- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 V1] sched/fair: Fix the condition in overload_clear
by Cheng Yu 11 Oct '24

11 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWDO4 ----------------------------------------- In the overload_clear function, there is a bug when setting the overload_cpus, that is, when the steal_task feature is globally enabled and rq->cfs.h_nr_running is less than 2, the need_clear should be set to true. Fixes: 433c0b725642 ("sched/fair: Count the number of tasks marked as steal_task on cfs_rq") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/fair.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 38841d1d640a..a518d636f07f 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -4492,11 +4492,10 @@ static void overload_clear(struct rq *rq) if (!steal_enabled()) return; - if (!group_steal_used() && rq->cfs.h_nr_running >= 2) - return; + if (rq->cfs.h_nr_running < 2) + need_clear = true; - if (group_steal_used() && - (rq->cfs.h_nr_running < 2 || rq->cfs.steal_h_nr_running == 0)) + if (group_steal_used() && rq->cfs.steal_h_nr_running < 1) need_clear = true; if (!need_clear) -- 2.25.1

2 1

[PATCH OLK-6.6] fix: fix version showed in ethtool
by s00851154 11 Oct '24

11 Oct '24

From: Shi Jing <shijing34(a)huawei.com> Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 5a1995956a555..4ea526329d155 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strscpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strscpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strscpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311aab76c..5868187eafa99 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-5.10 V1] sched/debug: Fix h_nr_running/steal_h_nr_running in sched_debug
by Cheng Yu 11 Oct '24

11 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWDPS ----------------------------------------- It would be more practical to put the statistics of h_nr_running and steal_h_nr_running in the per-cpu column. Fixes: 1f9456c873b7 ("sched/debug: Add h_nr_running/steal_h_nr_running in sched_debug") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/debug.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index ff2d6dc59c14..4275398bc713 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -594,11 +594,6 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq) SEQ_printf(m, " .%-30s: %d\n", "nr_spread_over", cfs_rq->nr_spread_over); SEQ_printf(m, " .%-30s: %d\n", "nr_running", cfs_rq->nr_running); -#ifdef CONFIG_SCHED_STEAL - SEQ_printf(m, " .%-30s: %d\n", "h_nr_running", cfs_rq->h_nr_running); - SEQ_printf(m, " .%-30s: %ld\n", "steal_h_nr_running", - cfs_rq->steal_h_nr_running); -#endif SEQ_printf(m, " .%-30s: %ld\n", "load", cfs_rq->load.weight); #ifdef CONFIG_SMP SEQ_printf(m, " .%-30s: %lu\n", "load_avg", @@ -714,6 +709,11 @@ do { \ SEQ_printf(m, " .%-30s: %Ld.%06ld\n", #x, SPLIT_NS(rq->x)) P(nr_running); +#ifdef CONFIG_SCHED_STEAL + SEQ_printf(m, " .%-30s: %d\n", "h_nr_running", rq->cfs.h_nr_running); + SEQ_printf(m, " .%-30s: %ld\n", "steal_h_nr_running", + rq->cfs.steal_h_nr_running); +#endif P(nr_switches); P(nr_uninterruptible); PN(next_balance); -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2024-46826
by Gu Bowen 11 Oct '24

11 Oct '24

Fix CVE-2024-46826 Alexey Dobriyan (1): ELF: fix kernel.randomize_va_space double read Gu Bowen (1): ELF: Fix mixed declarations and code of "snapshot_randomize_va_space" fs/binfmt_elf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[openeuler:openEuler-1.0-LTS 20512/23827] drivers/md/md.o: warning: objtool: md_seq_show()+0x1087: unreachable instruction
by kernel test robot 11 Oct '24

11 Oct '24

Hi Logan, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: a89f484219c9ea217d26908f16037d1ab55d4f17 [20512/23827] md: Ensure resync is reported after it starts config: x86_64-randconfig-001-20241011 (https://download.01.org/0day-ci/archive/20241011/202410111657.HXras3Wj-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241011/202410111657.HXras3Wj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111657.HXras3Wj-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/md/md.c:49: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/md/md.c:320:6: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 320 | int cpu; | ^ drivers/md/md.c:2231:24: warning: variable 'bi_rdev' set but not used [-Wunused-but-set-variable] 2231 | struct blk_integrity *bi_rdev; | ^ 3 warnings generated. >> drivers/md/md.o: warning: objtool: md_seq_show()+0x1087: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 V1 0/2] bugfix for cgroup steal task
by Cheng Yu 11 Oct '24

11 Oct '24

bugfix for cgroup steal task Cheng Yu (2): sched/fair: Fix the condition in overload_clear sched/debug: Fix h_nr_running/steal_h_nr_running in sched_debug kernel/sched/debug.c | 10 +++++----- kernel/sched/fair.c | 7 +++---- 2 files changed, 8 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 V1 1/2] sched/fair: Fix the condition in overload_clear
by Cheng Yu 11 Oct '24

11 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAQWPQ ----------------------------------------- In the overload_clear function, there is a bug when setting the overload_cpus, that is, when the steal_task feature is globally enabled and rq->cfs.h_nr_running is less than 2, the need_clear should be set to true. Fixes: 433c0b725642 ("sched/fair: Count the number of tasks marked as steal_task on cfs_rq") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/fair.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 38841d1d640a..a518d636f07f 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -4492,11 +4492,10 @@ static void overload_clear(struct rq *rq) if (!steal_enabled()) return; - if (!group_steal_used() && rq->cfs.h_nr_running >= 2) - return; + if (rq->cfs.h_nr_running < 2) + need_clear = true; - if (group_steal_used() && - (rq->cfs.h_nr_running < 2 || rq->cfs.steal_h_nr_running == 0)) + if (group_steal_used() && rq->cfs.steal_h_nr_running < 1) need_clear = true; if (!need_clear) -- 2.25.1

2 1

[openeuler:OLK-6.6 777/14350] arch/loongarch/kernel/legacy_boot.c:439:25-27: WARNING !A || A && B is equivalent to !A || B
by kernel test robot 11 Oct '24

11 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f7c1291d7c3f15bc448cd93e29fa539386fe85fe commit: db5bb24abc8dd120fd81b7ce21819e96578d011e [777/14350] LoongArch: Old BPI compatibility config: loongarch-randconfig-r062-20241011 (https://download.01.org/0day-ci/archive/20241011/202410111529.bqXXUCAv-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111529.bqXXUCAv-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> arch/loongarch/kernel/legacy_boot.c:439:25-27: WARNING !A || A && B is equivalent to !A || B vim +439 arch/loongarch/kernel/legacy_boot.c 423 424 static struct fwnode_handle * __init parse_isa_base(u64 *cpu_addr) 425 { 426 struct device_node *np; 427 const __be32 *ranges = NULL; 428 int len; 429 struct device_node *node; 430 431 for_each_node_by_name(np, "isa") { 432 node = of_node_get(np); 433 434 if (!node) 435 break; 436 437 ranges = of_get_property(node, "ranges", &len); 438 > 439 if (!ranges || (ranges && len > 0)) 440 break; 441 } 442 if (ranges) { 443 ranges += 2; 444 *cpu_addr = of_translate_address(np, ranges); 445 return &np->fwnode; 446 } 447 448 return NULL; 449 } 450 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 V1 2/2] sched/debug: Fix h_nr_running/steal_h_nr_running in sched_debug
by Cheng Yu 11 Oct '24

11 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAQWPQ ----------------------------------------- It would be more practical to put the statistics of h_nr_running and steal_h_nr_running in the per-cpu column. Fixes: 1f9456c873b7 ("sched/debug: Add h_nr_running/steal_h_nr_running in sched_debug") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/debug.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index ff2d6dc59c14..4275398bc713 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -594,11 +594,6 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq) SEQ_printf(m, " .%-30s: %d\n", "nr_spread_over", cfs_rq->nr_spread_over); SEQ_printf(m, " .%-30s: %d\n", "nr_running", cfs_rq->nr_running); -#ifdef CONFIG_SCHED_STEAL - SEQ_printf(m, " .%-30s: %d\n", "h_nr_running", cfs_rq->h_nr_running); - SEQ_printf(m, " .%-30s: %ld\n", "steal_h_nr_running", - cfs_rq->steal_h_nr_running); -#endif SEQ_printf(m, " .%-30s: %ld\n", "load", cfs_rq->load.weight); #ifdef CONFIG_SMP SEQ_printf(m, " .%-30s: %lu\n", "load_avg", @@ -714,6 +709,11 @@ do { \ SEQ_printf(m, " .%-30s: %Ld.%06ld\n", #x, SPLIT_NS(rq->x)) P(nr_running); +#ifdef CONFIG_SCHED_STEAL + SEQ_printf(m, " .%-30s: %d\n", "h_nr_running", rq->cfs.h_nr_running); + SEQ_printf(m, " .%-30s: %ld\n", "steal_h_nr_running", + rq->cfs.steal_h_nr_running); +#endif P(nr_switches); P(nr_uninterruptible); PN(next_balance); -- 2.25.1

1 0

[openeuler:OLK-6.6] BUILD REGRESSION f7c1291d7c3f15bc448cd93e29fa539386fe85fe
by kernel test robot 11 Oct '24

11 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f7c1291d7c3f15bc448cd93e29fa539386fe85fe !12080 btrfs: clean up our handling of refs == 0 in snapshot delete Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202410101809.HFdpybos-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410111205.LRqw3beL-lkp@intel.com drivers/crypto/ccp/hygon/tdm-dev.c:340:63: error: incomplete definition of type 'struct module' ld.lld: error: undefined symbol: arch_elf_adjust_prot Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-004-20241010 | `-- ld.lld:error:undefined-symbol:arch_elf_adjust_prot |-- loongarch-allmodconfig | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | `-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- loongarch-randconfig-001-20241011 | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- loongarch-randconfig-002-20241011 | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- loongarch-randconfig-r062-20241011 | `-- arch-loongarch-kernel-legacy_boot.c:WARNING-A-A-B-is-equivalent-to-A-B |-- x86_64-allyesconfig | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-buildonly-randconfig-003-20241011 | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-tdm-dev.c:error:incomplete-definition-of-type-struct-module | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3 | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-func | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-kselftests | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst `-- x86_64-rhel-8.3-rust |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst elapsed time: 1257m configs tested: 32 configs skipped: 133 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241011 gcc-14.1.0 arm64 randconfig-002-20241011 clang-20 arm64 randconfig-003-20241011 clang-20 arm64 randconfig-004-20241011 gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20241011 gcc-14.1.0 loongarch randconfig-002-20241011 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20241011 gcc-12 x86_64 buildonly-randconfig-002-20241011 gcc-12 x86_64 buildonly-randconfig-003-20241011 clang-18 x86_64 buildonly-randconfig-004-20241011 clang-18 x86_64 buildonly-randconfig-005-20241011 gcc-12 x86_64 buildonly-randconfig-006-20241011 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20241011 clang-18 x86_64 randconfig-002-20241011 gcc-11 x86_64 randconfig-003-20241011 gcc-12 x86_64 randconfig-004-20241011 gcc-12 x86_64 randconfig-005-20241011 clang-18 x86_64 randconfig-006-20241011 clang-18 x86_64 randconfig-011-20241011 gcc-12 x86_64 randconfig-012-20241011 clang-18 x86_64 randconfig-013-20241011 gcc-11 x86_64 randconfig-014-20241011 clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2024-46858
by Wang Liang 11 Oct '24

11 Oct '24

Davide Caratti (1): mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer Edward Adam Davis (1): mptcp: pm: Fix uaf in __timer_delete_sync Geliang Tang (1): mptcp: export lookup_anno_list_by_saddr net/mptcp/options.c | 2 +- net/mptcp/pm_netlink.c | 27 ++++++++++++++++----------- net/mptcp/protocol.h | 5 ++++- 3 files changed, 21 insertions(+), 13 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS-SP1] net: dpaa: Pad packets to ETH_ZLEN
by Wang Liang 11 Oct '24

