- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] vt: fix unicode buffer corruption when deleting characters
by Xiang Yang 23 May '24

23 May '24

From: Nicolas Pitre <nico(a)fluxnic.net> stable inclusion from stable-v4.19.312 commit fc7dfe3d123f00e720be80b920da287810a1f37d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q994 CVE: CVE-2024-35823 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… commit 1581dafaf0d34bc9c428a794a22110d7046d186d upstream. This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting chars in the buffer"). The cure is also the same i.e. replace memcpy() with memmove() due to the overlaping buffers. Signed-off-by: Nicolas Pitre <nico(a)fluxnic.net> Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition") Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/sn184on2-3p0q-0qrq-0218-895349s4753o@syhkavp.arg Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/tty/vt/vt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 163186cbfe79..12ddd82f0dad 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -405,7 +405,7 @@ static void vc_uniscr_delete(struct vc_data *vc, unsigned int nr) char32_t *ln = uniscr->lines[vc->vc_y]; unsigned int x = vc->vc_x, cols = vc->vc_cols; - memcpy(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); + memmove(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); memset32(&ln[cols - nr], ' ', nr); } } -- 2.34.1

2 1

[PATCH OLK-5.10 v3 0/4] arm64: Allow CPU0 to be nohz_full
by Xiongfeng Wang 23 May '24

23 May '24

Changelog: v1->v2: change __setup() to early_param() v2->v3: fix kabi because #include <linux/sched/isolation.h> modify defconfig Xiongfeng Wang (4): isolation: Do not check whether housekeeping CPUs are present isolation: Check whether all the housekeeping CPUs are online arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default arm64: defconfig: Enable CONFIG_ARCH_SUSPEND_NONZERO_CPU arch/arm64/Kconfig | 3 ++ arch/arm64/configs/openeuler_defconfig | 2 ++ include/linux/cpu.h | 5 +++- include/linux/sched/isolation.h | 5 ++++ kernel/sched/isolation.c | 39 +++++++++++++++++++++++--- kernel/smp.c | 4 +++ kernel/time/tick-sched.c | 5 +++- 7 files changed, 57 insertions(+), 6 deletions(-) -- 2.30.0

2 5

[PATCH OLK-5.10 v4] eeprom: at24: fix memory corruption race condition
by Wenyu Huang 23 May '24

23 May '24

From: Daniel Okazaki <dtokazaki(a)google.com> stable inclusion from stable-v5.10.217 commit c850f71fca09ea41800ed55905980063d17e01da category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9F4 CVE: CVE-2024-35848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ] If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Signed-off-by: Daniel Okazaki <dtokazaki(a)google.com> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/misc/eeprom/at24.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 305ffad131a2..c43072b2e9b6 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -757,14 +757,6 @@ static int at24_probe(struct i2c_client *client) pm_runtime_set_active(dev); pm_runtime_enable(dev); - at24->nvmem = devm_nvmem_register(dev, &nvmem_config); - if (IS_ERR(at24->nvmem)) { - pm_runtime_disable(dev); - if (!pm_runtime_status_suspended(dev)) - regulator_disable(at24->vcc_reg); - return PTR_ERR(at24->nvmem); - } - /* * Perform a one-byte test read to verify that the * chip is functional. @@ -777,6 +769,14 @@ static int at24_probe(struct i2c_client *client) return -ENODEV; } + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); + if (!pm_runtime_status_suspended(dev)) + regulator_disable(at24->vcc_reg); + return PTR_ERR(at24->nvmem); + } + pm_runtime_idle(dev); if (writable) -- 2.34.1

2 1

[PATCH OLK-5.10 v3] eeprom: at24: fix memory corruption race condition
by Wenyu Huang 23 May '24

23 May '24

From: Daniel Okazaki <dtokazaki(a)google.com> stable inclusion from stable-v5.10.159 commit c850f71fca09ea41800ed55905980063d17e01da category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9F4 CVE: CVE-2024-35848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ] If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Signed-off-by: Daniel Okazaki <dtokazaki(a)google.com> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/misc/eeprom/at24.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 305ffad131a2..c43072b2e9b6 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -757,14 +757,6 @@ static int at24_probe(struct i2c_client *client) pm_runtime_set_active(dev); pm_runtime_enable(dev); - at24->nvmem = devm_nvmem_register(dev, &nvmem_config); - if (IS_ERR(at24->nvmem)) { - pm_runtime_disable(dev); - if (!pm_runtime_status_suspended(dev)) - regulator_disable(at24->vcc_reg); - return PTR_ERR(at24->nvmem); - } - /* * Perform a one-byte test read to verify that the * chip is functional. @@ -777,6 +769,14 @@ static int at24_probe(struct i2c_client *client) return -ENODEV; } + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); + if (!pm_runtime_status_suspended(dev)) + regulator_disable(at24->vcc_reg); + return PTR_ERR(at24->nvmem); + } + pm_runtime_idle(dev); if (writable) -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-35999
by Yifan Qiao 23 May '24

23 May '24

Shyam Prasad N (1): cifs: protect session channel fields with chan_lock Steve French (1): smb3: missing lock when picking channel fs/cifs/cifsglob.h | 5 +++++ fs/cifs/cifs_debug.c | 2 ++ fs/cifs/connect.c | 25 +++++++++++++++++++--- fs/cifs/misc.c | 1 + fs/cifs/sess.c | 50 +++++++++++++++++++++++++++++++++----------- fs/cifs/transport.c | 10 +++++++-- 6 files changed, 76 insertions(+), 17 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
by Zhao Mengmeng 23 May '24

23 May '24

From: Jiri Benc <jbenc(a)redhat.com> stable inclusion from stable-v5.10.216 commit 3fb02ec57ead2891a2306af8c51a306bc5945e70 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRPL CVE: CVE-2024-35969 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7633c4da919ad51164acbf1aa322cc1a3ead6129 ] Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The memory itself of such item is not freed thanks to RCU but nothing guarantees the actual content of the memory is sane. In particular, the reference count can be zero. This can happen if ipv6_del_addr is called in parallel. ipv6_del_addr removes the entry from inet6_addr_lst (hlist_del_init_rcu(&ifp->addr_lst)) and drops all references (__in6_ifa_put(ifp) + in6_ifa_put(ifp)). With bad enough timing, this can happen: 1. In ipv6_get_ifaddr, hlist_for_each_entry_rcu returns an entry. 2. Then, the whole ipv6_del_addr is executed for the given entry. The reference count drops to zero and kfree_rcu is scheduled. 3. ipv6_get_ifaddr continues and tries to increments the reference count (in6_ifa_hold). 4. The rcu is unlocked and the entry is freed. 5. The freed entry is returned. Prevent increasing of the reference count in such case. The name in6_ifa_hold_safe is chosen to mimic the existing fib6_info_hold_safe. [ 41.506330] refcount_t: addition on 0; use-after-free. [ 41.506760] WARNING: CPU: 0 PID: 595 at lib/refcount.c:25 refcount_warn_saturate+0xa5/0x130 [ 41.507413] Modules linked in: veth bridge stp llc [ 41.507821] CPU: 0 PID: 595 Comm: python3 Not tainted 6.9.0-rc2.main-00208-g49563be82afa #14 [ 41.508479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) [ 41.509163] RIP: 0010:refcount_warn_saturate+0xa5/0x130 [ 41.509586] Code: ad ff 90 0f 0b 90 90 c3 cc cc cc cc 80 3d c0 30 ad 01 00 75 a0 c6 05 b7 30 ad 01 01 90 48 c7 c7 38 cc 7a 8c e8 cc 18 ad ff 90 <0f> 0b 90 90 c3 cc cc cc cc 80 3d 98 30 ad 01 00 0f 85 75 ff ff ff [ 41.510956] RSP: 0018:ffffbda3c026baf0 EFLAGS: 00010282 [ 41.511368] RAX: 0000000000000000 RBX: ffff9e9c46914800 RCX: 0000000000000000 [ 41.511910] RDX: ffff9e9c7ec29c00 RSI: ffff9e9c7ec1c900 RDI: ffff9e9c7ec1c900 [ 41.512445] RBP: ffff9e9c43660c9c R08: 0000000000009ffb R09: 00000000ffffdfff [ 41.512998] R10: 00000000ffffdfff R11: ffffffff8ca58a40 R12: ffff9e9c4339a000 [ 41.513534] R13: 0000000000000001 R14: ffff9e9c438a0000 R15: ffffbda3c026bb48 [ 41.514086] FS: 00007fbc4cda1740(0000) GS:ffff9e9c7ec00000(0000) knlGS:0000000000000000 [ 41.514726] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.515176] CR2: 000056233b337d88 CR3: 000000000376e006 CR4: 0000000000370ef0 [ 41.515713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.516252] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.516799] Call Trace: [ 41.517037] <TASK> [ 41.517249] ? __warn+0x7b/0x120 [ 41.517535] ? refcount_warn_saturate+0xa5/0x130 [ 41.517923] ? report_bug+0x164/0x190 [ 41.518240] ? handle_bug+0x3d/0x70 [ 41.518541] ? exc_invalid_op+0x17/0x70 [ 41.520972] ? asm_exc_invalid_op+0x1a/0x20 [ 41.521325] ? refcount_warn_saturate+0xa5/0x130 [ 41.521708] ipv6_get_ifaddr+0xda/0xe0 [ 41.522035] inet6_rtm_getaddr+0x342/0x3f0 [ 41.522376] ? __pfx_inet6_rtm_getaddr+0x10/0x10 [ 41.522758] rtnetlink_rcv_msg+0x334/0x3d0 [ 41.523102] ? netlink_unicast+0x30f/0x390 [ 41.523445] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 41.523832] netlink_rcv_skb+0x53/0x100 [ 41.524157] netlink_unicast+0x23b/0x390 [ 41.524484] netlink_sendmsg+0x1f2/0x440 [ 41.524826] __sys_sendto+0x1d8/0x1f0 [ 41.525145] __x64_sys_sendto+0x1f/0x30 [ 41.525467] do_syscall_64+0xa5/0x1b0 [ 41.525794] entry_SYSCALL_64_after_hwframe+0x72/0x7a [ 41.526213] RIP: 0033:0x7fbc4cfcea9a [ 41.526528] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 [ 41.527942] RSP: 002b:00007ffcf54012a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 41.528593] RAX: ffffffffffffffda RBX: 00007ffcf5401368 RCX: 00007fbc4cfcea9a [ 41.529173] RDX: 000000000000002c RSI: 00007fbc4b9d9bd0 RDI: 0000000000000005 [ 41.529786] RBP: 00007fbc4bafb040 R08: 00007ffcf54013e0 R09: 000000000000000c [ 41.530375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.530977] R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007fbc4ca85d1b [ 41.531573] </TASK> Fixes: 5c578aedcb21d ("IPv6: convert addrconf hash list to RCU") Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: Jiri Benc <jbenc(a)redhat.com> Link: https://lore.kernel.org/r/8ab821e36073a4a406c50ec83c9e8dc586c539e4.17125858… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- include/net/addrconf.h | 4 ++++ net/ipv6/addrconf.c | 7 ++++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/include/net/addrconf.h b/include/net/addrconf.h index edba74a53683..a24c65e9a994 100644 --- a/include/net/addrconf.h +++ b/include/net/addrconf.h @@ -429,6 +429,10 @@ static inline void in6_ifa_hold(struct inet6_ifaddr *ifp) refcount_inc(&ifp->refcnt); } +static inline bool in6_ifa_hold_safe(struct inet6_ifaddr *ifp) +{ + return refcount_inc_not_zero(&ifp->refcnt); +} /* * compute link-local solicited-node multicast address diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 5e42149b954f..821aa81dec47 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -2033,9 +2033,10 @@ struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *add if (ipv6_addr_equal(&ifp->addr, addr)) { if (!dev || ifp->idev->dev == dev || !(ifp->scope&(IFA_LINK|IFA_HOST) || strict)) { - result = ifp; - in6_ifa_hold(ifp); - break; + if (in6_ifa_hold_safe(ifp)) { + result = ifp; + break; + } } } } -- 2.33.0

2 1

[PATCH OLK-6.6] Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
by Zhao Mengmeng 23 May '24

