- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] btrfs: fix deadlock when cloning inline extents and using qgroups
by q00831684 01 Mar '24

01 Mar '24

From: Filipe Manana <fdmanana(a)suse.com> stable inclusion from stable-v5.12.5 commit 96157707c0420e3d3edfe046f1cc797fee117ade bugzilla: 189580 CVE: CVE-2021-46987 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit f9baa501b4fd6962257853d46ddffbc21f27e344 ] There are a few exceptional cases where cloning an inline extent needs to copy the inline extent data into a page of the destination inode. When this happens, we end up starting a transaction while having a dirty page for the destination inode and while having the range locked in the destination's inode iotree too. Because when reserving metadata space for a transaction we may need to flush existing delalloc in case there is not enough free space, we have a mechanism in place to prevent a deadlock, which was introduced in commit 3d45f221ce627d ("btrfs: fix deadlock when cloning inline extent and low on free metadata space"). However when using qgroups, a transaction also reserves metadata qgroup space, which can also result in flushing delalloc in case there is not enough available space at the moment. When this happens we deadlock, since flushing delalloc requires locking the file range in the inode's iotree and the range was already locked at the very beginning of the clone operation, before attempting to start the transaction. When this issue happens, stack traces like the following are reported: [72747.556262] task:kworker/u81:9 state:D stack: 0 pid: 225 ppid: 2 flags:0x00004000 [72747.556268] Workqueue: writeback wb_workfn (flush-btrfs-1142) [72747.556271] Call Trace: [72747.556273] __schedule+0x296/0x760 [72747.556277] schedule+0x3c/0xa0 [72747.556279] io_schedule+0x12/0x40 [72747.556284] __lock_page+0x13c/0x280 [72747.556287] ? generic_file_readonly_mmap+0x70/0x70 [72747.556325] extent_write_cache_pages+0x22a/0x440 [btrfs] [72747.556331] ? __set_page_dirty_nobuffers+0xe7/0x160 [72747.556358] ? set_extent_buffer_dirty+0x5e/0x80 [btrfs] [72747.556362] ? update_group_capacity+0x25/0x210 [72747.556366] ? cpumask_next_and+0x1a/0x20 [72747.556391] extent_writepages+0x44/0xa0 [btrfs] [72747.556394] do_writepages+0x41/0xd0 [72747.556398] __writeback_single_inode+0x39/0x2a0 [72747.556403] writeback_sb_inodes+0x1ea/0x440 [72747.556407] __writeback_inodes_wb+0x5f/0xc0 [72747.556410] wb_writeback+0x235/0x2b0 [72747.556414] ? get_nr_inodes+0x35/0x50 [72747.556417] wb_workfn+0x354/0x490 [72747.556420] ? newidle_balance+0x2c5/0x3e0 [72747.556424] process_one_work+0x1aa/0x340 [72747.556426] worker_thread+0x30/0x390 [72747.556429] ? create_worker+0x1a0/0x1a0 [72747.556432] kthread+0x116/0x130 [72747.556435] ? kthread_park+0x80/0x80 [72747.556438] ret_from_fork+0x1f/0x30 [72747.566958] Workqueue: btrfs-flush_delalloc btrfs_work_helper [btrfs] [72747.566961] Call Trace: [72747.566964] __schedule+0x296/0x760 [72747.566968] ? finish_wait+0x80/0x80 [72747.566970] schedule+0x3c/0xa0 [72747.566995] wait_extent_bit.constprop.68+0x13b/0x1c0 [btrfs] [72747.566999] ? finish_wait+0x80/0x80 [72747.567024] lock_extent_bits+0x37/0x90 [btrfs] [72747.567047] btrfs_invalidatepage+0x299/0x2c0 [btrfs] [72747.567051] ? find_get_pages_range_tag+0x2cd/0x380 [72747.567076] __extent_writepage+0x203/0x320 [btrfs] [72747.567102] extent_write_cache_pages+0x2bb/0x440 [btrfs] [72747.567106] ? update_load_avg+0x7e/0x5f0 [72747.567109] ? enqueue_entity+0xf4/0x6f0 [72747.567134] extent_writepages+0x44/0xa0 [btrfs] [72747.567137] ? enqueue_task_fair+0x93/0x6f0 [72747.567140] do_writepages+0x41/0xd0 [72747.567144] __filemap_fdatawrite_range+0xc7/0x100 [72747.567167] btrfs_run_delalloc_work+0x17/0x40 [btrfs] [72747.567195] btrfs_work_helper+0xc2/0x300 [btrfs] [72747.567200] process_one_work+0x1aa/0x340 [72747.567202] worker_thread+0x30/0x390 [72747.567205] ? create_worker+0x1a0/0x1a0 [72747.567208] kthread+0x116/0x130 [72747.567211] ? kthread_park+0x80/0x80 [72747.567214] ret_from_fork+0x1f/0x30 [72747.569686] task:fsstress state:D stack: 0 pid:841421 ppid:841417 flags:0x00000000 [72747.569689] Call Trace: [72747.569691] __schedule+0x296/0x760 [72747.569694] schedule+0x3c/0xa0 [72747.569721] try_flush_qgroup+0x95/0x140 [btrfs] [72747.569725] ? finish_wait+0x80/0x80 [72747.569753] btrfs_qgroup_reserve_data+0x34/0x50 [btrfs] [72747.569781] btrfs_check_data_free_space+0x5f/0xa0 [btrfs] [72747.569804] btrfs_buffered_write+0x1f7/0x7f0 [btrfs] [72747.569810] ? path_lookupat.isra.48+0x97/0x140 [72747.569833] btrfs_file_write_iter+0x81/0x410 [btrfs] [72747.569836] ? __kmalloc+0x16a/0x2c0 [72747.569839] do_iter_readv_writev+0x160/0x1c0 [72747.569843] do_iter_write+0x80/0x1b0 [72747.569847] vfs_writev+0x84/0x140 [72747.569869] ? btrfs_file_llseek+0x38/0x270 [btrfs] [72747.569873] do_writev+0x65/0x100 [72747.569876] do_syscall_64+0x33/0x40 [72747.569879] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [72747.569899] task:fsstress state:D stack: 0 pid:841424 ppid:841417 flags:0x00004000 [72747.569903] Call Trace: [72747.569906] __schedule+0x296/0x760 [72747.569909] schedule+0x3c/0xa0 [72747.569936] try_flush_qgroup+0x95/0x140 [btrfs] [72747.569940] ? finish_wait+0x80/0x80 [72747.569967] __btrfs_qgroup_reserve_meta+0x36/0x50 [btrfs] [72747.569989] start_transaction+0x279/0x580 [btrfs] [72747.570014] clone_copy_inline_extent+0x332/0x490 [btrfs] [72747.570041] btrfs_clone+0x5b7/0x7a0 [btrfs] [72747.570068] ? lock_extent_bits+0x64/0x90 [btrfs] [72747.570095] btrfs_clone_files+0xfc/0x150 [btrfs] [72747.570122] btrfs_remap_file_range+0x3d8/0x4a0 [btrfs] [72747.570126] do_clone_file_range+0xed/0x200 [72747.570131] vfs_clone_file_range+0x37/0x110 [72747.570134] ioctl_file_clone+0x7d/0xb0 [72747.570137] do_vfs_ioctl+0x138/0x630 [72747.570140] __x64_sys_ioctl+0x62/0xc0 [72747.570143] do_syscall_64+0x33/0x40 [72747.570146] entry_SYSCALL_64_after_hwframe+0x44/0xa9 So fix this by skipping the flush of delalloc for an inode that is flagged with BTRFS_INODE_NO_DELALLOC_FLUSH, meaning it is currently under such a special case of cloning an inline extent, when flushing delalloc during qgroup metadata reservation. The special cases for cloning inline extents were added in kernel 5.7 by by commit 05a5a7621ce66c ("Btrfs: implement full reflink support for inline extents"), while having qgroup metadata space reservation flushing delalloc when low on space was added in kernel 5.9 by commit c53e9653605dbf ("btrfs: qgroup: try to flush qgroup space when we get -EDQUOT"). So use a "Fixes:" tag for the later commit to ease stable kernel backports. Reported-by: Wang Yugui <wangyugui(a)e16-tech.com> Link: https://lore.kernel.org/linux-btrfs/20210421083137.31E3.409509F4@e16-tech.c… Fixes: c53e9653605dbf ("btrfs: qgroup: try to flush qgroup space when we get -EDQUOT") CC: stable(a)vger.kernel.org # 5.9+ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ctree.h | 2 +- fs/btrfs/inode.c | 4 ++-- fs/btrfs/ioctl.c | 2 +- fs/btrfs/qgroup.c | 2 +- fs/btrfs/send.c | 4 ++-- fs/btrfs/transaction.c | 2 +- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h index bcc6848bb6d6..92ecb4562584 100644 --- a/fs/btrfs/ctree.h +++ b/fs/btrfs/ctree.h @@ -3008,7 +3008,7 @@ int btrfs_truncate_inode_items(struct btrfs_trans_handle *trans, struct inode *inode, u64 new_size, u32 min_type); -int btrfs_start_delalloc_snapshot(struct btrfs_root *root); +int btrfs_start_delalloc_snapshot(struct btrfs_root *root, bool in_reclaim_context); int btrfs_start_delalloc_roots(struct btrfs_fs_info *fs_info, u64 nr, bool in_reclaim_context); int btrfs_set_extent_delalloc(struct btrfs_inode *inode, u64 start, u64 end, diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index c900a39666e3..d87a53613e34 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -9526,7 +9526,7 @@ static int start_delalloc_inodes(struct btrfs_root *root, return ret; } -int btrfs_start_delalloc_snapshot(struct btrfs_root *root) +int btrfs_start_delalloc_snapshot(struct btrfs_root *root, bool in_reclaim_context) { struct writeback_control wbc = { .nr_to_write = LONG_MAX, @@ -9539,7 +9539,7 @@ int btrfs_start_delalloc_snapshot(struct btrfs_root *root) if (test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state)) return -EROFS; - return start_delalloc_inodes(root, &wbc, true, false); + return start_delalloc_inodes(root, &wbc, true, in_reclaim_context); } int btrfs_start_delalloc_roots(struct btrfs_fs_info *fs_info, u64 nr, diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index 63bf68e0b006..e71c80b45bb1 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -1030,7 +1030,7 @@ static noinline int btrfs_mksnapshot(const struct path *parent, */ btrfs_drew_read_lock(&root->snapshot_lock); - ret = btrfs_start_delalloc_snapshot(root); + ret = btrfs_start_delalloc_snapshot(root, false); if (ret) goto out; diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c index a67323c2d41f..506d12ef0d16 100644 --- a/fs/btrfs/qgroup.c +++ b/fs/btrfs/qgroup.c @@ -3695,7 +3695,7 @@ static int try_flush_qgroup(struct btrfs_root *root) return 0; } - ret = btrfs_start_delalloc_snapshot(root); + ret = btrfs_start_delalloc_snapshot(root, true); if (ret < 0) goto out; btrfs_wait_ordered_extents(root, U64_MAX, 0, (u64)-1); diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c index b081b61e97c8..ff3114e652b3 100644 --- a/fs/btrfs/send.c +++ b/fs/btrfs/send.c @@ -7196,7 +7196,7 @@ static int flush_delalloc_roots(struct send_ctx *sctx) int i; if (root) { - ret = btrfs_start_delalloc_snapshot(root); + ret = btrfs_start_delalloc_snapshot(root, false); if (ret) return ret; btrfs_wait_ordered_extents(root, U64_MAX, 0, U64_MAX); @@ -7204,7 +7204,7 @@ static int flush_delalloc_roots(struct send_ctx *sctx) for (i = 0; i < sctx->clone_roots_cnt; i++) { root = sctx->clone_roots[i].root; - ret = btrfs_start_delalloc_snapshot(root); + ret = btrfs_start_delalloc_snapshot(root, false); if (ret) return ret; btrfs_wait_ordered_extents(root, U64_MAX, 0, U64_MAX); diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c index abd67f984fbc..6b1bdb710123 100644 --- a/fs/btrfs/transaction.c +++ b/fs/btrfs/transaction.c @@ -2044,7 +2044,7 @@ static inline int btrfs_start_delalloc_flush(struct btrfs_trans_handle *trans) list_for_each_entry(pending, head, list) { int ret; - ret = btrfs_start_delalloc_snapshot(pending->root); + ret = btrfs_start_delalloc_snapshot(pending->root, false); if (ret) return ret; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] media: dvbdev: Fix memory leak in dvb_media_device_free()
by Wenyu Huang 01 Mar '24