11 Oct '24

From: Sean Anderson <sean.anderson(a)linux.dev> mainline inclusion from mainline-v6.11 commit cbd7ec083413c6a2e0c326d49e24ec7d12c7a9e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9O1 CVE: CVE-2024-46854 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When sending packets under 60 bytes, up to three bytes of the buffer following the data may be leaked. Avoid this by extending all packets to ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be reproduced by running $ ping -s 11 destination Fixes: 9ad1a3749333 ("dpaa_eth: add support for DPAA Ethernet") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240910143144.1439910-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c index cb7c028b1bf5..638dd56bbc5e 100644 --- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c @@ -2147,12 +2147,12 @@ static netdev_tx_t dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) { const int queue_mapping = skb_get_queue_mapping(skb); - bool nonlinear = skb_is_nonlinear(skb); struct rtnl_link_stats64 *percpu_stats; struct dpaa_percpu_priv *percpu_priv; struct netdev_queue *txq; struct dpaa_priv *priv; struct qm_fd fd; + bool nonlinear; int offset = 0; int err = 0; @@ -2162,6 +2162,13 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) qm_fd_clear_fd(&fd); + /* Packet data is always read as 32-bit words, so zero out any part of + * the skb which might be sent if we have to pad the packet + */ + if (__skb_put_padto(skb, ETH_ZLEN, false)) + goto enomem; + + nonlinear = skb_is_nonlinear(skb); if (!nonlinear) { /* We're going to store the skb backpointer at the beginning * of the data buffer, so we need a privately owned skb -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] netfilter: nft_socket: fix sk refcount leaks
by Wang Liang 11 Oct '24

11 Oct '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.11 commit 8b26ff7af8c32cb4148b3e147c52f9e4c695209c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9K2 CVE: CVE-2024-46855 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We must put 'sk' reference before returning. Fixes: 039b1f4f24ec ("netfilter: nft_socket: fix erroneous socket assignment") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_socket.c [conflicts due to not mergered e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/nft_socket.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c index f6d517185d9c..151cd2fc0765 100644 --- a/net/netfilter/nft_socket.c +++ b/net/netfilter/nft_socket.c @@ -88,13 +88,13 @@ static void nft_socket_eval(const struct nft_expr *expr, *dest = sk->sk_mark; } else { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } break; case NFT_SOCKET_WILDCARD: if (!sk_fullsock(sk)) { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } nft_socket_wildcard(pkt, regs, sk, dest); break; @@ -103,6 +103,7 @@ static void nft_socket_eval(const struct nft_expr *expr, regs->verdict.code = NFT_BREAK; } +out_put_sk: if (sk != skb->sk) sock_gen_put(sk); } -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] CVE-2024-46858
by Wang Liang 11 Oct '24

11 Oct '24

Davide Caratti (1): mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer Edward Adam Davis (1): mptcp: pm: Fix uaf in __timer_delete_sync Geliang Tang (1): mptcp: export lookup_anno_list_by_saddr net/mptcp/options.c | 2 +- net/mptcp/pm_netlink.c | 27 ++++++++++++++++----------- net/mptcp/protocol.h | 5 ++++- 3 files changed, 21 insertions(+), 13 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] net: dpaa: Pad packets to ETH_ZLEN
by Wang Liang 11 Oct '24

11 Oct '24

From: Sean Anderson <sean.anderson(a)linux.dev> mainline inclusion from mainline-v6.11 commit cbd7ec083413c6a2e0c326d49e24ec7d12c7a9e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9O1 CVE: CVE-2024-46854 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When sending packets under 60 bytes, up to three bytes of the buffer following the data may be leaked. Avoid this by extending all packets to ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be reproduced by running $ ping -s 11 destination Fixes: 9ad1a3749333 ("dpaa_eth: add support for DPAA Ethernet") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240910143144.1439910-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c index cb7c028b1bf5..638dd56bbc5e 100644 --- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c @@ -2147,12 +2147,12 @@ static netdev_tx_t dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) { const int queue_mapping = skb_get_queue_mapping(skb); - bool nonlinear = skb_is_nonlinear(skb); struct rtnl_link_stats64 *percpu_stats; struct dpaa_percpu_priv *percpu_priv; struct netdev_queue *txq; struct dpaa_priv *priv; struct qm_fd fd; + bool nonlinear; int offset = 0; int err = 0; @@ -2162,6 +2162,13 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) qm_fd_clear_fd(&fd); + /* Packet data is always read as 32-bit words, so zero out any part of + * the skb which might be sent if we have to pad the packet + */ + if (__skb_put_padto(skb, ETH_ZLEN, false)) + goto enomem; + + nonlinear = skb_is_nonlinear(skb); if (!nonlinear) { /* We're going to store the skb backpointer at the beginning * of the data buffer, so we need a privately owned skb -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: nft_socket: fix sk refcount leaks
by Wang Liang 11 Oct '24

11 Oct '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.11 commit 8b26ff7af8c32cb4148b3e147c52f9e4c695209c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9K2 CVE: CVE-2024-46855 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We must put 'sk' reference before returning. Fixes: 039b1f4f24ec ("netfilter: nft_socket: fix erroneous socket assignment") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_socket.c [conflicts due to not mergered e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/nft_socket.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c index 826e5f8c78f3..07e73e50b713 100644 --- a/net/netfilter/nft_socket.c +++ b/net/netfilter/nft_socket.c @@ -88,13 +88,13 @@ static void nft_socket_eval(const struct nft_expr *expr, *dest = sk->sk_mark; } else { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } break; case NFT_SOCKET_WILDCARD: if (!sk_fullsock(sk)) { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } nft_socket_wildcard(pkt, regs, sk, dest); break; @@ -103,6 +103,7 @@ static void nft_socket_eval(const struct nft_expr *expr, regs->verdict.code = NFT_BREAK; } +out_put_sk: if (sk != skb->sk) sock_gen_put(sk); } -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 9b2f1457c730cd7915663ac5d9ccb849f2657714
by kernel test robot 11 Oct '24

11 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 9b2f1457c730cd7915663ac5d9ccb849f2657714 !12071 btrfs: clean up our handling of refs == 0 in snapshot delete Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-001-20241011 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-002-20241011 | `-- arch-arm64-kvm-..-..-..-virt-kvm-arm-arm.c:error:struct-sched_info-has-no-member-named-run_delay |-- arm64-randconfig-003-20241011 | `-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) |-- arm64-randconfig-004-20241011 | |-- include-linux-uaccess.h:warning:bind-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:kmask-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:p-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:params-may-be-used-uninitialized |-- x86_64-allnoconfig | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | `-- drivers-net-ethernet-stmicro-stmmac-dwmac-phytium.c:error:incompatible-pointer-to-integer-conversion-returning-void-from-a-function-with-result-type-int |-- x86_64-buildonly-randconfig-002-20241011 | |-- arch-x86-kernel-cpu-mce-therm_throt.o:warning:objtool:missing-symbol-for-section-.irqentry.text | `-- net-9p-client.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-003-20241011 | |-- fs-sysfs-symlink.o:warning:objtool:missing-symbol-for-section-.text | |-- net-9p-client.o:warning:objtool:missing-symbol-for-section-.init.text | `-- net-ax25-ax25_dev.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-buildonly-randconfig-005-20241011 | `-- fs-pstore-inode.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-kexec | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-001-20241011 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-002-20241011 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-randconfig-003-20241011 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-randconfig-012-20241011 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-014-20241011 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-015-20241011 `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity elapsed time: 1226m configs tested: 30 configs skipped: 138 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20241011 gcc-14.1.0 arm64 randconfig-002-20241011 gcc-14.1.0 arm64 randconfig-003-20241011 gcc-14.1.0 arm64 randconfig-004-20241011 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20241011 gcc-12 x86_64 buildonly-randconfig-002-20241011 gcc-12 x86_64 buildonly-randconfig-003-20241011 clang-18 x86_64 buildonly-randconfig-004-20241011 clang-18 x86_64 buildonly-randconfig-005-20241011 gcc-12 x86_64 buildonly-randconfig-006-20241011 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20241011 clang-18 x86_64 randconfig-002-20241011 gcc-11 x86_64 randconfig-003-20241011 gcc-12 x86_64 randconfig-004-20241011 gcc-12 x86_64 randconfig-005-20241011 clang-18 x86_64 randconfig-006-20241011 clang-18 x86_64 randconfig-011-20241011 gcc-12 x86_64 randconfig-012-20241011 clang-18 x86_64 randconfig-013-20241011 gcc-11 x86_64 randconfig-014-20241011 clang-18 x86_64 randconfig-015-20241011 gcc-12 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/6] Backport some patches of hns RoCE from mainline
by Chengchang Tang 11 Oct '24

11 Oct '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Backport some patches of hns RoCE from Linux mainline to olk-5.10 Chengchang Tang (2): RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled Junxian Huang (1): RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler Xinghai Cen (3): Revert "RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler" Revert "RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS" Revert "RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled" -- 2.33.0

2 7

[openeuler:OLK-6.6 13318/14350] drivers/crypto/ccp/hygon/tdm-dev.c:340:63: error: incomplete definition of type 'struct module'
by kernel test robot 11 Oct '24

11 Oct '24

Hi chench00, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f7c1291d7c3f15bc448cd93e29fa539386fe85fe commit: a1dd4972da4e66d9a9d1a89b3dfd8f742c20193b [13318/14350] crypto: tdm: Add Hygon TDM driver config: x86_64-buildonly-randconfig-003-20241011 (https://download.01.org/0day-ci/archive/20241011/202410111205.LRqw3beL-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241011/202410111205.LRqw3beL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111205.LRqw3beL-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/crypto/ccp/hygon/tdm-dev.c:94:6: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 94 | int ret = 0; | ^ >> drivers/crypto/ccp/hygon/tdm-dev.c:340:63: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ include/linux/fortify-string.h:707:53: note: expanded from macro 'memcpy' 707 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ | ^ include/linux/fortify-string.h:650:41: note: expanded from macro '__fortify_memcpy_chk' 650 | const size_t __fortify_size = (size_t)(size); \ | ^~~~ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:340:40: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ include/linux/fortify-string.h:708:35: note: expanded from macro 'memcpy' 708 | __struct_size(p), __struct_size(q), \ | ^ include/linux/fortify-string.h:110:56: note: expanded from macro '__struct_size' 110 | #define __struct_size(p) __builtin_dynamic_object_size(p, 0) | ^ include/linux/fortify-string.h:652:27: note: expanded from macro '__fortify_memcpy_chk' 652 | const size_t __q_size = (q_size); \ | ^~~~~~ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:340:40: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ include/linux/fortify-string.h:709:35: note: expanded from macro 'memcpy' 709 | __member_size(p), __member_size(q), \ | ^ include/linux/fortify-string.h:111:56: note: expanded from macro '__member_size' 111 | #define __member_size(p) __builtin_dynamic_object_size(p, 1) | ^ include/linux/fortify-string.h:654:33: note: expanded from macro '__fortify_memcpy_chk' 654 | const size_t __q_size_field = (q_size_field); \ | ^~~~~~~~~~~~ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:340:40: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ include/linux/fortify-string.h:707:50: note: expanded from macro 'memcpy' 707 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ | ^ include/linux/fortify-string.h:662:23: note: expanded from macro '__fortify_memcpy_chk' 662 | __underlying_##op(p, q, __fortify_size); \ | ^ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:606:20: warning: variable 'head' set but not used [-Wunused-but-set-variable] 606 | struct list_head *head = NULL; | ^ 2 warnings and 4 errors generated. vim +340 drivers/crypto/ccp/hygon/tdm-dev.c 323 324 if (!hash) { 325 ret = -DYN_NULL_POINTER; 326 pr_err("Null pointer\n"); 327 goto end; 328 } 329 330 ctx_msg.flag = flag; 331 ctx_msg.pid = current->pid; 332 memcpy(ctx_msg.comm, current->comm, sizeof(current->comm)); 333 334 return_address = CALLER_ADDR1; 335 if (return_address) { 336 #if IS_BUILTIN(CONFIG_CRYPTO_DEV_CCP_DD) 337 p_module = __module_address(return_address); 338 // caller is module 339 if (p_module) > 340 memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); 341 // caller is build-in 342 else 343 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 344 #elif IS_ENABLED(CONFIG_KALLSYMS) 345 symbol_len = sprint_symbol((char *)symbol_buf, return_address); 346 if (!symbol_len) { 347 ret = -DYN_ERR_API; 348 pr_err("sprint_symbol failed\n"); 349 goto end; 350 } 351 symbol_begin = strchr((char *)symbol_buf, '['); 352 if (!symbol_begin) { 353 ret = -DYN_NULL_POINTER; 354 pr_err("module name is not exist\n"); 355 goto end; 356 } 357 symbol_end = strchr((char *)symbol_buf, ']'); 358 if (!symbol_end) { 359 ret = -DYN_NULL_POINTER; 360 pr_err("module name is not exist\n"); 361 goto end; 362 } 363 symbol_begin++; 364 if (symbol_end - symbol_begin) 365 memcpy(ctx_msg.module_name, symbol_begin, symbol_end - symbol_begin); 366 else 367 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 368 #else 369 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 370 #endif 371 } else 372 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 373 374 ret = calc_task_context_hash(ctx_msg, hash); 375 if (ret) { 376 pr_err("calc_task_context_hash failed\n"); 377 goto end; 378 } 379 380 end: 381 return ret; 382 } 383 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] USB: usbtmc: prevent kernel-usb-infoleak
by Yipeng Zou 11 Oct '24

