmap_page+0xd5/0x100 ? iommu_dma_unmap_page+0x35/0x100 dma_unmap_page_attrs+0x55/0x220 ? bpf_prog_4d7e87c0d30db711_xdp_dispatcher+0x64/0x9f bnxt_rx_xdp+0x237/0x520 [bnxt_en] bnxt_rx_pkt+0x640/0xdd0 [bnxt_en] __bnxt_poll_work+0x1a1/0x3d0 [bnxt_en] bnxt_poll+0xaa/0x1e0 [bnxt_en] __napi_poll+0x33/0x1e0 net_rx_action+0x18a/0x2f0 Fixes: 578fcfd26e2a ("bnxt_en: Let the page pool manage the DMA mapping") Reviewed-by: Andy Gospodarek <andrew.gospodarek(a)broadcom.com> Reviewed-by: Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> Signed-off-by: Somnath Kotur <somnath.kotur(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Reviewed-by: Jacob Keller <jacob.e.keller(a)intel.com> Link: https://patch.msgid.link/20240820203415.168178-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c index 8cb9a99154aa..2845796f782c 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c @@ -297,11 +297,6 @@ bool bnxt_rx_xdp(struct bnxt *bp, struct bnxt_rx_ring_info *rxr, u16 cons, * redirect is coming from a frame received by the * bnxt_en driver. */ - rx_buf = &rxr->rx_buf_ring[cons]; - mapping = rx_buf->mapping - bp->rx_dma_offset; - dma_unmap_page_attrs(&pdev->dev, mapping, - BNXT_RX_PAGE_SIZE, bp->rx_dir, - DMA_ATTR_WEAK_ORDERING); /* if we are unable to allocate a new buffer, abort and reuse */ if (bnxt_alloc_rx_data(bp, rxr, rxr->rx_prod, GFP_ATOMIC)) { -- 2.34.1

2 1

[PATCH OLK-6.6] mptcp: pm: avoid possible UaF when selecting endp
by Liu Jian 09 Sep '24

09 Sep '24

From: "Matthieu Baerts (NGI0)" <matttbe(a)kernel.org> stable inclusion from stable-v6.6.48 commit 9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY17 CVE: CVE-2024-44974 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- commit 48e50dcbcbaaf713d82bf2da5c16aeced94ad07d upstream. select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free. A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with. Reported-by: Paolo Abeni <pabeni(a)redhat.com> Closes: https://lore.kernel.org/45cd30d3-7710-491c-ae4d-a1368c00beb1@redhat.com Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") Cc: stable(a)vger.kernel.org Reviewed-by: Mat Martineau <martineau(a)kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-14-38035d40de5… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/mptcp/pm_netlink.c | 64 ++++++++++++++++++++++-------------------- 1 file changed, 34 insertions(+), 30 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index b81fa77ce054..aa56696cdc78 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -148,11 +148,13 @@ static bool lookup_subflow_by_daddr(const struct list_head *list, return false; } -static struct mptcp_pm_addr_entry * +static bool select_local_address(const struct pm_nl_pernet *pernet, - const struct mptcp_sock *msk) + const struct mptcp_sock *msk, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; msk_owned_by_me(msk); @@ -164,17 +166,21 @@ select_local_address(const struct pm_nl_pernet *pernet, if (!test_bit(entry->addr.id, msk->pm.id_avail_bitmap)) continue; - ret = entry; + *new_entry = *entry; + found = true; break; } rcu_read_unlock(); - return ret; + + return found; } -static struct mptcp_pm_addr_entry * -select_signal_address(struct pm_nl_pernet *pernet, const struct mptcp_sock *msk) +static bool +select_signal_address(struct pm_nl_pernet *pernet, const struct mptcp_sock *msk, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; rcu_read_lock(); /* do not keep any additional per socket state, just signal @@ -189,11 +195,13 @@ select_signal_address(struct pm_nl_pernet *pernet, const struct mptcp_sock *msk) if (!(entry->flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) continue; - ret = entry; + *new_entry = *entry; + found = true; break; } rcu_read_unlock(); - return ret; + + return found; } unsigned int mptcp_pm_get_add_addr_signal_max(const struct mptcp_sock *msk) @@ -520,9 +528,10 @@ __lookup_addr(struct pm_nl_pernet *pernet, const struct mptcp_addr_info *info, static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) { - struct mptcp_pm_addr_entry *local, *signal_and_subflow = NULL; struct sock *sk = (struct sock *)msk; + struct mptcp_pm_addr_entry local; unsigned int add_addr_signal_max; + bool signal_and_subflow = false; unsigned int local_addr_max; struct pm_nl_pernet *pernet; unsigned int subflows_max; @@ -573,23 +582,22 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) if (msk->pm.addr_signal & BIT(MPTCP_ADD_ADDR_SIGNAL)) return; - local = select_signal_address(pernet, msk); - if (!local) + if (!select_signal_address(pernet, msk, &local)) goto subflow; /* If the alloc fails, we are on memory pressure, not worth * continuing, and trying to create subflows. */ - if (!mptcp_pm_alloc_anno_list(msk, &local->addr)) + if (!mptcp_pm_alloc_anno_list(msk, &local.addr)) return; - __clear_bit(local->addr.id, msk->pm.id_avail_bitmap); + __clear_bit(local.addr.id, msk->pm.id_avail_bitmap); msk->pm.add_addr_signaled++; - mptcp_pm_announce_addr(msk, &local->addr, false); + mptcp_pm_announce_addr(msk, &local.addr, false); mptcp_pm_nl_addr_send_ack(msk); - if (local->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW) - signal_and_subflow = local; + if (local.flags & MPTCP_PM_ADDR_FLAG_SUBFLOW) + signal_and_subflow = true; } subflow: @@ -600,26 +608,22 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) bool fullmesh; int i, nr; - if (signal_and_subflow) { - local = signal_and_subflow; - signal_and_subflow = NULL; - } else { - local = select_local_address(pernet, msk); - if (!local) - break; - } + if (signal_and_subflow) + signal_and_subflow = false; + else if (!select_local_address(pernet, msk, &local)) + break; - fullmesh = !!(local->flags & MPTCP_PM_ADDR_FLAG_FULLMESH); + fullmesh = !!(local.flags & MPTCP_PM_ADDR_FLAG_FULLMESH); msk->pm.local_addr_used++; - __clear_bit(local->addr.id, msk->pm.id_avail_bitmap); - nr = fill_remote_addresses_vec(msk, &local->addr, fullmesh, addrs); + __clear_bit(local.addr.id, msk->pm.id_avail_bitmap); + nr = fill_remote_addresses_vec(msk, &local.addr, fullmesh, addrs); if (nr == 0) continue; spin_unlock_bh(&msk->pm.lock); for (i = 0; i < nr; i++) - __mptcp_subflow_connect(sk, &local->addr, &addrs[i]); + __mptcp_subflow_connect(sk, &local.addr, &addrs[i]); spin_lock_bh(&msk->pm.lock); } mptcp_pm_nl_check_work_pending(msk); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] usb: gadget: core: Check for unset descriptor
by Ye Bin 09 Sep '24

09 Sep '24

From: Chris Wulff <crwulff(a)gmail.com> mainline inclusion from mainline-v6.11-rc3 commit 973a57891608a98e894db2887f278777f564de18 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZ1 CVE: CVE-2024-44960 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set up the endpoint for the current speed, or the gadget descriptors are malformed and the descriptor for the speed/endpoint are not found. No current gadget driver is known to have this problem, but this may cause a hard-to-find bug during development of new gadgets. Fixes: 54f83b8c8ea9 ("USB: gadget: Reject endpoints with 0 maxpacket value") Cc: stable(a)vger.kernel.org Signed-off-by: Chris Wulff <crwulff(a)gmail.com> Link: https://lore.kernel.org/r/20240725010419.314430-2-crwulff@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/usb/gadget/udc/core.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index b45dd7827ff9..1335a715f5dd 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -99,12 +99,10 @@ int usb_ep_enable(struct usb_ep *ep) goto out; /* UDC drivers can't handle endpoints with maxpacket size 0 */ - if (usb_endpoint_maxp(ep->desc) == 0) { - /* - * We should log an error message here, but we can't call - * dev_err() because there's no way to find the gadget - * given only ep. - */ + if (!ep->desc || usb_endpoint_maxp(ep->desc) == 0) { + WARN_ONCE(1, "%s: ep%d (%s) has %s\n", __func__, ep->address, ep->name, + (!ep->desc) ? "NULL descriptor" : "maxpacket 0"); + ret = -EINVAL; goto out; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] usb: gadget: core: Check for unset descriptor
by Ye Bin 09 Sep '24

09 Sep '24

From: Chris Wulff <crwulff(a)gmail.com> mainline inclusion from mainline-v6.11-rc3 commit 973a57891608a98e894db2887f278777f564de18 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZ1 CVE: CVE-2024-44960 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set up the endpoint for the current speed, or the gadget descriptors are malformed and the descriptor for the speed/endpoint are not found. No current gadget driver is known to have this problem, but this may cause a hard-to-find bug during development of new gadgets. Fixes: 54f83b8c8ea9 ("USB: gadget: Reject endpoints with 0 maxpacket value") Cc: stable(a)vger.kernel.org Signed-off-by: Chris Wulff <crwulff(a)gmail.com> Link: https://lore.kernel.org/r/20240725010419.314430-2-crwulff@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/usb/gadget/udc/core.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 7330c1999104..77ee0dbc52c5 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -99,12 +99,10 @@ int usb_ep_enable(struct usb_ep *ep) goto out; /* UDC drivers can't handle endpoints with maxpacket size 0 */ - if (usb_endpoint_maxp(ep->desc) == 0) { - /* - * We should log an error message here, but we can't call - * dev_err() because there's no way to find the gadget - * given only ep. - */ + if (!ep->desc || usb_endpoint_maxp(ep->desc) == 0) { + WARN_ONCE(1, "%s: ep%d (%s) has %s\n", __func__, ep->address, ep->name, + (!ep->desc) ? "NULL descriptor" : "maxpacket 0"); + ret = -EINVAL; goto out; } -- 2.34.1

2 1

[PATCH OLK-5.10] usb: gadget: core: Check for unset descriptor
by Ye Bin 09 Sep '24

09 Sep '24

From: Chris Wulff <crwulff(a)gmail.com> mainline inclusion from mainline-v6.11-rc3 commit 973a57891608a98e894db2887f278777f564de18 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZ1 CVE: CVE-2024-44960 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set up the endpoint for the current speed, or the gadget descriptors are malformed and the descriptor for the speed/endpoint are not found. No current gadget driver is known to have this problem, but this may cause a hard-to-find bug during development of new gadgets. Fixes: 54f83b8c8ea9 ("USB: gadget: Reject endpoints with 0 maxpacket value") Cc: stable(a)vger.kernel.org Signed-off-by: Chris Wulff <crwulff(a)gmail.com> Link: https://lore.kernel.org/r/20240725010419.314430-2-crwulff@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/usb/gadget/udc/core.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index e80aa717c8b5..dd2fafc5b0c3 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -99,12 +99,10 @@ int usb_ep_enable(struct usb_ep *ep) goto out; /* UDC drivers can't handle endpoints with maxpacket size 0 */ - if (usb_endpoint_maxp(ep->desc) == 0) { - /* - * We should log an error message here, but we can't call - * dev_err() because there's no way to find the gadget - * given only ep. - */ + if (!ep->desc || usb_endpoint_maxp(ep->desc) == 0) { + WARN_ONCE(1, "%s: ep%d (%s) has %s\n", __func__, ep->address, ep->name, + (!ep->desc) ? "NULL descriptor" : "maxpacket 0"); + ret = -EINVAL; goto out; } -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 14696/23701] drivers/base/node.c:429:5: sparse: sparse: symbol 'register_mem_block_under_node_early' was not declared. Should it be static?
by kernel test robot 07 Sep '24

07 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 13b424f97ef548612c760cfd0892f96de96707e0 commit: f38a43c2e1f2214acbda5d46af4518aa1d9d5e92 [14696/23701] mm: don't rely on system state to detect hot-plug operations config: x86_64-randconfig-123-20240906 (https://download.01.org/0day-ci/archive/20240907/202409072051.qFE23qXy-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240907/202409072051.qFE23qXy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409072051.qFE23qXy-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/base/node.c:429:5: sparse: sparse: symbol 'register_mem_block_under_node_early' was not declared. Should it be static? drivers/base/node.c:429:5: warning: no previous prototype for 'register_mem_block_under_node_early' [-Wmissing-prototypes] 429 | int register_mem_block_under_node_early(struct memory_block *mem_blk, void *arg) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/register_mem_block_under_node_early +429 drivers/base/node.c 427 428 /* register memory section under specified node if it spans that node */ > 429 int register_mem_block_under_node_early(struct memory_block *mem_blk, void *arg) 430 { 431 int nid = *(int *)arg; 432 unsigned long pfn, sect_start_pfn, sect_end_pfn; 433 434 sect_start_pfn = section_nr_to_pfn(mem_blk->start_section_nr); 435 sect_end_pfn = section_nr_to_pfn(mem_blk->end_section_nr); 436 sect_end_pfn += PAGES_PER_SECTION - 1; 437 for (pfn = sect_start_pfn; pfn <= sect_end_pfn; pfn++) { 438 int page_nid; 439 440 /* 441 * memory block could have several absent sections from start. 442 * skip pfn range from absent section 443 */ 444 if (!pfn_present(pfn)) { 445 pfn = round_down(pfn + PAGES_PER_SECTION, 446 PAGES_PER_SECTION) - 1; 447 continue; 448 } 449 450 /* 451 * We need to check if page belongs to nid only at the boot 452 * case because node's ranges can be interleaved. 453 */ 454 page_nid = get_nid_for_pfn(pfn); 455 if (page_nid < 0) 456 continue; 457 if (page_nid != nid) 458 continue; 459 460 return do_register_memory_block_under_node(nid, mem_blk); 461 } 462 /* mem section does not span the specified node */ 463 return 0; 464 } 465 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 7679/30000] kernel/locking/lockdep.o: warning: objtool: lockdep_unregister_key()+0x30b: unreachable instruction
by kernel test robot 07 Sep '24

07 Sep '24

Hi Waiman, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c431540f5e2720652e293713c7358952cd0148de commit: b91170be2b1f1ef673f5e79c7a4beb5673a8f881 [7679/30000] locking/lockdep: Avoid potential access of invalid memory in lock_class config: x86_64-randconfig-073-20240907 (https://download.01.org/0day-ci/archive/20240907/202409071717.JoTK5KQp-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240907/202409071717.JoTK5KQp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409071717.JoTK5KQp-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/locking/lockdep.o: warning: objtool: lockdep_unregister_key()+0x30b: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v2 0/2] CVE-2024-44972
by Yifan Qiao 07 Sep '24

07 Sep '24

Change Log: v2: Add CVE number inside the commit msg. Naohiro Aota (1): btrfs: fix invalid mapping of extent xarray state Qu Wenruo (1): btrfs: do not clear page dirty inside extent_write_locked_range() fs/btrfs/extent_io.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) -- 2.39.2

2 3

[openeuler:OLK-5.10] BUILD REGRESSION c431540f5e2720652e293713c7358952cd0148de
by kernel test robot 07 Sep '24

07 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: c431540f5e2720652e293713c7358952cd0148de !11041 coresight: etm4x: Fix unbalanced pm_runtime_enable() Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202409062029.0Fv1YZCJ-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `fmgr_usr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration |-- arm64-randconfig-002-20240907 | `-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration |-- arm64-randconfig-004-20240907 | `-- mm-memcontrol.c:error:implicit-declaration-of-function-ksm_process_profit |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-allyesconfig | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | |-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-function-mcp251xfd_tx_obj_write_sync | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_mbx_set_vf_multi_tc | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_tm_vf_tc_dwrr_cfg | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:variable-err-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-direction-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-queue-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-direction-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-queue-description-in-rnpvf_set_ring_vector | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_CTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_dispatch_event | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_net_exit | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-ctx-not-described-in-ubcore_update_uvs_eid_ret | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-dev-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-req-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-function-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-function-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TPG-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-function-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-function-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_UTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-function-ubcore_hash_table_rmv_vtpn | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_get_umap_ops | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_umap_priv_init | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_unmap_vma_pages | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-001-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-002-20240907 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-003-20240907 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-004-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-005-20240907 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-006-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-defconfig | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-001-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-002-20240907 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-003-20240906 | `-- multiple-definition-of-fmgr_usr_cmd_op-drivers-net-ethernet-netswift-txgbe-txgbe_hw.o:drivers-net-ethernet-netswift-txgbe-txgbe_type.h:first-defined-here |-- x86_64-randconfig-003-20240907 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-004-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-005-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-006-20240907 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-011-20240907 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-usb-dwc2-core_intr.c:error:struct-dwc2_hsotg-has-no-member-named-bus_suspended | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-012-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-013-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-014-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-015-20240907 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register `-- x86_64-rhel-8.3-rust |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register elapsed time: 1235m configs tested: 27 configs skipped: 128 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240907 gcc-14.1.0 arm64 randconfig-002-20240907 gcc-14.1.0 arm64 randconfig-003-20240907 gcc-14.1.0 arm64 randconfig-004-20240907 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240907 gcc-12 x86_64 buildonly-randconfig-002-20240907 gcc-12 x86_64 buildonly-randconfig-003-20240907 gcc-11 x86_64 buildonly-randconfig-004-20240907 clang-18 x86_64 buildonly-randconfig-005-20240907 gcc-12 x86_64 buildonly-randconfig-006-20240907 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240907 clang-18 x86_64 randconfig-002-20240907 gcc-12 x86_64 randconfig-003-20240907 gcc-12 x86_64 randconfig-004-20240907 clang-18 x86_64 randconfig-005-20240907 gcc-12 x86_64 randconfig-006-20240907 gcc-11 x86_64 randconfig-011-20240907 gcc-12 x86_64 randconfig-012-20240907 gcc-12 x86_64 randconfig-013-20240907 gcc-12 x86_64 randconfig-014-20240907 gcc-12 x86_64 randconfig-015-20240907 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13801/13880] include/linux/compiler_types.h:451:45: error: call to '__compiletime_assert_465' declared with attribute error: BUILD_BUG failed
by kernel test robot 07 Sep '24

07 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 10e0ea7796b38b1d35a6969966016d7a42d77b7f commit: c7fcbe1041758d0dedc32502609a73a22884d7b8 [13801/13880] mm: shmem: Merge shmem_alloc_hugefolio() with shmem_alloc_folio() config: arm64-randconfig-001-20240907 (https://download.01.org/0day-ci/archive/20240907/202409071355.c5MmsI6J-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240907/202409071355.c5MmsI6J-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409071355.c5MmsI6J-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from <command-line>: mm/shmem.c: In function 'shmem_alloc_folio.constprop.isra': >> include/linux/compiler_types.h:451:45: error: call to '__compiletime_assert_465' declared with attribute error: BUILD_BUG failed 451 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | ^ include/linux/compiler_types.h:432:25: note: in definition of macro '__compiletime_assert' 432 | prefix ## suffix(); \ | ^~~~~~ include/linux/compiler_types.h:451:9: note: in expansion of macro '_compiletime_assert' 451 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | ^~~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert' 39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) | ^~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:59:21: note: in expansion of macro 'BUILD_BUG_ON_MSG' 59 | #define BUILD_BUG() BUILD_BUG_ON_MSG(1, "BUILD_BUG failed") | ^~~~~~~~~~~~~~~~ include/linux/huge_mm.h:106:28: note: in expansion of macro 'BUILD_BUG' 106 | #define HPAGE_PMD_SHIFT ({ BUILD_BUG(); 0; }) | ^~~~~~~~~ include/linux/huge_mm.h:110:26: note: in expansion of macro 'HPAGE_PMD_SHIFT' 110 | #define HPAGE_PMD_ORDER (HPAGE_PMD_SHIFT-PAGE_SHIFT) | ^~~~~~~~~~~~~~~ mm/shmem.c:1641:64: note: in expansion of macro 'HPAGE_PMD_ORDER' 1641 | folio = vma_alloc_folio(gfp, order, &pvma, 0, order == HPAGE_PMD_ORDER); | ^~~~~~~~~~~~~~~ vim +/__compiletime_assert_465 +451 include/linux/compiler_types.h eb5c2d4b45e3d2 Will Deacon 2020-07-21 437 eb5c2d4b45e3d2 Will Deacon 2020-07-21 438 #define _compiletime_assert(condition, msg, prefix, suffix) \ eb5c2d4b45e3d2 Will Deacon 2020-07-21 439 __compiletime_assert(condition, msg, prefix, suffix) eb5c2d4b45e3d2 Will Deacon 2020-07-21 440 eb5c2d4b45e3d2 Will Deacon 2020-07-21 441 /** eb5c2d4b45e3d2 Will Deacon 2020-07-21 442 * compiletime_assert - break build and emit msg if condition is false eb5c2d4b45e3d2 Will Deacon 2020-07-21 443 * @condition: a compile-time constant condition to check eb5c2d4b45e3d2 Will Deacon 2020-07-21 444 * @msg: a message to emit if condition is false eb5c2d4b45e3d2 Will Deacon 2020-07-21 445 * eb5c2d4b45e3d2 Will Deacon 2020-07-21 446 * In tradition of POSIX assert, this macro will break the build if the eb5c2d4b45e3d2 Will Deacon 2020-07-21 447 * supplied condition is *false*, emitting the supplied error message if the eb5c2d4b45e3d2 Will Deacon 2020-07-21 448 * compiler has support to do so. eb5c2d4b45e3d2 Will Deacon 2020-07-21 449 */ eb5c2d4b45e3d2 Will Deacon 2020-07-21 450 #define compiletime_assert(condition, msg) \ eb5c2d4b45e3d2 Will Deacon 2020-07-21 @451 _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) eb5c2d4b45e3d2 Will Deacon 2020-07-21 452 :::::: The code at line 451 was first introduced by commit :::::: eb5c2d4b45e3d2d5d052ea6b8f1463976b1020d5 compiler.h: Move compiletime_assert() macros into compiler_types.h :::::: TO: Will Deacon <will(a)kernel.org> :::::: CC: Will Deacon <will(a)kernel.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13863/13880] arch/arm64/kernel/virtcca_cvm_host.c:37:6: warning: no previous prototype for function 'is_virtcca_cvm_enable'
by kernel test robot 07 Sep '24

07 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 10e0ea7796b38b1d35a6969966016d7a42d77b7f commit: ed007ade0cef81fb47328683b8a7eec5edfa8494 [13863/13880] virtcca feature: secure smmu init config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240907/202409071200.Tf9aVoeY-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 05f5a91d00b02f4369f46d076411c700755ae041) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240907/202409071200.Tf9aVoeY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409071200.Tf9aVoeY-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/arm64/kernel/virtcca_cvm_host.c:6: In file included from include/linux/mm.h:2242: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kernel/virtcca_cvm_host.c:37:6: warning: no previous prototype for function 'is_virtcca_cvm_enable' [-Wmissing-prototypes] 37 | bool is_virtcca_cvm_enable(void) | ^ arch/arm64/kernel/virtcca_cvm_host.c:37:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 37 | bool is_virtcca_cvm_enable(void) | ^ | static 6 warnings generated. -- >> arch/arm64/kvm/tmi.c:142: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write command to command queue arch/arm64/kvm/tmi.c:166: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Map mmio stage2 translation for device arch/arm64/kvm/tmi.c:180: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Unmap mmio stage2 translation for device arch/arm64/kvm/tmi.c:193: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write device mmio arch/arm64/kvm/tmi.c:208: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Read device mmio arch/arm64/kvm/tmi.c:233: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Attach device and configure L2 ste before activate CVM arch/arm64/kvm/tmi.c:276: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write smmu secure register arch/arm64/kvm/tmi.c:290: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Read smmu secure register -- In file included from drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:6: In file included from include/linux/pci.h:1669: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2242: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:509:13: warning: no previous prototype for function 'virtcca_smmu_evtq_thread' [-Wmissing-prototypes] 509 | irqreturn_t virtcca_smmu_evtq_thread(int irq, void *dev) | ^ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:509:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 509 | irqreturn_t virtcca_smmu_evtq_thread(int irq, void *dev) | ^ | static >> drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:527:13: warning: no previous prototype for function 'virtcca_smmu_gerror_handler' [-Wmissing-prototypes] 527 | irqreturn_t virtcca_smmu_gerror_handler(int irq, void *dev) | ^ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:527:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 527 | irqreturn_t virtcca_smmu_gerror_handler(int irq, void *dev) | ^ | static 7 warnings generated. -- >> drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:58: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Traverse pcie topology to find the root <bus,device> number drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:80: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Traverse pcie topology to find child devices drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:118: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Get all devices which share the same root_bd as dev drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:146: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Add device obj to hash tablse drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:183: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Whether the root port is secure or not drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:204: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Whether the vm is confidential vm drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:225: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Whether the stream id of dev is confidential drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:246: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Whether the cmd queue need transfer to secure world drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:298: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write queue command to TMM drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:328: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write a batch of queue command to TMM, if need sync, will send additional cmd queue drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:383: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Initialize a queue of the corresponding type drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:424: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write values to secure smmu registers and wait for completion drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:449: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write values to glabal bypass register drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:485: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Disable the secure smmu drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:505: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * The secure evt queue thread drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:520: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * The secure gerror handler drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:590: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Disable secure smmu irq function drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:603: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Enable secure smmu irq function drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:617: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Get irq index from platform drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:636: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Complete the stage2 page table establishment for the security device drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:691: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Setting up the STE config content for the security device drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:729: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Add secure device to hash table drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:766: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Delegate device to secure state drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:815: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Enable the PCIe protection controller function of the security device drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:844: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write secure smmu msi msg drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:877: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Enable secure smmu msi drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:907: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Set secure irq handle drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:945: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Write value to smmu registers and wait for completion drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:965: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Initialize the smmu irq drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:1016: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * For SMMU, it has various uses. In virtCCA scenario, drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:1044: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Enable the smmu secure state drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:1079: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Whether the smmu support secure registers and secure stage2 translate drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:1113: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Implement security settings for corresponding devices targeting the secure smmu domain drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:1171: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Initialize the smmu security features vim +/is_virtcca_cvm_enable +37 arch/arm64/kernel/virtcca_cvm_host.c 36 > 37 bool is_virtcca_cvm_enable(void) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 5435/23701] drivers/tty/serial/sc16is7xx.c:1501:1: warning: label 'err_i2c' defined but not used
by kernel test robot 07 Sep '24

07 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 13b424f97ef548612c760cfd0892f96de96707e0 commit: 1c30433d9fa5c5b48039990ba214c0e8e199a22d [5435/23701] sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init() config: x86_64-randconfig-121-20240906 (https://download.01.org/0day-ci/archive/20240907/202409071206.ARybrxJe-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240907/202409071206.ARybrxJe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409071206.ARybrxJe-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/tty/serial/sc16is7xx.c:1501:1: sparse: sparse: unused label 'err_i2c' drivers/tty/serial/sc16is7xx.c: In function 'sc16is7xx_init': >> drivers/tty/serial/sc16is7xx.c:1501:1: warning: label 'err_i2c' defined but not used [-Wunused-label] 1501 | err_i2c: | ^~~~~~~ vim +/err_i2c +1501 drivers/tty/serial/sc16is7xx.c 1487 1488 #ifdef CONFIG_SERIAL_SC16IS7XX_SPI 1489 ret = spi_register_driver(&sc16is7xx_spi_uart_driver); 1490 if (ret < 0) { 1491 pr_err("failed to init sc16is7xx spi --> %d\n", ret); 1492 goto err_spi; 1493 } 1494 #endif 1495 return ret; 1496 1497 err_spi: 1498 #ifdef CONFIG_SERIAL_SC16IS7XX_I2C 1499 i2c_del_driver(&sc16is7xx_i2c_uart_driver); 1500 #endif > 1501 err_i2c: 1502 uart_unregister_driver(&sc16is7xx_uart); 1503 return ret; 1504 } 1505 module_init(sc16is7xx_init); 1506 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] nfs: fix memory leak in error path of nfs4_do_reclaim
by Li Lingfeng 07 Sep '24

