- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT CVE: NA Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index 118699fff2f9..27a8931647ea 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -86,8 +86,11 @@ __releases(&journal->j_state_lock) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] PCI/ROM: Fix PCI ROM header check bug
by liwei 29 Jul '24

29 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEAGS -------------------------------- In UEFI Specification Version 2.8, describes that the PCIR data structure must start on a 4-byte boundary. Add checks to prevent vulnerabilities. Fixes: d7ad2254fa7c ("[IA64] SN: Correct ROM resource length for BIOS copy") Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/rom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c index 137bf0cee897..d7bae7a804c4 100644 --- a/drivers/pci/rom.c +++ b/drivers/pci/rom.c @@ -98,6 +98,12 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, } /* get the PCI data structure and check its "PCIR" signature */ pds = image + readw(image + 24); + /* The PCIR data structure must begin on a 4-byte boundary */ + if (!IS_ALIGNED((unsigned long)pds, 4)) { + pci_info(pdev, "Invalid PCI ROM header signature: PCIR %#06x\n", + readw(image + 24)); + break; + } if (readl(pds) != 0x52494350) { pci_info(pdev, "Invalid PCI ROM data signature: expecting 0x52494350, got %#010x\n", readl(pds)); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT CVE: NA Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index b7e1a2bdd7fb..727f3505280c 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -98,8 +98,11 @@ __releases(&journal->j_state_lock) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* -- 2.31.1

2 1

[PATCH OLK-5.10] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT CVE: NA Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index b7e1a2bdd7fb..727f3505280c 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -98,8 +98,11 @@ __releases(&journal->j_state_lock) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT CVE: NA Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index b35f0b63baf0..ab6c0b9c5336 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -96,8 +96,11 @@ void __jbd2_log_wait_for_space(journal_t *journal) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] fix CVE-2024-40976
by Jinjiang Tu 29 Jul '24

29 Jul '24

fix CVE-2024-40976. Erico Nunes (2): drm/lima: add mask irq callback to gp and pp drm/lima: mask irqs in timeout path before hard reset drivers/gpu/drm/lima/lima_bcast.c | 12 ++++++++++++ drivers/gpu/drm/lima/lima_bcast.h | 3 +++ drivers/gpu/drm/lima/lima_gp.c | 8 ++++++++ drivers/gpu/drm/lima/lima_pp.c | 18 ++++++++++++++++++ drivers/gpu/drm/lima/lima_sched.c | 7 +++++++ drivers/gpu/drm/lima/lima_sched.h | 1 + 6 files changed, 49 insertions(+) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] fix CVE-2024-40976
by Jinjiang Tu 29 Jul '24

29 Jul '24

fix CVE-2024-40976. Erico Nunes (2): drm/lima: add mask irq callback to gp and pp drm/lima: mask irqs in timeout path before hard reset drivers/gpu/drm/lima/lima_bcast.c | 12 ++++++++++++ drivers/gpu/drm/lima/lima_bcast.h | 3 +++ drivers/gpu/drm/lima/lima_gp.c | 8 ++++++++ drivers/gpu/drm/lima/lima_pp.c | 18 ++++++++++++++++++ drivers/gpu/drm/lima/lima_sched.c | 7 +++++++ drivers/gpu/drm/lima/lima_sched.h | 1 + 6 files changed, 49 insertions(+) -- 2.25.1

2 3

[PATCH OLK-6.6 0/2] bpf: Fix null-pointer-deref in resolve_prog_type()
by Tengda Wu 29 Jul '24

29 Jul '24

This patchset is going to fix null-pointer-deref in resolve_prog_type() for BPF_PROG_TYPE_EXT. `prog->aux->dst_prog` in resolve_prog_type() is assigned by `attach_prog_fd`, and would be NULL if `attach_prog_fd` is not provided. Loading EXT prog with bpf_dynptr_from_skb() kfunc call in this way will lead to null-pointer-deref. In last version we fix it by forcing `attach_prog_fd` non-empty at load time, which leads to libbpf_probe_prog_types() api broken. Currently, we fix it by just adding null check for EXT prog in resolve_prog_type() as the old way did. For the sake of safety, we compared the full test logs of selftest before and after applying these changes, and the results show that the two test logs were consistent. Tengda Wu (2): bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT selftests/bpf: Test for null-pointer-deref bugfix in resolve_prog_type() include/linux/bpf_verifier.h | 2 +- tools/testing/selftests/bpf/verifier/calls.c | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] filelock: fix uaf while fcntl/close race
by Long Li 29 Jul '24

29 Jul '24

This patch set fix uaf while fcntl/close race. Jann Horn (2): filelock: Remove locks reliably when fcntl/close race is detected filelock: Fix fcntl/close race recovery compat path fs/locks.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 0/2] bpf: Fix null-pointer-deref in resolve_prog_type()
by Tengda Wu 29 Jul '24

29 Jul '24

This patchset is going to fix null-pointer-deref in resolve_prog_type() for BPF_PROG_TYPE_EXT. `prog->aux->dst_prog` in resolve_prog_type() is assigned by `attach_prog_fd`, and would be NULL if `attach_prog_fd` is not provided. Loading EXT prog with bpf_dynptr_from_skb() kfunc call in this way will lead to null-pointer-deref. In last version we fix it by forcing `attach_prog_fd` non-empty at load time, which leads to libbpf_probe_prog_types() api broken. Currently, we fix it by just adding null check for EXT prog in resolve_prog_type() as the old way did. For the sake of safety, we compared the full test logs of selftest before and after applying these changes, and the results show that the two test logs were consistent. Tengda Wu (2): bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT selftests/bpf: Test for null-pointer-deref bugfix in resolve_prog_type() include/linux/bpf_verifier.h | 2 +- tools/testing/selftests/bpf/verifier/calls.c | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] blk-wbt: don't throttle swap writes in direct reclaim
by Baokun Li 29 Jul '24

29 Jul '24

mainline inclusion from mainline-v6.11-rc1 commit 4e63aeb5d0101ddada36a2f64f048e2f9d2202fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA8D5J CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Now we avoid throttling swap writes by determining whether the current process is kswapd (aka current_is_kswapd()), but swap writes can come from either kswapd or direct reclaim, so the swap writes from direct reclaim will still be throttled. When a process holds a lock to allocate a free page, and enters direct reclaim because there is no free memory, then it might trigger a hung due to the wbt throttling that causes other processes to fail to get the lock. Both kswapd and direct reclaim set the REQ_SWAP flag, so use REQ_SWAP instead of current_is_kswapd() to avoid throttling swap writes. Also renamed WBT_KSWAPD to WBT_SWAP and WBT_RWQ_KSWAPD to WBT_RWQ_SWAP. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20240604030522.3686177-1-libaokun@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-wbt.c block/blk-wbt.h [Because commit 0bc65bd41dfd ("blk-wbt: move private information from blk-wbt.h to blk-wbt.c") has not been merged.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- block/blk-wbt.c | 14 +++++++------- block/blk-wbt.h | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/block/blk-wbt.c b/block/blk-wbt.c index 94b5eff0cd3a..16ca5e91f3aa 100644 --- a/block/blk-wbt.c +++ b/block/blk-wbt.c @@ -107,8 +107,8 @@ static bool wb_recent_wait(struct rq_wb *rwb) static inline struct rq_wait *get_rq_wait(struct rq_wb *rwb, enum wbt_flags wb_acct) { - if (wb_acct & WBT_KSWAPD) - return &rwb->rq_wait[WBT_RWQ_KSWAPD]; + if (wb_acct & WBT_SWAP) + return &rwb->rq_wait[WBT_RWQ_SWAP]; else if (wb_acct & WBT_DISCARD) return &rwb->rq_wait[WBT_RWQ_DISCARD]; @@ -461,7 +461,7 @@ static bool close_io(struct rq_wb *rwb) time_before(now, rwb->last_comp + HZ / 10); } -#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO) +#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO | REQ_SWAP) static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) { @@ -479,13 +479,13 @@ static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) /* * At this point we know it's a buffered write. If this is - * kswapd trying to free memory, or REQ_SYNC is set, then + * swap trying to free memory, or REQ_SYNC is set, then * it's WB_SYNC_ALL writeback, and we'll use the max limit for * that. If the write is marked as a background write, then use * the idle limit, or go to normal if we haven't had competing * IO for a bit. */ - if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb) || current_is_kswapd()) + if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb)) limit = rwb->rq_depth.max_depth; else if ((rw & REQ_BACKGROUND) || close_io(rwb)) { /* @@ -618,8 +618,8 @@ static enum wbt_flags bio_to_wbt_flags(struct rq_wb *rwb, struct bio *bio) if (bio_op(bio) == REQ_OP_READ) { flags = WBT_READ; } else if (wbt_should_throttle(rwb, bio)) { - if (current_is_kswapd()) - flags |= WBT_KSWAPD; + if (bio->bi_opf & REQ_SWAP) + flags |= WBT_SWAP; if (bio_op(bio) == REQ_OP_DISCARD) flags |= WBT_DISCARD; flags |= WBT_TRACKED; diff --git a/block/blk-wbt.h b/block/blk-wbt.h index 58b36e019f9e..4bfecfb16246 100644 --- a/block/blk-wbt.h +++ b/block/blk-wbt.h @@ -14,7 +14,7 @@ enum wbt_flags { WBT_TRACKED = 1, /* write, tracked for throttling */ WBT_READ = 2, /* read */ - WBT_KSWAPD = 4, /* write, from kswapd */ + WBT_SWAP = 4, /* write, from swap_writepage() */ WBT_DISCARD = 8, /* discard */ WBT_NR_BITS = 4, /* number of bits */ @@ -22,7 +22,7 @@ enum wbt_flags { enum { WBT_RWQ_BG = 0, - WBT_RWQ_KSWAPD, + WBT_RWQ_SWAP, WBT_RWQ_DISCARD, WBT_NUM_RWQ, }; -- 2.31.1