11 Oct '24

From: Edward Adam Davis <eadavis(a)qq.com> mainline inclusion from mainline-v6.12-rc1 commit 625fa77151f00c1bd00d34d60d6f2e710b3f9aad category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU7U CVE: CVE-2024-47671 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The syzbot reported a kernel-usb-infoleak in usbtmc_write, we need to clear the structure before filling fields. Fixes: 4ddc645f40e9 ("usb: usbtmc: Add ioctl for vendor specific write") Reported-and-tested-by: syzbot+9d34f80f841e948c3fdb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9d34f80f841e948c3fdb Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/tencent_9649AA6EC56EDECCA8A7D106C792D1C66B06@qq.c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/class/usbtmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c index 49f59d53b4b2..cf285d43d0c1 100644 --- a/drivers/usb/class/usbtmc.c +++ b/drivers/usb/class/usbtmc.c @@ -724,7 +724,7 @@ static struct urb *usbtmc_create_urb(void) if (!urb) return NULL; - dmabuf = kmalloc(bufsize, GFP_KERNEL); + dmabuf = kzalloc(bufsize, GFP_KERNEL); if (!dmabuf) { usb_free_urb(urb); return NULL; -- 2.34.1

2 1

[PATCH OLK-6.6] USB: usbtmc: prevent kernel-usb-infoleak
by Yipeng Zou 11 Oct '24

11 Oct '24

From: Edward Adam Davis <eadavis(a)qq.com> mainline inclusion from mainline-v6.12-rc1 commit 625fa77151f00c1bd00d34d60d6f2e710b3f9aad category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU7U CVE: CVE-2024-47671 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The syzbot reported a kernel-usb-infoleak in usbtmc_write, we need to clear the structure before filling fields. Fixes: 4ddc645f40e9 ("usb: usbtmc: Add ioctl for vendor specific write") Reported-and-tested-by: syzbot+9d34f80f841e948c3fdb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9d34f80f841e948c3fdb Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/tencent_9649AA6EC56EDECCA8A7D106C792D1C66B06@qq.c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/class/usbtmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c index 311007b1d904..c2e666e82857 100644 --- a/drivers/usb/class/usbtmc.c +++ b/drivers/usb/class/usbtmc.c @@ -754,7 +754,7 @@ static struct urb *usbtmc_create_urb(void) if (!urb) return NULL; - dmabuf = kmalloc(bufsize, GFP_KERNEL); + dmabuf = kzalloc(bufsize, GFP_KERNEL); if (!dmabuf) { usb_free_urb(urb); return NULL; -- 2.34.1

2 1

[PATCH OLK-5.10] USB: usbtmc: prevent kernel-usb-infoleak
by Yipeng Zou 11 Oct '24

11 Oct '24

From: Edward Adam Davis <eadavis(a)qq.com> mainline inclusion from mainline-v6.12-rc1 commit 625fa77151f00c1bd00d34d60d6f2e710b3f9aad category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU7U CVE: CVE-2024-47671 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The syzbot reported a kernel-usb-infoleak in usbtmc_write, we need to clear the structure before filling fields. Fixes: 4ddc645f40e9 ("usb: usbtmc: Add ioctl for vendor specific write") Reported-and-tested-by: syzbot+9d34f80f841e948c3fdb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9d34f80f841e948c3fdb Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/tencent_9649AA6EC56EDECCA8A7D106C792D1C66B06@qq.c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/class/usbtmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c index 76ff182427bc..78adc112a77b 100644 --- a/drivers/usb/class/usbtmc.c +++ b/drivers/usb/class/usbtmc.c @@ -724,7 +724,7 @@ static struct urb *usbtmc_create_urb(void) if (!urb) return NULL; - dmabuf = kmalloc(bufsize, GFP_KERNEL); + dmabuf = kzalloc(bufsize, GFP_KERNEL); if (!dmabuf) { usb_free_urb(urb); return NULL; -- 2.34.1

2 1

[PATCH OLK-5.10] tracing: Have tracing_max_latency inc the trace array ref count
by Chen Zhongjin 11 Oct '24

11 Oct '24

From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.6-rc2 commit 7d660c9b2bc95107f90a9f4c4759be85309a6550 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IATD5H Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The tracing_max_latency file points to the trace_array max_latency field. For an instance, if the file is opened and the instance is deleted, reading or writing to the file will cause a use after free. Up the ref count of the trace_array when tracing_max_latency is opened. Link: https://lkml.kernel.org/r/20230907024803.666889383@goodmis.org Link: https://lore.kernel.org/all/1cb3aee2-19af-c472-e265-05176fe9bd84@huawei.com/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Zheng Yejian <zhengyejian1(a)huawei.com> Fixes: 8530dec63e7b4 ("tracing: Add tracing_check_open_get_tr()") Tested-by: Linux Kernel Functional Testing <lkft(a)linaro.org> Tested-by: Naresh Kamboju <naresh.kamboju(a)linaro.org> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace.c [adjust context conflicts] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/trace/trace.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 3c776919305a..a470950b8ed6 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -1718,7 +1718,7 @@ static void trace_create_maxlat_file(struct trace_array *tr, init_irq_work(&tr->fsnotify_irqwork, latency_fsnotify_workfn_irq); tr->d_max_latency = trace_create_file("tracing_max_latency", TRACE_MODE_WRITE, - d_tracer, &tr->max_latency, + d_tracer, tr, &tracing_max_lat_fops); } @@ -1752,7 +1752,7 @@ void latency_fsnotify(struct trace_array *tr) #define trace_create_maxlat_file(tr, d_tracer) \ trace_create_file("tracing_max_latency", TRACE_MODE_WRITE, \ - d_tracer, &tr->max_latency, &tracing_max_lat_fops) + d_tracer, tr, &tracing_max_lat_fops) #else #define trace_create_maxlat_file(tr, d_tracer) do { } while (0) @@ -6227,14 +6227,18 @@ static ssize_t tracing_max_lat_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos) { - return tracing_nsecs_read(filp->private_data, ubuf, cnt, ppos); + struct trace_array *tr = filp->private_data; + + return tracing_nsecs_read(&tr->max_latency, ubuf, cnt, ppos); } static ssize_t tracing_max_lat_write(struct file *filp, const char __user *ubuf, size_t cnt, loff_t *ppos) { - return tracing_nsecs_write(filp->private_data, ubuf, cnt, ppos); + struct trace_array *tr = filp->private_data; + + return tracing_nsecs_write(&tr->max_latency, ubuf, cnt, ppos); } #endif @@ -7264,10 +7268,11 @@ static const struct file_operations tracing_thresh_fops = { #if defined(CONFIG_TRACER_MAX_TRACE) || defined(CONFIG_HWLAT_TRACER) static const struct file_operations tracing_max_lat_fops = { - .open = tracing_open_generic, + .open = tracing_open_generic_tr, .read = tracing_max_lat_read, .write = tracing_max_lat_write, .llseek = generic_file_llseek, + .release = tracing_release_generic_tr, }; #endif -- 2.25.1

2 1

[PATCH OLK-6.6] arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
by Heyuan Wang 11 Oct '24

11 Oct '24

From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> mainline inclusion from mainline-v6.11-rc1 commit 2488444274c70038eb6b686cba5f1ce48ebb9cdd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9OA CVE: CVE-2024-46822 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In a review discussion of the changes to support vCPU hotplug where a check was added on the GICC being enabled if was online, it was noted that there is need to map back to the cpu and use that to index into a cpumask. As such, a valid ID is needed. If an MPIDR check fails in acpi_map_gic_cpu_interface() it is possible for the entry in cpu_madt_gicc[cpu] == NULL. This function would then cause a NULL pointer dereference. Whilst a path to trigger this has not been established, harden this caller against the possibility. Reviewed-by: Gavin Shan <gshan(a)redhat.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Link: https://lore.kernel.org/r/20240529133446.28446-13-Jonathan.Cameron@huawei.c… Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: wangheyuan <wangheyuan2(a)h-partners.com> --- arch/arm64/include/asm/acpi.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h index bc9a6656fc0c..a407f9cd549e 100644 --- a/arch/arm64/include/asm/acpi.h +++ b/arch/arm64/include/asm/acpi.h @@ -124,7 +124,8 @@ static inline int get_cpu_for_acpi_id(u32 uid) int cpu; for (cpu = 0; cpu < nr_cpu_ids; cpu++) - if (uid == get_acpi_id_for_cpu(cpu)) + if (acpi_cpu_get_madt_gicc(cpu) && + uid == get_acpi_id_for_cpu(cpu)) return cpu; return -EINVAL; -- 2.25.1

2 1

[PATCH OLK-5.10 00/19] blk-throttle: support prioritized processing of metadata
by Yu Kuai 10 Oct '24

10 Oct '24

Jens Axboe (1): block: move blk-throtl fast path inline Jinke Han (1): blk-throttle: Fix io statistics for cgroup v1 Kemeng Shi (2): blk-throttle: Fix that bps of child could exceed bps limited in parent blk-throttle: correct calculation of wait time in tg_may_dispatch Laibin Qiu (1): blk-throttle: Set BIO_THROTTLED when bio has been throttled Ming Lei (4): block: throttle split bio in case of iops limit block: don't try to throttle split bio if iops limit isn't set block: revert 4f1e9630afe6 ("blk-throtl: optimize IOPS throttle for large IO scenarios") block: avoid use-after-free on throttle data Yu Kuai (10): Revert "blk-throttle: fix io hung due to configuration updates" Revert "blk-throttle: Set BIO_THROTTLED when bio has been throttled" blk-throttle: fix that io throttle can only work for single bio blk-throttle: fix io hung due to configuration updates blk-throttle: remove THROTL_TG_HAS_IOPS_LIMIT blk-throttle: improve bypassing bios checkings blk-throttle: print signed value 'carryover_bytes/ios' for user blk-throttle: fix wrong comparation while 'carryover_ios/bytes' is negative blk-throttle: consider 'carryover_ios/bytes' in throtl_trim_slice() blk-throttle: support prioritized processing of metadata block/bio.c | 2 - block/blk-cgroup.c | 7 +- block/blk-core.c | 1 + block/blk-merge.c | 6 +- block/blk-sysfs.c | 1 + block/blk-throttle.c | 519 +++++++++++++------------------------- block/blk-throttle.h | 214 ++++++++++++++++ block/blk.h | 16 -- include/linux/bio.h | 2 +- include/linux/blk_types.h | 2 +- 10 files changed, 396 insertions(+), 374 deletions(-) create mode 100644 block/blk-throttle.h -- 2.39.2

2 20

[openeuler:OLK-6.6 691/14344] ld.lld: error: undefined symbol: arch_elf_adjust_prot
by kernel test robot 10 Oct '24

10 Oct '24

Hi Yury, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f7c1291d7c3f15bc448cd93e29fa539386fe85fe commit: 7de3ab4c3dd938fae3626a6344830b018eb7ba4f [691/14344] arm64: introduce binfmt_elf32.c config: arm64-randconfig-004-20241010 (https://download.01.org/0day-ci/archive/20241010/202410101809.HFdpybos-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 70e0a7e7e6a8541bcc46908c592eed561850e416) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241010/202410101809.HFdpybos-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410101809.HFdpybos-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: undefined symbol: arch_elf_adjust_prot >>> referenced by binfmt_elf.c:583 (arch/arm64/kernel/../../../fs/binfmt_elf.c:583) >>> arch/arm64/kernel/binfmt_elf32.o:(load_elf_binary) in archive vmlinux.a >>> referenced by binfmt_elf.c:583 (arch/arm64/kernel/../../../fs/binfmt_elf.c:583) >>> arch/arm64/kernel/binfmt_elf32.o:(load_elf_interp) in archive vmlinux.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] drm/i915/gt: Cleanup partial engine discovery failures
by Yu Liao 10 Oct '24