23 May '24

From: Sungwoo Kim <iam(a)sung-woo.kim> mainline inclusion from mainline-v6.9 commit 4d7b41c0e43995b0e992b9f8903109275744b658 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RMPS CVE: CVE-2024-36013 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Extend a critical section to prevent chan from early freeing. Also make the l2cap_connect() return type void. Nothing is using the returned value but it is ugly to return a potentially freed pointer. Making it void will help with backports because earlier kernels did use the return value. Now the compile will break for kernels where this patch is not a complete fix. Call stack summary: [use] l2cap_bredr_sig_cmd l2cap_connect ┌ mutex_lock(&conn->chan_lock); │ chan = pchan->ops->new_connection(pchan); <- alloc chan │ __l2cap_chan_add(conn, chan); │ l2cap_chan_hold(chan); │ list_add(&chan->list, &conn->chan_l); ... (1) └ mutex_unlock(&conn->chan_lock); chan->conf_state ... (4) <- use after free [free] l2cap_conn_del ┌ mutex_lock(&conn->chan_lock); │ foreach chan in conn->chan_l: ... (2) │ l2cap_chan_put(chan); │ l2cap_chan_destroy │ kfree(chan) ... (3) <- chan freed └ mutex_unlock(&conn->chan_lock); ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0 net/bluetooth/l2cap_core.c:4260 Read of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311 Fixes: 73ffa904b782 ("Bluetooth: Move conf_{req,rsp} stuff to struct l2cap_chan") Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- net/bluetooth/l2cap_core.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 706d2478ddb3..edf83e886b82 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -3902,13 +3902,12 @@ static inline int l2cap_command_rej(struct l2cap_conn *conn, return 0; } -static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, - struct l2cap_cmd_hdr *cmd, - u8 *data, u8 rsp_code, u8 amp_id) +static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, + u8 *data, u8 rsp_code, u8 amp_id) { struct l2cap_conn_req *req = (struct l2cap_conn_req *) data; struct l2cap_conn_rsp rsp; - struct l2cap_chan *chan = NULL, *pchan; + struct l2cap_chan *chan = NULL, *pchan = NULL; int result, status = L2CAP_CS_NO_INFO; u16 dcid = 0, scid = __le16_to_cpu(req->scid); @@ -3921,7 +3920,7 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, &conn->hcon->dst, ACL_LINK); if (!pchan) { result = L2CAP_CR_BAD_PSM; - goto sendresp; + goto response; } mutex_lock(&conn->chan_lock); @@ -4008,17 +4007,15 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, } response: - l2cap_chan_unlock(pchan); - mutex_unlock(&conn->chan_lock); - l2cap_chan_put(pchan); - -sendresp: rsp.scid = cpu_to_le16(scid); rsp.dcid = cpu_to_le16(dcid); rsp.result = cpu_to_le16(result); rsp.status = cpu_to_le16(status); l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp); + if (!pchan) + return; + if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) { struct l2cap_info_req info; info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); @@ -4041,7 +4038,9 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, chan->num_conf_req++; } - return chan; + l2cap_chan_unlock(pchan); + mutex_unlock(&conn->chan_lock); + l2cap_chan_put(pchan); } static int l2cap_connect_req(struct l2cap_conn *conn, -- 2.33.0

2 1

[PATCH OLK-5.10 v2] eeprom: at24: fix memory corruption race condition
by Wenyu Huang 23 May '24

23 May '24

From: Daniel Okazaki <dtokazaki(a)google.com> stable inclusion from stable-v5.15.159 commit c850f71fca09ea41800ed55905980063d17e01da category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9F4 CVE: CVE-2024-35848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ] If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Signed-off-by: Daniel Okazaki <dtokazaki(a)google.com> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/misc/eeprom/at24.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 305ffad131a2..c43072b2e9b6 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -757,14 +757,6 @@ static int at24_probe(struct i2c_client *client) pm_runtime_set_active(dev); pm_runtime_enable(dev); - at24->nvmem = devm_nvmem_register(dev, &nvmem_config); - if (IS_ERR(at24->nvmem)) { - pm_runtime_disable(dev); - if (!pm_runtime_status_suspended(dev)) - regulator_disable(at24->vcc_reg); - return PTR_ERR(at24->nvmem); - } - /* * Perform a one-byte test read to verify that the * chip is functional. @@ -777,6 +769,14 @@ static int at24_probe(struct i2c_client *client) return -ENODEV; } + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); + if (!pm_runtime_status_suspended(dev)) + regulator_disable(at24->vcc_reg); + return PTR_ERR(at24->nvmem); + } + pm_runtime_idle(dev); if (writable) -- 2.34.1

2 1

[PATCH OLK-5.10 0/5] CVE-2024-35995
by liwei 23 May '24

23 May '24

CVE-2024-35995 Jarred White (2): ACPI: CPPC: Use access_width over bit_width for system memory accesses ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro Rafael J. Wysocki (1): ACPI: CPPC: Fix up I/O port access in cpc_read() Steven Noonan (1): ACPI: CPPC: Implement support for SystemIO registers Vanshidhar Konda (1): ACPI: CPPC: Fix access width used for PCC registers drivers/acpi/cppc_acpi.c | 174 +++++++++++++++++++++++++++++---------- 1 file changed, 132 insertions(+), 42 deletions(-) -- 2.25.1

2 6

[PATCH OLK-6.6] Bluetooth: HCI: Fix potential null-ptr-deref
by Zhao Mengmeng 23 May '24

23 May '24

From: Sungwoo Kim <iam(a)sung-woo.kim> stable inclusion from stable-v6.6.31 commit 1f7ebb69c1d65732bcac2fda9d15421f76f01e81 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RMQS CVE: CVE-2024-36011 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d2706004a1b8b526592e823d7e52551b518a7941 ] Fix potential null-ptr-deref in hci_le_big_sync_established_evt(). Fixes: f777d8827817 (Bluetooth: ISO: Notify user space about failed bis connections) Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- net/bluetooth/hci_event.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 1b4abf8e90f6..9274d3255049 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -7200,6 +7200,8 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data, u16 handle = le16_to_cpu(ev->bis[i]); bis = hci_conn_hash_lookup_handle(hdev, handle); + if (!bis) + continue; set_bit(HCI_CONN_BIG_SYNC_FAILED, &bis->flags); hci_connect_cfm(bis, ev->status); -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS 0/5] CVE-2024-35995
by liwei 23 May '24

23 May '24

CVE-2024-35995 Jarred White (2): ACPI: CPPC: Use access_width over bit_width for system memory accesses ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro Rafael J. Wysocki (1): ACPI: CPPC: Fix up I/O port access in cpc_read() Steven Noonan (1): ACPI: CPPC: Implement support for SystemIO registers Vanshidhar Konda (1): ACPI: CPPC: Fix access width used for PCC registers drivers/acpi/cppc_acpi.c | 174 +++++++++++++++++++++++++++++---------- 1 file changed, 132 insertions(+), 42 deletions(-) -- 2.25.1

2 6

[PATCH openEuler-1.0-LTS] media: bttv: fix use after free error due to btv->timeout timer
by Ye Bin 23 May '24

23 May '24

From: Zheng Wang <zyytlz.wz(a)163.com> mainline inclusion from mainline-v6.7-rc1 commit bd5b50b329e850d467e7bcc07b2b6bde3752fbda category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFON CVE: CVE-2023-52847 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There may be some a race condition between timer function bttv_irq_timeout and bttv_remove. The timer is setup in probe and there is no timer_delete operation in remove function. When it hit kfree btv, the function might still be invoked, which will cause use after free bug. This bug is found by static analysis, it may be false positive. Fix it by adding del_timer_sync invoking to the remove function. cpu0 cpu1 bttv_probe ->timer_setup ->bttv_set_dma ->mod_timer; bttv_remove ->kfree(btv); ->bttv_irq_timeout ->USE btv Fixes: 162e6376ac58 ("media: pci: Convert timers to use timer_setup()") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/media/pci/bt8xx/bttv-driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c index cf05e11da01b..00400f58d9c4 100644 --- a/drivers/media/pci/bt8xx/bttv-driver.c +++ b/drivers/media/pci/bt8xx/bttv-driver.c @@ -4293,6 +4293,7 @@ static void bttv_remove(struct pci_dev *pci_dev) /* free resources */ free_irq(btv->c.pci->irq,btv); + del_timer_sync(&btv->timeout); iounmap(btv->bt848_mmio); release_mem_region(pci_resource_start(btv->c.pci,0), pci_resource_len(btv->c.pci,0)); -- 2.31.1

2 1

[PATCH OLK-6.6] Bluetooth: msft: fix slab-use-after-free in msft_do_close()
by Zhao Mengmeng 23 May '24

23 May '24

From: Sungwoo Kim <iam(a)sung-woo.kim> stable inclusion from stable-v6.6.31 commit a85a60e62355e3bf4802dead7938966824b23940 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RMR9 CVE: CVE-2024-36012 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 10f9f426ac6e752c8d87bf4346930ba347aaabac ] Tying the msft->data lifetime to hdev by freeing it in hci_release_dev() to fix the following case: [use] msft_do_close() msft = hdev->msft_data; if (!msft) ...(1) <- passed. return; mutex_lock(&msft->filter_lock); ...(4) <- used after freed. [free] msft_unregister() msft = hdev->msft_data; hdev->msft_data = NULL; ...(2) kfree(msft); ...(3) <- msft is freed. ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f/0xc30 kernel/locking/mutex.c:752 Read of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309 Fixes: bf6a4e30ffbd ("Bluetooth: disable advertisement filters during suspend") Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- net/bluetooth/hci_core.c | 3 +-- net/bluetooth/msft.c | 2 +- net/bluetooth/msft.h | 4 ++-- 3 files changed, 4 insertions(+), 5 deletions(-) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 0592369579ab..befe645d3f9b 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -2736,8 +2736,6 @@ void hci_unregister_dev(struct hci_dev *hdev) hci_unregister_suspend_notifier(hdev); - msft_unregister(hdev); - hci_dev_do_close(hdev); if (!test_bit(HCI_INIT, &hdev->flags) && @@ -2791,6 +2789,7 @@ void hci_release_dev(struct hci_dev *hdev) hci_discovery_filter_clear(hdev); hci_blocked_keys_clear(hdev); hci_codec_list_clear(&hdev->local_codecs); + msft_release(hdev); hci_dev_unlock(hdev); ida_destroy(&hdev->unset_handle_ida); diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c index 9612c5d1b13f..d039683d3bdd 100644 --- a/net/bluetooth/msft.c +++ b/net/bluetooth/msft.c @@ -769,7 +769,7 @@ void msft_register(struct hci_dev *hdev) mutex_init(&msft->filter_lock); } -void msft_unregister(struct hci_dev *hdev) +void msft_release(struct hci_dev *hdev) { struct msft_data *msft = hdev->msft_data; diff --git a/net/bluetooth/msft.h b/net/bluetooth/msft.h index 2a63205b377b..fe538e9c91c0 100644 --- a/net/bluetooth/msft.h +++ b/net/bluetooth/msft.h @@ -14,7 +14,7 @@ bool msft_monitor_supported(struct hci_dev *hdev); void msft_register(struct hci_dev *hdev); -void msft_unregister(struct hci_dev *hdev); +void msft_release(struct hci_dev *hdev); void msft_do_open(struct hci_dev *hdev); void msft_do_close(struct hci_dev *hdev); void msft_vendor_evt(struct hci_dev *hdev, void *data, struct sk_buff *skb); @@ -35,7 +35,7 @@ static inline bool msft_monitor_supported(struct hci_dev *hdev) } static inline void msft_register(struct hci_dev *hdev) {} -static inline void msft_unregister(struct hci_dev *hdev) {} +static inline void msft_release(struct hci_dev *hdev) {} static inline void msft_do_open(struct hci_dev *hdev) {} static inline void msft_do_close(struct hci_dev *hdev) {} static inline void msft_vendor_evt(struct hci_dev *hdev, void *data, -- 2.33.0

2 1

[PATCH OLK-5.10] drm/i915/gt: Reset queue_priority_hint on parking
by Wenyu Huang 23 May '24