2 1

[PATCH OLK-5.10] blk-wbt: don't throttle swap writes in direct reclaim
by Baokun Li 29 Jul '24

29 Jul '24

mainline inclusion from mainline-v6.11-rc1 commit 4e63aeb5d0101ddada36a2f64f048e2f9d2202fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA8D5J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Now we avoid throttling swap writes by determining whether the current process is kswapd (aka current_is_kswapd()), but swap writes can come from either kswapd or direct reclaim, so the swap writes from direct reclaim will still be throttled. When a process holds a lock to allocate a free page, and enters direct reclaim because there is no free memory, then it might trigger a hung due to the wbt throttling that causes other processes to fail to get the lock. Both kswapd and direct reclaim set the REQ_SWAP flag, so use REQ_SWAP instead of current_is_kswapd() to avoid throttling swap writes. Also renamed WBT_KSWAPD to WBT_SWAP and WBT_RWQ_KSWAPD to WBT_RWQ_SWAP. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20240604030522.3686177-1-libaokun@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-wbt.c block/blk-wbt.h [Because commit 0bc65bd41dfd ("blk-wbt: move private information from blk-wbt.h to blk-wbt.c") has not been merged.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- block/blk-wbt.c | 14 +++++++------- block/blk-wbt.h | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/block/blk-wbt.c b/block/blk-wbt.c index 6a90d33e6f6a..fe01c63c9153 100644 --- a/block/blk-wbt.c +++ b/block/blk-wbt.c @@ -105,8 +105,8 @@ static bool wb_recent_wait(struct rq_wb *rwb) static inline struct rq_wait *get_rq_wait(struct rq_wb *rwb, enum wbt_flags wb_acct) { - if (wb_acct & WBT_KSWAPD) - return &rwb->rq_wait[WBT_RWQ_KSWAPD]; + if (wb_acct & WBT_SWAP) + return &rwb->rq_wait[WBT_RWQ_SWAP]; else if (wb_acct & WBT_DISCARD) return &rwb->rq_wait[WBT_RWQ_DISCARD]; @@ -459,7 +459,7 @@ static bool close_io(struct rq_wb *rwb) time_before(now, rwb->last_comp + HZ / 10); } -#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO) +#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO | REQ_SWAP) static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) { @@ -477,13 +477,13 @@ static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) /* * At this point we know it's a buffered write. If this is - * kswapd trying to free memory, or REQ_SYNC is set, then + * swap trying to free memory, or REQ_SYNC is set, then * it's WB_SYNC_ALL writeback, and we'll use the max limit for * that. If the write is marked as a background write, then use * the idle limit, or go to normal if we haven't had competing * IO for a bit. */ - if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb) || current_is_kswapd()) + if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb)) limit = rwb->rq_depth.max_depth; else if ((rw & REQ_BACKGROUND) || close_io(rwb)) { /* @@ -560,8 +560,8 @@ static enum wbt_flags bio_to_wbt_flags(struct rq_wb *rwb, struct bio *bio) if (bio_op(bio) == REQ_OP_READ) { flags = WBT_READ; } else if (wbt_should_throttle(rwb, bio)) { - if (current_is_kswapd()) - flags |= WBT_KSWAPD; + if (bio->bi_opf & REQ_SWAP) + flags |= WBT_SWAP; if (bio_op(bio) == REQ_OP_DISCARD) flags |= WBT_DISCARD; flags |= WBT_TRACKED; diff --git a/block/blk-wbt.h b/block/blk-wbt.h index 824047c395ff..2e3417d2676c 100644 --- a/block/blk-wbt.h +++ b/block/blk-wbt.h @@ -14,7 +14,7 @@ enum wbt_flags { WBT_TRACKED = 1, /* write, tracked for throttling */ WBT_READ = 2, /* read */ - WBT_KSWAPD = 4, /* write, from kswapd */ + WBT_SWAP = 4, /* write, from swap_writepage() */ WBT_DISCARD = 8, /* discard */ WBT_NR_BITS = 4, /* number of bits */ @@ -22,7 +22,7 @@ enum wbt_flags { enum { WBT_RWQ_BG = 0, - WBT_RWQ_KSWAPD, + WBT_RWQ_SWAP, WBT_RWQ_DISCARD, WBT_NUM_RWQ, }; -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] blk-wbt: don't throttle swap writes in direct reclaim
by Baokun Li 29 Jul '24

29 Jul '24

mainline inclusion from mainline-v6.11-rc1 commit 4e63aeb5d0101ddada36a2f64f048e2f9d2202fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA8D5J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Now we avoid throttling swap writes by determining whether the current process is kswapd (aka current_is_kswapd()), but swap writes can come from either kswapd or direct reclaim, so the swap writes from direct reclaim will still be throttled. When a process holds a lock to allocate a free page, and enters direct reclaim because there is no free memory, then it might trigger a hung due to the wbt throttling that causes other processes to fail to get the lock. Both kswapd and direct reclaim set the REQ_SWAP flag, so use REQ_SWAP instead of current_is_kswapd() to avoid throttling swap writes. Also renamed WBT_KSWAPD to WBT_SWAP and WBT_RWQ_KSWAPD to WBT_RWQ_SWAP. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20240604030522.3686177-1-libaokun@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-wbt.c block/blk-wbt.h [Because commit 0bc65bd41dfd ("blk-wbt: move private information from blk-wbt.h to blk-wbt.c") has not been merged.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- block/blk-wbt.c | 14 +++++++------- block/blk-wbt.h | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/block/blk-wbt.c b/block/blk-wbt.c index 6a90d33e6f6a..fe01c63c9153 100644 --- a/block/blk-wbt.c +++ b/block/blk-wbt.c @@ -105,8 +105,8 @@ static bool wb_recent_wait(struct rq_wb *rwb) static inline struct rq_wait *get_rq_wait(struct rq_wb *rwb, enum wbt_flags wb_acct) { - if (wb_acct & WBT_KSWAPD) - return &rwb->rq_wait[WBT_RWQ_KSWAPD]; + if (wb_acct & WBT_SWAP) + return &rwb->rq_wait[WBT_RWQ_SWAP]; else if (wb_acct & WBT_DISCARD) return &rwb->rq_wait[WBT_RWQ_DISCARD]; @@ -459,7 +459,7 @@ static bool close_io(struct rq_wb *rwb) time_before(now, rwb->last_comp + HZ / 10); } -#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO) +#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO | REQ_SWAP) static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) { @@ -477,13 +477,13 @@ static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) /* * At this point we know it's a buffered write. If this is - * kswapd trying to free memory, or REQ_SYNC is set, then + * swap trying to free memory, or REQ_SYNC is set, then * it's WB_SYNC_ALL writeback, and we'll use the max limit for * that. If the write is marked as a background write, then use * the idle limit, or go to normal if we haven't had competing * IO for a bit. */ - if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb) || current_is_kswapd()) + if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb)) limit = rwb->rq_depth.max_depth; else if ((rw & REQ_BACKGROUND) || close_io(rwb)) { /* @@ -560,8 +560,8 @@ static enum wbt_flags bio_to_wbt_flags(struct rq_wb *rwb, struct bio *bio) if (bio_op(bio) == REQ_OP_READ) { flags = WBT_READ; } else if (wbt_should_throttle(rwb, bio)) { - if (current_is_kswapd()) - flags |= WBT_KSWAPD; + if (bio->bi_opf & REQ_SWAP) + flags |= WBT_SWAP; if (bio_op(bio) == REQ_OP_DISCARD) flags |= WBT_DISCARD; flags |= WBT_TRACKED; diff --git a/block/blk-wbt.h b/block/blk-wbt.h index 824047c395ff..2e3417d2676c 100644 --- a/block/blk-wbt.h +++ b/block/blk-wbt.h @@ -14,7 +14,7 @@ enum wbt_flags { WBT_TRACKED = 1, /* write, tracked for throttling */ WBT_READ = 2, /* read */ - WBT_KSWAPD = 4, /* write, from kswapd */ + WBT_SWAP = 4, /* write, from swap_writepage() */ WBT_DISCARD = 8, /* discard */ WBT_NR_BITS = 4, /* number of bits */ @@ -22,7 +22,7 @@ enum wbt_flags { enum { WBT_RWQ_BG = 0, - WBT_RWQ_KSWAPD, + WBT_RWQ_SWAP, WBT_RWQ_DISCARD, WBT_NUM_RWQ, }; -- 2.31.1

2 1

[PATCH OLK-6.6] blk-wbt: don't throttle swap writes in direct reclaim
by Baokun Li 29 Jul '24