10 Oct '24

From: Chris Wilson <chris.p.wilson(a)intel.com> mainline inclusion from mainline-v6.2-rc1 commit 78a033433a5ae4fee85511ee075bc9a48312c79e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIK8 CVE: CVE-2022-48893 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If we abort driver initialisation in the middle of gt/engine discovery, some engines will be fully setup and some not. Those incompletely setup engines only have 'engine->release == NULL' and so will leak any of the common objects allocated. v2: - Drop the destroy_pinned_context() helper for now. It's not really worth it with just a single callsite at the moment. (Janusz) Signed-off-by: Chris Wilson <chris.p.wilson(a)intel.com> Cc: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Signed-off-by: Matt Roper <matthew.d.roper(a)intel.com> Reviewed-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220915232654.3283095-2-matt… Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c index c940ac3aae2f..5bec331c0813 100644 --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c @@ -905,8 +905,13 @@ int intel_engines_init(struct intel_gt *gt) return err; err = setup(engine); - if (err) + if (err) { + intel_engine_cleanup_common(engine); return err; + } + + /* The backend should now be responsible for cleanup */ + GEM_BUG_ON(engine->release == NULL); err = engine_init_common(engine); if (err) -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/i915/gt: Cleanup partial engine discovery failures
by Yu Liao 10 Oct '24

10 Oct '24

From: Chris Wilson <chris.p.wilson(a)intel.com> mainline inclusion from mainline-v6.2-rc1 commit 78a033433a5ae4fee85511ee075bc9a48312c79e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIK8 CVE: CVE-2022-48893 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If we abort driver initialisation in the middle of gt/engine discovery, some engines will be fully setup and some not. Those incompletely setup engines only have 'engine->release == NULL' and so will leak any of the common objects allocated. v2: - Drop the destroy_pinned_context() helper for now. It's not really worth it with just a single callsite at the moment. (Janusz) Signed-off-by: Chris Wilson <chris.p.wilson(a)intel.com> Cc: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Signed-off-by: Matt Roper <matthew.d.roper(a)intel.com> Reviewed-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220915232654.3283095-2-matt… Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c index c940ac3aae2f..5bec331c0813 100644 --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c @@ -905,8 +905,13 @@ int intel_engines_init(struct intel_gt *gt) return err; err = setup(engine); - if (err) + if (err) { + intel_engine_cleanup_common(engine); return err; + } + + /* The backend should now be responsible for cleanup */ + GEM_BUG_ON(engine->release == NULL); err = engine_init_common(engine); if (err) -- 2.33.0

2 1

[PATCH OLK-6.6] userfaultfd: don't BUG_ON() if khugepaged yanks our page table
by Liu Shixin 10 Oct '24

10 Oct '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v6.6.51 commit 4a594acc12d5954cdc71d4450a386748bf3d136a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9P2 CVE: CVE-2024-46838 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4828d207dc5161dc7ddf9a4f6dcfd80c7dd7d20a upstream. Since khugepaged was changed to allow retracting page tables in file mappings without holding the mmap lock, these BUG_ON()s are wrong - get rid of them. We could also remove the preceding "if (unlikely(...))" block, but then we could reach pte_offset_map_lock() with transhuge pages not just for file mappings but also for anonymous mappings - which would probably be fine but I think is not necessarily expected. Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-2-5efa61078a41@goog… Fixes: 1d65b771bc08 ("mm/khugepaged: retract_page_tables() without mmap or vma lock") Signed-off-by: Jann Horn <jannh(a)google.com> Reviewed-by: Qi Zheng <zhengqi.arch(a)bytedance.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Pavel Emelyanov <xemul(a)virtuozzo.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/userfaultfd.c [ Context conflict with userswap feature. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/userfaultfd.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c index b7562e6847b2..2c71a269a52c 100644 --- a/mm/userfaultfd.c +++ b/mm/userfaultfd.c @@ -724,9 +724,10 @@ static __always_inline ssize_t mfill_atomic(struct mm_struct *dst_mm, err = -EFAULT; break; } - - BUG_ON(pmd_none(*dst_pmd)); - BUG_ON(pmd_trans_huge(*dst_pmd)); + /* + * For shmem mappings, khugepaged is allowed to remove page + * tables under us; pte_offset_map_lock() will deal with that. + */ #ifdef CONFIG_USERSWAP if (static_branch_unlikely(&userswap_enabled) && -- 2.34.1

2 1

[openeuler:OLK-6.6 6858/14336] drivers/char/ipmi/ipmi_bt_sm.c:194:11: error: call to undeclared function 'acpi_evaluate_integer'; ISO C99 and later do not support implicit function declarations
by kernel test robot 10 Oct '24

10 Oct '24

Hi Devyn, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 5cfda5c5e5fbd3cbd5845d1ba3ebb1ccd52c05a9 commit: 6449ff7a5a2b148bc0a60efb3f0d723aaeceaae6 [6858/14336] ipmi: Errata workaround to prevent SMS message processing timeout config: arm64-randconfig-002-20241010 (https://download.01.org/0day-ci/archive/20241010/202410101323.VsBPpYrP-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 70e0a7e7e6a8541bcc46908c592eed561850e416) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241010/202410101323.VsBPpYrP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410101323.VsBPpYrP-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/char/ipmi/ipmi_bt_sm.c:194:11: error: call to undeclared function 'acpi_evaluate_integer'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 194 | status = acpi_evaluate_integer(handle, "SATN", NULL, &tmp); | ^ drivers/char/ipmi/ipmi_bt_sm.c:194:11: note: did you mean 'acpi_evaluate_object'? include/acpi/acpixf.h:550:8: note: 'acpi_evaluate_object' declared here 550 | acpi_evaluate_object(acpi_handle object, | ^ include/acpi/platform/aclinux.h:93:21: note: expanded from macro 'ACPI_EXTERNAL_RETURN_STATUS' 93 | static ACPI_INLINE prototype {return(AE_NOT_CONFIGURED);} | ^ 1 error generated. vim +/acpi_evaluate_integer +194 drivers/char/ipmi/ipmi_bt_sm.c 177 178 #ifdef CONFIG_HISILICON_ERRATUM_162102203 179 /* 180 * To confirm whether the SMS_ATN flag needs to be stored and get 181 * quirk through the method reported by the BIOS. Because in special 182 * cases SMS_ATN flag bits may be lost before being processed. 183 */ 184 static bool get_sms_atn_quirk(struct si_sm_io *io) 185 { 186 acpi_handle handle; 187 acpi_status status; 188 unsigned long long tmp; 189 190 handle = ACPI_HANDLE(io->dev); 191 if (!handle) 192 return false; 193 > 194 status = acpi_evaluate_integer(handle, "SATN", NULL, &tmp); 195 if (ACPI_FAILURE(status)) 196 return false; 197 else if (tmp != 1) 198 return false; 199 200 return true; 201 } 202 #endif 203 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] swiotlb: fix swiotlb_bounce() to do partial sync's correctly
by Kaixiong Yu 10 Oct '24

10 Oct '24

Merge mainline commit e8068f2d756d("swiotlb: fix swiotlb_bounce() to do partial sync's correctly") and af133562d5a("swiotlb: extend buffer pre-padding to alloc_align_mask if necessary") Michael Kelley (1): swiotlb: fix swiotlb_bounce() to do partial sync's correctly Petr Tesarik (1): swiotlb: extend buffer pre-padding to alloc_align_mask if necessary kernel/dma/swiotlb.c | 87 +++++++++++++++++++++++++++++--------------- 1 file changed, 58 insertions(+), 29 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] btrfs: clean up our handling of refs == 0 in snapshot delete
by Baokun Li 10 Oct '24

10 Oct '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v6.6.51 commit 7d1df13bf078ffebfedd361d714ff6cee1ff01b9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NE CVE: CVE-2024-46840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b8ccef048354074a548f108e51d0557d6adfd3a3 ] In reada we BUG_ON(refs == 0), which could be unkind since we aren't holding a lock on the extent leaf and thus could get a transient incorrect answer. In walk_down_proc we also BUG_ON(refs == 0), which could happen if we have extent tree corruption. Change that to return -EUCLEAN. In do_walk_down() we catch this case and handle it correctly, however we return -EIO, which -EUCLEAN is a more appropriate error code. Finally in walk_up_proc we have the same BUG_ON(refs == 0), so convert that to proper error handling. Also adjust the error message so we can actually do something with the information. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/btrfs/extent-tree.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index c88907111d80..ebd07c3801af 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5086,7 +5086,15 @@ static noinline void reada_walk_down(struct btrfs_trans_handle *trans, /* We don't care about errors in readahead. */ if (ret < 0) continue; - BUG_ON(refs == 0); + + /* + * This could be racey, it's conceivable that we raced and end + * up with a bogus refs count, if that's the case just skip, if + * we are actually corrupt we will notice when we look up + * everything again with our locks. + */ + if (refs == 0) + continue; if (wc->stage == DROP_REFERENCE) { if (refs == 1) @@ -5152,7 +5160,11 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, &wc->flags[level]); if (ret) return ret; - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } } if (wc->stage == DROP_REFERENCE) { @@ -5286,8 +5298,9 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans, goto out_unlock; if (unlikely(wc->refs[level - 1] == 0)) { - btrfs_err(fs_info, "Missing references."); - ret = -EIO; + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + bytenr); + ret = -EUCLEAN; goto out_unlock; } *lookup_info = 0; @@ -5487,7 +5500,12 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, path->locks[level] = 0; return ret; } - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_tree_unlock_rw(eb, path->locks[level]); + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } if (wc->refs[level] == 1) { btrfs_tree_unlock_rw(eb, path->locks[level]); path->locks[level] = 0; -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] btrfs: clean up our handling of refs == 0 in snapshot delete
by Baokun Li 10 Oct '24

10 Oct '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v5.10.226 commit c60676b81fab456b672796830f6d8057058f029c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NE CVE: CVE-2024-46840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b8ccef048354074a548f108e51d0557d6adfd3a3 ] In reada we BUG_ON(refs == 0), which could be unkind since we aren't holding a lock on the extent leaf and thus could get a transient incorrect answer. In walk_down_proc we also BUG_ON(refs == 0), which could happen if we have extent tree corruption. Change that to return -EUCLEAN. In do_walk_down() we catch this case and handle it correctly, however we return -EIO, which -EUCLEAN is a more appropriate error code. Finally in walk_up_proc we have the same BUG_ON(refs == 0), so convert that to proper error handling. Also adjust the error message so we can actually do something with the information. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/btrfs/extent-tree.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 62956c24b4b5..8212c2440158 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -4796,7 +4796,15 @@ static noinline void reada_walk_down(struct btrfs_trans_handle *trans, /* We don't care about errors in readahead. */ if (ret < 0) continue; - BUG_ON(refs == 0); + + /* + * This could be racey, it's conceivable that we raced and end + * up with a bogus refs count, if that's the case just skip, if + * we are actually corrupt we will notice when we look up + * everything again with our locks. + */ + if (refs == 0) + continue; if (wc->stage == DROP_REFERENCE) { if (refs == 1) @@ -4862,7 +4870,11 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, &wc->flags[level]); if (ret) return ret; - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } } if (wc->stage == DROP_REFERENCE) { @@ -4995,8 +5007,9 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans, goto out_unlock; if (unlikely(wc->refs[level - 1] == 0)) { - btrfs_err(fs_info, "Missing references."); - ret = -EIO; + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + bytenr); + ret = -EUCLEAN; goto out_unlock; } *lookup_info = 0; @@ -5198,7 +5211,12 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, path->locks[level] = 0; return ret; } - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_tree_unlock_rw(eb, path->locks[level]); + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } if (wc->refs[level] == 1) { btrfs_tree_unlock_rw(eb, path->locks[level]); path->locks[level] = 0; -- 2.31.1

2 1

[PATCH OLK-5.10] btrfs: clean up our handling of refs == 0 in snapshot delete
by Baokun Li 10 Oct '24

10 Oct '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v5.10.226 commit c60676b81fab456b672796830f6d8057058f029c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NE CVE: CVE-2024-46840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b8ccef048354074a548f108e51d0557d6adfd3a3 ] In reada we BUG_ON(refs == 0), which could be unkind since we aren't holding a lock on the extent leaf and thus could get a transient incorrect answer. In walk_down_proc we also BUG_ON(refs == 0), which could happen if we have extent tree corruption. Change that to return -EUCLEAN. In do_walk_down() we catch this case and handle it correctly, however we return -EIO, which -EUCLEAN is a more appropriate error code. Finally in walk_up_proc we have the same BUG_ON(refs == 0), so convert that to proper error handling. Also adjust the error message so we can actually do something with the information. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/btrfs/extent-tree.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 854c7fa0fc06..12d2923da2b4 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -4808,7 +4808,15 @@ static noinline void reada_walk_down(struct btrfs_trans_handle *trans, /* We don't care about errors in readahead. */ if (ret < 0) continue; - BUG_ON(refs == 0); + + /* + * This could be racey, it's conceivable that we raced and end + * up with a bogus refs count, if that's the case just skip, if + * we are actually corrupt we will notice when we look up + * everything again with our locks. + */ + if (refs == 0) + continue; if (wc->stage == DROP_REFERENCE) { if (refs == 1) @@ -4874,7 +4882,11 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, &wc->flags[level]); if (ret) return ret; - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } } if (wc->stage == DROP_REFERENCE) { @@ -5007,8 +5019,9 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans, goto out_unlock; if (unlikely(wc->refs[level - 1] == 0)) { - btrfs_err(fs_info, "Missing references."); - ret = -EIO; + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + bytenr); + ret = -EUCLEAN; goto out_unlock; } *lookup_info = 0; @@ -5210,7 +5223,12 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, path->locks[level] = 0; return ret; } - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_tree_unlock_rw(eb, path->locks[level]); + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } if (wc->refs[level] == 1) { btrfs_tree_unlock_rw(eb, path->locks[level]); path->locks[level] = 0; -- 2.31.1