23 May '24

From: Chris Wilson <chris(a)chris-wilson.co.uk> stable inclusion from stable-v5.10.216 commit fe34587acc995e7b1d7a5d3444a0736721ec32b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5FX CVE: CVE-2024-26937 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4a3859ea5240365d21f6053ee219bb240d520895 upstream. Originally, with strict in order execution, we could complete execution only when the queue was empty. Preempt-to-busy allows replacement of an active request that may complete before the preemption is processed by HW. If that happens, the request is retired from the queue, but the queue_priority_hint remains set, preventing direct submission until after the next CS interrupt is processed. This preempt-to-busy race can be triggered by the heartbeat, which will also act as the power-management barrier and upon completion allow us to idle the HW. We may process the completion of the heartbeat, and begin parking the engine before the CS event that restores the queue_priority_hint, causing us to fail the assertion that it is MIN. <3>[ 166.210729] __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1)) <0>[ 166.210781] Dumping ftrace buffer: <0>[ 166.210795] --------------------------------- ... <0>[ 167.302811] drm_fdin-1097 2..s1. 165741070us : trace_ports: 0000:00:02.0 rcs0: promote { ccid:20 1217:2 prio 0 } <0>[ 167.302861] drm_fdin-1097 2d.s2. 165741072us : execlists_submission_tasklet: 0000:00:02.0 rcs0: preempting last=1217:2, prio=0, hint=2147483646 <0>[ 167.302928] drm_fdin-1097 2d.s2. 165741072us : __i915_request_unsubmit: 0000:00:02.0 rcs0: fence 1217:2, current 0 <0>[ 167.302992] drm_fdin-1097 2d.s2. 165741073us : __i915_request_submit: 0000:00:02.0 rcs0: fence 3:4660, current 4659 <0>[ 167.303044] drm_fdin-1097 2d.s1. 165741076us : execlists_submission_tasklet: 0000:00:02.0 rcs0: context:3 schedule-in, ccid:40 <0>[ 167.303095] drm_fdin-1097 2d.s1. 165741077us : trace_ports: 0000:00:02.0 rcs0: submit { ccid:40 3:4660* prio 2147483646 } <0>[ 167.303159] kworker/-89 11..... 165741139us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence c90:2, current 2 <0>[ 167.303208] kworker/-89 11..... 165741148us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:c90 unpin <0>[ 167.303272] kworker/-89 11..... 165741159us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 1217:2, current 2 <0>[ 167.303321] kworker/-89 11..... 165741166us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:1217 unpin <0>[ 167.303384] kworker/-89 11..... 165741170us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 3:4660, current 4660 <0>[ 167.303434] kworker/-89 11d..1. 165741172us : __intel_context_retire: 0000:00:02.0 rcs0: context:1216 retire runtime: { total:56028ns, avg:56028ns } <0>[ 167.303484] kworker/-89 11..... 165741198us : __engine_park: 0000:00:02.0 rcs0: parked <0>[ 167.303534] <idle>-0 5d.H3. 165741207us : execlists_irq_handler: 0000:00:02.0 rcs0: semaphore yield: 00000040 <0>[ 167.303583] kworker/-89 11..... 165741397us : __intel_context_retire: 0000:00:02.0 rcs0: context:1217 retire runtime: { total:325575ns, avg:0ns } <0>[ 167.303756] kworker/-89 11..... 165741777us : __intel_context_retire: 0000:00:02.0 rcs0: context:c90 retire runtime: { total:0ns, avg:0ns } <0>[ 167.303806] kworker/-89 11..... 165742017us : __engine_park: __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1)) <0>[ 167.303811] --------------------------------- <4>[ 167.304722] ------------[ cut here ]------------ <2>[ 167.304725] kernel BUG at drivers/gpu/drm/i915/gt/intel_engine_pm.c:283! <4>[ 167.304731] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI <4>[ 167.304734] CPU: 11 PID: 89 Comm: kworker/11:1 Tainted: G W 6.8.0-rc2-CI_DRM_14193-gc655e0fd2804+ #1 <4>[ 167.304736] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022 <4>[ 167.304738] Workqueue: i915-unordered retire_work_handler [i915] <4>[ 167.304839] RIP: 0010:__engine_park+0x3fd/0x680 [i915] <4>[ 167.304937] Code: 00 48 c7 c2 b0 e5 86 a0 48 8d 3d 00 00 00 00 e8 79 48 d4 e0 bf 01 00 00 00 e8 ef 0a d4 e0 31 f6 bf 09 00 00 00 e8 03 49 c0 e0 <0f> 0b 0f 0b be 01 00 00 00 e8 f5 61 fd ff 31 c0 e9 34 fd ff ff 48 <4>[ 167.304940] RSP: 0018:ffffc9000059fce0 EFLAGS: 00010246 <4>[ 167.304942] RAX: 0000000000000200 RBX: 0000000000000000 RCX: 0000000000000006 <4>[ 167.304944] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000009 <4>[ 167.304946] RBP: ffff8881330ca1b0 R08: 0000000000000001 R09: 0000000000000001 <4>[ 167.304947] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8881330ca000 <4>[ 167.304948] R13: ffff888110f02aa0 R14: ffff88812d1d0205 R15: ffff88811277d4f0 <4>[ 167.304950] FS: 0000000000000000(0000) GS:ffff88844f780000(0000) knlGS:0000000000000000 <4>[ 167.304952] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 167.304953] CR2: 00007fc362200c40 CR3: 000000013306e003 CR4: 0000000000770ef0 <4>[ 167.304955] PKRU: 55555554 <4>[ 167.304957] Call Trace: <4>[ 167.304958] <TASK> <4>[ 167.305573] ____intel_wakeref_put_last+0x1d/0x80 [i915] <4>[ 167.305685] i915_request_retire.part.0+0x34f/0x600 [i915] <4>[ 167.305800] retire_requests+0x51/0x80 [i915] <4>[ 167.305892] intel_gt_retire_requests_timeout+0x27f/0x700 [i915] <4>[ 167.305985] process_scheduled_works+0x2db/0x530 <4>[ 167.305990] worker_thread+0x18c/0x350 <4>[ 167.305993] kthread+0xfe/0x130 <4>[ 167.305997] ret_from_fork+0x2c/0x50 <4>[ 167.306001] ret_from_fork_asm+0x1b/0x30 <4>[ 167.306004] </TASK> It is necessary for the queue_priority_hint to be lower than the next request submission upon waking up, as we rely on the hint to decide when to kick the tasklet to submit that first request. Fixes: 22b7a426bbe1 ("drm/i915/execlists: Preempt-to-busy") Closes: https://gitlab.freedesktop.org/drm/intel/issues/10154 Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Cc: Mika Kuoppala <mika.kuoppala(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> # v5.4+ Reviewed-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Reviewed-by: Andi Shyti <andi.shyti(a)linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240318135906.716055-2-janus… (cherry picked from commit 98850e96cf811dc2d0a7d0af491caff9f5d49c1e) Signed-off-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/gpu/drm/i915/gt/intel_engine_pm.c | 3 --- drivers/gpu/drm/i915/gt/intel_lrc.c | 3 +++ 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/gt/intel_engine_pm.c b/drivers/gpu/drm/i915/gt/intel_engine_pm.c index f7b2e07e2229..f9fdbd79c0f3 100644 --- a/drivers/gpu/drm/i915/gt/intel_engine_pm.c +++ b/drivers/gpu/drm/i915/gt/intel_engine_pm.c @@ -250,9 +250,6 @@ static int __engine_park(struct intel_wakeref *wf) intel_engine_park_heartbeat(engine); intel_breadcrumbs_park(engine->breadcrumbs); - /* Must be reset upon idling, or we may miss the busy wakeup. */ - GEM_BUG_ON(engine->execlists.queue_priority_hint != INT_MIN); - if (engine->park) engine->park(engine); diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c index ee9b33c3aff8..5a414d989dca 100644 --- a/drivers/gpu/drm/i915/gt/intel_lrc.c +++ b/drivers/gpu/drm/i915/gt/intel_lrc.c @@ -5032,6 +5032,9 @@ static void execlists_park(struct intel_engine_cs *engine) { cancel_timer(&engine->execlists.timer); cancel_timer(&engine->execlists.preempt); + + /* Reset upon idling, or we may delay the busy wakeup. */ + WRITE_ONCE(engine->execlists.queue_priority_hint, INT_MIN); } void intel_execlists_set_default_submission(struct intel_engine_cs *engine) -- 2.34.1

2 1

[PATCH OLK-5.10] netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
by Zhao Wenhui 23 May '24

23 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit d1261bde59a3a087ab0c81181821e194278d9264 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q91I CVE: CVE-2024-27428 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 119cae5ea3f9e35cdada8e572cc067f072fa825a ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- net/netrom/nr_dev.c | 2 +- net/netrom/nr_out.c | 2 +- net/netrom/nr_subr.c | 5 +++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/net/netrom/nr_dev.c b/net/netrom/nr_dev.c index 29e418c8c6c3..4caee8754b79 100644 --- a/net/netrom/nr_dev.c +++ b/net/netrom/nr_dev.c @@ -81,7 +81,7 @@ static int nr_header(struct sk_buff *skb, struct net_device *dev, buff[6] |= AX25_SSSID_SPARE; buff += AX25_ADDR_LEN; - *buff++ = sysctl_netrom_network_ttl_initialiser; + *buff++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); *buff++ = NR_PROTO_IP; *buff++ = NR_PROTO_IP; diff --git a/net/netrom/nr_out.c b/net/netrom/nr_out.c index 44929657f5b7..5e531394a724 100644 --- a/net/netrom/nr_out.c +++ b/net/netrom/nr_out.c @@ -204,7 +204,7 @@ void nr_transmit_buffer(struct sock *sk, struct sk_buff *skb) dptr[6] |= AX25_SSSID_SPARE; dptr += AX25_ADDR_LEN; - *dptr++ = sysctl_netrom_network_ttl_initialiser; + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); if (!nr_route_frame(skb, NULL)) { kfree_skb(skb); diff --git a/net/netrom/nr_subr.c b/net/netrom/nr_subr.c index e2d2af924cff..c3bbd5880850 100644 --- a/net/netrom/nr_subr.c +++ b/net/netrom/nr_subr.c @@ -182,7 +182,8 @@ void nr_write_internal(struct sock *sk, int frametype) *dptr++ = nr->my_id; *dptr++ = frametype; *dptr++ = nr->window; - if (nr->bpqext) *dptr++ = sysctl_netrom_network_ttl_initialiser; + if (nr->bpqext) + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); break; case NR_DISCREQ: @@ -236,7 +237,7 @@ void __nr_transmit_reply(struct sk_buff *skb, int mine, unsigned char cmdflags) dptr[6] |= AX25_SSSID_SPARE; dptr += AX25_ADDR_LEN; - *dptr++ = sysctl_netrom_network_ttl_initialiser; + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); if (mine) { *dptr++ = 0; -- 2.34.1

2 1

[PATCH OLK-5.10] netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
by Zhao Wenhui 23 May '24

23 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit d1261bde59a3a087ab0c81181821e194278d9264 category: bugfix bugzilla: 189802 CVE: CVE-2024-27428 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 119cae5ea3f9e35cdada8e572cc067f072fa825a ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- net/netrom/nr_dev.c | 2 +- net/netrom/nr_out.c | 2 +- net/netrom/nr_subr.c | 5 +++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/net/netrom/nr_dev.c b/net/netrom/nr_dev.c index 29e418c8c6c3..4caee8754b79 100644 --- a/net/netrom/nr_dev.c +++ b/net/netrom/nr_dev.c @@ -81,7 +81,7 @@ static int nr_header(struct sk_buff *skb, struct net_device *dev, buff[6] |= AX25_SSSID_SPARE; buff += AX25_ADDR_LEN; - *buff++ = sysctl_netrom_network_ttl_initialiser; + *buff++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); *buff++ = NR_PROTO_IP; *buff++ = NR_PROTO_IP; diff --git a/net/netrom/nr_out.c b/net/netrom/nr_out.c index 44929657f5b7..5e531394a724 100644 --- a/net/netrom/nr_out.c +++ b/net/netrom/nr_out.c @@ -204,7 +204,7 @@ void nr_transmit_buffer(struct sock *sk, struct sk_buff *skb) dptr[6] |= AX25_SSSID_SPARE; dptr += AX25_ADDR_LEN; - *dptr++ = sysctl_netrom_network_ttl_initialiser; + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); if (!nr_route_frame(skb, NULL)) { kfree_skb(skb); diff --git a/net/netrom/nr_subr.c b/net/netrom/nr_subr.c index e2d2af924cff..c3bbd5880850 100644 --- a/net/netrom/nr_subr.c +++ b/net/netrom/nr_subr.c @@ -182,7 +182,8 @@ void nr_write_internal(struct sock *sk, int frametype) *dptr++ = nr->my_id; *dptr++ = frametype; *dptr++ = nr->window; - if (nr->bpqext) *dptr++ = sysctl_netrom_network_ttl_initialiser; + if (nr->bpqext) + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); break; case NR_DISCREQ: @@ -236,7 +237,7 @@ void __nr_transmit_reply(struct sk_buff *skb, int mine, unsigned char cmdflags) dptr[6] |= AX25_SSSID_SPARE; dptr += AX25_ADDR_LEN; - *dptr++ = sysctl_netrom_network_ttl_initialiser; + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); if (mine) { *dptr++ = 0; -- 2.34.1