29 Jul '24

mainline inclusion from mainline-v6.11-rc1 commit 4e63aeb5d0101ddada36a2f64f048e2f9d2202fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA8D5J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Now we avoid throttling swap writes by determining whether the current process is kswapd (aka current_is_kswapd()), but swap writes can come from either kswapd or direct reclaim, so the swap writes from direct reclaim will still be throttled. When a process holds a lock to allocate a free page, and enters direct reclaim because there is no free memory, then it might trigger a hung due to the wbt throttling that causes other processes to fail to get the lock. Both kswapd and direct reclaim set the REQ_SWAP flag, so use REQ_SWAP instead of current_is_kswapd() to avoid throttling swap writes. Also renamed WBT_KSWAPD to WBT_SWAP and WBT_RWQ_KSWAPD to WBT_RWQ_SWAP. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20240604030522.3686177-1-libaokun@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- block/blk-wbt.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/block/blk-wbt.c b/block/blk-wbt.c index f8fda9cf583e..296cdfea7c2a 100644 --- a/block/blk-wbt.c +++ b/block/blk-wbt.c @@ -36,7 +36,7 @@ enum wbt_flags { WBT_TRACKED = 1, /* write, tracked for throttling */ WBT_READ = 2, /* read */ - WBT_KSWAPD = 4, /* write, from kswapd */ + WBT_SWAP = 4, /* write, from swap_writepage() */ WBT_DISCARD = 8, /* discard */ WBT_NR_BITS = 4, /* number of bits */ @@ -44,7 +44,7 @@ enum wbt_flags { enum { WBT_RWQ_BG = 0, - WBT_RWQ_KSWAPD, + WBT_RWQ_SWAP, WBT_RWQ_DISCARD, WBT_NUM_RWQ, }; @@ -173,8 +173,8 @@ static bool wb_recent_wait(struct rq_wb *rwb) static inline struct rq_wait *get_rq_wait(struct rq_wb *rwb, enum wbt_flags wb_acct) { - if (wb_acct & WBT_KSWAPD) - return &rwb->rq_wait[WBT_RWQ_KSWAPD]; + if (wb_acct & WBT_SWAP) + return &rwb->rq_wait[WBT_RWQ_SWAP]; else if (wb_acct & WBT_DISCARD) return &rwb->rq_wait[WBT_RWQ_DISCARD]; @@ -529,7 +529,7 @@ static bool close_io(struct rq_wb *rwb) time_before(now, rwb->last_comp + HZ / 10); } -#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO) +#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO | REQ_SWAP) static inline unsigned int get_limit(struct rq_wb *rwb, blk_opf_t opf) { @@ -540,13 +540,13 @@ static inline unsigned int get_limit(struct rq_wb *rwb, blk_opf_t opf) /* * At this point we know it's a buffered write. If this is - * kswapd trying to free memory, or REQ_SYNC is set, then + * swap trying to free memory, or REQ_SYNC is set, then * it's WB_SYNC_ALL writeback, and we'll use the max limit for * that. If the write is marked as a background write, then use * the idle limit, or go to normal if we haven't had competing * IO for a bit. */ - if ((opf & REQ_HIPRIO) || wb_recent_wait(rwb) || current_is_kswapd()) + if ((opf & REQ_HIPRIO) || wb_recent_wait(rwb)) limit = rwb->rq_depth.max_depth; else if ((opf & REQ_BACKGROUND) || close_io(rwb)) { /* @@ -623,8 +623,8 @@ static enum wbt_flags bio_to_wbt_flags(struct rq_wb *rwb, struct bio *bio) if (bio_op(bio) == REQ_OP_READ) { flags = WBT_READ; } else if (wbt_should_throttle(bio)) { - if (current_is_kswapd()) - flags |= WBT_KSWAPD; + if (bio->bi_opf & REQ_SWAP) + flags |= WBT_SWAP; if (bio_op(bio) == REQ_OP_DISCARD) flags |= WBT_DISCARD; flags |= WBT_TRACKED; -- 2.31.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-39471
by Wenyu Huang 29 Jul '24

29 Jul '24

Bob Zhou (1): drm/amdgpu: add error handle to avoid out-of-bounds Dan Carpenter (1): drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/3] fix CVE-2024-27010
by Zhengchao Shao 29 Jul '24

29 Jul '24

Fix CVE-2024-27010 Eric Dumazet (1): net/sched: Fix mirred deadlock on device recursion Johannes Berg (1): net/sched: initialize noop_qdisc owner Zhengchao Shao (1): net/sched: fix kabi change in struct Qdisc include/net/sch_generic.h | 2 +- net/core/dev.c | 6 ++++++ net/sched/sch_generic.c | 2 ++ 3 files changed, 9 insertions(+), 1 deletion(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/2] CVE-2024-39471
by Wenyu Huang 29 Jul '24

29 Jul '24

Bob Zhou (1): drm/amdgpu: add error handle to avoid out-of-bounds Dan Carpenter (1): drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) -- 2.34.1

2 6

[PATCH 0/2] filelock: fix uaf while fcntl/close race
by Long Li 29 Jul '24

29 Jul '24

This patch set fix uaf while fcntl/close race. Jann Horn (2): filelock: Remove locks reliably when fcntl/close race is detected filelock: Fix fcntl/close race recovery compat path fs/locks.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) -- 2.39.2

1 2

[PATCH openEuler-1.0-LTS] net/sched: initialize noop_qdisc owner
by Zhengchao Shao 29 Jul '24

29 Jul '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v6.10-rc4 commit 44180feaccf266d9b0b28cc4ceaac019817deb5c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG4FI Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- When the noop_qdisc owner isn't initialized, then it will be 0, so packets will erroneously be regarded as having been subject to recursion as long as only CPU 0 queues them. For non-SMP, that's all packets, of course. This causes a change in what's reported to userspace, normally noop_qdisc would drop packets silently, but with this change the syscall returns -ENOBUFS if RECVERR is also set on the socket. Fix this by initializing the owner field to -1, just like it would be for dynamically allocated qdiscs by qdisc_alloc(). Fixes: 0f022d32c3ec ("net/sched: Fix mirred deadlock on device recursion") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240607175340.786bfb938803.I493bf8422e36be4454c0… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/sch_generic.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index 18b587cf9db8..296052020afa 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -585,6 +585,7 @@ struct Qdisc noop_qdisc = { .qlen = 0, .lock = __SPIN_LOCK_UNLOCKED(noop_qdisc.skb_bad_txq.lock), }, + .owner = -1, }; EXPORT_SYMBOL(noop_qdisc); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net/sched: initialize noop_qdisc owner
by Zhengchao Shao 29 Jul '24

29 Jul '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v6.10-rc4 commit 44180feaccf266d9b0b28cc4ceaac019817deb5c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG4FI Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- When the noop_qdisc owner isn't initialized, then it will be 0, so packets will erroneously be regarded as having been subject to recursion as long as only CPU 0 queues them. For non-SMP, that's all packets, of course. This causes a change in what's reported to userspace, normally noop_qdisc would drop packets silently, but with this change the syscall returns -ENOBUFS if RECVERR is also set on the socket. Fix this by initializing the owner field to -1, just like it would be for dynamically allocated qdiscs by qdisc_alloc(). Fixes: 0f022d32c3ec ("net/sched: Fix mirred deadlock on device recursion") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240607175340.786bfb938803.I493bf8422e36be4454c0… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/sch_generic.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index ecdd9e83f2f4..fd66b13438bc 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -592,6 +592,7 @@ struct Qdisc noop_qdisc = { .qlen = 0, .lock = __SPIN_LOCK_UNLOCKED(noop_qdisc.skb_bad_txq.lock), }, + .owner = -1, }; EXPORT_SYMBOL(noop_qdisc); -- 2.34.1

2 1

[PATCH OLK-5.10] net/sched: initialize noop_qdisc owner
by Zhengchao Shao 29 Jul '24

29 Jul '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v6.10-rc4 commit 44180feaccf266d9b0b28cc4ceaac019817deb5c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG4FI Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- When the noop_qdisc owner isn't initialized, then it will be 0, so packets will erroneously be regarded as having been subject to recursion as long as only CPU 0 queues them. For non-SMP, that's all packets, of course. This causes a change in what's reported to userspace, normally noop_qdisc would drop packets silently, but with this change the syscall returns -ENOBUFS if RECVERR is also set on the socket. Fix this by initializing the owner field to -1, just like it would be for dynamically allocated qdiscs by qdisc_alloc(). Fixes: 0f022d32c3ec ("net/sched: Fix mirred deadlock on device recursion") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240607175340.786bfb938803.I493bf8422e36be4454c0… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/sch_generic.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index a3e9dd348500..ec55f306ab2a 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -592,6 +592,7 @@ struct Qdisc noop_qdisc = { .qlen = 0, .lock = __SPIN_LOCK_UNLOCKED(noop_qdisc.skb_bad_txq.lock), }, + .owner = -1, }; EXPORT_SYMBOL(noop_qdisc); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-39471
by Wenyu Huang 29 Jul '24

29 Jul '24

Bob Zhou (1): drm/amdgpu: add error handle to avoid out-of-bounds Dan Carpenter (1): drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] drm/radeon: fix UBSAN warning in kv_dpm.c
by Kaixiong Yu 29 Jul '24

29 Jul '24

From: Alex Deucher <alexander.deucher(a)amd.com> stable inclusion from stable-v4.19.317 commit 07e8f15fa16695cf4c90e89854e59af4a760055b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACR1V CVE: CVE-2024-40988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a498df5421fd737d11bfd152428ba6b1c8538321 upstream. Adds bounds check for sumo_vid_mapping_entry. Reviewed-by: Mario Limonciello <mario.limonciello(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/gpu/drm/radeon/sumo_dpm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c index 1e4975f3374c..b9eb7e2d3352 100644 --- a/drivers/gpu/drm/radeon/sumo_dpm.c +++ b/drivers/gpu/drm/radeon/sumo_dpm.c @@ -1620,6 +1620,8 @@ void sumo_construct_vid_mapping_table(struct radeon_device *rdev, for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++) { if (table[i].ulSupportedSCLK != 0) { + if (table[i].usVoltageIndex >= SUMO_MAX_NUMBER_VOLTAGES) + continue; vid_mapping_table->entries[table[i].usVoltageIndex].vid_7bit = table[i].usVoltageID; vid_mapping_table->entries[table[i].usVoltageIndex].vid_2bit = -- 2.25.1