01 Mar '24

From: Peilin Ye <yepeilin.cs(a)gmail.com> mainline inclusion from mainline-v6.8-rc6 commit bf9a40ae8d722f281a2721779595d6df1c33a0bf category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I94UCW CVE: CVE-2020-36777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- dvb_media_device_free() is leaking memory. Free `dvbdev->adapter->conn` before setting it to NULL, as documented in include/media/media-device.h: "The media_entity instance itself must be freed explicitly by the driver if required." Link: https://syzkaller.appspot.com/bug?id=9bbe4b842c98f0ed05c5eed77a226e9de33bf2… Link: https://lore.kernel.org/linux-media/20201211083039.521617-1-yepeilin.cs@gma… Cc: stable(a)vger.kernel.org Fixes: 0230d60e4661 ("[media] dvbdev: Add RF connector if needed") Reported-by: syzbot+7f09440acc069a0d38ac(a)syzkaller.appspotmail.com Signed-off-by: Peilin Ye <yepeilin.cs(a)gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/media/dvb-core/dvbdev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c index a7d57ff7c88b..4b562238749d 100644 --- a/drivers/media/dvb-core/dvbdev.c +++ b/drivers/media/dvb-core/dvbdev.c @@ -242,6 +242,7 @@ static void dvb_media_device_free(struct dvb_device *dvbdev) if (dvbdev->adapter->conn) { media_device_unregister_entity(dvbdev->adapter->conn); + kfree(dvbdev->adapter->conn); dvbdev->adapter->conn = NULL; kfree(dvbdev->adapter->conn_pads); dvbdev->adapter->conn_pads = NULL; -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS ebba55154f6b47b476dbcd26c12f31ead8bcd4c6
by kernel test robot 01 Mar '24

01 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: ebba55154f6b47b476dbcd26c12f31ead8bcd4c6 !4794 serial: imx: fix tx statemachine deadlock Warning ids grouped by kconfigs: clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns | `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode `-- x86_64-randconfig-161-20240301 `-- drivers-misc-uacce-uacce.c-uacce_get_ss_dma()-warn:potential-spectre-issue-slice-r-(local-cap) elapsed time: 727m configs tested: 35 configs skipped: 150 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240301 gcc arm64 randconfig-002-20240301 clang arm64 randconfig-003-20240301 gcc arm64 randconfig-004-20240301 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240301 clang x86_64 buildonly-randconfig-002-20240301 gcc x86_64 buildonly-randconfig-003-20240301 clang x86_64 buildonly-randconfig-004-20240301 gcc x86_64 buildonly-randconfig-005-20240301 clang x86_64 buildonly-randconfig-006-20240301 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240301 gcc x86_64 randconfig-002-20240301 clang x86_64 randconfig-003-20240301 clang x86_64 randconfig-004-20240301 clang x86_64 randconfig-005-20240301 gcc x86_64 randconfig-006-20240301 gcc x86_64 randconfig-011-20240301 clang x86_64 randconfig-012-20240301 clang x86_64 randconfig-013-20240301 clang x86_64 randconfig-014-20240301 gcc x86_64 randconfig-015-20240301 clang x86_64 randconfig-016-20240301 gcc x86_64 randconfig-071-20240301 gcc x86_64 randconfig-072-20240301 clang x86_64 randconfig-073-20240301 gcc x86_64 randconfig-074-20240301 gcc x86_64 randconfig-075-20240301 gcc x86_64 randconfig-076-20240301 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS WITH WARNING a828e118f71b941479af277bc6aade0094fc62fe
by kernel test robot 01 Mar '24

01 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: a828e118f71b941479af277bc6aade0094fc62fe !4812 parisc: Clear stale IIR value on instruction access rights trap Warning reports: https://lore.kernel.org/oe-kbuild-all/202402292301.Zc2bmew3-lkp@intel.com Warning: (recently discovered and may have been fixed) drivers/net/ethernet/hisilicon/hns3/hnae3.h:721:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-randconfig-001-20240228 | `-- drivers-net-ethernet-hisilicon-hns3-hnae3.h:warning:array-subscript-struct-hclge_reset_cmd-is-partly-outside-array-bounds-of-struct-hclge_desc `-- arm64-randconfig-002-20240229 |-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-ce-description-in-qm_hw_error_init |-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-fe-description-in-qm_hw_error_init |-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-msi-description-in-qm_hw_error_init `-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-nfe-description-in-qm_hw_error_init elapsed time: 724m configs tested: 35 configs skipped: 148 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240229 gcc arm64 randconfig-002-20240229 gcc arm64 randconfig-003-20240229 gcc arm64 randconfig-004-20240229 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240229 gcc x86_64 buildonly-randconfig-002-20240229 clang x86_64 buildonly-randconfig-003-20240229 gcc x86_64 buildonly-randconfig-004-20240229 gcc x86_64 buildonly-randconfig-005-20240229 gcc x86_64 buildonly-randconfig-006-20240229 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240229 clang x86_64 randconfig-002-20240229 clang x86_64 randconfig-003-20240229 clang x86_64 randconfig-004-20240229 clang x86_64 randconfig-005-20240229 clang x86_64 randconfig-006-20240229 clang x86_64 randconfig-011-20240229 gcc x86_64 randconfig-012-20240229 gcc x86_64 randconfig-013-20240229 gcc x86_64 randconfig-014-20240229 gcc x86_64 randconfig-015-20240229 gcc x86_64 randconfig-016-20240229 gcc x86_64 randconfig-071-20240229 clang x86_64 randconfig-072-20240229 clang x86_64 randconfig-073-20240229 clang x86_64 randconfig-074-20240229 clang x86_64 randconfig-075-20240229 gcc x86_64 randconfig-076-20240229 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2409/3684] mm/mem_reliable.c:159:45: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list')
by kernel test robot 01 Mar '24

01 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 3016126ef302b602feaa8a7b99e4f85987536d65 commit: e1767ef2184b4a3d188596e2217e62fe757f07b3 [2409/3684] mm: mem_reliable: Show reliable meminfo config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240301/202403010836.kBJY9HM4-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project 325f51237252e6dab8e4e1ea1fa7acbb4faee1cd) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240301/202403010836.kBJY9HM4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403010836.kBJY9HM4-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/mem_reliable.c:5: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> mm/mem_reliable.c:159:45: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 159 | num += global_node_page_state(NR_LRU_BASE + LRU_ACTIVE_FILE); | ~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~ mm/mem_reliable.c:160:45: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 160 | num += global_node_page_state(NR_LRU_BASE + LRU_INACTIVE_FILE); | ~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~ 7 warnings generated. vim +159 mm/mem_reliable.c 133 134 void reliable_report_meminfo(struct seq_file *m) 135 { 136 if (!mem_reliable_is_enabled()) 137 return; 138 139 seq_printf(m, "ReliableTotal: %8lu kB\n", 140 PAGES_TO_KB(total_reliable_pages())); 141 seq_printf(m, "ReliableUsed: %8lu kB\n", 142 PAGES_TO_KB(used_reliable_pages())); 143 seq_printf(m, "ReliableTaskUsed: %8lu kB\n", 144 PAGES_TO_KB(task_reliable_used_pages())); 145 seq_printf(m, "ReliableBuddyMem: %8lu kB\n", 146 PAGES_TO_KB(free_reliable_pages())); 147 148 if (shmem_reliable_is_enabled()) { 149 unsigned long shmem_pages = (unsigned long)percpu_counter_sum( 150 &shmem_reliable_pages); 151 seq_printf(m, "ReliableShmem: %8lu kB\n", 152 PAGES_TO_KB(shmem_pages)); 153 } 154 155 if (filemap_reliable_is_enabled()) { 156 unsigned long nr_reliable_pages = 0; 157 unsigned long num = 0; 158 > 159 num += global_node_page_state(NR_LRU_BASE + LRU_ACTIVE_FILE); 160 num += global_node_page_state(NR_LRU_BASE + LRU_INACTIVE_FILE); 161 seq_printf(m, "FileCache: %8lu kB\n", PAGES_TO_KB(num)); 162 163 nr_reliable_pages = 164 percpu_counter_sum_positive(&pagecache_reliable_pages); 165 seq_printf(m, "ReliableFileCache: %8lu kB\n", 166 PAGES_TO_KB(nr_reliable_pages)); 167 } 168 } 169 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3638/3684] drivers/i2c/busses/i2c-hisi.c:476: warning: expecting prototype for i2c_dw_acpi_pin_mux_change(). Prototype was for i2c_hisi_pin_mux_change() instead
by kernel test robot 01 Mar '24