2 1

[PATCH OLK-5.10] eeprom: at24: fix memory corruption race condition
by Wenyu Huang 23 May '24

23 May '24

From: Daniel Okazaki <dtokazaki(a)google.com> stable inclusion from stable-v5.15.159 commit c850f71fca09ea41800ed55905980063d17e01da category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9F4 CVE: CVE-2024-35848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ] If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Signed-off-by: Daniel Okazaki <dtokazaki(a)google.com> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/misc/eeprom/at24.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 305ffad131a2..c43072b2e9b6 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -757,14 +757,6 @@ static int at24_probe(struct i2c_client *client) pm_runtime_set_active(dev); pm_runtime_enable(dev); - at24->nvmem = devm_nvmem_register(dev, &nvmem_config); - if (IS_ERR(at24->nvmem)) { - pm_runtime_disable(dev); - if (!pm_runtime_status_suspended(dev)) - regulator_disable(at24->vcc_reg); - return PTR_ERR(at24->nvmem); - } - /* * Perform a one-byte test read to verify that the * chip is functional. @@ -777,6 +769,14 @@ static int at24_probe(struct i2c_client *client) return -ENODEV; } + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); + if (!pm_runtime_status_suspended(dev)) + regulator_disable(at24->vcc_reg); + return PTR_ERR(at24->nvmem); + } + pm_runtime_idle(dev); if (writable) -- 2.34.1

2 1

[PATCH OLK-6.6 v2] mm: add thp anon pmd size mapping align control
by Ze Zuo 23 May '24

23 May '24

From: Kefeng Wang <wangkefeng.wang(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9R7N8 CVE: NA ------------------------------------------------- After committing df0ad0579ac9 ('mm: align larger anonymous mappings on THP boundaries'), we found a number of issues, eg, a significant increase in memory access latency on arm64, which was addressed by commit bb713c2a4a43 (arm64: mmap: disable align larger anonymous mappings on THP boundaries), but subsequently found on x86 that the patch also resulted in a significant degradation of the SPECCPU test. Commit 449846913eb6('mm: huge_memory: add thp mapping align control') has implemented the sysfs interface control of 64 KB aligned mapping in arm64, based on this for thp_align_mapping to add a new bit to control pmd size page alignment, where the 64K alignment mapping enable for arm64 will depend on the new bits being turned on. it is disabled by default, and could be enabled by /sys/kernel/mm/transparent_hugepage/thp_mapping_align. Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> Changes since v1: - Fix build error without CONFIG_TRANSPARENT_HUGEPAGE. - delete some unsed define. --- Documentation/admin-guide/mm/transhuge.rst | 19 +++++++++++-------- include/linux/huge_mm.h | 7 +++++++ mm/huge_memory.c | 12 ++++++++++-- mm/mmap.c | 2 +- 4 files changed, 29 insertions(+), 11 deletions(-) diff --git a/Documentation/admin-guide/mm/transhuge.rst b/Documentation/admin-guide/mm/transhuge.rst index 54046f487f15..aeff60881fd0 100644 --- a/Documentation/admin-guide/mm/transhuge.rst +++ b/Documentation/admin-guide/mm/transhuge.rst @@ -211,14 +211,17 @@ possible to enable/disable it by configurate the corresponding bit:: echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled -The kernel could try to enable other larger size mappings align other -than THP size, eg, 64K on arm64, BIT0 for file mapping, BIT1 for anon -mapping, it is disabled by default, and could enable this feature by -writing the corresponding bit to 1:: - - echo 0x1 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align +The kernel could try to enable mappings for different sizes, eg, 64K for +arm64, BIT0 for file mapping, BIT1 for anonymous mapping, and THP size +page, BIT3 for anonymous mapping, where 64K for arm64 is dependent on +BIT3 being turned on, the above feature are disabled by default, and +could enable the above feature by writing the corresponding bit to 1:: + + echo 0x4 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x5 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x6 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x7 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + The kernel could enable high-orders(greated than PAGE_ALLOC_COSTLY_ORDER, only support order 4 for now) be stored on PCP lists(except PMD order), which could diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index 3e5f7064e2de..3a15b8417199 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -54,6 +54,7 @@ enum transparent_hugepage_flag { TRANSPARENT_HUGEPAGE_FILE_EXEC_MTHP_FLAG, TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, + TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, }; struct kobject; @@ -288,6 +289,10 @@ static inline void count_mthp_stat(int order, enum mthp_stat_item item) (transparent_hugepage_flags & \ (1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG)) +#define thp_anon_mapping_pmd_align() \ + (transparent_hugepage_flags & \ + (1<<TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG)) + unsigned long thp_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags); @@ -443,6 +448,8 @@ static inline void folio_prep_large_rmappable(struct folio *folio) {} #define transparent_hugepage_flags 0UL +#define thp_anon_mapping_pmd_align() 0UL + #define thp_get_unmapped_area NULL static inline bool diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 763bb25e4f99..c090e6cbef3b 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -518,7 +518,9 @@ static struct kobj_attribute thp_exec_enabled_attr = #define FILE_MAPPING_ALIGN BIT(0) #define ANON_MAPPING_ALIGN BIT(1) -#define THP_MAPPING_ALIGN_ALL (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN) +#define ANON_MAPPING_PMD_ALIGN BIT(2) +#define THP_MAPPING_ALIGN_ALL \ + (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN | ANON_MAPPING_PMD_ALIGN) static ssize_t thp_mapping_align_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) @@ -533,6 +535,10 @@ static ssize_t thp_mapping_align_show(struct kobject *kobj, &transparent_hugepage_flags)) val |= ANON_MAPPING_ALIGN; + if (test_bit(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + &transparent_hugepage_flags)) + val |= ANON_MAPPING_PMD_ALIGN; + return sysfs_emit(buf, "0x%lx\n", val); } static ssize_t thp_mapping_align_store(struct kobject *kobj, @@ -544,13 +550,15 @@ static ssize_t thp_mapping_align_store(struct kobject *kobj, ret = kstrtoul(buf, 16, &val); if (ret < 0) return ret; - if (val & ~THP_MAPPING_ALIGN_ALL) + if ((val & ~THP_MAPPING_ALIGN_ALL) || (val && !(val & ANON_MAPPING_PMD_ALIGN))) return -EINVAL; thp_flag_set(TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, val & FILE_MAPPING_ALIGN); thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, val & ANON_MAPPING_ALIGN); + thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + val & ANON_MAPPING_PMD_ALIGN); return count; } diff --git a/mm/mmap.c b/mm/mmap.c index 1c256f38128e..1d8def3db125 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1857,7 +1857,7 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len, */ get_area = shmem_get_unmapped_area; } else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && - !IS_ENABLED(CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT)) { + thp_anon_mapping_pmd_align()) { /* Ensures that larger anonymous mappings are THP aligned. */ get_area = thp_get_unmapped_area; } -- 2.33.0

3 2

[PATCH openEuler-22.03-LTS-SP1] clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
by Li Huafei 23 May '24

23 May '24

From: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> stable inclusion from stable-v5.10.201 commit 96e9544a0c4faca616b3f9f4034dcd83a14e7f22 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RG0J CVE: CVE-2023-52876 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0884393c63cc9a1772f7121a6645ba7bd76feeb9 ] Add the check for the return value of mtk_alloc_clk_data() in order to avoid NULL pointer dereference. Fixes: 3b5e748615e7 ("clk: mediatek: add clock support for MT7629 SoC") Signed-off-by: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> Link: https://lore.kernel.org/r/20230912093407.21505-4-jiasheng@iscas.ac.cn Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Signed-off-by: Stephen Boyd <sboyd(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: sanglipeng <sanglipeng1(a)jd.com> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/clk/mediatek/clk-mt7629-eth.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/clk/mediatek/clk-mt7629-eth.c b/drivers/clk/mediatek/clk-mt7629-eth.c index 88279d0ea1a76..3ab7b672f8c70 100644 --- a/drivers/clk/mediatek/clk-mt7629-eth.c +++ b/drivers/clk/mediatek/clk-mt7629-eth.c @@ -83,6 +83,8 @@ static int clk_mt7629_ethsys_init(struct platform_device *pdev) int r; clk_data = mtk_alloc_clk_data(CLK_ETH_NR_CLK); + if (!clk_data) + return -ENOMEM; mtk_clk_register_gates(node, eth_clks, CLK_ETH_NR_CLK, clk_data); @@ -105,6 +107,8 @@ static int clk_mt7629_sgmiisys_init(struct platform_device *pdev) int r; clk_data = mtk_alloc_clk_data(CLK_SGMII_NR_CLK); + if (!clk_data) + return -ENOMEM; mtk_clk_register_gates(node, sgmii_clks[id++], CLK_SGMII_NR_CLK, clk_data); -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] *** load balance fixes ***
by Zhang Qiao 23 May '24

23 May '24

Zhang Qiao (2): sched/numa: Fix numa imbalance in load_balance() config: Disable COBFIG_ARCH_CUSTOM_NUMA_DISTANCE for arm64 arch/arm64/configs/openeuler_defconfig | 2 +- kernel/sched/fair.c | 13 ++++++++----- 2 files changed, 9 insertions(+), 6 deletions(-) -- 2.18.0.huawei.25

1 2

[PATCH openEuler-1.0-LTS] net/mlx5e: fix a double-free in arfs_create_groups
by Chen Zhongjin 23 May '24

23 May '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> mainline inclusion from mainline-v6.8-rc2 commit 3c6d5189246f590e4e1f167991558bdb72a4738b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9IE CVE: CVE-2024-35835 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When `in` allocated by kvzalloc fails, arfs_create_groups will free ft->g and return an error. However, arfs_create_table, the only caller of arfs_create_groups, will hold this error and call to mlx5e_destroy_flow_table, in which the ft->g will be freed again. Fixes: 1cabe6b0965e ("net/mlx5e: Create aRFS flow tables") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Saeed Mahameed <saeedm(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c [fix context conflicts] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- .../net/ethernet/mellanox/mlx5/core/en_arfs.c | 26 +++++++++++-------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c index 37dbe27391695..8a4fbb89820cf 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c @@ -233,11 +233,13 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, ft->g = kcalloc(MLX5E_ARFS_NUM_GROUPS, sizeof(*ft->g), GFP_KERNEL); - in = kvzalloc(inlen, GFP_KERNEL); - if (!in || !ft->g) { - kvfree(ft->g); - kvfree(in); + if (!ft->g) return -ENOMEM; + + in = kvzalloc(inlen, GFP_KERNEL); + if (!in) { + err = -ENOMEM; + goto err_free_g; } mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria); @@ -257,7 +259,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, break; default: err = -EINVAL; - goto out; + goto err_free_in; } switch (type) { @@ -279,7 +281,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, break; default: err = -EINVAL; - goto out; + goto err_free_in; } MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS); @@ -288,7 +290,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, MLX5_SET_CFG(in, end_flow_index, ix - 1); ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in); if (IS_ERR(ft->g[ft->num_groups])) - goto err; + goto err_clean_group; ft->num_groups++; memset(in, 0, inlen); @@ -297,18 +299,20 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, MLX5_SET_CFG(in, end_flow_index, ix - 1); ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in); if (IS_ERR(ft->g[ft->num_groups])) - goto err; + goto err_clean_group; ft->num_groups++; kvfree(in); return 0; -err: +err_clean_group: err = PTR_ERR(ft->g[ft->num_groups]); ft->g[ft->num_groups] = NULL; -out: +err_free_in: kvfree(in); - +err_free_g: + kfree(ft->g); + ft->g = NULL; return err; } -- 2.25.1

2 1

[PATCH OLK-6.6 1/2] sched/numa: Fix numa imbalance in load_balance()
by Zhang Qiao 23 May '24