2 1

[PATCH OLK-5.10 00/12] mm: numa-affinity: support THP migration
by Nanyong Sun 29 Jul '24

29 Jul '24

1. Backport the patch series: mm: thp: use generic THP migration for NUMA hinting fault 2. Support THP migration in numa-affinity 3. Some minor optimizations Aneesh Kumar K.V (1): mm/migrate: fix NR_ISOLATED corruption on 64-bit Nanyong Sun (3): mm: fix KABI broken in struct vm_fault mm: numa-affinity: support THP migration mm: numa-affinity: delete the duplicate numa_migrate_prep Yang Shi (7): mm: memory: add orig_pmd to struct vm_fault mm: memory: make numa_migrate_prep() non-static mm: thp: refactor NUMA fault handling mm: migrate: account THP NUMA migration counters correctly mm: migrate: don't split THP for misplaced NUMA page mm: migrate: check mapcount for THP instead of refcount mm: thp: skip make PMD PROT_NONE if THP migration is not supported Ze Zuo (1): mm: numa-affinity: backport some migrate policy from AutoNuma include/linux/huge_mm.h | 9 +- include/linux/migrate.h | 23 ----- include/linux/mm.h | 8 +- mm/huge_memory.c | 157 +++++++++++------------------- mm/internal.h | 21 +--- mm/mem_sampling.c | 89 ++++++++++++++--- mm/memory.c | 31 +++--- mm/migrate.c | 205 +++++++++------------------------------- 8 files changed, 202 insertions(+), 341 deletions(-) -- 2.25.1

3 14

[PATCH v2 OLK-5.10 00/13] mm: numa-affinity: support THP migration
by Nanyong Sun 28 Jul '24

28 Jul '24

1. Backport the patch series: mm: thp: use generic THP migration for NUMA hinting fault 2. Support THP migration in numa-affinity 3. Some minor optimizations change from v1: backport one more "bugfix" patch(the last one) to avoid CI failed. Aneesh Kumar K.V (1): mm/migrate: fix NR_ISOLATED corruption on 64-bit Huang Ying (1): mm,do_huge_pmd_numa_page: remove unnecessary TLB flushing code Nanyong Sun (3): mm: fix KABI broken in struct vm_fault mm: numa-affinity: support THP migration mm: numa-affinity: delete the duplicate numa_migrate_prep Yang Shi (7): mm: memory: add orig_pmd to struct vm_fault mm: memory: make numa_migrate_prep() non-static mm: thp: refactor NUMA fault handling mm: migrate: account THP NUMA migration counters correctly mm: migrate: don't split THP for misplaced NUMA page mm: migrate: check mapcount for THP instead of refcount mm: thp: skip make PMD PROT_NONE if THP migration is not supported Ze Zuo (1): mm: numa-affinity: backport some migrate policy from AutoNuma include/linux/huge_mm.h | 9 +- include/linux/migrate.h | 23 ----- include/linux/mm.h | 8 +- mm/huge_memory.c | 167 +++++++++----------------------- mm/internal.h | 21 +--- mm/mem_sampling.c | 89 ++++++++++++++--- mm/memory.c | 31 +++--- mm/migrate.c | 205 +++++++++------------------------------- 8 files changed, 194 insertions(+), 359 deletions(-) -- 2.25.1

2 14

[openeuler:openEuler-1.0-LTS 11557/23376] drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_gro.o: warning: objtool: missing symbol for section .text
by kernel test robot 28 Jul '24

28 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 0e54270d90f09583500ef61f20ffb02efafa8031 commit: 98cbed17790cdb1565119733aa422bab3b955d46 [11557/23376] net: hns3: place cae gro implementations in an independent file config: x86_64-buildonly-randconfig-005-20240727 (https://download.01.org/0day-ci/archive/20240728/202407281559.WpczUOhm-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240728/202407281559.WpczUOhm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407281559.WpczUOhm-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_gro.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1889/10967] kernel/sched/fair.c:151:14: sparse: sparse: symbol 'sysctl_sched_prio_load_balance_enabled' was not declared. Should it be static?
by kernel test robot 28 Jul '24

28 Jul '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b4a0c4baeb5af802ab07bb35e874446f0389901f commit: 89bf80a4d6d5ba852b9042480e0be23c2c4a628c [1889/10967] sched: Introduce priority load balance for qos scheduler config: loongarch-randconfig-r112-20240728 (https://download.01.org/0day-ci/archive/20240728/202407281041.HjAnBUAM-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240728/202407281041.HjAnBUAM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407281041.HjAnBUAM-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/fair.c:143:14: sparse: sparse: symbol 'sysctl_overload_detect_period' was not declared. Should it be static? kernel/sched/fair.c:144:14: sparse: sparse: symbol 'sysctl_offline_wait_interval' was not declared. Should it be static? >> kernel/sched/fair.c:151:14: sparse: sparse: symbol 'sysctl_sched_prio_load_balance_enabled' was not declared. Should it be static? kernel/sched/fair.c:1271:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_entity const *se @@ got struct sched_entity [noderef] __rcu * @@ kernel/sched/fair.c:1271:34: sparse: expected struct sched_entity const *se kernel/sched/fair.c:1271:34: sparse: got struct sched_entity [noderef] __rcu * kernel/sched/fair.c:12846:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12846:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12846:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:5925:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:5925:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:5925:22: sparse: struct task_struct * kernel/sched/fair.c:7998:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:7998:20: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:7998:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8310:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8310:9: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:8310:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8421:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8421:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8421:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8641:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:8641:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:8641:22: sparse: struct task_struct * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8763:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8763:13: sparse: expected void *ptr kernel/sched/fair.c:8763:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8763:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8763:13: sparse: expected void *ptr kernel/sched/fair.c:8763:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8763:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8763:13: sparse: expected void *ptr kernel/sched/fair.c:8763:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8763:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8763:13: sparse: expected void *ptr kernel/sched/fair.c:8763:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8999:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8999:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8999:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:10040:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *child @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:10040:40: sparse: expected struct sched_domain *child kernel/sched/fair.c:10040:40: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:10677:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:10677:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:10677:22: sparse: struct task_struct * kernel/sched/fair.c:12118:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12118:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12118:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:11775:44: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *sd_parent @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:11775:44: sparse: expected struct sched_domain *sd_parent kernel/sched/fair.c:11775:44: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12214:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12214:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12214:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:7214:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:7214:28: sparse: expected struct sched_domain *sd kernel/sched/fair.c:7214:28: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:7220:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:7220:28: sparse: expected struct sched_domain *sd kernel/sched/fair.c:7220:28: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:7227:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:7227:28: sparse: expected struct sched_domain *sd kernel/sched/fair.c:7227:28: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:7235:17: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:7235:17: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:7235:17: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c: note: in included file: kernel/sched/sched.h:2312:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2312:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2312:9: sparse: struct task_struct * kernel/sched/sched.h:2148:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2148:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2148:25: sparse: struct task_struct * kernel/sched/sched.h:2148:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2148:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2148:25: sparse: struct task_struct * vim +/sysctl_sched_prio_load_balance_enabled +151 kernel/sched/fair.c 149 150 #ifdef CONFIG_QOS_SCHED_PRIO_LB > 151 unsigned int sysctl_sched_prio_load_balance_enabled; 152 #endif 153 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 1e94b0d2faf96417b94f05cc073514c74aec2430
by kernel test robot 28 Jul '24

28 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 1e94b0d2faf96417b94f05cc073514c74aec2430 !10333 BMA: Fix DMA reset problem and change the version elapsed time: 731m configs tested: 35 configs skipped: 129 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240728 gcc-14.1.0 arm64 randconfig-002-20240728 clang-20 arm64 randconfig-003-20240728 gcc-14.1.0 arm64 randconfig-004-20240728 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240727 gcc-8 x86_64 buildonly-randconfig-002-20240727 gcc-13 x86_64 buildonly-randconfig-003-20240727 gcc-13 x86_64 buildonly-randconfig-004-20240727 gcc-13 x86_64 buildonly-randconfig-005-20240727 clang-18 x86_64 buildonly-randconfig-006-20240727 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240727 gcc-13 x86_64 randconfig-002-20240727 clang-18 x86_64 randconfig-003-20240727 clang-18 x86_64 randconfig-004-20240727 clang-18 x86_64 randconfig-005-20240727 gcc-13 x86_64 randconfig-006-20240727 clang-18 x86_64 randconfig-011-20240727 gcc-13 x86_64 randconfig-012-20240727 gcc-13 x86_64 randconfig-013-20240727 clang-18 x86_64 randconfig-014-20240727 gcc-10 x86_64 randconfig-015-20240727 gcc-12 x86_64 randconfig-016-20240727 gcc-10 x86_64 randconfig-071-20240727 gcc-13 x86_64 randconfig-072-20240727 gcc-13 x86_64 randconfig-073-20240727 gcc-8 x86_64 randconfig-074-20240727 gcc-8 x86_64 randconfig-075-20240727 clang-18 x86_64 randconfig-076-20240727 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 11551/23376] drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_checksum.o: warning: objtool: missing symbol for section .text
by kernel test robot 28 Jul '24