07 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAPAZ3 -------------------------------- Commit c77e22834ae9 ("NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()") separate out the freeing of the state owners from nfs4_purge_state_owners() and finish it outside the rcu lock. However, the error path is omitted. As a result, the state owners in "freeme" will not be released. Fix it by adding freeing in the error path. Fixes: c77e22834ae9 ("NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4state.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c index 9a5d911a7edc..ae031c89251b 100644 --- a/fs/nfs/nfs4state.c +++ b/fs/nfs/nfs4state.c @@ -1957,6 +1957,7 @@ static int nfs4_do_reclaim(struct nfs_client *clp, const struct nfs4_state_recov set_bit(ops->owner_flag_bit, &sp->so_flags); nfs4_put_state_owner(sp); status = nfs4_recovery_handle_error(clp, status); + nfs4_free_state_owners(&freeme); return (status != 0) ? status : -EAGAIN; } -- 2.31.1

2 1

[PATCH OLK-5.10] nfs: fix memory leak in error path of nfs4_do_reclaim
by Li Lingfeng 07 Sep '24

07 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAOYZS -------------------------------- Commit c77e22834ae9 ("NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()") separate out the freeing of the state owners from nfs4_purge_state_owners() and finish it outside the rcu lock. However, the error path is omitted. As a result, the state owners in "freeme" will not be released. Fix it by adding freeing in the error path. Fixes: c77e22834ae9 ("NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4state.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c index afb617a4a7e4..f5ebb747ddf4 100644 --- a/fs/nfs/nfs4state.c +++ b/fs/nfs/nfs4state.c @@ -1948,6 +1948,7 @@ static int nfs4_do_reclaim(struct nfs_client *clp, const struct nfs4_state_recov set_bit(ops->owner_flag_bit, &sp->so_flags); nfs4_put_state_owner(sp); status = nfs4_recovery_handle_error(clp, status); + nfs4_free_state_owners(&freeme); return (status != 0) ? status : -EAGAIN; } -- 2.31.1

2 1

[openeuler:openEuler-1.0-LTS 5421/23701] arch/arm64/kernel/ptrace.c:1379:38: sparse: sparse: incorrect type in argument 6 (different address spaces)
by kernel test robot 07 Sep '24