01 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 3016126ef302b602feaa8a7b99e4f85987536d65 commit: bdc031294c4d4fd6326f9460ceedd37fa1d79195 [3638/3684] i2c: hisi: Add gpio bus recovery support config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240301/202403010757.Yy3swMx9-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project edd4aee4dd9b5b98b2576a6f783e4086173d902a) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240301/202403010757.Yy3swMx9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403010757.Yy3swMx9-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/i2c/busses/i2c-hisi.c:476: warning: expecting prototype for i2c_dw_acpi_pin_mux_change(). Prototype was for i2c_hisi_pin_mux_change() instead vim +476 drivers/i2c/busses/i2c-hisi.c 465 466 /** 467 * i2c_dw_acpi_pin_mux_change - Change the I2C controller's pin mux through ACPI 468 * @dev: device owns the SCL/SDA pin 469 * @to_gpio: true to switch to GPIO, false to switch to SCL/SDA 470 * 471 * The function invokes the specific ACPI method "PMUX" for changing the 472 * pin mux of I2C controller between SCL/SDA and GPIO in order to help on 473 * the generic GPIO recovery process. 474 */ 475 static void i2c_hisi_pin_mux_change(struct device *dev, bool to_gpio) > 476 { 477 acpi_handle handle = ACPI_HANDLE(dev); 478 struct acpi_object_list arg_list; 479 unsigned long long data; 480 union acpi_object arg; 481 482 arg.type = ACPI_TYPE_INTEGER; 483 arg.integer.value = to_gpio; 484 arg_list.count = 1; 485 arg_list.pointer = &arg; 486 487 acpi_evaluate_integer(handle, HISI_I2C_PIN_MUX_METHOD, &arg_list, &data); 488 } 489 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 14909/21656] drivers/net/ethernet/hisilicon/hns3/hnae3.h:721:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]'
by kernel test robot 29 Feb '24

29 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a828e118f71b941479af277bc6aade0094fc62fe commit: 729f96a4e0c32f1c1bfa60e4ff485aa91890963d [14909/21656] net: hns3: optimize the process of queue reset config: arm64-randconfig-001-20240228 (https://download.01.org/0day-ci/archive/20240229/202402292301.Zc2bmew3-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240229/202402292301.Zc2bmew3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402292301.Zc2bmew3-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3345:5: warning: no previous prototype for 'hclge_set_all_vf_rst' [-Wmissing-prototypes] 3345 | int hclge_set_all_vf_rst(struct hclge_dev *hdev, bool reset) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9556:5: warning: no previous prototype for 'hclge_reset_tqp_cmd' [-Wmissing-prototypes] 9556 | int hclge_reset_tqp_cmd(struct hnae3_handle *handle) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9603:5: warning: no previous prototype for 'hclge_reset_rcb' [-Wmissing-prototypes] 9603 | int hclge_reset_rcb(struct hnae3_handle *handle) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:11699:5: warning: no previous prototype for 'hclge_init' [-Wmissing-prototypes] 11699 | int hclge_init(void) | ^~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_get_strings': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:668:50: warning: '%s' directive output may be truncated writing up to 3359 bytes into a region of size 32 [-Wformat-truncation=] 668 | snprintf(buff, ETH_GSTRING_LEN, "%s", strs[i].desc); | ^~ In function 'hclge_comm_get_strings', inlined from 'hclge_get_strings' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:774:7: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:668:17: note: 'snprintf' output between 1 and 3360 bytes into a destination of size 32 668 | snprintf(buff, ETH_GSTRING_LEN, "%s", strs[i].desc); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h:9, from drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:18: In function 'hclge_func_reset_cmd', inlined from 'hclge_reset_prepare_wait' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3608:9: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); drivers/net/ethernet/hisilicon/hns3/hnae3.h:720:18: note: in definition of macro 'hnae3_set_field' 720 | (origin) &= (~(mask)); \ | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_prepare_wait': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ In function 'hclge_func_reset_cmd', inlined from 'hclge_reset_prepare_wait' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3608:9: >> drivers/net/ethernet/hisilicon/hns3/hnae3.h:721:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 721 | (origin) |= ((val) << (shift)) & (mask); \ | ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:726:9: note: in expansion of macro 'hnae3_set_field' 726 | hnae3_set_field((origin), (0x1 << (shift)), (shift), (val)) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_prepare_wait': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ In function 'hclge_func_reset_cmd', inlined from 'hclge_reset_prepare_wait' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3608:9: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3468:29: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3468 | req->fun_reset_vfid = func_id; | ~~~~~~~~~~~~~~~~~~~~^~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_prepare_wait': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_func_reset_cmd': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:720:18: note: in definition of macro 'hnae3_set_field' 720 | (origin) &= (~(mask)); \ | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:721:18: note: in definition of macro 'hnae3_set_field' 721 | (origin) |= ((val) << (shift)) & (mask); \ | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3468:12: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3468 | req->fun_reset_vfid = func_id; | ^~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_rcb': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9619:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 9619 | hnae3_set_bit(req->fun_reset_rcb, HCLGE_CFG_RESET_RCB_B, 1); | ^~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:720:18: note: in definition of macro 'hnae3_set_field' 720 | (origin) &= (~(mask)); \ | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9619:9: note: in expansion of macro 'hnae3_set_bit' 9619 | hnae3_set_bit(req->fun_reset_rcb, HCLGE_CFG_RESET_RCB_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9610:27: note: at offset 8 into object 'desc' of size 32 9610 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9619:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 9619 | hnae3_set_bit(req->fun_reset_rcb, HCLGE_CFG_RESET_RCB_B, 1); | ^~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:721:18: note: in definition of macro 'hnae3_set_field' 721 | (origin) |= ((val) << (shift)) & (mask); \ | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9619:9: note: in expansion of macro 'hnae3_set_bit' 9619 | hnae3_set_bit(req->fun_reset_rcb, HCLGE_CFG_RESET_RCB_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9610:27: note: at offset 8 into object 'desc' of size 32 9610 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9620:12: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 9620 | req->fun_reset_rcb_vqid_start = cpu_to_le16(queue_gid); | ^~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9610:27: note: at offset 8 into object 'desc' of size 32 9610 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9621:12: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 9621 | req->fun_reset_rcb_vqid_num = cpu_to_le16(handle->kinfo.num_tqps); | ^~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9610:27: note: at offset 8 into object 'desc' of size 32 9610 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9630:28: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 9630 | return_status = req->fun_reset_rcb_return_status; | ^~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9610:27: note: at offset 8 into object 'desc' of size 32 9610 | struct hclge_desc desc; | ^~~~ vim +721 drivers/net/ethernet/hisilicon/hns3/hnae3.h 38caee9d3ee8b32 Salil 2017-08-02 717 e4e87715aa850ab Peng Li 2018-07-02 718 #define hnae3_set_field(origin, mask, shift, val) \ 38caee9d3ee8b32 Salil 2017-08-02 719 do { \ 38caee9d3ee8b32 Salil 2017-08-02 720 (origin) &= (~(mask)); \ 38caee9d3ee8b32 Salil 2017-08-02 @721 (origin) |= ((val) << (shift)) & (mask); \ 38caee9d3ee8b32 Salil 2017-08-02 722 } while (0) e4e87715aa850ab Peng Li 2018-07-02 723 #define hnae3_get_field(origin, mask, shift) (((origin) & (mask)) >> (shift)) 38caee9d3ee8b32 Salil 2017-08-02 724 :::::: The code at line 721 was first introduced by commit :::::: 38caee9d3ee8b32b36912f54e19438eddd126772 net: hns3: Add support of the HNAE3 framework :::::: TO: Salil <salil.mehta(a)huawei.com> :::::: CC: David S. Miller <davem(a)davemloft.net> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] sched/membarrier: reduce the ability to hammer on sys_membarrier
by Zhao Wenhui 29 Feb '24

29 Feb '24

From: Linus Torvalds <torvalds(a)linuxfoundation.org> stable inclusion from stable-v4.19.307 commit 3cd139875e9a7688b3fc715264032620812a5fa3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93SNV CVE: CVE-2024-26602 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 944d5fe50f3f03daacfea16300e656a1691c4a23 upstream. On some systems, sys_membarrier can be very expensive, causing overall slowdowns for everything. So put a lock on the path in order to serialize the accesses to prevent the ability for this to be called at too high of a frequency and saturate the machine. Reviewed-and-tested-by: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Acked-by: Borislav Petkov <bp(a)alien8.de> Fixes: 22e4ebb97582 ("membarrier: Provide expedited private command") Fixes: c5f58bd58f43 ("membarrier: Provide GLOBAL_EXPEDITED command") Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> [ converted to explicit mutex_*() calls - cleanup.h is not in this stable branch - gregkh ] Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- kernel/sched/membarrier.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c index 1757074be994..4978b8fe59e5 100644 --- a/kernel/sched/membarrier.c +++ b/kernel/sched/membarrier.c @@ -34,6 +34,8 @@ | MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED \ | MEMBARRIER_PRIVATE_EXPEDITED_SYNC_CORE_BITMASK) +static DEFINE_MUTEX(membarrier_ipi_mutex); + static void ipi_mb(void *info) { smp_mb(); /* IPIs should be serializing but paranoid. */ @@ -89,6 +91,7 @@ static int membarrier_global_expedited(void) if (!zalloc_cpumask_var(&tmpmask, GFP_KERNEL)) return -ENOMEM; + mutex_lock(&membarrier_ipi_mutex); cpus_read_lock(); rcu_read_lock(); for_each_online_cpu(cpu) { @@ -135,6 +138,7 @@ static int membarrier_global_expedited(void) * rq->curr modification in scheduler. */ smp_mb(); /* exit from system call is not a mb */ + mutex_unlock(&membarrier_ipi_mutex); return 0; } @@ -168,6 +172,7 @@ static int membarrier_private_expedited(int flags) if (!zalloc_cpumask_var(&tmpmask, GFP_KERNEL)) return -ENOMEM; + mutex_lock(&membarrier_ipi_mutex); cpus_read_lock(); rcu_read_lock(); for_each_online_cpu(cpu) { @@ -202,6 +207,7 @@ static int membarrier_private_expedited(int flags) * rq->curr modification in scheduler. */ smp_mb(); /* exit from system call is not a mb */ + mutex_unlock(&membarrier_ipi_mutex); return 0; } -- 2.34.1