23 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RMHW CVE: NA -------------------------------- When perform load balance, a NUMA imbalance is allowed if busy CPUs is less than the maximum threshold, it keeps a pair of communication tasks on the current node when the destination is lightly loaded. 1. But, calculate_imbalance() use local->sum_nr_running, it may not be accurate, because communication tasks is on busiest group, so should be busiest->sum_nr_running. 2. At the same time, idles cpus are used to calculate imbalance, but the group_weight may not be the same between local and busiest groups. In this case, even if both groups are very idle, imbalance will be calculated very large, so the imbalance is calculated by calculating the difference of busy cpus between groups. Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> --- kernel/sched/fair.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 3dcbf50b677f..a650f1a4f4b2 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -1493,7 +1493,7 @@ adjust_numa_imbalance(int imbalance, int dst_running, int imb_numa_nr) * Allow a small imbalance based on a simple pair of communicating * tasks that remain local when the destination is lightly loaded. */ - if (imbalance <= NUMA_IMBALANCE_MIN) + if (imbalance <= imb_numa_nr) return 0; return imbalance; @@ -12077,6 +12077,8 @@ find_idlest_group(struct sched_domain *sd, struct task_struct *p, int this_cpu) #ifdef CONFIG_NUMA if (sd->flags & SD_NUMA) { int imb_numa_nr = sd->imb_numa_nr; + int local_buys_cpus = local_sgs.group_weight - local_sgs.idle_cpus; + int idlest_buys_cpus = idlest_sgs.group_weight - idlest_sgs.idle_cpus; #ifdef CONFIG_NUMA_BALANCING int idlest_cpu; /* @@ -12106,7 +12108,7 @@ find_idlest_group(struct sched_domain *sd, struct task_struct *p, int this_cpu) imb_numa_nr = min(cpumask_weight(cpus), sd->imb_numa_nr); } - imbalance = abs(local_sgs.idle_cpus - idlest_sgs.idle_cpus); + imbalance = abs(idlest_buys_cpus - local_buys_cpus); if (!adjust_numa_imbalance(imbalance, local_sgs.sum_nr_running + 1, imb_numa_nr)) { @@ -12382,18 +12384,19 @@ static inline void calculate_imbalance(struct lb_env *env, struct sd_lb_stats *s /* * If there is no overload, we just want to even the number of - * idle cpus. + * busy cpus. */ env->migration_type = migrate_task; env->imbalance = max_t(long, 0, - (local->idle_cpus - busiest->idle_cpus)); + ((busiest->group_weight - busiest->idle_cpus) + - (local->group_weight - local->idle_cpus))); } #ifdef CONFIG_NUMA /* Consider allowing a small imbalance between NUMA groups */ if (env->sd->flags & SD_NUMA) { env->imbalance = adjust_numa_imbalance(env->imbalance, - local->sum_nr_running + 1, + busiest->sum_nr_running, env->sd->imb_numa_nr); } #endif -- 2.18.0.huawei.25

1 1

[PATCH OLK-5.10] net/mlx5e: fix a double-free in arfs_create_groups
by Chen Zhongjin 23 May '24

23 May '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> mainline inclusion from mainline-v6.8-rc2 commit 3c6d5189246f590e4e1f167991558bdb72a4738b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9IE CVE: CVE-2024-35835 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When `in` allocated by kvzalloc fails, arfs_create_groups will free ft->g and return an error. However, arfs_create_table, the only caller of arfs_create_groups, will hold this error and call to mlx5e_destroy_flow_table, in which the ft->g will be freed again. Fixes: 1cabe6b0965e ("net/mlx5e: Create aRFS flow tables") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Saeed Mahameed <saeedm(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- .../net/ethernet/mellanox/mlx5/core/en_arfs.c | 26 +++++++++++-------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c index 2e800d730231d..113269802961a 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c @@ -214,11 +214,13 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, ft->g = kcalloc(MLX5E_ARFS_NUM_GROUPS, sizeof(*ft->g), GFP_KERNEL); - in = kvzalloc(inlen, GFP_KERNEL); - if (!in || !ft->g) { - kfree(ft->g); - kvfree(in); + if (!ft->g) return -ENOMEM; + + in = kvzalloc(inlen, GFP_KERNEL); + if (!in) { + err = -ENOMEM; + goto err_free_g; } mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria); @@ -238,7 +240,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, break; default: err = -EINVAL; - goto out; + goto err_free_in; } switch (type) { @@ -260,7 +262,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, break; default: err = -EINVAL; - goto out; + goto err_free_in; } MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS); @@ -269,7 +271,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, MLX5_SET_CFG(in, end_flow_index, ix - 1); ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in); if (IS_ERR(ft->g[ft->num_groups])) - goto err; + goto err_clean_group; ft->num_groups++; memset(in, 0, inlen); @@ -278,18 +280,20 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, MLX5_SET_CFG(in, end_flow_index, ix - 1); ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in); if (IS_ERR(ft->g[ft->num_groups])) - goto err; + goto err_clean_group; ft->num_groups++; kvfree(in); return 0; -err: +err_clean_group: err = PTR_ERR(ft->g[ft->num_groups]); ft->g[ft->num_groups] = NULL; -out: +err_free_in: kvfree(in); - +err_free_g: + kfree(ft->g); + ft->g = NULL; return err; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2021-47407
by Yongqiang Liu 23 May '24

23 May '24

Haimin Zhang (1): KVM: x86: Handle SRCU initialization failure during page track init arch/x86/include/asm/kvm_page_track.h | 2 +- arch/x86/kvm/page_track.c | 4 ++-- arch/x86/kvm/x86.c | 7 ++++++- 3 files changed, 9 insertions(+), 4 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
by Zhao Wenhui 23 May '24

23 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v4.19.310 commit acc653e8a3aaab1b7103f98645f2cce7be89e3d3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q91I CVE: CVE-2024-27428 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 119cae5ea3f9e35cdada8e572cc067f072fa825a ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- net/netrom/nr_dev.c | 2 +- net/netrom/nr_out.c | 2 +- net/netrom/nr_subr.c | 5 +++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/net/netrom/nr_dev.c b/net/netrom/nr_dev.c index 988f542481a8..fa845edad7bf 100644 --- a/net/netrom/nr_dev.c +++ b/net/netrom/nr_dev.c @@ -84,7 +84,7 @@ static int nr_header(struct sk_buff *skb, struct net_device *dev, buff[6] |= AX25_SSSID_SPARE; buff += AX25_ADDR_LEN; - *buff++ = sysctl_netrom_network_ttl_initialiser; + *buff++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); *buff++ = NR_PROTO_IP; *buff++ = NR_PROTO_IP; diff --git a/net/netrom/nr_out.c b/net/netrom/nr_out.c index 00fbf1419ec6..213bddab6e74 100644 --- a/net/netrom/nr_out.c +++ b/net/netrom/nr_out.c @@ -207,7 +207,7 @@ void nr_transmit_buffer(struct sock *sk, struct sk_buff *skb) dptr[6] |= AX25_SSSID_SPARE; dptr += AX25_ADDR_LEN; - *dptr++ = sysctl_netrom_network_ttl_initialiser; + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); if (!nr_route_frame(skb, NULL)) { kfree_skb(skb); diff --git a/net/netrom/nr_subr.c b/net/netrom/nr_subr.c index 029c8bb90f4c..c97c427622ee 100644 --- a/net/netrom/nr_subr.c +++ b/net/netrom/nr_subr.c @@ -184,7 +184,8 @@ void nr_write_internal(struct sock *sk, int frametype) *dptr++ = nr->my_id; *dptr++ = frametype; *dptr++ = nr->window; - if (nr->bpqext) *dptr++ = sysctl_netrom_network_ttl_initialiser; + if (nr->bpqext) + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); break; case NR_DISCREQ: @@ -238,7 +239,7 @@ void __nr_transmit_reply(struct sk_buff *skb, int mine, unsigned char cmdflags) dptr[6] |= AX25_SSSID_SPARE; dptr += AX25_ADDR_LEN; - *dptr++ = sysctl_netrom_network_ttl_initialiser; + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); if (mine) { *dptr++ = 0; -- 2.34.1

2 1

[PATCH OLK-5.10 v2 0/3] arm64: Allow CPU0 to be nohz_full
by Xiongfeng Wang 23 May '24

23 May '24

Changelog: change __setup() to early_param() Xiongfeng Wang (3): isolation: Do not check whether housekeeping CPUs are present isolation: Check whether all the housekeeping CPUs are online arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default arch/arm64/Kconfig | 3 +++ include/linux/cpu.h | 3 ++- include/linux/sched/isolation.h | 5 +++++ kernel/sched/isolation.c | 39 +++++++++++++++++++++++++++++---- kernel/smp.c | 4 ++++ kernel/time/tick-sched.c | 3 ++- 6 files changed, 51 insertions(+), 6 deletions(-) -- 2.30.0

2 4

[PATCH OLK-5.10] netrom: Fix a data-race around sysctl_netrom_transport_timeout
by Hui Tang 23 May '24

23 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit 291d36d772f5ea5c68a263ee440f2c9eade371c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q95M CVE: CVE-2024-27427 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 60a7a152abd494ed4f69098cf0f322e6bb140612 ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 24747163122b..685751096744 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -453,7 +453,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, nr_init_timers(sk); nr->t1 = - msecs_to_jiffies(sysctl_netrom_transport_timeout); + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_timeout)); nr->t2 = msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); nr->n2 = -- 2.34.1

2 1

[OLK-5.10 v3 0/4] Some bugfixes for openeuler 22.03 sp4
by Chengchang Tang 23 May '24

23 May '24

From: Juan Zhou <zhoujuan51(a)h-partners.com> Some bugfixes for openeuler 22.03 sp4. Chengchang Tang (3): RDMA/hns: Fix missing resetting notify RDMA/hns: Use mutex to protect uconctext RDMA/hns: Fix allocating POE channels after IB device registeration wenglianfa (1): RDMA/hns : Fix scc delay_work to execute after sysfs shutdown drivers/infiniband/core/ib_core_uverbs.c | 85 ++++++++++++++++++++ drivers/infiniband/core/rdma_core.h | 1 - drivers/infiniband/core/uverbs_main.c | 64 --------------- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 6 +- drivers/infiniband/hw/hns/hns_roce_device.h | 2 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 14 ++-- drivers/infiniband/hw/hns/hns_roce_main.c | 14 ++-- drivers/infiniband/hw/hns/hns_roce_sysfs.c | 5 ++ include/rdma/ib_verbs.h | 2 + 9 files changed, 110 insertions(+), 83 deletions(-) -- 2.33.0

1 4

[openeuler:OLK-6.6 9705/9710] drivers/irqchip/irq-loongson-eiointc.c:378:58: error: 'NODES_PER_FLATMODE_NODE' undeclared
by kernel test robot 23 May '24

23 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c542a3e5830d4d587bcc2b51a185b671a6c64853 commit: 30affb08c584efdc07b3c68015b5902ea02ec86a [9705/9710] irqchip/loongson-eiointc: fix gsi register error config: loongarch-allnoconfig (https://download.01.org/0day-ci/archive/20240523/202405231321.wKWdnTl4-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240523/202405231321.wKWdnTl4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405231321.wKWdnTl4-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/irqchip/irq-loongson-eiointc.c:357:12: warning: no previous prototype for 'pch_pic_parse_madt' [-Wmissing-prototypes] 357 | int __init pch_pic_parse_madt(union acpi_subtable_headers *header, | ^~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-loongson-eiointc.c:370:12: warning: no previous prototype for 'pch_msi_parse_madt' [-Wmissing-prototypes] 370 | int __init pch_msi_parse_madt(union acpi_subtable_headers *header, | ^~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-loongson-eiointc.c: In function 'pch_msi_parse_madt': >> drivers/irqchip/irq-loongson-eiointc.c:378:58: error: 'NODES_PER_FLATMODE_NODE' undeclared (first use in this function) 378 | node = eiointc_priv[nr_pics - 1]->node / NODES_PER_FLATMODE_NODE; | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-loongson-eiointc.c:378:58: note: each undeclared identifier is reported only once for each function it appears in drivers/irqchip/irq-loongson-eiointc.c: In function 'eiointc_acpi_init': drivers/irqchip/irq-loongson-eiointc.c:481:45: error: 'NODES_PER_FLATMODE_NODE' undeclared (first use in this function) 481 | node = acpi_eiointc->node / NODES_PER_FLATMODE_NODE; | ^~~~~~~~~~~~~~~~~~~~~~~ vim +/NODES_PER_FLATMODE_NODE +378 drivers/irqchip/irq-loongson-eiointc.c 369 370 int __init pch_msi_parse_madt(union acpi_subtable_headers *header, 371 const unsigned long end) 372 { 373 struct irq_domain *parent; 374 struct acpi_madt_msi_pic *pchmsi_entry = (struct acpi_madt_msi_pic *)header; 375 int node; 376 377 if (cpu_has_flatmode) > 378 node = eiointc_priv[nr_pics - 1]->node / NODES_PER_FLATMODE_NODE; 379 else 380 node = eiointc_priv[nr_pics - 1]->node; 381 382 parent = acpi_get_vec_parent(node, msi_group); 383 384 if (parent) 385 return pch_msi_acpi_init(parent, pchmsi_entry); 386 387 return 0; 388 } 389 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter()
by Zizhi Wo 23 May '24