07 Sep '24

Hi Paulo, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 13b424f97ef548612c760cfd0892f96de96707e0 commit: 71e217e85c3dff8a9151707ed3afc7b4b054a2d4 [5421/23701] selinux: use kernel linux/socket.h for genheaders and mdp config: arm64-randconfig-r131-20240906 (https://download.01.org/0day-ci/archive/20240907/202409071155.6ow4kT3d-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240907/202409071155.6ow4kT3d-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409071155.6ow4kT3d-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/arm64/kernel/ptrace.c:1379:38: sparse: sparse: incorrect type in argument 6 (different address spaces) @@ expected void const [noderef] <asn:1> *data @@ got unsigned int * @@ arch/arm64/kernel/ptrace.c:1379:38: sparse: expected void const [noderef] <asn:1> *data arch/arm64/kernel/ptrace.c:1379:38: sparse: got unsigned int * arch/arm64/kernel/ptrace.c:1637:5: warning: no previous prototype for 'syscall_trace_enter' [-Wmissing-prototypes] 1637 | int syscall_trace_enter(struct pt_regs *regs) | ^~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/ptrace.c:1655:6: warning: no previous prototype for 'syscall_trace_exit' [-Wmissing-prototypes] 1655 | void syscall_trace_exit(struct pt_regs *regs) | ^~~~~~~~~~~~~~~~~~ -- >> arch/arm64/kernel/traps.c:77:23: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected unsigned int [noderef] <asn:1> *__p @@ got unsigned int [usertype] * @@ arch/arm64/kernel/traps.c:77:23: sparse: expected unsigned int [noderef] <asn:1> *__p arch/arm64/kernel/traps.c:77:23: sparse: got unsigned int [usertype] * arch/arm64/kernel/traps.c:408:29: warning: no previous prototype for 'do_undefinstr' [-Wmissing-prototypes] 408 | asmlinkage void __exception do_undefinstr(struct pt_regs *regs) | ^~~~~~~~~~~~~ arch/arm64/kernel/traps.c:541:29: warning: no previous prototype for 'do_sysinstr' [-Wmissing-prototypes] 541 | asmlinkage void __exception do_sysinstr(unsigned int esr, struct pt_regs *regs) | ^~~~~~~~~~~ arch/arm64/kernel/traps.c:561:43: warning: initialized field overwritten [-Woverride-init] 561 | [ESR_ELx_EC_UNKNOWN] = "Unknown/Uncategorized", | ^~~~~~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:561:43: note: (near initialization for 'esr_class_str[0]') arch/arm64/kernel/traps.c:562:43: warning: initialized field overwritten [-Woverride-init] 562 | [ESR_ELx_EC_WFx] = "WFI/WFE", | ^~~~~~~~~ arch/arm64/kernel/traps.c:562:43: note: (near initialization for 'esr_class_str[1]') arch/arm64/kernel/traps.c:563:43: warning: initialized field overwritten [-Woverride-init] 563 | [ESR_ELx_EC_CP15_32] = "CP15 MCR/MRC", | ^~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:563:43: note: (near initialization for 'esr_class_str[3]') arch/arm64/kernel/traps.c:564:43: warning: initialized field overwritten [-Woverride-init] 564 | [ESR_ELx_EC_CP15_64] = "CP15 MCRR/MRRC", | ^~~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:564:43: note: (near initialization for 'esr_class_str[4]') arch/arm64/kernel/traps.c:565:43: warning: initialized field overwritten [-Woverride-init] 565 | [ESR_ELx_EC_CP14_MR] = "CP14 MCR/MRC", | ^~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:565:43: note: (near initialization for 'esr_class_str[5]') arch/arm64/kernel/traps.c:566:43: warning: initialized field overwritten [-Woverride-init] 566 | [ESR_ELx_EC_CP14_LS] = "CP14 LDC/STC", | ^~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:566:43: note: (near initialization for 'esr_class_str[6]') arch/arm64/kernel/traps.c:567:43: warning: initialized field overwritten [-Woverride-init] 567 | [ESR_ELx_EC_FP_ASIMD] = "ASIMD", | ^~~~~~~ arch/arm64/kernel/traps.c:567:43: note: (near initialization for 'esr_class_str[7]') arch/arm64/kernel/traps.c:568:43: warning: initialized field overwritten [-Woverride-init] 568 | [ESR_ELx_EC_CP10_ID] = "CP10 MRC/VMRS", | ^~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:568:43: note: (near initialization for 'esr_class_str[8]') arch/arm64/kernel/traps.c:569:43: warning: initialized field overwritten [-Woverride-init] 569 | [ESR_ELx_EC_CP14_64] = "CP14 MCRR/MRRC", | ^~~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:569:43: note: (near initialization for 'esr_class_str[12]') arch/arm64/kernel/traps.c:570:43: warning: initialized field overwritten [-Woverride-init] 570 | [ESR_ELx_EC_ILL] = "PSTATE.IL", | ^~~~~~~~~~~ arch/arm64/kernel/traps.c:570:43: note: (near initialization for 'esr_class_str[14]') arch/arm64/kernel/traps.c:571:43: warning: initialized field overwritten [-Woverride-init] 571 | [ESR_ELx_EC_SVC32] = "SVC (AArch32)", | ^~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:571:43: note: (near initialization for 'esr_class_str[17]') arch/arm64/kernel/traps.c:572:43: warning: initialized field overwritten [-Woverride-init] 572 | [ESR_ELx_EC_HVC32] = "HVC (AArch32)", | ^~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:572:43: note: (near initialization for 'esr_class_str[18]') arch/arm64/kernel/traps.c:573:43: warning: initialized field overwritten [-Woverride-init] 573 | [ESR_ELx_EC_SMC32] = "SMC (AArch32)", | ^~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:573:43: note: (near initialization for 'esr_class_str[19]') arch/arm64/kernel/traps.c:574:43: warning: initialized field overwritten [-Woverride-init] 574 | [ESR_ELx_EC_SVC64] = "SVC (AArch64)", | ^~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:574:43: note: (near initialization for 'esr_class_str[21]') arch/arm64/kernel/traps.c:575:43: warning: initialized field overwritten [-Woverride-init] 575 | [ESR_ELx_EC_HVC64] = "HVC (AArch64)", | ^~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:575:43: note: (near initialization for 'esr_class_str[22]') arch/arm64/kernel/traps.c:576:43: warning: initialized field overwritten [-Woverride-init] 576 | [ESR_ELx_EC_SMC64] = "SMC (AArch64)", | ^~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:576:43: note: (near initialization for 'esr_class_str[23]') arch/arm64/kernel/traps.c:577:43: warning: initialized field overwritten [-Woverride-init] 577 | [ESR_ELx_EC_SYS64] = "MSR/MRS (AArch64)", | ^~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:577:43: note: (near initialization for 'esr_class_str[24]') arch/arm64/kernel/traps.c:578:43: warning: initialized field overwritten [-Woverride-init] 578 | [ESR_ELx_EC_SVE] = "SVE", | ^~~~~ arch/arm64/kernel/traps.c:578:43: note: (near initialization for 'esr_class_str[25]') arch/arm64/kernel/traps.c:579:43: warning: initialized field overwritten [-Woverride-init] 579 | [ESR_ELx_EC_IMP_DEF] = "EL3 IMP DEF", | ^~~~~~~~~~~~~ arch/arm64/kernel/traps.c:579:43: note: (near initialization for 'esr_class_str[31]') arch/arm64/kernel/traps.c:580:43: warning: initialized field overwritten [-Woverride-init] 580 | [ESR_ELx_EC_IABT_LOW] = "IABT (lower EL)", | ^~~~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:580:43: note: (near initialization for 'esr_class_str[32]') arch/arm64/kernel/traps.c:581:43: warning: initialized field overwritten [-Woverride-init] 581 | [ESR_ELx_EC_IABT_CUR] = "IABT (current EL)", | ^~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/traps.c:581:43: note: (near initialization for 'esr_class_str[33]') arch/arm64/kernel/traps.c:582:43: warning: initialized field overwritten [-Woverride-init] -- >> arch/arm64/kernel/cpu_errata.c:277:1: sparse: sparse: symbol '__pcpu_scope_arm64_ssbd_callback_required' was not declared. Should it be static? arch/arm64/kernel/cpu_errata.c:311:13: warning: no previous prototype for 'arm64_update_smccc_conduit' [-Wmissing-prototypes] 311 | void __init arm64_update_smccc_conduit(struct alt_instr *alt, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/cpu_errata.c:333:13: warning: no previous prototype for 'arm64_enable_wa2_handling' [-Wmissing-prototypes] 333 | void __init arm64_enable_wa2_handling(struct alt_instr *alt, | ^~~~~~~~~~~~~~~~~~~~~~~~~ -- >> crypto/testmgr.c:1915:17: sparse: sparse: Variable length array is used. >> crypto/testmgr.c:1921:24: sparse: sparse: cast to restricted __le32 >> crypto/testmgr.c:1921:24: sparse: sparse: cast to restricted __le32 >> crypto/testmgr.c:1921:24: sparse: sparse: cast to restricted __le32 >> crypto/testmgr.c:1921:24: sparse: sparse: cast to restricted __le32 >> crypto/testmgr.c:1921:24: sparse: sparse: cast to restricted __le32 >> crypto/testmgr.c:1921:24: sparse: sparse: cast to restricted __le32 -- >> drivers/base/regmap/regmap.c:335:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] @@ got unsigned short [usertype] @@ drivers/base/regmap/regmap.c:335:14: sparse: expected restricted __be16 [usertype] drivers/base/regmap/regmap.c:335:14: sparse: got unsigned short [usertype] >> drivers/base/regmap/regmap.c:342:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] @@ got int @@ drivers/base/regmap/regmap.c:342:14: sparse: expected restricted __le16 [usertype] drivers/base/regmap/regmap.c:342:14: sparse: got int >> drivers/base/regmap/regmap.c:378:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] @@ got unsigned int [usertype] @@ drivers/base/regmap/regmap.c:378:14: sparse: expected restricted __be32 [usertype] drivers/base/regmap/regmap.c:378:14: sparse: got unsigned int [usertype] >> drivers/base/regmap/regmap.c:385:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] @@ got unsigned int @@ drivers/base/regmap/regmap.c:385:14: sparse: expected restricted __le32 [usertype] drivers/base/regmap/regmap.c:385:14: sparse: got unsigned int >> drivers/base/regmap/regmap.c:412:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be64 [usertype] @@ got unsigned long long [usertype] @@ drivers/base/regmap/regmap.c:412:14: sparse: expected restricted __be64 [usertype] drivers/base/regmap/regmap.c:412:14: sparse: got unsigned long long [usertype] >> drivers/base/regmap/regmap.c:419:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le64 [usertype] @@ got unsigned long long @@ drivers/base/regmap/regmap.c:419:14: sparse: expected restricted __le64 [usertype] drivers/base/regmap/regmap.c:419:14: sparse: got unsigned long long -- >> drivers/bluetooth/btmtkuart.c:479:59: sparse: sparse: Using plain integer as NULL pointer -- >> drivers/clk/hisilicon/clk-hi3660.c:336:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:338:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:340:70: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:342:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:344:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:346:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:348:70: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:350:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:352:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:354:70: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:356:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:358:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:360:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:362:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:364:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:366:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:368:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:370:69: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:372:70: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:374:70: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:376:70: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:378:71: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:423:68: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:425:68: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:427:68: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:429:68: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:449:70: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:451:71: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:453:71: sparse: sparse: Using plain integer as NULL pointer drivers/clk/hisilicon/clk-hi3660.c:455:71: sparse: sparse: Using plain integer as NULL pointer -- >> drivers/clk/tegra/clk-super.c:124:22: sparse: sparse: symbol 'tegra_clk_super_mux_ops' was not declared. Should it be static? drivers/clk/tegra/clk-super.c:121:9: sparse: sparse: context imbalance in 'clk_super_set_parent' - different lock contexts for basic block -- >> drivers/clk/tegra/clk-tegra210.c:2952:9: sparse: sparse: Using plain integer as NULL pointer >> drivers/clk/tegra/clk-tegra210.c:2952:9: sparse: sparse: Using plain integer as NULL pointer -- drivers/clocksource/timer-of.c:39:55: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] <asn:3> * @@ got struct clock_event_device *clkevt @@ drivers/clocksource/timer-of.c:39:55: sparse: expected void [noderef] <asn:3> * drivers/clocksource/timer-of.c:39:55: sparse: got struct clock_event_device *clkevt >> drivers/clocksource/timer-of.c:39:24: sparse: sparse: incompatible types in conditional expression (different types): drivers/clocksource/timer-of.c:39:24: sparse: void drivers/clocksource/timer-of.c:39:24: sparse: void const * drivers/clocksource/timer-of.c:83:51: sparse: sparse: incorrect type in argument 4 (different address spaces) @@ expected void [noderef] <asn:3> *percpu_dev_id @@ got struct clock_event_device *clkevt @@ drivers/clocksource/timer-of.c:83:51: sparse: expected void [noderef] <asn:3> *percpu_dev_id drivers/clocksource/timer-of.c:83:51: sparse: got struct clock_event_device *clkevt -- >> drivers/cpufreq/tegra186-cpufreq.c:79:37: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *driver_data @@ got void [noderef] <asn:2> * @@ drivers/cpufreq/tegra186-cpufreq.c:79:37: sparse: expected void *driver_data drivers/cpufreq/tegra186-cpufreq.c:79:37: sparse: got void [noderef] <asn:2> * >> drivers/cpufreq/tegra186-cpufreq.c:94:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void [noderef] <asn:2> *edvd_reg @@ got void *driver_data @@ drivers/cpufreq/tegra186-cpufreq.c:94:40: sparse: expected void [noderef] <asn:2> *edvd_reg drivers/cpufreq/tegra186-cpufreq.c:94:40: sparse: got void *driver_data -- >> drivers/crypto/bcm/spu.c:26:6: sparse: sparse: symbol 'tag_to_hash_idx' was not declared. Should it be static? drivers/crypto/bcm/spu.c:77:26: sparse: sparse: cast to restricted __be32 drivers/crypto/bcm/spu.c:82:26: sparse: sparse: cast to restricted __be32 drivers/crypto/bcm/spu.c:102:23: sparse: sparse: cast to restricted __be32 drivers/crypto/bcm/spu.c:410:18: sparse: sparse: cast to restricted __be16 drivers/crypto/bcm/spu.c:799:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] proto_flags @@ got restricted __be32 [usertype] @@ drivers/crypto/bcm/spu.c:799:30: sparse: expected unsigned int [usertype] proto_flags drivers/crypto/bcm/spu.c:799:30: sparse: got restricted __be32 [usertype] drivers/crypto/bcm/spu.c:800:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] cipher_flags @@ got restricted __be32 [usertype] @@ drivers/crypto/bcm/spu.c:800:31: sparse: expected unsigned int [usertype] cipher_flags drivers/crypto/bcm/spu.c:800:31: sparse: got restricted __be32 [usertype] drivers/crypto/bcm/spu.c:801:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] ecf @@ got restricted __be32 [usertype] @@ drivers/crypto/bcm/spu.c:801:22: sparse: expected unsigned int [usertype] ecf drivers/crypto/bcm/spu.c:801:22: sparse: got restricted __be32 [usertype] drivers/crypto/bcm/spu.c:806:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] offset_mac @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:806:27: sparse: expected unsigned short [usertype] offset_mac drivers/crypto/bcm/spu.c:806:27: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:807:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] length_mac @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:807:27: sparse: expected unsigned short [usertype] length_mac drivers/crypto/bcm/spu.c:807:27: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:808:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] offset_crypto @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:808:30: sparse: expected unsigned short [usertype] offset_crypto drivers/crypto/bcm/spu.c:808:30: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:809:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] length_crypto @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:809:30: sparse: expected unsigned short [usertype] length_crypto drivers/crypto/bcm/spu.c:809:30: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:818:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] offset_icv @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:818:27: sparse: expected unsigned short [usertype] offset_icv drivers/crypto/bcm/spu.c:818:27: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:819:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] offset_iv @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:819:26: sparse: expected unsigned short [usertype] offset_iv drivers/crypto/bcm/spu.c:819:26: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:830:18: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] size @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:830:18: sparse: expected unsigned short [usertype] size drivers/crypto/bcm/spu.c:830:18: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:914:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] proto_flags @@ got restricted __be32 [usertype] @@ drivers/crypto/bcm/spu.c:914:30: sparse: expected unsigned int [usertype] proto_flags drivers/crypto/bcm/spu.c:914:30: sparse: got restricted __be32 [usertype] drivers/crypto/bcm/spu.c:917:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] cipher_flags @@ got restricted __be32 [usertype] @@ drivers/crypto/bcm/spu.c:917:31: sparse: expected unsigned int [usertype] cipher_flags drivers/crypto/bcm/spu.c:917:31: sparse: got restricted __be32 [usertype] drivers/crypto/bcm/spu.c:918:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] ecf @@ got restricted __be32 [usertype] @@ drivers/crypto/bcm/spu.c:918:22: sparse: expected unsigned int [usertype] ecf drivers/crypto/bcm/spu.c:918:22: sparse: got restricted __be32 [usertype] drivers/crypto/bcm/spu.c:990:23: sparse: sparse: cast to restricted __be32 drivers/crypto/bcm/spu.c:1010:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] cipher_flags @@ got restricted __be32 [usertype] @@ drivers/crypto/bcm/spu.c:1010:31: sparse: expected unsigned int [usertype] cipher_flags drivers/crypto/bcm/spu.c:1010:31: sparse: got restricted __be32 [usertype] drivers/crypto/bcm/spu.c:1020:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] length_crypto @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:1020:38: sparse: expected unsigned short [usertype] length_crypto drivers/crypto/bcm/spu.c:1020:38: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:1023:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] length_crypto @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:1023:38: sparse: expected unsigned short [usertype] length_crypto drivers/crypto/bcm/spu.c:1023:38: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:1033:18: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] size @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:1033:18: sparse: expected unsigned short [usertype] size drivers/crypto/bcm/spu.c:1033:18: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:1037:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] size @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:1037:26: sparse: expected unsigned short [usertype] size drivers/crypto/bcm/spu.c:1037:26: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:1039:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] size @@ got restricted __be16 [usertype] @@ drivers/crypto/bcm/spu.c:1039:26: sparse: expected unsigned short [usertype] size drivers/crypto/bcm/spu.c:1039:26: sparse: got restricted __be16 [usertype] drivers/crypto/bcm/spu.c:1094:45: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu.c:1094:45: sparse: expected unsigned long long [usertype] drivers/crypto/bcm/spu.c:1094:45: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu.c:1096:45: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __be64 [usertype] @@ drivers/crypto/bcm/spu.c:1096:45: sparse: expected unsigned long long [usertype] drivers/crypto/bcm/spu.c:1096:45: sparse: got restricted __be64 [usertype] drivers/crypto/bcm/spu.c: In function 'spum_dump_msg_hdr': drivers/crypto/bcm/spu.c:121:31: warning: variable 'name' set but not used [-Wunused-but-set-variable] 121 | char *name = "NONE"; | ^~~~ drivers/crypto/bcm/spu.c:162:31: warning: variable 'name' set but not used [-Wunused-but-set-variable] 162 | char *name = "NONE"; | ^~~~ drivers/crypto/bcm/spu.c:186:31: warning: variable 'name' set but not used [-Wunused-but-set-variable] 186 | char *name = "NONE"; | ^~~~ drivers/crypto/bcm/spu.c:228:31: warning: variable 'name' set but not used [-Wunused-but-set-variable] 228 | char *name = "NONE"; | ^~~~ drivers/crypto/bcm/spu.c:484: warning: Excess function parameter 'Return' description in 'spum_gcm_ccm_pad_len' drivers/crypto/bcm/spu.c:544: warning: Function parameter or member 'iv_len' not described in 'spum_aead_ivlen' drivers/crypto/bcm/spu.c:544: warning: Excess function parameter 'iv_ctr_len' description in 'spum_aead_ivlen' drivers/crypto/bcm/spu.c:576: warning: Function parameter or member 'alg_digest_size' not described in 'spum_digest_size' drivers/crypto/bcm/spu.c:576: warning: Function parameter or member 'alg' not described in 'spum_digest_size' drivers/crypto/bcm/spu.c:576: warning: Function parameter or member 'htype' not described in 'spum_digest_size' drivers/crypto/bcm/spu.c:603: warning: bad line: drivers/crypto/bcm/spu.c:952: warning: Function parameter or member 'is_inbound' not described in 'spum_cipher_req_finish' drivers/crypto/bcm/spu.c:952: warning: Excess function parameter 'isInbound' description in 'spum_cipher_req_finish' -- >> drivers/crypto/bcm/spu2.c:52:6: sparse: sparse: symbol 'spu2_cipher_type_names' was not declared. Should it be static? >> drivers/crypto/bcm/spu2.c:56:6: sparse: sparse: symbol 'spu2_cipher_mode_names' was not declared. Should it be static? >> drivers/crypto/bcm/spu2.c:60:6: sparse: sparse: symbol 'spu2_hash_type_names' was not declared. Should it be static? >> drivers/crypto/bcm/spu2.c:66:6: sparse: sparse: symbol 'spu2_hash_mode_names' was not declared. Should it be static? drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:481:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:482:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:483:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:484:29: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:536:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:599:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl0 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:599:20: sparse: expected unsigned long long [usertype] ctrl0 drivers/crypto/bcm/spu2.c:599:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:600:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl1 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:600:20: sparse: expected unsigned long long [usertype] ctrl1 drivers/crypto/bcm/spu2.c:600:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:601:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl2 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:601:20: sparse: expected unsigned long long [usertype] ctrl2 drivers/crypto/bcm/spu2.c:601:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:602:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl3 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:602:20: sparse: expected unsigned long long [usertype] ctrl3 drivers/crypto/bcm/spu2.c:602:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:647:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl0 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:647:20: sparse: expected unsigned long long [usertype] ctrl0 drivers/crypto/bcm/spu2.c:647:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:727:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl1 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:727:20: sparse: expected unsigned long long [usertype] ctrl1 drivers/crypto/bcm/spu2.c:727:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:761:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl2 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:761:20: sparse: expected unsigned long long [usertype] ctrl2 drivers/crypto/bcm/spu2.c:761:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:775:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl3 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:775:20: sparse: expected unsigned long long [usertype] ctrl3 drivers/crypto/bcm/spu2.c:775:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:819:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1226:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1231:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] ctrl0 @@ got restricted __le64 [usertype] @@ drivers/crypto/bcm/spu2.c:1231:20: sparse: expected unsigned long long [usertype] ctrl0 drivers/crypto/bcm/spu2.c:1231:20: sparse: got restricted __le64 [usertype] drivers/crypto/bcm/spu2.c:1239:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1239:17: sparse: sparse: cast to restricted __le64 drivers/crypto/bcm/spu2.c:1239:17: sparse: sparse: cast to restricted __le64 -- >> drivers/crypto/bcm/cipher.c:99:6: sparse: sparse: symbol 'BCMHEADER' was not declared. Should it be static? >> drivers/crypto/bcm/cipher.c:2100:6: sparse: sparse: symbol 'spu_no_incr_hash' was not declared. Should it be static? >> drivers/crypto/bcm/cipher.c:4826:5: sparse: sparse: symbol 'bcm_spu_probe' was not declared. Should it be static? >> drivers/crypto/bcm/cipher.c:4870:5: sparse: sparse: symbol 'bcm_spu_remove' was not declared. Should it be static? drivers/crypto/bcm/cipher.c: In function 'handle_ahash_req': drivers/crypto/bcm/cipher.c:720:22: warning: variable 'chunk_start' set but not used [-Wunused-but-set-variable] 720 | unsigned int chunk_start = 0; | ^~~~~~~~~~~ drivers/crypto/bcm/cipher.c: In function 'spu_rx_callback': drivers/crypto/bcm/cipher.c:1679:38: warning: variable 'areq' set but not used [-Wunused-but-set-variable] 1679 | struct crypto_async_request *areq; | ^~~~ drivers/crypto/bcm/cipher.c:1678:29: warning: variable 'ctx' set but not used [-Wunused-but-set-variable] 1678 | struct iproc_ctx_s *ctx; | ^~~ drivers/crypto/bcm/cipher.c: At top level: drivers/crypto/bcm/cipher.c:2100:6: warning: no previous prototype for 'spu_no_incr_hash' [-Wmissing-prototypes] 2100 | bool spu_no_incr_hash(struct iproc_ctx_s *ctx) | ^~~~~~~~~~~~~~~~ drivers/crypto/bcm/cipher.c:4826:5: warning: no previous prototype for 'bcm_spu_probe' [-Wmissing-prototypes] 4826 | int bcm_spu_probe(struct platform_device *pdev) | ^~~~~~~~~~~~~ drivers/crypto/bcm/cipher.c:4870:5: warning: no previous prototype for 'bcm_spu_remove' [-Wmissing-prototypes] 4870 | int bcm_spu_remove(struct platform_device *pdev) | ^~~~~~~~~~~~~~ drivers/crypto/bcm/cipher.c:1097: warning: Function parameter or member 'req' not described in 'spu_aead_rx_sg_create' drivers/crypto/bcm/cipher.c:3087: warning: Function parameter or member 'cipher' not described in 'rfc4543_gcm_esp_setkey' drivers/crypto/bcm/cipher.c:3087: warning: Function parameter or member 'key' not described in 'rfc4543_gcm_esp_setkey' drivers/crypto/bcm/cipher.c:3087: warning: Function parameter or member 'keylen' not described in 'rfc4543_gcm_esp_setkey' -- >> drivers/crypto/qce/ablkcipher.c:215:17: sparse: sparse: Variable length array is used. -- >> drivers/firmware/google/coreboot_table.c:117:22: sparse: sparse: cast removes address space '<asn:2>' of expression >> drivers/firmware/google/coreboot_table.c:119:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const volatile [noderef] <asn:2> * @@ got void *[assigned] ptr_entry @@ drivers/firmware/google/coreboot_table.c:119:17: sparse: expected void const volatile [noderef] <asn:2> * drivers/firmware/google/coreboot_table.c:119:17: sparse: got void *[assigned] ptr_entry drivers/firmware/google/coreboot_table.c:131:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const volatile [noderef] <asn:2> * @@ got void *[assigned] ptr_entry @@ drivers/firmware/google/coreboot_table.c:131:17: sparse: expected void const volatile [noderef] <asn:2> * drivers/firmware/google/coreboot_table.c:131:17: sparse: got void *[assigned] ptr_entry -- >> drivers/firmware/google/memconsole-coreboot.c:70:45: sparse: sparse: incorrect type in argument 4 (different address spaces) @@ expected void const *from @@ got unsigned char [noderef] <asn:2> * @@ drivers/firmware/google/memconsole-coreboot.c:70:45: sparse: expected void const *from drivers/firmware/google/memconsole-coreboot.c:70:45: sparse: got unsigned char [noderef] <asn:2> * >> drivers/firmware/google/memconsole-coreboot.c:80:18: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct cbmem_cons [noderef] <asn:2> *tmp_cbmc @@ got void * @@ drivers/firmware/google/memconsole-coreboot.c:80:18: sparse: expected struct cbmem_cons [noderef] <asn:2> *tmp_cbmc drivers/firmware/google/memconsole-coreboot.c:80:18: sparse: got void * >> drivers/firmware/google/memconsole-coreboot.c:88:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct cbmem_cons [noderef] <asn:2> *static [toplevel] cbmem_console @@ got void * @@ drivers/firmware/google/memconsole-coreboot.c:88:23: sparse: expected struct cbmem_cons [noderef] <asn:2> *static [toplevel] cbmem_console drivers/firmware/google/memconsole-coreboot.c:88:23: sparse: got void * >> drivers/firmware/google/memconsole-coreboot.c:91:18: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *addr @@ got struct cbmem_cons [noderef] <asn:2> *tmp_cbmc @@ drivers/firmware/google/memconsole-coreboot.c:91:18: sparse: expected void *addr drivers/firmware/google/memconsole-coreboot.c:91:18: sparse: got struct cbmem_cons [noderef] <asn:2> *tmp_cbmc >> drivers/firmware/google/memconsole-coreboot.c:106:26: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *addr @@ got struct cbmem_cons [noderef] <asn:2> *static [toplevel] cbmem_console @@ drivers/firmware/google/memconsole-coreboot.c:106:26: sparse: expected void *addr drivers/firmware/google/memconsole-coreboot.c:106:26: sparse: got struct cbmem_cons [noderef] <asn:2> *static [toplevel] cbmem_console >> drivers/firmware/google/memconsole-coreboot.c:49:22: sparse: sparse: dereference of noderef expression drivers/firmware/google/memconsole-coreboot.c:50:21: sparse: sparse: dereference of noderef expression drivers/firmware/google/memconsole-coreboot.c:87:30: sparse: sparse: dereference of noderef expression -- >> drivers/firmware/meson/meson_sm.c:43:22: sparse: sparse: symbol 'gxbb_chip' was not declared. Should it be static? drivers/firmware/meson/meson_sm.c:89:24: sparse: sparse: Using plain integer as NULL pointer >> drivers/firmware/meson/meson_sm.c:171:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const * @@ got void [noderef] <asn:2> *static [toplevel] sm_shmem_out_base @@ drivers/firmware/meson/meson_sm.c:171:17: sparse: expected void const * drivers/firmware/meson/meson_sm.c:171:17: sparse: got void [noderef] <asn:2> *static [toplevel] sm_shmem_out_base >> drivers/firmware/meson/meson_sm.c:205:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void * @@ got void [noderef] <asn:2> *static [toplevel] sm_shmem_in_base @@ drivers/firmware/meson/meson_sm.c:205:9: sparse: expected void * drivers/firmware/meson/meson_sm.c:205:9: sparse: got void [noderef] <asn:2> *static [toplevel] sm_shmem_in_base -- >> drivers/firmware/tegra/bpmp-debugfs.c:62:14: sparse: sparse: cast to restricted __le32 >> drivers/firmware/tegra/bpmp-debugfs.c:62:14: sparse: sparse: cast to restricted __le32 >> drivers/firmware/tegra/bpmp-debugfs.c:62:14: sparse: sparse: cast to restricted __le32 >> drivers/firmware/tegra/bpmp-debugfs.c:62:14: sparse: sparse: cast to restricted __le32 >> drivers/firmware/tegra/bpmp-debugfs.c:62:14: sparse: sparse: cast to restricted __le32 >> drivers/firmware/tegra/bpmp-debugfs.c:62:14: sparse: sparse: cast to restricted __le32 >> drivers/firmware/tegra/bpmp-debugfs.c:114:24: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] cmd @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:114:24: sparse: expected unsigned int [usertype] cmd drivers/firmware/tegra/bpmp-debugfs.c:114:24: sparse: got restricted __le32 [usertype] >> drivers/firmware/tegra/bpmp-debugfs.c:116:38: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] fnameaddr @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:116:38: sparse: expected unsigned int [usertype] fnameaddr drivers/firmware/tegra/bpmp-debugfs.c:116:38: sparse: got restricted __le32 [usertype] >> drivers/firmware/tegra/bpmp-debugfs.c:117:37: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] fnamelen @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:117:37: sparse: expected unsigned int [usertype] fnamelen drivers/firmware/tegra/bpmp-debugfs.c:117:37: sparse: got restricted __le32 [usertype] >> drivers/firmware/tegra/bpmp-debugfs.c:118:37: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] dataaddr @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:118:37: sparse: expected unsigned int [usertype] dataaddr drivers/firmware/tegra/bpmp-debugfs.c:118:37: sparse: got restricted __le32 [usertype] >> drivers/firmware/tegra/bpmp-debugfs.c:119:36: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] datalen @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:119:36: sparse: expected unsigned int [usertype] datalen drivers/firmware/tegra/bpmp-debugfs.c:119:36: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:150:24: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] cmd @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:150:24: sparse: expected unsigned int [usertype] cmd drivers/firmware/tegra/bpmp-debugfs.c:150:24: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:152:38: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] fnameaddr @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:152:38: sparse: expected unsigned int [usertype] fnameaddr drivers/firmware/tegra/bpmp-debugfs.c:152:38: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:153:37: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] fnamelen @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:153:37: sparse: expected unsigned int [usertype] fnamelen drivers/firmware/tegra/bpmp-debugfs.c:153:37: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:154:37: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] dataaddr @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:154:37: sparse: expected unsigned int [usertype] dataaddr drivers/firmware/tegra/bpmp-debugfs.c:154:37: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:155:36: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] datalen @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:155:36: sparse: expected unsigned int [usertype] datalen drivers/firmware/tegra/bpmp-debugfs.c:155:36: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:173:24: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] cmd @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:173:24: sparse: expected unsigned int [usertype] cmd drivers/firmware/tegra/bpmp-debugfs.c:173:24: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:175:37: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] dataaddr @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:175:37: sparse: expected unsigned int [usertype] dataaddr drivers/firmware/tegra/bpmp-debugfs.c:175:37: sparse: got restricted __le32 [usertype] drivers/firmware/tegra/bpmp-debugfs.c:176:36: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] datalen @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:176:36: sparse: expected unsigned int [usertype] datalen drivers/firmware/tegra/bpmp-debugfs.c:176:36: sparse: got restricted __le32 [usertype] >> drivers/firmware/tegra/bpmp-debugfs.c:384:53: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] mrq @@ got restricted __le32 [usertype] @@ drivers/firmware/tegra/bpmp-debugfs.c:384:53: sparse: expected unsigned int [usertype] mrq drivers/firmware/tegra/bpmp-debugfs.c:384:53: sparse: got restricted __le32 [usertype] -- drivers/infiniband/core/ud_header.c: note: in included file (through include/net/checksum.h, include/linux/skbuff.h, include/linux/if_ether.h): >> arch/arm64/include/asm/checksum.h:45:27: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted __wsum [usertype] csum @@ got unsigned int [usertype] @@ arch/arm64/include/asm/checksum.h:45:27: sparse: expected restricted __wsum [usertype] csum arch/arm64/include/asm/checksum.h:45:27: sparse: got unsigned int [usertype] -- drivers/infiniband/core/verbs.c: note: in included file (through include/net/checksum.h, include/linux/skbuff.h, include/linux/if_ether.h, ...): >> arch/arm64/include/asm/checksum.h:45:27: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted __wsum [usertype] csum @@ got unsigned int [usertype] @@ arch/arm64/include/asm/checksum.h:45:27: sparse: expected restricted __wsum [usertype] csum arch/arm64/include/asm/checksum.h:45:27: sparse: got unsigned int [usertype] drivers/infiniband/core/verbs.c:242: warning: Function parameter or member 'flags' not described in '__ib_alloc_pd' drivers/infiniband/core/verbs.c:242: warning: Function parameter or member 'caller' not described in '__ib_alloc_pd' drivers/infiniband/core/verbs.c:1581: warning: Function parameter or member 'qp' not described in '_ib_modify_qp' drivers/infiniband/core/verbs.c:1581: warning: Function parameter or member 'attr' not described in '_ib_modify_qp' drivers/infiniband/core/verbs.c:1581: warning: Function parameter or member 'attr_mask' not described in '_ib_modify_qp' drivers/infiniband/core/verbs.c:1581: warning: Function parameter or member 'udata' not described in '_ib_modify_qp' -- >> drivers/irqchip/irq-brcmstb-l2.c:278:12: sparse: sparse: symbol 'brcmstb_l2_edge_intc_of_init' was not declared. Should it be static? >> drivers/irqchip/irq-brcmstb-l2.c:285:12: sparse: sparse: symbol 'brcmstb_l2_lvl_intc_of_init' was not declared. Should it be static? drivers/irqchip/irq-brcmstb-l2.c:278:12: warning: no previous prototype for 'brcmstb_l2_edge_intc_of_init' [-Wmissing-prototypes] 278 | int __init brcmstb_l2_edge_intc_of_init(struct device_node *np, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-brcmstb-l2.c:285:12: warning: no previous prototype for 'brcmstb_l2_lvl_intc_of_init' [-Wmissing-prototypes] 285 | int __init brcmstb_l2_lvl_intc_of_init(struct device_node *np, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/mtd/nand/raw/nand_base.c:277:17: sparse: sparse: cast from restricted __le16 drivers/mtd/nand/raw/nand_base.c: In function 'nand_command': drivers/mtd/nand/raw/nand_base.c:848:20: warning: this statement may fall through [-Wimplicit-fallthrough=] 848 | if (column == -1 && page_addr == -1) | ^ drivers/mtd/nand/raw/nand_base.c:851:9: note: here 851 | default: | ^~~~~~~ drivers/mtd/nand/raw/nand_base.c: In function 'nand_command_lp': drivers/mtd/nand/raw/nand_base.c:998:17: warning: this statement may fall through [-Wimplicit-fallthrough=] 998 | chip->cmd_ctrl(mtd, NAND_CMD_NONE, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 999 | NAND_NCE | NAND_CTRL_CHANGE); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/mtd/nand/raw/nand_base.c:1002:9: note: here 1002 | default: | ^~~~~~~ drivers/mtd/nand/raw/nand_base.c: In function 'nand_scan_tail': drivers/mtd/nand/raw/nand_base.c:6511:20: warning: this statement may fall through [-Wimplicit-fallthrough=] 6511 | if (!ecc->read_page) | ^ drivers/mtd/nand/raw/nand_base.c:6514:9: note: here 6514 | case NAND_ECC_HW: | ^~~~ drivers/mtd/nand/raw/nand_base.c:6530:20: warning: this statement may fall through [-Wimplicit-fallthrough=] 6530 | if (!ecc->write_subpage && ecc->hwctl && ecc->calculate) | ^ drivers/mtd/nand/raw/nand_base.c:6533:9: note: here 6533 | case NAND_ECC_HW_SYNDROME: | ^~~~ drivers/mtd/nand/raw/nand_base.c:6568:27: warning: this statement may fall through [-Wimplicit-fallthrough=] 6568 | ecc->algo = NAND_ECC_HAMMING; | ~~~~~~~~~~^~~~~~~~~~~~~~~~~~ drivers/mtd/nand/raw/nand_base.c:6570:9: note: here 6570 | case NAND_ECC_SOFT: | ^~~~ -- >> drivers/mtd/nand/raw/hisi504_nand.c:373:26: sparse: sparse: cast removes address space '<asn:2>' of expression drivers/mtd/nand/raw/hisi504_nand.c:378:26: sparse: sparse: cast removes address space '<asn:2>' of expression >> drivers/mtd/nand/raw/hisi504_nand.c:487:17: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void * @@ got void [noderef] <asn:2> *mmio @@ drivers/mtd/nand/raw/hisi504_nand.c:487:17: sparse: expected void * drivers/mtd/nand/raw/hisi504_nand.c:487:17: sparse: got void [noderef] <asn:2> *mmio drivers/mtd/nand/raw/hisi504_nand.c:499:17: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void * @@ got void [noderef] <asn:2> *mmio @@ drivers/mtd/nand/raw/hisi504_nand.c:499:17: sparse: expected void * drivers/mtd/nand/raw/hisi504_nand.c:499:17: sparse: got void [noderef] <asn:2> *mmio drivers/mtd/nand/raw/hisi504_nand.c:622:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void * @@ got void [noderef] <asn:2> *mmio @@ drivers/mtd/nand/raw/hisi504_nand.c:622:9: sparse: expected void * drivers/mtd/nand/raw/hisi504_nand.c:622:9: sparse: got void [noderef] <asn:2> *mmio -- >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/control.c:451:17: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/control.c: In function 'i2400m_get_device_info': drivers/net/wimax/i2400m/control.c:961:31: warning: implicit conversion from 'enum <anonymous>' to 'enum i2400m_tlv' [-Wenum-conversion] 961 | I2400M_TLV_DETAILED_DEVICE_INFO, sizeof(*ddi)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/wimax/i2400m/debug-levels.h:30, from drivers/net/wimax/i2400m/control.c:86: drivers/net/wimax/i2400m/control.c: In function 'i2400m_report_tlv_system_state': include/linux/wimax/debug.h:200:4: warning: this statement may fall through [-Wimplicit-fallthrough=] 200 | do { 22- | ^ include/linux/wimax/debug.h:404:36: note: in expansion of macro '_d_printf' 404 | #define d_printf(l, _dev, f, a...) _d_printf(l, "", _dev, f, ## a) | ^~~~~~~~~ drivers/net/wimax/i2400m/control.c:354:17: note: in expansion of macro 'd_printf' 354 | d_printf(1, dev, "entering BS-negotiated idle moden"); | ^~~~~~~~ drivers/net/wimax/i2400m/control.c:355:9: note: here 355 | case I2400M_SS_DISCONNECTING: | ^~~~ drivers/net/wimax/i2400m/control.c:708: warning: Excess function parameter 'msg_skb' description in 'i2400m_msg_to_dev' drivers/net/wimax/i2400m/control.c:1196: warning: Function parameter or member 'arg' not described in 'i2400m_set_init_config' drivers/net/wimax/i2400m/control.c:1196: warning: Excess function parameter 'arg_size' description in 'i2400m_set_init_config' -- >> drivers/net/wimax/i2400m/fw.c:194:36: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/wimax/i2400m/fw.c:195:34: sparse: sparse: invalid assignment: += drivers/net/wimax/i2400m/fw.c:195:34: sparse: left side has type unsigned int drivers/net/wimax/i2400m/fw.c:195:34: sparse: right side has type restricted __le32 drivers/net/wimax/i2400m/fw.c:196:32: sparse: sparse: restricted __le32 degrades to integer drivers/net/wimax/i2400m/fw.c:196:47: sparse: sparse: restricted __le32 degrades to integer drivers/net/wimax/i2400m/fw.c:196:66: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/wimax/i2400m/fw.c:261:27: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/fw.c:261:27: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/fw.c:261:27: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/fw.c:261:27: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/fw.c:261:27: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/fw.c:261:27: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/fw.c:261:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/wimax/i2400m/fw.c:261:25: sparse: expected restricted __le32 drivers/net/wimax/i2400m/fw.c:261:25: sparse: got unsigned int drivers/net/wimax/i2400m/fw.c:262:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:262:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:262:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:262:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:262:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:262:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:262:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/wimax/i2400m/fw.c:262:25: sparse: expected restricted __le32 drivers/net/wimax/i2400m/fw.c:262:25: sparse: got unsigned int drivers/net/wimax/i2400m/fw.c:263:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:263:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:263:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:263:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:263:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:263:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:263:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/wimax/i2400m/fw.c:263:25: sparse: expected restricted __le32 drivers/net/wimax/i2400m/fw.c:263:25: sparse: got unsigned int drivers/net/wimax/i2400m/fw.c:264:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:264:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:264:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:264:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:264:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:264:27: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:264:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/wimax/i2400m/fw.c:264:25: sparse: expected restricted __le32 drivers/net/wimax/i2400m/fw.c:264:25: sparse: got unsigned int drivers/net/wimax/i2400m/fw.c:417:48: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:417:48: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:417:48: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:417:48: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:417:48: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:417:48: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/fw.c:417:41: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/wimax/i2400m/fw.c:485:24: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] data_size @@ got unsigned int @@ drivers/net/wimax/i2400m/fw.c:485:24: sparse: expected restricted __le32 [usertype] data_size drivers/net/wimax/i2400m/fw.c:485:24: sparse: got unsigned int >> drivers/net/wimax/i2400m/fw.c:486:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] target_addr @@ got unsigned int @@ drivers/net/wimax/i2400m/fw.c:486:26: sparse: expected restricted __le32 [usertype] target_addr drivers/net/wimax/i2400m/fw.c:486:26: sparse: got unsigned int >> drivers/net/wimax/i2400m/fw.c:487:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] block_checksum @@ got unsigned int @@ drivers/net/wimax/i2400m/fw.c:487:29: sparse: expected restricted __le32 [usertype] block_checksum drivers/net/wimax/i2400m/fw.c:487:29: sparse: got unsigned int drivers/net/wimax/i2400m/fw.c:512:27: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/wimax/i2400m/fw.c:1085:62: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected unsigned long addr @@ got restricted __le32 const [usertype] address @@ drivers/net/wimax/i2400m/fw.c:1085:62: sparse: expected unsigned long addr drivers/net/wimax/i2400m/fw.c:1085:62: sparse: got restricted __le32 const [usertype] address drivers/net/wimax/i2400m/fw.c:587: warning: Function parameter or member 'i2400m' not described in 'i2400m_bm_cmd' drivers/net/wimax/i2400m/fw.c:587: warning: Excess function parameter 'returns' description in 'i2400m_bm_cmd' drivers/net/wimax/i2400m/fw.c:649: warning: Function parameter or member 'chunk' not described in 'i2400m_download_chunk' drivers/net/wimax/i2400m/fw.c:649: warning: Function parameter or member '__chunk_len' not described in 'i2400m_download_chunk' drivers/net/wimax/i2400m/fw.c:649: warning: Excess function parameter 'buf' description in 'i2400m_download_chunk' drivers/net/wimax/i2400m/fw.c:649: warning: Excess function parameter 'buf_len' description in 'i2400m_download_chunk' drivers/net/wimax/i2400m/fw.c:1551: warning: Function parameter or member 'flags' not described in 'i2400m_dev_bootstrap' -- >> drivers/net/wimax/i2400m/op-rfkill.c:104:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] length @@ got unsigned long @@ drivers/net/wimax/i2400m/op-rfkill.c:104:25: sparse: expected restricted __le16 [usertype] length drivers/net/wimax/i2400m/op-rfkill.c:104:25: sparse: got unsigned long >> drivers/net/wimax/i2400m/op-rfkill.c:173:14: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/op-rfkill.c:173:14: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/op-rfkill.c:173:14: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/op-rfkill.c:173:14: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/op-rfkill.c:173:14: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/op-rfkill.c:173:14: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/op-rfkill.c:174:14: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/op-rfkill.c:174:14: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/op-rfkill.c:174:14: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/op-rfkill.c:174:14: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/op-rfkill.c:174:14: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/op-rfkill.c:174:14: sparse: sparse: cast to restricted __le32 -- >> drivers/net/wimax/i2400m/tx.c:788:35: sparse: sparse: cast to restricted __le16 >> drivers/net/wimax/i2400m/tx.c:788:35: sparse: sparse: cast to restricted __le16 >> drivers/net/wimax/i2400m/tx.c:788:35: sparse: sparse: cast to restricted __le16 >> drivers/net/wimax/i2400m/tx.c:788:35: sparse: sparse: cast to restricted __le16 >> drivers/net/wimax/i2400m/tx.c:788:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] num_pls @@ got int @@ drivers/net/wimax/i2400m/tx.c:788:33: sparse: expected restricted __le16 [usertype] num_pls drivers/net/wimax/i2400m/tx.c:788:33: sparse: got int >> drivers/net/wimax/i2400m/tx.c:896:32: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:896:32: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:896:32: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:896:32: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:896:32: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:896:32: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:896:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] barker @@ got unsigned int @@ drivers/net/wimax/i2400m/tx.c:896:30: sparse: expected restricted __le32 [usertype] barker drivers/net/wimax/i2400m/tx.c:896:30: sparse: got unsigned int drivers/net/wimax/i2400m/tx.c:897:34: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/tx.c:897:34: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/tx.c:897:34: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/tx.c:897:34: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/tx.c:897:34: sparse: sparse: cast to restricted __le32 drivers/net/wimax/i2400m/tx.c:897:34: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:897:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] sequence @@ got unsigned int @@ drivers/net/wimax/i2400m/tx.c:897:32: sparse: expected restricted __le32 [usertype] sequence drivers/net/wimax/i2400m/tx.c:897:32: sparse: got unsigned int drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast from restricted __le16 drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast from restricted __le16 drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast from restricted __le16 drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast from restricted __le16 drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast from restricted __le16 drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast to restricted __le32 >> drivers/net/wimax/i2400m/tx.c:899:15: sparse: sparse: cast from restricted __le16 drivers/net/wimax/i2400m/tx.c: In function 'i2400m_tx': drivers/net/wimax/i2400m/tx.c:784:44: warning: array subscript <unknown> is outside array bounds of 'struct i2400m_pld[0]' [-Warray-bounds=] 784 | i2400m_pld_set(&tx_msg->pld[num_pls], buf_len, pl_type); | ~~~~~~~~~~~^~~~~~~~~ In file included from drivers/net/wimax/i2400m/i2400m.h:160, from drivers/net/wimax/i2400m/tx.c:249: include/uapi/linux/wimax/i2400m.h:322:27: note: while referencing 'pld' 322 | struct i2400m_pld pld[0]; | ^~~ In file included from include/linux/swab.h:5, from include/uapi/linux/byteorder/big_endian.h:13, from include/linux/byteorder/big_endian.h:5, from arch/arm64/include/uapi/asm/byteorder.h:21, from include/asm-generic/bitops/le.h:6, from arch/arm64/include/asm/bitops.h:40, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from include/linux/list.h:9, from include/linux/timer.h:6, from include/linux/netdevice.h:29, from drivers/net/wimax/i2400m/tx.c:246: drivers/net/wimax/i2400m/tx.c:786:49: warning: array subscript <unknown> is outside array bounds of 'struct i2400m_pld[0]' [-Warray-bounds=] 786 | le32_to_cpu(tx_msg->pld[num_pls].val), | ~~~~~~~~~~~^~~~~~~~~ include/uapi/linux/swab.h:117:39: note: in definition of macro '__swab32' 117 | (__builtin_constant_p((__u32)(x)) ? 64- | ^ include/linux/byteorder/generic.h:89:21: note: in expansion of macro '__le32_to_cpu' 89 | #define le32_to_cpu __le32_to_cpu | ^~~~~~~~~~~~~ include/linux/wimax/debug.h:404:36: note: in expansion of macro '_d_printf' 404 | #define d_printf(l, _dev, f, a...) _d_printf(l, "", _dev, f, ## a) | ^~~~~~~~~ drivers/net/wimax/i2400m/tx.c:785:17: note: in expansion of macro 'd_printf' 785 | d_printf(3, dev, "pld 0x%08x (type 0x%1x len 0x%04zxn", | ^~~~~~~~ include/uapi/linux/wimax/i2400m.h:322:27: note: while referencing 'pld' 322 | struct i2400m_pld pld[0]; | ^~~ drivers/net/wimax/i2400m/tx.c:717: warning: Function parameter or member 'i2400m' not described in 'i2400m_tx' drivers/net/wimax/i2400m/tx.c:966: warning: Function parameter or member 'i2400m' not described in 'i2400m_tx_setup' drivers/net/wimax/i2400m/tx.c:1007: warning: Function parameter or member 'i2400m' not described in 'i2400m_tx_release' -- >> drivers/phy/qualcomm/phy-qcom-ufs.c:93:21: sparse: sparse: cast removes address space '<asn:2>' of expression drivers/phy/qualcomm/phy-qcom-ufs.c:94:32: sparse: sparse: cast removes address space '<asn:2>' of expression drivers/phy/qualcomm/phy-qcom-ufs.c:105:21: sparse: sparse: cast removes address space '<asn:2>' of expression >> drivers/phy/qualcomm/phy-qcom-ufs.c:512:6: sparse: sparse: symbol 'ufs_qcom_phy_disable_iface_clk' was not declared. Should it be static? drivers/phy/qualcomm/phy-qcom-ufs.c:512:6: warning: no previous prototype for 'ufs_qcom_phy_disable_iface_clk' [-Wmissing-prototypes] 512 | void ufs_qcom_phy_disable_iface_clk(struct ufs_qcom_phy *phy) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/phy/rockchip/phy-rockchip-typec.c:403:16: sparse: sparse: symbol 'usb3_pll_cfg' was not declared. Should it be static? >> drivers/phy/rockchip/phy-rockchip-typec.c:420:16: sparse: sparse: symbol 'dp_pll_cfg' was not declared. Should it be static? drivers/phy/rockchip/phy-rockchip-typec.c:369: warning: cannot understand function prototype: 'struct rockchip_usb3phy_port_cfg ' -- >> drivers/platform/chrome/cros_ec_debugfs.c:266:30: sparse: sparse: symbol 'cros_ec_console_log_fops' was not declared. Should it be static? >> drivers/platform/chrome/cros_ec_debugfs.c:275:30: sparse: sparse: symbol 'cros_ec_pdinfo_fops' was not declared. Should it be static? drivers/platform/chrome/cros_ec_debugfs.c: In function 'cros_ec_pdinfo_read': drivers/platform/chrome/cros_ec_debugfs.c:234:15: warning: taking address of packed member of 'struct <anonymous>' may result in an unaligned pointer value [-Waddress-of-packed-member] 234 | msg = &ec_buf.msg; | ^~~~~~~~~~~ -- >> drivers/usb/gadget/udc/renesas_usb3.c:1539:17: sparse: sparse: restricted __le16 degrades to integer >> drivers/usb/gadget/udc/renesas_usb3.c:1542:43: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected unsigned short [usertype] addr @@ got restricted __le16 [usertype] wValue @@ drivers/usb/gadget/udc/renesas_usb3.c:1542:43: sparse: expected unsigned short [usertype] addr drivers/usb/gadget/udc/renesas_usb3.c:1542:43: sparse: got restricted __le16 [usertype] wValue >> drivers/usb/gadget/udc/renesas_usb3.c:1599:24: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [assigned] [usertype] status @@ got restricted __le16 [usertype] @@ drivers/usb/gadget/udc/renesas_usb3.c:1599:24: sparse: expected unsigned short [assigned] [usertype] status drivers/usb/gadget/udc/renesas_usb3.c:1599:24: sparse: got restricted __le16 [usertype] drivers/usb/gadget/udc/renesas_usb3.c:1767:17: sparse: sparse: restricted __le16 degrades to integer drivers/usb/gadget/udc/renesas_usb3.c: In function 'renesas_usb3_init_ep.isra': drivers/usb/gadget/udc/renesas_usb3.c:2516:73: warning: '%d' directive output may be truncated writing between 1 and 11 bytes into a region of size 6 [-Wformat-truncation=] 2516 | snprintf(usb3_ep->ep_name, sizeof(usb3_ep->ep_name), "ep%d", i); | ^~ drivers/usb/gadget/udc/renesas_usb3.c:2516:70: note: directive argument in the range [-2147483639, 2147483646] 2516 | snprintf(usb3_ep->ep_name, sizeof(usb3_ep->ep_name), "ep%d", i); | ^~~~~~ drivers/usb/gadget/udc/renesas_usb3.c:2516:17: note: 'snprintf' output between 4 and 14 bytes into a destination of size 8 2516 | snprintf(usb3_ep->ep_name, sizeof(usb3_ep->ep_name), "ep%d", i); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/usb/isp1760/isp1760-udc.c:212:24: sparse: sparse: cast to restricted __le32 drivers/usb/isp1760/isp1760-udc.c:212:24: sparse: sparse: cast to restricted __le32 drivers/usb/isp1760/isp1760-udc.c:212:24: sparse: sparse: cast to restricted __le32 drivers/usb/isp1760/isp1760-udc.c:212:24: sparse: sparse: cast to restricted __le32 drivers/usb/isp1760/isp1760-udc.c:212:24: sparse: sparse: cast to restricted __le32 drivers/usb/isp1760/isp1760-udc.c:212:24: sparse: sparse: cast to restricted __le32 drivers/usb/isp1760/isp1760-udc.c:214:31: sparse: sparse: cast to restricted __le16 drivers/usb/isp1760/isp1760-udc.c:214:31: sparse: sparse: cast to restricted __le16 drivers/usb/isp1760/isp1760-udc.c:214:31: sparse: sparse: cast to restricted __le16 drivers/usb/isp1760/isp1760-udc.c:214:31: sparse: sparse: cast to restricted __le16 drivers/usb/isp1760/isp1760-udc.c:268:53: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned int [usertype] val @@ got restricted __le32 [usertype] @@ drivers/usb/isp1760/isp1760-udc.c:268:53: sparse: expected unsigned int [usertype] val drivers/usb/isp1760/isp1760-udc.c:268:53: sparse: got restricted __le32 [usertype] drivers/usb/isp1760/isp1760-udc.c:270:17: sparse: sparse: cast from restricted __le16 >> drivers/usb/isp1760/isp1760-udc.c:270:17: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned short [usertype] val @@ got restricted __le16 [usertype] @@ drivers/usb/isp1760/isp1760-udc.c:270:17: sparse: expected unsigned short [usertype] val drivers/usb/isp1760/isp1760-udc.c:270:17: sparse: got restricted __le16 [usertype] drivers/usb/isp1760/isp1760-udc.c:270:17: sparse: sparse: cast from restricted __le16 drivers/usb/isp1760/isp1760-udc.c:270:17: sparse: sparse: cast from restricted __le16 drivers/usb/isp1760/isp1760-udc.c:485:9: sparse: sparse: cast from restricted __le16 drivers/usb/isp1760/isp1760-udc.c:485:9: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned short [usertype] val @@ got restricted __le16 [usertype] @@ drivers/usb/isp1760/isp1760-udc.c:485:9: sparse: expected unsigned short [usertype] val drivers/usb/isp1760/isp1760-udc.c:485:9: sparse: got restricted __le16 [usertype] drivers/usb/isp1760/isp1760-udc.c:485:9: sparse: sparse: cast from restricted __le16 drivers/usb/isp1760/isp1760-udc.c:485:9: sparse: sparse: cast from restricted __le16 -- >> drivers/usb/misc/usb251xb.c:448:36: sparse: sparse: cast to restricted __be32 drivers/usb/misc/usb251xb.c:462:36: sparse: sparse: cast to restricted __be32 drivers/usb/misc/usb251xb.c:476:36: sparse: sparse: cast to restricted __be32 -- >> drivers/usb/renesas_usbhs/common.c:164:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] wValue @@ got unsigned short @@ drivers/usb/renesas_usbhs/common.c:164:25: sparse: expected restricted __le16 [usertype] wValue drivers/usb/renesas_usbhs/common.c:164:25: sparse: got unsigned short >> drivers/usb/renesas_usbhs/common.c:165:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] wIndex @@ got unsigned short @@ drivers/usb/renesas_usbhs/common.c:165:25: sparse: expected restricted __le16 [usertype] wIndex drivers/usb/renesas_usbhs/common.c:165:25: sparse: got unsigned short >> drivers/usb/renesas_usbhs/common.c:166:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] wLength @@ got unsigned short @@ drivers/usb/renesas_usbhs/common.c:166:25: sparse: expected restricted __le16 [usertype] wLength drivers/usb/renesas_usbhs/common.c:166:25: sparse: got unsigned short >> drivers/usb/renesas_usbhs/common.c:172:39: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned short [usertype] data @@ got restricted __le16 [usertype] wValue @@ drivers/usb/renesas_usbhs/common.c:172:39: sparse: expected unsigned short [usertype] data drivers/usb/renesas_usbhs/common.c:172:39: sparse: got restricted __le16 [usertype] wValue >> drivers/usb/renesas_usbhs/common.c:173:39: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned short [usertype] data @@ got restricted __le16 [usertype] wIndex @@ drivers/usb/renesas_usbhs/common.c:173:39: sparse: expected unsigned short [usertype] data drivers/usb/renesas_usbhs/common.c:173:39: sparse: got restricted __le16 [usertype] wIndex >> drivers/usb/renesas_usbhs/common.c:174:39: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned short [usertype] data @@ got restricted __le16 [usertype] wLength @@ drivers/usb/renesas_usbhs/common.c:174:39: sparse: expected unsigned short [usertype] data drivers/usb/renesas_usbhs/common.c:174:39: sparse: got restricted __le16 [usertype] wLength -- >> drivers/watchdog/zx2967_wdt.c:181:16: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] <asn:2> *regmap @@ got struct regmap * @@ drivers/watchdog/zx2967_wdt.c:181:16: sparse: expected void [noderef] <asn:2> *regmap drivers/watchdog/zx2967_wdt.c:181:16: sparse: got struct regmap * >> drivers/watchdog/zx2967_wdt.c:187:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct regmap *map @@ got void [noderef] <asn:2> *regmap @@ drivers/watchdog/zx2967_wdt.c:187:9: sparse: expected struct regmap *map drivers/watchdog/zx2967_wdt.c:187:9: sparse: got void [noderef] <asn:2> *regmap -- fs/compat_ioctl.c:602:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char *iomem_base @@ got void [noderef] <asn:1> * @@ fs/compat_ioctl.c:602:28: sparse: expected unsigned char *iomem_base fs/compat_ioctl.c:602:28: sparse: got void [noderef] <asn:1> * >> fs/compat_ioctl.c:613:21: sparse: sparse: Using plain integer as NULL pointer -- >> kernel/dma/coherent.c:56:18: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] <asn:2> *mem_base @@ got void * @@ kernel/dma/coherent.c:56:18: sparse: expected void [noderef] <asn:2> *mem_base kernel/dma/coherent.c:56:18: sparse: got void * >> kernel/dma/coherent.c:72:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *virt_base @@ got void [noderef] <asn:2> *mem_base @@ kernel/dma/coherent.c:72:28: sparse: expected void *virt_base kernel/dma/coherent.c:72:28: sparse: got void [noderef] <asn:2> *mem_base >> kernel/dma/coherent.c:85:26: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *addr @@ got void [noderef] <asn:2> *mem_base @@ kernel/dma/coherent.c:85:26: sparse: expected void *addr kernel/dma/coherent.c:85:26: sparse: got void [noderef] <asn:2> *mem_base -- kernel/locking/rwsem-xadd.c: note: in included file (through arch/arm64/include/asm/atomic.h, include/linux/atomic.h, include/asm-generic/bitops/atomic.h, ...): >> arch/arm64/include/asm/cmpxchg.h:141:1: sparse: sparse: cast truncates bits from constant value (ffffffff00000000 becomes 0) >> arch/arm64/include/asm/cmpxchg.h:141:1: sparse: sparse: cast truncates bits from constant value (ffffffff00000000 becomes 0) >> arch/arm64/include/asm/cmpxchg.h:141:1: sparse: sparse: cast truncates bits from constant value (ffffffff00000000 becomes 0) >> arch/arm64/include/asm/cmpxchg.h:141:1: sparse: sparse: cast truncates bits from constant value (ffffffff00000000 becomes 0) -- >> lib/test_overflow.c:381:16: sparse: sparse: cast truncates bits from constant value (12c becomes 2c) >> lib/test_overflow.c:383:16: sparse: sparse: cast truncates bits from constant value (1112c becomes 112c) >> lib/test_overflow.c:385:16: sparse: sparse: cast truncates bits from constant value (10811112c becomes 811112c) lib/test_overflow.c:386:16: sparse: sparse: cast truncates bits from constant value (10811112c becomes 811112c) lib/test_overflow.c:403:16: sparse: sparse: cast truncates bits from constant value (12c becomes 2c) lib/test_overflow.c:405:16: sparse: sparse: cast truncates bits from constant value (1112c becomes 112c) lib/test_overflow.c:407:16: sparse: sparse: cast truncates bits from constant value (10811112c becomes 811112c) lib/test_overflow.c:408:16: sparse: sparse: cast truncates bits from constant value (10811112c becomes 811112c) >> lib/test_overflow.c:413:16: sparse: sparse: cast truncates bits from constant value (100 becomes 0) lib/test_overflow.c:415:16: sparse: sparse: cast truncates bits from constant value (10000 becomes 0) lib/test_overflow.c:417:16: sparse: sparse: cast truncates bits from constant value (100000000 becomes 0) lib/test_overflow.c:418:16: sparse: sparse: cast truncates bits from constant value (100000000 becomes 0) In file included from include/linux/device.h:29, from lib/test_overflow.c:7: lib/test_overflow.c: In function 'test_overflow_shift': include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 18- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 21- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:337:16: note: in expansion of macro 'TEST_ONE_SHIFT' 337 | err |= TEST_ONE_SHIFT(1, 0, unsigned int, 1U << 0, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 27- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 30- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:338:16: note: in expansion of macro 'TEST_ONE_SHIFT' 338 | err |= TEST_ONE_SHIFT(1, 20, unsigned int, 1U << 20, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 36- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 39- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:339:16: note: in expansion of macro 'TEST_ONE_SHIFT' 339 | err |= TEST_ONE_SHIFT(1, 31, unsigned int, 1U << 31, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 45- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 48- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:340:16: note: in expansion of macro 'TEST_ONE_SHIFT' 340 | err |= TEST_ONE_SHIFT(0xFFFFU, 16, unsigned int, 0xFFFFU << 16, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:43: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 54- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 57- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:340:16: note: in expansion of macro 'TEST_ONE_SHIFT' 340 | err |= TEST_ONE_SHIFT(0xFFFFU, 16, unsigned int, 0xFFFFU << 16, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 63- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 66- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:341:16: note: in expansion of macro 'TEST_ONE_SHIFT' 341 | err |= TEST_ONE_SHIFT(1, 0, u32, 1U << 0, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 72- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 75- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:342:16: note: in expansion of macro 'TEST_ONE_SHIFT' 342 | err |= TEST_ONE_SHIFT(1, 20, u32, 1U << 20, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 81- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 84- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:343:16: note: in expansion of macro 'TEST_ONE_SHIFT' 343 | err |= TEST_ONE_SHIFT(1, 31, u32, 1U << 31, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 90- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 93- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:344:16: note: in expansion of macro 'TEST_ONE_SHIFT' 344 | err |= TEST_ONE_SHIFT(0xFFFFU, 16, u32, 0xFFFFU << 16, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:43: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 99- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' 302 | bool __of = check_shl_overflow(__a, __s, &__d); 102- | ^~~~~~~~~~~~~~~~~~ lib/test_overflow.c:344:16: note: in expansion of macro 'TEST_ONE_SHIFT' 344 | err |= TEST_ONE_SHIFT(0xFFFFU, 16, u32, 0xFFFFU << 16, false); | ^~~~~~~~~~~~~~ include/linux/overflow.h:232:33: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 232 | (_to_shift != _s || *_d < 0 || _a < 0 || 108- | ^ lib/test_overflow.c:302:21: note: in expansion of macro 'check_shl_overflow' -- >> mm/kmemleak.c:920:39: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] <asn:3> *ptr @@ got void const *ptr @@ mm/kmemleak.c:920:39: sparse: expected void const [noderef] <asn:3> *ptr mm/kmemleak.c:920:39: sparse: got void const *ptr >> mm/kmemleak.c:979:50: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const *ptr @@ got void const [noderef] <asn:3> *ptr @@ mm/kmemleak.c:979:50: sparse: expected void const *ptr mm/kmemleak.c:979:50: sparse: got void const [noderef] <asn:3> *ptr mm/kmemleak.c:1069:49: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const *ptr @@ got void const [noderef] <asn:3> *ptr @@ mm/kmemleak.c:1069:49: sparse: expected void const *ptr mm/kmemleak.c:1069:49: sparse: got void const [noderef] <asn:3> *ptr >> mm/kmemleak.c:2061:49: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] <asn:3> *ptr @@ got void const *ptr @@ mm/kmemleak.c:2061:49: sparse: expected void const [noderef] <asn:3> *ptr mm/kmemleak.c:2061:49: sparse: got void const *ptr mm/kmemleak.c:1685:13: sparse: sparse: context imbalance in 'kmemleak_seq_start' - different lock contexts for basic block mm/kmemleak.c: note: in included file (through include/linux/rculist.h, include/linux/sched/signal.h): include/linux/rcupdate.h:681:9: sparse: sparse: context imbalance in 'kmemleak_seq_stop' - unexpected unlock In file included from arch/arm64/include/asm/atomic.h:36, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from mm/kmemleak.c:74: In function '__cmpxchg_case_mb_4', inlined from '__cmpxchg_mb' at arch/arm64/include/asm/cmpxchg.h:143:1, inlined from 'kmemleak_disable' at mm/kmemleak.c:1958:6: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'int[1]' [-Warray-bounds=] 259 | asm volatile( 28- | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:291:1: note: in expansion of macro '__CMPXCHG_CASE' 291 | __CMPXCHG_CASE(w, , mb_4, dmb ish, , l, "memory") | ^~~~~~~~~~~~~~ mm/kmemleak.c: In function 'kmemleak_disable': mm/kmemleak.c:217:12: note: object 'kmemleak_error' of size 4 217 | static int kmemleak_error; | ^~~~~~~~~~~~~~ In function '__cmpxchg_case_mb_4', inlined from '__cmpxchg_mb' at arch/arm64/include/asm/cmpxchg.h:143:1, inlined from 'kmemleak_disable' at mm/kmemleak.c:1958:6: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'int[1]' [-Warray-bounds=] 259 | asm volatile( 41- | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:291:1: note: in expansion of macro '__CMPXCHG_CASE' 291 | __CMPXCHG_CASE(w, , mb_4, dmb ish, , l, "memory") | ^~~~~~~~~~~~~~ mm/kmemleak.c: In function 'kmemleak_disable': mm/kmemleak.c:217:12: note: object 'kmemleak_error' of size 4 217 | static int kmemleak_error; | ^~~~~~~~~~~~~~ -- >> net/bridge/netfilter/ebtables.c:747:16: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned char [usertype] proto @@ got restricted __be16 [usertype] ethproto @@ net/bridge/netfilter/ebtables.c:747:16: sparse: expected unsigned char [usertype] proto net/bridge/netfilter/ebtables.c:747:16: sparse: got restricted __be16 [usertype] ethproto >> net/bridge/netfilter/ebtables.c:384:16: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned char [usertype] proto @@ got restricted __be16 const [usertype] ethproto @@ net/bridge/netfilter/ebtables.c:384:16: sparse: expected unsigned char [usertype] proto net/bridge/netfilter/ebtables.c:384:16: sparse: got restricted __be16 const [usertype] ethproto net/bridge/netfilter/ebtables.c:421:16: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned char [usertype] proto @@ got restricted __be16 const [usertype] ethproto @@ net/bridge/netfilter/ebtables.c:421:16: sparse: expected unsigned char [usertype] proto net/bridge/netfilter/ebtables.c:421:16: sparse: got restricted __be16 const [usertype] ethproto In file included from include/linux/netfilter/x_tables.h:9, from net/bridge/netfilter/ebtables.c:21: net/bridge/netfilter/ebtables.c: In function 'do_update_counters.isra': net/bridge/netfilter/ebtables.c:1292:49: warning: array subscript i is outside array bounds of 'struct ebt_counter[0]' [-Warray-bounds=] 1292 | ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt); include/uapi/linux/netfilter/x_tables.h:108:34: note: in definition of macro 'ADD_COUNTER' 108 | #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0) | ^ In file included from net/bridge/netfilter/ebtables.c:22: include/linux/netfilter_bridge/ebtables.h:88:28: note: while referencing 'counters' 88 | struct ebt_counter counters[0] ____cacheline_aligned; | ^~~~~~~~ net/bridge/netfilter/ebtables.c:1292:49: warning: array subscript i is outside array bounds of 'struct ebt_counter[0]' [-Warray-bounds=] 1292 | ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt); include/uapi/linux/netfilter/x_tables.h:108:34: note: in definition of macro 'ADD_COUNTER' 108 | #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0) | ^ include/linux/netfilter_bridge/ebtables.h:88:28: note: while referencing 'counters' 88 | struct ebt_counter counters[0] ____cacheline_aligned; | ^~~~~~~~ net/bridge/netfilter/ebtables.c:1292:49: warning: array subscript i is outside array bounds of 'struct ebt_counter[0]' [-Warray-bounds=] 1292 | ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt); include/uapi/linux/netfilter/x_tables.h:108:51: note: in definition of macro 'ADD_COUNTER' 108 | #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0) | ^ include/linux/netfilter_bridge/ebtables.h:88:28: note: while referencing 'counters' 88 | struct ebt_counter counters[0] ____cacheline_aligned; | ^~~~~~~~ net/bridge/netfilter/ebtables.c:1292:49: warning: array subscript i is outside array bounds of 'struct ebt_counter[0]' [-Warray-bounds=] 1292 | ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt); include/uapi/linux/netfilter/x_tables.h:108:51: note: in definition of macro 'ADD_COUNTER' 108 | #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0) | ^ include/linux/netfilter_bridge/ebtables.h:88:28: note: while referencing 'counters' 88 | struct ebt_counter counters[0] ____cacheline_aligned; | ^~~~~~~~ -- >> net/ceph/crypto.c:219:9: sparse: sparse: Variable length array is used. In file included from include/linux/ceph/ceph_fs.h:16, from include/linux/ceph/types.h:11, from include/linux/ceph/decode.h:11, from net/ceph/crypto.c:16: include/linux/ceph/msgr.h:67:1: warning: alignment 1 of 'struct ceph_entity_addr' is less than 8 [-Wpacked-not-aligned] 67 | } __attribute__ ((packed)); | ^ -- >> net/dsa/legacy.c:474:44: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted __be32 const [usertype] *p @@ got unsigned int const *[assigned] sw_addr @@ net/dsa/legacy.c:474:44: sparse: expected restricted __be32 const [usertype] *p net/dsa/legacy.c:474:44: sparse: got unsigned int const *[assigned] sw_addr >> net/dsa/legacy.c:502:51: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted __be32 const [usertype] *p @@ got unsigned int const *[assigned] port_reg @@ net/dsa/legacy.c:502:51: sparse: expected restricted __be32 const [usertype] *p net/dsa/legacy.c:502:51: sparse: got unsigned int const *[assigned] port_reg -- >> net/dsa/tag_mtk.c:80:13: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] hdr @@ got unsigned short [usertype] @@ net/dsa/tag_mtk.c:80:13: sparse: expected restricted __be16 [usertype] hdr net/dsa/tag_mtk.c:80:13: sparse: got unsigned short [usertype] net/dsa/tag_mtk.c:90:17: sparse: sparse: restricted __be16 degrades to integer -- net/dsa/tag_qca.c:59:15: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] @@ got restricted __be16 [usertype] @@ net/dsa/tag_qca.c:59:15: sparse: expected unsigned short [usertype] net/dsa/tag_qca.c:59:15: sparse: got restricted __be16 [usertype] >> net/dsa/tag_qca.c:79:13: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] hdr @@ got unsigned short [usertype] @@ net/dsa/tag_qca.c:79:13: sparse: expected restricted __be16 [usertype] hdr net/dsa/tag_qca.c:79:13: sparse: got unsigned short [usertype] net/dsa/tag_qca.c:82:16: sparse: sparse: restricted __be16 degrades to integer net/dsa/tag_qca.c:92:17: sparse: sparse: restricted __be16 degrades to integer -- >> net/netfilter/core.c:586:26: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile *p @@ got void ( *[noderef] <asn:4> * )( ... ) @@ net/netfilter/core.c:586:26: sparse: expected void const volatile *p net/netfilter/core.c:586:26: sparse: got void ( *[noderef] <asn:4> * )( ... ) >> net/netfilter/core.c:586:26: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile *p @@ got void ( *[noderef] <asn:4> * )( ... ) @@ net/netfilter/core.c:586:26: sparse: expected void const volatile *p net/netfilter/core.c:586:26: sparse: got void ( *[noderef] <asn:4> * )( ... ) net/netfilter/core.c:586:26: sparse: sparse: incompatible types in comparison expression (different address spaces): net/netfilter/core.c:586:26: sparse: void ( [noderef] <asn:4> * )( ... ) net/netfilter/core.c:586:26: sparse: void ( * )( ... ) -- >> net/netfilter/nf_nat_core.c:707:25: sparse: sparse: incompatible types in comparison expression (different address spaces): net/netfilter/nf_nat_core.c:707:25: sparse: struct nf_nat_l4proto const [noderef] <asn:4> * net/netfilter/nf_nat_core.c:707:25: sparse: struct nf_nat_l4proto const * In file included from include/net/ip_tunnels.h:16, from include/net/gre.h:6, from include/linux/netfilter/nf_conntrack_proto_gre.h:5, from include/net/netfilter/nf_conntrack.h:25, from net/netfilter/nf_nat_core.c:22: In function 'net_generic', inlined from 'nf_nat_register_fn' at net/netfilter/nf_nat_core.c:908:28: include/net/netns/generic.h:46:22: warning: array subscript <unknown> is outside array bounds of 'void *[0]' [-Warray-bounds=] 46 | ptr = ng->ptr[id]; | ~~~~~~~^~~~ include/net/netns/generic.h: In function 'nf_nat_register_fn': include/net/netns/generic.h:35:23: note: while referencing 'ptr' 35 | void *ptr[0]; | ^~~ In function 'net_generic', inlined from 'nf_nat_unregister_fn' at net/netfilter/nf_nat_core.c:986:28: include/net/netns/generic.h:46:22: warning: array subscript <unknown> is outside array bounds of 'void *[0]' [-Warray-bounds=] 46 | ptr = ng->ptr[id]; | ~~~~~~~^~~~ include/net/netns/generic.h: In function 'nf_nat_unregister_fn': include/net/netns/generic.h:35:23: note: while referencing 'ptr' 35 | void *ptr[0]; | ^~~ -- >> net/netfilter/nft_counter.c:158:35: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct nft_counter_percpu_priv [noderef] <asn:3> *priv @@ got struct nft_counter_percpu_priv *priv @@ net/netfilter/nft_counter.c:158:35: sparse: expected struct nft_counter_percpu_priv [noderef] <asn:3> *priv net/netfilter/nft_counter.c:158:35: sparse: got struct nft_counter_percpu_priv *priv >> net/netfilter/nft_counter.c:113:20: sparse: sparse: dereference of noderef expression -- >> net/tls/tls_main.c:746:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __poll_t ( *static [addressable] [assigned] [toplevel] poll )( ... ) @@ got unsigned int ( * )( ... ) @@ net/tls/tls_main.c:746:31: sparse: expected restricted __poll_t ( *static [addressable] [assigned] [toplevel] poll )( ... ) net/tls/tls_main.c:746:31: sparse: got unsigned int ( * )( ... ) -- >> net/tls/tls_sw.c:1302:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int ( *sk_poll )( ... ) @@ got restricted __poll_t ( *const poll )( ... ) @@ net/tls/tls_sw.c:1302:36: sparse: expected unsigned int ( *sk_poll )( ... ) net/tls/tls_sw.c:1302:36: sparse: got restricted __poll_t ( *const poll )( ... ) -- >> net/tls/tls_device.c:559:19: sparse: sparse: cast to restricted __be32 -- >> security/selinux/ss/ebitmap.c:389:28: sparse: sparse: cast to restricted __le32 >> security/selinux/ss/ebitmap.c:389:28: sparse: sparse: cast to restricted __le32 >> security/selinux/ss/ebitmap.c:389:28: sparse: sparse: cast to restricted __le32 >> security/selinux/ss/ebitmap.c:389:28: sparse: sparse: cast to restricted __le32 >> security/selinux/ss/ebitmap.c:389:28: sparse: sparse: cast to restricted __le32 >> security/selinux/ss/ebitmap.c:389:28: sparse: sparse: cast to restricted __le32 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 >> security/selinux/ss/ebitmap.c:431:23: sparse: sparse: cast to restricted __le64 -- >> security/smack/smack_lsm.c:2588:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] dport @@ got unsigned short [usertype] @@ security/smack/smack_lsm.c:2588:27: sparse: expected restricted __be16 [usertype] dport security/smack/smack_lsm.c:2588:27: sparse: got unsigned short [usertype] security/smack/smack_lsm.c:4880:17: sparse: sparse: cast removes address space '<asn:4>' of expression >> security/smack/smack_lsm.c:1845:50: sparse: sparse: dereference of noderef expression >> security/smack/smack_lsm.c:1845:50: sparse: sparse: dereference of noderef expression security/smack/smack_lsm.c: In function 'smack_d_instantiate': security/smack/smack_lsm.c:3475:23: warning: this statement may fall through [-Wimplicit-fallthrough=] 3475 | final = &smack_known_star; | ~~~~~~^~~~~~~~~~~~~~~~~~~ security/smack/smack_lsm.c:3484:9: note: here 3484 | default: | ^~~~~~~ security/smack/smack_lsm.c:398: warning: Function parameter or member 'mode' not described in 'smk_ptrace_mode' security/smack/smack_lsm.c:514: warning: Function parameter or member 'typefrom_file' not described in 'smack_syslog' security/smack/smack_lsm.c:514: warning: Excess function parameter 'type' description in 'smack_syslog' security/smack/smack_lsm.c:1279: warning: Function parameter or member 'path' not described in 'smack_inode_getattr' security/smack/smack_lsm.c:1279: warning: Excess function parameter 'mnt' description in 'smack_inode_getattr' security/smack/smack_lsm.c:1279: warning: Excess function parameter 'dentry' description in 'smack_inode_getattr' security/smack/smack_lsm.c:1721: warning: Function parameter or member 'file' not described in 'smack_mmap_file' security/smack/smack_lsm.c:1721: warning: Function parameter or member 'reqprot' not described in 'smack_mmap_file' security/smack/smack_lsm.c:1721: warning: Function parameter or member 'prot' not described in 'smack_mmap_file' security/smack/smack_lsm.c:1721: warning: Function parameter or member 'flags' not described in 'smack_mmap_file' security/smack/smack_lsm.c:1939: warning: Excess function parameter 'cred' description in 'smack_file_open' security/smack/smack_lsm.c:1967: warning: Function parameter or member 'cred' not described in 'smack_cred_alloc_blank' security/smack/smack_lsm.c:1967: warning: Excess function parameter 'new' description in 'smack_cred_alloc_blank' security/smack/smack_lsm.c:2225: warning: Excess function parameter 'policy' description in 'smack_task_setscheduler' security/smack/smack_lsm.c:2225: warning: Excess function parameter 'lp' description in 'smack_task_setscheduler' security/smack/smack_lsm.c:2697: warning: Function parameter or member 'sk' not described in 'smk_ipv6_port_check' security/smack/smack_lsm.c:2697: warning: Function parameter or member 'act' not described in 'smk_ipv6_port_check' security/smack/smack_lsm.c:2697: warning: Excess function parameter 'sock' description in 'smk_ipv6_port_check' security/smack/smack_lsm.c:3110: warning: Function parameter or member 'ipc' not described in 'smack_shm_shmat' security/smack/smack_lsm.c:3110: warning: Excess function parameter 'isp' description in 'smack_shm_shmat' -- sound/core/pcm_native.c:591:51: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted snd_pcm_state_t [usertype] state @@ got int state @@ sound/core/pcm_native.c:591:51: sparse: expected restricted snd_pcm_state_t [usertype] state sound/core/pcm_native.c:591:51: sparse: got int state sound/core/pcm_native.c:756:38: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:756:38: sparse: expected int state sound/core/pcm_native.c:756:38: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:768:38: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:768:38: sparse: expected int state sound/core/pcm_native.c:768:38: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:817:38: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:817:38: sparse: expected int state sound/core/pcm_native.c:817:38: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:1227:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted snd_pcm_state_t [usertype] state @@ got int state @@ sound/core/pcm_native.c:1227:32: sparse: expected restricted snd_pcm_state_t [usertype] state sound/core/pcm_native.c:1227:32: sparse: got int state sound/core/pcm_native.c:1251:31: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:1251:31: sparse: expected int state sound/core/pcm_native.c:1251:31: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:1258:40: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:1258:40: sparse: expected int state sound/core/pcm_native.c:1258:40: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:1284:28: sparse: sparse: restricted snd_pcm_state_t degrades to integer sound/core/pcm_native.c:1286:40: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted snd_pcm_state_t [usertype] state @@ got int state @@ sound/core/pcm_native.c:1286:40: sparse: expected restricted snd_pcm_state_t [usertype] state sound/core/pcm_native.c:1286:40: sparse: got int state sound/core/pcm_native.c:1310:64: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] state @@ sound/core/pcm_native.c:1310:64: sparse: expected int state sound/core/pcm_native.c:1310:64: sparse: got restricted snd_pcm_state_t [usertype] state sound/core/pcm_native.c:1326:38: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:1326:38: sparse: expected int state sound/core/pcm_native.c:1326:38: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:1700:38: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:1700:38: sparse: expected int state sound/core/pcm_native.c:1700:38: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:1766:61: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:1766:61: sparse: expected int state sound/core/pcm_native.c:1766:61: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:1767:63: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected int state @@ got restricted snd_pcm_state_t [usertype] @@ sound/core/pcm_native.c:1767:63: sparse: expected int state sound/core/pcm_native.c:1767:63: sparse: got restricted snd_pcm_state_t [usertype] sound/core/pcm_native.c:1784:76: sparse: sparse: incorrect type in initializer (different base types) @@ expected int new_state @@ got restricted snd_pcm_state_t @@ sound/core/pcm_native.c:1784:76: sparse: expected int new_state sound/core/pcm_native.c:1784:76: sparse: got restricted snd_pcm_state_t sound/core/pcm_native.c:2105:26: sparse: sparse: restricted snd_pcm_format_t degrades to integer sound/core/pcm_native.c:2109:54: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted snd_pcm_format_t [usertype] format @@ got unsigned int [assigned] k @@ sound/core/pcm_native.c:2109:54: sparse: expected restricted snd_pcm_format_t [usertype] format sound/core/pcm_native.c:2109:54: sparse: got unsigned int [assigned] k sound/core/pcm_native.c:2127:26: sparse: sparse: restricted snd_pcm_format_t degrades to integer sound/core/pcm_native.c:2131:54: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted snd_pcm_format_t [usertype] format @@ got unsigned int [assigned] k @@ sound/core/pcm_native.c:2131:54: sparse: expected restricted snd_pcm_format_t [usertype] format sound/core/pcm_native.c:2131:54: sparse: got unsigned int [assigned] k sound/core/pcm_native.c:2311:30: sparse: sparse: restricted snd_pcm_access_t degrades to integer sound/core/pcm_native.c:2313:30: sparse: sparse: restricted snd_pcm_access_t degrades to integer sound/core/pcm_native.c:2316:38: sparse: sparse: restricted snd_pcm_access_t degrades to integer sound/core/pcm_native.c:2318:38: sparse: sparse: restricted snd_pcm_access_t degrades to integer sound/core/pcm_native.c:2320:38: sparse: sparse: restricted snd_pcm_access_t degrades to integer sound/core/pcm_native.c:2330:86: sparse: sparse: restricted snd_pcm_subformat_t degrades to integer sound/core/pcm_native.c: note: in included file: >> sound/core/pcm_compat.c:226:13: sparse: sparse: incorrect type in initializer (different base types) @@ expected signed int __pu_val @@ got restricted snd_pcm_state_t [addressable] [assigned] [usertype] state @@ sound/core/pcm_compat.c:226:13: sparse: expected signed int __pu_val sound/core/pcm_compat.c:226:13: sparse: got restricted snd_pcm_state_t [addressable] [assigned] [usertype] state >> sound/core/pcm_compat.c:235:13: sparse: sparse: incorrect type in initializer (different base types) @@ expected signed int __pu_val @@ got restricted snd_pcm_state_t [addressable] [assigned] [usertype] suspended_state @@ sound/core/pcm_compat.c:235:13: sparse: expected signed int __pu_val sound/core/pcm_compat.c:235:13: sparse: got restricted snd_pcm_state_t [addressable] [assigned] [usertype] suspended_state >> sound/core/pcm_compat.c:525:13: sparse: sparse: incorrect type in initializer (different base types) @@ expected signed int __pu_val @@ got restricted snd_pcm_state_t [assigned] [usertype] state @@ sound/core/pcm_compat.c:525:13: sparse: expected signed int __pu_val sound/core/pcm_compat.c:525:13: sparse: got restricted snd_pcm_state_t [assigned] [usertype] state sound/core/pcm_compat.c:528:13: sparse: sparse: incorrect type in initializer (different base types) @@ expected signed int __pu_val @@ got restricted snd_pcm_state_t [addressable] [assigned] [usertype] suspended_state @@ sound/core/pcm_compat.c:528:13: sparse: expected signed int __pu_val sound/core/pcm_compat.c:528:13: sparse: got restricted snd_pcm_state_t [addressable] [assigned] [usertype] suspended_state sound/core/pcm_native.c:128:9: sparse: sparse: context imbalance in '__snd_pcm_stream_lock_mode' - different lock contexts for basic block sound/core/pcm_native.c:138:28: sparse: sparse: context imbalance in '__snd_pcm_stream_unlock_mode' - unexpected unlock sound/core/pcm_native.c:1098:52: sparse: sparse: context imbalance in 'snd_pcm_action_group' - unexpected unlock sound/core/pcm_native.c: In function 'constrain_mask_params': sound/core/pcm_native.c:285:25: warning: variable 'old_mask' set but not used [-Wunused-but-set-variable] 285 | struct snd_mask old_mask; | ^~~~~~~~ sound/core/pcm_native.c: In function 'constrain_interval_params': sound/core/pcm_native.c:321:29: warning: variable 'old_interval' set but not used [-Wunused-but-set-variable] 321 | struct snd_interval old_interval; | ^~~~~~~~~~~~ sound/core/pcm_native.c: In function 'constrain_params_by_rules': sound/core/pcm_native.c:362:29: warning: variable 'old_interval' set but not used [-Wunused-but-set-variable] 362 | struct snd_interval old_interval; | ^~~~~~~~~~~~ sound/core/pcm_native.c:361:25: warning: variable 'old_mask' set but not used [-Wunused-but-set-variable] 361 | struct snd_mask old_mask; | ^~~~~~~~ sound/core/pcm_native.c: In function 'snd_pcm_hw_params_choose': sound/core/pcm_native.c:633:29: warning: variable 'old_interval' set but not used [-Wunused-but-set-variable] 633 | struct snd_interval old_interval; | ^~~~~~~~~~~~ sound/core/pcm_native.c:632:25: warning: variable 'old_mask' set but not used [-Wunused-but-set-variable] 632 | struct snd_mask old_mask; | ^~~~~~~~ In file included from include/linux/uaccess.h:11, from include/linux/poll.h:12, from include/sound/info.h:25, from sound/core/pcm_native.c:33: sound/core/pcm_compat.c: In function 'snd_pcm_status_user_compat': sound/core/pcm_compat.c:218:33: warning: taking address of packed member of 'struct snd_pcm_status32' may result in an unaligned pointer value [-Waddress-of-packed-member] 218 | (u32 __user *)(&src->audio_tstamp_data))) arch/arm64/include/asm/uaccess.h:311:43: note: in definition of macro '__get_user_check' 311 | __typeof__(*(ptr)) __user *__p = (ptr); 105- | ^~~ arch/arm64/include/asm/uaccess.h:334:25: note: in expansion of macro '__get_user' 334 | #define get_user __get_user | ^~~~~~~~~~ sound/core/pcm_compat.c:217:20: note: in expansion of macro 'get_user' 217 | if (ext && get_user(status.audio_tstamp_data, | ^~~~~~~~ sound/core/pcm_compat.c:226:36: warning: taking address of packed member of 'struct snd_pcm_status32' may result in an unaligned pointer value [-Waddress-of-packed-member] 226 | if (put_user(status.state, &src->state) || arch/arm64/include/asm/uaccess.h:380:43: note: in definition of macro '__put_user_check' 380 | __typeof__(*(ptr)) __user *__p = (ptr); 116- | ^~~ arch/arm64/include/asm/uaccess.h:403:25: note: in expansion of macro '__put_user' 403 | #define put_user __put_user | ^~~~~~~~~~ sound/core/pcm_compat.c:226:13: note: in expansion of macro 'put_user' 226 | if (put_user(status.state, &src->state) || | ^~~~~~~~ sound/core/pcm_compat.c:229:39: warning: taking address of packed member of 'struct snd_pcm_status32' may result in an unaligned pointer value [-Waddress-of-packed-member] 229 | put_user(status.appl_ptr, &src->appl_ptr) || arch/arm64/include/asm/uaccess.h:380:43: note: in definition of macro '__put_user_check' 380 | __typeof__(*(ptr)) __user *__p = (ptr); 127- | ^~~ arch/arm64/include/asm/uaccess.h:403:25: note: in expansion of macro '__put_user' 403 | #define put_user __put_user | ^~~~~~~~~~ sound/core/pcm_compat.c:229:13: note: in expansion of macro 'put_user' 229 | put_user(status.appl_ptr, &src->appl_ptr) || | ^~~~~~~~ sound/core/pcm_compat.c:230:37: warning: taking address of packed member of 'struct snd_pcm_status32' may result in an unaligned pointer value [-Waddress-of-packed-member] 230 | put_user(status.hw_ptr, &src->hw_ptr) || arch/arm64/include/asm/uaccess.h:380:43: note: in definition of macro '__put_user_check' 380 | __typeof__(*(ptr)) __user *__p = (ptr); 138- | ^~~ arch/arm64/include/asm/uaccess.h:403:25: note: in expansion of macro '__put_user' 403 | #define put_user __put_user | ^~~~~~~~~~ sound/core/pcm_compat.c:230:13: note: in expansion of macro 'put_user' 230 | put_user(status.hw_ptr, &src->hw_ptr) || | ^~~~~~~~ sound/core/pcm_compat.c:231:36: warning: taking address of packed member of 'struct snd_pcm_status32' may result in an unaligned pointer value [-Waddress-of-packed-member] 231 | put_user(status.delay, &src->delay) || arch/arm64/include/asm/uaccess.h:380:43: note: in definition of macro '__put_user_check' 380 | __typeof__(*(ptr)) __user *__p = (ptr); 149- | ^~~ arch/arm64/include/asm/uaccess.h:403:25: note: in expansion of macro '__put_user' 403 | #define put_user __put_user | ^~~~~~~~~~ sound/core/pcm_compat.c:231:13: note: in expansion of macro 'put_user' 231 | put_user(status.delay, &src->delay) || | ^~~~~~~~ sound/core/pcm_compat.c:232:36: warning: taking address of packed member of 'struct snd_pcm_status32' may result in an unaligned pointer value [-Waddress-of-packed-member] 232 | put_user(status.avail, &src->avail) || arch/arm64/include/asm/uaccess.h:380:43: note: in definition of macro '__put_user_check' 380 | __typeof__(*(ptr)) __user *__p = (ptr); 160- | ^~~ arch/arm64/include/asm/uaccess.h:403:25: note: in expansion of macro '__put_user' 403 | #define put_user __put_user | ^~~~~~~~~~ sound/core/pcm_compat.c:232:13: note: in expansion of macro 'put_user' 232 | put_user(status.avail, &src->avail) || -- >> sound/soc/codecs/rt5645.c:680:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short reg @@ got restricted __be16 [usertype] @@ sound/soc/codecs/rt5645.c:680:33: sparse: expected unsigned short reg sound/soc/codecs/rt5645.c:680:33: sparse: got restricted __be16 [usertype] >> sound/soc/codecs/rt5645.c:681:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short val @@ got restricted __be16 [usertype] @@ sound/soc/codecs/rt5645.c:681:33: sparse: expected unsigned short val sound/soc/codecs/rt5645.c:681:33: sparse: got restricted __be16 [usertype] >> sound/soc/codecs/rt5645.c:706:35: sparse: sparse: cast to restricted __be16 sound/soc/codecs/rt5645.c:707:35: sparse: sparse: cast to restricted __be16 sound/soc/codecs/rt5645.c:1623:38: warning: 'rt5645_if3_adc_in_mux' defined but not used [-Wunused-const-variable=] 1623 | static const struct snd_kcontrol_new rt5645_if3_adc_in_mux = | ^~~~~~~~~~~~~~~~~~~~~ sound/soc/codecs/rt5645.c:1312:38: warning: 'rt5645_inr_mux' defined but not used [-Wunused-const-variable=] 1312 | static const struct snd_kcontrol_new rt5645_inr_mux = | ^~~~~~~~~~~~~~ sound/soc/codecs/rt5645.c:1301:38: warning: 'rt5645_inl_mux' defined but not used [-Wunused-const-variable=] 1301 | static const struct snd_kcontrol_new rt5645_inl_mux = | ^~~~~~~~~~~~~~ vim +1379 arch/arm64/kernel/ptrace.c 478fcb2cdb2351 Will Deacon 2012-03-05 1362 478fcb2cdb2351 Will Deacon 2012-03-05 1363 static int compat_ptrace_write_user(struct task_struct *tsk, compat_ulong_t off, 478fcb2cdb2351 Will Deacon 2012-03-05 1364 compat_ulong_t val) 478fcb2cdb2351 Will Deacon 2012-03-05 1365 { 478fcb2cdb2351 Will Deacon 2012-03-05 1366 int ret; c168870704bcde Will Deacon 2014-06-02 1367 mm_segment_t old_fs = get_fs(); 478fcb2cdb2351 Will Deacon 2012-03-05 1368 478fcb2cdb2351 Will Deacon 2012-03-05 1369 if (off & 3 || off >= COMPAT_USER_SZ) 478fcb2cdb2351 Will Deacon 2012-03-05 1370 return -EIO; 478fcb2cdb2351 Will Deacon 2012-03-05 1371 478fcb2cdb2351 Will Deacon 2012-03-05 1372 if (off >= sizeof(compat_elf_gregset_t)) 478fcb2cdb2351 Will Deacon 2012-03-05 1373 return 0; 478fcb2cdb2351 Will Deacon 2012-03-05 1374 c168870704bcde Will Deacon 2014-06-02 1375 set_fs(KERNEL_DS); 478fcb2cdb2351 Will Deacon 2012-03-05 1376 ret = copy_regset_from_user(tsk, &user_aarch32_view, 478fcb2cdb2351 Will Deacon 2012-03-05 1377 REGSET_COMPAT_GPR, off, 478fcb2cdb2351 Will Deacon 2012-03-05 1378 sizeof(compat_ulong_t), 478fcb2cdb2351 Will Deacon 2012-03-05 @1379 &val); c168870704bcde Will Deacon 2014-06-02 1380 set_fs(old_fs); c168870704bcde Will Deacon 2014-06-02 1381 478fcb2cdb2351 Will Deacon 2012-03-05 1382 return ret; 478fcb2cdb2351 Will Deacon 2012-03-05 1383 } 478fcb2cdb2351 Will Deacon 2012-03-05 1384 :::::: The code at line 1379 was first introduced by commit :::::: 478fcb2cdb2351dcfc3fb23f42d76f4436ee4149 arm64: Debugging support :::::: TO: Will Deacon <will.deacon(a)arm.com> :::::: CC: Catalin Marinas <catalin.marinas(a)arm.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS 10e0ea7796b38b1d35a6969966016d7a42d77b7f
by kernel test robot 07 Sep '24