2 1

[PATCH OLK-5.10 0/7] ext4: dio: Put endio under irq context for overwrite
by Zhihao Cheng 29 Feb '24

29 Feb '24

Christoph Hellwig (2): iomap: rename the flags variable in __iomap_dio_rw iomap: pass a flags argument to iomap_dio_rw Jens Axboe (3): iomap: cleanup up iomap_dio_bio_end_io() iomap: use an unsigned type for IOMAP_DIO_* defines iomap: add IOMAP_DIO_INLINE_COMP Zhihao Cheng (2): iomap: Add a IOMAP_DIO_MAY_INLINE_COMP flag ext4: Optimize endio process for DIO overwrites fs/btrfs/inode.c | 4 +-- fs/ext4/file.c | 15 +++++--- fs/gfs2/file.c | 7 ++-- fs/iomap/direct-io.c | 84 ++++++++++++++++++++++++++++--------------- fs/xfs/xfs_file.c | 5 ++- fs/zonefs/super.c | 4 +-- include/linux/iomap.h | 16 +++++++-- 7 files changed, 88 insertions(+), 47 deletions(-) -- 2.31.1

2 8

[PATCH openEuler-1.0-LTS v2 0/2] fix CVE-2020-36782
by Zhang Xiaoxu 29 Feb '24

29 Feb '24

v1->v2: update bugzilla Qinglang Miao (1): i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails Zhang Qilong (1): PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter drivers/i2c/busses/i2c-imx-lpi2c.c | 2 +- include/linux/pm_runtime.h | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH v1 OLK-6.6 0/3] kworker: Fix the problem of ipsan performance degradation on ARM architecture
by jiangdongxu 29 Feb '24

29 Feb '24

From: shaodenghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. shaodenghui (3): iscsi: add member for NUMA aware order workqueue workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance drivers/scsi/iscsi_tcp.c | 9 +++++++++ drivers/scsi/libiscsi.c | 17 ++++++++++++----- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 15 ++++++++++----- 5 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 4

[PATCH openEuler-1.0-LTS v2] io_uring: fix overflows checks in provide buffers
by Long Li 29 Feb '24

29 Feb '24

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v5.10.36 commit cbbc13b115b8f18e0a714d89f87fbdc499acfe2d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JIH CVE: CVE-2021-47040 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 38134ada0ceea3e848fe993263c0ff6207fd46e7 ] Colin reported before possible overflow and sign extension problems in io_provide_buffers_prep(). As Linus pointed out previous attempt did nothing useful, see d81269fecb8ce ("io_uring: fix provide_buffers sign extension"). Do that with help of check_<op>_overflow helpers. And fix struct io_provide_buf::len type, as it doesn't make much sense to keep it signed. Reported-by: Colin Ian King <colin.king(a)canonical.com> Fixes: efe68c1ca8f49 ("io_uring: validate the full range of provided buffers for access") Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/46538827e70fce5f6cdb50897cff4cacc490f380.16184882… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/io_uring.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 018d38bec473..afac3197fd6c 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -486,7 +486,7 @@ struct io_splice { struct io_provide_buf { struct file *file; __u64 addr; - __s32 len; + __u32 len; __u32 bgid; __u16 nbufs; __u16 bid; @@ -3606,7 +3606,7 @@ static int io_remove_buffers(struct io_kiocb *req, bool force_nonblock, static int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { - unsigned long size; + unsigned long size, tmp_check; struct io_provide_buf *p = &req->pbuf; u64 tmp; @@ -3620,6 +3620,12 @@ static int io_provide_buffers_prep(struct io_kiocb *req, p->addr = READ_ONCE(sqe->addr); p->len = READ_ONCE(sqe->len); + if (check_mul_overflow((unsigned long)p->len, (unsigned long)p->nbufs, + &size)) + return -EOVERFLOW; + if (check_add_overflow((unsigned long)p->addr, size, &tmp_check)) + return -EOVERFLOW; + size = (unsigned long)p->len * p->nbufs; if (!access_ok(u64_to_user_ptr(p->addr), size)) return -EFAULT; -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2020-36782
by Zhang Xiaoxu 29 Feb '24

29 Feb '24

*** BLURB HERE *** Qinglang Miao (1): i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails Zhang Qilong (1): PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter drivers/i2c/busses/i2c-imx-lpi2c.c | 2 +- include/linux/pm_runtime.h | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS V1] parisc: Clear stale IIR value on instruction access rights trap
by Cheng Yu 29 Feb '24

29 Feb '24

From: Helge Deller <deller(a)gmx.de> mainline inclusion from mainline-v5.16-rc7 commit 484730e5862f6b872dca13840bed40fd7c60fa26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I947PH CVE: CVE-2021-46928 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a trap 7 (Instruction access rights) occurs, this means the CPU couldn't execute an instruction due to missing execute permissions on the memory region. In this case it seems the CPU didn't even fetched the instruction from memory and thus did not store it in the cr19 (IIR) register before calling the trap handler. So, the trap handler will find some random old stale value in cr19. This patch simply overwrites the stale IIR value with a constant magic "bad food" value (0xbaadf00d), in the hope people don't start to try to understand the various random IIR values in trap 7 dumps. Noticed-by: John David Anglin <dave.anglin(a)bell.net> Signed-off-by: Helge Deller <deller(a)gmx.de> --- arch/parisc/kernel/traps.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c index abeb5321a83f..f509ce685f0e 100644 --- a/arch/parisc/kernel/traps.c +++ b/arch/parisc/kernel/traps.c @@ -697,6 +697,8 @@ void notrace handle_interruption(int code, struct pt_regs *regs) } up_read(&current->mm->mmap_sem); } + /* CPU could not fetch instruction, so clear stale IIR value. */ + regs->iir = 0xbaadf00d; /* Fall Through */ case 27: /* Data memory protection ID trap */ -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS V1] parisc: Clear stale IIR value on instruction access rights trap
by Guan Jing 29 Feb '24

29 Feb '24

From: Helge Deller <deller(a)gmx.de> mainline inclusion from mainline-v5.16-rc7 commit 484730e5862f6b872dca13840bed40fd7c60fa26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I947PH CVE: CVE-2021-46928 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a trap 7 (Instruction access rights) occurs, this means the CPU couldn't execute an instruction due to missing execute permissions on the memory region. In this case it seems the CPU didn't even fetched the instruction from memory and thus did not store it in the cr19 (IIR) register before calling the trap handler. So, the trap handler will find some random old stale value in cr19. This patch simply overwrites the stale IIR value with a constant magic "bad food" value (0xbaadf00d), in the hope people don't start to try to understand the various random IIR values in trap 7 dumps. Noticed-by: John David Anglin <dave.anglin(a)bell.net> Signed-off-by: Helge Deller <deller(a)gmx.de> --- arch/parisc/kernel/traps.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c index abeb5321a83f..f509ce685f0e 100644 --- a/arch/parisc/kernel/traps.c +++ b/arch/parisc/kernel/traps.c @@ -697,6 +697,8 @@ void notrace handle_interruption(int code, struct pt_regs *regs) } up_read(&current->mm->mmap_sem); } + /* CPU could not fetch instruction, so clear stale IIR value. */ + regs->iir = 0xbaadf00d; /* Fall Through */ case 27: /* Data memory protection ID trap */ -- 2.25.1

2 1

[PATCH v1 OLK-6.6 0/3] kworker: Fix the problem of ipsan performance degradation on ARM architecture
by jiangdongxu 29 Feb '24

29 Feb '24

From: shaodenghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. shaodenghui (3): iscsi: add member for NUMA aware order workqueue workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance drivers/scsi/iscsi_tcp.c | 9 +++++++++ drivers/scsi/libiscsi.c | 17 ++++++++++++----- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 15 ++++++++++----- 5 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

1 3

[PATCH OLK-5.10] netfilter: nft_set_rbtree: skip end interval element from gc
by Dong Chenchen 29 Feb '24

29 Feb '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v5.10.209 commit 4cee42fcf54fec46b344681e7cc4f234bb22f85a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HII CVE: CVE-2024-26581 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 60c0c230c6f046da536d3df8b39a20b9a9fd6af0 upstream. rbtree lazy gc on insert might collect an end interval element that has been just added in this transactions, skip end interval elements that are not yet active. Fixes: f718863aca46 ("netfilter: nft_set_rbtree: fix overlap expiration walk") Cc: stable(a)vger.kernel.org Reported-by: lonial con <kongln9170(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_rbtree.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c index eae760adae4d..e352bbef8a36 100644 --- a/net/netfilter/nft_set_rbtree.c +++ b/net/netfilter/nft_set_rbtree.c @@ -216,8 +216,7 @@ static void *nft_rbtree_get(const struct net *net, const struct nft_set *set, static int nft_rbtree_gc_elem(const struct nft_set *__set, struct nft_rbtree *priv, - struct nft_rbtree_elem *rbe, - u8 genmask) + struct nft_rbtree_elem *rbe) { struct nft_set *set = (struct nft_set *)__set; struct rb_node *prev = rb_prev(&rbe->node); @@ -235,7 +234,7 @@ static int nft_rbtree_gc_elem(const struct nft_set *__set, while (prev) { rbe_prev = rb_entry(prev, struct nft_rbtree_elem, node); if (nft_rbtree_interval_end(rbe_prev) && - nft_set_elem_active(&rbe_prev->ext, genmask)) + nft_set_elem_active(&rbe_prev->ext, NFT_GENMASK_ANY)) break; prev = rb_prev(prev); @@ -328,7 +327,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, /* perform garbage collection to avoid bogus overlap reports. */ if (nft_set_elem_expired(&rbe->ext)) { - err = nft_rbtree_gc_elem(set, priv, rbe, genmask); + err = nft_rbtree_gc_elem(set, priv, rbe); if (err < 0) return err; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] io_uring: fix overflows checks in provide buffers
by Long Li 29 Feb '24

