- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] Add generic xdp multi-buffer support for ipvlan
by Yue Haibing 29 Sep '24

29 Sep '24

1 0

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Add array index check for hdcp ddc access
by Bowen You 29 Sep '24

29 Sep '24

From: Hersen Wu <hersenxs.wu(a)amd.com> [Why] Coverity reports OVERRUN warning. Do not check if array index valid. [How] Check msg_id valid and valid array index. Reviewed-by: Alex Hung <alex.hung(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Hersen Wu <hersenxs.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> --- .../drm/amd/display/modules/hdcp/hdcp_ddc.c | 28 ++++++++++++++++--- 1 file changed, 24 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c index 8e9caae7c955..1b2df97226a3 100644 --- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c +++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c @@ -156,11 +156,16 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp, uint32_t cur_size = 0; uint32_t data_offset = 0; - if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) { + if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID || + msg_id >= MOD_HDCP_MESSAGE_ID_MAX) return MOD_HDCP_STATUS_DDC_FAILURE; - } if (is_dp_hdcp(hdcp)) { + int num_dpcd_addrs = sizeof(hdcp_dpcd_addrs) / + sizeof(hdcp_dpcd_addrs[0]); + if (msg_id >= num_dpcd_addrs) + return MOD_HDCP_STATUS_DDC_FAILURE; + while (buf_len > 0) { cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE); success = hdcp->config.ddc.funcs.read_dpcd(hdcp->config.ddc.handle, @@ -175,6 +180,11 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp, data_offset += cur_size; } } else { + int num_i2c_offsets = sizeof(hdcp_i2c_offsets) / + sizeof(hdcp_i2c_offsets[0]); + if (msg_id >= num_i2c_offsets) + return MOD_HDCP_STATUS_DDC_FAILURE; + success = hdcp->config.ddc.funcs.read_i2c( hdcp->config.ddc.handle, HDCP_I2C_ADDR, @@ -219,11 +229,16 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp, uint32_t cur_size = 0; uint32_t data_offset = 0; - if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) { + if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID || + msg_id >= MOD_HDCP_MESSAGE_ID_MAX) return MOD_HDCP_STATUS_DDC_FAILURE; - } if (is_dp_hdcp(hdcp)) { + int num_dpcd_addrs = sizeof(hdcp_dpcd_addrs) / + sizeof(hdcp_dpcd_addrs[0]); + if (msg_id >= num_dpcd_addrs) + return MOD_HDCP_STATUS_DDC_FAILURE; + while (buf_len > 0) { cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE); success = hdcp->config.ddc.funcs.write_dpcd( @@ -239,6 +254,11 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp, data_offset += cur_size; } } else { + int num_i2c_offsets = sizeof(hdcp_i2c_offsets) / + sizeof(hdcp_i2c_offsets[0]); + if (msg_id >= num_i2c_offsets) + return MOD_HDCP_STATUS_DDC_FAILURE; + hdcp->buf[0] = hdcp_i2c_offsets[msg_id]; memmove(&hdcp->buf[1], buf, buf_len); success = hdcp->config.ddc.funcs.write_i2c( -- 2.34.1

2 5

[PATCH OLK-6.6] of/irq: Prevent device address out-of-bounds read in interrupt map walk
by Zhang Zekun 29 Sep '24

29 Sep '24

From: Stefan Wiehler <stefan.wiehler(a)nokia.com> stable inclusion from stable-v6.6.51 commit 7ead730af11ee7da107f16fc77995613c58d292d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWTE CVE: CVE-2024-46743 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------------- [ Upstream commit b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305 ] When of_irq_parse_raw() is invoked with a device address smaller than the interrupt parent node (from #address-cells property), KASAN detects the following out-of-bounds read when populating the initial match table (dyndbg="func of_irq_parse_* +p"): OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0 OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2 OF: intspec=4 OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2 OF: -> addrsize=3 ================================================================== BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0 Read of size 4 at addr ffffff81beca5608 by task bash/764 CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokia_sm_arm64 #1 Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023 Call trace: dump_backtrace+0xdc/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0x6c/0x84 print_report+0x150/0x448 kasan_report+0x98/0x140 __asan_load4+0x78/0xa0 of_irq_parse_raw+0x2b8/0x8d0 of_irq_parse_one+0x24c/0x270 parse_interrupts+0xc0/0x120 of_fwnode_add_links+0x100/0x2d0 fw_devlink_parse_fwtree+0x64/0xc0 device_add+0xb38/0xc30 of_device_add+0x64/0x90 of_platform_device_create_pdata+0xd0/0x170 of_platform_bus_create+0x244/0x600 of_platform_notify+0x1b0/0x254 blocking_notifier_call_chain+0x9c/0xd0 __of_changeset_entry_notify+0x1b8/0x230 __of_changeset_apply_notify+0x54/0xe4 of_overlay_fdt_apply+0xc04/0xd94 ... The buggy address belongs to the object at ffffff81beca5600 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 8 bytes inside of 128-byte region [ffffff81beca5600, ffffff81beca5680) The buggy address belongs to the physical page: page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4 head:00000000230d3d03 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x8000000000010200(slab|head|zone=2) raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ================================================================== OF: -> got it ! Prevent the out-of-bounds read by copying the device address into a buffer of sufficient size. Signed-off-by: Stefan Wiehler <stefan.wiehler(a)nokia.com> Link: https://lore.kernel.org/r/20240812100652.3800963-1-stefan.wiehler@nokia.com Signed-off-by: Rob Herring (Arm) <robh(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/of/irq.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index c94203ce65bb..8fd63100ba8f 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -344,7 +344,8 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar struct device_node *p; const __be32 *addr; u32 intsize; - int i, res; + int i, res, addr_len; + __be32 addr_buf[3] = { 0 }; pr_debug("of_irq_parse_one: dev=%pOF, index=%d\n", device, index); @@ -353,13 +354,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar return of_irq_parse_oldworld(device, index, out_irq); /* Get the reg property (if any) */ - addr = of_get_property(device, "reg", NULL); + addr = of_get_property(device, "reg", &addr_len); + + /* Prevent out-of-bounds read in case of longer interrupt parent address size */ + if (addr_len > (3 * sizeof(__be32))) + addr_len = 3 * sizeof(__be32); + if (addr) + memcpy(addr_buf, addr, addr_len); /* Try the new-style interrupts-extended first */ res = of_parse_phandle_with_args(device, "interrupts-extended", "#interrupt-cells", index, out_irq); if (!res) - return of_irq_parse_raw(addr, out_irq); + return of_irq_parse_raw(addr_buf, out_irq); /* Look for the interrupt parent. */ p = of_irq_find_parent(device); @@ -389,7 +396,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar /* Check if there are any interrupt-map translations to process */ - res = of_irq_parse_raw(addr, out_irq); + res = of_irq_parse_raw(addr_buf, out_irq); out: of_node_put(p); return res; -- 2.17.1

2 1

[PATCH OLK-6.6] sched: Support to enable/disable dynamic_affinity
by Hui Tang 29 Sep '24

29 Sep '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAUFO7 -------------------------------- Currently, the 'dynamic_affinty' can be enabled but can not disabled by cmdline. In some scenarios may need to be enabled by default, it is more reasonable changing cmdline to 'dynamic_affinty=enable/disable'. Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- kernel/sched/fair.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 415f4b060123..099a2e25d03d 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -8962,12 +8962,27 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu) DEFINE_STATIC_KEY_FALSE(__dynamic_affinity_switch); -static int __init dynamic_affinity_switch_setup(char *__unused) +static int __init dynamic_affinity_switch_setup(char *str) { - static_branch_enable(&__dynamic_affinity_switch); - return 1; + int ret = 1; + + if (!str) + goto out; + + if (!strcmp(str, "enable")) + static_branch_enable(&__dynamic_affinity_switch); + else if (!strcmp(str, "disable")) + static_branch_disable(&__dynamic_affinity_switch); + else + ret = 0; + +out: + if (!ret) + pr_warn("Unable to parse dynamic_affinity=\n"); + + return ret; } -__setup("dynamic_affinity", dynamic_affinity_switch_setup); +__setup("dynamic_affinity=", dynamic_affinity_switch_setup); static inline bool prefer_cpus_valid(struct task_struct *p) { -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amd/display: Assign linear_pitch_alignment even for VM
by Gu Bowen 29 Sep '24

29 Sep '24

From: Alvin Lee <alvin.lee2(a)amd.com> stable inclusion from stable-v6.6.50 commit d2fe7ac613a1ea8c346c9f5c89dc6ecc27232997 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAP55A Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 984debc133efa05e62f5aa1a7a1dd8ca0ef041f4 ] [Description] Assign linear_pitch_alignment so we don't cause a divide by 0 error in VM environments Reviewed-by: Sohaib Nadeem <sohaib.nadeem(a)amd.com> Acked-by: Wayne Lin <wayne.lin(a)amd.com> Signed-off-by: Alvin Lee <alvin.lee2(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index 72db370e2f21..50e643bfdfba 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1298,6 +1298,7 @@ struct dc *dc_create(const struct dc_init_data *init_params) return NULL; if (init_params->dce_environment == DCE_ENV_VIRTUAL_HW) { + dc->caps.linear_pitch_alignment = 64; if (!dc_construct_ctx(dc, init_params)) goto destruct_dc; } else { -- 2.25.1

2 1

[PATCH OLK-6.6] drm/amd/display: Run DC_LOG_DC after checking link->link_enc
by Gu Bowen 29 Sep '24

29 Sep '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v6.6.51 commit 874e3bb302f97b94ac548959ec4f925b8e7b45e2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWBK CVE: CVE-2024-46776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3a82f62b0d9d7687eac47603bb6cd14a50fa718b ] [WHAT] The DC_LOG_DC should be run after link->link_enc is checked, not before. This fixes 1 REVERSE_INULL issue reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/link/link_factory.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/link/link_factory.c b/drivers/gpu/drm/amd/display/dc/link/link_factory.c index 2c366866f570..33bb96f770b8 100644 --- a/drivers/gpu/drm/amd/display/dc/link/link_factory.c +++ b/drivers/gpu/drm/amd/display/dc/link/link_factory.c @@ -629,14 +629,14 @@ static bool construct_phy(struct dc_link *link, link->link_enc = link->dc->res_pool->funcs->link_enc_create(dc_ctx, &enc_init_data); - DC_LOG_DC("BIOS object table - DP_IS_USB_C: %d", link->link_enc->features.flags.bits.DP_IS_USB_C); - DC_LOG_DC("BIOS object table - IS_DP2_CAPABLE: %d", link->link_enc->features.flags.bits.IS_DP2_CAPABLE); - if (!link->link_enc) { DC_ERROR("Failed to create link encoder!\n"); goto link_enc_create_fail; } + DC_LOG_DC("BIOS object table - DP_IS_USB_C: %d", link->link_enc->features.flags.bits.DP_IS_USB_C); + DC_LOG_DC("BIOS object table - IS_DP2_CAPABLE: %d", link->link_enc->features.flags.bits.IS_DP2_CAPABLE); + /* Update link encoder tracking variables. These are used for the dynamic * assignment of link encoders to streams. */ -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] drm/amdgpu: fix mc_data out-of-bounds read warning
by He Yujie 29 Sep '24