07 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 10e0ea7796b38b1d35a6969966016d7a42d77b7f !11443 v2 drm/amd/display: Fix null pointer deref in dcn20_resource.c Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-allnoconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-allmodconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-allnoconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-allyesconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-003-20240907 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-006-20240907 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-defconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-004-20240907 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-012-20240907 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-016-20240907 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-071-20240907 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs `-- x86_64-rhel-8.3-rust `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs elapsed time: 1225m configs tested: 30 configs skipped: 97 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 x86_64 alldefconfig gcc-12 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240907 gcc-12 x86_64 buildonly-randconfig-002-20240907 gcc-12 x86_64 buildonly-randconfig-003-20240907 gcc-11 x86_64 buildonly-randconfig-004-20240907 clang-18 x86_64 buildonly-randconfig-005-20240907 gcc-12 x86_64 buildonly-randconfig-006-20240907 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240907 clang-18 x86_64 randconfig-002-20240907 gcc-12 x86_64 randconfig-003-20240907 gcc-12 x86_64 randconfig-004-20240907 clang-18 x86_64 randconfig-005-20240907 gcc-12 x86_64 randconfig-006-20240907 gcc-11 x86_64 randconfig-011-20240907 gcc-12 x86_64 randconfig-012-20240907 gcc-12 x86_64 randconfig-013-20240907 gcc-12 x86_64 randconfig-014-20240907 gcc-12 x86_64 randconfig-015-20240907 clang-18 x86_64 randconfig-016-20240907 gcc-12 x86_64 randconfig-071-20240907 clang-18 x86_64 randconfig-072-20240907 gcc-12 x86_64 randconfig-073-20240907 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] CVE-2024-44972
by Yifan Qiao 07 Sep '24