29 Feb '24

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v5.10.36 commit cbbc13b115b8f18e0a714d89f87fbdc499acfe2d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JIH CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 38134ada0ceea3e848fe993263c0ff6207fd46e7 ] Colin reported before possible overflow and sign extension problems in io_provide_buffers_prep(). As Linus pointed out previous attempt did nothing useful, see d81269fecb8ce ("io_uring: fix provide_buffers sign extension"). Do that with help of check_<op>_overflow helpers. And fix struct io_provide_buf::len type, as it doesn't make much sense to keep it signed. Reported-by: Colin Ian King <colin.king(a)canonical.com> Fixes: efe68c1ca8f49 ("io_uring: validate the full range of provided buffers for access") Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/46538827e70fce5f6cdb50897cff4cacc490f380.16184882… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/io_uring.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 018d38bec473..afac3197fd6c 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -486,7 +486,7 @@ struct io_splice { struct io_provide_buf { struct file *file; __u64 addr; - __s32 len; + __u32 len; __u32 bgid; __u16 nbufs; __u16 bid; @@ -3606,7 +3606,7 @@ static int io_remove_buffers(struct io_kiocb *req, bool force_nonblock, static int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { - unsigned long size; + unsigned long size, tmp_check; struct io_provide_buf *p = &req->pbuf; u64 tmp; @@ -3620,6 +3620,12 @@ static int io_provide_buffers_prep(struct io_kiocb *req, p->addr = READ_ONCE(sqe->addr); p->len = READ_ONCE(sqe->len); + if (check_mul_overflow((unsigned long)p->len, (unsigned long)p->nbufs, + &size)) + return -EOVERFLOW; + if (check_add_overflow((unsigned long)p->addr, size, &tmp_check)) + return -EOVERFLOW; + size = (unsigned long)p->len * p->nbufs; if (!access_ok(u64_to_user_ptr(p->addr), size)) return -EFAULT; -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS V2] media: pvrusb2: fix use after free on context disconnection
by Guan Jing 29 Feb '24

29 Feb '24

From: "Ricardo B. Marliere" <ricardo(a)marliere.net> stable inclusion from stable-v5.10.209 commit 3233d8bf7893550045682192cb227af7fa3defeb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VV CVE: CVE-2023-52445 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ded85b0c0edd8f45fec88783d7555a5b982449c1 ] Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack. Reported-and-tested-by: syzbot+621409285c4156a009b3(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a02a4205fff8eb92@google.com/ Fixes: e5be15c63804 ("V4L/DVB (7711): pvrusb2: Fix race on module unload") Signed-off-by: Ricardo B. Marliere <ricardo(a)marliere.net> Acked-by: Mike Isely <isely(a)pobox.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guan Jing <guanjing6(a)huawei.com> --- drivers/media/usb/pvrusb2/pvrusb2-context.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/usb/pvrusb2/pvrusb2-context.c index d9e8481e9e28..9236463ba269 100644 --- a/drivers/media/usb/pvrusb2/pvrusb2-context.c +++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c @@ -277,7 +277,8 @@ void pvr2_context_disconnect(struct pvr2_context *mp) { pvr2_hdw_disconnect(mp->hdw); mp->disconnect_flag = !0; - pvr2_context_notify(mp); + if (!pvr2_context_shutok()) + pvr2_context_notify(mp); } -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2023-52451 backport to OLK-5.10 v2
by Lin Yujun 29 Feb '24

29 Feb '24

*** BLURB HERE *** Laurent Dufour (1): powerpc/pseries/memhotplug: Quieten some DLPAR operations Nathan Lynch (1): powerpc/pseries/memhp: Fix access beyond end of drmem array .../platforms/pseries/hotplug-memory.c | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-52451 backport to 4.19 v2
by Lin Yujun 29 Feb '24

29 Feb '24

*** BLURB HERE *** Laurent Dufour (1): powerpc/pseries/memhotplug: Quieten some DLPAR operations Nathan Lynch (1): powerpc/pseries/memhp: Fix access beyond end of drmem array .../platforms/pseries/hotplug-memory.c | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/4] CVE-2024-26583
by Ziyang Xuan 29 Feb '24

29 Feb '24

Patchset for CVE-2024-26583. Jakub Kicinski (4): tls: rx: simplify async wait net: tls: factor out tls_*crypt_async_wait() tls: fix race between async notify and socket close tls: fix race between tx work scheduling and socket close include/net/tls.h | 6 --- net/tls/tls_sw.c | 108 +++++++++++++++++----------------------------- 2 files changed, 39 insertions(+), 75 deletions(-) -- 2.25.1

2 5

[PATCH OLK-6.6 0/6] Export vcpu stat via debugfs
by liangtian 29 Feb '24

29 Feb '24

Create debugfs entry for vcpu stat. chenjiajun (6): kvm: debugfs: Export vcpu stat via debugfs kvm: debugfs: export remaining aarch64 kvm exit reasons to debugfs kvm: debugfs: aarch64 export cpu time related items to debugfs kvm: debugfs: Export x86 kvm exits to vcpu_stat kvm: debugfs: add fastpath msr_wr exits to debugfs statistics kvm: debugfs: add EXIT_REASON_PREEMPTION_TIMER to vcpu_stat arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/kvm_host.h | 21 ++++ arch/arm64/kvm/Kconfig | 9 ++ arch/arm64/kvm/arm.c | 31 ++++++ arch/arm64/kvm/guest.c | 40 +++++++- arch/arm64/kvm/handle_exit.c | 8 ++ arch/arm64/kvm/hyp/include/hyp/switch.h | 2 + arch/arm64/kvm/mmu.c | 1 + arch/arm64/kvm/sys_regs.c | 9 ++ arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/kvm_host.h | 17 ++++ arch/x86/kvm/Kconfig | 9 ++ arch/x86/kvm/vmx/vmx.c | 8 ++ arch/x86/kvm/x86.c | 87 ++++++++++++++++ include/linux/kvm_host.h | 44 ++++++++ include/uapi/linux/kvm.h | 1 + virt/kvm/kvm_main.c | 129 ++++++++++++++++++++++++ 17 files changed, 417 insertions(+), 1 deletion(-) -- 2.33.0

2 7

[PATCH OLK-5.10] serial: imx: fix tx statemachine deadlock
by felix 29 Feb '24

29 Feb '24

From: Paul Geurts <paul_geurts(a)live.nl> stable inclusion from stable-v5.10.209 commit 6e04a9d30509fb53ba6df5d655ed61d607a7cfda category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EEE CVE: CVE-2023-52456 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 78d60dae9a0c9f09aa3d6477c94047df2fe6f7b0 ] When using the serial port as RS485 port, the tx statemachine is used to control the RTS pin to drive the RS485 transceiver TX_EN pin. When the TTY port is closed in the middle of a transmission (for instance during userland application crash), imx_uart_shutdown disables the interface and disables the Transmission Complete interrupt. afer that, imx_uart_stop_tx bails on an incomplete transmission, to be retriggered by the TC interrupt. This interrupt is disabled and therefore the tx statemachine never transitions out of SEND. The statemachine is in deadlock now, and the TX_EN remains low, making the interface useless. imx_uart_stop_tx now checks for incomplete transmission AND whether TC interrupts are enabled before bailing to be retriggered. This makes sure the state machine handling is reached, and is properly set to WAIT_AFTER_SEND. Fixes: cb1a60923609 ("serial: imx: implement rts delaying for rs485") Signed-off-by: Paul Geurts <paul_geurts(a)live.nl> Tested-by: Rasmus Villemoes <rasmus.villemoes(a)prevas.dk> Tested-by: Eberhard Stoll <eberhard.stoll(a)gmx.de> Link: https://lore.kernel.org/r/AM0PR09MB26758F651BC1B742EB45775995B8A@AM0PR09MB2… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- drivers/tty/serial/imx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c index da63ef345e81..6a7add3ac4d5 100644 --- a/drivers/tty/serial/imx.c +++ b/drivers/tty/serial/imx.c @@ -461,13 +461,13 @@ static void imx_uart_stop_tx(struct uart_port *port) ucr1 = imx_uart_readl(sport, UCR1); imx_uart_writel(sport, ucr1 & ~UCR1_TRDYEN, UCR1); + ucr4 = imx_uart_readl(sport, UCR4); usr2 = imx_uart_readl(sport, USR2); - if (!(usr2 & USR2_TXDC)) { + if ((!(usr2 & USR2_TXDC)) && (ucr4 & UCR4_TCEN)) { /* The shifter is still busy, so retry once TC triggers */ return; } - ucr4 = imx_uart_readl(sport, UCR4); ucr4 &= ~UCR4_TCEN; imx_uart_writel(sport, ucr4, UCR4); -- 2.34.1

2 1

[openeuler:OLK-6.6 1659/3426] kernel/sched/fair.c:143:14: sparse: sparse: symbol 'sysctl_overload_detect_period' was not declared. Should it be static?
by kernel test robot 29 Feb '24

29 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 54465add6cb7660c781c0ae7b4d3e3d56185624e commit: a3c9f2da0a35df4e41751556be4308f57bdaf3d6 [1659/3426] sched: Introduce handle priority reversion mechanism config: arm64-randconfig-r111-20240227 (https://download.01.org/0day-ci/archive/20240229/202402290858.u7zfnMrE-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240229/202402290858.u7zfnMrE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402290858.u7zfnMrE-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/sched/fair.c:143:14: sparse: sparse: symbol 'sysctl_overload_detect_period' was not declared. Should it be static? >> kernel/sched/fair.c:144:14: sparse: sparse: symbol 'sysctl_offline_wait_interval' was not declared. Should it be static? kernel/sched/fair.c:1236:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_entity const *se @@ got struct sched_entity [noderef] __rcu * @@ kernel/sched/fair.c:1236:34: sparse: expected struct sched_entity const *se kernel/sched/fair.c:1236:34: sparse: got struct sched_entity [noderef] __rcu * kernel/sched/fair.c:12477:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12477:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12477:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:5766:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:5766:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:5766:22: sparse: struct task_struct * kernel/sched/fair.c:6508:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:6508:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:6508:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:7809:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:7809:20: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:7809:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8014:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8014:9: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:8014:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8113:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8113:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8113:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8333:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:8333:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:8333:22: sparse: struct task_struct * kernel/sched/fair.c:8687:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8687:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8687:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:9680:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *child @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:9680:40: sparse: expected struct sched_domain *child kernel/sched/fair.c:9680:40: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:10317:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:10317:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:10317:22: sparse: struct task_struct * kernel/sched/fair.c:11749:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:11749:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:11749:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:11406:44: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *sd_parent @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:11406:44: sparse: expected struct sched_domain *sd_parent kernel/sched/fair.c:11406:44: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:11845:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:11845:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:11845:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c: note: in included file (through include/linux/rculist.h, include/linux/pid.h, include/linux/sched.h, ...): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true kernel/sched/fair.c: note: in included file: kernel/sched/sched.h:2145:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2145:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2145:25: sparse: struct task_struct * kernel/sched/sched.h:2309:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2309:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2309:9: sparse: struct task_struct * kernel/sched/sched.h:2145:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2145:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2145:25: sparse: struct task_struct * kernel/sched/sched.h:2145:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2145:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2145:25: sparse: struct task_struct * vim +/sysctl_overload_detect_period +143 kernel/sched/fair.c 139 140 static DEFINE_PER_CPU_SHARED_ALIGNED(struct list_head, qos_throttled_cfs_rq); 141 static DEFINE_PER_CPU_SHARED_ALIGNED(struct hrtimer, qos_overload_timer); 142 static DEFINE_PER_CPU(int, qos_cpu_overload); > 143 unsigned int sysctl_overload_detect_period = 5000; /* in ms */ > 144 unsigned int sysctl_offline_wait_interval = 100; /* in ms */ 145 static int one_thousand = 1000; 146 static int hundred_thousand = 100000; 147 static int unthrottle_qos_cfs_rqs(int cpu); 148 #endif 149 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION e0a00cd6ae6571f9fc6f9f42313f70879df89904
by kernel test robot 29 Feb '24