28 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 0e54270d90f09583500ef61f20ffb02efafa8031 commit: cbfc331af49be9d450cdf64943af2167aa34e17b [11551/23376] net: hns3: split checksum's kernel cmd from hns3_cae_lib.c config: x86_64-buildonly-randconfig-005-20240727 (https://download.01.org/0day-ci/archive/20240728/202407280656.dQn0SLk3-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240728/202407280656.dQn0SLk3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407280656.dQn0SLk3-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_checksum.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS b4a0c4baeb5af802ab07bb35e874446f0389901f
by kernel test robot 28 Jul '24

28 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: b4a0c4baeb5af802ab07bb35e874446f0389901f !9533 net/mlx5: Add a timeout to acquire the command queue semaphore Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- clang:warning:no-such-include-directory:drivers-infiniband-hw-hiroce3-include-mag |-- arm64-defconfig | |-- WARNING:modpost:vmlinux:section-mismatch-in-reference:arm_smmu_device_probe-(section:.text)-arm_smmu_v3_plat_info-(section:.init.data) | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-002-20240727 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-003-20240727 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-defconfig | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-001-20240727 | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-002-20240727 | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and `-- x86_64-allyesconfig `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device elapsed time: 723m configs tested: 40 configs skipped: 124 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240727 clang-20 arm64 randconfig-002-20240727 gcc-14.1.0 arm64 randconfig-003-20240727 gcc-14.1.0 arm64 randconfig-004-20240727 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch defconfig gcc-14.1.0 loongarch randconfig-001-20240727 gcc-14.1.0 loongarch randconfig-002-20240727 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240727 gcc-8 x86_64 buildonly-randconfig-002-20240727 gcc-13 x86_64 buildonly-randconfig-003-20240727 gcc-13 x86_64 buildonly-randconfig-004-20240727 gcc-13 x86_64 buildonly-randconfig-005-20240727 clang-18 x86_64 buildonly-randconfig-006-20240727 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240727 gcc-13 x86_64 randconfig-002-20240727 clang-18 x86_64 randconfig-003-20240727 clang-18 x86_64 randconfig-004-20240727 clang-18 x86_64 randconfig-005-20240727 gcc-13 x86_64 randconfig-006-20240727 clang-18 x86_64 randconfig-011-20240727 gcc-13 x86_64 randconfig-012-20240727 gcc-13 x86_64 randconfig-013-20240727 clang-18 x86_64 randconfig-014-20240727 gcc-10 x86_64 randconfig-015-20240727 gcc-12 x86_64 randconfig-016-20240727 gcc-10 x86_64 randconfig-071-20240727 gcc-13 x86_64 randconfig-072-20240727 gcc-13 x86_64 randconfig-073-20240727 gcc-8 x86_64 randconfig-074-20240727 gcc-8 x86_64 randconfig-075-20240727 clang-18 x86_64 randconfig-076-20240727 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 0e54270d90f09583500ef61f20ffb02efafa8031
by kernel test robot 28 Jul '24

28 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 0e54270d90f09583500ef61f20ffb02efafa8031 !10324 BMA: Fix iBMA bug and change Warning ids grouped by kconfigs: recent_errors |-- x86_64-buildonly-randconfig-002-20240727 | `-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-003-20240727 | `-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-004-20240727 | `-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-005-20240727 | |-- drivers-iommu-.tmp_amd_iommu_quirks.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_fd.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_hilink_param.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_irq.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_mac.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_port.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_promisc.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_qinfo.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_qos.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_qres.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_rss.o:warning:objtool:missing-symbol-for-section-.text | `-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_vlan.o:warning:objtool:missing-symbol-for-section-.text `-- x86_64-buildonly-randconfig-006-20240727 `-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized elapsed time: 590m configs tested: 35 configs skipped: 129 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240727 gcc-14.1.0 arm64 randconfig-002-20240727 gcc-14.1.0 arm64 randconfig-003-20240727 gcc-14.1.0 arm64 randconfig-004-20240727 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240727 gcc-8 x86_64 buildonly-randconfig-002-20240727 gcc-13 x86_64 buildonly-randconfig-003-20240727 gcc-13 x86_64 buildonly-randconfig-004-20240727 gcc-13 x86_64 buildonly-randconfig-005-20240727 clang-18 x86_64 buildonly-randconfig-006-20240727 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240727 gcc-13 x86_64 randconfig-002-20240727 clang-18 x86_64 randconfig-003-20240727 clang-18 x86_64 randconfig-004-20240727 clang-18 x86_64 randconfig-005-20240727 gcc-13 x86_64 randconfig-006-20240727 clang-18 x86_64 randconfig-011-20240727 gcc-13 x86_64 randconfig-012-20240727 gcc-13 x86_64 randconfig-013-20240727 clang-18 x86_64 randconfig-014-20240727 gcc-10 x86_64 randconfig-015-20240727 gcc-12 x86_64 randconfig-016-20240727 gcc-10 x86_64 randconfig-071-20240727 gcc-13 x86_64 randconfig-072-20240727 gcc-13 x86_64 randconfig-073-20240727 gcc-8 x86_64 randconfig-074-20240727 gcc-8 x86_64 randconfig-075-20240727 clang-18 x86_64 randconfig-076-20240727 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/5] fix CVE-2024-36479 for sp1
by Wupeng Ma 27 Jul '24

27 Jul '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Backport patch to fix CVE-2024-36479 for openEuler-22.03-LTS-SP1. Alexis Lothoré (1): fpga: bridge: properly initialize bridge device before populating children Marco Pagani (2): fpga: remove redundant checks for bridge ops fpga: bridge: add owner module and take its refcount Russ Weight (2): fpga: bridge: Rename dev to parent for parent device fpga: bridge: Use standard dev_release for class driver Documentation/driver-api/fpga/fpga-bridge.rst | 11 +- drivers/fpga/altera-fpga2sdram.c | 12 +- drivers/fpga/altera-freeze-bridge.c | 10 +- drivers/fpga/altera-hps2fpga.c | 12 +- drivers/fpga/dfl-fme-br.c | 10 +- drivers/fpga/fpga-bridge.c | 188 ++++++------------ drivers/fpga/xilinx-pr-decoupler.c | 13 +- include/linux/fpga/fpga-bridge.h | 34 +++- 8 files changed, 116 insertions(+), 174 deletions(-) -- 2.25.1

2 6

[PATCH OLK-5.10 0/5] fix CVE-2024-36479 for olk-5.10
by Wupeng Ma 27 Jul '24

27 Jul '24

From: Ma Wupeng <mawupeng1(a)huawei.com> backport patch to fix CVE-2024-36479. Alexis Lothoré (1): fpga: bridge: properly initialize bridge device before populating children Marco Pagani (2): fpga: remove redundant checks for bridge ops fpga: bridge: add owner module and take its refcount Russ Weight (2): fpga: bridge: Rename dev to parent for parent device fpga: bridge: Use standard dev_release for class driver Documentation/driver-api/fpga/fpga-bridge.rst | 11 +- drivers/fpga/altera-fpga2sdram.c | 12 +- drivers/fpga/altera-freeze-bridge.c | 10 +- drivers/fpga/altera-hps2fpga.c | 12 +- drivers/fpga/dfl-fme-br.c | 10 +- drivers/fpga/fpga-bridge.c | 188 ++++++------------ drivers/fpga/xilinx-pr-decoupler.c | 13 +- include/linux/fpga/fpga-bridge.h | 34 +++- 8 files changed, 116 insertions(+), 174 deletions(-) -- 2.25.1

2 6

[PATCH OLK-5.10 0/4] BMA: Fix DMA reset problem and change the version
by Li Nan 27 Jul '24

27 Jul '24

From: Wujiahai <wujiahai(a)huawei.com> 1. Resolved the problem that the DMA reset does not meet the expectation due to the mismatch between the register configuration and the communication transmission direction during DMA reset. 2. Change the iBMA driver version. Wujiahai (4): BMA/edma_drv: Fix DMA reset problem and change the version number. BMA/cdev_drv: Change the version number. BMA/veth_drv: Change the version number. BMA/kbox_drv: Change the version number. drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c | 4 ++-- drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h | 2 +- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) -- 2.27.0

2 5

[PATCH OLK-5.10 0/4] BMA: Fix DMA reset problem and change the version
by Li Nan 27 Jul '24

27 Jul '24

From: Wujiahai <wujiahai(a)huawei.com> 1. Resolved the problem that the DMA reset does not meet the expectation due to the mismatch between the register configuration and the communication transmission direction during DMA reset. 2. Change the iBMA driver version. Wujiahai (4): BMA/edma_drv: Fix DMA reset problem and change the version number. BMA/cdev_drv: Change the version number. BMA/veth_drv: Change the version number. BMA/kbox_drv: Change the version number. drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c | 4 ++-- drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h | 2 +- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) -- 2.27.0

2 5

[PATCH OLK-6.6] drm/amdgpu: add error handle to avoid out-of-bounds
by Wenyu Huang 27 Jul '24