2 1

[openeuler:OLK-5.10 23034/30000] kernel/sched/topology.c:1749:2: error: implicit declaration of function 'register_sysctl_init'
by kernel test robot 10 Oct '24

10 Oct '24

Hi Tim, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c9c7afae6802fd2282529d80c0f808360f7b654a commit: f4128ae8e6ff03b4c805707fe75d0345797f7f53 [23034/30000] sched: Add cluster scheduler level for x86 config: x86_64-buildonly-randconfig-002-20241010 (https://download.01.org/0day-ci/archive/20241010/202410100921.MexAROBI-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241010/202410100921.MexAROBI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410100921.MexAROBI-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/topology.c:5: kernel/sched/sched.h:1838:15: warning: cast from 'void (*)(struct rq *)' to 'void (*)(struct callback_head *)' converts to incompatible function type [-Wcast-function-type-strict] 1838 | head->func = (void (*)(struct callback_head *))func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/topology.c:718:6: warning: variable 'numa_distance' set but not used [-Wunused-but-set-variable] 718 | int numa_distance = 0; | ^ >> kernel/sched/topology.c:1749:2: error: implicit declaration of function 'register_sysctl_init' [-Werror,-Wimplicit-function-declaration] 1749 | register_sysctl_init("kernel", sched_cluster_sysctls); | ^ 2 warnings and 1 error generated. vim +/register_sysctl_init +1749 kernel/sched/topology.c 8ce3e706b314091 Tim Chen 2021-12-03 1746 8ce3e706b314091 Tim Chen 2021-12-03 1747 static int __init sched_cluster_sysctl_init(void) 8ce3e706b314091 Tim Chen 2021-12-03 1748 { 8ce3e706b314091 Tim Chen 2021-12-03 @1749 register_sysctl_init("kernel", sched_cluster_sysctls); 8ce3e706b314091 Tim Chen 2021-12-03 1750 return 0; 8ce3e706b314091 Tim Chen 2021-12-03 1751 } 8ce3e706b314091 Tim Chen 2021-12-03 1752 late_initcall(sched_cluster_sysctl_init); 9e68cc2bf535a2f Tim Chen 2021-12-03 1753 :::::: The code at line 1749 was first introduced by commit :::::: 8ce3e706b31409147f035c037055caa68e450ce5 scheduler: Add runtime knob sysctl_sched_cluster :::::: TO: Tim Chen <tim.c.chen(a)linux.intel.com> :::::: CC: Jie Liu <liujie375(a)h-partners.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 4855/30000] fs/ntfs3/frecord.o: warning: objtool: .text.unlikely: unexpected end of section
by kernel test robot 10 Oct '24

10 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c9c7afae6802fd2282529d80c0f808360f7b654a commit: c213d417e466b7a7d9e02939bb67fcf5d82a3f2f [4855/30000] fs/ntfs3: Add NTFS3 in fs/Kconfig and fs/Makefile config: x86_64-buildonly-randconfig-004-20241010 (https://download.01.org/0day-ci/archive/20241010/202410100857.PsMQ97VM-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241010/202410100857.PsMQ97VM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410100857.PsMQ97VM-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/ntfs3/frecord.o: warning: objtool: .text.unlikely: unexpected end of section -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 18857/30000] security/integrity/ima/ima.h:381:16: warning: declaration of 'struct ima_digest' will not be visible outside of this function
by kernel test robot 10 Oct '24

10 Oct '24

Hi Zhou, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c9c7afae6802fd2282529d80c0f808360f7b654a commit: e94df9b790f7ed9025c9321f16a77044f66b14a5 [18857/30000] ima: Add macros to isolate the IMA digest list config: x86_64-randconfig-003-20241010 (https://download.01.org/0day-ci/archive/20241010/202410100850.oF7Ohlzy-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241010/202410100850.oF7Ohlzy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410100850.oF7Ohlzy-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from security/integrity/ima/ima_template.c:13: >> security/integrity/ima/ima.h:381:16: warning: declaration of 'struct ima_digest' will not be visible outside of this function [-Wvisibility] 381 | struct ima_digest *found_digest) | ^ 1 warning generated. -- In file included from security/integrity/ima/ima_asymmetric_keys.c:13: >> security/integrity/ima/ima.h:381:16: warning: declaration of 'struct ima_digest' will not be visible outside of this function [-Wvisibility] 381 | struct ima_digest *found_digest) | ^ security/integrity/ima/ima_asymmetric_keys.c:27:6: warning: no previous prototype for function 'ima_post_key_create_or_update' [-Wmissing-prototypes] 27 | void ima_post_key_create_or_update(struct key *keyring, struct key *key, | ^ security/integrity/ima/ima_asymmetric_keys.c:27:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 27 | void ima_post_key_create_or_update(struct key *keyring, struct key *key, | ^ | static 2 warnings generated. -- In file included from security/integrity/ima/ima_main.c:30: >> security/integrity/ima/ima.h:381:16: warning: declaration of 'struct ima_digest' will not be visible outside of this function [-Wvisibility] 381 | struct ima_digest *found_digest) | ^ security/integrity/ima/ima_main.c:440:29: error: too few arguments to function call, expected 8, have 7 433 | rc = ima_appraise_measurement(func, iint, file, | ~~~~~~~~~~~~~~~~~~~~~~~~ 434 | pathname, xattr_value, 435 | #ifdef CONFIG_IMA_DIGEST_LIST 436 | xattr_len, modsig, 437 | ima_digest_allow(found_digest, 438 | IMA_APPRAISE)); 439 | #else 440 | xattr_len, modsig); | ^ security/integrity/ima/ima.h:373:19: note: 'ima_appraise_measurement' declared here 373 | static inline int ima_appraise_measurement(enum ima_hooks func, | ^ ~~~~~~~~~~~~~~~~~~~~ 374 | struct integrity_iint_cache *iint, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 375 | struct file *file, | ~~~~~~~~~~~~~~~~~~ 376 | const unsigned char *filename, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 377 | struct evm_ima_xattr_data *xattr_value, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 378 | int xattr_len, | ~~~~~~~~~~~~~~ 379 | #ifndef CONFIG_IMA_DIGEST_LIST | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 380 | const struct modsig *modsig, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 381 | struct ima_digest *found_digest) | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning and 1 error generated. vim +381 security/integrity/ima/ima.h 273df864cf7466 Nayna Jain 2019-10-30 372 4ad87a3d7444de Mimi Zohar 2016-01-14 373 static inline int ima_appraise_measurement(enum ima_hooks func, d79d72e02485c0 Mimi Zohar 2012-12-03 374 struct integrity_iint_cache *iint, 2fe5d6def1672a Mimi Zohar 2012-02-13 375 struct file *file, d3634d0f426bde Dmitry Kasatkin 2013-04-25 376 const unsigned char *filename, d3634d0f426bde Dmitry Kasatkin 2013-04-25 377 struct evm_ima_xattr_data *xattr_value, 39b07096364a42 Thiago Jung Bauermann 2019-06-27 378 int xattr_len, e94df9b790f7ed Zhou Shuiqing 2023-09-06 379 #ifndef CONFIG_IMA_DIGEST_LIST a44c2ae6cac55b Roberto Sassu 2021-03-03 380 const struct modsig *modsig, a44c2ae6cac55b Roberto Sassu 2021-03-03 @381 struct ima_digest *found_digest) e94df9b790f7ed Zhou Shuiqing 2023-09-06 382 #else e94df9b790f7ed Zhou Shuiqing 2023-09-06 383 const struct modsig *modsig) e94df9b790f7ed Zhou Shuiqing 2023-09-06 384 #endif 2fe5d6def1672a Mimi Zohar 2012-02-13 385 { 2fe5d6def1672a Mimi Zohar 2012-02-13 386 return INTEGRITY_UNKNOWN; 2fe5d6def1672a Mimi Zohar 2012-02-13 387 } 2fe5d6def1672a Mimi Zohar 2012-02-13 388 :::::: The code at line 381 was first introduced by commit :::::: a44c2ae6cac55bdcc0d33f62600233ea0f3f6688 ima: Add support for appraisal with digest lists :::::: TO: Roberto Sassu <roberto.sassu(a)huawei.com> :::::: CC: Zheng Zengkai <zhengzengkai(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION bd281fec9a629fc56d2e07e32f8e719201dfc38f
by kernel test robot 10 Oct '24

10 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: bd281fec9a629fc56d2e07e32f8e719201dfc38f !12069 platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-001-20241010 | `-- arch-arm64-mm-init.c:error:mem_sleep_current-undeclared-(first-use-in-this-function) |-- arm64-randconfig-002-20241010 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:implicit-declaration-of-function-pci_disable_msi | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:implicit-declaration-of-function-pci_enable_msi | `-- mm-pin_mem.c:error:lvalue-required-as-unary-operand |-- arm64-randconfig-003-20241010 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- mm-mem_reliable.c:warning:zero-defined-but-not-used |-- arm64-randconfig-004-20241010 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-allnoconfig | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | `-- drivers-net-ethernet-stmicro-stmmac-dwmac-phytium.c:error:incompatible-pointer-to-integer-conversion-returning-void-from-a-function-with-result-type-int |-- x86_64-buildonly-randconfig-001-20241010 | `-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount |-- x86_64-buildonly-randconfig-002-20241010 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20241010 | |-- drivers-char-hw_random-zhaoxin-rng.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-char-ipmi-ipmi_si_intf.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-hwtracing-intel_th-msu-sink.o:warning:objtool:missing-symbol-for-section-.init.text | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20241010 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-kexec | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-161-20241010 `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity elapsed time: 828m configs tested: 18 configs skipped: 138 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241010 gcc-14.1.0 arm64 randconfig-002-20241010 gcc-14.1.0 arm64 randconfig-003-20241010 gcc-14.1.0 arm64 randconfig-004-20241010 gcc-14.1.0 x86_64 alldefconfig gcc-12 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20241010 gcc-12 x86_64 buildonly-randconfig-002-20241010 clang-18 x86_64 buildonly-randconfig-003-20241010 clang-18 x86_64 buildonly-randconfig-004-20241010 gcc-12 x86_64 buildonly-randconfig-005-20241010 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21254/23825] drivers/gpu/drm/phytium/phytium_pci.c:237:23: error: implicit declaration of function 'pci_enable_msi'; did you mean 'pci_enable_sriov'?
by kernel test robot 10 Oct '24