29 Feb '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: e0a00cd6ae6571f9fc6f9f42313f70879df89904 !3123 Add pcie acs and no-bus-reset quirk for mucse Nics Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202402290415.QIyguW8r-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) kernel/trace/trace_osnoise.c:933: undefined reference to `latency_fsnotify' Error/Warning ids grouped by kconfigs: gcc_recent_errors `-- x86_64-randconfig-102-20240227 `-- kernel-trace-trace_osnoise.c:undefined-reference-to-latency_fsnotify clang_recent_errors `-- x86_64-allyesconfig |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 734m configs tested: 35 configs skipped: 131 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240228 clang arm64 randconfig-002-20240228 gcc arm64 randconfig-003-20240228 gcc arm64 randconfig-004-20240228 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240228 gcc x86_64 buildonly-randconfig-002-20240228 clang x86_64 buildonly-randconfig-003-20240228 clang x86_64 buildonly-randconfig-004-20240228 gcc x86_64 buildonly-randconfig-005-20240228 gcc x86_64 buildonly-randconfig-006-20240228 clang x86_64 defconfig gcc x86_64 randconfig-001-20240228 clang x86_64 randconfig-002-20240228 gcc x86_64 randconfig-003-20240228 gcc x86_64 randconfig-004-20240228 gcc x86_64 randconfig-005-20240228 gcc x86_64 randconfig-006-20240228 clang x86_64 randconfig-011-20240228 clang x86_64 randconfig-012-20240228 clang x86_64 randconfig-013-20240228 clang x86_64 randconfig-014-20240228 gcc x86_64 randconfig-015-20240228 gcc x86_64 randconfig-016-20240228 gcc x86_64 randconfig-071-20240228 gcc x86_64 randconfig-072-20240228 clang x86_64 randconfig-073-20240228 gcc x86_64 randconfig-074-20240228 gcc x86_64 randconfig-075-20240228 clang x86_64 randconfig-076-20240228 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3190/3426] drivers/crypto/montage/tsse/tsse_dev_mgr.c:107:5: warning: no previous prototype for function 'tsse_stop_dev'
by kernel test robot 29 Feb '24

29 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 54465add6cb7660c781c0ae7b4d3e3d56185624e commit: 811debd4ea52033d7393d4a7de2be11f71c70348 [3190/3426] add support for Mont-TSSE Driver config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240229/202402290504.Dzt3mHvf-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240229/202402290504.Dzt3mHvf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402290504.Dzt3mHvf-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/montage/tsse/tsse_dev_mgr.c:107:5: warning: no previous prototype for function 'tsse_stop_dev' [-Wmissing-prototypes] 107 | int tsse_stop_dev(struct tsse_dev *tdev, bool busy_exit) | ^ drivers/crypto/montage/tsse/tsse_dev_mgr.c:107:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 107 | int tsse_stop_dev(struct tsse_dev *tdev, bool busy_exit) | ^ | static >> drivers/crypto/montage/tsse/tsse_dev_mgr.c:220:2: warning: variable 'ptr' is used uninitialized whenever 'for' loop exits because its condition is false [-Wsometimes-uninitialized] 220 | list_for_each(itr, &tsse_dev_table) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/list.h:687:27: note: expanded from macro 'list_for_each' 687 | for (pos = (head)->next; !list_is_head(pos, (head)); pos = pos->next) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/crypto/montage/tsse/tsse_dev_mgr.c:227:9: note: uninitialized use occurs here 227 | return ptr; | ^~~ drivers/crypto/montage/tsse/tsse_dev_mgr.c:220:2: note: remove the condition if it is always true 220 | list_for_each(itr, &tsse_dev_table) { | ^ include/linux/list.h:687:27: note: expanded from macro 'list_for_each' 687 | for (pos = (head)->next; !list_is_head(pos, (head)); pos = pos->next) | ^ drivers/crypto/montage/tsse/tsse_dev_mgr.c:216:22: note: initialize the variable 'ptr' to silence this warning 216 | struct tsse_dev *ptr; | ^ | = NULL drivers/crypto/montage/tsse/tsse_dev_mgr.c:37:20: warning: unused function 'tsse_list_add_tail' [-Wunused-function] 37 | static inline void tsse_list_add_tail(struct list_head *new, | ^~~~~~~~~~~~~~~~~~ 3 warnings generated. -- >> drivers/crypto/montage/tsse/tsse_ipc.c:17:18: warning: no previous prototype for function 'get_msginf' [-Wmissing-prototypes] 17 | struct tsse_msg *get_msginf(void __iomem *d2h) | ^ drivers/crypto/montage/tsse/tsse_ipc.c:17:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 17 | struct tsse_msg *get_msginf(void __iomem *d2h) | ^ | static >> drivers/crypto/montage/tsse/tsse_ipc.c:41:6: warning: no previous prototype for function 'ipc_recieve_msg' [-Wmissing-prototypes] 41 | void ipc_recieve_msg(struct tsse_ipc *tsseipc, struct ipc_msg *msg) | ^ drivers/crypto/montage/tsse/tsse_ipc.c:41:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 41 | void ipc_recieve_msg(struct tsse_ipc *tsseipc, struct ipc_msg *msg) | ^ | static >> drivers/crypto/montage/tsse/tsse_ipc.c:53:5: warning: no previous prototype for function 'msg_rout' [-Wmissing-prototypes] 53 | int msg_rout(struct tsse_ipc *tsseipc, struct tsse_msg *tssemsg) | ^ drivers/crypto/montage/tsse/tsse_ipc.c:53:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 53 | int msg_rout(struct tsse_ipc *tsseipc, struct tsse_msg *tssemsg) | ^ | static >> drivers/crypto/montage/tsse/tsse_ipc.c:103:6: warning: no previous prototype for function 'ipc_send_msg' [-Wmissing-prototypes] 103 | void ipc_send_msg(struct tsse_ipc *tsseipc, struct ipc_data *msg) | ^ drivers/crypto/montage/tsse/tsse_ipc.c:103:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 103 | void ipc_send_msg(struct tsse_ipc *tsseipc, struct ipc_data *msg) | ^ | static >> drivers/crypto/montage/tsse/tsse_ipc.c:115:6: warning: no previous prototype for function 'ipc_hw_init' [-Wmissing-prototypes] 115 | void ipc_hw_init(struct tsse_ipc *hw_ipc) | ^ drivers/crypto/montage/tsse/tsse_ipc.c:115:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 115 | void ipc_hw_init(struct tsse_ipc *hw_ipc) | ^ | static >> drivers/crypto/montage/tsse/tsse_ipc.c:122:5: warning: no previous prototype for function 'ipc_init_msg' [-Wmissing-prototypes] 122 | int ipc_init_msg(struct tsse_ipc *tsseipc) | ^ drivers/crypto/montage/tsse/tsse_ipc.c:122:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 122 | int ipc_init_msg(struct tsse_ipc *tsseipc) | ^ | static 6 warnings generated. -- >> drivers/crypto/montage/tsse/tsse_fw_service.c:26:5: warning: no previous prototype for function 'fw_send_msg' [-Wmissing-prototypes] 26 | int fw_send_msg(struct tsse_ipc *tsseipc, struct ipc_msg *msg) | ^ drivers/crypto/montage/tsse/tsse_fw_service.c:26:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 26 | int fw_send_msg(struct tsse_ipc *tsseipc, struct ipc_msg *msg) | ^ | static >> drivers/crypto/montage/tsse/tsse_fw_service.c:51:6: warning: no previous prototype for function 'fw_free' [-Wmissing-prototypes] 51 | void fw_free(void *msg_t) | ^ drivers/crypto/montage/tsse/tsse_fw_service.c:51:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 51 | void fw_free(void *msg_t) | ^ | static 2 warnings generated. -- >> drivers/crypto/montage/tsse/tsse_service.c:15:6: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 15 | int ret; | ^ >> drivers/crypto/montage/tsse/tsse_service.c:11:5: warning: no previous prototype for function 'service_rout' [-Wmissing-prototypes] 11 | int service_rout(struct tsse_ipc *tsseipc, struct ipc_msg *msg) | ^ drivers/crypto/montage/tsse/tsse_service.c:11:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 11 | int service_rout(struct tsse_ipc *tsseipc, struct ipc_msg *msg) | ^ | static 2 warnings generated. vim +/tsse_stop_dev +107 drivers/crypto/montage/tsse/tsse_dev_mgr.c 106 > 107 int tsse_stop_dev(struct tsse_dev *tdev, bool busy_exit) 108 { 109 int times, max_retry = 150; 110 111 clear_bit(TSSE_DEV_STATUS_STARTING, &tdev->status); 112 clear_bit(TSSE_DEV_STATUS_STARTED, &tdev->status); 113 114 for (times = 0; times < max_retry; times++) { 115 if (!tsse_dev_in_use(tdev)) 116 break; 117 msleep(100); 118 } 119 120 if (times >= max_retry) { 121 tsse_dev_err(tdev, "Failed to stop busy device\n"); 122 if (busy_exit) 123 return -EBUSY; 124 } 125 if (tdev->qpairs_bank.num_qparis != 0) { 126 mutex_lock(&tsse_dev_table_lock); 127 tsse_list_del(&tdev->list); 128 mutex_unlock(&tsse_dev_table_lock); 129 tsse_dev_info(tdev, "removed from active dev table list\n"); 130 } 131 132 tsse_dev_info(tdev, "device stopped\n"); 133 134 return 0; 135 } 136 137 int tsse_start_dev(struct tsse_dev *tdev) 138 { 139 struct tsse_dev *tmp_dev; 140 struct list_head *prev_node = &tsse_dev_table; 141 int ret = 0; 142 143 if (tdev->qpairs_bank.num_qparis == 0) { 144 set_bit(TSSE_DEV_STATUS_STARTED, &tdev->status); 145 tsse_dev_info(tdev, "device started\n"); 146 return 0; 147 } 148 149 set_bit(TSSE_DEV_STATUS_STARTING, &tdev->status); 150 151 mutex_lock(&tsse_dev_table_lock); 152 153 list_for_each_entry(tmp_dev, &tsse_dev_table, list) { 154 if (tmp_dev == tdev) { 155 ret = -EEXIST; 156 tsse_dev_err(tdev, 157 "The device cannot be added repeatedly\n"); 158 goto clear_status; 159 } 160 } 161 162 set_bit(TSSE_DEV_STATUS_STARTED, &tdev->status); 163 tsse_list_add(&tdev->list, prev_node, prev_node->next); 164 165 tsse_dev_info(tdev, "device started\n"); 166 mutex_unlock(&tsse_dev_table_lock); 167 168 return 0; 169 clear_status: 170 mutex_unlock(&tsse_dev_table_lock); 171 clear_bit(TSSE_DEV_STATUS_STARTING, &tdev->status); 172 clear_bit(TSSE_DEV_STATUS_STARTED, &tdev->status); 173 return ret; 174 } 175 EXPORT_SYMBOL_GPL(tsse_start_dev); 176 177 int tsse_prepare_restart_dev(struct tsse_dev *tdev) 178 { 179 return tsse_stop_dev(tdev, false); 180 } 181 EXPORT_SYMBOL_GPL(tsse_prepare_restart_dev); 182 183 void tsse_devmgr_rm_dev(struct tsse_dev *tdev) 184 { 185 tsse_stop_dev(tdev, false); 186 tsse_dev_free_irq_vectors(tdev); 187 msleep(300); 188 } 189 EXPORT_SYMBOL_GPL(tsse_devmgr_rm_dev); 190 191 int tsse_devmgr_add_dev(struct tsse_dev *tdev) 192 { 193 int ret; 194 195 ret = tsse_dev_alloc_irq_vectors(tdev); 196 if (ret == 0) { 197 atomic_set(&tdev->ref_count, 0); 198 tdev->status = 0; 199 ret = tsse_start_dev(tdev); 200 201 if (ret != 0) 202 tsse_dev_free_irq_vectors(tdev); 203 } 204 return ret; 205 } 206 EXPORT_SYMBOL_GPL(tsse_devmgr_add_dev); 207 208 struct list_head *tsse_devmgr_get_head(void) 209 { 210 return &tsse_dev_table; 211 } 212 213 struct tsse_dev *get_tssedev(int id) 214 { 215 struct list_head *itr; 216 struct tsse_dev *ptr; 217 218 mutex_lock(&tsse_dev_table_lock); 219 > 220 list_for_each(itr, &tsse_dev_table) { -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS e5b3fc125c261e89df707841ae3e10abc87cc58e
by kernel test robot 29 Feb '24