29 Sep '24

From: Tim Huang <Tim.Huang(a)amd.com> stable inclusion from stable-v4.19.322 commit 5fa4df25ecfc7b6c9006f5b871c46cfe25ea8826 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV9S CVE: CVE-2024-46722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 51dfc0a4d609fe700750a62f41447f01b8c9ea50 ] Clear warning that read mc_data[i-1] may out-of-bounds. Signed-off-by: Tim Huang <Tim.Huang(a)amd.com> Reviewed-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c index bf872f694f50..653651a5b910 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c @@ -1641,6 +1641,8 @@ int amdgpu_atombios_init_mc_reg_table(struct amdgpu_device *adev, (u32)le32_to_cpu(*((u32 *)reg_data + j)); j++; } else if ((reg_table->mc_reg_address[i].pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { + if (i == 0) + continue; reg_table->mc_reg_table_entry[num_ranges].mc_data[i] = reg_table->mc_reg_table_entry[num_ranges].mc_data[i - 1]; } -- 2.34.1

2 1

[PATCH OLK-5.10] serial: sc16is7xx: fix invalid FIFO access with special register set
by Gu Bowen 29 Sep '24

29 Sep '24

From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> mainline inclusion from mainline-v6.11-rc3 commit 7d3b793faaab1305994ce568b59d61927235f57b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY1A CVE: CVE-2024-44950 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When enabling access to the special register set, Receiver time-out and RHR interrupts can happen. In this case, the IRQ handler will try to read from the FIFO thru the RHR register at address 0x00, but address 0x00 is mapped to DLL register, resulting in erroneous FIFO reading. Call graph example: sc16is7xx_startup(): entry sc16is7xx_ms_proc(): entry sc16is7xx_set_termios(): entry sc16is7xx_set_baud(): DLH/DLL = $009C --> access special register set sc16is7xx_port_irq() entry --> IIR is 0x0C sc16is7xx_handle_rx() entry sc16is7xx_fifo_read(): --> unable to access FIFO (RHR) because it is mapped to DLL (LCR=LCR_CONF_MODE_A) sc16is7xx_set_baud(): exit --> Restore access to general register set Fix the problem by claiming the efr_lock mutex when accessing the Special register set. Fixes: dfeae619d781 ("serial: sc16is7xx") Cc: stable(a)vger.kernel.org Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> Link: https://lore.kernel.org/r/20240723125302.1305372-3-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/sc16is7xx.c [The conflicts occurs because the commit 3837a0379533 ("serial: sc16is7xx: improve regmap debugfs by using one regmap per port") and commit 4409df5866b7f ("serial: sc16is7xx: change EFR lock to operate on each channels") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/serial/sc16is7xx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c index 29f05db0d49b..367692a35398 100644 --- a/drivers/tty/serial/sc16is7xx.c +++ b/drivers/tty/serial/sc16is7xx.c @@ -538,6 +538,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) SC16IS7XX_MCR_CLKSEL_BIT, prescaler); + mutex_lock(&s->efr_lock); + /* Open the LCR divisors for configuration */ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, SC16IS7XX_LCR_CONF_MODE_A); @@ -551,6 +553,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) /* Put LCR back to the normal mode */ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); + mutex_unlock(&s->efr_lock); + return DIV_ROUND_CLOSEST(clk / 16, div); } -- 2.25.1

2 1

[PATCH OLK-6.6] drm/amd/pm: Fix negative array index read
by Tengda Wu 29 Sep '24

29 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit 4711b1347cb9f0c3083da6d87c624d75f9bd1d50 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9MO CVE: CVE-2024-46821 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c8c19ebf7c0b202a6a2d37a52ca112432723db5f ] Avoid using the negative values for clk_idex as an index into an array pptable->DpmDescriptor. V2: fix clk_index return check (Tim Huang) Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Fixes: c49b1b59a2fa ("drm/amd/powerplay: change sysfs pp_dpm_xxx format for navi10") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- .../gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 27 ++++++++++++++----- 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c index c564f6e191f8..b1b23233635a 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c @@ -1222,19 +1222,22 @@ static int navi10_get_current_clk_freq_by_table(struct smu_context *smu, value); } -static bool navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) +static int navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) { PPTable_t *pptable = smu->smu_table.driver_pptable; DpmDescriptor_t *dpm_desc = NULL; - uint32_t clk_index = 0; + int clk_index = 0; clk_index = smu_cmn_to_asic_specific_index(smu, CMN2ASIC_MAPPING_CLK, clk_type); + if (clk_index < 0) + return clk_index; + dpm_desc = &pptable->DpmDescriptor[clk_index]; /* 0 - Fine grained DPM, 1 - Discrete DPM */ - return dpm_desc->SnapToDiscrete == 0; + return dpm_desc->SnapToDiscrete == 0 ? 1 : 0; } static inline bool navi10_od_feature_is_supported(struct smu_11_0_overdrive_table *od_table, enum SMU_11_0_ODFEATURE_CAP cap) @@ -1290,7 +1293,11 @@ static int navi10_emit_clk_levels(struct smu_context *smu, if (ret) return ret; - if (!navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (!ret) { for (i = 0; i < count; i++) { ret = smu_v11_0_get_dpm_freq_by_index(smu, clk_type, i, &value); @@ -1499,7 +1506,11 @@ static int navi10_print_clk_levels(struct smu_context *smu, if (ret) return size; - if (!navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (!ret) { for (i = 0; i < count; i++) { ret = smu_v11_0_get_dpm_freq_by_index(smu, clk_type, i, &value); if (ret) @@ -1668,7 +1679,11 @@ static int navi10_force_clk_levels(struct smu_context *smu, case SMU_UCLK: case SMU_FCLK: /* There is only 2 levels for fine grained DPM */ - if (navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (ret) { soft_max_level = (soft_max_level >= 1 ? 1 : 0); soft_min_level = (soft_min_level >= 1 ? 1 : 0); } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/pm: Fix negative array index read
by Tengda Wu 29 Sep '24

29 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit c8c19ebf7c0b202a6a2d37a52ca112432723db5f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9MO CVE: CVE-2024-46821 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Avoid using the negative values for clk_idex as an index into an array pptable->DpmDescriptor. V2: fix clk_index return check (Tim Huang) Signed-off-by: Jesse Zhang <jesse.zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Fixes: c49b1b59a2fa ("drm/amd/powerplay: change sysfs pp_dpm_xxx format for navi10") Conflicts: drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c [The commit didn't backport b06b48d7ddae ("amdgpu/pm: Implement emit_clk_levels for navi10") yet] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- .../gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c index 2937784bc824..bc6f912b1f90 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c @@ -885,19 +885,22 @@ static int navi10_get_current_clk_freq_by_table(struct smu_context *smu, value); } -static bool navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) +static int navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) { PPTable_t *pptable = smu->smu_table.driver_pptable; DpmDescriptor_t *dpm_desc = NULL; - uint32_t clk_index = 0; + int clk_index = 0; clk_index = smu_cmn_to_asic_specific_index(smu, CMN2ASIC_MAPPING_CLK, clk_type); + if (clk_index < 0) + return clk_index; + dpm_desc = &pptable->DpmDescriptor[clk_index]; /* 0 - Fine grained DPM, 1 - Discrete DPM */ - return dpm_desc->SnapToDiscrete == 0 ? true : false; + return dpm_desc->SnapToDiscrete == 0 ? 1 : 0; } static inline bool navi10_od_feature_is_supported(struct smu_11_0_overdrive_table *od_table, enum SMU_11_0_ODFEATURE_CAP cap) @@ -949,7 +952,11 @@ static int navi10_print_clk_levels(struct smu_context *smu, if (ret) return size; - if (!navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (!ret) { for (i = 0; i < count; i++) { ret = smu_v11_0_get_dpm_freq_by_index(smu, clk_type, i, &value); if (ret) @@ -1112,7 +1119,11 @@ static int navi10_force_clk_levels(struct smu_context *smu, case SMU_UCLK: case SMU_FCLK: /* There is only 2 levels for fine grained DPM */ - if (navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (ret) { soft_max_level = (soft_max_level >= 1 ? 1 : 0); soft_min_level = (soft_min_level >= 1 ? 1 : 0); } -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/pm: Fix negative array index read
by Tengda Wu 29 Sep '24

29 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit c8c19ebf7c0b202a6a2d37a52ca112432723db5f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9MO CVE: CVE-2024-46821 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Avoid using the negative values for clk_idex as an index into an array pptable->DpmDescriptor. V2: fix clk_index return check (Tim Huang) Signed-off-by: Jesse Zhang <jesse.zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Fixes: c49b1b59a2fa ("drm/amd/powerplay: change sysfs pp_dpm_xxx format for navi10") Conflicts: drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c [The commit didn't backport b06b48d7ddae ("amdgpu/pm: Implement emit_clk_levels for navi10") yet] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- .../gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c index a7773b6453d5..0af9ee3a520a 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c @@ -900,19 +900,22 @@ static int navi10_get_current_clk_freq_by_table(struct smu_context *smu, value); } -static bool navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) +static int navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) { PPTable_t *pptable = smu->smu_table.driver_pptable; DpmDescriptor_t *dpm_desc = NULL; - uint32_t clk_index = 0; + int clk_index = 0; clk_index = smu_cmn_to_asic_specific_index(smu, CMN2ASIC_MAPPING_CLK, clk_type); + if (clk_index < 0) + return clk_index; + dpm_desc = &pptable->DpmDescriptor[clk_index]; /* 0 - Fine grained DPM, 1 - Discrete DPM */ - return dpm_desc->SnapToDiscrete == 0 ? true : false; + return dpm_desc->SnapToDiscrete == 0 ? 1 : 0; } static inline bool navi10_od_feature_is_supported(struct smu_11_0_overdrive_table *od_table, enum SMU_11_0_ODFEATURE_CAP cap) @@ -964,7 +967,11 @@ static int navi10_print_clk_levels(struct smu_context *smu, if (ret) return size; - if (!navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (!ret) { for (i = 0; i < count; i++) { ret = smu_v11_0_get_dpm_freq_by_index(smu, clk_type, i, &value); if (ret) @@ -1127,7 +1134,11 @@ static int navi10_force_clk_levels(struct smu_context *smu, case SMU_UCLK: case SMU_FCLK: /* There is only 2 levels for fine grained DPM */ - if (navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (ret) { soft_max_level = (soft_max_level >= 1 ? 1 : 0); soft_min_level = (soft_min_level >= 1 ? 1 : 0); } -- 2.34.1

2 1

[PATCH OLK-6.6] serial: sc16is7xx: fix invalid FIFO access with special register set
by Gu Bowen 29 Sep '24

29 Sep '24

From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> mainline inclusion from mainline-v6.11-rc3 commit 7d3b793faaab1305994ce568b59d61927235f57b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY1A CVE: CVE-2024-44950 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When enabling access to the special register set, Receiver time-out and RHR interrupts can happen. In this case, the IRQ handler will try to read from the FIFO thru the RHR register at address 0x00, but address 0x00 is mapped to DLL register, resulting in erroneous FIFO reading. Call graph example: sc16is7xx_startup(): entry sc16is7xx_ms_proc(): entry sc16is7xx_set_termios(): entry sc16is7xx_set_baud(): DLH/DLL = $009C --> access special register set sc16is7xx_port_irq() entry --> IIR is 0x0C sc16is7xx_handle_rx() entry sc16is7xx_fifo_read(): --> unable to access FIFO (RHR) because it is mapped to DLL (LCR=LCR_CONF_MODE_A) sc16is7xx_set_baud(): exit --> Restore access to general register set Fix the problem by claiming the efr_lock mutex when accessing the Special register set. Fixes: dfeae619d781 ("serial: sc16is7xx") Cc: stable(a)vger.kernel.org Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> Link: https://lore.kernel.org/r/20240723125302.1305372-3-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/sc16is7xx.c [Trace context conflict, no adaptation required.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/serial/sc16is7xx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c index 7a9924d9b294..f290fbe21d63 100644 --- a/drivers/tty/serial/sc16is7xx.c +++ b/drivers/tty/serial/sc16is7xx.c @@ -545,6 +545,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) SC16IS7XX_MCR_CLKSEL_BIT, prescaler == 1 ? 0 : SC16IS7XX_MCR_CLKSEL_BIT); + mutex_lock(&one->efr_lock); + /* Open the LCR divisors for configuration */ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, SC16IS7XX_LCR_CONF_MODE_A); @@ -558,6 +560,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) /* Put LCR back to the normal mode */ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); + mutex_unlock(&one->efr_lock); + return DIV_ROUND_CLOSEST((clk / prescaler) / 16, div); } -- 2.25.1