10 Oct '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bd281fec9a629fc56d2e07e32f8e719201dfc38f commit: cad0702e5286d3cc80afe545de027858b855dd5a [21254/23825] DRM: Phytium display DRM driver config: arm64-randconfig-002-20241010 (https://download.01.org/0day-ci/archive/20241010/202410100635.fEGuT7Zt-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241010/202410100635.fEGuT7Zt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410100635.fEGuT7Zt-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/gpu/drm/phytium/phytium_pci.c:23:6: warning: no previous prototype for 'phytium_pci_vram_hw_init' [-Wmissing-prototypes] 23 | void phytium_pci_vram_hw_init(struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c:30:5: warning: no previous prototype for 'phytium_pci_vram_init' [-Wmissing-prototypes] 30 | int phytium_pci_vram_init(struct pci_dev *pdev, struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c:68:6: warning: no previous prototype for 'phytium_pci_vram_fini' [-Wmissing-prototypes] 68 | void phytium_pci_vram_fini(struct pci_dev *pdev, struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c:89:5: warning: no previous prototype for 'phytium_pci_dma_init' [-Wmissing-prototypes] 89 | int phytium_pci_dma_init(struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c: In function 'phytium_pci_dma_init': drivers/gpu/drm/phytium/phytium_pci.c:99:34: error: 'PCI_VENDOR_ID_PHYTIUM' undeclared (first use in this function); did you mean 'PCI_VENDOR_ID_PHILIPS'? 99 | gpu_dev = pci_get_device(PCI_VENDOR_ID_PHYTIUM, 0xdc20, NULL); | ^~~~~~~~~~~~~~~~~~~~~ | PCI_VENDOR_ID_PHILIPS drivers/gpu/drm/phytium/phytium_pci.c:99:34: note: each undeclared identifier is reported only once for each function it appears in drivers/gpu/drm/phytium/phytium_pci.c: At top level: drivers/gpu/drm/phytium/phytium_pci.c:137:6: warning: no previous prototype for 'phytium_pci_dma_fini' [-Wmissing-prototypes] 137 | void phytium_pci_dma_fini(struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c: In function 'phytium_pci_probe': >> drivers/gpu/drm/phytium/phytium_pci.c:237:23: error: implicit declaration of function 'pci_enable_msi'; did you mean 'pci_enable_sriov'? [-Werror=implicit-function-declaration] 237 | ret = pci_enable_msi(pdev); | ^~~~~~~~~~~~~~ | pci_enable_sriov >> drivers/gpu/drm/phytium/phytium_pci.c:272:17: error: implicit declaration of function 'pci_disable_msi'; did you mean 'pci_disable_sriov'? [-Werror=implicit-function-declaration] 272 | pci_disable_msi(pdev); | ^~~~~~~~~~~~~~~ | pci_disable_sriov In file included from drivers/gpu/drm/phytium/phytium_pci.c:7: drivers/gpu/drm/phytium/phytium_pci.c: At top level: include/linux/pci.h:888:19: error: 'PCI_VENDOR_ID_PHYTIUM' undeclared here (not in a function); did you mean 'PCI_VENDOR_ID_PHILIPS'? 888 | .vendor = PCI_VENDOR_ID_##vend, .device = (dev), \ | ^~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c:375:11: note: in expansion of macro 'PCI_VDEVICE' 375 | { PCI_VDEVICE(PHYTIUM, 0xdc22), (kernel_ulong_t)&x100_info }, | ^~~~~~~~~~~ cc1: some warnings being treated as errors vim +237 drivers/gpu/drm/phytium/phytium_pci.c 88 89 int phytium_pci_dma_init(struct phytium_display_private *priv) 90 { 91 struct pci_dev *dma_dev, *gpu_dev; 92 struct drm_device *drm_dev = priv->dev; 93 dma_cap_mask_t mask; 94 struct phytium_dma_slave s; 95 int ret = 0; 96 u16 cmd; 97 98 /* check x100 gpu enable */ > 99 gpu_dev = pci_get_device(PCI_VENDOR_ID_PHYTIUM, 0xdc20, NULL); 100 if (!gpu_dev) { 101 DRM_INFO("failed to get gpu_dev\n"); 102 ret = -ENODEV; 103 goto failed; 104 } 105 106 pci_read_config_word(gpu_dev, PCI_COMMAND, &cmd); 107 if (!(cmd & PCI_COMMAND_MASTER)) { 108 DRM_INFO("gpu_dev master is disabled\n"); 109 ret = -ENODEV; 110 goto failed; 111 } 112 113 dma_dev = pci_get_device(PCI_VENDOR_ID_PHYTIUM, 0xdc3c, NULL); 114 if (!dma_dev) { 115 DRM_INFO("failed to get dma_dev\n"); 116 ret = -ENODEV; 117 goto failed; 118 } 119 120 dma_cap_zero(mask); 121 dma_cap_set(DMA_SLAVE, mask); 122 123 s.dma_dev = &dma_dev->dev; 124 s.chan_id = 2; 125 priv->dma_chan = dma_request_channel(mask, phytium_pci_dma_chan_filter, &s); 126 if (!priv->dma_chan) { 127 DRM_DEV_ERROR(drm_dev->dev, "failed to request dma chan\n"); 128 ret = -EBUSY; 129 goto failed; 130 } 131 priv->dma_inited = 1; 132 133 failed: 134 return ret; 135 } 136 > 137 void phytium_pci_dma_fini(struct phytium_display_private *priv) 138 { 139 if (priv->dma_inited) 140 dma_release_channel(priv->dma_chan); 141 priv->dma_inited = 0; 142 priv->dma_chan = NULL; 143 } 144 145 static struct phytium_display_private* 146 phytium_pci_private_init(struct pci_dev *pdev, const struct pci_device_id *ent) 147 { 148 struct drm_device *dev = pci_get_drvdata(pdev); 149 struct phytium_display_private *priv = NULL; 150 struct phytium_pci_private *pci_priv = NULL; 151 struct phytium_device_info *phytium_info = (struct phytium_device_info *)ent->driver_data; 152 int i = 0; 153 resource_size_t io_addr, io_size; 154 155 pci_priv = devm_kzalloc(&pdev->dev, sizeof(*pci_priv), GFP_KERNEL); 156 if (!pci_priv) { 157 DRM_ERROR("no memory to allocate for drm_display_private\n"); 158 goto failed_malloc_priv; 159 } 160 161 memset(pci_priv, 0, sizeof(*pci_priv)); 162 priv = &pci_priv->base; 163 phytium_display_private_init(priv, dev); 164 165 memcpy(&(priv->info), phytium_info, sizeof(struct phytium_device_info)); 166 DRM_DEBUG_KMS("priv->info.num_pipes :%d\n", priv->info.num_pipes); 167 priv->info.pipe_mask = ((pdev->subsystem_device >> PIPE_MASK_SHIFT) & PIPE_MASK_MASK); 168 priv->info.edp_mask = ((pdev->subsystem_device >> EDP_MASK_SHIFT) & EDP_MASK_MASK); 169 priv->info.num_pipes = 0; 170 for_each_pipe_masked(priv, i) 171 priv->info.num_pipes++; 172 if (priv->info.num_pipes == 0) { 173 DRM_ERROR("num_pipes is zero, so exit init\n"); 174 goto failed_init_numpipe; 175 } 176 177 io_addr = pci_resource_start(pdev, 0); 178 io_size = pci_resource_len(pdev, 0); 179 priv->regs = ioremap(io_addr, io_size); 180 if (priv->regs == NULL) { 181 DRM_ERROR("pci bar0 ioremap fail, addr:0x%llx, size:0x%llx\n", io_addr, io_size); 182 goto failed_ioremap; 183 } 184 185 priv->irq = pdev->irq; 186 if (IS_X100(priv)) { 187 pci_priv->dc_hw_vram_init = x100_dc_hw_vram_init; 188 priv->dc_hw_clear_msi_irq = x100_dc_hw_clear_msi_irq; 189 priv->dc_hw_fb_format_check = x100_dc_hw_fb_format_check; 190 } else if (IS_E2000(priv)) { 191 pci_priv->dc_hw_vram_init = e2000_dc_hw_vram_init; 192 priv->dc_hw_clear_msi_irq = NULL; 193 priv->dc_hw_fb_format_check = e2000_dc_hw_fb_format_check; 194 } 195 196 return priv; 197 198 failed_ioremap: 199 failed_init_numpipe: 200 devm_kfree(&pdev->dev, pci_priv); 201 failed_malloc_priv: 202 return NULL; 203 } 204 205 static void 206 phytium_pci_private_fini(struct pci_dev *pdev, struct phytium_display_private *priv) 207 { 208 struct phytium_pci_private *pci_priv = to_pci_priv(priv); 209 210 if (priv->regs) 211 iounmap(priv->regs); 212 213 devm_kfree(&pdev->dev, pci_priv); 214 } 215 216 static int phytium_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) 217 { 218 struct phytium_display_private *priv = NULL; 219 struct drm_device *dev = NULL; 220 int ret = 0; 221 222 dev = drm_dev_alloc(&phytium_display_drm_driver, &pdev->dev); 223 if (IS_ERR(dev)) { 224 DRM_ERROR("failed to allocate drm_device\n"); 225 return PTR_ERR(dev); 226 } 227 dev->pdev = pdev; 228 pci_set_drvdata(pdev, dev); 229 pci_set_master(pdev); 230 ret = pci_enable_device(pdev); 231 if (ret) { 232 DRM_ERROR("pci enbale device fail\n"); 233 goto failed_enable_device; 234 } 235 236 if (dc_msi_enable) { > 237 ret = pci_enable_msi(pdev); 238 if (ret) 239 DRM_ERROR("pci enbale msi fail\n"); 240 } 241 242 dma_set_mask(&pdev->dev, DMA_BIT_MASK(40)); 243 244 priv = phytium_pci_private_init(pdev, ent); 245 if (priv) 246 dev->dev_private = priv; 247 else 248 goto failed_pci_private_init; 249 250 ret = phytium_pci_vram_init(pdev, priv); 251 if (ret) { 252 DRM_ERROR("failed to init pci vram\n"); 253 goto failed_pci_vram_init; 254 } 255 256 ret = drm_dev_register(dev, 0); 257 if (ret) { 258 DRM_ERROR("failed to register drm dev\n"); 259 goto failed_register_drm; 260 } 261 262 phytium_dp_hpd_irq_setup(dev, true); 263 264 return 0; 265 266 failed_register_drm: 267 phytium_pci_vram_fini(pdev, priv); 268 failed_pci_vram_init: 269 phytium_pci_private_fini(pdev, priv); 270 failed_pci_private_init: 271 if (pdev->msi_enabled) > 272 pci_disable_msi(pdev); 273 pci_disable_device(pdev); 274 failed_enable_device: 275 pci_set_drvdata(pdev, NULL); 276 drm_dev_put(dev); 277 278 return -1; 279 } 280 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3405/14324] drivers/gpu/drm/phytium/phytium_pci.c:236:9: error: call to undeclared function 'pci_enable_msi'; ISO C99 and later do not support implicit function declarations
by kernel test robot 10 Oct '24