07 Sep '24

Naohiro Aota (1): btrfs: fix invalid mapping of extent xarray state Qu Wenruo (1): btrfs: do not clear page dirty inside extent_write_locked_range() fs/btrfs/extent_io.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) -- 2.39.2

2 3

[openeuler:openEuler-1.0-LTS 2828/23701] drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c:297:17: sparse: sparse: dubious: x & !y
by kernel test robot 07 Sep '24

07 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 13b424f97ef548612c760cfd0892f96de96707e0 commit: 9baadf685a5618364776aed92067526bb40c137d [2828/23701] build_bug.h: remove most of dummy BUILD_BUG_ON stubs for Sparse config: x86_64-randconfig-121-20240906 (https://download.01.org/0day-ci/archive/20240907/202409070807.ESq0nR8U-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240907/202409070807.ESq0nR8U-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409070807.ESq0nR8U-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c:297:17: sparse: sparse: dubious: x & !y drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c:481:16: sparse: sparse: dubious: x & !y -- drivers/net/wireless/mediatek/mt76/mt76x0/mac.c:166:16: sparse: sparse: incorrect type in return expression (different base types) @@ expected unsigned short @@ got restricted __le16 [usertype] @@ drivers/net/wireless/mediatek/mt76/mt76x0/mac.c:166:16: sparse: expected unsigned short drivers/net/wireless/mediatek/mt76/mt76x0/mac.c:166:16: sparse: got restricted __le16 [usertype] drivers/net/wireless/mediatek/mt76/mt76x0/mac.c:175:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] tx_rate @@ got unsigned short @@ drivers/net/wireless/mediatek/mt76/mt76x0/mac.c:175:23: sparse: expected restricted __le16 [usertype] tx_rate drivers/net/wireless/mediatek/mt76/mt76x0/mac.c:175:23: sparse: got unsigned short >> drivers/net/wireless/mediatek/mt76/mt76x0/mac.c:409:16: sparse: sparse: dubious: x & !y vim +297 drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 280 b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 281 int mt76x2_mac_wcid_set_key(struct mt76x2_dev *dev, u8 idx, b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 282 struct ieee80211_key_conf *key) b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 283 { b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 284 enum mt76x2_cipher_type cipher; b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 285 u8 key_data[32]; b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 286 u8 iv_data[8]; b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 287 b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 288 cipher = mt76x2_mac_get_key_info(key, key_data); b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 289 if (cipher == MT_CIPHER_NONE && key) b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 290 return -EOPNOTSUPP; b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 291 b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 292 mt76_rmw_field(dev, MT_WCID_ATTR(idx), MT_WCID_ATTR_PKEY_MODE, cipher); b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 293 mt76_wr_copy(dev, MT_WCID_KEY(idx), key_data, sizeof(key_data)); b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 294 b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 295 memset(iv_data, 0, sizeof(iv_data)); b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 296 if (key) { b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 @297 mt76_rmw_field(dev, MT_WCID_ATTR(idx), MT_WCID_ATTR_PAIRWISE, b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 298 !!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)); b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 299 iv_data[3] = key->keyidx << 6; b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 300 if (cipher >= MT_CIPHER_TKIP) b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 301 iv_data[3] |= 0x20; b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 302 } b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 303 b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 304 mt76_wr_copy(dev, MT_WCID_IV(idx), iv_data, sizeof(iv_data)); b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 305 b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 306 return 0; b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 307 } b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 308 EXPORT_SYMBOL_GPL(mt76x2_mac_wcid_set_key); b9c45e1c42b7d7 Lorenzo Bianconi 2018-07-31 309 :::::: The code at line 297 was first introduced by commit :::::: b9c45e1c42b7d709ade99b6ae243065a832e87aa mt76: add mt76x2_mac_common to mt76x2-common module :::::: TO: Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com> :::::: CC: Kalle Valo <kvalo(a)codeaurora.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 23675/23701] block/blk-io-hierarchy/iodump.c:571:7: warning: no previous prototype for '__bio_stage_hierarchy_start'
by kernel test robot 06 Sep '24

06 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 13b424f97ef548612c760cfd0892f96de96707e0 commit: ac91631e9ef7b530c02e40d10085072c08fb4a0a [23675/23701] blk-io-hierarchy: support new stage for bio lifetime config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240906/202409062219.DDwu0HG6-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240906/202409062219.DDwu0HG6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409062219.DDwu0HG6-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/blk-io-hierarchy/iodump.c:571:7: warning: no previous prototype for '__bio_stage_hierarchy_start' [-Wmissing-prototypes] 571 | void *__bio_stage_hierarchy_start(struct bio_stage_dump_data *bstage_ddata, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/asm-generic/preempt.h:5, from ./arch/arm64/include/generated/asm/preempt.h:1, from include/linux/preempt.h:81, from include/linux/spinlock.h:51, from include/linux/wait.h:9, from include/linux/wait_bit.h:8, from include/linux/fs.h:7, from include/linux/seq_file.h:11, from block/blk-io-hierarchy/iodump.c:14: In function 'check_object_size', inlined from 'check_copy_size' at include/linux/thread_info.h:90:2, inlined from 'copy_from_user' at include/linux/uaccess.h:143:6, inlined from 'threshold_store' at block/blk-io-hierarchy/iodump.c:273:6: include/linux/thread_info.h:59:17: warning: 'b' may be used uninitialized [-Wmaybe-uninitialized] 59 | __check_object_size(ptr, n, to_user); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/thread_info.h: In function 'threshold_store': include/linux/thread_info.h:52:13: note: by argument 1 of type 'const void *' to '__check_object_size' declared here 52 | extern void __check_object_size(const void *ptr, unsigned long n, | ^~~~~~~~~~~~~~~~~~~ block/blk-io-hierarchy/iodump.c:267:14: note: 'b' declared here 267 | char b[MAX_BUF_LEN + 1]; | ^ vim +/__bio_stage_hierarchy_start +571 block/blk-io-hierarchy/iodump.c 570 > 571 void *__bio_stage_hierarchy_start(struct bio_stage_dump_data *bstage_ddata, 572 loff_t *pos) 573 { 574 struct pos_data *pdata = &bstage_ddata->pdata; 575 struct rq_dump_data *rq_ddata = &bstage_ddata->rq_ddata; 576 577 retry: 578 if (stage_is_bio(pdata->stage)) { 579 struct list_head *list; 580 struct bio_dump_data *bio_ddata = 581 get_bio_stage_ddata(rq_ddata->q, pdata->stage); 582 583 if (!bio_ddata) { 584 bio_stage_start_next_stage(bstage_ddata, pos); 585 goto retry; 586 } 587 588 spin_lock_irq(&bio_ddata->lock); 589 list = seq_list_start(&bio_ddata->head, pdata->count); 590 if (list) 591 return list; 592 593 spin_unlock_irq(&bio_ddata->lock); 594 bio_stage_start_next_stage(bstage_ddata, pos); 595 goto retry; 596 } 597 598 if (pdata->stage == STAGE_BIO && 599 __rq_hierarchy_start(rq_ddata, pdata->count)) 600 return bstage_ddata; 601 602 return NULL; 603 } 604 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 13838/30000] drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `fmgr_usr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here
by kernel test robot 06 Sep '24

06 Sep '24

Hi DuanqiangWen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c431540f5e2720652e293713c7358952cd0148de commit: 3ddd74dceeba1f4ea8b20db59276ea3c6eded3d5 [13838/30000] openeuler: net: txgbe: Fix some known bugs, merge net-swift txgbe-1.2.3 out-of-tree config: x86_64-randconfig-003-20240906 (https://download.01.org/0day-ci/archive/20240906/202409062029.0Fv1YZCJ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240906/202409062029.0Fv1YZCJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409062029.0Fv1YZCJ-lkp@intel.com/ All errors (new ones prefixed by >>): ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `fmgr_cmd_op': drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2344: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2858: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `wr32': >> drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `fmgr_usr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_erase_chip': drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2371: multiple definition of `flash_erase_chip'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2885: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_erase_sector': drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2377: multiple definition of `flash_erase_sector'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2891: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_write_dword': drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2393: multiple definition of `flash_write_dword'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2908: first defined here vim +2877 drivers/net/ethernet/netswift/ngbe/ngbe_type.h a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2873 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2874 static inline void a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2875 wr32(struct ngbe_hw *hw, u32 reg, u32 val) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2876 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2877 u8 __iomem *base = READ_ONCE(hw->hw_addr); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2878 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2879 if (unlikely(!base)) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2880 return; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2881 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2882 ngbe_wr32(base + reg, val); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2883 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2884 :::::: The code at line 2877 was first introduced by commit :::::: a5961b4bc6ce09a70902686ecc848a47493a9251 openeuler: net: ngbe: add ngbe module support :::::: TO: Duanqiang Wen <duanqiangwen(a)net-swift.com> :::::: CC: Duanqiang Wen <duanqiangwen(a)net-swift.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] ACPI/HMAT: Fix compile error when CONFIG_ACPI_HMAT is not enabled
by Zhang Zekun 06 Sep '24

06 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAPHFQ ------------------------------------------------ Fix compile error when CONFIG_ACPI_HMAT is not enabled: j ../drivers/acpi/acpi_memhotplug.c: In function ‘acpi_memory_enable_device’: ../drivers/acpi/acpi_memhotplug.c:236:5: error: implicit declaration of function ‘hmat_restore_target’; did you mean ‘mte_restore_tags’? [-Werror=implicit-function-declaration] hmat_restore_target(node); ^~~~~~~~~~~~~~~~~~~ mte_restore_tags Fixes: 2e1b00fcf1e3 ("ACPI/HMAT: Add missing locality information for hot-added device") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/acpi/internal.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h index 82444a4cbf15..3a7cc297c63d 100644 --- a/drivers/acpi/internal.h +++ b/drivers/acpi/internal.h @@ -265,6 +265,10 @@ void acpi_init_lpit(void); #else static inline void acpi_init_lpit(void) { } #endif +#ifdef CONFIG_ACPI_HMAT void hmat_restore_target(int nid); +#else +static inline void hmat_restore_target(int nid) {} +#endif #endif /* _ACPI_INTERNAL_H_ */ -- 2.17.1

2 1

[openeuler:openEuler-1.0-LTS 23662/23701] include/linux/thread_info.h:59:17: warning: 'b' may be used uninitialized
by kernel test robot 06 Sep '24