29 Feb '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: e5b3fc125c261e89df707841ae3e10abc87cc58e !4751 [sync] PR-4623: i2c: Optimized the value setting of maxwrite limit to fifo depth - 1 Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-randconfig-002-20240228 | `-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c:warning:unused-variable-adapter `-- arm64-randconfig-004-20240228 |-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-ce-description-in-qm_hw_error_init |-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-fe-description-in-qm_hw_error_init |-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-msi-description-in-qm_hw_error_init `-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-nfe-description-in-qm_hw_error_init elapsed time: 827m configs tested: 35 configs skipped: 131 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240228 gcc arm64 randconfig-002-20240228 gcc arm64 randconfig-003-20240228 gcc arm64 randconfig-004-20240228 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240228 gcc x86_64 buildonly-randconfig-002-20240228 clang x86_64 buildonly-randconfig-003-20240228 clang x86_64 buildonly-randconfig-004-20240228 gcc x86_64 buildonly-randconfig-005-20240228 gcc x86_64 buildonly-randconfig-006-20240228 clang x86_64 defconfig gcc x86_64 randconfig-001-20240228 clang x86_64 randconfig-002-20240228 gcc x86_64 randconfig-003-20240228 gcc x86_64 randconfig-004-20240228 gcc x86_64 randconfig-005-20240228 gcc x86_64 randconfig-006-20240228 clang x86_64 randconfig-011-20240228 clang x86_64 randconfig-012-20240228 clang x86_64 randconfig-013-20240228 clang x86_64 randconfig-014-20240228 gcc x86_64 randconfig-015-20240228 gcc x86_64 randconfig-016-20240228 gcc x86_64 randconfig-071-20240228 gcc x86_64 randconfig-072-20240228 clang x86_64 randconfig-073-20240228 gcc x86_64 randconfig-074-20240228 gcc x86_64 randconfig-075-20240228 clang x86_64 randconfig-076-20240228 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2698/3426] drivers/platform/mpam/mpam_devices.c:247:32: error: implicit declaration of function '__acpi_get_mem_attribute'
by kernel test robot 29 Feb '24

29 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 54465add6cb7660c781c0ae7b4d3e3d56185624e commit: 3e9e723f3bf92a19e5e15dda89bbb136ce463294 [2698/3426] arm_mpam: Add probe/remove for mpam msc driver and kbuild boiler plate config: arm64-randconfig-003-20240228 (https://download.01.org/0day-ci/archive/20240229/202402290519.U4kA7SUR-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240229/202402290519.U4kA7SUR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402290519.U4kA7SUR-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from include/linux/mmzone.h:8, from include/linux/gfp.h:7, from include/linux/slab.h:16, from include/linux/resource_ext.h:11, from include/linux/acpi.h:13, from drivers/platform/mpam/mpam_devices.c:6: drivers/platform/mpam/mpam_devices.c: In function 'mpam_msc_drv_probe': drivers/platform/mpam/mpam_devices.c:212:38: error: 'struct mpam_msc' has no member named 'mon_sel_lock'; did you mean 'part_sel_lock'? 212 | spin_lock_init(&msc->mon_sel_lock); | ^~~~~~~~~~~~ include/linux/spinlock.h:335:45: note: in definition of macro 'spin_lock_init' 335 | __raw_spin_lock_init(spinlock_check(lock), \ | ^~~~ >> drivers/platform/mpam/mpam_devices.c:247:32: error: implicit declaration of function '__acpi_get_mem_attribute' [-Werror=implicit-function-declaration] 247 | prot = __acpi_get_mem_attribute(msc->pcc_chan->shmem_base_addr); | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/platform/mpam/mpam_devices.c:247:32: error: incompatible types when assigning to type 'pgprot_t' from type 'int' cc1: some warnings being treated as errors vim +/__acpi_get_mem_attribute +247 drivers/platform/mpam/mpam_devices.c 170 171 static int mpam_msc_drv_probe(struct platform_device *pdev) 172 { 173 int err; 174 pgprot_t prot; 175 void * __iomem io; 176 struct mpam_msc *msc; 177 struct resource *msc_res; 178 void *plat_data = pdev->dev.platform_data; 179 180 mutex_lock(&mpam_list_lock); 181 do { 182 msc = devm_kzalloc(&pdev->dev, sizeof(*msc), GFP_KERNEL); 183 if (!msc) { 184 err = -ENOMEM; 185 break; 186 } 187 188 INIT_LIST_HEAD_RCU(&msc->glbl_list); 189 msc->pdev = pdev; 190 191 err = device_property_read_u32(&pdev->dev, "arm,not-ready-us", 192 &msc->nrdy_usec); 193 if (err) { 194 /* This will prevent CSU monitors being usable */ 195 msc->nrdy_usec = 0; 196 } 197 198 err = get_msc_affinity(msc); 199 if (err) 200 break; 201 if (cpumask_empty(&msc->accessibility)) { 202 pr_err_once("msc:%u is not accessible from any CPU!", 203 msc->id); 204 err = -EINVAL; 205 break; 206 } 207 208 mutex_init(&msc->lock); 209 msc->id = mpam_num_msc++; 210 INIT_LIST_HEAD_RCU(&msc->ris); 211 spin_lock_init(&msc->part_sel_lock); > 212 spin_lock_init(&msc->mon_sel_lock); 213 214 if (device_property_read_u32(&pdev->dev, "pcc-channel", 215 &msc->pcc_subspace_id)) 216 msc->iface = MPAM_IFACE_MMIO; 217 else 218 msc->iface = MPAM_IFACE_PCC; 219 220 if (msc->iface == MPAM_IFACE_MMIO) { 221 io = devm_platform_get_and_ioremap_resource(pdev, 0, 222 &msc_res); 223 if (IS_ERR(io)) { 224 pr_err("Failed to map MSC base address\n"); 225 devm_kfree(&pdev->dev, msc); 226 err = PTR_ERR(io); 227 break; 228 } 229 msc->mapped_hwpage_sz = msc_res->end - msc_res->start; 230 msc->mapped_hwpage = io; 231 } else if (msc->iface == MPAM_IFACE_PCC) { 232 msc->pcc_cl.dev = &pdev->dev; 233 msc->pcc_cl.rx_callback = mpam_pcc_rx_callback; 234 msc->pcc_cl.tx_block = false; 235 msc->pcc_cl.tx_tout = 1000; /* 1s */ 236 msc->pcc_cl.knows_txdone = false; 237 238 msc->pcc_chan = pcc_mbox_request_channel(&msc->pcc_cl, 239 msc->pcc_subspace_id); 240 if (IS_ERR(msc->pcc_chan)) { 241 pr_err("Failed to request MSC PCC channel\n"); 242 devm_kfree(&pdev->dev, msc); 243 err = PTR_ERR(msc->pcc_chan); 244 break; 245 } 246 > 247 prot = __acpi_get_mem_attribute(msc->pcc_chan->shmem_base_addr); 248 io = ioremap_prot(msc->pcc_chan->shmem_base_addr, 249 msc->pcc_chan->shmem_size, pgprot_val(prot)); 250 if (IS_ERR(io)) { 251 pr_err("Failed to map MSC base address\n"); 252 pcc_mbox_free_channel(msc->pcc_chan); 253 devm_kfree(&pdev->dev, msc); 254 err = PTR_ERR(io); 255 break; 256 } 257 258 /* TODO: issue a read to update the registers */ 259 260 msc->mapped_hwpage_sz = msc->pcc_chan->shmem_size; 261 msc->mapped_hwpage = io + sizeof(struct acpi_pcct_shared_memory); 262 } 263 264 list_add_rcu(&msc->glbl_list, &mpam_all_msc); 265 platform_set_drvdata(pdev, msc); 266 } while (0); 267 mutex_unlock(&mpam_list_lock); 268 269 if (!err) { 270 /* Create RIS entries described by firmware */ 271 if (!acpi_disabled) 272 err = acpi_mpam_parse_resources(msc, plat_data); 273 else 274 err = mpam_dt_parse_resources(msc, plat_data); 275 } 276 277 if (!err && fw_num_msc == mpam_num_msc) 278 mpam_discovery_complete(); 279 280 return err; 281 } 282 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 9781/30000] kernel/trace/trace_osnoise.c:933: undefined reference to `latency_fsnotify'
by kernel test robot 29 Feb '24