2 1

[PATCH OLK-6.6] sched: Support to enable/disable dynamic_affinity
by Hui Tang 29 Sep '24

29 Sep '24

Offering: HULK hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAUFO7 CVE: NA -------------------------------- Currently, the 'dynamic_affinty' can be enabled but can not disabled by cmdline. In some scenarios may need to be enabled by default, it is more reasonable changing cmdline to 'dynamic_affinty=enable/disable'. Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- kernel/sched/fair.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 415f4b060123..099a2e25d03d 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -8962,12 +8962,27 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu) DEFINE_STATIC_KEY_FALSE(__dynamic_affinity_switch); -static int __init dynamic_affinity_switch_setup(char *__unused) +static int __init dynamic_affinity_switch_setup(char *str) { - static_branch_enable(&__dynamic_affinity_switch); - return 1; + int ret = 1; + + if (!str) + goto out; + + if (!strcmp(str, "enable")) + static_branch_enable(&__dynamic_affinity_switch); + else if (!strcmp(str, "disable")) + static_branch_disable(&__dynamic_affinity_switch); + else + ret = 0; + +out: + if (!ret) + pr_warn("Unable to parse dynamic_affinity=\n"); + + return ret; } -__setup("dynamic_affinity", dynamic_affinity_switch_setup); +__setup("dynamic_affinity=", dynamic_affinity_switch_setup); static inline bool prefer_cpus_valid(struct task_struct *p) { -- 2.34.1

2 1

[PATCH OLK-6.6] [Backport] serial: sc16is7xx: fix invalid FIFO access with special register set
by Gu Bowen 29 Sep '24

29 Sep '24

From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> mainline inclusion from mainline-v6.11-rc3 commit 7d3b793faaab1305994ce568b59d61927235f57b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY1A CVE: CVE-2024-44950 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When enabling access to the special register set, Receiver time-out and RHR interrupts can happen. In this case, the IRQ handler will try to read from the FIFO thru the RHR register at address 0x00, but address 0x00 is mapped to DLL register, resulting in erroneous FIFO reading. Call graph example: sc16is7xx_startup(): entry sc16is7xx_ms_proc(): entry sc16is7xx_set_termios(): entry sc16is7xx_set_baud(): DLH/DLL = $009C --> access special register set sc16is7xx_port_irq() entry --> IIR is 0x0C sc16is7xx_handle_rx() entry sc16is7xx_fifo_read(): --> unable to access FIFO (RHR) because it is mapped to DLL (LCR=LCR_CONF_MODE_A) sc16is7xx_set_baud(): exit --> Restore access to general register set Fix the problem by claiming the efr_lock mutex when accessing the Special register set. Fixes: dfeae619d781 ("serial: sc16is7xx") Cc: stable(a)vger.kernel.org Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> Link: https://lore.kernel.org/r/20240723125302.1305372-3-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/sc16is7xx.c [Trace context conflict, no adaptation required.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/serial/sc16is7xx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c index 7a9924d9b294..f290fbe21d63 100644 --- a/drivers/tty/serial/sc16is7xx.c +++ b/drivers/tty/serial/sc16is7xx.c @@ -545,6 +545,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) SC16IS7XX_MCR_CLKSEL_BIT, prescaler == 1 ? 0 : SC16IS7XX_MCR_CLKSEL_BIT); + mutex_lock(&one->efr_lock); + /* Open the LCR divisors for configuration */ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, SC16IS7XX_LCR_CONF_MODE_A); @@ -558,6 +560,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) /* Put LCR back to the normal mode */ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); + mutex_unlock(&one->efr_lock); + return DIV_ROUND_CLOSEST((clk / prescaler) / 16, div); } -- 2.25.1

2 1

[PATCH OLK-6.6] scsi: ufs: core: Remove SCSI host only if added
by Pu Lehui 29 Sep '24

29 Sep '24

From: Kyoungrul Kim <k831.kim(a)samsung.com> stable inclusion from stable-v6.6.51 commit 2f49e05d6b58d660f035a75ff96b77071b4bd5ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9QP CVE: CVE-2024-46843 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7cbff570dbe8907e23bba06f6414899a0fbb2fcc ] If host tries to remove ufshcd driver from a UFS device it would cause a kernel panic if ufshcd_async_scan fails during ufshcd_probe_hba before adding a SCSI host with scsi_add_host and MCQ is enabled since SCSI host has been defered after MCQ configuration introduced by commit 0cab4023ec7b ("scsi: ufs: core: Defer adding host to SCSI if MCQ is supported"). To guarantee that SCSI host is removed only if it has been added, set the scsi_host_added flag to true after adding a SCSI host and check whether it is set or not before removing it. Signed-off-by: Kyoungrul Kim <k831.kim(a)samsung.com> Signed-off-by: Minwoo Im <minwoo.im(a)samsung.com> Link: https://lore.kernel.org/r/20240627085104epcms2p5897a3870ea5c6416aa44f94df6c… Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/ufs/core/ufshcd.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index 94edac17b95f..2f92e3f4ca91 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -10119,7 +10119,8 @@ void ufshcd_remove(struct ufs_hba *hba) blk_mq_destroy_queue(hba->tmf_queue); blk_put_queue(hba->tmf_queue); blk_mq_free_tag_set(&hba->tmf_tag_set); - scsi_remove_host(hba->host); + if (hba->scsi_host_added) + scsi_remove_host(hba->host); /* disable interrupts */ ufshcd_disable_intr(hba, hba->intr_mask); ufshcd_hba_stop(hba); @@ -10391,6 +10392,7 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) dev_err(hba->dev, "scsi_add_host failed\n"); goto out_disable; } + hba->scsi_host_added = true; } hba->tmf_tag_set = (struct blk_mq_tag_set) { @@ -10472,7 +10474,8 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) free_tmf_tag_set: blk_mq_free_tag_set(&hba->tmf_tag_set); out_remove_scsi_host: - scsi_remove_host(hba->host); + if (hba->scsi_host_added) + scsi_remove_host(hba->host); out_disable: hba->is_irq_enabled = false; ufshcd_hba_exit(hba); -- 2.34.1

2 1

[PATCH OLK-6.6] scsi: ufs: core: Remove SCSI host only if added
by Pu Lehui 29 Sep '24

29 Sep '24

From: Kyoungrul Kim <k831.kim(a)samsung.com> stable inclusion from stable-v6.6.51 commit 2f49e05d6b58d660f035a75ff96b77071b4bd5ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9QP CVE: CVE-2024-46843 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7cbff570dbe8907e23bba06f6414899a0fbb2fcc ] If host tries to remove ufshcd driver from a UFS device it would cause a kernel panic if ufshcd_async_scan fails during ufshcd_probe_hba before adding a SCSI host with scsi_add_host and MCQ is enabled since SCSI host has been defered after MCQ configuration introduced by commit 0cab4023ec7b ("scsi: ufs: core: Defer adding host to SCSI if MCQ is supported"). To guarantee that SCSI host is removed only if it has been added, set the scsi_host_added flag to true after adding a SCSI host and check whether it is set or not before removing it. Signed-off-by: Kyoungrul Kim <k831.kim(a)samsung.com> Signed-off-by: Minwoo Im <minwoo.im(a)samsung.com> Link: https://lore.kernel.org/r/20240627085104epcms2p5897a3870ea5c6416aa44f94df6c… Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/ufs/core/ufshcd.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index 94edac17b95f..2f92e3f4ca91 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -10119,7 +10119,8 @@ void ufshcd_remove(struct ufs_hba *hba) blk_mq_destroy_queue(hba->tmf_queue); blk_put_queue(hba->tmf_queue); blk_mq_free_tag_set(&hba->tmf_tag_set); - scsi_remove_host(hba->host); + if (hba->scsi_host_added) + scsi_remove_host(hba->host); /* disable interrupts */ ufshcd_disable_intr(hba, hba->intr_mask); ufshcd_hba_stop(hba); @@ -10391,6 +10392,7 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) dev_err(hba->dev, "scsi_add_host failed\n"); goto out_disable; } + hba->scsi_host_added = true; } hba->tmf_tag_set = (struct blk_mq_tag_set) { @@ -10472,7 +10474,8 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) free_tmf_tag_set: blk_mq_free_tag_set(&hba->tmf_tag_set); out_remove_scsi_host: - scsi_remove_host(hba->host); + if (hba->scsi_host_added) + scsi_remove_host(hba->host); out_disable: hba->is_irq_enabled = false; ufshcd_hba_exit(hba); -- 2.34.1

2 1

[openeuler:OLK-5.10 24628/30000] fs/proc/base.c:1454:6: warning: no previous prototype for 'pbha_bit0_hide_file'
by kernel test robot 29 Sep '24

29 Sep '24

Hi Ma, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0988d5e5eb47d35a2babb4c0d6b6b81aa0fccbd3 commit: bea38841945a52bd03004240eb0da6a5115bae21 [24628/30000] arm64: mm: Hide pbha_bit0 in procfs if pbha is not enabled config: arm64-randconfig-004-20240928 (https://download.01.org/0day-ci/archive/20240929/202409291756.R89OCM5f-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240929/202409291756.R89OCM5f-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291756.R89OCM5f-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/proc/base.c:1454:6: warning: no previous prototype for 'pbha_bit0_hide_file' [-Wmissing-prototypes] 1454 | bool pbha_bit0_hide_file(const char *name) | ^~~~~~~~~~~~~~~~~~~ vim +/pbha_bit0_hide_file +1454 fs/proc/base.c 1453 > 1454 bool pbha_bit0_hide_file(const char *name) 1455 { 1456 if (!system_support_pbha_bit0() && !strncmp("pbha_bit0", name, 9)) 1457 return true; 1458 1459 return false; 1460 } 1461 #else 1462 static bool pbha_bit0_hide_file(const char *name) { return false; } 1463 #endif 1464 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] drm/amdgpu: Fix the warning division or modulo by zero
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit d116bb921e8b104f45d1f30a473ea99ef4262b9a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAUA67 CVE: CVE-2024-46806 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c ] Checks the partition mode and returns an error for an invalid mode. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Suggested-by: Lijo Lazar <lijo.lazar(a)amd.com> Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c index 0284c9198a04..6c6f9d9b5d89 100644 --- a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c +++ b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c @@ -500,6 +500,12 @@ static int aqua_vanjaram_switch_partition_mode(struct amdgpu_xcp_mgr *xcp_mgr, if (mode == AMDGPU_AUTO_COMPUTE_PARTITION_MODE) { mode = __aqua_vanjaram_get_auto_mode(xcp_mgr); + if (mode == AMDGPU_UNKNOWN_COMPUTE_PARTITION_MODE) { + dev_err(adev->dev, + "Invalid config, no compatible compute partition mode found, available memory partitions: %d", + adev->gmc.num_mem_partitions); + return -EINVAL; + } } else if (!__aqua_vanjaram_is_valid_mode(xcp_mgr, mode)) { dev_err(adev->dev, "Invalid compute partition mode requested, requested: %s, available memory partitions: %d", -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2024-44958 6.6
by Zheng Zucheng 29 Sep '24