27 Jul '24

From: Bob Zhou <bob.zhou(a)amd.com> stable inclusion from stable-v6.6.34 commit 5b0a3dc3e87821acb80e841b464d335aff242691 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8AED CVE: CVE-2024-39471 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8b2faf1a4f3b6c748c0da36cda865a226534d520 upstream. if the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should be stop to avoid out-of-bounds read, so directly return -EINVAL. Signed-off-by: Bob Zhou <bob.zhou(a)amd.com> Acked-by: Christian König <christian.koenig(a)amd.com> Reviewed-by: Le Ma <le.ma(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c index cd37f45e01a11..31d82b68053ec 100644 --- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c @@ -2031,6 +2031,9 @@ static int sdma_v4_0_process_trap_irq(struct amdgpu_device *adev, DRM_DEBUG("IH: SDMA trap\n"); instance = sdma_v4_0_irq_id_to_seq(entry->client_id); + if (instance < 0) + return instance; + switch (entry->ring_id) { case 0: amdgpu_fence_process(&adev->sdma.instance[instance].ring); -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 11543/23370] drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_qres.o: warning: objtool: missing symbol for section .text
by kernel test robot 27 Jul '24

27 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 365ea86d72567c1550e42ecf0e3f4521da9a5570 commit: ed046b8a9bc5f5836ece3a3efa29c54f0fc904e7 [11543/23370] net: hns3: rename hns3_cae's files and remove send_cmdq config: x86_64-buildonly-randconfig-005-20240727 (https://download.01.org/0day-ci/archive/20240727/202407271613.wxmYLLXu-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240727/202407271613.wxmYLLXu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407271613.wxmYLLXu-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:6:5: warning: no previous prototype for function 'hns3_get_qres_rx_value' [-Wmissing-prototypes] 6 | int hns3_get_qres_rx_value(struct hns3_nic_priv *net_priv, int ring_id, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:6:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6 | int hns3_get_qres_rx_value(struct hns3_nic_priv *net_priv, int ring_id, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:54:5: warning: no previous prototype for function 'hns3_get_qres_tx_value' [-Wmissing-prototypes] 54 | int hns3_get_qres_tx_value(struct hns3_nic_priv *net_priv, int ring_id, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:54:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 54 | int hns3_get_qres_tx_value(struct hns3_nic_priv *net_priv, int ring_id, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:100:6: warning: no previous prototype for function 'fill_queue_info' [-Wmissing-prototypes] 100 | void fill_queue_info(struct hns3_nic_priv *net_priv, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:100:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 100 | void fill_queue_info(struct hns3_nic_priv *net_priv, | ^ | static 3 warnings generated. >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_qres.o: warning: objtool: missing symbol for section .text -- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:19:6: warning: no previous prototype for function 'fill_port_info' [-Wmissing-prototypes] 19 | void fill_port_info(struct hclge_port_info *get_port_info_out, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:19:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 19 | void fill_port_info(struct hclge_port_info *get_port_info_out, | ^ | static 1 warning generated. >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_port.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_hilink_param.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_irq.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_qinfo.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_rss.o: warning: objtool: missing symbol for section .text -- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:20:5: warning: no previous prototype for function 'hclge_test_send_generic_cmd' [-Wmissing-prototypes] 20 | int hclge_test_send_generic_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:20:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 20 | int hclge_test_send_generic_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:62:5: warning: no previous prototype for function 'hclge_test_send_allocate_cmd' [-Wmissing-prototypes] 62 | int hclge_test_send_allocate_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:62:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 62 | int hclge_test_send_allocate_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:100:5: warning: no previous prototype for function 'hclge_test_send_key_cfg_cmd' [-Wmissing-prototypes] 100 | int hclge_test_send_key_cfg_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:100:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 100 | int hclge_test_send_key_cfg_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:153:5: warning: no previous prototype for function 'hclge_test_send_tcam_op_cmd' [-Wmissing-prototypes] 153 | int hclge_test_send_tcam_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:153:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 153 | int hclge_test_send_tcam_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:224:5: warning: no previous prototype for function 'hclge_test_send_ad_op_cmd' [-Wmissing-prototypes] 224 | int hclge_test_send_ad_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:224:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 224 | int hclge_test_send_ad_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:267:5: warning: no previous prototype for function 'hclge_test_send_cnt_op_cmd' [-Wmissing-prototypes] 267 | int hclge_test_send_cnt_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:267:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 267 | int hclge_test_send_cnt_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static 6 warnings generated. >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_fd.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_mac.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_vlan.o: warning: objtool: missing symbol for section .text -- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:9:19: warning: no previous prototype for function 'get_val_hdev' [-Wmissing-prototypes] 9 | struct hclge_dev *get_val_hdev(struct hns3_nic_priv *net_priv) | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:9:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 9 | struct hclge_dev *get_val_hdev(struct hns3_nic_priv *net_priv) | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:19:5: warning: no previous prototype for function 'hns3_cmd_rx_priv_wl_config' [-Wmissing-prototypes] 19 | int hns3_cmd_rx_priv_wl_config(struct hclge_dev *hdev, u16 tc, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:19:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 19 | int hns3_cmd_rx_priv_wl_config(struct hclge_dev *hdev, u16 tc, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:89:5: warning: no previous prototype for function 'hns3_cmd_common_thrd_config' [-Wmissing-prototypes] 89 | int hns3_cmd_common_thrd_config(struct hclge_dev *hdev, u16 tc, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:89:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 89 | int hns3_cmd_common_thrd_config(struct hclge_dev *hdev, u16 tc, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:161:5: warning: no previous prototype for function 'hns3_cmd_common_wl_config' [-Wmissing-prototypes] 161 | int hns3_cmd_common_wl_config(struct hclge_dev *hdev, u32 high, u32 low, u32 en) | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:161:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 161 | int hns3_cmd_common_wl_config(struct hclge_dev *hdev, u32 high, u32 low, u32 en) | ^ | static 4 warnings generated. >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_qos.o: warning: objtool: missing symbol for section .text -- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:6:5: warning: no previous prototype for function 'hns3_read_promisc_mode_cfg' [-Wmissing-prototypes] 6 | int hns3_read_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:6:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6 | int hns3_read_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:44:5: warning: no previous prototype for function 'hns3_set_promisc_mode_cfg' [-Wmissing-prototypes] 44 | int hns3_set_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:44:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 44 | int hns3_set_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^ | static 2 warnings generated. >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_promisc.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] drm/amdgpu: add error handle to avoid out-of-bounds
by Wenyu Huang 27 Jul '24

27 Jul '24

From: Bob Zhou <bob.zhou(a)amd.com> stable inclusion from stable-v5.10.220 commit 8112fa72b7f139052843ff484130d6f97e9f052f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8AED CVE: CVE-2024-39471 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 8b2faf1a4f3b6c748c0da36cda865a226534d520 upstream. if the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should be stop to avoid out-of-bounds read, so directly return -EINVAL. Signed-off-by: Bob Zhou <bob.zhou(a)amd.com> Acked-by: Christian König <christian.koenig(a)amd.com> Reviewed-by: Le Ma <le.ma(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c index dbcaef3f35da9..c54834ed8751e 100644 --- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c @@ -2073,6 +2073,9 @@ static int sdma_v4_0_process_trap_irq(struct amdgpu_device *adev, DRM_DEBUG("IH: SDMA trap\n"); instance = sdma_v4_0_irq_id_to_seq(entry->client_id); + if (instance < 0) + return instance; + switch (entry->ring_id) { case 0: amdgpu_fence_process(&adev->sdma.instance[instance].ring); -- 2.34.1

2 1

[PATCH OLK-6.6] mm/page_table_check: fix crash on ZONE_DEVICE
by Wupeng Ma 27 Jul '24

27 Jul '24

From: Peter Xu <peterx(a)redhat.com> stable inclusion from stable-v6.6.36 commit 84d3549d54f5ff9fa3281257be3019386f51d1a0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACSUZ CVE: CVE-2024-40948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8bb592c2eca8fd2bc06db7d80b38da18da4a2f43 upstream. Not all pages may apply to pgtable check. One example is ZONE_DEVICE pages: they map PFNs directly, and they don't allocate page_ext at all even if there's struct page around. One may reference devm_memremap_pages(). When both ZONE_DEVICE and page-table-check enabled, then try to map some dax memories, one can trigger kernel bug constantly now when the kernel was trying to inject some pfn maps on the dax device: kernel BUG at mm/page_table_check.c:55! While it's pretty legal to use set_pxx_at() for ZONE_DEVICE pages for page fault resolutions, skip all the checks if page_ext doesn't even exist in pgtable checker, which applies to ZONE_DEVICE but maybe more. Link: https://lkml.kernel.org/r/20240605212146.994486-1-peterx@redhat.com Fixes: df4e817b7108 ("mm: page table check") Signed-off-by: Peter Xu <peterx(a)redhat.com> Reviewed-by: Pasha Tatashin <pasha.tatashin(a)soleen.com> Reviewed-by: Dan Williams <dan.j.williams(a)intel.com> Reviewed-by: Alistair Popple <apopple(a)nvidia.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- mm/page_table_check.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/mm/page_table_check.c b/mm/page_table_check.c index af69c3c8f7c2..6363f93a47c6 100644 --- a/mm/page_table_check.c +++ b/mm/page_table_check.c @@ -71,6 +71,9 @@ static void page_table_check_clear(unsigned long pfn, unsigned long pgcnt) page = pfn_to_page(pfn); page_ext = page_ext_get(page); + if (!page_ext) + return; + BUG_ON(PageSlab(page)); anon = PageAnon(page); @@ -108,6 +111,9 @@ static void page_table_check_set(unsigned long pfn, unsigned long pgcnt, page = pfn_to_page(pfn); page_ext = page_ext_get(page); + if (!page_ext) + return; + BUG_ON(PageSlab(page)); anon = PageAnon(page); @@ -138,7 +144,10 @@ void __page_table_check_zero(struct page *page, unsigned int order) BUG_ON(PageSlab(page)); page_ext = page_ext_get(page); - BUG_ON(!page_ext); + + if (!page_ext) + return; + for (i = 0; i < (1ul << order); i++) { struct page_table_check *ptc = get_page_table_check(page_ext); -- 2.25.1