23 May '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.1-rc3 commit f950c85e782f90702468bba8243cc97a8d0d04b0 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RJQB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a kmemleak when writedata alloc failed: unreferenced object 0xffff888175ae4000 (size 4096): comm "dd", pid 19419, jiffies 4296028749 (age 739.396s) hex dump (first 32 bytes): 80 02 b0 04 00 ea ff ff c0 02 b0 04 00 ea ff ff ................ 80 22 4c 04 00 ea ff ff c0 22 4c 04 00 ea ff ff ."L......"L..... backtrace: [<0000000072fdbb86>] __kmalloc_node+0x50/0x150 [<0000000039faf56f>] __iov_iter_get_pages_alloc+0x605/0xdd0 [<00000000f862a9d4>] iov_iter_get_pages_alloc2+0x3b/0x80 [<000000008f226067>] cifs_write_from_iter+0x2ae/0xe40 [<000000001f78f2f1>] __cifs_writev+0x337/0x5c0 [<00000000257fcef5>] vfs_write+0x503/0x690 [<000000008778a238>] ksys_write+0xb9/0x150 [<00000000ed82047c>] do_syscall_64+0x35/0x80 [<000000003365551d>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 __iov_iter_get_pages_alloc+0x605/0xdd0 is: want_pages_array at lib/iov_iter.c:1304 (inlined by) __iov_iter_get_pages_alloc at lib/iov_iter.c:1457 If writedata allocate failed, the pages and pagevec should be cleanup. Fixes: 8c5f9c1ab7cb ("CIFS: Add support for direct I/O write") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)cjr.nz> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/file.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/cifs/file.c b/fs/cifs/file.c index a56738244f3a..e914f4f5cc83 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -2982,6 +2982,9 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from, cifs_uncached_writev_complete); if (!wdata) { rc = -ENOMEM; + for (i = 0; i < nr_pages; i++) + put_page(pagevec[i]); + kvfree(pagevec); add_credits_and_wake_if(server, credits, 0); break; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] netrom: Fix a data-race around sysctl_netrom_transport_timeout
by Hui Tang 23 May '24

23 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v4.19.310 commit 500936692ccca8617a955652d1929f079b17a201 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q95M CVE: CVE-2024-27427 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 60a7a152abd494ed4f69098cf0f322e6bb140612 ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 8f18fea17cfc..82daed1296f5 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -456,7 +456,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, nr_init_timers(sk); nr->t1 = - msecs_to_jiffies(sysctl_netrom_transport_timeout); + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_timeout)); nr->t2 = msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); nr->n2 = -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2023-52868
by Chen Ridong 23 May '24

23 May '24

*** BLURB HERE *** Dan Carpenter (1): thermal: core: prevent potential string overflow drivers/thermal/thermal_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/1] CVE-2023-52868
by Chen Ridong 23 May '24

23 May '24

*** BLURB HERE *** Dan Carpenter (1): thermal: core: prevent potential string overflow drivers/thermal/thermal_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/1] CVE-2023-52868
by Chen Ridong 23 May '24

23 May '24

*** BLURB HERE *** Dan Carpenter (1): thermal: core: prevent potential string overflow drivers/thermal/thermal_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/4] LoongArch: fix kdump not work when legacy mode disabled
by Hongchen Zhang 23 May '24

23 May '24

Hongchen Zhang (4): Revert "LoongArch: kdump: Add high memory reservation" Revert "LoongArch: Fix kdump failure on v40 interface specification" Revert "LoongArch: kdump: Add memory reservation for old kernel" LoongArch: fix efi map page table error arch/loongarch/kernel/efi.c | 39 ++++++++++++--- arch/loongarch/kernel/setup.c | 94 +++++------------------------------ 2 files changed, 44 insertions(+), 89 deletions(-) -- 2.33.0

2 5

[PATCH OLK-6.6] LoongArch: limit min pci msi-x/msi vector number when request more than 32 vectors
by Hongchen Zhang 23 May '24

23 May '24

From: Juxin Gao <gaojuxin(a)loongson.cn> LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9R7M9 ------------------------------------------ When we test wangxun network card ,we get failed. The reason is wangxun driver request a large minvec (33 or bigger), and it failed on LoongArch machine. Usually, it is not necessary to set the minimum number of MSI-X interrupts used to such a large number, so we limit it Signed-off-by: Juxin Gao <gaojuxin(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- drivers/pci/msi/msi.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c index cde8c4e264b7..7078200be11f 100644 --- a/drivers/pci/msi/msi.c +++ b/drivers/pci/msi/msi.c @@ -424,8 +424,10 @@ int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec, int rc; #ifdef CONFIG_LOONGARCH - if (maxvec > 32) + if (maxvec > 32) { maxvec = pci_irq_numbers; + minvec = min_t(int, pci_irq_numbers, minvec); + } #endif if (!pci_msi_supported(dev, minvec) || dev->current_state != PCI_D0) @@ -810,8 +812,10 @@ int __pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries, int int hwsize, rc, nvec = maxvec; #ifdef CONFIG_LOONGARCH - if (maxvec > 32) + if (maxvec > 32) { nvec = pci_irq_numbers; + minvec = min_t(int, pci_irq_numbers, minvec); + } #endif if (maxvec < minvec) -- 2.33.0

2 1

[PATCH] LoongArch: limit min pci msi-x/msi vector number when request more than 32 vectors
by Hongchen Zhang 23 May '24

23 May '24

From: Juxin Gao <gaojuxin(a)loongson.cn> LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9R7M9 ------------------------------------------ When we test wangxun network card ,we get failed. The reason is wangxun driver request a large minvec (33 or bigger), and it failed on LoongArch machine. Usually, it is not necessary to set the minimum number of MSI-X interrupts used to such a large number, so we limit it Signed-off-by: Juxin Gao <gaojuxin(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- drivers/pci/msi/msi.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c index cde8c4e264b7..7078200be11f 100644 --- a/drivers/pci/msi/msi.c +++ b/drivers/pci/msi/msi.c @@ -424,8 +424,10 @@ int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec, int rc; #ifdef CONFIG_LOONGARCH - if (maxvec > 32) + if (maxvec > 32) { maxvec = pci_irq_numbers; + minvec = min_t(int, pci_irq_numbers, minvec); + } #endif if (!pci_msi_supported(dev, minvec) || dev->current_state != PCI_D0) @@ -810,8 +812,10 @@ int __pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries, int int hwsize, rc, nvec = maxvec; #ifdef CONFIG_LOONGARCH - if (maxvec > 32) + if (maxvec > 32) { nvec = pci_irq_numbers; + minvec = min_t(int, pci_irq_numbers, minvec); + } #endif if (maxvec < minvec) -- 2.33.0

1 0

[PATCH OLK-6.6] mm: add thp anon pmd size mapping align control
by Ze Zuo 23 May '24

23 May '24

From: Kefeng Wang <wangkefeng.wang(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9R7N8 CVE: NA ------------------------------------------------- After committing df0ad0579ac9 ('mm: align larger anonymous mappings on THP boundaries'), we found a number of issues, eg, a significant increase in memory access latency on arm64, which was addressed by commit bb713c2a4a43 (arm64: mmap: disable align larger anonymous mappings on THP boundaries), but subsequently found on x86 that the patch also resulted in a significant degradation of the SPECCPU test. Commit 449846913eb6('mm: huge_memory: add thp mapping align control') has implemented the sysfs interface control of 64 KB aligned mapping in arm64, based on this for thp_align_mapping to add a new bit to control pmd size page alignment, where the 64K alignment mapping enable for arm64 will depend on the new bits being turned on. it is disabled by default, and could be enabled by /sys/kernel/mm/transparent_hugepage/thp_mapping_align. Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- Documentation/admin-guide/mm/transhuge.rst | 19 +++++++++++-------- include/linux/huge_mm.h | 5 +++++ mm/huge_memory.c | 14 ++++++++++++-- mm/mmap.c | 2 +- 4 files changed, 29 insertions(+), 11 deletions(-) diff --git a/Documentation/admin-guide/mm/transhuge.rst b/Documentation/admin-guide/mm/transhuge.rst index 54046f487f15..aeff60881fd0 100644 --- a/Documentation/admin-guide/mm/transhuge.rst +++ b/Documentation/admin-guide/mm/transhuge.rst @@ -211,14 +211,17 @@ possible to enable/disable it by configurate the corresponding bit:: echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled -The kernel could try to enable other larger size mappings align other -than THP size, eg, 64K on arm64, BIT0 for file mapping, BIT1 for anon -mapping, it is disabled by default, and could enable this feature by -writing the corresponding bit to 1:: - - echo 0x1 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align +The kernel could try to enable mappings for different sizes, eg, 64K for +arm64, BIT0 for file mapping, BIT1 for anonymous mapping, and THP size +page, BIT3 for anonymous mapping, where 64K for arm64 is dependent on +BIT3 being turned on, the above feature are disabled by default, and +could enable the above feature by writing the corresponding bit to 1:: + + echo 0x4 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x5 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x6 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x7 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + The kernel could enable high-orders(greated than PAGE_ALLOC_COSTLY_ORDER, only support order 4 for now) be stored on PCP lists(except PMD order), which could diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index 3e5f7064e2de..6dcdcc47dd5e 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -54,6 +54,7 @@ enum transparent_hugepage_flag { TRANSPARENT_HUGEPAGE_FILE_EXEC_MTHP_FLAG, TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, + TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, }; struct kobject; @@ -288,6 +289,10 @@ static inline void count_mthp_stat(int order, enum mthp_stat_item item) (transparent_hugepage_flags & \ (1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG)) +#define thp_anon_mapping_pmd_align() \ + (transparent_hugepage_flags & \ + (1<<TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG)) + unsigned long thp_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags); diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 763bb25e4f99..67e09693215c 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -518,7 +518,11 @@ static struct kobj_attribute thp_exec_enabled_attr = #define FILE_MAPPING_ALIGN BIT(0) #define ANON_MAPPING_ALIGN BIT(1) -#define THP_MAPPING_ALIGN_ALL (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN) +#define ANON_MAPPING_PMD_ALIGN BIT(2) +#define THP_MAPPING_64K_ALIGN \ + (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN) +#define THP_MAPPING_ALIGN_ALL \ + (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN | ANON_MAPPING_PMD_ALIGN) static ssize_t thp_mapping_align_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) @@ -533,6 +537,10 @@ static ssize_t thp_mapping_align_show(struct kobject *kobj, &transparent_hugepage_flags)) val |= ANON_MAPPING_ALIGN; + if (test_bit(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + &transparent_hugepage_flags)) + val |= ANON_MAPPING_PMD_ALIGN; + return sysfs_emit(buf, "0x%lx\n", val); } static ssize_t thp_mapping_align_store(struct kobject *kobj, @@ -544,13 +552,15 @@ static ssize_t thp_mapping_align_store(struct kobject *kobj, ret = kstrtoul(buf, 16, &val); if (ret < 0) return ret; - if (val & ~THP_MAPPING_ALIGN_ALL) + if ((val & ~THP_MAPPING_ALIGN_ALL) || (val & THP_MAPPING_64K_ALIGN)) return -EINVAL; thp_flag_set(TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, val & FILE_MAPPING_ALIGN); thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, val & ANON_MAPPING_ALIGN); + thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + val & ANON_MAPPING_PMD_ALIGN); return count; } diff --git a/mm/mmap.c b/mm/mmap.c index 1c256f38128e..1d8def3db125 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1857,7 +1857,7 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len, */ get_area = shmem_get_unmapped_area; } else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && - !IS_ENABLED(CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT)) { + thp_anon_mapping_pmd_align()) { /* Ensures that larger anonymous mappings are THP aligned. */ get_area = thp_get_unmapped_area; } -- 2.33.0

2 1

[openeuler:OLK-6.6 9677/9706] arch/arm64/kernel/cpufeature.c:2129:13: warning: unused variable 'enable_pseudo_nmi'
by kernel test robot 23 May '24