29 Sep '24

Yang Yingliang (2): [Backport] sched/smt: Introduce sched_smt_present_inc/dec() helper [Backport] sched/smt: Fix unbalance sched_smt_present dec/inc kernel/sched/core.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] Fix CVE-2024-44958 5.10
by Zheng Zucheng 29 Sep '24

29 Sep '24

Yang Yingliang (2): sched/smt: Introduce sched_smt_present_inc/dec() helper sched/smt: Fix unbalance sched_smt_present dec/inc kernel/sched/core.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] drm/amdgpu: fix the waring dereferencing hive
by Yi Yang 29 Sep '24

29 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit 4ab720b6aa1ef5e71db1e534b5b45c80ac4ec58a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9PU CVE: CVE-2024-46805 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1940708ccf5aff76de4e0b399f99267c93a89193 ] Check the amdgpu_hive_info *hive that maybe is NULL. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c index 429ef212c1f2..a4f9015345cc 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c @@ -1336,6 +1336,9 @@ static void psp_xgmi_reflect_topology_info(struct psp_context *psp, uint8_t dst_num_links = node_info.num_links; hive = amdgpu_get_xgmi_hive(psp->adev); + if (WARN_ON(!hive)) + return; + list_for_each_entry(mirror_adev, &hive->device_list, gmc.xgmi.head) { struct psp_xgmi_topology_info *mirror_top_info; int j; -- 2.25.1

2 1

[openeuler:OLK-5.10 29235/30000] drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:1195:5: sparse: sparse: symbol 'hclge_tm_vf_tc_dwrr_cfg' was not declared. Should it be static?
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: dc55753ca59725e5130059dc4c520e8a91c655c0 commit: 518ea89ec98b78c749c27d6ba7792e1bdb5779ed [29235/30000] net: hns3: add support for vf multiple tcs config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240929/202409291552.pM1zgESs-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409291552.pM1zgESs-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291552.pM1zgESs-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:1195:5: sparse: sparse: symbol 'hclge_tm_vf_tc_dwrr_cfg' was not declared. Should it be static? vim +/hclge_tm_vf_tc_dwrr_cfg +1195 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c 1194 > 1195 int hclge_tm_vf_tc_dwrr_cfg(struct hclge_vport *vport) 1196 { 1197 struct hnae3_knic_private_info *kinfo = &vport->nic.kinfo; 1198 struct hclge_dev *hdev = vport->back; 1199 struct hclge_pg_info *pg_info; 1200 u8 dwrr; 1201 int ret; 1202 u32 i; 1203 1204 for (i = 0; i < kinfo->tc_info.max_tc; i++) { 1205 pg_info = &hdev->tm_info.pg_info[hdev->tm_info.tc_info[i].pgid]; 1206 dwrr = i < kinfo->tc_info.num_tc ? pg_info->tc_dwrr[i] : 0; 1207 ret = hclge_tm_qs_weight_cfg(hdev, vport->qs_offset + i, dwrr); 1208 if (ret) 1209 return ret; 1210 } 1211 1212 return 0; 1213 } 1214 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] Fix CVE-2024-44958 for 6.6
by Zheng Zucheng 29 Sep '24

29 Sep '24

Yang Yingliang (2): [Backport] sched/smt: Introduce sched_smt_present_inc/dec() helper [Backport] sched/smt: Fix unbalance sched_smt_present dec/inc kernel/sched/core.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 18534/23801] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3a5093f2913b14c22e19e60b6bf7a4d8ec2e5c69 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [18534/23801] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-104-20240929 (https://download.01.org/0day-ci/archive/20240929/202409291416.g51wPHKv-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291416.g51wPHKv-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] net: phy: Fix missing of_node_put() for leds
by Zhang Changzhong 29 Sep '24

29 Sep '24

From: Jinjie Ruan <ruanjinjie(a)huawei.com> stable inclusion from stable-v6.6.51 commit 26928c8f00f6bb0e194f3957fe51c69d36838eb2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYBT CVE: CVE-2024-46767 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2560db6ede1aaf162a73b2df43e0b6c5ed8819f7 ] The call of of_get_child_by_name() will cause refcount incremented for leds, if it succeeds, it should call of_node_put() to decrease it, fix it. Fixes: 01e5b728e9e4 ("net: phy: Add a binding for PHY LEDs") Reviewed-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://patch.msgid.link/20240830022025.610844-1-ruanjinjie@huawei.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/phy_device.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index c895cd1..2e4bff6 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -3164,11 +3164,13 @@ static int of_phy_leds(struct phy_device *phydev) err = of_phy_led(phydev, led); if (err) { of_node_put(led); + of_node_put(leds); phy_leds_unregister(phydev); return err; } } + of_node_put(leds); return 0; } -- 2.9.5

2 1

[PATCH OLK-6.6] mptcp: pm: only decrement add_addr_accepted for MPJ req
by Wang Liang 29 Sep '24

29 Sep '24

From: "Matthieu Baerts (NGI0)" <matttbe(a)kernel.org> stable inclusion from stable-v6.6.48 commit d20bf2c96d7ffd171299b32f562f70e5bf5dc608 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJM CVE: CVE-2024-45009 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1c1f721375989579e46741f59523e39ec9b2a9bd upstream. Adding the following warning ... WARN_ON_ONCE(msk->pm.add_addr_accepted == 0) ... before decrementing the add_addr_accepted counter helped to find a bug when running the "remove single subflow" subtest from the mptcp_join.sh selftest. Removing a 'subflow' endpoint will first trigger a RM_ADDR, then the subflow closure. Before this patch, and upon the reception of the RM_ADDR, the other peer will then try to decrement this add_addr_accepted. That's not correct because the attached subflows have not been created upon the reception of an ADD_ADDR. A way to solve that is to decrement the counter only if the attached subflow was an MP_JOIN to a remote id that was not 0, and initiated by the host receiving the RM_ADDR. Fixes: d0876b2284cf ("mptcp: add the incoming RM_ADDR support") Cc: stable(a)vger.kernel.org Reviewed-by: Mat Martineau <martineau(a)kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-9-38035d40de5b… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/mptcp/pm_netlink.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index aa56696cdc78..7fc4d7063c82 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -841,7 +841,7 @@ static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk, mptcp_close_ssk(sk, ssk, subflow); spin_lock_bh(&msk->pm.lock); - removed = true; + removed |= subflow->request_join; if (rm_type == MPTCP_MIB_RMSUBFLOW) __MPTCP_INC_STATS(sock_net(sk), rm_type); } @@ -855,7 +855,11 @@ static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk, if (!mptcp_pm_is_kernel(msk)) continue; - if (rm_type == MPTCP_MIB_RMADDR) { + if (rm_type == MPTCP_MIB_RMADDR && rm_id && + !WARN_ON_ONCE(msk->pm.add_addr_accepted == 0)) { + /* Note: if the subflow has been closed before, this + * add_addr_accepted counter will not be decremented. + */ msk->pm.add_addr_accepted--; WRITE_ONCE(msk->pm.accept_addr, true); } else if (rm_type == MPTCP_MIB_RMSUBFLOW) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/3] Fix CVE-2024-44958
by Zheng Zucheng 29 Sep '24

29 Sep '24

Yang Yingliang (2): sched/smt: Introduce sched_smt_present_inc/dec() helper sched/smt: Fix unbalance sched_smt_present dec/inc Zheng Zucheng (1): sched: Revert fix unbalance sched_smt_present dec/inc kernel/sched/core.c | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS-SP1] btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.11-rc1 commit a580fb2c3479d993556e1c31b237c9e5be4944a3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9LZ CVE: CVE-2024-46841 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We handle errors here properly, ENOMEM isn't fatal, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 4049405548ac..d53a4a3a9f8a 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -4860,7 +4860,6 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, eb->start, level, 1, &wc->refs[level], &wc->flags[level]); - BUG_ON(ret == -ENOMEM); if (ret) return ret; BUG_ON(wc->refs[level] == 0); -- 2.39.2

2 1

[PATCH OLK-5.10] btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.11-rc1 commit a580fb2c3479d993556e1c31b237c9e5be4944a3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9LZ CVE: CVE-2024-46841 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We handle errors here properly, ENOMEM isn't fatal, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index ae6625aa2c4a..854c7fa0fc06 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -4872,7 +4872,6 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, eb->start, level, 1, &wc->refs[level], &wc->flags[level]); - BUG_ON(ret == -ENOMEM); if (ret) return ret; BUG_ON(wc->refs[level] == 0); -- 2.39.2

2 1

[PATCH OLK-6.6] btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.11-rc1 commit a580fb2c3479d993556e1c31b237c9e5be4944a3 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9LZ CVE: CVE-2024-46841 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We handle errors here properly, ENOMEM isn't fatal, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 39afb1c46907..c88907111d80 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5150,7 +5150,6 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, eb->start, level, 1, &wc->refs[level], &wc->flags[level]); - BUG_ON(ret == -ENOMEM); if (ret) return ret; BUG_ON(wc->refs[level] == 0); -- 2.39.2

2 1

[PATCH OLK-6.6] drm/amdgpu: Fix the warning division or modulo by zero
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit d116bb921e8b104f45d1f30a473ea99ef4262b9a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAUA67 CVE: CVE-2024-46806 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c ] Checks the partition mode and returns an error for an invalid mode. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Suggested-by: Lijo Lazar <lijo.lazar(a)amd.com> Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c index 0284c9198a04..6c6f9d9b5d89 100644 --- a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c +++ b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c @@ -500,6 +500,12 @@ static int aqua_vanjaram_switch_partition_mode(struct amdgpu_xcp_mgr *xcp_mgr, if (mode == AMDGPU_AUTO_COMPUTE_PARTITION_MODE) { mode = __aqua_vanjaram_get_auto_mode(xcp_mgr); + if (mode == AMDGPU_UNKNOWN_COMPUTE_PARTITION_MODE) { + dev_err(adev->dev, + "Invalid config, no compatible compute partition mode found, available memory partitions: %d", + adev->gmc.num_mem_partitions); + return -EINVAL; + } } else if (!__aqua_vanjaram_is_valid_mode(xcp_mgr, mode)) { dev_err(adev->dev, "Invalid compute partition mode requested, requested: %s, available memory partitions: %d", -- 2.39.2