2 1

[PATCH OLK-5.10] net/smc: enable smcrv1 when RNIC supports rocev2
by Zhengchao Shao 27 Jul '24

27 Jul '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAFYD8 ----------------------------------------- When the RNIC supports rocev2, smcrv1 can also be used to send and receive packets. Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/smc/smc_ib.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c index 2e0d7aeefc41..3e45bcc51cb4 100644 --- a/net/smc/smc_ib.c +++ b/net/smc/smc_ib.c @@ -201,8 +201,7 @@ int smc_ib_determine_gid(struct smc_ib_device *smcibdev, u8 ibport, if (!IS_ERR(ndev) && ((!vlan_id && !is_vlan_dev(ndev)) || (vlan_id && is_vlan_dev(ndev) && - vlan_dev_vlan_id(ndev) == vlan_id)) && - attr->gid_type == IB_GID_TYPE_ROCE) { + vlan_dev_vlan_id(ndev) == vlan_id))) { rcu_read_unlock(); if (gid) memcpy(gid, &attr->gid, SMC_GID_SIZE); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] NFC: port100: fix use-after-free in port100_send_complete
by Wupeng Ma 27 Jul '24

27 Jul '24

From: Pavel Skripkin <paskripkin(a)gmail.com> stable inclusion from stable-v4.19.235 commit b1db33d4e54bc35d8db96ce143ea0ef92e23d58e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S9P CVE: CVE-2022-48857 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f80cfe2f26581f188429c12bd937eb905ad3ac7b ] Syzbot reported UAF in port100_send_complete(). The root case is in missing usb_kill_urb() calls on error handling path of ->probe function. port100_send_complete() accesses devm allocated memory which will be freed on probe failure. We should kill this urbs before returning an error from probe function to prevent reported use-after-free Fail log: BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26 ... Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670 ... Allocated by task 1255: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524 alloc_dr drivers/base/devres.c:116 [inline] devm_kmalloc+0x96/0x1d0 drivers/base/devres.c:823 devm_kzalloc include/linux/device.h:209 [inline] port100_probe+0x8a/0x1320 drivers/nfc/port100.c:1502 Freed by task 1255: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0xff/0x140 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:236 [inline] __cache_free mm/slab.c:3437 [inline] kfree+0xf8/0x2b0 mm/slab.c:3794 release_nodes+0x112/0x1a0 drivers/base/devres.c:501 devres_release_all+0x114/0x190 drivers/base/devres.c:530 really_probe+0x626/0xcc0 drivers/base/dd.c:670 Reported-and-tested-by: syzbot+16bcb127fb73baeecb14(a)syzkaller.appspotmail.com Fixes: 0347a6ab300a ("NFC: port100: Commands mechanism implementation") Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> Link: https://lore.kernel.org/r/20220308185007.6987-1-paskripkin@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/nfc/port100.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c index 60ae382f50da..08da712ad45f 100644 --- a/drivers/nfc/port100.c +++ b/drivers/nfc/port100.c @@ -1618,7 +1618,9 @@ static int port100_probe(struct usb_interface *interface, nfc_digital_free_device(dev->nfc_digital_dev); error: + usb_kill_urb(dev->in_urb); usb_free_urb(dev->in_urb); + usb_kill_urb(dev->out_urb); usb_free_urb(dev->out_urb); usb_put_dev(dev->udev); -- 2.25.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS 2b2a7e656e24161c2ed8fbec4744b6f231431b7f
by kernel test robot 27 Jul '24

27 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2b2a7e656e24161c2ed8fbec4744b6f231431b7f !10316 sched: Add cfs_preferred_nid_init hook elapsed time: 731m configs tested: 35 configs skipped: 138 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240727 clang-20 arm64 randconfig-002-20240727 gcc-14.1.0 arm64 randconfig-003-20240727 gcc-14.1.0 arm64 randconfig-004-20240727 clang-20 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240727 gcc-8 x86_64 buildonly-randconfig-002-20240727 gcc-13 x86_64 buildonly-randconfig-003-20240727 gcc-13 x86_64 buildonly-randconfig-004-20240727 gcc-13 x86_64 buildonly-randconfig-005-20240727 clang-18 x86_64 buildonly-randconfig-006-20240727 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240727 gcc-13 x86_64 randconfig-002-20240727 clang-18 x86_64 randconfig-003-20240727 clang-18 x86_64 randconfig-004-20240727 clang-18 x86_64 randconfig-005-20240727 gcc-13 x86_64 randconfig-006-20240727 clang-18 x86_64 randconfig-011-20240727 gcc-13 x86_64 randconfig-012-20240727 gcc-13 x86_64 randconfig-013-20240727 clang-18 x86_64 randconfig-014-20240727 gcc-10 x86_64 randconfig-015-20240727 gcc-12 x86_64 randconfig-016-20240727 gcc-10 x86_64 randconfig-071-20240727 gcc-13 x86_64 randconfig-072-20240727 gcc-13 x86_64 randconfig-073-20240727 gcc-8 x86_64 randconfig-074-20240727 gcc-8 x86_64 randconfig-075-20240727 clang-18 x86_64 randconfig-076-20240727 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS 06bfbb032512dd58dfe4598cca653d0021fea49a
by kernel test robot 27 Jul '24

27 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 06bfbb032512dd58dfe4598cca653d0021fea49a !9892 support for SMC-D loopback_lo feature Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- clang:warning:no-such-include-directory:drivers-infiniband-hw-hiroce3-include-mag |-- arm64-defconfig | |-- WARNING:modpost:vmlinux:section-mismatch-in-reference:arm_smmu_device_probe-(section:.text)-arm_smmu_v3_plat_info-(section:.init.data) | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-002-20240727 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-003-20240727 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-defconfig | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-001-20240727 | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-002-20240727 | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and `-- x86_64-allyesconfig `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device elapsed time: 726m configs tested: 31 configs skipped: 134 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240727 clang-20 arm64 randconfig-002-20240727 gcc-14.1.0 arm64 randconfig-003-20240727 gcc-14.1.0 arm64 randconfig-004-20240727 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch defconfig gcc-14.1.0 loongarch randconfig-001-20240727 gcc-14.1.0 loongarch randconfig-002-20240727 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240727 gcc-8 x86_64 buildonly-randconfig-002-20240727 gcc-13 x86_64 buildonly-randconfig-003-20240727 gcc-13 x86_64 buildonly-randconfig-004-20240727 gcc-13 x86_64 buildonly-randconfig-005-20240727 clang-18 x86_64 buildonly-randconfig-006-20240727 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240727 gcc-13 x86_64 randconfig-002-20240727 clang-18 x86_64 randconfig-003-20240727 clang-18 x86_64 randconfig-004-20240727 clang-18 x86_64 randconfig-005-20240727 gcc-13 x86_64 randconfig-006-20240727 clang-18 x86_64 randconfig-011-20240727 gcc-13 x86_64 randconfig-012-20240727 gcc-13 x86_64 randconfig-013-20240727 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 9458/23370] drivers/iommu/.tmp_amd_iommu_quirks.o: warning: objtool: missing symbol for section .text
by kernel test robot 27 Jul '24

27 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 365ea86d72567c1550e42ecf0e3f4521da9a5570 commit: fe2ee4839a7421367da12f5610e1b45c619fcbad [9458/23370] iommu/amd: Override wrong IVRS IOAPIC on Raven Ridge systems config: x86_64-buildonly-randconfig-005-20240727 (https://download.01.org/0day-ci/archive/20240727/202407271424.5G6KyQ0z-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240727/202407271424.5G6KyQ0z-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407271424.5G6KyQ0z-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/iommu/.tmp_amd_iommu_quirks.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] kobject: Fix global-out-of-bounds in kobject_action_type()
by Xia Fukun 27 Jul '24

27 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9REGZ CVE: NA -------------------------------- The following c language code can trigger KASAN's global variable out-of-bounds access error in kobject_action_type(): int main() { int fd; char *filename = "/sys/block/ram12/uevent"; char str[86] = "offline"; int len = 86; fd = open(filename, O_WRONLY); if (fd == -1) { printf("open"); exit(1); } if (write(fd, str, len) == -1) { printf("write"); exit(1); } close(fd); return 0; } Function kobject_action_type() receives the input parameters buf and count, where count is the length of the string buf. In the use case we provided, count is 86, the count_first is 85. Buf points to a string with a length of 86, and its first seven characters are "offline". In line 87 of the code, kobject_actions[action] is the string "offline" with the length of 7,an out-of-boundary access will appear: kobject_actions[action][85]. Modify the judgment logic in line 87. If the length of the string kobject_actions[action] is greater than count_first(e.g. buf is "off", count is 3), continue the loop. Otherwise, the match is considered successful. This change means that our test case will be successfully parsed as an offline event and no out-of-bounds access error will occur. Fixes: f36776fafbaa ("kobject: support passing in variables for synthetic uevents") Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- lib/kobject_uevent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c index 26d21339bef27..b5fc7b9ce197a 100644 --- a/lib/kobject_uevent.c +++ b/lib/kobject_uevent.c @@ -84,7 +84,7 @@ static int kobject_action_type(const char *buf, size_t count, for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) { if (strncmp(kobject_actions[action], buf, count_first) != 0) continue; - if (kobject_actions[action][count_first] != '\0') + if (strlen(kobject_actions[action]) > count_first) continue; if (args) *args = args_start; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/5] BMA: Fix iBMA bug and change
by Wang Hai 27 Jul '24