23 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b51533d469099a915373a13041776b93b232ff65 commit: c6ce2becb89528f83c1ad3c0607ad05baecebc0a [9677/9706] arm64/cpufeature: Fix pseudo nmi identifier undeclaration complilation error config: arm64-randconfig-001-20240523 (https://download.01.org/0day-ci/archive/20240523/202405230925.19JMExYE-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project fa9b1be45088dce1e4b602d451f118128b94237b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240523/202405230925.19JMExYE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405230925.19JMExYE-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/arm64/kernel/cpufeature.c:67: In file included from include/linux/crash_dump.h:5: In file included from include/linux/kexec.h:18: In file included from include/linux/crash_core.h:6: In file included from include/linux/elfcore.h:11: In file included from include/linux/ptrace.h:10: In file included from include/linux/pid_namespace.h:7: In file included from include/linux/mm.h:2234: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kernel/cpufeature.c:2129:13: warning: unused variable 'enable_pseudo_nmi' [-Wunused-variable] 2129 | static bool enable_pseudo_nmi; | ^~~~~~~~~~~~~~~~~ 5 warnings generated. vim +/enable_pseudo_nmi +2129 arch/arm64/kernel/cpufeature.c 3e6c69a058deaa Mark Brown 2019-12-09 2127 f72387e1f8bc99 Mark Brown 2022-11-03 2128 #if IS_ENABLED(CONFIG_ARM64_PSEUDO_NMI) || IS_ENABLED(CONFIG_ARM64_NMI) bc3c03ccb4641f Julien Thierry 2019-01-31 @2129 static bool enable_pseudo_nmi; f72387e1f8bc99 Mark Brown 2022-11-03 2130 #endif bc3c03ccb4641f Julien Thierry 2019-01-31 2131 :::::: The code at line 2129 was first introduced by commit :::::: bc3c03ccb4641fb940b27a0d369431876923a8fe arm64: Enable the support of pseudo-NMIs :::::: TO: Julien Thierry <julien.thierry(a)arm.com> :::::: CC: Catalin Marinas <catalin.marinas(a)arm.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 19459/22464] mm/memory_hotplug.c:1278:30: warning: 'start' may be used uninitialized
by kernel test robot 23 May '24

23 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 80ab23a867e779b7d5f818a57bd578a57143becb commit: 5f0e34d2aceec67c169be7599d82f0e8519c37f7 [19459/22464] mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning config: x86_64-buildonly-randconfig-003-20240523 (https://download.01.org/0day-ci/archive/20240523/202405230933.fLM0leXg-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240523/202405230933.fLM0leXg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405230933.fLM0leXg-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): mm/memory_hotplug.c: In function '__remove_section': mm/memory_hotplug.c:481:23: warning: variable 'start_pfn' set but not used [-Wunused-but-set-variable] 481 | unsigned long start_pfn; | ^~~~~~~~~ mm/memory_hotplug.c: In function 'test_pages_in_a_zone': >> mm/memory_hotplug.c:1278:30: warning: 'start' may be used uninitialized [-Wmaybe-uninitialized] 1278 | *valid_start = start; | ~~~~~~~~~~~~~^~~~~~~ mm/memory_hotplug.c:1245:23: note: 'start' was declared here 1245 | unsigned long start, end; | ^~~~~ vim +/start +1278 mm/memory_hotplug.c 5c755e9fd81381 Badari Pulavarty 2008-07-23 1236 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1237 /* deb88a2a19e858 Toshi Kani 2017-02-03 1238 * Confirm all pages in a range [start, end) belong to the same zone. a96dfddbcc0433 Toshi Kani 2017-02-03 1239 * When true, return its valid [start, end). 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1240 */ a96dfddbcc0433 Toshi Kani 2017-02-03 1241 int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn, a96dfddbcc0433 Toshi Kani 2017-02-03 1242 unsigned long *valid_start, unsigned long *valid_end) 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1243 { 5f0f2887f4de95 Andrew Banman 2015-12-29 1244 unsigned long pfn, sec_end_pfn; a96dfddbcc0433 Toshi Kani 2017-02-03 1245 unsigned long start, end; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1246 struct zone *zone = NULL; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1247 struct page *page; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1248 int i; deb88a2a19e858 Toshi Kani 2017-02-03 1249 for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn + 1); 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1250 pfn < end_pfn; deb88a2a19e858 Toshi Kani 2017-02-03 1251 pfn = sec_end_pfn, sec_end_pfn += PAGES_PER_SECTION) { 5f0f2887f4de95 Andrew Banman 2015-12-29 1252 /* Make sure the memory section is present first */ 5f0f2887f4de95 Andrew Banman 2015-12-29 1253 if (!present_section_nr(pfn_to_section_nr(pfn))) 5f0f2887f4de95 Andrew Banman 2015-12-29 1254 continue; 5f0f2887f4de95 Andrew Banman 2015-12-29 1255 for (; pfn < sec_end_pfn && pfn < end_pfn; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1256 pfn += MAX_ORDER_NR_PAGES) { 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1257 i = 0; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1258 /* This is just a CONFIG_HOLES_IN_ZONE check.*/ 5f0f2887f4de95 Andrew Banman 2015-12-29 1259 while ((i < MAX_ORDER_NR_PAGES) && 5f0f2887f4de95 Andrew Banman 2015-12-29 1260 !pfn_valid_within(pfn + i)) 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1261 i++; d6d8c8a48291b9 zhong jiang 2017-02-24 1262 if (i == MAX_ORDER_NR_PAGES || pfn + i >= end_pfn) 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1263 continue; 65e9b09942c6df Mikhail Zaslonko 2019-02-13 1264 /* Check if we got outside of the zone */ 65e9b09942c6df Mikhail Zaslonko 2019-02-13 1265 if (zone && !zone_spans_pfn(zone, pfn + i)) 65e9b09942c6df Mikhail Zaslonko 2019-02-13 1266 return 0; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1267 page = pfn_to_page(pfn + i); 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1268 if (zone && page_zone(page) != zone) 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1269 return 0; a96dfddbcc0433 Toshi Kani 2017-02-03 1270 if (!zone) a96dfddbcc0433 Toshi Kani 2017-02-03 1271 start = pfn + i; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1272 zone = page_zone(page); a96dfddbcc0433 Toshi Kani 2017-02-03 1273 end = pfn + MAX_ORDER_NR_PAGES; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1274 } 5f0f2887f4de95 Andrew Banman 2015-12-29 1275 } deb88a2a19e858 Toshi Kani 2017-02-03 1276 a96dfddbcc0433 Toshi Kani 2017-02-03 1277 if (zone) { a96dfddbcc0433 Toshi Kani 2017-02-03 @1278 *valid_start = start; d6d8c8a48291b9 zhong jiang 2017-02-24 1279 *valid_end = min(end, end_pfn); 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1280 return 1; a96dfddbcc0433 Toshi Kani 2017-02-03 1281 } else { deb88a2a19e858 Toshi Kani 2017-02-03 1282 return 0; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1283 } a96dfddbcc0433 Toshi Kani 2017-02-03 1284 } 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1285 :::::: The code at line 1278 was first introduced by commit :::::: a96dfddbcc04336bbed50dc2b24823e45e09e80c base/memory, hotplug: fix a kernel oops in show_valid_zones() :::::: TO: Toshi Kani <toshi.kani(a)hpe.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS db8faa5982edf652cdab6a767183575299a2be5b
by kernel test robot 23 May '24

23 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: db8faa5982edf652cdab6a767183575299a2be5b !7743 netrom: Fix data-races around sysctl_net_busy_read Warning ids grouped by kconfigs: clang_recent_errors `-- x86_64-allnoconfig |-- Warning:openEuler-MAINTAINERS-references-a-file-that-doesn-t-exist:Documentation-networking-hinic3.rst |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_device.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl_admin.c:linux-version.h-not-needed. `-- drivers-ub-urma-uburma-uburma_mmap.c:linux-version.h-not-needed. elapsed time: 829m configs tested: 11 configs skipped: 131 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240523 clang arm64 randconfig-002-20240523 gcc arm64 randconfig-003-20240523 clang arm64 randconfig-004-20240523 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION b51533d469099a915373a13041776b93b232ff65
by kernel test robot 23 May '24

23 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: b51533d469099a915373a13041776b93b232ff65 !7771 ext4: default enable iomap for buffered IO and large folio Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- arch-arm64-kernel-cpufeature.c:warning:enable_pseudo_nmi-defined-but-not-used | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used `-- arm64-randconfig-002-20240523 `-- arch-arm64-kernel-cpufeature.c:warning:enable_pseudo_nmi-defined-but-not-used clang_recent_errors `-- arm64-allmodconfig |-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Excess-function-parameter-context-description-in-hmm_umem_get |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Function-parameter-or-member-device-not-described-in-hmm_umem_get |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_alloc_rx_buffers |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_jumbo_sgl |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_desc |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_priv_tag |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_unmap_and_free_tx_resource |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_jumbo |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_simple |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_add_flow_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_del_flow_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_add_fster_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_del_fster_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_get_irq_num |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-getparam |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_atoi |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_isdigit |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_strtok |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clean_queue |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clr_table |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_erase_norflash |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_fru_info |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_mac |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_meter_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_read_norflash |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_dev_type_to_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_hw_flag_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_mac_to_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_arfs_cnt |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cq |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqdesc_states |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_pcie_drop_counter |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_queue |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_ring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxdesc_states |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxq |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txdesc_states |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txq |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txtail |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_delete |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_insert |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_search |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_help |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_update_adpt_speed |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_write_norflash |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ext_toeplitz_key |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_crc32_init |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_speed |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_recv |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_send |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_set_mac_inloop |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_spd_verify |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_transform_vf_stat_format |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_update_status |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_intx |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_msix |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_msix_clean_vf_mbx |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adjust_adpt_port_max_queue |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adpt_release |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_phy_capabilities |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_vf_link_status |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_rx_ring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_tx_ring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_exit_module |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_cq_resources |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_rx_resources |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_tx_resources |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_hw_init |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_init_module |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_link_speed_to_rate |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_pf_init |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_print_link_message |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_set_vf_port_vlan |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:variable-tx_linearize-set-but-not-used |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_procfs.c:warning:no-previous-prototype-for-function-ne6x_proc_i2c_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_ne6x_reg_perform |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_get_user_data_template |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_lock |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_perform |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_polling |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_send |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_set_user_data_template |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_table_update |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_unlock |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_close_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_release_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_setup_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_clear_vf_status |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_conv_link_speed_to_virtchnl |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_free_vfs |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_is_reset_in_progress |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_deinit_snapshot |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_init_snapshot |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_reset_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_sdk_send_msg_to_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_send_init_mbx_mesg |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_bw_for_max_vpnum |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_state_qs_dis |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_status_to_errno |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_notify_vf_link_state |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_set_default_allowlist |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showqueue |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showring |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_ethtool.c:warning:unannotated-fall-through-between-switch-labels |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-nce_get_vsi_stats_struct |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_add_vlan_list |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_asq_done |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_configure_queues |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_del_vlan_list |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_down |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_interrupt_scheme |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_sdk_mbx |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_irq_enable_queues |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_is_remove_in_progress |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_pdev_to_adapter |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_process_config |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_promiscuous_mode_changed |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_replace_primary_mac |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_sdk_send_msg_to_pf |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_vf_parse_hw_config |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box_async |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_box `-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_object_qpc_mpt_create elapsed time: 821m configs tested: 15 configs skipped: 104 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-002-20240523 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240523 gcc x86_64 buildonly-randconfig-002-20240523 gcc x86_64 buildonly-randconfig-003-20240523 gcc x86_64 buildonly-randconfig-004-20240523 clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 80ab23a867e779b7d5f818a57bd578a57143becb
by kernel test robot 23 May '24

23 May '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 80ab23a867e779b7d5f818a57bd578a57143becb !7742 netrom: Fix data-races around sysctl_net_busy_read Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-randconfig-003-20240523 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code `-- arm64-randconfig-004-20240523 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code clang_recent_errors |-- x86_64-allyesconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension `-- x86_64-buildonly-randconfig-004-20240521 `-- drivers-spi-spi-phytium-plat.o:warning:objtool:missing-symbol-for-section-.init.text elapsed time: 797m configs tested: 15 configs skipped: 131 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240523 gcc arm64 randconfig-002-20240523 gcc arm64 randconfig-003-20240523 gcc arm64 randconfig-004-20240523 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240523 gcc x86_64 buildonly-randconfig-002-20240523 gcc x86_64 buildonly-randconfig-003-20240523 gcc x86_64 buildonly-randconfig-004-20240523 clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] netfilter: nft_flow_offload: reset dst in route object after setting up flow
by Liu Jian 22 May '24