2 1

[openeuler:OLK-5.10 22702/30000] drivers/irqchip/irq-mbigen.c:122:11: sparse: sparse: symbol 'vtimer_cpu_mask' was not declared. Should it be static?
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: dc55753ca59725e5130059dc4c520e8a91c655c0 commit: 212e82b2357f9103ddb3b759c37ae518831f701b [22702/30000] mbigen: vtimer mbigen driver support config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240929/202409291341.axFxcmaf-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409291341.axFxcmaf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291341.axFxcmaf-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/irqchip/irq-mbigen.c:122:11: sparse: sparse: symbol 'vtimer_cpu_mask' was not declared. Should it be static? drivers/irqchip/irq-mbigen.c:318:34: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void [noderef] __iomem *base @@ got void *chip_data @@ drivers/irqchip/irq-mbigen.c:318:34: sparse: expected void [noderef] __iomem *base drivers/irqchip/irq-mbigen.c:318:34: sparse: got void *chip_data drivers/irqchip/irq-mbigen.c:330:34: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void [noderef] __iomem *base @@ got void *chip_data @@ drivers/irqchip/irq-mbigen.c:330:34: sparse: expected void [noderef] __iomem *base drivers/irqchip/irq-mbigen.c:330:34: sparse: got void *chip_data drivers/irqchip/irq-mbigen.c:362:31: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void [noderef] __iomem *base @@ got void *chip_data @@ drivers/irqchip/irq-mbigen.c:362:31: sparse: expected void [noderef] __iomem *base drivers/irqchip/irq-mbigen.c:362:31: sparse: got void *chip_data drivers/irqchip/irq-mbigen.c:435:65: sparse: sparse: incorrect type in argument 5 (different address spaces) @@ expected void *chip_data @@ got void [noderef] __iomem *base @@ drivers/irqchip/irq-mbigen.c:435:65: sparse: expected void *chip_data drivers/irqchip/irq-mbigen.c:435:65: sparse: got void [noderef] __iomem *base vim +/vtimer_cpu_mask +122 drivers/irqchip/irq-mbigen.c 121 > 122 cpumask_t vtimer_cpu_mask; 123 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 23323/30000] drivers/ub/urma/ubcore/ubcore_tp.c:392:5: warning: no previous prototype for 'ubcore_modify_tp_state'
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: dc55753ca59725e5130059dc4c520e8a91c655c0 commit: 329bf7f331286ee5d571d374e31ed50d2877b110 [23323/30000] ubcore: fix the bug of tp negotiation concurrency config: arm64-randconfig-004-20240928 (https://download.01.org/0day-ci/archive/20240929/202409291302.BCi0PcSr-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240929/202409291302.BCi0PcSr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291302.BCi0PcSr-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/ubcore/ubcore_tp.c:66:17: warning: no previous prototype for 'ubcore_get_mtu' [-Wmissing-prototypes] 66 | enum ubcore_mtu ubcore_get_mtu(int mtu) | ^~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_tp.c:392:5: warning: no previous prototype for 'ubcore_modify_tp_state' [-Wmissing-prototypes] 392 | int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_tp.c:894:19: warning: no previous prototype for 'ubcore_create_vtp' [-Wmissing-prototypes] 894 | struct ubcore_tp *ubcore_create_vtp(struct ubcore_device *dev, union ubcore_eid *remote_eid, | ^~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_tp.c:920:5: warning: no previous prototype for 'ubcore_destroy_vtp' [-Wmissing-prototypes] 920 | int ubcore_destroy_vtp(struct ubcore_tp *vtp) | ^~~~~~~~~~~~~~~~~~ vim +/ubcore_modify_tp_state +392 drivers/ub/urma/ubcore/ubcore_tp.c 391 > 392 int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp, 393 enum ubcore_tp_state new_state, struct ubcore_tp_attr *attr, union ubcore_tp_attr_mask mask) 394 { 395 if (ubcore_modify_tp_state_check(tp, new_state) != 0) 396 return -1; 397 398 if (tp->state == UBCORE_TP_STATE_ERR && new_state == UBCORE_TP_STATE_ERR) { 399 ubcore_log_info("tp is already in ERR state and tpn = %u", 400 tp->tpn); 401 return 0; 402 } 403 404 if (dev->ops->modify_tp(tp, attr, mask) != 0) { 405 /* tp->peer_ext.addr will be freed when called ubcore_destroy_tp */ 406 ubcore_log_err("Failed to modify tp to %u from state %u and tpn = %u", 407 (uint32_t)new_state, (uint32_t)tp->state, tp->tpn); 408 return -1; 409 } 410 tp->state = new_state; 411 ubcore_log_info("tp state:(%u to %u) with tpn %u, peer_tpn %u", 412 (uint32_t)tp->state, (uint32_t)new_state, tp->tpn, tp->peer_tpn); 413 return 0; 414 } 415 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20368/23799] drivers/android/binder_alloc_selftest.c:109:19: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3a5093f2913b14c22e19e60b6bf7a4d8ec2e5c69 commit: d549e609b8685eb101a4653249ef7e3fe8bb3e99 [20368/23799] binder: use userspace pointer as base of buffer space config: arm64-randconfig-r133-20240926 (https://download.01.org/0day-ci/archive/20240929/202409291234.x2jnAFD9-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409291234.x2jnAFD9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291234.x2jnAFD9-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/android/binder_alloc_selftest.c:109:19: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *page_addr @@ got void [noderef] <asn:1> *user_data @@ drivers/android/binder_alloc_selftest.c:109:19: sparse: expected void *page_addr drivers/android/binder_alloc_selftest.c:109:19: sparse: got void [noderef] <asn:1> *user_data >> drivers/android/binder_alloc_selftest.c:111:41: sparse: sparse: subtraction of different types can't work (different address spaces) drivers/android/binder_alloc_selftest.c:85: warning: Enum value 'LOOP_END' not described in enum 'buf_end_align_type' vim +109 drivers/android/binder_alloc_selftest.c 100 101 static bool check_buffer_pages_allocated(struct binder_alloc *alloc, 102 struct binder_buffer *buffer, 103 size_t size) 104 { 105 void *page_addr, *end; 106 int page_index; 107 108 end = (void *)PAGE_ALIGN((uintptr_t)buffer->user_data + size); > 109 page_addr = buffer->user_data; 110 for (; page_addr < end; page_addr += PAGE_SIZE) { > 111 page_index = (page_addr - alloc->buffer) / PAGE_SIZE; 112 if (!alloc->pages[page_index].page_ptr || 113 !list_empty(&alloc->pages[page_index].lru)) { 114 pr_err("expect alloc but is %s at page index %d\n", 115 alloc->pages[page_index].page_ptr ? 116 "lru" : "free", page_index); 117 return false; 118 } 119 } 120 return true; 121 } 122 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] drm/amdgpu: fix mc_data out-of-bounds read warning
by He Yujie 29 Sep '24

29 Sep '24

From: Tim Huang <Tim.Huang(a)amd.com> stable inclusion from stable-v4.19.322 commit eb1d4ce2609584eeb7694866f34d4b213caa3af9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV9S CVE: CVE-2024-46722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 51dfc0a4d609fe700750a62f41447f01b8c9ea50 ] Clear warning that read mc_data[i-1] may out-of-bounds. Signed-off-by: Tim Huang <Tim.Huang(a)amd.com> Reviewed-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c index bf872f694f50..653651a5b910 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c @@ -1641,6 +1641,8 @@ int amdgpu_atombios_init_mc_reg_table(struct amdgpu_device *adev, (u32)le32_to_cpu(*((u32 *)reg_data + j)); j++; } else if ((reg_table->mc_reg_address[i].pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { + if (i == 0) + continue; reg_table->mc_reg_table_entry[num_ranges].mc_data[i] = reg_table->mc_reg_table_entry[num_ranges].mc_data[i - 1]; } -- 2.34.1

2 1

[PATCH OLK-5.10 00/10] sbitmap: backport bugfix patches
by Yu Kuai 29 Sep '24

29 Sep '24

Hugh Dickins (1): sbitmap: fix lockup while swapping Jan Kara (1): sbitmap: Avoid leaving waitqueue in invalid state in __sbq_wake_up() Kemeng Shi (3): sbitmap: correct wake_batch recalculation to avoid potential IO hung blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait blk-mq: Fix potential io hung for shared sbitmap per tagset Laibin Qiu (2): blk-mq: fix tag_get wait task can't be awakened blk-mq: Fix wrong wakeup batch configuration which will cause hang Li Lingfeng (1): block: Fix lockdep warning in blk_mq_mark_tag_wait Yu Kuai (2): blk-mq: fix potential io hang by wrong 'wake_batch' sbitmap: fix possible io hung due to lost wakeup block/blk-mq-tag.c | 46 +++++++++++++++---- block/blk-mq.c | 12 +++-- include/linux/sbitmap.h | 11 +++++ lib/sbitmap.c | 97 +++++++++++++++++++++++++++++------------ 4 files changed, 128 insertions(+), 38 deletions(-) -- 2.39.2

2 11

[PATCH OLK-5.10] usb: typec: ucsi: Fix null pointer dereference in trace
by Zhang Zekun 29 Sep '24

29 Sep '24

From: Abhishek Pandit-Subedi <abhishekpandit(a)chromium.org> stable inclusion from stable-v5.10.226 commit 7e64cabe81c303bdf6fd26b6a09a3289b33bc870 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV3B CVE: CVE-2024-46719 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------------ [ Upstream commit 99516f76db48e1a9d54cdfed63c1babcee4e71a5 ] ucsi_register_altmode checks IS_ERR for the alt pointer and treats NULL as valid. When CONFIG_TYPEC_DP_ALTMODE is not enabled, ucsi_register_displayport returns NULL which causes a NULL pointer dereference in trace. Rather than return NULL, call typec_port_register_altmode to register DisplayPort alternate mode as a non-controllable mode when CONFIG_TYPEC_DP_ALTMODE is not enabled. Reviewed-by: Benson Leung <bleung(a)chromium.org> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Signed-off-by: Abhishek Pandit-Subedi <abhishekpandit(a)chromium.org> Signed-off-by: Jameson Thies <jthies(a)google.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Link: https://lore.kernel.org/r/20240510201244.2968152-2-jthies@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/usb/typec/ucsi/ucsi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h index cc1459b366cc..20995adc6b81 100644 --- a/drivers/usb/typec/ucsi/ucsi.h +++ b/drivers/usb/typec/ucsi/ucsi.h @@ -376,7 +376,7 @@ ucsi_register_displayport(struct ucsi_connector *con, bool override, int offset, struct typec_altmode_desc *desc) { - return NULL; + return typec_port_register_altmode(con->port, desc); } static inline void -- 2.17.1

2 1

[PATCH OLK-5.10] of/irq: Prevent device address out-of-bounds read in interrupt map walk
by Zhang Zekun 29 Sep '24

29 Sep '24

From: Stefan Wiehler <stefan.wiehler(a)nokia.com> stable inclusion from stable-v5.10.226 commit 9d1e9f0876b03d74d44513a0ed3ed15ef8f2fed5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWTE CVE: CVE-2024-46743 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------------------------------------- [ Upstream commit b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305 ] When of_irq_parse_raw() is invoked with a device address smaller than the interrupt parent node (from #address-cells property), KASAN detects the following out-of-bounds read when populating the initial match table (dyndbg="func of_irq_parse_* +p"): OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0 OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2 OF: intspec=4 OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2 OF: -> addrsize=3 ================================================================== BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0 Read of size 4 at addr ffffff81beca5608 by task bash/764 CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokia_sm_arm64 #1 Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023 Call trace: dump_backtrace+0xdc/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0x6c/0x84 print_report+0x150/0x448 kasan_report+0x98/0x140 __asan_load4+0x78/0xa0 of_irq_parse_raw+0x2b8/0x8d0 of_irq_parse_one+0x24c/0x270 parse_interrupts+0xc0/0x120 of_fwnode_add_links+0x100/0x2d0 fw_devlink_parse_fwtree+0x64/0xc0 device_add+0xb38/0xc30 of_device_add+0x64/0x90 of_platform_device_create_pdata+0xd0/0x170 of_platform_bus_create+0x244/0x600 of_platform_notify+0x1b0/0x254 blocking_notifier_call_chain+0x9c/0xd0 __of_changeset_entry_notify+0x1b8/0x230 __of_changeset_apply_notify+0x54/0xe4 of_overlay_fdt_apply+0xc04/0xd94 ... The buggy address belongs to the object at ffffff81beca5600 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 8 bytes inside of 128-byte region [ffffff81beca5600, ffffff81beca5680) The buggy address belongs to the physical page: page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4 head:00000000230d3d03 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x8000000000010200(slab|head|zone=2) raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ================================================================== OF: -> got it ! Prevent the out-of-bounds read by copying the device address into a buffer of sufficient size. Signed-off-by: Stefan Wiehler <stefan.wiehler(a)nokia.com> Link: https://lore.kernel.org/r/20240812100652.3800963-1-stefan.wiehler@nokia.com Signed-off-by: Rob Herring (Arm) <robh(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/of/irq.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index 352e14b007e7..ad0cb49e233a 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -288,7 +288,8 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar struct device_node *p; const __be32 *addr; u32 intsize; - int i, res; + int i, res, addr_len; + __be32 addr_buf[3] = { 0 }; pr_debug("of_irq_parse_one: dev=%pOF, index=%d\n", device, index); @@ -297,13 +298,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar return of_irq_parse_oldworld(device, index, out_irq); /* Get the reg property (if any) */ - addr = of_get_property(device, "reg", NULL); + addr = of_get_property(device, "reg", &addr_len); + + /* Prevent out-of-bounds read in case of longer interrupt parent address size */ + if (addr_len > (3 * sizeof(__be32))) + addr_len = 3 * sizeof(__be32); + if (addr) + memcpy(addr_buf, addr, addr_len); /* Try the new-style interrupts-extended first */ res = of_parse_phandle_with_args(device, "interrupts-extended", "#interrupt-cells", index, out_irq); if (!res) - return of_irq_parse_raw(addr, out_irq); + return of_irq_parse_raw(addr_buf, out_irq); /* Look for the interrupt parent. */ p = of_irq_find_parent(device); @@ -333,7 +340,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar /* Check if there are any interrupt-map translations to process */ - res = of_irq_parse_raw(addr, out_irq); + res = of_irq_parse_raw(addr_buf, out_irq); out: of_node_put(p); return res; -- 2.17.1