10 Oct '24

Hi Li, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 5d76abff5e121f2d916bcbc121f558c82e5dc221 commit: 792b82446538ed840a6e23b89673ce21564702bd [3405/14324] Fix gic support for Phytium S2500 config: arm64-randconfig-002-20241010 (https://download.01.org/0day-ci/archive/20241010/202410100523.x3WsGWyG-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 70e0a7e7e6a8541bcc46908c592eed561850e416) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241010/202410100523.x3WsGWyG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410100523.x3WsGWyG-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/gpu/drm/phytium/phytium_pci.c:7: In file included from include/linux/pci.h:2106: In file included from arch/arm64/include/asm/pci.h:7: In file included from include/linux/dma-mapping.h:11: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ drivers/gpu/drm/phytium/phytium_pci.c:23:6: warning: no previous prototype for function 'phytium_pci_vram_hw_init' [-Wmissing-prototypes] 23 | void phytium_pci_vram_hw_init(struct phytium_display_private *priv) | ^ drivers/gpu/drm/phytium/phytium_pci.c:23:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 23 | void phytium_pci_vram_hw_init(struct phytium_display_private *priv) | ^ | static drivers/gpu/drm/phytium/phytium_pci.c:30:5: warning: no previous prototype for function 'phytium_pci_vram_init' [-Wmissing-prototypes] 30 | int phytium_pci_vram_init(struct pci_dev *pdev, struct phytium_display_private *priv) | ^ drivers/gpu/drm/phytium/phytium_pci.c:30:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 30 | int phytium_pci_vram_init(struct pci_dev *pdev, struct phytium_display_private *priv) | ^ | static drivers/gpu/drm/phytium/phytium_pci.c:68:6: warning: no previous prototype for function 'phytium_pci_vram_fini' [-Wmissing-prototypes] 68 | void phytium_pci_vram_fini(struct pci_dev *pdev, struct phytium_display_private *priv) | ^ drivers/gpu/drm/phytium/phytium_pci.c:68:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 68 | void phytium_pci_vram_fini(struct pci_dev *pdev, struct phytium_display_private *priv) | ^ | static drivers/gpu/drm/phytium/phytium_pci.c:89:5: warning: no previous prototype for function 'phytium_pci_dma_init' [-Wmissing-prototypes] 89 | int phytium_pci_dma_init(struct phytium_display_private *priv) | ^ drivers/gpu/drm/phytium/phytium_pci.c:89:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 89 | int phytium_pci_dma_init(struct phytium_display_private *priv) | ^ | static drivers/gpu/drm/phytium/phytium_pci.c:137:6: warning: no previous prototype for function 'phytium_pci_dma_fini' [-Wmissing-prototypes] 137 | void phytium_pci_dma_fini(struct phytium_display_private *priv) | ^ drivers/gpu/drm/phytium/phytium_pci.c:137:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 137 | void phytium_pci_dma_fini(struct phytium_display_private *priv) | ^ | static >> drivers/gpu/drm/phytium/phytium_pci.c:236:9: error: call to undeclared function 'pci_enable_msi'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 236 | ret = pci_enable_msi(pdev); | ^ >> drivers/gpu/drm/phytium/phytium_pci.c:271:3: error: call to undeclared function 'pci_disable_msi'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 271 | pci_disable_msi(pdev); | ^ drivers/gpu/drm/phytium/phytium_pci.c:271:3: note: did you mean 'pci_disable_sriov'? include/linux/pci.h:2437:20: note: 'pci_disable_sriov' declared here 2437 | static inline void pci_disable_sriov(struct pci_dev *dev) { } | ^ drivers/gpu/drm/phytium/phytium_pci.c:291:3: error: call to undeclared function 'pci_disable_msi'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 291 | pci_disable_msi(pdev); | ^ 6 warnings and 3 errors generated. vim +/pci_enable_msi +236 drivers/gpu/drm/phytium/phytium_pci.c b80df10f845813 lishuo 2024-01-31 215 b80df10f845813 lishuo 2024-01-31 216 static int phytium_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) b80df10f845813 lishuo 2024-01-31 217 { b80df10f845813 lishuo 2024-01-31 218 struct phytium_display_private *priv = NULL; b80df10f845813 lishuo 2024-01-31 219 struct drm_device *dev = NULL; b80df10f845813 lishuo 2024-01-31 220 int ret = 0; b80df10f845813 lishuo 2024-01-31 221 b80df10f845813 lishuo 2024-01-31 222 dev = drm_dev_alloc(&phytium_display_drm_driver, &pdev->dev); b80df10f845813 lishuo 2024-01-31 223 if (IS_ERR(dev)) { b80df10f845813 lishuo 2024-01-31 224 DRM_ERROR("failed to allocate drm_device\n"); b80df10f845813 lishuo 2024-01-31 225 return PTR_ERR(dev); b80df10f845813 lishuo 2024-01-31 226 } b80df10f845813 lishuo 2024-01-31 227 pci_set_drvdata(pdev, dev); b80df10f845813 lishuo 2024-01-31 228 pci_set_master(pdev); b80df10f845813 lishuo 2024-01-31 229 ret = pci_enable_device(pdev); b80df10f845813 lishuo 2024-01-31 230 if (ret) { b80df10f845813 lishuo 2024-01-31 231 DRM_ERROR("pci enable device fail\n"); b80df10f845813 lishuo 2024-01-31 232 goto failed_enable_device; b80df10f845813 lishuo 2024-01-31 233 } b80df10f845813 lishuo 2024-01-31 234 b80df10f845813 lishuo 2024-01-31 235 if (dc_msi_enable) { b80df10f845813 lishuo 2024-01-31 @236 ret = pci_enable_msi(pdev); b80df10f845813 lishuo 2024-01-31 237 if (ret) b80df10f845813 lishuo 2024-01-31 238 DRM_ERROR("pci enable msi fail\n"); b80df10f845813 lishuo 2024-01-31 239 } b80df10f845813 lishuo 2024-01-31 240 b80df10f845813 lishuo 2024-01-31 241 dma_set_mask(&pdev->dev, DMA_BIT_MASK(40)); b80df10f845813 lishuo 2024-01-31 242 b80df10f845813 lishuo 2024-01-31 243 priv = phytium_pci_private_init(pdev, ent); b80df10f845813 lishuo 2024-01-31 244 if (priv) b80df10f845813 lishuo 2024-01-31 245 dev->dev_private = priv; b80df10f845813 lishuo 2024-01-31 246 else b80df10f845813 lishuo 2024-01-31 247 goto failed_pci_private_init; b80df10f845813 lishuo 2024-01-31 248 b80df10f845813 lishuo 2024-01-31 249 ret = phytium_pci_vram_init(pdev, priv); b80df10f845813 lishuo 2024-01-31 250 if (ret) { b80df10f845813 lishuo 2024-01-31 251 DRM_ERROR("failed to init pci vram\n"); b80df10f845813 lishuo 2024-01-31 252 goto failed_pci_vram_init; b80df10f845813 lishuo 2024-01-31 253 } b80df10f845813 lishuo 2024-01-31 254 b80df10f845813 lishuo 2024-01-31 255 ret = drm_dev_register(dev, 0); b80df10f845813 lishuo 2024-01-31 256 if (ret) { b80df10f845813 lishuo 2024-01-31 257 DRM_ERROR("failed to register drm dev\n"); b80df10f845813 lishuo 2024-01-31 258 goto failed_register_drm; b80df10f845813 lishuo 2024-01-31 259 } b80df10f845813 lishuo 2024-01-31 260 b80df10f845813 lishuo 2024-01-31 261 phytium_dp_hpd_irq_setup(dev, true); b80df10f845813 lishuo 2024-01-31 262 b80df10f845813 lishuo 2024-01-31 263 return 0; b80df10f845813 lishuo 2024-01-31 264 b80df10f845813 lishuo 2024-01-31 265 failed_register_drm: b80df10f845813 lishuo 2024-01-31 266 phytium_pci_vram_fini(pdev, priv); b80df10f845813 lishuo 2024-01-31 267 failed_pci_vram_init: b80df10f845813 lishuo 2024-01-31 268 phytium_pci_private_fini(pdev, priv); b80df10f845813 lishuo 2024-01-31 269 failed_pci_private_init: b80df10f845813 lishuo 2024-01-31 270 if (pdev->msi_enabled) b80df10f845813 lishuo 2024-01-31 @271 pci_disable_msi(pdev); b80df10f845813 lishuo 2024-01-31 272 pci_disable_device(pdev); b80df10f845813 lishuo 2024-01-31 273 failed_enable_device: b80df10f845813 lishuo 2024-01-31 274 pci_set_drvdata(pdev, NULL); b80df10f845813 lishuo 2024-01-31 275 drm_dev_put(dev); b80df10f845813 lishuo 2024-01-31 276 b80df10f845813 lishuo 2024-01-31 277 return -1; b80df10f845813 lishuo 2024-01-31 278 } b80df10f845813 lishuo 2024-01-31 279 :::::: The code at line 236 was first introduced by commit :::::: b80df10f845813bb4fc2002b5386ecdfa8be5f6c DRM: Phytium display DRM driver :::::: TO: lishuo <lishuo(a)phytium.com.cn> :::::: CC: lishuo <lishuo(a)phytium.com.cn> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION c9c7afae6802fd2282529d80c0f808360f7b654a
by kernel test robot 10 Oct '24

10 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: c9c7afae6802fd2282529d80c0f808360f7b654a !12050 um: line: always fill *error_out in setup_one_line() Unverified Error/Warning (likely false positive, kindly check if interested): drivers/gpu/drm/loongson/lsdc_plane.o: warning: objtool: lsdc_plane_init() falls through to next function lsdc_plane_reset() drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.o: warning: objtool: pvrdma_create_qp() falls through to next function pvrdma_destroy_qp() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-defconfig | `-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_main.c:warning:implicit-conversion-from-enum-hclge_ext_opcode_type-to-enum-hclge_opcode_type |-- arm64-randconfig-002-20241010 | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-003-20241010 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-x16-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- x86_64-allnoconfig | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- kernel-sched-core.c:warning:no-previous-prototype-for-function-sched_setsteal | |-- kernel-sched-core.c:warning:no-previous-prototype-for-function-tg_change_steal | |-- ld.lld:error:duplicate-symbol:debug | |-- ld.lld:error:duplicate-symbol:lld_dev_hold | `-- ld.lld:error:duplicate-symbol:lld_dev_put |-- x86_64-buildonly-randconfig-001-20241010 | `-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init |-- x86_64-buildonly-randconfig-002-20241010 | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20241009 | `-- drivers-gpu-drm-loongson-lsdc_plane.o:warning:objtool:lsdc_plane_init-falls-through-to-next-function-lsdc_plane_reset() |-- x86_64-buildonly-randconfig-006-20241010 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-kexec | `-- arch-x86-kvm-vmx-vmx.o:warning:objtool:fix_rmode_seg:unreachable-instruction |-- x86_64-randconfig-016-20241009 | `-- drivers-fpga-dfl.o:warning:objtool:dfl_fpga_cdev_config_ports_pf:unreachable-instruction |-- x86_64-randconfig-075-20241009 | `-- drivers-infiniband-hw-vmw_pvrdma-pvrdma_qp.o:warning:objtool:pvrdma_create_qp-falls-through-to-next-function-pvrdma_destroy_qp() |-- x86_64-rhel-8.3 | `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target |-- x86_64-rhel-8.3-func | `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target `-- x86_64-rhel-8.3-kselftests `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target elapsed time: 805m configs tested: 19 configs skipped: 138 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20241010 clang-20 arm64 randconfig-002-20241010 clang-20 arm64 randconfig-003-20241010 clang-20 arm64 randconfig-004-20241010 clang-20 x86_64 alldefconfig gcc-12 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20241010 gcc-12 x86_64 buildonly-randconfig-002-20241010 clang-18 x86_64 buildonly-randconfig-003-20241010 clang-18 x86_64 buildonly-randconfig-004-20241010 gcc-12 x86_64 buildonly-randconfig-006-20241010 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 5d76abff5e121f2d916bcbc121f558c82e5dc221
by kernel test robot 10 Oct '24

10 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 5d76abff5e121f2d916bcbc121f558c82e5dc221 !12063 cpufreq: intel_pstate: Revise global turbo disable check Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-001-20241010 | |-- mm-share_pool.c:error:call-to-undeclared-function-huge_ptep_get-ISO-C99-and-later-do-not-support-implicit-function-declarations | `-- mm-share_pool.c:error:initializing-pte_t-with-an-expression-of-incompatible-type-int |-- arm64-randconfig-002-20241010 | |-- drivers-char-ipmi-ipmi_bt_sm.c:error:call-to-undeclared-function-acpi_evaluate_integer-ISO-C99-and-later-do-not-support-implicit-function-declarations | |-- drivers-ptp-ptp_hisi.c:warning:unused-variable-hisi_ptp_acpi_match | `-- kernel-cgroup-cgroup.c:error:use-of-undeclared-identifier-cgroup_psi_stat_show |-- loongarch-allmodconfig | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | `-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- x86_64-allyesconfig | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-buildonly-randconfig-001-20241010 | `-- drivers-crypto-ccp-hygon-hct.c:error:struct-device-has-no-member-named-numa_node |-- x86_64-buildonly-randconfig-002-20241010 | `-- include-linux-psp-hygon.h:error:conflicting-types-for-vpsp_try_do_cmd |-- x86_64-rhel-8.3 | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-func | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-kselftests | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst `-- x86_64-rhel-8.3-rust |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst elapsed time: 778m configs tested: 16 configs skipped: 101 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241010 clang-20 arm64 randconfig-002-20241010 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 x86_64 alldefconfig gcc-12 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20241010 gcc-12 x86_64 buildonly-randconfig-002-20241010 clang-18 x86_64 buildonly-randconfig-003-20241010 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ELF: fix kernel.randomize_va_space double read
by Gu Bowen 09 Oct '24

09 Oct '24

From: Alexey Dobriyan <adobriyan(a)gmail.com> stable inclusion from stable-v6.6.51 commit 53f17409abf61f66b6f05aff795e938e5ba811d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NT CVE: CVE-2024-46826 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2a97388a807b6ab5538aa8f8537b2463c6988bd2 ] ELF loader uses "randomize_va_space" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with unpredictable consequences. Issue exactly one load for consistent value across one exec. Signed-off-by: Alexey Dobriyan <adobriyan(a)gmail.com> Link: https://lore.kernel.org/r/3329905c-7eb8-400a-8f0a-d87cff979b5b@p183 Signed-off-by: Kees Cook <kees(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- fs/binfmt_elf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 7b3d2d491407..fb2c8d14327a 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -1008,7 +1008,8 @@ static int load_elf_binary(struct linux_binprm *bprm) if (elf_read_implies_exec(*elf_ex, executable_stack)) current->personality |= READ_IMPLIES_EXEC; - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) + const int snapshot_randomize_va_space = READ_ONCE(randomize_va_space); + if (!(current->personality & ADDR_NO_RANDOMIZE) && snapshot_randomize_va_space) current->flags |= PF_RANDOMIZE; setup_new_exec(bprm); @@ -1300,7 +1301,7 @@ static int load_elf_binary(struct linux_binprm *bprm) mm->end_data = end_data; mm->start_stack = bprm->p; - if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) { + if ((current->flags & PF_RANDOMIZE) && (snapshot_randomize_va_space > 1)) { /* * For architectures with ELF randomization, when executing * a loader directly (i.e. no interpreter listed in ELF -- 2.25.1