22 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.8-rc6 commit 9e0f0430389be7696396c62f037be4bf72cf93e3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8LQ CVE: CVE-2024-27403 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise if flow_offload_add() fails, error path releases dst twice, leading to a refcount underflow. Fixes: a3c90f7a2323 ("netfilter: nf_tables: flow offload expression") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: include/net/netfilter/nf_flow_table.h net/netfilter/nf_flow_table_core.c [This is because we did not backport f1363e058b84, fa502c865666, 8b9229d15877, 7a27f6ab4135] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/netfilter/nf_flow_table_core.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c index b3957fe7eced..4f4869853cbe 100644 --- a/net/netfilter/nf_flow_table_core.c +++ b/net/netfilter/nf_flow_table_core.c @@ -21,6 +21,16 @@ struct flow_offload_entry { static DEFINE_MUTEX(flowtable_lock); static LIST_HEAD(flowtables); +static struct dst_entry *nft_route_dst_fetch(struct nf_flow_route *route, + enum flow_offload_tuple_dir dir) +{ + struct dst_entry *dst = route->tuple[dir].dst; + + route->tuple[dir].dst = NULL; + + return dst; +} + static void flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct, struct nf_flow_route *route, @@ -29,7 +39,7 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct, struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple; struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple; struct dst_entry *other_dst = route->tuple[!dir].dst; - struct dst_entry *dst = route->tuple[dir].dst; + struct dst_entry *dst = nft_route_dst_fetch(route, dir); ft->dir = dir; -- 2.34.1

2 1

[PATCH OLK-5.10] f2fs: fix to wait on block writeback for post_read case
by Zizhi Wo 22 May '24

22 May '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.1.75 commit 9bfd5ea71521d0e522ba581c6ccc5db93759c0c3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9I6 CVE: CVE-2023-52682 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 55fdc1c24a1d6229fe0ecf31335fb9a2eceaaa00 ] If inode is compressed, but not encrypted, it missed to call f2fs_wait_on_block_writeback() to wait for GCed page writeback in IPU write path. Thread A GC-Thread - f2fs_gc - do_garbage_collect - gc_data_segment - move_data_block - f2fs_submit_page_write migrate normal cluster's block via meta_inode's page cache - f2fs_write_single_data_page - f2fs_do_write_data_page - f2fs_inplace_write_data - f2fs_submit_page_bio IRQ - f2fs_read_end_io IRQ old data overrides new data due to out-of-order GC and common IO. - f2fs_read_end_io Fixes: 4c8ff7095bef ("f2fs: support data compression") Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/f2fs/data.c [f2fs_handle_error function does not exist. The conflict is not related to the patch] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/data.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c index 18c031a0bf56..67eaddc47717 100644 --- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -2541,9 +2541,6 @@ int f2fs_encrypt_one_page(struct f2fs_io_info *fio) page = fio->compressed_page ? fio->compressed_page : fio->page; - /* wait for GCed page writeback via META_MAPPING */ - f2fs_wait_on_block_writeback(inode, fio->old_blkaddr); - if (fscrypt_inode_uses_inline_crypto(inode)) return 0; @@ -2702,6 +2699,11 @@ int f2fs_do_write_data_page(struct f2fs_io_info *fio) err = -EFSCORRUPTED; goto out_writepage; } + + /* wait for GCed page writeback via META_MAPPING */ + if (fio->post_read) + f2fs_wait_on_block_writeback(inode, fio->old_blkaddr); + /* * If current allocation needs SSR, * it had better in-place writes for updated data. -- 2.39.2

2 1

[PATCH OLK-5.10] f2fs: fix to wait on block writeback for post_read case
by Zizhi Wo 22 May '24

22 May '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.1.75 commit 9bfd5ea71521d0e522ba581c6ccc5db93759c0c3 category: bugfix bugzilla: 189947 CVE: CVE-2023-52682 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 55fdc1c24a1d6229fe0ecf31335fb9a2eceaaa00 ] If inode is compressed, but not encrypted, it missed to call f2fs_wait_on_block_writeback() to wait for GCed page writeback in IPU write path. Thread A GC-Thread - f2fs_gc - do_garbage_collect - gc_data_segment - move_data_block - f2fs_submit_page_write migrate normal cluster's block via meta_inode's page cache - f2fs_write_single_data_page - f2fs_do_write_data_page - f2fs_inplace_write_data - f2fs_submit_page_bio IRQ - f2fs_read_end_io IRQ old data overrides new data due to out-of-order GC and common IO. - f2fs_read_end_io Fixes: 4c8ff7095bef ("f2fs: support data compression") Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/f2fs/data.c [f2fs_handle_error function does not exist. The conflict is not related to the patch] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/data.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c index 18c031a0bf56..67eaddc47717 100644 --- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -2541,9 +2541,6 @@ int f2fs_encrypt_one_page(struct f2fs_io_info *fio) page = fio->compressed_page ? fio->compressed_page : fio->page; - /* wait for GCed page writeback via META_MAPPING */ - f2fs_wait_on_block_writeback(inode, fio->old_blkaddr); - if (fscrypt_inode_uses_inline_crypto(inode)) return 0; @@ -2702,6 +2699,11 @@ int f2fs_do_write_data_page(struct f2fs_io_info *fio) err = -EFSCORRUPTED; goto out_writepage; } + + /* wait for GCed page writeback via META_MAPPING */ + if (fio->post_read) + f2fs_wait_on_block_writeback(inode, fio->old_blkaddr); + /* * If current allocation needs SSR, * it had better in-place writes for updated data. -- 2.39.2

2 1

[PATCH OLK-5.10 0/1] Fix allmodconfig build error
by Shuai Wu 22 May '24

22 May '24

Fix allmodconfig build error in hiroce3 driver. Fixes: ae52f9c522dd ("infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver") Shuai Wu (1): net/ethernet/huawei/hiroce3: Fix allmodconfig build error .../hw/hiroce3/bond/roce_bond_common.c | 38 +- .../hw/hiroce3/cq/roce_cq_destroy.c | 15 +- .../hw/hiroce3/host/hmm/hmm_comp_mtt.c | 1 + .../hw/hiroce3/host/hmm/hmm_comp_mw_mr.c | 1 + .../hw/hiroce3/host/hmm/hmm_comp_res.c | 1 + .../infiniband/hw/hiroce3/host/hmm/hmm_mr.c | 98 +---- .../infiniband/hw/hiroce3/host/hmm/hmm_umem.c | 4 +- .../infiniband/hw/hiroce3/host/hmm/hmm_umem.h | 2 +- .../include/rdma/rdma_context_format.h | 4 +- .../include/rdma/rdma_ext_ctx_format.h | 5 +- .../hw/hiroce3/include/rdma/roce_ccf_format.h | 4 +- .../hw/hiroce3/include/rdma/roce_verbs_attr.h | 4 +- .../include/rdma/roce_verbs_attr_qpc_chip.h | 4 +- .../hiroce3/include/rdma/roce_verbs_cq_attr.h | 4 +- .../include/rdma/roce_verbs_ext_attr.h | 4 +- .../include/rdma/roce_verbs_gid_attr.h | 4 +- .../hiroce3/include/rdma/roce_verbs_mr_attr.h | 4 +- .../hw/hiroce3/include/rdma/roce_verbs_pub.h | 4 +- .../include/rdma/roce_verbs_srq_attr.h | 4 +- drivers/infiniband/hw/hiroce3/mr/roce_mr.c | 37 -- drivers/infiniband/hw/hiroce3/roce.h | 1 - drivers/infiniband/hw/hiroce3/roce_main.c | 7 +- .../ethernet/huawei/hinic3/bond/hinic3_bond.c | 1 - .../ethernet/huawei/hinic3/bond/hinic3_bond.h | 4 +- .../ethernet/huawei/hinic3/cqm/cqm_bat_cla.c | 198 +++------ .../huawei/hinic3/cqm/cqm_bitmap_table.c | 10 +- .../huawei/hinic3/cqm/cqm_bloomfilter.c | 69 +--- .../net/ethernet/huawei/hinic3/cqm/cqm_cmd.c | 139 ++----- .../net/ethernet/huawei/hinic3/cqm/cqm_cmd.h | 2 - .../net/ethernet/huawei/hinic3/cqm/cqm_db.c | 192 +++------ .../ethernet/huawei/hinic3/cqm/cqm_define.h | 4 - .../net/ethernet/huawei/hinic3/cqm/cqm_main.c | 178 +++------ .../ethernet/huawei/hinic3/cqm/cqm_object.c | 378 +++++------------- .../huawei/hinic3/cqm/cqm_object_intern.c | 194 +++------ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c | 2 +- .../ethernet/huawei/hinic3/hw/hinic3_hwif.c | 38 -- .../huawei/hinic3/hw/hinic3_multi_host_mgmt.c | 56 ++- .../hinic3/include/bond/bond_common_defs.h | 4 +- .../huawei/hinic3/include/hinic3_common.h | 2 - .../huawei/hinic3/include/hinic3_cqm.h | 11 - .../huawei/hinic3/include/hinic3_cqm_define.h | 4 - .../include/mpu/mpu_outband_ncsi_cmd_defs.h | 4 +- 42 files changed, 474 insertions(+), 1266 deletions(-) -- 2.33.0

2 2

[PATCH OLK-5.10] kobject: Fix global-out-of-bounds in kobject_action_type()
by Xia Fukun 22 May '24

22 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9REGZ CVE: NA -------------------------------- The following c language code can trigger KASAN's global variable out-of-bounds access error in kobject_action_type(): int main() { int fd; char *filename = "/sys/block/ram12/uevent"; char str[86] = "offline"; int len = 86; fd = open(filename, O_WRONLY); if (fd == -1) { printf("open"); exit(1); } if (write(fd, str, len) == -1) { printf("write"); exit(1); } close(fd); return 0; } Function kobject_action_type() receives the input parameters buf and count, where count is the length of the string buf. In the use case we provided, count is 86, the count_first is 85. Buf points to a string with a length of 86, and its first seven characters are "offline". In line 87 of the code, kobject_actions[action] is the string "offline" with the length of 7,an out-of-boundary access will appear: kobject_actions[action][85]. Modify the judgment logic in line 87. If the length of the string kobject_actions[action] is greater than count_first(e.g. buf is "off", count is 3), continue the loop. Otherwise, the match is considered successful. This change means that our test case will be successfully parsed as an offline event and no out-of-bounds access error will occur. Fixes: f36776fafbaa ("kobject: support passing in variables for synthetic uevents") Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- lib/kobject_uevent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c index c87d5b6a8a55..8056def4c028 100644 --- a/lib/kobject_uevent.c +++ b/lib/kobject_uevent.c @@ -84,7 +84,7 @@ static int kobject_action_type(const char *buf, size_t count, for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) { if (strncmp(kobject_actions[action], buf, count_first) != 0) continue; - if (kobject_actions[action][count_first] != '\0') + if (strlen(kobject_actions[action]) > count_first) continue; if (args) *args = args_start; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
by Liu Chuang 22 May '24

22 May '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v4.19.299 commit 2f236d8638f5b43e0c72919a6a27fe286c32053f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RDP6 CVE: CVE-2023-52840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit eb988e46da2e4eae89f5337e047ce372fe33d5b1 ] The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is a use after free. Move the put_device() to the end to fix this. Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/706efd36-7561-42f3-adfa-dd1d0bd4f5a1@moroto.mount… Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/input/rmi4/rmi_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/input/rmi4/rmi_bus.c b/drivers/input/rmi4/rmi_bus.c index bd0d5ff01b08..02408487b442 100644 --- a/drivers/input/rmi4/rmi_bus.c +++ b/drivers/input/rmi4/rmi_bus.c @@ -279,11 +279,11 @@ void rmi_unregister_function(struct rmi_function *fn) device_del(&fn->dev); of_node_put(fn->dev.of_node); - put_device(&fn->dev); for (i = 0; i < fn->num_of_irqs; i++) irq_dispose_mapping(fn->irq[i]); + put_device(&fn->dev); } /** -- 2.34.1

2 1

[PATCH OLK-5.10 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 12 +++++++++++- 2 files changed, 18 insertions(+), 3 deletions(-) -- 2.34.1

2 2