2 1

[PATCH OLK-5.10] KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
by Zhang Zekun 29 Sep '24

29 Sep '24

From: Marc Zyngier <maz(a)kernel.org> stable inclusion from stable-v5.10.225 commit 15818af2f7aa55eff375333cb7689df15d3f24ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR5D2 CVE: CVE-2024-46707 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------------------------- commit 3e6245ebe7ef341639e9a7e402b3ade8ad45a19f upstream. On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a write to any of the ICC_*SGI*_EL1 registers is trapped to EL2. We therefore try to emulate the SGI access, only to hit a NULL pointer as no private interrupt is allocated (no GIC, remember?). The obvious fix is to give the guest what it deserves, in the shape of a UNDEF exception. Reported-by: Alexander Potapenko <glider(a)google.com> Signed-off-by: Marc Zyngier <maz(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240820100349.3544850-2-maz@kernel.org Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/arm64/kvm/vgic/vgic.h [Code context change only] Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- arch/arm64/kvm/sys_regs.c | 6 ++++++ arch/arm64/kvm/vgic/vgic.h | 7 +++++++ 2 files changed, 13 insertions(+) diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c index 0cb9e4de5afd..1ee3c00ed8a0 100644 --- a/arch/arm64/kvm/sys_regs.c +++ b/arch/arm64/kvm/sys_regs.c @@ -30,6 +30,7 @@ #include <trace/events/kvm.h> #include "sys_regs.h" +#include "vgic/vgic.h" #include "trace.h" @@ -275,6 +276,11 @@ static bool access_gic_sgi(struct kvm_vcpu *vcpu, { bool g1; + if (!kvm_has_gicv3(vcpu->kvm)) { + kvm_inject_undefined(vcpu); + return false; + } + if (!p->is_write) return read_from_write_only(vcpu, p, r); diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h index 47abce1ff89e..06564e8dd69b 100644 --- a/arch/arm64/kvm/vgic/vgic.h +++ b/arch/arm64/kvm/vgic/vgic.h @@ -330,4 +330,11 @@ void vgic_v4_configure_vsgis(struct kvm *kvm); void vgic_v4_get_vlpi_state(struct vgic_irq *irq, bool *val); void vgic_v4_configure_vtimer(struct kvm *kvm); +static inline bool kvm_has_gicv3(struct kvm *kvm) +{ + return (static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif) && + irqchip_in_kernel(kvm) && + kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3); +} + #endif -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] btrfs: remove NULL transaction support for btrfs_lookup_extent_info()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.11-rc1 commit 119474bdbac0858053cf367c8c932dd5c4bb4e85 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX0N Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There are no callers of btrfs_lookup_extent_info() that pass a NULL value for the transaction handle argument, so there's no point in having special logic to deal with the NULL. The last caller that passed a NULL value was removed in commit 19b546d7a1b2 ("btrfs: relocation: Use btrfs_find_all_leafs to locate data extent parent tree leaves"). So remove the NULL handling from btrfs_lookup_extent_info(). Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202409271612.ikY68CAg-lkp@intel.com/ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Context differences.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 9521cb45433f..4049405548ac 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -135,11 +135,6 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, if (!path) return -ENOMEM; - if (!trans) { - path->skip_locking = 1; - path->search_commit_root = 1; - } - search_again: key.objectid = bytenr; key.offset = offset; @@ -172,10 +167,7 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, if (unlikely(item_size < sizeof(*ei))) { ret = -EINVAL; btrfs_print_v0_err(fs_info); - if (trans) - btrfs_abort_transaction(trans, ret); - else - btrfs_handle_fs_error(fs_info, ret, NULL); + btrfs_abort_transaction(trans, ret); goto out_free; } @@ -197,9 +189,6 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, ret = 0; } - if (!trans) - goto out; - delayed_refs = &trans->transaction->delayed_refs; spin_lock(&delayed_refs->lock); head = btrfs_find_delayed_ref_head(delayed_refs, bytenr); @@ -239,7 +228,7 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, mutex_unlock(&head->mutex); } spin_unlock(&delayed_refs->lock); -out: + WARN_ON(num_refs == 0); if (refs) *refs = num_refs; -- 2.39.2

2 1

[PATCH OLK-6.6] btrfs: remove NULL transaction support for btrfs_lookup_extent_info()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.11-rc1 commit 119474bdbac0858053cf367c8c932dd5c4bb4e85 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX0N Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There are no callers of btrfs_lookup_extent_info() that pass a NULL value for the transaction handle argument, so there's no point in having special logic to deal with the NULL. The last caller that passed a NULL value was removed in commit 19b546d7a1b2 ("btrfs: relocation: Use btrfs_find_all_leafs to locate data extent parent tree leaves"). So remove the NULL handling from btrfs_lookup_extent_info(). Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202409271612.ikY68CAg-lkp@intel.com/ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 9bf1e4ac4de0..39afb1c46907 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -124,11 +124,6 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, if (!path) return -ENOMEM; - if (!trans) { - path->skip_locking = 1; - path->search_commit_root = 1; - } - search_again: key.objectid = bytenr; key.offset = offset; @@ -164,11 +159,7 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, btrfs_err(fs_info, "unexpected extent item size, has %u expect >= %zu", item_size, sizeof(*ei)); - if (trans) - btrfs_abort_transaction(trans, ret); - else - btrfs_handle_fs_error(fs_info, ret, NULL); - + btrfs_abort_transaction(trans, ret); goto out_free; } @@ -189,9 +180,6 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, ret = 0; } - if (!trans) - goto out; - delayed_refs = &trans->transaction->delayed_refs; spin_lock(&delayed_refs->lock); head = btrfs_find_delayed_ref_head(delayed_refs, bytenr); @@ -231,7 +219,7 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, mutex_unlock(&head->mutex); } spin_unlock(&delayed_refs->lock); -out: + WARN_ON(num_refs == 0); if (refs) *refs = num_refs; -- 2.39.2

2 1

[PATCH OLK-5.10] btrfs: remove NULL transaction support for btrfs_lookup_extent_info()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.11-rc1 commit 119474bdbac0858053cf367c8c932dd5c4bb4e85 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX0N Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There are no callers of btrfs_lookup_extent_info() that pass a NULL value for the transaction handle argument, so there's no point in having special logic to deal with the NULL. The last caller that passed a NULL value was removed in commit 19b546d7a1b2 ("btrfs: relocation: Use btrfs_find_all_leafs to locate data extent parent tree leaves"). So remove the NULL handling from btrfs_lookup_extent_info(). Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202409271612.ikY68CAg-lkp@intel.com/ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Context differences.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 054785ffacf7..ae6625aa2c4a 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -135,11 +135,6 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, if (!path) return -ENOMEM; - if (!trans) { - path->skip_locking = 1; - path->search_commit_root = 1; - } - search_again: key.objectid = bytenr; key.offset = offset; @@ -172,10 +167,7 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, if (unlikely(item_size < sizeof(*ei))) { ret = -EINVAL; btrfs_print_v0_err(fs_info); - if (trans) - btrfs_abort_transaction(trans, ret); - else - btrfs_handle_fs_error(fs_info, ret, NULL); + btrfs_abort_transaction(trans, ret); goto out_free; } @@ -197,9 +189,6 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, ret = 0; } - if (!trans) - goto out; - delayed_refs = &trans->transaction->delayed_refs; spin_lock(&delayed_refs->lock); head = btrfs_find_delayed_ref_head(delayed_refs, bytenr); @@ -239,7 +228,7 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, mutex_unlock(&head->mutex); } spin_unlock(&delayed_refs->lock); -out: + WARN_ON(num_refs == 0); if (refs) *refs = num_refs; -- 2.39.2

2 1

[PATCH OLK-5.10] kprobes: Fix deadlock issue with kmemleak
by Zheng Yejian 29 Sep '24