06 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 13b424f97ef548612c760cfd0892f96de96707e0 commit: b9f356e64a7eda411ba8b63df9d4c5e204f16025 [23662/23701] block-io-hierarchy: core hierarchy iodump implementation config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240906/202409061840.VkS4KqE5-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240906/202409061840.VkS4KqE5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409061840.VkS4KqE5-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from include/asm-generic/preempt.h:5, from ./arch/arm64/include/generated/asm/preempt.h:1, from include/linux/preempt.h:81, from include/linux/spinlock.h:51, from include/linux/wait.h:9, from include/linux/wait_bit.h:8, from include/linux/fs.h:7, from include/linux/seq_file.h:11, from block/blk-io-hierarchy/iodump.c:14: In function 'check_object_size', inlined from 'check_copy_size' at include/linux/thread_info.h:90:2, inlined from 'copy_from_user' at include/linux/uaccess.h:143:6, inlined from 'threshold_store' at block/blk-io-hierarchy/iodump.c:240:6: >> include/linux/thread_info.h:59:17: warning: 'b' may be used uninitialized [-Wmaybe-uninitialized] 59 | __check_object_size(ptr, n, to_user); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/thread_info.h: In function 'threshold_store': include/linux/thread_info.h:52:13: note: by argument 1 of type 'const void *' to '__check_object_size' declared here 52 | extern void __check_object_size(const void *ptr, unsigned long n, | ^~~~~~~~~~~~~~~~~~~ block/blk-io-hierarchy/iodump.c:234:14: note: 'b' declared here 234 | char b[MAX_BUF_LEN + 1]; | ^ vim +/b +59 include/linux/thread_info.h 0f60a8efe4005ab Kees Cook 2016-07-12 50 f5509cc18daa7f8 Kees Cook 2016-06-07 51 #ifdef CONFIG_HARDENED_USERCOPY f5509cc18daa7f8 Kees Cook 2016-06-07 52 extern void __check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f8 Kees Cook 2016-06-07 53 bool to_user); f5509cc18daa7f8 Kees Cook 2016-06-07 54 a85d6b8242dc78e Kees Cook 2016-09-07 55 static __always_inline void check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f8 Kees Cook 2016-06-07 56 bool to_user) f5509cc18daa7f8 Kees Cook 2016-06-07 57 { 81409e9e2805881 Kees Cook 2016-08-31 58 if (!__builtin_constant_p(n)) f5509cc18daa7f8 Kees Cook 2016-06-07 @59 __check_object_size(ptr, n, to_user); f5509cc18daa7f8 Kees Cook 2016-06-07 60 } f5509cc18daa7f8 Kees Cook 2016-06-07 61 #else f5509cc18daa7f8 Kees Cook 2016-06-07 62 static inline void check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f8 Kees Cook 2016-06-07 63 bool to_user) f5509cc18daa7f8 Kees Cook 2016-06-07 64 { } f5509cc18daa7f8 Kees Cook 2016-06-07 65 #endif /* CONFIG_HARDENED_USERCOPY */ f5509cc18daa7f8 Kees Cook 2016-06-07 66 :::::: The code at line 59 was first introduced by commit :::::: f5509cc18daa7f82bcc553be70df2117c8eedc16 mm: Hardened usercopy :::::: TO: Kees Cook <keescook(a)chromium.org> :::::: CC: Kees Cook <keescook(a)chromium.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/3] block, bfq: fix possible UAF for bfqq->bic with merge chain
by Yu Kuai 06 Sep '24

06 Sep '24

Yu Kuai (3): block, bfq: fix possible UAF for bfqq->bic with merge chain block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() block, bfq: don't break merge chain in bfq_split_bfqq() block/bfq-iosched.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) -- 2.39.2

2 4

[PATCH OLK-6.6 0/3] Some patches of Net are incorporated into olk-6.6 as follows:
by Jijie Shao 06 Sep '24

06 Sep '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some patches of Net are incorporated into olk-6.6 as follows: Jian Shen (2): net: hns3: don't auto enable misc vector net: hns3: initialize reset_timer before hclgevf_misc_irq_init() Jie Wang (1): net: hns3: fix kernel crash when 1588 is sent on HIP08 devices .../net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 11 +++++++---- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 3 +++ .../net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 2 +- 3 files changed, 11 insertions(+), 5 deletions(-) -- 2.33.0

2 4

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 13b424f97ef548612c760cfd0892f96de96707e0
by kernel test robot 06 Sep '24

06 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 13b424f97ef548612c760cfd0892f96de96707e0 !11418 md/raid5: avoid BUG_ON() while continue reshape after reassembling Warning ids grouped by kconfigs: recent_errors |-- x86_64-allyesconfig | `-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start `-- x86_64-buildonly-randconfig-001-20240906 |-- block-.tmp_blk-mq.o:warning:objtool:blk_mq_unfreeze_queue:unreachable-instruction |-- drivers-dax-.tmp_bus.o:warning:objtool:__dax_driver_register:unreachable-instruction |-- drivers-gpu-drm-.tmp_drm_atomic_helper.o:warning:objtool:drm_atomic_helper_check_modeset:unreachable-instruction |-- drivers-nvdimm-.tmp_namespace_devs.o:warning:objtool:nd_region_register_namespaces:unreachable-instruction |-- net-bpf-.tmp_test_run.o:warning:objtool:bpf_prog_test_run_skb:unreachable-instruction |-- net-can-j1939-.tmp_socket.o:warning:objtool:j1939_sk_queue_activate_next:unreachable-instruction `-- net-can-j1939-.tmp_transport.o:warning:objtool:j1939_xtp_abort_to_errno:unreachable-instruction elapsed time: 1242m configs tested: 35 configs skipped: 138 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240906 gcc-14.1.0 arm64 randconfig-002-20240906 gcc-14.1.0 arm64 randconfig-003-20240906 gcc-14.1.0 arm64 randconfig-004-20240906 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240906 clang-18 x86_64 buildonly-randconfig-002-20240906 clang-18 x86_64 buildonly-randconfig-003-20240906 clang-18 x86_64 buildonly-randconfig-004-20240906 clang-18 x86_64 buildonly-randconfig-005-20240906 clang-18 x86_64 buildonly-randconfig-006-20240906 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240906 clang-18 x86_64 randconfig-002-20240906 gcc-12 x86_64 randconfig-003-20240906 gcc-12 x86_64 randconfig-004-20240906 gcc-12 x86_64 randconfig-005-20240906 gcc-12 x86_64 randconfig-006-20240906 gcc-12 x86_64 randconfig-011-20240906 clang-18 x86_64 randconfig-012-20240906 gcc-12 x86_64 randconfig-013-20240906 clang-18 x86_64 randconfig-014-20240906 clang-18 x86_64 randconfig-015-20240906 clang-18 x86_64 randconfig-016-20240906 clang-18 x86_64 randconfig-071-20240906 gcc-12 x86_64 randconfig-072-20240906 gcc-12 x86_64 randconfig-073-20240906 clang-18 x86_64 randconfig-074-20240906 gcc-12 x86_64 randconfig-075-20240906 clang-18 x86_64 randconfig-076-20240906 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] ACPI/HMAT: Fix compile error when CONFIG_ACPI_HMAT is not enabled
by Zhang Zekun 06 Sep '24

06 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAPHFQ ------------------------------------------------ Fix compile error when CONFIG_ACPI_HMAT is not enabled: j ../drivers/acpi/acpi_memhotplug.c: In function ‘acpi_memory_enable_device’: ../drivers/acpi/acpi_memhotplug.c:236:5: error: implicit declaration of function ‘hmat_restore_target’; did you mean ‘mte_restore_tags’? [-Werror=implicit-function-declaration] hmat_restore_target(node); ^~~~~~~~~~~~~~~~~~~ mte_restore_tags Fixes: 2e1b00fcf1e3 ("ACPI/HMAT: Add missing locality information for hot-added device") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/acpi/internal.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h index 82444a4cbf15..3a7cc297c63d 100644 --- a/drivers/acpi/internal.h +++ b/drivers/acpi/internal.h @@ -265,6 +265,10 @@ void acpi_init_lpit(void); #else static inline void acpi_init_lpit(void) { } #endif +#ifdef CONFIG_ACPI_HMAT void hmat_restore_target(int nid); +#else +static inline void hmat_restore_target(int nid) {} +#endif #endif /* _ACPI_INTERNAL_H_ */ -- 2.17.1

1 0

[PATCH OLK-5.10 0/1] zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
by Chen Ridong 06 Sep '24

06 Sep '24

zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING Oleg Nesterov (1): zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING kernel/pid_namespace.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
by Chen Ridong 06 Sep '24

06 Sep '24

zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING Oleg Nesterov (1): zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING kernel/pid_namespace.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-5.10 v2 00/23] mm/block: add bdi sysfs knobs
by Yifan Qiao 06 Sep '24

06 Sep '24

At meta network block devices (nbd) are used to implement remote block storage. In testing and during production it has been observed that these network block devices can consume a huge portion of the dirty writeback cache and writeback can take a considerable time. To be able to give stricter limits, I'm proposing the following changes: introduce strictlimit knob Currently the max_ratio knob exists to limit the dirty_memory. However this knob only applies once (dirty_ratio + dirty_background_ratio) / 2 has been reached. With the BDI_CAP_STRICTLIMIT flag, the max_ratio can be applied without reaching that limit. This change exposes that knob. This knob can also be useful for NFS, fuse filesystems and USB devices. Use part of 1000000 internal calculation The max_ratio is based on percentage. With the current machine sizes percentage values can be very high (1% of a 256GB main memory is already 2.5GB). This change uses part of 1000000 instead of percentages for the internal calculations. Introduce two new sysfs knobs: min_bytes and max_bytes. Currently all calculations are based on ratio, but for a user it often more convenient to specify a limit in bytes. The new knobs will not store bytes values, instead they will translate the byte value to a corresponding ratio. As the internal values are now part of 1000, the ratio is closer to the specified value. However the value should be more seen as an approximation as it can fluctuate over time. Introduce two new sysfs knobs: min_ratio_fine and max_ratio_fine. The granularity for the existing sysfs bdi knobs min_ratio and max_ratio is based on percentage values. The new sysfs bdi knobs min_ratio_fine and max_ratio_fine allow to specify the ratio as part of 1 million. Chen Wandun (1): mm: rework calculation of bdi_min_ratio in bdi_set_min_ratio Jingbo Xu (2): mm: fix arithmetic for max_prop_frac when setting max_ratio mm: fix arithmetic for bdi min_ratio Stefan Roesch (20): mm: add bdi_set_strict_limit() function mm: add knob /sys/class/bdi/<bdi>/strict_limit mm: document /sys/class/bdi/<bdi>/strict_limit knob mm: use part per 1000000 for bdi ratios mm: add bdi_get_max_bytes() function mm: split off __bdi_set_max_ratio() function mm: add bdi_set_max_bytes() function mm: add knob /sys/class/bdi/<bdi>/max_bytes mm: document /sys/class/bdi/<bdi>/max_bytes knob mm: add bdi_get_min_bytes() function mm: split off __bdi_set_min_ratio() function mm: add bdi_set_min_bytes() function mm: add /sys/class/bdi/<bdi>/min_bytes knob mm: document /sys/class/bdi/<bdi>/min_bytes knob mm: add bdi_set_max_ratio_no_scale() function mm: add /sys/class/bdi/<bdi>/max_ratio_fine knob mm: document /sys/class/bdi/<bdi>/max_ratio_fine knob mm: add bdi_set_min_ratio_no_scale() function mm: add /sys/class/bdi/<bdi>/min_ratio_fine knob mm: document /sys/class/bdi/<bdi>/min_ratio_fine knob Documentation/ABI/testing/sysfs-class-bdi | 48 +++++++ include/linux/backing-dev.h | 10 ++ mm/backing-dev.c | 133 +++++++++++++++++++- mm/page-writeback.c | 147 +++++++++++++++++++--- 4 files changed, 321 insertions(+), 17 deletions(-) -- 2.39.2

3 25

[openeuler:OLK-6.6 13863/13878] drivers/base/platform-msi.c:237: warning: Function parameter or member 'write_msi_msg' not described in 'platform_msi_domain_alloc_range_irqs'
by kernel test robot 06 Sep '24

06 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ad51fadf8895f81201ef22e91984b57ed9b2f9af commit: ed007ade0cef81fb47328683b8a7eec5edfa8494 [13863/13878] virtcca feature: secure smmu init config: x86_64-defconfig (https://download.01.org/0day-ci/archive/20240906/202409061150.PH2ggN81-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240906/202409061150.PH2ggN81-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409061150.PH2ggN81-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/base/platform-msi.c:237: warning: Function parameter or member 'write_msi_msg' not described in 'platform_msi_domain_alloc_range_irqs' vim +237 drivers/base/platform-msi.c 223 224 #ifdef CONFIG_HISI_VIRTCCA_HOST 225 /** 226 * platform_msi_domain_alloc_range_irqs - Allocate specific scope MSI interrupts for @dev 227 * @dev: The device for which to allocate interrupts 228 * @start: The start index of msi 229 * @end: The end index of msi 230 * 231 * %0 if alloc irqs success 232 * %error_code if alloc irqs failed 233 * %-EINVAL if platform_data is null 234 */ 235 int platform_msi_domain_alloc_range_irqs(struct device *dev, unsigned int start, 236 unsigned int end, irq_write_msi_msg_t write_msi_msg) > 237 { 238 int err; 239 240 if (!dev->msi.data->platform_data) 241 return -EINVAL; 242 243 dev->msi.data->platform_data->write_msg = write_msi_msg; 244 err = msi_domain_alloc_irqs_range(dev, MSI_DEFAULT_DOMAIN, start, end); 245 if (err) 246 platform_msi_free_priv_data(dev); 247 248 return err; 249 } 250 EXPORT_SYMBOL_GPL(platform_msi_domain_alloc_range_irqs); 251 #endif 252 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] arm64: Add ARM64_HAS_LSE2 CPU capability
by Tian Tao 06 Sep '24

06 Sep '24

When FEAT_LSE2 is implemented and Bit 6 of sctlr_elx is nAA, the full name of the Not-aligned access. nAA bit has two values: 0b0 Unaligned accesses by the specified instructions generate an Alignment fault. 0b1 Unaligned accesses by the specified instructions do not generate an Alignment fault. this patch sets the nAA bit to 1,The following instructions will not generate an Alignment fault if all bytes being accessed are not within a single 16-byte quantity: • LDAPR, LDAPRH, LDAPUR, LDAPURH, LDAPURSH, LDAPURSW, LDAR, LDARH,LDLAR, LDLARH. • STLLR, STLLRH, STLR, STLRH, STLUR, and STLURH Signed-off-by: Tian Tao <tiantao6(a)hisilicon.com> --- arch/arm64/Kconfig | 10 ++++++++++ arch/arm64/include/asm/sysreg.h | 1 + arch/arm64/kernel/cpufeature.c | 18 ++++++++++++++++++ arch/arm64/tools/cpucaps | 1 + 4 files changed, 30 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 77d7ef0b16c2..bdeb2d897069 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -2023,6 +2023,16 @@ config ARM64_TLB_RANGE The feature introduces new assembly instructions, and they were support when binutils >= 2.30. +config ARM64_LSE2 + bool "Enable support for not-aligned access" + depends on AS_HAS_ARMV8_4 + help + LSE2 is an extension to the original LSE (Large System Extensions) feature, + introduced in ARMv8.4. + + Enable this feature will not generate an Alignment fault if all bytes being + accessed are not within a single 16-byte quantity. + endmenu # "ARMv8.4 architectural features" menu "ARMv8.5 architectural features" diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h index 8cced8aa75a9..42e3a1959aa8 100644 --- a/arch/arm64/include/asm/sysreg.h +++ b/arch/arm64/include/asm/sysreg.h @@ -854,6 +854,7 @@ #define SCTLR_ELx_ENDB (BIT(13)) #define SCTLR_ELx_I (BIT(12)) #define SCTLR_ELx_EOS (BIT(11)) +#define SCTLR_ELx_nAA (BIT(6)) #define SCTLR_ELx_SA (BIT(3)) #define SCTLR_ELx_C (BIT(2)) #define SCTLR_ELx_A (BIT(1)) diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 646ecd3069fd..cc85c6cd9908 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -2299,6 +2299,14 @@ static void cpu_enable_mte(struct arm64_cpu_capabilities const *cap) } #endif /* CONFIG_ARM64_MTE */ +#ifdef CONFIG_ARM64_LSE2 +static void cpu_enable_lse2(const struct arm64_cpu_capabilities *__unused) +{ + sysreg_clear_set(sctlr_el2, SCTLR_ELx_nAA, SCTLR_ELx_nAA); + isb(); +} +#endif + static void user_feature_fixup(void) { if (cpus_have_cap(ARM64_WORKAROUND_2658417)) { @@ -2427,6 +2435,16 @@ static const struct arm64_cpu_capabilities arm64_features[] = { ARM64_CPUID_FIELDS(ID_AA64ISAR0_EL1, ATOMIC, IMP) }, #endif /* CONFIG_ARM64_LSE_ATOMICS */ +#ifdef CONFIG_ARM64_LSE2 + { + .desc = "FEAT_LSE2", + .capability = ARM64_HAS_LSE2, + .type = ARM64_CPUCAP_SYSTEM_FEATURE, + .matches = has_cpuid_feature, + .cpu_enable = cpu_enable_lse2, + ARM64_CPUID_FIELDS(ID_AA64MMFR2_EL1, AT, IMP) + }, +#endif { .desc = "Virtualization Host Extensions", .capability = ARM64_HAS_VIRT_HOST_EXTN, diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps index ac3429d892b9..0c7c0a293574 100644 --- a/arch/arm64/tools/cpucaps +++ b/arch/arm64/tools/cpucaps @@ -41,6 +41,7 @@ HAS_HCX HAS_LDAPR HAS_LPA2 HAS_LSE_ATOMICS +HAS_LSE2 HAS_MOPS HAS_NESTED_VIRT HAS_PAN -- 2.33.0

1 0

[PATCH 0/3] Some patches of Net are incorporated into olk-6.6 as follows:
by Jijie Shao 06 Sep '24

06 Sep '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some patches of Net are incorporated into olk-6.6 as follows: Jian Shen (2): net: hns3: remove unnecessary synchronize_irq net: hns3: initialize reset_timer before hclgevf_misc_irq_init() Jie Wang (1): net: hns3: fix kernel crash when 1588 is sent on HIP08 devices drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 8 ++++---- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 3 +++ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 2 +- 3 files changed, 8 insertions(+), 5 deletions(-) -- 2.33.0

1 3

[PATCH OLK-6.6 v2] drm/amd/display: Fix null pointer deref in dcn20_resource.c
by Xiaomeng Zhang 06 Sep '24

06 Sep '24

From: Aurabindo Pillai <aurabindo.pillai(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit ecbf60782662f0a388493685b85a645a0ba1613c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMUG CVE: CVE-2024-43899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes a hang thats triggered when MPV is run on a DCN401 dGPU: mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all and then enabling fullscreen playback (double click on the video) The following calltrace will be seen: [ 181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 181.843997] #PF: supervisor instruction fetch in kernel mode [ 181.844003] #PF: error_code(0x0010) - not-present page [ 181.844009] PGD 0 P4D 0 [ 181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI [ 181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018 [ 181.844044] RIP: 0010:0x0 [ 181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246 [ 181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 [ 181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400 [ 181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c [ 181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8 [ 181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005 [ 181.844121] FS: 00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000 [ 181.844128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0 [ 181.844141] Call Trace: [ 181.844146] <TASK> [ 181.844153] ? show_regs+0x6d/0x80 [ 181.844167] ? __die+0x24/0x80 [ 181.844179] ? page_fault_oops+0x99/0x1b0 [ 181.844192] ? do_user_addr_fault+0x31d/0x6b0 [ 181.844204] ? exc_page_fault+0x83/0x1b0 [ 181.844216] ? asm_exc_page_fault+0x27/0x30 [ 181.844237] dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu] [ 181.845115] amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu] [ 181.845985] amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu] [ 181.846848] fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu] [ 181.847734] fill_dc_plane_attributes+0x162/0x350 [amdgpu] [ 181.848748] dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.849791] ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.850840] amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu] Signed-off-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c [The conflicts were due to file path changed] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c index d587f807dfd7..94bf438c7310 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c @@ -2178,10 +2178,11 @@ bool dcn20_get_dcc_compression_cap(const struct dc *dc, const struct dc_dcc_surface_param *input, struct dc_surface_dcc_cap *output) { - return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( - dc->res_pool->hubbub, - input, - output); + if (dc->res_pool->hubbub->funcs->get_dcc_compression_cap) + return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( + dc->res_pool->hubbub, input, output); + + return false; } static void dcn20_destroy_resource_pool(struct resource_pool **pool) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v2] drm/amd/display: Fix null pointer deref in dcn20_resource.c
by Xiaomeng Zhang 06 Sep '24

06 Sep '24

From: Aurabindo Pillai <aurabindo.pillai(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit ecbf60782662f0a388493685b85a645a0ba1613c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMUG CVE: CVE-2024-43899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes a hang thats triggered when MPV is run on a DCN401 dGPU: mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all and then enabling fullscreen playback (double click on the video) The following calltrace will be seen: [ 181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 181.843997] #PF: supervisor instruction fetch in kernel mode [ 181.844003] #PF: error_code(0x0010) - not-present page [ 181.844009] PGD 0 P4D 0 [ 181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI [ 181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018 [ 181.844044] RIP: 0010:0x0 [ 181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246 [ 181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 [ 181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400 [ 181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c [ 181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8 [ 181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005 [ 181.844121] FS: 00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000 [ 181.844128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0 [ 181.844141] Call Trace: [ 181.844146] <TASK> [ 181.844153] ? show_regs+0x6d/0x80 [ 181.844167] ? __die+0x24/0x80 [ 181.844179] ? page_fault_oops+0x99/0x1b0 [ 181.844192] ? do_user_addr_fault+0x31d/0x6b0 [ 181.844204] ? exc_page_fault+0x83/0x1b0 [ 181.844216] ? asm_exc_page_fault+0x27/0x30 [ 181.844237] dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu] [ 181.845115] amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu] [ 181.845985] amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu] [ 181.846848] fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu] [ 181.847734] fill_dc_plane_attributes+0x162/0x350 [amdgpu] [ 181.848748] dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.849791] ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.850840] amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu] Signed-off-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c [The conflicts were due to file path changed] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c index 53ac82693532..2990793e86a2 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c @@ -3290,10 +3290,11 @@ bool dcn20_get_dcc_compression_cap(const struct dc *dc, const struct dc_dcc_surface_param *input, struct dc_surface_dcc_cap *output) { - return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( - dc->res_pool->hubbub, - input, - output); + if (dc->res_pool->hubbub->funcs->get_dcc_compression_cap) + return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( + dc->res_pool->hubbub, input, output); + + return false; } static void dcn20_destroy_resource_pool(struct resource_pool **pool) -- 2.34.1

2 1

[PATCH OLK-5.10 v2] drm/amd/display: Fix null pointer deref in dcn20_resource.c
by Xiaomeng Zhang 06 Sep '24

06 Sep '24

From: Aurabindo Pillai <aurabindo.pillai(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit ecbf60782662f0a388493685b85a645a0ba1613c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMUG CVE: CVE-2024-43899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes a hang thats triggered when MPV is run on a DCN401 dGPU: mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all and then enabling fullscreen playback (double click on the video) The following calltrace will be seen: [ 181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 181.843997] #PF: supervisor instruction fetch in kernel mode [ 181.844003] #PF: error_code(0x0010) - not-present page [ 181.844009] PGD 0 P4D 0 [ 181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI [ 181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018 [ 181.844044] RIP: 0010:0x0 [ 181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246 [ 181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 [ 181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400 [ 181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c [ 181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8 [ 181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005 [ 181.844121] FS: 00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000 [ 181.844128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0 [ 181.844141] Call Trace: [ 181.844146] <TASK> [ 181.844153] ? show_regs+0x6d/0x80 [ 181.844167] ? __die+0x24/0x80 [ 181.844179] ? page_fault_oops+0x99/0x1b0 [ 181.844192] ? do_user_addr_fault+0x31d/0x6b0 [ 181.844204] ? exc_page_fault+0x83/0x1b0 [ 181.844216] ? asm_exc_page_fault+0x27/0x30 [ 181.844237] dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu] [ 181.845115] amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu] [ 181.845985] amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu] [ 181.846848] fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu] [ 181.847734] fill_dc_plane_attributes+0x162/0x350 [amdgpu] [ 181.848748] dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.849791] ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.850840] amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu] Signed-off-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c [The conflicts were due to file path changed] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c index 53ac82693532..2990793e86a2 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c @@ -3290,10 +3290,11 @@ bool dcn20_get_dcc_compression_cap(const struct dc *dc, const struct dc_dcc_surface_param *input, struct dc_surface_dcc_cap *output) { - return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( - dc->res_pool->hubbub, - input, - output); + if (dc->res_pool->hubbub->funcs->get_dcc_compression_cap) + return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( + dc->res_pool->hubbub, input, output); + + return false; } static void dcn20_destroy_resource_pool(struct resource_pool **pool) -- 2.34.1

2 1

[PATCH OLK-6.6] tools: Add dynamic process-level cgroup memory monitoring tool
by Taoxy2004 06 Sep '24