27 Jul '24

From: Wujiahai <wujiahai(a)huawei.com> 1. a low probability that iBMA cdev_veth driver causes softlockup problem 2. a low probability that iBMA veth driver causes soft interrupt loops 3. Change the iBMA driver version. 4. Resolved the problem that the DMA reset does not meet the expectation due to the mismatch between the register configuration and the communication transmission direction during DMA reset. Wujiahai (5): BMA/edma_drv: Fix DMA reset problem and change the version number. BMA/cdev_drv: Change the version number. BMA/veth_drv: Fix soft interrupt loops and change the version number BMA/kbox_drv: Change the version number. BMA/cdev_veth_drv: Fix softlockup problem .../net/ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- .../bma/cdev_veth_drv/virtual_cdev_eth_net.c | 14 ++++++++------ drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- .../net/ethernet/huawei/bma/edma_drv/edma_host.c | 4 ++-- .../ethernet/huawei/bma/kbox_drv/kbox_include.h | 2 +- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c | 12 +++++++++++- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 7 files changed, 25 insertions(+), 13 deletions(-) -- 2.27.0

2 6

[PATCH OLK-6.6] media: i2c: et8ek8: Don't strip remove function when driver is builtin
by Wupeng Ma 26 Jul '24

26 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v6.6.33 commit c1a3803e5bb91c13e9ad582003e4288f67f06cd9 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA74DQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 545b215736c5c4b354e182d99c578a472ac9bfce ] Using __exit for the remove function results in the remove callback being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text) Fixes: c5254e72b8ed ("[media] media: Driver for Toshiba et8ek8 5MP sensor") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/i2c/et8ek8/et8ek8_driver.c b/drivers/media/i2c/et8ek8/et8ek8_driver.c index d6fc843f9368..0d6f0f8506f7 100644 --- a/drivers/media/i2c/et8ek8/et8ek8_driver.c +++ b/drivers/media/i2c/et8ek8/et8ek8_driver.c @@ -1460,7 +1460,7 @@ static int et8ek8_probe(struct i2c_client *client) return ret; } -static void __exit et8ek8_remove(struct i2c_client *client) +static void et8ek8_remove(struct i2c_client *client) { struct v4l2_subdev *subdev = i2c_get_clientdata(client); struct et8ek8_sensor *sensor = to_et8ek8_sensor(subdev); @@ -1502,7 +1502,7 @@ static struct i2c_driver et8ek8_i2c_driver = { .of_match_table = et8ek8_of_table, }, .probe = et8ek8_probe, - .remove = __exit_p(et8ek8_remove), + .remove = et8ek8_remove, .id_table = et8ek8_id_table, }; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] media: i2c: et8ek8: Don't strip remove function when driver is builtin
by Wupeng Ma 26 Jul '24

26 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v6.6.33 commit c1a3803e5bb91c13e9ad582003e4288f67f06cd9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S9P CVE: CVE-2024-38611 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 545b215736c5c4b354e182d99c578a472ac9bfce ] Using __exit for the remove function results in the remove callback being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text) Fixes: c5254e72b8ed ("[media] media: Driver for Toshiba et8ek8 5MP sensor") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/media/i2c/et8ek8/et8ek8_driver.c [Ma Wupeng: return val of et8ek8_remove lead to conflict] Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/i2c/et8ek8/et8ek8_driver.c b/drivers/media/i2c/et8ek8/et8ek8_driver.c index 256acf73d5ea..4d7c4eac5e20 100644 --- a/drivers/media/i2c/et8ek8/et8ek8_driver.c +++ b/drivers/media/i2c/et8ek8/et8ek8_driver.c @@ -1460,7 +1460,7 @@ static int et8ek8_probe(struct i2c_client *client) return ret; } -static int __exit et8ek8_remove(struct i2c_client *client) +static int et8ek8_remove(struct i2c_client *client) { struct v4l2_subdev *subdev = i2c_get_clientdata(client); struct et8ek8_sensor *sensor = to_et8ek8_sensor(subdev); @@ -1504,7 +1504,7 @@ static struct i2c_driver et8ek8_i2c_driver = { .of_match_table = et8ek8_of_table, }, .probe_new = et8ek8_probe, - .remove = __exit_p(et8ek8_remove), + .remove = et8ek8_remove, .id_table = et8ek8_id_table, }; -- 2.25.1

2 1

[PATCH OLK-5.10] media: i2c: et8ek8: Don't strip remove function when driver is builtin
by Wupeng Ma 26 Jul '24

26 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v6.6.33 commit c1a3803e5bb91c13e9ad582003e4288f67f06cd9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S9P CVE: CVE-2024-38611 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 545b215736c5c4b354e182d99c578a472ac9bfce ] Using __exit for the remove function results in the remove callback being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text) Fixes: c5254e72b8ed ("[media] media: Driver for Toshiba et8ek8 5MP sensor") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/media/i2c/et8ek8/et8ek8_driver.c [Ma Wupeng: return val of et8ek8_remove lead to conflict] Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/i2c/et8ek8/et8ek8_driver.c b/drivers/media/i2c/et8ek8/et8ek8_driver.c index 256acf73d5ea..4d7c4eac5e20 100644 --- a/drivers/media/i2c/et8ek8/et8ek8_driver.c +++ b/drivers/media/i2c/et8ek8/et8ek8_driver.c @@ -1460,7 +1460,7 @@ static int et8ek8_probe(struct i2c_client *client) return ret; } -static int __exit et8ek8_remove(struct i2c_client *client) +static int et8ek8_remove(struct i2c_client *client) { struct v4l2_subdev *subdev = i2c_get_clientdata(client); struct et8ek8_sensor *sensor = to_et8ek8_sensor(subdev); @@ -1504,7 +1504,7 @@ static struct i2c_driver et8ek8_i2c_driver = { .of_match_table = et8ek8_of_table, }, .probe_new = et8ek8_probe, - .remove = __exit_p(et8ek8_remove), + .remove = et8ek8_remove, .id_table = et8ek8_id_table, }; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] thermal: Fix NULL pointer dereferences in of_thermal_ functions
by Liu Mingrui 26 Jul '24

26 Jul '24

From: Subbaraman Narayanamurthy <quic_subbaram(a)quicinc.com> stable inclusion from stable-v5.10.81 commit 6a315471cb6a07f651e1d3adc8962730f4fcccac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNF5 CVE: CVE-2021-47202 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 96cfe05051fd8543cdedd6807ec59a0e6c409195 upstream. of_parse_thermal_zones() parses the thermal-zones node and registers a thermal_zone device for each subnode. However, if a thermal zone is consuming a thermal sensor and that thermal sensor device hasn't probed yet, an attempt to set trip_point_*_temp for that thermal zone device can cause a NULL pointer dereference. Fix it. console:/sys/class/thermal/thermal_zone87 # echo 120000 > trip_point_0_temp ... Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ... Call trace: of_thermal_set_trip_temp+0x40/0xc4 trip_point_temp_store+0xc0/0x1dc dev_attr_store+0x38/0x88 sysfs_kf_write+0x64/0xc0 kernfs_fop_write_iter+0x108/0x1d0 vfs_write+0x2f4/0x368 ksys_write+0x7c/0xec __arm64_sys_write+0x20/0x30 el0_svc_common.llvm.7279915941325364641+0xbc/0x1bc do_el0_svc+0x28/0xa0 el0_svc+0x14/0x24 el0_sync_handler+0x88/0xec el0_sync+0x1c0/0x200 While at it, fix the possible NULL pointer dereference in other functions as well: of_thermal_get_temp(), of_thermal_set_emul_temp(), of_thermal_get_trend(). Suggested-by: David Collins <quic_collinsd(a)quicinc.com> Signed-off-by: Subbaraman Narayanamurthy <quic_subbaram(a)quicinc.com> Acked-by: Daniel Lezcano <daniel.lezcano(a)linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/thermal/of-thermal.c Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/thermal/of-thermal.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c index 4f2816559205..856dce4d72e2 100644 --- a/drivers/thermal/of-thermal.c +++ b/drivers/thermal/of-thermal.c @@ -77,7 +77,7 @@ static int of_thermal_get_temp(struct thermal_zone_device *tz, { struct __thermal_zone *data = tz->devdata; - if (!data->ops->get_temp) + if (!data->ops || !data->ops->get_temp) return -EINVAL; return data->ops->get_temp(data->sensor_data, temp); @@ -174,6 +174,10 @@ static int of_thermal_set_emul_temp(struct thermal_zone_device *tz, { struct __thermal_zone *data = tz->devdata; + if (!data->ops || !data->ops->set_emul_temp) + return -EINVAL; + + return data->ops->set_emul_temp(data->sensor_data, temp); } @@ -182,7 +186,7 @@ static int of_thermal_get_trend(struct thermal_zone_device *tz, int trip, { struct __thermal_zone *data = tz->devdata; - if (!data->ops->get_trend) + if (!data->ops || !data->ops->get_trend) return -EINVAL; return data->ops->get_trend(data->sensor_data, trip, trend); @@ -310,7 +314,7 @@ static int of_thermal_set_trip_temp(struct thermal_zone_device *tz, int trip, if (trip >= data->ntrips || trip < 0) return -EDOM; - if (data->ops->set_trip_temp) { + if (data->ops && data->ops->set_trip_temp) { int ret; ret = data->ops->set_trip_temp(data->sensor_data, trip, temp); -- 2.25.1

2 1