29 Sep '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://codehub-y.huawei.com/hulk/bugzilla/issues/196 -------------------------------- There is following deadlock issue: CPU0 CPU1 ==== ==== kretprobe_trampoline kmem_cache_alloc trampoline_handler kmemleak_alloc __kretprobe_trampoline_handler create_object kretprobe_hash_lock <-- hold kmemleak lock <-- hold kretprobe table lock __link_object recycle_rp_inst stack_trace_save kfree_rcu kvfree_call_rcu ... kmemleak_ignore unwind_next_frame kretprobe_find_ret_addr <-- wait for kmemleak lock kretprobe_hash_lock <-- wait for kretprobe table lock One task on CPU0 hold kretprobe_hash_lock and wait for kmemleak_lock, however, kmemleak_lock was held by other task on CPU1 and that task is waiting for kretprobe_hash_lock, then deadlock happended. To fix it, move kfree_rcu() out of kretprobe table lock area. Fixes: b67815b05d67 ("[Backport] kprobes: Add kretprobe_find_ret_addr() for searching return address") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/kprobes.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index dacb71214fa1..5d64d97975ba 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1223,7 +1223,7 @@ void kprobes_inc_nmissed_count(struct kprobe *p) } NOKPROBE_SYMBOL(kprobes_inc_nmissed_count); -static void recycle_rp_inst(struct kretprobe_instance *ri) +static void recycle_rp_inst(struct kretprobe_instance *ri, struct hlist_head *head) { struct kretprobe *rp = ri->rp; @@ -1235,7 +1235,7 @@ static void recycle_rp_inst(struct kretprobe_instance *ri) hlist_add_head(&ri->hlist, &rp->free_instances); raw_spin_unlock(&rp->lock); } else - kfree_rcu(ri, rcu); + hlist_add_head(&ri->hlist, head); } NOKPROBE_SYMBOL(recycle_rp_inst); @@ -1326,6 +1326,7 @@ void kprobe_flush_task(struct task_struct *tk) struct hlist_head *head; struct hlist_node *tmp; unsigned long hash, flags = 0; + HLIST_HEAD(empty_rp); if (unlikely(!kprobes_initialized)) /* Early boot. kretprobe_table_locks not yet initialized. */ @@ -1338,10 +1339,16 @@ void kprobe_flush_task(struct task_struct *tk) kretprobe_table_lock(hash, &flags); hlist_for_each_entry_safe(ri, tmp, head, hlist) { if (ri->task == tk) - recycle_rp_inst(ri); + recycle_rp_inst(ri, &empty_rp); } kretprobe_table_unlock(hash, &flags); + hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) { + hlist_del(&ri->hlist); + INIT_HLIST_NODE(&ri->hlist); + kfree_rcu(ri, rcu); + } + kprobe_busy_end(); } NOKPROBE_SYMBOL(kprobe_flush_task); @@ -2014,6 +2021,7 @@ unsigned long __kretprobe_trampoline_handler(struct pt_regs *regs, unsigned long flags; kprobe_opcode_t *correct_ret_addr = NULL; bool skipped = false; + HLIST_HEAD(empty_rp); kretprobe_hash_lock(current, &head, &flags); @@ -2082,7 +2090,7 @@ unsigned long __kretprobe_trampoline_handler(struct pt_regs *regs, __this_cpu_write(current_kprobe, prev); } - recycle_rp_inst(ri); + recycle_rp_inst(ri, &empty_rp); if (ri == last) break; @@ -2090,6 +2098,12 @@ unsigned long __kretprobe_trampoline_handler(struct pt_regs *regs, kretprobe_hash_unlock(current, &flags); + hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) { + hlist_del(&ri->hlist); + INIT_HLIST_NODE(&ri->hlist); + kfree_rcu(ri, rcu); + } + return (unsigned long)correct_ret_addr; } NOKPROBE_SYMBOL(__kretprobe_trampoline_handler) -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 5940/23799] drivers/iommu/iommu.c:979:31: sparse: sparse: dubious: !x | !y
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: ac084b72b429b1bc0378add3abecfe107a732b7a [5940/23799] iommu: introduce device fault report API config: arm64-randconfig-r133-20240926 (https://download.01.org/0day-ci/archive/20240929/202409290930.qkB2O1Kz-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409290930.qkB2O1Kz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290930.qkB2O1Kz-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/iommu/iommu.c:979:31: sparse: sparse: dubious: !x | !y drivers/iommu/iommu.c: In function 'iommu_unregister_device_fault_handler': drivers/iommu/iommu.c:937:13: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 937 | int ret = 0; | ^~~ vim +979 drivers/iommu/iommu.c 960 961 962 /** 963 * iommu_report_device_fault() - Report fault event to device 964 * @dev: the device 965 * @evt: fault event data 966 * 967 * Called by IOMMU model specific drivers when fault is detected, typically 968 * in a threaded IRQ handler. 969 * 970 * Return 0 on success, or an error. 971 */ 972 int iommu_report_device_fault(struct device *dev, struct iommu_fault_event *evt) 973 { 974 int ret = 0; 975 struct iommu_fault_event *evt_pending; 976 struct iommu_fault_param *fparam; 977 978 /* iommu_param is allocated when device is added to group */ > 979 if (!dev->iommu_param | !evt) 980 return -EINVAL; 981 /* we only report device fault if there is a handler registered */ 982 mutex_lock(&dev->iommu_param->lock); 983 if (!dev->iommu_param->fault_param || 984 !dev->iommu_param->fault_param->handler) { 985 ret = -EINVAL; 986 goto done_unlock; 987 } 988 fparam = dev->iommu_param->fault_param; 989 if (evt->type == IOMMU_FAULT_PAGE_REQ && evt->last_req) { 990 evt_pending = kzalloc(sizeof(*evt_pending), GFP_ATOMIC); 991 if (!evt_pending) { 992 ret = -ENOMEM; 993 goto done_unlock; 994 } 995 memcpy(evt_pending, evt, sizeof(struct iommu_fault_event)); 996 mutex_lock(&fparam->lock); 997 list_add_tail(&evt_pending->list, &fparam->faults); 998 mutex_unlock(&fparam->lock); 999 } 1000 ret = fparam->handler(evt, fparam->data); 1001 done_unlock: 1002 mutex_unlock(&dev->iommu_param->lock); 1003 return ret; 1004 } 1005 EXPORT_SYMBOL_GPL(iommu_report_device_fault); 1006 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 21562/30000] drivers/ub/urma/ubcore/ubcore_netdev.c:213:5: warning: no previous prototype for 'ubcore_unset_port_netdev'
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 37c6170f742ef3a18a3131a2a157dd7b7aa08103 [21562/30000] ub: Fix bugs in urma kernel and user lib config: arm64-randconfig-004-20240928 (https://download.01.org/0day-ci/archive/20240929/202409290901.wWQmpMUX-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240929/202409290901.wWQmpMUX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290901.wWQmpMUX-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/ubcore/ubcore_netdev.c:51:5: warning: no previous prototype for 'ubcore_check_port_state' [-Wmissing-prototypes] 51 | int ubcore_check_port_state(struct ubcore_device *dev, uint8_t port_idx) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:75:6: warning: no previous prototype for 'ubcore_find_port_netdev' [-Wmissing-prototypes] 75 | void ubcore_find_port_netdev(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:133:5: warning: no previous prototype for 'ubcore_set_port_netdev' [-Wmissing-prototypes] 133 | int ubcore_set_port_netdev(struct ubcore_device *dev, struct net_device *ndev, | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:213:5: warning: no previous prototype for 'ubcore_unset_port_netdev' [-Wmissing-prototypes] 213 | int ubcore_unset_port_netdev(struct ubcore_device *dev, struct net_device *ndev, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:242:6: warning: no previous prototype for 'ubcore_put_port_netdev' [-Wmissing-prototypes] 242 | void ubcore_put_port_netdev(struct ubcore_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:262:10: warning: no previous prototype for 'ubcore_sip_idx_alloc' [-Wmissing-prototypes] 262 | uint32_t ubcore_sip_idx_alloc(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:290:5: warning: no previous prototype for 'ubcore_sip_idx_free' [-Wmissing-prototypes] 290 | int ubcore_sip_idx_free(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:303:6: warning: no previous prototype for 'ubcore_sip_table_init' [-Wmissing-prototypes] 303 | void ubcore_sip_table_init(void) | ^~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:309:6: warning: no previous prototype for 'ubcore_sip_table_uninit' [-Wmissing-prototypes] 309 | void ubcore_sip_table_uninit(void) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:324:5: warning: no previous prototype for 'ubcore_add_sip_entry' [-Wmissing-prototypes] 324 | int ubcore_add_sip_entry(const struct ubcore_sip_info *sip, uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:344:5: warning: no previous prototype for 'ubcore_del_sip_entry' [-Wmissing-prototypes] 344 | int ubcore_del_sip_entry(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:358:5: warning: no previous prototype for 'ubcore_lookup_sip_idx' [-Wmissing-prototypes] 358 | int ubcore_lookup_sip_idx(struct ubcore_sip_info *sip, uint32_t *idx) | ^~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:379:10: warning: no previous prototype for 'ubcore_get_sip_max_cnt' [-Wmissing-prototypes] 379 | uint32_t ubcore_get_sip_max_cnt(void) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:384:25: warning: no previous prototype for 'ubcore_lookup_sip_info' [-Wmissing-prototypes] 384 | struct ubcore_sip_info *ubcore_lookup_sip_info(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:395:5: warning: no previous prototype for 'ubcore_notify_uvs_del_sip' [-Wmissing-prototypes] 395 | int ubcore_notify_uvs_del_sip(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:437:5: warning: no previous prototype for 'ubcore_notify_uvs_add_sip' [-Wmissing-prototypes] 437 | int ubcore_notify_uvs_add_sip(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ vim +/ubcore_unset_port_netdev +213 drivers/ub/urma/ubcore/ubcore_netdev.c 212 > 213 int ubcore_unset_port_netdev(struct ubcore_device *dev, struct net_device *ndev, 214 unsigned int port_id) 215 { 216 struct ubcore_ndev_port *port_info; 217 218 if (dev == NULL || ndev == NULL) { 219 ubcore_log_err("invalid input parameter.\n"); 220 return -1; 221 } 222 down_write(&g_port_list_lock); 223 list_for_each_entry(port_info, &dev->port_list, node) { 224 if (port_info->ndev == ndev) { 225 if (ubcore_del_port(port_info, (uint8_t)port_id, dev, ndev) != 0) { 226 up_write(&g_port_list_lock); 227 ubcore_log_err("Failed to do ubcore_del_port"); 228 return -1; 229 } 230 up_write(&g_port_list_lock); 231 return 0; 232 } 233 } 234 up_write(&g_port_list_lock); 235 236 ubcore_log_err("Failed to find and remove ndev:%s dev_name: %s bound port: %u\n", 237 netdev_name(ndev), dev->dev_name, port_id); 238 return -1; 239 } 240 EXPORT_SYMBOL(ubcore_unset_port_netdev); 241 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 21579/30000] net/smc/smc_core.c:770:6: sparse: sparse: symbol '__smcr_link_clear' was not declared. Should it be static?
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 7dad816cb1f8841fda526c0978c10a94793f1178 [21579/30000] anolis: net/smc: Resolve the race between SMC-R link access and clear config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240929/202409290926.Ll8zQyOY-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409290926.Ll8zQyOY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290926.Ll8zQyOY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> net/smc/smc_core.c:770:6: sparse: sparse: symbol '__smcr_link_clear' was not declared. Should it be static? vim +/__smcr_link_clear +770 net/smc/smc_core.c 769 > 770 void __smcr_link_clear(struct smc_link *lnk) 771 { 772 smc_wr_free_link_mem(lnk); 773 smc_lgr_put(lnk->lgr); /* lgr_hold in smcr_link_init() */ 774 memset(lnk, 0, sizeof(struct smc_link)); 775 lnk->state = SMC_LNK_UNUSED; 776 } 777 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 4008/23799] drivers/staging/erofs/utils.c:138:6: sparse: sparse: symbol 'erofs_try_to_release_workgroup' was not declared. Should it be static?