06 Sep '24

community inclusion category: feature bugzilla: https://gitee.com/openeuler/open-source-summer/issues/I9JQ4D ---------------------------------------------------------------------- This patch introduces a new tool called "probeCgroup" that enables dynamic monitoring of memory usage at the process level within cgroups. By using kprobes at relevant cgroup functions, this tool can track memory allocations and deallocations for individual processes within a cgroup, providing detailed statistics on memory usage. The key features of the tool include: 1. Dynamic insertion of kprobes at critical points in the cgroup subsystem. 2. Tracking memory allocation and deallocation events for each process by recording page addresses in a hash table. 3. Providing real-time statistics on memory usage at the process level. 4. Providing statistics on memory usage for processes that are OOM. Signed-off-by: Taoxy2004 <221870066(a)smail.nju.edu.cn> --- tools/probeCgroup/Makefile | 7 + tools/probeCgroup/README.md | 29 + tools/probeCgroup/probeCgroup.c | 612 ++++++++++++++++++ tools/probeCgroup/probeCgroup.h | 415 ++++++++++++ tools/probeCgroup/run.sh | 8 + tools/probeCgroup/scripts/script1.sh | 10 + tools/probeCgroup/scripts/script2.sh | 14 + tools/probeCgroup/scripts/script3.sh | 11 + .../testcases/1_load_unload_test.py | 24 + .../testcases/2_multiple_process_test.py | 48 ++ .../testcases/3_multiple_cgroup_test.py | 55 ++ tools/probeCgroup/testcases/4_oom_test.py | 52 ++ .../testcases/5_multiple_threads_test.py | 45 ++ tools/probeCgroup/testcases/cgroup_utils.py | 114 ++++ tools/probeCgroup/testcases/mem-allocate.c | 35 + .../testcases/multiple-thread-mem-allocate.c | 60 ++ tools/probeCgroup/testcases/run.py | 32 + .../testcases/simple-mem-allocate.c | 27 + 18 files changed, 1598 insertions(+) create mode 100644 tools/probeCgroup/Makefile create mode 100644 tools/probeCgroup/README.md create mode 100644 tools/probeCgroup/probeCgroup.c create mode 100644 tools/probeCgroup/probeCgroup.h create mode 100755 tools/probeCgroup/run.sh create mode 100755 tools/probeCgroup/scripts/script1.sh create mode 100755 tools/probeCgroup/scripts/script2.sh create mode 100755 tools/probeCgroup/scripts/script3.sh create mode 100755 tools/probeCgroup/testcases/1_load_unload_test.py create mode 100755 tools/probeCgroup/testcases/2_multiple_process_test.py create mode 100755 tools/probeCgroup/testcases/3_multiple_cgroup_test.py create mode 100755 tools/probeCgroup/testcases/4_oom_test.py create mode 100755 tools/probeCgroup/testcases/5_multiple_threads_test.py create mode 100644 tools/probeCgroup/testcases/cgroup_utils.py create mode 100644 tools/probeCgroup/testcases/mem-allocate.c create mode 100644 tools/probeCgroup/testcases/multiple-thread-mem-allocate.c create mode 100755 tools/probeCgroup/testcases/run.py create mode 100644 tools/probeCgroup/testcases/simple-mem-allocate.c diff --git a/tools/probeCgroup/Makefile b/tools/probeCgroup/Makefile new file mode 100644 index 000000000000..606c951e5487 --- /dev/null +++ b/tools/probeCgroup/Makefile @@ -0,0 +1,7 @@ +obj-m := probeCgroup.o +CROSS_COMPILE = '' +KDIR := /lib/modules/$(shell uname -r)/build +all: + make -C $(KDIR) M=$(PWD) modules +clean: + rm -f *.ko *.o *.mod *.mod.o *.mod.c .*.cmd *.symvers module* diff --git a/tools/probeCgroup/README.md b/tools/probeCgroup/README.md new file mode 100644 index 000000000000..ff0b6fc21228 --- /dev/null +++ b/tools/probeCgroup/README.md @@ -0,0 +1,29 @@ +# probeCgroup + +#### Description +probeCgroup is a process-level cgroup memory monitoring tool based on dynamic tracing (kprobe/kretprobe) technology. By inserting kprobes and kretprobes at the entry and exit points of relevant cgroup functions, this tool can track the memory usage of individual processes within each cgroup in real time. + +#### Software Architecture +1. Dynamic Tracing : Insert kprobes and kretprobes at critical points in cgroup functions to capture memory allocation and release events. +2. Hash Table Recording : Record the addresses of pages currently used by each process in a hash table, so that when a page is released, the process it belongs to can be identified. +3. Real-Time Statistics : Provide real-time statistics showing the memory usage of individual processes within each cgroup. + +#### Instruction +1. Compile and Load the Module + a. In the 'probeCgroup' directory, run the 'make' command to compile the module. + b. Load the module: 'insmod probeCgroup.ko'. + c. View memory statistics: 'cat /proc/cgroup_memory_usage_per_process'. + If an OOM (Out of Memory) event occurs in a cgroup, you can see "oom:" followed by the process that experienced the OOM and its memory usage at the time. + +2. Automate OOM Scenario + In the 'probeCgroup' directory, run './run.sh'. This script will automatically set up an OOM scenario and output the content of '/proc/cgroup_memory_usage_per_process' after execution. + +3. Perform More Tests + a. After compiling the module, in the 'testcases' directory, run './run.py'. + b. This script will perform various tests, including: + - Loading and unloading the module + - Each cgroup containing multiple processes + - Creating multiple cgroups + - OOM scenarios + - Multithreading + c. The tests will take approximately one minute to complete. diff --git a/tools/probeCgroup/probeCgroup.c b/tools/probeCgroup/probeCgroup.c new file mode 100644 index 000000000000..9883cb1e082d --- /dev/null +++ b/tools/probeCgroup/probeCgroup.c @@ -0,0 +1,612 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * probeCgroup.c - A tool used to get memory usage for each process in a cgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include "probeCgroup.h" + +// kretprobe at mem_cgroup_charge +struct charge_data { + struct cgroup *cgrp; + struct mem_cgroup *memcg; + struct task_struct *task; + unsigned long addr; +}; + +static int mem_cgroup_charge_entry_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct charge_data *data; + struct folio *page; + struct mm_struct *mm; + struct mem_cgroup *memcg; + struct cgroup_subsys_state css; + struct cgroup *cgrp; + + if (!current->mm) + return 1; + page = (struct folio *)regs->di; + mm = (struct mm_struct *)regs->si; + if (mm == NULL || page == NULL) + return -1; + memcg = get_mem_cgroup_from_mm(mm); + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + + data = (struct charge_data *)ri->data; + data->memcg = memcg; + data->addr = (unsigned long)page; + data->task = current; + data->cgrp = cgrp; + } + return 0; +} + +NOKPROBE_SYMBOL(mem_cgroup_charge_entry_handler); + +static int mem_cgroup_charge_ret_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + unsigned long retval = regs_return_value(regs); + struct charge_data *data = (struct charge_data *)ri->data; + int id; + struct cgroup_info *cgrp_info; + struct task_info *tsk_info; + + if (data->memcg != NULL && retval == 0) { + id = ((data->memcg)->css).id; + + spin_lock(&lock); + cgrp_info = find_cgroup_info(id); + if (cgrp_info == NULL) { + cgrp_info = create_cgroup_info(data->cgrp, data->memcg); + if (cgrp_info == NULL) { + spin_unlock(&lock); + return -1; + } + add_cgroup_info(cgrp_info); + } + spin_unlock(&lock); + + read_lock(&cgrp_info->cgrp_lock); + tsk_info = find_task_info(cgrp_info, data->task->tgid); + read_unlock(&cgrp_info->cgrp_lock); + + // for some cases, task->comm changes over time + if (tsk_info != NULL + && strcmp(data->task->comm, tsk_info->comm) != 0) { + strscpy(tsk_info->comm, data->task->comm, + sizeof(tsk_info->comm)); + } + + if (tsk_info == NULL) { + tsk_info = create_task_info(data->task); + if (tsk_info == NULL) + return -1; + add_task_to_cgroup_info(cgrp_info, tsk_info); + } + + if (HashMap_insert(tsk_info->pages, data->addr)) { + //update counter + spin_lock(&(tsk_info->cnt_lock)); + tsk_info->count += + folio_nr_pages((struct folio *)data->addr); + spin_unlock(&(tsk_info->cnt_lock)); + } + } + + return 0; + +} + +NOKPROBE_SYMBOL(mem_cgroup_charge_ret_handler); + +static struct kretprobe mem_cgroup_charge_kretprobe = { + .handler = mem_cgroup_charge_ret_handler, + .entry_handler = mem_cgroup_charge_entry_handler, + .data_size = sizeof(struct charge_data), + .maxactive = 20, +}; + +static int mem_cgroup_charge_kretprobe_init(void) +{ + int ret; + + mem_cgroup_charge_kretprobe.kp.symbol_name = "__mem_cgroup_charge"; + ret = register_kretprobe(&mem_cgroup_charge_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); + return ret; + } + pr_info("Planted return probe at %s: %p\n", + mem_cgroup_charge_kretprobe.kp.symbol_name, + mem_cgroup_charge_kretprobe.kp.addr); + return 0; +} + +static void mem_cgroup_charge_kretprobe_exit(void) +{ + unregister_kretprobe(&mem_cgroup_charge_kretprobe); + pr_info("kretprobe at %p unregistered\n", + mem_cgroup_charge_kretprobe.kp.addr); + + /* nmissed > 0 suggests that maxactive was set too low. */ + pr_info("Missed probing %d instances of %s\n", + mem_cgroup_charge_kretprobe.nmissed, + mem_cgroup_charge_kretprobe.kp.symbol_name); +} + +// kretprobe at uncharge_folio + +struct uncharge_data { + struct cgroup *cgrp; + struct mem_cgroup *memcg; + unsigned long addr; + bool isKmem; + int nr_pages; +}; + +static int uncharge_folio_entry_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct uncharge_data *data; + struct folio *page; + struct mem_cgroup *memcg = NULL; + struct cgroup_subsys_state css; + struct cgroup *cgrp; + struct obj_cgroup *objcg; + int nr_pages = 0; + + data = (struct uncharge_data *)ri->data; + page = (struct folio *)regs->di; + if (page == NULL) { + data->memcg = NULL; + return -1; + } + if (page->memcg_data & MEMCG_DATA_KMEM) { // if the page belongs to kmem + if (!folio_test_large(page)) + nr_pages = 1; + else + nr_pages = page->_folio_nr_pages; + // nr_pages = thp_nr_pages(page); + objcg = __folio_objcg(page); + if (objcg != NULL) + memcg = objcg->memcg; + data->isKmem = true; + data->nr_pages = nr_pages; + } else { + memcg = __folio_memcg(page); + data->isKmem = false; + } + + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + + data->memcg = memcg; + data->addr = (unsigned long)page; + data->cgrp = cgrp; + } + return 0; +} + +NOKPROBE_SYMBOL(uncharge_folio_entry_handler); + +static int uncharge_folio_ret_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct uncharge_data *data = (struct uncharge_data *)ri->data; + int id; + struct cgroup_info *cgrp_info; + int ret = -1; + + if (data->memcg != NULL) { + id = ((data->memcg)->css).id; + cgrp_info = find_cgroup_info(id); + if (cgrp_info == NULL) + return -1; + if (data->isKmem) + ret = -1; + else + ret = remove_page_from_cgroup_info(data->addr, cgrp_info); + } + + return ret; +} + +NOKPROBE_SYMBOL(uncharge_folio_ret_handler); + +static struct kretprobe uncharge_folio_kretprobe = { + .handler = uncharge_folio_ret_handler, + .entry_handler = uncharge_folio_entry_handler, + .data_size = sizeof(struct uncharge_data), + .maxactive = 20, +}; + +static int uncharge_folio_kretprobe_init(void) +{ + int ret; + + uncharge_folio_kretprobe.kp.symbol_name = "uncharge_folio"; + ret = register_kretprobe(&uncharge_folio_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); + return ret; + } + pr_info("Planted return probe at %s: %p\n", + uncharge_folio_kretprobe.kp.symbol_name, + uncharge_folio_kretprobe.kp.addr); + return 0; +} + +static void uncharge_folio_kretprobe_exit(void) +{ + unregister_kretprobe(&uncharge_folio_kretprobe); + pr_info("kretprobe at %p unregistered\n", + uncharge_folio_kretprobe.kp.addr); + + /* nmissed > 0 suggests that maxactive was set too low. */ + pr_info("Missed probing %d instances of %s\n", + uncharge_folio_kretprobe.nmissed, + uncharge_folio_kretprobe.kp.symbol_name); +} + +//kprobe at do_exit +static struct kprobe do_exit_kprobe; +static int do_exit_kprobe_pre_handler(struct kprobe *p, struct pt_regs *regs) +{ + struct task_struct *cur = current; + int tgid = cur->tgid; + struct mm_struct *mm = cur->mm; + struct mem_cgroup *memcg = get_mem_cgroup_from_mm(mm); + struct cgroup_subsys_state css; + struct cgroup *cgrp; + struct cgroup_info *cgrp_info; + struct task_info *tsk_info; + int id; + + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + id = (memcg->css).id; + cgrp_info = find_cgroup_info(id); + if (cgrp_info != NULL) { + write_lock(&cgrp_info->cgrp_lock); + tsk_info = find_task_info(cgrp_info, tgid); + if (tsk_info != NULL) { + list_del(&tsk_info->list); + write_unlock(&cgrp_info->cgrp_lock); + remove_task_from_cgroup_info(cgrp_info, + tsk_info); + } else { + write_unlock(&cgrp_info->cgrp_lock); + } + return 0; + } + } + return 0; +} + +static void do_exit_kprobe_post_handler(struct kprobe *p, + struct pt_regs *regs, + unsigned long flags) +{ + +} + +static int do_exit_kprobe_init(void) +{ + do_exit_kprobe.pre_handler = do_exit_kprobe_pre_handler; + do_exit_kprobe.post_handler = do_exit_kprobe_post_handler; + do_exit_kprobe.symbol_name = "do_exit"; + if (register_kprobe(&do_exit_kprobe)) { + pr_alert("register_kprobe on do_exit failed!\n"); + return -EINVAL; + } + return 0; +} + +static void do_exit_kprobe_exit(void) +{ + unregister_kprobe(&do_exit_kprobe); +} + +//kprobe at mark_oom_victim +static struct kprobe mark_oom_victim_kprobe; + +static int mark_oom_victim_kprobe_pre_handler(struct kprobe *p, + struct pt_regs *regs) +{ + struct task_struct *victim; + int tgid; + struct mm_struct *mm; + struct mem_cgroup *memcg; + struct cgroup_subsys_state css; + struct cgroup *cgrp; + struct cgroup_info *cgrp_info; + struct task_info *tsk_info; + int id; + struct task_info *oom_info; + + victim = (struct task_struct *)regs->di; + tgid = victim->tgid; + mm = victim->mm; + memcg = get_mem_cgroup_from_mm(mm); + if (memcg != NULL) { + css = memcg->css; + cgrp = css.cgroup; + id = (memcg->css).id; + cgrp_info = find_cgroup_info(id); + if (cgrp_info != NULL) { + read_lock(&cgrp_info->cgrp_lock); + tsk_info = find_task_info(cgrp_info, tgid); + read_unlock(&cgrp_info->cgrp_lock); + if (tsk_info != NULL) { + oom_info = create_oom_task_info(tsk_info); + if (oom_info != NULL) { + add_oom_task_to_cgroup_info(cgrp_info, + oom_info); + } + return 0; + } + } + } + return 0; +} + +static void mark_oom_victim_kprobe_post_handler(struct kprobe *p, + struct pt_regs *regs, + unsigned long flags) +{ + +} + +static int mark_oom_victim_kprobe_init(void) +{ + mark_oom_victim_kprobe.pre_handler = mark_oom_victim_kprobe_pre_handler; + mark_oom_victim_kprobe.post_handler = + mark_oom_victim_kprobe_post_handler; + mark_oom_victim_kprobe.symbol_name = "mark_oom_victim"; + if (register_kprobe(&mark_oom_victim_kprobe)) { + pr_alert("register_kprobe on mark_oom_victim failed!\n"); + return -EINVAL; + } + return 0; +} + +static void mark_oom_victim_kprobe_exit(void) +{ + unregister_kprobe(&mark_oom_victim_kprobe); +} + +//kretporbe at cgroup_destroy_locked +struct destroy_data { + struct cgroup *cgrp; +}; + +static int cgroup_destroy_locked_entry_handler(struct kretprobe_instance + *ri, struct pt_regs *regs) +{ + struct destroy_data *data; + + data = (struct destroy_data *)ri->data; + data->cgrp = (struct cgroup *)regs->di; + return 0; +} + +NOKPROBE_SYMBOL(cgroup_destroy_locked_entry_handler); + +static int cgroup_destroy_locked_ret_handler(struct kretprobe_instance *ri, + struct pt_regs *regs) +{ + struct destroy_data *data = (struct destroy_data *)ri->data; + struct cgroup *cgrp = data->cgrp; + struct cgroup_info *cgrp_info = NULL; + unsigned long retval = regs_return_value(regs); + + if (!cgrp) + return -1; + if (retval != 0) + return -1; + list_for_each_entry(cgrp_info, &all_cgroup_info, list) { + if (cgrp_info->cgrp == cgrp) { + spin_lock(&lock); + list_del(&cgrp_info->list); + spin_unlock(&lock); + destroy_cgroup_info(cgrp_info); + return 0; + } + } + return -1; +} + +NOKPROBE_SYMBOL(cgroup_destroy_locked_ret_handler); + +static struct kretprobe cgroup_destroy_locked_kretprobe = { + .handler = cgroup_destroy_locked_ret_handler, + .entry_handler = cgroup_destroy_locked_entry_handler, + .data_size = sizeof(struct destroy_data), + .maxactive = 20, +}; + +static int cgroup_destroy_locked_kretprobe_init(void) +{ + int ret; + + cgroup_destroy_locked_kretprobe.kp.symbol_name = + "cgroup_destroy_locked"; + ret = register_kretprobe(&cgroup_destroy_locked_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); + return ret; + } + pr_info("Planted return probe at %s: %p\n", + cgroup_destroy_locked_kretprobe.kp.symbol_name, + cgroup_destroy_locked_kretprobe.kp.addr); + return 0; +} + +static void cgroup_destroy_locked_kretprobe_exit(void) +{ + unregister_kretprobe(&cgroup_destroy_locked_kretprobe); + pr_info("kretprobe at %p unregistered\n", + cgroup_destroy_locked_kretprobe.kp.addr); + + /* nmissed > 0 suggests that maxactive was set too low. */ + pr_info("Missed probing %d instances of %s\n", + cgroup_destroy_locked_kretprobe.nmissed, + cgroup_destroy_locked_kretprobe.kp.symbol_name); +} + +// print the tasks in order of their memory usage +static void print_sorted_tasks_list(struct cgroup_info *cgrp_info, + int type, struct seq_file *m) +{ + struct list_head *cur, *insert_pos; + struct task_info *task, *insert_task; + struct list_head new_list = LIST_HEAD_INIT(new_list); + struct list_head *old_list; + struct task_info *new_task, *next_task; + + if (type == 0) { + if (cgrp_info == NULL) + return; + read_lock(&cgrp_info->cgrp_lock); + old_list = &cgrp_info->tasks_list; + } else { + if (cgrp_info == NULL) + return; + old_list = &cgrp_info->oom_list; + } + + list_for_each_entry_safe(task, insert_task, old_list, list) { + new_task = kmalloc(sizeof(struct task_info), GFP_ATOMIC); + if (!new_task) + return; + new_task->tgid = task->tgid; + strscpy(new_task->comm, task->comm, sizeof(new_task->comm)); + new_task->count = task->count; + new_task->pages = NULL; + INIT_LIST_HEAD(&new_task->list); + + //insertion sort + cur = &new_list; + insert_pos = cur->next; + while (insert_pos != &new_list) { + next_task = + list_entry(insert_pos, struct task_info, list); + if (new_task->count >= next_task->count) + break; + cur = insert_pos; + insert_pos = insert_pos->next; + } + + (&new_task->list)->prev = insert_pos->prev; + (insert_pos->prev)->next = (&new_task->list); + (&new_task->list)->next = insert_pos; + insert_pos->prev = (&new_task->list); + } + if (type == 0) + read_unlock(&cgrp_info->cgrp_lock); + + //print + if (type == 1 && (&new_list) != new_list.next) { + seq_puts(m, "oom:\n"); + seq_printf(m, "%10s %20s %20s\n", "pid", "command", + "memory usage (KB)"); + } + if (type == 0) + seq_printf(m, "%10s %20s %20s\n", "pid", "command", + "memory usage (KB)"); + list_for_each_entry_safe(task, insert_task, &new_list, list) { + seq_printf(m, "%10d %20s %20d\n", task->tgid, task->comm, + (task->count) * 4); + } + + list_for_each_entry_safe(task, insert_task, &new_list, list) { + list_del(&task->list); + kfree(task); + } +} + +static struct proc_dir_entry *cgroup_info_read; +#define procfs_file_read "cgroup_memory_usage_per_process" + +void seq_print_tasks(struct cgroup_info *cgroup_info, struct seq_file *m) +{ + if (!cgroup_info) + return; + + print_sorted_tasks_list(cgroup_info, 0, m); +} + +void seq_print_oom_tasks(struct cgroup_info *cgroup_info, struct seq_file *m) +{ + if (!cgroup_info) + return; + + print_sorted_tasks_list(cgroup_info, 1, m); +} + +void seq_print_cgroups(struct seq_file *m) +{ + struct cgroup_info *cgrp, *pos; + + spin_lock(&lock); + list_for_each_entry_safe(cgrp, pos, &all_cgroup_info, list) { + seq_printf(m, "cgroup name : %s\n", cgrp->name); + seq_print_tasks(cgrp, m); + seq_print_oom_tasks(cgrp, m); + seq_puts(m, "\n"); + } + spin_unlock(&lock); +} + +static int memory_usage_show(struct seq_file *m, void *v) +{ + seq_print_cgroups(m); + return 0; +} + +static int __init global_init(void) +{ + int ret = 0; + + cgroup_info_read = + proc_create_single(procfs_file_read, 0, NULL, memory_usage_show); + if (!cgroup_info_read) + return -ENOMEM; + ret = mem_cgroup_charge_kretprobe_init(); + uncharge_folio_kretprobe_init(); + do_exit_kprobe_init(); + mark_oom_victim_kprobe_init(); + cgroup_destroy_locked_kretprobe_init(); + + return ret; +} + +static void __exit global_exit(void) +{ + struct cgroup_info *cgrp_info, *pos; + + mem_cgroup_charge_kretprobe_exit(); + uncharge_folio_kretprobe_exit(); + do_exit_kprobe_exit(); + mark_oom_victim_kprobe_exit(); + cgroup_destroy_locked_kretprobe_exit(); + + remove_proc_entry(procfs_file_read, NULL); + + //release all memory use + list_for_each_entry_safe(cgrp_info, pos, &all_cgroup_info, list) { + list_del(&cgrp_info->list); + destroy_cgroup_info(cgrp_info); + } +} + +module_init(global_init) +module_exit(global_exit) +MODULE_LICENSE("GPL"); diff --git a/tools/probeCgroup/probeCgroup.h b/tools/probeCgroup/probeCgroup.h new file mode 100644 index 000000000000..953a6e0aca31 --- /dev/null +++ b/tools/probeCgroup/probeCgroup.h @@ -0,0 +1,415 @@ +/* SPDX-License-Identifier: GPL-2.0*/ +/* + * probeCgroup.h + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/kprobes.h> +#include <linux/ktime.h> +#include <linux/limits.h> +#include <linux/sched.h> +#include <linux/mm_types.h> +#include <linux/memcontrol.h> +#include <linux/cgroup-defs.h> +#include <linux/kernfs.h> +#include <linux/string.h> +#include <linux/list.h> +#include <linux/oom.h> +#include <linux/fs.h> +#include <linux/proc_fs.h> +#include <linux/huge_mm.h> +#include <linux/page-flags.h> +#include <linux/spinlock.h> +#include <linux/rwlock.h> + +static spinlock_t lock; // global lock for the list of cgroup_info + +struct HashNode { + unsigned long addr; + struct HashNode *next; +}; + +struct HashNode *HashNode_create(unsigned long addr) +{ + struct HashNode *node = NULL; + + node = kzalloc(sizeof(struct HashNode), GFP_ATOMIC); + if (node == NULL) + return NULL; + node->addr = addr; + node->next = NULL; + return node; +} + +struct HashBucket { + struct HashNode *head; + spinlock_t bkt_lock; +}; + +void HashBucket_init(struct HashBucket *bkt) +{ + bkt->head = NULL; + spin_lock_init(&bkt->bkt_lock); +} + +bool HashBucket_insert(struct HashBucket *bkt, unsigned long addr) +{ + struct HashNode *new_node; + struct HashNode *node; + struct HashNode *prev; + bool ret = true; + + if (bkt == NULL) + return false; + + prev = NULL; + new_node = NULL; + new_node = HashNode_create(addr); + + spin_lock(&bkt->bkt_lock); + node = bkt->head; + while (node != NULL && node->addr != addr) { + prev = node; + node = node->next; + } + if (node == NULL) { + if (new_node == NULL) { + pr_info("not enough memory for HashNode\n"); + spin_unlock(&bkt->bkt_lock); + return false; + } + if (bkt->head == NULL) + bkt->head = new_node; + else + prev->next = new_node; + spin_unlock(&bkt->bkt_lock); + ret = true; + } else { + spin_unlock(&bkt->bkt_lock); + kfree(new_node); + ret = false; + } + + return ret; +} + +bool HashBucket_erase(struct HashBucket *bkt, unsigned long addr) +{ + struct HashNode *node; + struct HashNode *prev; + bool ret = true; + + if (bkt == NULL) + return false; + + spin_lock(&bkt->bkt_lock); + node = bkt->head; + prev = NULL; + while (node != NULL && node->addr != addr) { + prev = node; + node = node->next; + } + if (node == NULL) { + spin_unlock(&bkt->bkt_lock); + ret = false; + } else { + if (bkt->head == node) + bkt->head = node->next; + else + prev->next = node->next; + kfree(node); + spin_unlock(&bkt->bkt_lock); + ret = true; + } + + return ret; +} + +void HashBucket_clear(struct HashBucket *bkt) +{ + struct HashNode *node; + struct HashNode *prev; + + if (bkt == NULL) + return; + + spin_lock(&bkt->bkt_lock); + node = bkt->head; + prev = NULL; + bkt->head = NULL; + while (node != NULL) { + prev = node; + node = node->next; + kfree(prev); + } + spin_unlock(&bkt->bkt_lock); +} + +struct HashMap { + unsigned long size; + struct HashBucket *HashTable; +}; + +unsigned long hash_func(unsigned long addr, unsigned long size) +{ + return addr % size; +} + +struct HashMap *HashMap_create(unsigned long size) +{ + struct HashMap *hm = NULL; + struct HashBucket *ht = NULL; + int i = 0; + + hm = kmalloc(sizeof(struct HashMap), GFP_ATOMIC); + if (hm == NULL) + return NULL; + ht = kmalloc((size * sizeof(struct HashBucket)), GFP_ATOMIC); + if (ht == NULL) { + kfree(hm); + return NULL; + } + for (i = 0; i < size; i++) + HashBucket_init(&(ht[i])); + + hm->size = size; + hm->HashTable = ht; + return hm; +} + +bool HashMap_insert(struct HashMap *hm, unsigned long addr) +{ + unsigned long index; + + if (hm == NULL) + return false; + index = hash_func(addr, hm->size); + if (hm->HashTable == NULL) + return false; + return HashBucket_insert(&(hm->HashTable[index]), addr); +} + +bool HashMap_erase(struct HashMap *hm, unsigned long addr) +{ + unsigned long index; + + if (hm == NULL) + return false; + index = hash_func(addr, hm->size); + if (hm->HashTable == NULL) + return false; + return HashBucket_erase(&(hm->HashTable[index]), addr); +} + +void HashMap_clear(struct HashMap *hm) +{ + unsigned long size; + struct HashBucket *ht; + int i; + + if (hm == NULL) + return; + size = hm->size; + ht = hm->HashTable; + if (ht == NULL) + return; + hm->HashTable = NULL; + for (i = 0; i < size; i++) + HashBucket_clear(&(ht[i])); + + kfree(ht); + kfree(hm); +} + +//struct that save the information for each task +struct task_info { + int tgid; + char comm[TASK_COMM_LEN]; + int count; // number of pages + struct HashMap *pages; + struct list_head list; + spinlock_t cnt_lock; +}; + +// struct that save the information for each cgroup +struct cgroup_info { + struct cgroup *cgrp; + struct mem_cgroup *memcg; + int id; + char name[64]; + struct list_head list; + struct list_head tasks_list; + struct list_head oom_list; + rwlock_t cgrp_lock; + unsigned int cached_bytes; +}; + +static LIST_HEAD(all_cgroup_info); // a list that linked all the cgroup_info struct + +static struct task_info *create_task_info(struct task_struct *cur_task) +{ + struct task_info *tsk_info = + kmalloc(sizeof(struct task_info), GFP_ATOMIC); + if (!tsk_info) + return NULL; + + // initialization + tsk_info->tgid = cur_task->tgid; + strscpy(tsk_info->comm, cur_task->comm, sizeof(tsk_info->comm)); + tsk_info->count = 0; + tsk_info->pages = NULL; + tsk_info->pages = HashMap_create(1023); + INIT_LIST_HEAD(&tsk_info->list); + spin_lock_init(&(tsk_info->cnt_lock)); + + return tsk_info; +} + +static int +add_task_to_cgroup_info(struct cgroup_info *cgrp, struct task_info *task) +{ + if (!cgrp || !task) + return -EINVAL; + + write_lock(&cgrp->cgrp_lock); + list_add_tail(&task->list, &cgrp->tasks_list); + write_unlock(&cgrp->cgrp_lock); + return 0; +} + +static int +remove_task_from_cgroup_info(struct cgroup_info *cgrp, struct task_info *task) +{ + if (cgrp == NULL || task == NULL) + return -EINVAL; + + HashMap_clear(task->pages); + // kfree(task->pages); + kfree(task); + return 0; +} + +static struct task_info *find_task_info(struct cgroup_info *cgrp, int tgid) +{ + struct task_info *tsk_info, *pos; + + list_for_each_entry_safe(tsk_info, pos, &cgrp->tasks_list, list) { + if (tsk_info->tgid == tgid) + return tsk_info; + } + return NULL; +} + +static int +remove_page_from_cgroup_info(unsigned long addr, struct cgroup_info *cgrp) +{ + struct task_info *tsk_info, *pos; + + read_lock(&cgrp->cgrp_lock); + list_for_each_entry_safe(tsk_info, pos, &cgrp->tasks_list, list) { + if (HashMap_erase(tsk_info->pages, addr)) { + spin_lock(&(tsk_info->cnt_lock)); + tsk_info->count -= folio_nr_pages((struct folio *)addr); + spin_unlock(&(tsk_info->cnt_lock)); + read_unlock(&cgrp->cgrp_lock); + return 0; + } + } + read_unlock(&cgrp->cgrp_lock); + return -1; +} + +static struct cgroup_info *create_cgroup_info(struct cgroup *cgrp, + struct mem_cgroup *memcg) +{ + struct cgroup_info *cgrp_info = + kmalloc(sizeof(struct cgroup_info), GFP_ATOMIC); + struct kernfs_node *kn; + + if (!cgrp_info) + return NULL; + + cgrp_info->cgrp = cgrp; + cgrp_info->memcg = memcg; + cgrp_info->id = (memcg->css).id; + kn = cgrp->kn; + strscpy(cgrp_info->name, kn->name, sizeof(cgrp_info->name)); + INIT_LIST_HEAD(&cgrp_info->list); + INIT_LIST_HEAD(&cgrp_info->tasks_list); + INIT_LIST_HEAD(&cgrp_info->oom_list); + rwlock_init(&(cgrp_info->cgrp_lock)); + cgrp_info->cached_bytes = 0; + + return cgrp_info; +} + +static void destroy_cgroup_info(struct cgroup_info *cgrp_info) +{ + struct task_info *task, *tmp; + + if (!cgrp_info) + return; + + write_lock(&cgrp_info->cgrp_lock); + list_for_each_entry_safe(task, tmp, &cgrp_info->tasks_list, list) { + list_del(&task->list); + remove_task_from_cgroup_info(cgrp_info, task); + } + write_unlock(&cgrp_info->cgrp_lock); + list_for_each_entry_safe(task, tmp, &cgrp_info->oom_list, list) { + list_del(&task->list); + remove_task_from_cgroup_info(cgrp_info, task); + } + + kfree(cgrp_info); +} + +static int add_cgroup_info(struct cgroup_info *cgrp_info) +{ + if (!cgrp_info) + return -EINVAL; + + list_add_tail(&cgrp_info->list, &all_cgroup_info); + return 0; +} + +static struct cgroup_info *find_cgroup_info(int id) +{ + struct cgroup_info *cgrp_info = NULL; + + list_for_each_entry(cgrp_info, &all_cgroup_info, list) { + if (cgrp_info->id == id) + return cgrp_info; + } + + return NULL; +} + +static struct task_info *create_oom_task_info(struct task_info *tsk_info) +{ + struct task_info *oom_tsk_info = + kmalloc(sizeof(struct task_info), GFP_ATOMIC); + if (!oom_tsk_info) + return NULL; + + oom_tsk_info->tgid = tsk_info->tgid; + strscpy(oom_tsk_info->comm, tsk_info->comm, sizeof(oom_tsk_info->comm)); + oom_tsk_info->count = tsk_info->count; + oom_tsk_info->pages = NULL; + INIT_LIST_HEAD(&oom_tsk_info->list); + + return oom_tsk_info; +} + +static int +add_oom_task_to_cgroup_info(struct cgroup_info *cgrp, + struct task_info *oom_task) +{ + if (!cgrp || !oom_task) + return -EINVAL; + list_add_tail(&oom_task->list, &cgrp->oom_list); + return 0; +} diff --git a/tools/probeCgroup/run.sh b/tools/probeCgroup/run.sh new file mode 100755 index 000000000000..7e1ffefe66d1 --- /dev/null +++ b/tools/probeCgroup/run.sh @@ -0,0 +1,8 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +cd scripts +./script1.sh +./script2.sh +./script3.sh diff --git a/tools/probeCgroup/scripts/script1.sh b/tools/probeCgroup/scripts/script1.sh new file mode 100755 index 000000000000..539e8258afb9 --- /dev/null +++ b/tools/probeCgroup/scripts/script1.sh @@ -0,0 +1,10 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +cd .. +make +insmod probeCgroup.ko + +cd testcases +gcc simple-mem-allocate.c -o simple-mem-allocate diff --git a/tools/probeCgroup/scripts/script2.sh b/tools/probeCgroup/scripts/script2.sh new file mode 100755 index 000000000000..2ad515cfb912 --- /dev/null +++ b/tools/probeCgroup/scripts/script2.sh @@ -0,0 +1,14 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +current_dir=$(pwd) +cd /sys/fs/cgroup/memory +mkdir test +cd test +sh -c "echo $$ >> cgroup.procs" +sh -c "echo 5M > memory.limit_in_bytes" +sh -c "echo 0 > memory.swappiness" +cd "$current_dir" +cd ../testcases +./simple-mem-allocate diff --git a/tools/probeCgroup/scripts/script3.sh b/tools/probeCgroup/scripts/script3.sh new file mode 100755 index 000000000000..127eb45de5c9 --- /dev/null +++ b/tools/probeCgroup/scripts/script3.sh @@ -0,0 +1,11 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +cd /proc +cat cgroup_memory_usage_per_process + +cat /sys/fs/cgroup/memory/test/cgroup.procs > /sys/fs/cgroup/memory/cgroup.procs +rmdir /sys/fs/cgroup/memory/test +# cat cgroup_memory_usage_per_process +rmmod probeCgroup diff --git a/tools/probeCgroup/testcases/1_load_unload_test.py b/tools/probeCgroup/testcases/1_load_unload_test.py new file mode 100755 index 000000000000..5389a14a1dac --- /dev/null +++ b/tools/probeCgroup/testcases/1_load_unload_test.py @@ -0,0 +1,24 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +import os +import subprocess +import time + +def test_module_load_unload(): + try: + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + print('loading module successfully!') + subprocess.check_call(['rmmod', 'probeCgroup']) + output = subprocess.check_output(['lsmod']) + assert b'probeCgroup' not in output + print('unloading module successfully!') + except subprocess.CalledProcessError as e: + print('Load unload test failed. Insmod failed.') + except AssertionError as e: + print('Load unload test failed. Cannot remove module.') + +if __name__ == '__main__': + test_module_load_unload() \ No newline at end of file diff --git a/tools/probeCgroup/testcases/2_multiple_process_test.py b/tools/probeCgroup/testcases/2_multiple_process_test.py new file mode 100755 index 000000000000..d88c7f7f2952 --- /dev/null +++ b/tools/probeCgroup/testcases/2_multiple_process_test.py @@ -0,0 +1,48 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup, check_kmem_usage +import os +import subprocess +import time + +def test_multiple_process(num_procs): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroup_name = 'test' + cgroup_path = create_cgroup(cgroup_name) + + processes = [] + pids = [] + + for i in range(num_procs): + process = subprocess.Popen(['./mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + processes.append(process) + pids.append(pid) + + time.sleep(0.1) + try: + count = 0 + for i in range (2000): + count += check_memory_usage(cgroup_name, pids, False) + time.sleep(0.01) + assert count <= 50, f"Memory read by probeCgroup is not accurate" + + remove_cgroup(cgroup_path, pids) + check_memory_usage(cgroup_name, pids, True) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass multiple process test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + remove_cgroup(cgroup_path, pids) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_multiple_process(3) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/3_multiple_cgroup_test.py b/tools/probeCgroup/testcases/3_multiple_cgroup_test.py new file mode 100755 index 000000000000..592a716df877 --- /dev/null +++ b/tools/probeCgroup/testcases/3_multiple_cgroup_test.py @@ -0,0 +1,55 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup +import os +import subprocess +import time + +def test_multiple_cgroup(num_procs, num_cgroups): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroups = [] + processes = {} + pids = {} + for i in range(num_cgroups): + cgroup_name = f'test_{i}' + cgroup_path = create_cgroup(cgroup_name) + cgroups.append((cgroup_name, cgroup_path)) + + for j in range(num_procs): + process = subprocess.Popen(['./mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + if cgroup_path not in processes: + processes[cgroup_path] = [] + processes[cgroup_path].append(process) + if cgroup_path not in pids: + pids[cgroup_path] = [] + pids[cgroup_path].append(pid) + + time.sleep(0.1) + try: + for i in range (100): + for cgroup_name, cgroup_path in cgroups: + check_memory_usage(cgroup_name, pids[cgroup_path], False) + time.sleep(0.01) + + for cgroup_name, cgroup_path in cgroups: + remove_cgroup(cgroup_path, pids[cgroup_path]) + check_memory_usage(cgroup_name, pids[cgroup_path], True) + cleanup(processes[cgroup_path]) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass multiple cgroup test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + for cgroup_name, cgroup_path in cgroups: + remove_cgroup(cgroup_path, pids[cgroup_path]) + cleanup(processes[cgroup_path]) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_multiple_cgroup(2,2) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/4_oom_test.py b/tools/probeCgroup/testcases/4_oom_test.py new file mode 100755 index 000000000000..128a258c56f5 --- /dev/null +++ b/tools/probeCgroup/testcases/4_oom_test.py @@ -0,0 +1,52 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup, get_oom_process_memory_usage +import os +import subprocess +import time + +def test_oom(num_procs): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroup_name = 'test' + cgroup_path = create_cgroup(cgroup_name) + + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.limit_in_bytes", 'w') as limit_file: + limit_file.write("5M") + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.swappiness", 'w') as swap_file: + swap_file.write("0") + + processes = [] + pids = [] + for i in range(num_procs): + process = subprocess.Popen(['./simple-mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + processes.append(process) + pids.append(pid) + + time.sleep(6) + + try: + for pid in pids: + memory_usage = get_oom_process_memory_usage(pid, cgroup_name) + assert memory_usage is not None, f"Memory usage(oom) not found for PID {pid}" + assert memory_usage > 0, f"Memory usage should be greater than zero for PID {pid}" + + remove_cgroup(cgroup_path, pids) + check_memory_usage(cgroup_name, pids, True) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass oom test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + remove_cgroup(cgroup_path, pids) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_oom(1) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/5_multiple_threads_test.py b/tools/probeCgroup/testcases/5_multiple_threads_test.py new file mode 100755 index 000000000000..7e1b86dabe48 --- /dev/null +++ b/tools/probeCgroup/testcases/5_multiple_threads_test.py @@ -0,0 +1,45 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +from cgroup_utils import create_cgroup, add_process_to_cgroup, get_process_memory_usage, remove_cgroup, check_memory_usage, cleanup, check_kmem_usage +import os +import subprocess +import time + +def test_multiple_thread(num_procs): + subprocess.check_call(['insmod', '../probeCgroup.ko']) + time.sleep(1) + + cgroup_name = 'test' + cgroup_path = create_cgroup(cgroup_name) + + processes = [] + pids = [] + for i in range(num_procs): + process = subprocess.Popen(['./multiple-thread-mem-allocate']) + pid = process.pid + add_process_to_cgroup(cgroup_path, pid) + processes.append(process) + pids.append(pid) + + time.sleep(1) + try: + for i in range (200): + check_memory_usage(cgroup_name, pids, False) + time.sleep(0.01) + + remove_cgroup(cgroup_path, pids) + check_memory_usage(cgroup_name, pids, True) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + + print('pass multiple threads test!') + except AssertionError as e: + print(f"Assertion failed: {e}") + remove_cgroup(cgroup_path, pids) + cleanup(processes) + subprocess.check_call(['rmmod', 'probeCgroup']) + +if __name__ == '__main__': + test_multiple_thread(5) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/cgroup_utils.py b/tools/probeCgroup/testcases/cgroup_utils.py new file mode 100644 index 000000000000..e00c580e724e --- /dev/null +++ b/tools/probeCgroup/testcases/cgroup_utils.py @@ -0,0 +1,114 @@ +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +import os +import subprocess +import time + +def create_cgroup(cgroup_name): + cgroup_path = f'/sys/fs/cgroup/memory/{cgroup_name}' + + try: + os.makedirs(cgroup_path) + except FileExistsError: + pass + + return cgroup_path + +def add_process_to_cgroup(cgroup_path, pid): + with open(os.path.join(cgroup_path, 'cgroup.procs'), 'w') as procs_file: + procs_file.write(str(pid)) + +def get_process_memory_usage(pid, cgroup_name): + cur_name = '' + with open('/proc/cgroup_memory_usage_per_process', 'r') as file: + for line in file: + parts = line.strip().split() + if len(parts) >= 4 and parts[0] == 'cgroup': + cur_name = parts[3] + if len(parts) >= 3 and parts[0] != 'cgroup' and cur_name == cgroup_name and parts[0] != 'pid' and int(parts[0]) == pid: + return int(parts[2]) + return None + +def get_process_kmem_usage(pid, cgroup_name): + cur_name = '' + with open('/proc/cgroup_memory_usage_per_process', 'r') as file: + for line in file: + parts = line.strip().split() + if len(parts) >= 4 and parts[0] == 'cgroup': + cur_name = parts[3] + if len(parts) >= 4 and parts[0] != 'cgroup' and cur_name == cgroup_name and parts[0] != 'pid' and int(parts[0]) == pid: + return int(parts[3]) + return None + +def remove_cgroup(cgroup_path, pids): + for pid in pids: + with open('/sys/fs/cgroup/memory/cgroup.procs', 'w') as backup_file: + backup_file.write(str(pid)) + os.rmdir(cgroup_path) + return + +def check_memory_usage(cgroup_name, pids, delete): + memory_sum = 0 + for pid in pids: + memory_usage = get_process_memory_usage(pid, cgroup_name) + if delete == False: + assert memory_usage is not None, f"Memory usage not found for PID {pid}" + assert memory_usage >= 0, f"Memory usage should be greater than zero for PID {pid}" + memory_sum += memory_usage + else: + assert memory_usage is None, f"Error: Memory usage should not be available for PID {pid} after deleting the cgroup." + if delete == False: + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.usage_in_bytes", 'r') as file: + content = file.readline().strip() + memory_read = int(content) + memory_sum *= 1024 + delta = abs(memory_read - memory_sum) + # print(f"read: {memory_read}") + # print(f"sum : {memory_sum}") + if (delta > max(memory_read, memory_sum) * 0.1): + return 1 + else: + return 0 + else: + return 0 + +def check_kmem_usage(cgroup_name, pids, delete): + kmem_sum = 0 + for pid in pids: + kmem_usage = get_process_kmem_usage(pid, cgroup_name) + if delete == False: + assert kmem_usage is not None, f"Kmem usage not found for PID {pid}" + assert kmem_usage >= 0, f"Kmem usage should be greater than zero for PID {pid}" + kmem_sum += kmem_usage + else: + assert kmem_usage is None, f"Error: Kmem usage should not be available for PID {pid} after deleting the cgroup." + if delete == False: + with open(f"/sys/fs/cgroup/memory/{cgroup_name}/memory.kmem.usage_in_bytes", 'r') as file: + content = file.readline().strip() + kmem_read = int(content) + kmem_sum *= 1024 + delta = abs(kmem_read - kmem_sum) + # print(f"kmem read: {kmem_read}") + # print(f"kmem sum : {kmem_sum}") + # assert delta <= max(kmem_read, kmem_sum) * 0.2, f"Kmem read by probeCgroup is not accurate, {kmem_read}, {kmem_sum}" + +def cleanup(processes): + for process in processes: + process.terminate() + process.wait() + +def get_oom_process_memory_usage(pid, cgroup_name): + cur_name = '' + oom = False + with open('/proc/cgroup_memory_usage_per_process', 'r') as file: + for line in file: + parts = line.strip().split() + if len(parts) >= 4 and parts[0] == 'cgroup': + cur_name = parts[3] + oom = False + if len(parts) >= 1 and parts[0] == 'oom:': + oom = True + if len(parts) >= 3 and parts[0] != 'cgroup' and cur_name == cgroup_name and parts[0] != 'pid' and int(parts[0]) == pid and oom == True: + return int(parts[2]) + return None \ No newline at end of file diff --git a/tools/probeCgroup/testcases/mem-allocate.c b/tools/probeCgroup/testcases/mem-allocate.c new file mode 100644 index 000000000000..e78e37cae61b --- /dev/null +++ b/tools/probeCgroup/testcases/mem-allocate.c @@ -0,0 +1,35 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * mem-allocate.c - The program to test probeCgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> + +#define MB (1024 * 1024) + +char *arr[40]; + +int main(int argc, char *argv[]) +{ + char *p; + int i = 0; + + while (1) { + for (i = 0; i < 40; i++) { + p = (char *)malloc(MB); + memset(p, 0, MB); + arr[i] = p; + usleep(100000); + } + for (int i = 0; i < 40; i++) { + free(arr[i]); + usleep(100000); + } + } + return 0; +} diff --git a/tools/probeCgroup/testcases/multiple-thread-mem-allocate.c b/tools/probeCgroup/testcases/multiple-thread-mem-allocate.c new file mode 100644 index 000000000000..55f4c068f55e --- /dev/null +++ b/tools/probeCgroup/testcases/multiple-thread-mem-allocate.c @@ -0,0 +1,60 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * multiple-thread-mem-allocate.c - The program to test probeCgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> +#include <pthread.h> + +#define MB (1024 * 1024) + +void *memory_test(void *) +{ + char *arr[25]; + char *p; + int i = 0; + int cnt = 0; + + while (1) { + for (i = 0; i < 20; i++) { + p = (char *)malloc(MB); + memset(p, 0, MB); + arr[i] = p; + usleep(10000); + } + for (int i = 0; i < 20; i++) { + free(arr[i]); + usleep(10000); + } + } +} + +int main(int argc, char *argv[]) +{ + pthread_t threads[4]; + int rc; + + // create threads + for (int i = 0; i < 4; i++) { + rc = pthread_create(&threads[i], NULL, memory_test, NULL); + if (rc != 0) { + fprintf(stderr, "Error creating thread: %d\n", rc); + return 1; + } + } + + for (int i = 0; i < 4; i++) { + rc = pthread_join(threads[i], NULL); + if (rc != 0) { + fprintf(stderr, "Error joining thread: %d\n", rc); + return 1; + } + } + + return 0; +} diff --git a/tools/probeCgroup/testcases/run.py b/tools/probeCgroup/testcases/run.py new file mode 100755 index 000000000000..8ffd0ca720d8 --- /dev/null +++ b/tools/probeCgroup/testcases/run.py @@ -0,0 +1,32 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + +import os +import subprocess +import sys + +def run_tests(directory): + """Run all Python scripts in the given directory.""" + python_files = [f for f in os.listdir(directory) if f.endswith('test.py')] + python_files.sort() + + for filename in python_files: + try: + filepath = os.path.join(directory, filename) + + subprocess.check_call([sys.executable, filepath]) + except subprocess.CalledProcessError as e: + print(f"Error executing {filename}:") + return + except Exception as e: + print(f"Error executing {filename}:") + print(e) + return + +if __name__ == '__main__': + tests_directory = '.' + subprocess.check_call(['gcc', 'mem-allocate.c', '-o', 'mem-allocate']) + subprocess.check_call(['gcc', 'simple-mem-allocate.c', '-o', 'simple-mem-allocate']) + subprocess.check_call(['gcc', 'multiple-thread-mem-allocate.c', '-o', 'multiple-thread-mem-allocate']) + run_tests(tests_directory) \ No newline at end of file diff --git a/tools/probeCgroup/testcases/simple-mem-allocate.c b/tools/probeCgroup/testcases/simple-mem-allocate.c new file mode 100644 index 000000000000..16328b10ba48 --- /dev/null +++ b/tools/probeCgroup/testcases/simple-mem-allocate.c @@ -0,0 +1,27 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * mem-allocate.c - The program to test probeCgroup + * + * Copyright (C) Taoxy2004 <221870066(a)smail.nju.edu.cn> + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> + +#define MB (1024 * 1024) + +int main(int argc, char *argv[]) +{ + char *p; + int i = 0; + + while (1) { + p = (char *)malloc(MB); + memset(p, 0, MB); + sleep(1); + } + + return 0; +} -- 2.43.0