2 1

[PATCH OLK-6.6] drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ
by liwei 09 Oct '24

09 Oct '24

From: Marek Vasut <marex(a)denx.de> mainline inclusion from mainline-v6.11-rc1 commit 162e48cb1d84c2c966b649b8ac5c9d4f75f6d44f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAUAT8 CVE: CVE-2024-46810 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Make sure the connector is fully initialized before signalling any HPD events via drm_kms_helper_hotplug_event(), otherwise this may lead to NULL pointer dereference. Signed-off-by: Marek Vasut <marex(a)denx.de> Reviewed-by: Robert Foss <rfoss(a)kernel.org> Signed-off-by: Robert Foss <rfoss(a)kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240531203333.277476-1-marex… Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/gpu/drm/bridge/tc358767.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c index d941c3a0e611..7fd4a5fe03ed 100644 --- a/drivers/gpu/drm/bridge/tc358767.c +++ b/drivers/gpu/drm/bridge/tc358767.c @@ -2034,7 +2034,7 @@ static irqreturn_t tc_irq_handler(int irq, void *arg) dev_err(tc->dev, "syserr %x\n", stat); } - if (tc->hpd_pin >= 0 && tc->bridge.dev) { + if (tc->hpd_pin >= 0 && tc->bridge.dev && tc->aux.drm_dev) { /* * H is triggered when the GPIO goes high. * -- 2.25.1

2 1

[PATCH OLK-5.10] blk-mq: fix lockdep hardirq warning in __blk_mq_tag_idle()
by Yu Kuai 09 Oct '24

09 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAVONP CVE: NA -------------------------------- commit c6f9c0e2d53d ("blk-mq: allow hardware queue to get more tag while sharing a tag set") started to call blk_mq_tag_idle() from hardirq context. And later commit 1b6433f06bda ("blk-mq: fix potential io hang by wrong 'wake_batch'") add spin_unlock_irq() in blk_mq_tag_idle(), which may enable interrupt in hardirq context, and may trigger AA deadlock. Fixes: 1b6433f06bda ("blk-mq: fix potential io hang by wrong 'wake_batch'") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- block/blk-mq-tag.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c index 73c046bc3d90..dd4f9bdcb8c2 100644 --- a/block/blk-mq-tag.c +++ b/block/blk-mq-tag.c @@ -85,6 +85,7 @@ void __blk_mq_tag_idle(struct blk_mq_hw_ctx *hctx) { struct blk_mq_tags *tags = hctx->tags; unsigned int users; + unsigned long flags; if (blk_mq_is_sbitmap_shared(hctx->flags)) { struct request_queue *q = hctx->queue; @@ -97,10 +98,10 @@ void __blk_mq_tag_idle(struct blk_mq_hw_ctx *hctx) return; } - spin_lock_irq(&tags->lock); + spin_lock_irqsave(&tags->lock, flags); users = atomic_dec_return(&tags->active_queues); blk_mq_update_wake_batch(tags, users); - spin_unlock_irq(&tags->lock); + spin_unlock_irqrestore(&tags->lock, flags); blk_mq_tag_wakeup_all(tags, false); } -- 2.39.2

2 1

[PATCH OLK-6.6] drm/amd/display: Check index for aux_rd_interval before using
by Qi Xi 09 Oct '24

09 Oct '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit 9ba2ea6337b4f159aecb177555a6a81da92d302e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV7O CVE: CVE-2024-46728 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- aux_rd_interval has size of 7 and should be checked. This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- .../gpu/drm/amd/display/dc/link/protocols/link_dp_training.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c index 16a62e018712..9d1adfc09fb2 100644 --- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c +++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c @@ -914,10 +914,10 @@ static enum dc_status configure_lttpr_mode_non_transparent( /* Driver does not need to train the first hop. Skip DPCD read and clear * AUX_RD_INTERVAL for DPTX-to-DPIA hop. */ - if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA) + if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA && repeater_cnt > 0 && repeater_cnt < MAX_REPEATER_CNT) link->dpcd_caps.lttpr_caps.aux_rd_interval[--repeater_cnt] = 0; - for (repeater_id = repeater_cnt; repeater_id > 0; repeater_id--) { + for (repeater_id = repeater_cnt; repeater_id > 0 && repeater_id < MAX_REPEATER_CNT; repeater_id--) { aux_interval_address = DP_TRAINING_AUX_RD_INTERVAL_PHY_REPEATER1 + ((DP_REPEATER_CONFIGURATION_AND_STATUS_SIZE) * (repeater_id - 1)); core_link_read_dpcd( -- 2.25.1

2 1

[PATCH OLK-5.10] kprobes: Fix deadlock issue with kmemleak
by Zheng Yejian 09 Oct '24

09 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9K8D1 ----------------------------------------- There is following deadlock issue: CPU0 CPU1 ==== ==== kretprobe_trampoline kmem_cache_alloc trampoline_handler kmemleak_alloc __kretprobe_trampoline_handler create_object kretprobe_hash_lock <-- hold kmemleak lock <-- hold kretprobe table lock __link_object recycle_rp_inst stack_trace_save kfree_rcu kvfree_call_rcu ... kmemleak_ignore unwind_next_frame kretprobe_find_ret_addr <-- wait for kmemleak lock kretprobe_hash_lock <-- wait for kretprobe table lock One task on CPU0 hold kretprobe_hash_lock and wait for kmemleak_lock, however, kmemleak_lock was held by other task on CPU1 and that task is waiting for kretprobe_hash_lock, then deadlock happended. To fix it, move kfree_rcu() out of kretprobe table lock area. Fixes: 88fef946364b ("kprobes: Add kretprobe_find_ret_addr() for searching return address") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/kprobes.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index dacb71214fa1..5d64d97975ba 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1223,7 +1223,7 @@ void kprobes_inc_nmissed_count(struct kprobe *p) } NOKPROBE_SYMBOL(kprobes_inc_nmissed_count); -static void recycle_rp_inst(struct kretprobe_instance *ri) +static void recycle_rp_inst(struct kretprobe_instance *ri, struct hlist_head *head) { struct kretprobe *rp = ri->rp; @@ -1235,7 +1235,7 @@ static void recycle_rp_inst(struct kretprobe_instance *ri) hlist_add_head(&ri->hlist, &rp->free_instances); raw_spin_unlock(&rp->lock); } else - kfree_rcu(ri, rcu); + hlist_add_head(&ri->hlist, head); } NOKPROBE_SYMBOL(recycle_rp_inst); @@ -1326,6 +1326,7 @@ void kprobe_flush_task(struct task_struct *tk) struct hlist_head *head; struct hlist_node *tmp; unsigned long hash, flags = 0; + HLIST_HEAD(empty_rp); if (unlikely(!kprobes_initialized)) /* Early boot. kretprobe_table_locks not yet initialized. */ @@ -1338,10 +1339,16 @@ void kprobe_flush_task(struct task_struct *tk) kretprobe_table_lock(hash, &flags); hlist_for_each_entry_safe(ri, tmp, head, hlist) { if (ri->task == tk) - recycle_rp_inst(ri); + recycle_rp_inst(ri, &empty_rp); } kretprobe_table_unlock(hash, &flags); + hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) { + hlist_del(&ri->hlist); + INIT_HLIST_NODE(&ri->hlist); + kfree_rcu(ri, rcu); + } + kprobe_busy_end(); } NOKPROBE_SYMBOL(kprobe_flush_task); @@ -2014,6 +2021,7 @@ unsigned long __kretprobe_trampoline_handler(struct pt_regs *regs, unsigned long flags; kprobe_opcode_t *correct_ret_addr = NULL; bool skipped = false; + HLIST_HEAD(empty_rp); kretprobe_hash_lock(current, &head, &flags); @@ -2082,7 +2090,7 @@ unsigned long __kretprobe_trampoline_handler(struct pt_regs *regs, __this_cpu_write(current_kprobe, prev); } - recycle_rp_inst(ri); + recycle_rp_inst(ri, &empty_rp); if (ri == last) break; @@ -2090,6 +2098,12 @@ unsigned long __kretprobe_trampoline_handler(struct pt_regs *regs, kretprobe_hash_unlock(current, &flags); + hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) { + hlist_del(&ri->hlist); + INIT_HLIST_NODE(&ri->hlist); + kfree_rcu(ri, rcu); + } + return (unsigned long)correct_ret_addr; } NOKPROBE_SYMBOL(__kretprobe_trampoline_handler) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] btrfs: clean up our handling of refs == 0 in snapshot delete
by Baokun Li 09 Oct '24

09 Oct '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v4.19.322 commit c847b28a799733b04574060ab9d00f215970627d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NE CVE: CVE-2024-46840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b8ccef048354074a548f108e51d0557d6adfd3a3 ] In reada we BUG_ON(refs == 0), which could be unkind since we aren't holding a lock on the extent leaf and thus could get a transient incorrect answer. In walk_down_proc we also BUG_ON(refs == 0), which could happen if we have extent tree corruption. Change that to return -EUCLEAN. In do_walk_down() we catch this case and handle it correctly, however we return -EIO, which -EUCLEAN is a more appropriate error code. Finally in walk_up_proc we have the same BUG_ON(refs == 0), so convert that to proper error handling. Also adjust the error message so we can actually do something with the information. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/btrfs/extent-tree.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index e579e19ebd4b..8207c202e498 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -8400,7 +8400,15 @@ static noinline void reada_walk_down(struct btrfs_trans_handle *trans, /* We don't care about errors in readahead. */ if (ret < 0) continue; - BUG_ON(refs == 0); + + /* + * This could be racey, it's conceivable that we raced and end + * up with a bogus refs count, if that's the case just skip, if + * we are actually corrupt we will notice when we look up + * everything again with our locks. + */ + if (refs == 0) + continue; if (wc->stage == DROP_REFERENCE) { if (refs == 1) @@ -8467,7 +8475,11 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, BUG_ON(ret == -ENOMEM); if (ret) return ret; - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } } if (wc->stage == DROP_REFERENCE) { @@ -8575,8 +8587,9 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans, goto out_unlock; if (unlikely(wc->refs[level - 1] == 0)) { - btrfs_err(fs_info, "Missing references."); - ret = -EIO; + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + bytenr); + ret = -EUCLEAN; goto out_unlock; } *lookup_info = 0; @@ -8744,7 +8757,12 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, path->locks[level] = 0; return ret; } - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_tree_unlock_rw(eb, path->locks[level]); + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } if (wc->refs[level] == 1) { btrfs_tree_unlock_rw(eb, path->locks[level]); path->locks[level] = 0; -- 2.31.1

2 1

[openeuler:OLK-5.10 11219/30000] vmlinux.o: warning: objtool: do_syscall_64()+0x46: call to memset() leaves .noinstr.text section
by kernel test robot 09 Oct '24

09 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 411e7ef551c128efdf5b4e53cc01245ba85b3817 commit: 130620d5878d2348208258965876547a69353f9f [11219/30000] x86/entry: Enable random_kstack_offset support config: x86_64-buildonly-randconfig-006-20241009 (https://download.01.org/0day-ci/archive/20241009/202410091420.7w9TkxwA-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241009/202410091420.7w9TkxwA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410091420.7w9TkxwA-lkp@intel.com/ All warnings (new ones prefixed by >>): >> vmlinux.o: warning: objtool: do_syscall_64()+0x46: call to memset() leaves .noinstr.text section vmlinux.o: warning: objtool: fixup_bad_iret()+0x36: call to memset() leaves .noinstr.text section ld.lld: error: undefined symbol: __tsan_memset >>> referenced by do_mounts.c >>> do_mounts.o:(name_to_dev_t) in archive init/built-in.a >>> referenced by do_mounts.c >>> do_mounts.o:(mount_block_root) in archive init/built-in.a >>> referenced by vsyscall_64.c >>> entry/vsyscall/vsyscall_64.o:(trace_event_raw_event_emulate_vsyscall) in archive arch/x86/built-in.a >>> referenced 14932 more times -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

openEuler Kernel SIG双周例会
by openEuler conference 09 Oct '24

09 Oct '24

您好！ Kernel 邀请您参加 2024-10-11 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复此邮件申报，也可直接填写至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/960499088 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-10-11 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复此邮件申报，也可直接填写至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/960499088. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

2024

2023

2022

2021

2020

2019