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: fb4c3a2751ebf142fecc61eea8c738573ec3bf10 [4008/23799] staging: erofs: fix race when the managed cache is enabled config: arm64-randconfig-r133-20240926 (https://download.01.org/0day-ci/archive/20240929/202409290639.uZftDFPU-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409290639.uZftDFPU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290639.uZftDFPU-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/staging/erofs/utils.c:138:6: sparse: sparse: symbol 'erofs_try_to_release_workgroup' was not declared. Should it be static? drivers/staging/erofs/utils.c:138:6: warning: no previous prototype for 'erofs_try_to_release_workgroup' [-Wmissing-prototypes] 138 | bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/erofs_try_to_release_workgroup +138 drivers/staging/erofs/utils.c 137 > 138 bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi, 139 struct erofs_workgroup *grp, 140 bool cleanup) 141 { 142 void *entry; 143 144 /* 145 * for managed cache enabled, the refcount of workgroups 146 * themselves could be < 0 (freezed). So there is no guarantee 147 * that all refcount > 0 if managed cache is enabled. 148 */ 149 if (!erofs_workgroup_try_to_freeze(grp, 1)) 150 return false; 151 152 /* 153 * note that all cached pages should be unlinked 154 * before delete it from the radix tree. 155 * Otherwise some cached pages of an orphan old workgroup 156 * could be still linked after the new one is available. 157 */ 158 if (erofs_try_to_free_all_cached_pages(sbi, grp)) { 159 erofs_workgroup_unfreeze(grp, 1); 160 return false; 161 } 162 163 /* 164 * it is impossible to fail after the workgroup is freezed, 165 * however in order to avoid some race conditions, add a 166 * DBG_BUGON to observe this in advance. 167 */ 168 entry = radix_tree_delete(&sbi->workstn_tree, grp->index); 169 DBG_BUGON((void *)((unsigned long)entry & 170 ~RADIX_TREE_EXCEPTIONAL_ENTRY) != grp); 171 172 /* 173 * if managed cache is enable, the last refcount 174 * should indicate the related workstation. 175 */ 176 erofs_workgroup_unfreeze_final(grp); 177 return true; 178 } 179 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 21084/30000] drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 0b68f4778af4fded021ba67f5eb3fb74ff8d7fc1 [21084/30000] net: hns3: support arp proxy config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240929/202409290547.aSbDInhQ-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409290547.aSbDInhQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290547.aSbDInhQ-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] vlan_tci @@ got unsigned short [usertype] vlan_tci @@ drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: expected restricted __be16 [usertype] vlan_tci drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: got unsigned short [usertype] vlan_tci >> drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:128:58: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned short [usertype] vlan_tci @@ got restricted __be16 [usertype] vlan_tci @@ drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:128:58: sparse: expected unsigned short [usertype] vlan_tci drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:128:58: sparse: got restricted __be16 [usertype] vlan_tci vim +79 drivers/net/ethernet/hisilicon/hns3/hns3_roh.c 56 57 int hns3_handle_roh_arp_req(struct sk_buff *skb, struct hns3_nic_priv *priv) 58 { 59 struct hnae3_handle *h = priv->ae_handle; 60 struct hns3_enet_ring *ring; 61 struct arphdr *arphdr; 62 struct ethhdr *ethhdr; 63 int reply_idx, len; 64 __be32 *sip, *tip; 65 66 /* use same queue num in rx */ 67 ring = &priv->ring[skb->queue_mapping + h->kinfo.num_tqps]; 68 reply_idx = ring->arp_reply_tail; 69 hns3_roh_arp_reply_idx_move_fd(reply_idx); 70 /* This smp_load_acquire() pairs with smp_store_release() in 71 * hns3_handle_roh_arp_reply(). 72 */ 73 if (reply_idx == smp_load_acquire(&ring->arp_reply_head)) 74 return NETDEV_TX_BUSY; 75 len = skb->len; 76 77 if (skb_vlan_tagged(skb)) { 78 ring->arp_reply[reply_idx].has_vlan = true; > 79 ring->arp_reply[reply_idx].vlan_tci = skb_vlan_tag_get(skb); 80 skb_vlan_pop(skb); 81 len += VLAN_HLEN; 82 } else { 83 ring->arp_reply[reply_idx].has_vlan = false; 84 } 85 86 ethhdr = eth_hdr(skb); 87 arphdr = arp_hdr(skb); 88 89 hns3_extract_arp_ip_field(arphdr, &sip, &tip, skb->dev->addr_len); 90 ether_addr_copy(ring->arp_reply[reply_idx].dest_hw, ethhdr->h_source); 91 ether_addr_copy(ring->arp_reply[reply_idx].src_hw, ethhdr->h_dest); 92 ring->arp_reply[reply_idx].dest_ip = *sip; 93 ring->arp_reply[reply_idx].src_ip = *tip; 94 hns3_roh_update_mac_by_ip(be32_to_cpu(*tip), 95 ring->arp_reply[reply_idx].src_hw); 96 /* This smp_store_release() pairs with smp_load_acquire() in 97 * hns3_handle_roh_arp_reply(). Ensure that the arp_reply_tail is 98 * update validly. 99 */ 100 smp_store_release(&ring->arp_reply_tail, reply_idx); 101 102 ring = &priv->ring[skb->queue_mapping]; 103 u64_stats_update_begin(&ring->syncp); 104 ring->stats.tx_pkts++; 105 ring->stats.tx_bytes += len; 106 u64_stats_update_end(&ring->syncp); 107 108 dev_kfree_skb_any(skb); 109 napi_schedule(&ring->tqp_vector->napi); 110 return NETDEV_TX_OK; 111 } 112 113 static struct sk_buff *setup_arp_reply_skb(struct hns3_arp_reply *arp_reply, 114 struct hns3_nic_priv *priv) 115 { 116 struct sk_buff *skb = arp_create(ARPOP_REPLY, ETH_P_ARP, 117 arp_reply->dest_ip, priv->netdev, 118 arp_reply->src_ip, arp_reply->dest_hw, 119 arp_reply->src_hw, arp_reply->dest_hw); 120 if (!skb) 121 return NULL; 122 123 skb_reset_mac_header(skb); 124 skb_reset_mac_len(skb); 125 126 if (arp_reply->has_vlan) { 127 skb = vlan_insert_tag_set_proto(skb, htons(ETH_P_8021Q), > 128 arp_reply->vlan_tci); 129 if (!skb) 130 return NULL; 131 skb_reset_network_header(skb); 132 } 133 134 skb_reserve(skb, skb->mac_len); 135 return skb; 136 } 137 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 21485/30000] drivers/ub/urma/ubcore/ubcore_device.c:344:6: warning: no previous prototype for 'ubcore_destroy_upi_list'
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 84e122368ec3a37e074c9657bc09422b62f6ccd0 [21485/30000] ub: add new feature for urma config: arm64-randconfig-004-20240928 (https://download.01.org/0day-ci/archive/20240929/202409290428.ZYNCVbJr-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240929/202409290428.ZYNCVbJr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290428.ZYNCVbJr-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/ubcore/ubcore_device.c:344:6: warning: no previous prototype for 'ubcore_destroy_upi_list' [-Wmissing-prototypes] 344 | void ubcore_destroy_upi_list(void) | ^~~~~~~~~~~~~~~~~~~~~~~ -- drivers/ub/urma/ubcore/ubcore_uvs_cmd.c: In function 'ubcore_uvs_cmd_channel_init': >> drivers/ub/urma/ubcore/ubcore_uvs_cmd.c:47:15: warning: 'strncpy' output truncated before terminating nul copying 10 bytes from a string of the same length [-Wstringop-truncation] 47 | (void)strncpy(arg.out.kernel_out, "Hello uvs!", strlen("Hello uvs!")); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/ub/urma/ubcore/ubcore_netdev.c:49:5: warning: no previous prototype for 'ubcore_check_port_state' [-Wmissing-prototypes] 49 | int ubcore_check_port_state(struct ubcore_device *dev, uint8_t port_idx) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:73:5: warning: no previous prototype for 'ubcore_find_port_netdev' [-Wmissing-prototypes] 73 | int ubcore_find_port_netdev(struct ubcore_device *dev, struct net_device *ndev) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:90:5: warning: no previous prototype for 'ubcore_find_port_with_dev_name' [-Wmissing-prototypes] 90 | int ubcore_find_port_with_dev_name(struct ubcore_device *dev, char *dev_name) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:113:5: warning: no previous prototype for 'ubcore_set_port_netdev' [-Wmissing-prototypes] 113 | int ubcore_set_port_netdev(struct ubcore_device *dev, struct net_device *ndev, | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:149:6: warning: no previous prototype for 'ubcore_put_port_netdev' [-Wmissing-prototypes] 149 | void ubcore_put_port_netdev(struct ubcore_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:169:10: warning: no previous prototype for 'ubcore_sip_idx_alloc' [-Wmissing-prototypes] 169 | uint32_t ubcore_sip_idx_alloc(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:197:5: warning: no previous prototype for 'ubcore_sip_idx_free' [-Wmissing-prototypes] 197 | int ubcore_sip_idx_free(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:210:6: warning: no previous prototype for 'ubcore_sip_table_init' [-Wmissing-prototypes] 210 | void ubcore_sip_table_init(void) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:216:6: warning: no previous prototype for 'ubcore_sip_table_uninit' [-Wmissing-prototypes] 216 | void ubcore_sip_table_uninit(void) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:230:5: warning: no previous prototype for 'ubcore_add_sip_entry' [-Wmissing-prototypes] 230 | int ubcore_add_sip_entry(const struct ubcore_sip_info *sip, uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:250:5: warning: no previous prototype for 'ubcore_del_sip_entry' [-Wmissing-prototypes] 250 | int ubcore_del_sip_entry(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:264:5: warning: no previous prototype for 'ubcore_lookup_sip_idx' [-Wmissing-prototypes] 264 | int ubcore_lookup_sip_idx(struct ubcore_sip_info *sip, uint32_t *idx) | ^~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:285:10: warning: no previous prototype for 'ubcore_get_sip_max_cnt' [-Wmissing-prototypes] 285 | uint32_t ubcore_get_sip_max_cnt(void) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:290:25: warning: no previous prototype for 'ubcore_lookup_sip_info' [-Wmissing-prototypes] 290 | struct ubcore_sip_info *ubcore_lookup_sip_info(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:301:5: warning: no previous prototype for 'ubcore_notify_uvs_del_sip' [-Wmissing-prototypes] 301 | int ubcore_notify_uvs_del_sip(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:343:5: warning: no previous prototype for 'ubcore_notify_uvs_add_sip' [-Wmissing-prototypes] 343 | int ubcore_notify_uvs_add_sip(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ vim +/ubcore_destroy_upi_list +344 drivers/ub/urma/ubcore/ubcore_device.c 343 > 344 void ubcore_destroy_upi_list(void) 345 { 346 struct ubcore_upi_entry *entry = NULL, *next; 347 348 mutex_lock(&g_upi_lock); 349 list_for_each_entry_safe(entry, next, &g_upi_list, node) { 350 if (entry != NULL) { 351 list_del(&entry->node); 352 kfree(entry); 353 } 354 } 355 mutex_unlock(&g_upi_lock); 356 } 357 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1487/23799] drivers/firmware/efi/libstub/arm-stub.c:72:6: sparse: sparse: symbol 'install_memreserve_table' was not declared. Should it be static?
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: 805a16040f9b52834cff060839fe25ad655f042e [1487/23799] efi/arm: libstub: add a root memreserve config table config: arm64-randconfig-r133-20240926 (https://download.01.org/0day-ci/archive/20240929/202409290414.yOuyHbaP-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409290414.yOuyHbaP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409290414.yOuyHbaP-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/firmware/efi/libstub/arm-stub.c:72:6: sparse: sparse: symbol 'install_memreserve_table' was not declared. Should it be static? drivers/firmware/efi/libstub/arm-stub.c:72:6: warning: no previous prototype for 'install_memreserve_table' [-Wmissing-prototypes] 72 | void install_memreserve_table(efi_system_table_t *sys_table_arg) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/firmware/efi/libstub/arm-stub.c:116:15: warning: no previous prototype for 'efi_entry' [-Wmissing-prototypes] 116 | unsigned long efi_entry(void *handle, efi_system_table_t *sys_table, | ^~~~~~~~~ drivers/firmware/efi/libstub/arm-stub.c: In function 'efi_entry': drivers/firmware/efi/libstub/arm-stub.c:135:29: warning: variable 'si' set but not used [-Wunused-but-set-variable] 135 | struct screen_info *si; | ^~ vim +/install_memreserve_table +72 drivers/firmware/efi/libstub/arm-stub.c 71 > 72 void install_memreserve_table(efi_system_table_t *sys_table_arg) 73 { 74 struct linux_efi_memreserve *rsv; 75 efi_guid_t memreserve_table_guid = LINUX_EFI_MEMRESERVE_TABLE_GUID; 76 efi_status_t status; 77 78 status = efi_call_early(allocate_pool, EFI_LOADER_DATA, sizeof(*rsv), 79 (void **)&rsv); 80 if (status != EFI_SUCCESS) { 81 pr_efi_err(sys_table_arg, "Failed to allocate memreserve entry!\n"); 82 return; 83 } 84 85 rsv->next = 0; 86 rsv->base = 0; 87 rsv->size = 0; 88 89 status = efi_call_early(install_configuration_table, 90 &memreserve_table_guid, 91 rsv); 92 if (status != EFI_SUCCESS) 93 pr_efi_err(sys_table_arg, "Failed to install memreserve config table!\n"); 94 } 95 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0