2 1

[PATCH OLK-5.10 v2] drm/amd/display: Fix null pointer deref in dcn20_resource.c
by Xiaomeng Zhang 06 Sep '24

06 Sep '24

From: Aurabindo Pillai <aurabindo.pillai(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit ecbf60782662f0a388493685b85a645a0ba1613c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMUG CVE: CVE-2024-43899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes a hang thats triggered when MPV is run on a DCN401 dGPU: mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all and then enabling fullscreen playback (double click on the video) The following calltrace will be seen: [ 181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 181.843997] #PF: supervisor instruction fetch in kernel mode [ 181.844003] #PF: error_code(0x0010) - not-present page [ 181.844009] PGD 0 P4D 0 [ 181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI [ 181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018 [ 181.844044] RIP: 0010:0x0 [ 181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246 [ 181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 [ 181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400 [ 181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c [ 181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8 [ 181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005 [ 181.844121] FS: 00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000 [ 181.844128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0 [ 181.844141] Call Trace: [ 181.844146] <TASK> [ 181.844153] ? show_regs+0x6d/0x80 [ 181.844167] ? __die+0x24/0x80 [ 181.844179] ? page_fault_oops+0x99/0x1b0 [ 181.844192] ? do_user_addr_fault+0x31d/0x6b0 [ 181.844204] ? exc_page_fault+0x83/0x1b0 [ 181.844216] ? asm_exc_page_fault+0x27/0x30 [ 181.844237] dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu] [ 181.845115] amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu] [ 181.845985] amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu] [ 181.846848] fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu] [ 181.847734] fill_dc_plane_attributes+0x162/0x350 [amdgpu] [ 181.848748] dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.849791] ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.850840] amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu] Signed-off-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c [The conflicts were due to file path changed] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c index d587f807dfd7..94bf438c7310 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c @@ -2178,10 +2178,11 @@ bool dcn20_get_dcc_compression_cap(const struct dc *dc, const struct dc_dcc_surface_param *input, struct dc_surface_dcc_cap *output) { - return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( - dc->res_pool->hubbub, - input, - output); + if (dc->res_pool->hubbub->funcs->get_dcc_compression_cap) + return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( + dc->res_pool->hubbub, input, output); + + return false; } static void dcn20_destroy_resource_pool(struct resource_pool **pool) -- 2.34.1

2 1

[PATCH OLK-5.10 v2] drm/amd/display: Fix null pointer deref in dcn20_resource.c
by Xiaomeng Zhang 06 Sep '24

06 Sep '24

From: Aurabindo Pillai <aurabindo.pillai(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit ecbf60782662f0a388493685b85a645a0ba1613c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMUG CVE: CVE-2024-43899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes a hang thats triggered when MPV is run on a DCN401 dGPU: mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all and then enabling fullscreen playback (double click on the video) The following calltrace will be seen: [ 181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 181.843997] #PF: supervisor instruction fetch in kernel mode [ 181.844003] #PF: error_code(0x0010) - not-present page [ 181.844009] PGD 0 P4D 0 [ 181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI [ 181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018 [ 181.844044] RIP: 0010:0x0 [ 181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246 [ 181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 [ 181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400 [ 181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c [ 181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8 [ 181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005 [ 181.844121] FS: 00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000 [ 181.844128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0 [ 181.844141] Call Trace: [ 181.844146] <TASK> [ 181.844153] ? show_regs+0x6d/0x80 [ 181.844167] ? __die+0x24/0x80 [ 181.844179] ? page_fault_oops+0x99/0x1b0 [ 181.844192] ? do_user_addr_fault+0x31d/0x6b0 [ 181.844204] ? exc_page_fault+0x83/0x1b0 [ 181.844216] ? asm_exc_page_fault+0x27/0x30 [ 181.844237] dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu] [ 181.845115] amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu] [ 181.845985] amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu] [ 181.846848] fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu] [ 181.847734] fill_dc_plane_attributes+0x162/0x350 [amdgpu] [ 181.848748] dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.849791] ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.850840] amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu] Signed-off-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c [The conflicts were due to file path changed] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c index 53ac82693532..2990793e86a2 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c @@ -3290,10 +3290,11 @@ bool dcn20_get_dcc_compression_cap(const struct dc *dc, const struct dc_dcc_surface_param *input, struct dc_surface_dcc_cap *output) { - return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( - dc->res_pool->hubbub, - input, - output); + if (dc->res_pool->hubbub->funcs->get_dcc_compression_cap) + return dc->res_pool->hubbub->funcs->get_dcc_compression_cap( + dc->res_pool->hubbub, input, output); + + return false; } static void dcn20_destroy_resource_pool(struct resource_pool **pool) -- 2.34.1

2 1

[PATCH OLK-5.10] cifs: Fix pages leak when cifs_writedata allocate fails in cifs_writedata_direct_alloc()
by Zizhi Wo 05 Sep '24

05 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAOH1I -------------------------------- The function cifs_writedata_alloc() first allocates pages and then executes cifs_writedata_direct_alloc(). If the subsequent allocation of wdata fails, the previously allocated pages are not released, leading to a memory leak: [root@fedora debug]# cat kmemleak unreferenced object 0xff110001287aa000 (size 8192): comm "kworker/u220:9", pid 1604, jiffies 4294753971 (age 19.114s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000c80fa56d>] kmemleak_alloc+0x65/0xd0 [<0000000032ff36c6>] __kmalloc+0x641/0xa50 [<00000000da9a4c31>] cifs_writedata_alloc+0x1d/0x30 [<00000000337073aa>] cifs_writepages+0x3e0/0x1990 [<0000000095bfb1fd>] do_writepages+0x31/0xb0 [<00000000321368a2>] __writeback_single_inode+0x4f/0x550 [<00000000f200b315>] writeback_sb_inodes+0x24a/0x7a0 [<00000000badd6d82>] __writeback_inodes_wb+0x88/0x120 [<000000000632fc4a>] wb_writeback+0x3aa/0x4c0 [<00000000c184a6e4>] wb_workfn+0x507/0x770 [<000000005d8f6f94>] process_one_work+0x226/0x540 [<000000000c3dd58a>] worker_thread+0x1b3/0x680 [<00000000457537ac>] kthread+0x159/0x1c0 [<000000000ef58c85>] ret_from_fork+0x1f/0x30 This issue can be avoided by promptly using kvfree. Fixes: 8e7360f67e75 ("CIFS: Add support for direct pages in wdata") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/cifssmb.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c index 95992c93bbe3..1a6c9ac25615 100644 --- a/fs/cifs/cifssmb.c +++ b/fs/cifs/cifssmb.c @@ -2119,12 +2119,17 @@ cifs_writev_complete(struct work_struct *work) struct cifs_writedata * cifs_writedata_alloc(unsigned int nr_pages, work_func_t complete) { + struct cifs_writedata *wdata = NULL; + struct page **pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS); - if (pages) - return cifs_writedata_direct_alloc(pages, complete); + if (pages) { + wdata = cifs_writedata_direct_alloc(pages, complete); + if (!wdata) + kvfree(pages); + } - return NULL; + return wdata; } struct cifs_writedata * -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS V3] cifs: Fix pages leak when cifs_writedata allocate fails in cifs_writedata_direct_alloc()
by Zizhi Wo 05 Sep '24

05 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAOH1I -------------------------------- The function cifs_writedata_alloc() first allocates pages and then executes cifs_writedata_direct_alloc(). If the subsequent allocation of wdata fails, the previously allocated pages are not released, leading to a memory leak: [root@fedora debug]# cat kmemleak unreferenced object 0xff110001287aa000 (size 8192): comm "kworker/u220:9", pid 1604, jiffies 4294753971 (age 19.114s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000c80fa56d>] kmemleak_alloc+0x65/0xd0 [<0000000032ff36c6>] __kmalloc+0x641/0xa50 [<00000000da9a4c31>] cifs_writedata_alloc+0x1d/0x30 [<00000000337073aa>] cifs_writepages+0x3e0/0x1990 [<0000000095bfb1fd>] do_writepages+0x31/0xb0 [<00000000321368a2>] __writeback_single_inode+0x4f/0x550 [<00000000f200b315>] writeback_sb_inodes+0x24a/0x7a0 [<00000000badd6d82>] __writeback_inodes_wb+0x88/0x120 [<000000000632fc4a>] wb_writeback+0x3aa/0x4c0 [<00000000c184a6e4>] wb_workfn+0x507/0x770 [<000000005d8f6f94>] process_one_work+0x226/0x540 [<000000000c3dd58a>] worker_thread+0x1b3/0x680 [<00000000457537ac>] kthread+0x159/0x1c0 [<000000000ef58c85>] ret_from_fork+0x1f/0x30 This issue can be avoided by promptly using kvfree. Fixes: 8e7360f67e75 ("CIFS: Add support for direct pages in wdata") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/cifssmb.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c index cb70f0c6aa1b..15b039820a26 100644 --- a/fs/cifs/cifssmb.c +++ b/fs/cifs/cifssmb.c @@ -2109,12 +2109,17 @@ cifs_writev_complete(struct work_struct *work) struct cifs_writedata * cifs_writedata_alloc(unsigned int nr_pages, work_func_t complete) { + struct cifs_writedata *wdata = NULL; + struct page **pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS); - if (pages) - return cifs_writedata_direct_alloc(pages, complete); + if (pages) { + wdata = cifs_writedata_direct_alloc(pages, complete); + if (!wdata) + kvfree(pages); + } - return NULL; + return wdata; } struct cifs_writedata * -- 2.39.2

2 1

2024

2023

2022

2021

2020

2019

Kernel