29 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e0a00cd6ae6571f9fc6f9f42313f70879df89904 commit: d11dbe8b4e8ad4c5bd90147912352ef6f13a2bb6 [9781/30000] trace: Add osnoise tracer config: x86_64-randconfig-102-20240227 (https://download.01.org/0day-ci/archive/20240229/202402290415.QIyguW8r-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240229/202402290415.QIyguW8r-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402290415.QIyguW8r-lkp@intel.com/ All errors (new ones prefixed by >>): ld: warning: arch/x86/lib/retpoline.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: arch/x86/lib/retpoline.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: .tmp_vmlinux.kallsyms1 has a LOAD segment with RWX permissions ld: kernel/trace/trace_osnoise.o: in function `run_osnoise': >> kernel/trace/trace_osnoise.c:933: undefined reference to `latency_fsnotify' vim +933 kernel/trace/trace_osnoise.c 784 785 /* 786 * run_osnoise - Sample the time and look for osnoise 787 * 788 * Used to capture the time, looking for potential osnoise latency repeatedly. 789 * Different from hwlat_detector, it is called with preemption and interrupts 790 * enabled. This allows irqs, softirqs and threads to run, interfering on the 791 * osnoise sampling thread, as they would do with a regular thread. 792 */ 793 static int run_osnoise(void) 794 { 795 struct osnoise_variables *osn_var = this_cpu_osn_var(); 796 u64 noise = 0, sum_noise = 0, max_noise = 0; 797 struct trace_array *tr = osnoise_trace; 798 u64 start, sample, last_sample; 799 u64 last_int_count, int_count; 800 s64 total, last_total = 0; 801 struct osnoise_sample s; 802 unsigned int threshold; 803 int hw_count = 0; 804 u64 runtime, stop_in; 805 int ret = -1; 806 807 /* 808 * Considers the current thread as the workload. 809 */ 810 osn_var->pid = current->pid; 811 812 /* 813 * Save the current stats for the diff 814 */ 815 save_osn_sample_stats(osn_var, &s); 816 817 /* 818 * if threshold is 0, use the default value of 5 us. 819 */ 820 threshold = tracing_thresh ? : 5000; 821 822 /* 823 * Make sure NMIs see sampling first 824 */ 825 osn_var->sampling = true; 826 barrier(); 827 828 /* 829 * Transform the *_us config to nanoseconds to avoid the 830 * division on the main loop. 831 */ 832 runtime = osnoise_data.sample_runtime * NSEC_PER_USEC; 833 stop_in = osnoise_data.stop_tracing * NSEC_PER_USEC; 834 835 /* 836 * Start timestemp 837 */ 838 start = time_get(); 839 840 /* 841 * "previous" loop. 842 */ 843 last_int_count = set_int_safe_time(osn_var, &last_sample); 844 845 do { 846 /* 847 * Get sample! 848 */ 849 int_count = set_int_safe_time(osn_var, &sample); 850 851 noise = time_sub(sample, last_sample); 852 853 /* 854 * This shouldn't happen. 855 */ 856 if (noise < 0) { 857 osnoise_taint("negative noise!"); 858 goto out; 859 } 860 861 /* 862 * Sample runtime. 863 */ 864 total = time_sub(sample, start); 865 866 /* 867 * Check for possible overflows. 868 */ 869 if (total < last_total) { 870 osnoise_taint("total overflow!"); 871 break; 872 } 873 874 last_total = total; 875 876 if (noise >= threshold) { 877 int interference = int_count - last_int_count; 878 879 if (noise > max_noise) 880 max_noise = noise; 881 882 if (!interference) 883 hw_count++; 884 885 sum_noise += noise; 886 887 trace_sample_threshold(last_sample, noise, interference); 888 889 if (osnoise_data.stop_tracing) 890 if (noise > stop_in) 891 osnoise_stop_tracing(); 892 } 893 894 /* 895 * For the non-preemptive kernel config: let threads runs, if 896 * they so wish. 897 */ 898 cond_resched(); 899 900 last_sample = sample; 901 last_int_count = int_count; 902 903 } while (total < runtime && !kthread_should_stop()); 904 905 /* 906 * Finish the above in the view for interrupts. 907 */ 908 barrier(); 909 910 osn_var->sampling = false; 911 912 /* 913 * Make sure sampling data is no longer updated. 914 */ 915 barrier(); 916 917 /* 918 * Save noise info. 919 */ 920 s.noise = time_to_us(sum_noise); 921 s.runtime = time_to_us(total); 922 s.max_sample = time_to_us(max_noise); 923 s.hw_count = hw_count; 924 925 /* Save interference stats info */ 926 diff_osn_sample_stats(osn_var, &s); 927 928 trace_osnoise_sample(&s); 929 930 /* Keep a running maximum ever recorded osnoise "latency" */ 931 if (max_noise > tr->max_latency) { 932 tr->max_latency = max_noise; > 933 latency_fsnotify(tr); 934 } 935 936 if (osnoise_data.stop_tracing_total) 937 if (s.noise > osnoise_data.stop_tracing_total) 938 osnoise_stop_tracing(); 939 940 return 0; 941 out: 942 return ret; 943 } 944 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 54465add6cb7660c781c0ae7b4d3e3d56185624e
by kernel test robot 29 Feb '24

29 Feb '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 54465add6cb7660c781c0ae7b4d3e3d56185624e !4767 reserve space for arch related structures Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202402282256.hBTLFUwO-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) binfmt_elf32.c:(.text+0x7bc): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `arch_elf_adjust_prot' kernel/sched/core.c:9719:2: error: implicit declaration of function 'tg_update_affinity_domains' is invalid in C99 [-Werror,-Wimplicit-function-declaration] kernel/sched/core.c:9931:2: error: implicit declaration of function 'init_auto_affinity' is invalid in C99 [-Werror,-Wimplicit-function-declaration] Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | `-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support |-- arm64-randconfig-002-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- arm64-randconfig-003-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- arm64-randconfig-r111-20240227 | `-- binfmt_elf32.c:(.text):relocation-truncated-to-fit:R_AARCH64_CALL26-against-undefined-symbol-arch_elf_adjust_prot |-- loongarch-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- loongarch-randconfig-002-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-004-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-005-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-003-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-004-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-014-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-015-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-016-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-071-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-073-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device `-- x86_64-randconfig-074-20240228 `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device clang_recent_errors |-- arm64-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_cursor_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_spread_is_enable | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_connector_add | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_display_register | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_adjust_link_train_parameter | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_coding_8b10b_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_dpcd_sink_dpms | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_encoder_destroy | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_fast_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_get_link_train_fallback_values | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hpd_poll_handler | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_config_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_audio | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_hpd_irq_setup | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_init | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_output_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_video_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_scrambled_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_start_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_encoder_mode_valid | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_get_encoder_crtc_mask | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_fini | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_init | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_dma_transfer | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vunmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_alloc | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_free | |-- drivers-gpu-drm-phytium-phytium_panel.c:warning:no-previous-prototype-for-function-phytium_dp_panel_release_backlight_funcs | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_hw_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_init | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_set_property | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_destroy | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_fini | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_init | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_clear_msi_irq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_disable | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_dcreq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_reset | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_spread_is_enable | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-001-20240227 | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-is-invalid-in-C99-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-is-invalid-in-C99-Werror-Wimplicit-function-declaration |-- arm64-randconfig-001-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- arm64-randconfig-004-20240228 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- ld.lld:error:undefined-symbol:lockdep_is_cpus_held |-- x86_64-allyesconfig | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-sm3_generic_block_fn | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_finup | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_update | |-- arch-x86-crypto-sm4-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-gmi_sm4_set_key | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-base_offset-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-pin-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_back-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_read-set-but-not-used | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-buildonly-randconfig-002-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-006-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-006-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-013-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-161-20240228 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device `-- x86_64-rhel-8.3-rust `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device elapsed time: 734m configs tested: 40 configs skipped: 126 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240228 clang arm64 randconfig-002-20240228 gcc arm64 randconfig-003-20240228 gcc arm64 randconfig-004-20240228 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240228 gcc loongarch randconfig-002-20240228 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240228 gcc x86_64 buildonly-randconfig-002-20240228 clang x86_64 buildonly-randconfig-003-20240228 clang x86_64 buildonly-randconfig-004-20240228 gcc x86_64 buildonly-randconfig-005-20240228 gcc x86_64 buildonly-randconfig-006-20240228 clang x86_64 defconfig gcc x86_64 randconfig-001-20240228 clang x86_64 randconfig-002-20240228 gcc x86_64 randconfig-003-20240228 gcc x86_64 randconfig-004-20240228 gcc x86_64 randconfig-005-20240228 gcc x86_64 randconfig-006-20240228 clang x86_64 randconfig-011-20240228 clang x86_64 randconfig-012-20240228 clang x86_64 randconfig-013-20240228 clang x86_64 randconfig-014-20240228 gcc x86_64 randconfig-015-20240228 gcc x86_64 randconfig-016-20240228 gcc x86_64 randconfig-071-20240228 gcc x86_64 randconfig-072-20240228 clang x86_64 randconfig-073-20240228 gcc x86_64 randconfig-074-20240228 gcc x86_64 randconfig-075-20240228 clang x86_64 randconfig-076-20240228 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2545/3426] kernel/sched/core.c:9719:2: error: implicit declaration of function 'tg_update_affinity_domains' is invalid in C99
by kernel test robot 28 Feb '24

28 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 54465add6cb7660c781c0ae7b4d3e3d56185624e commit: 6eb07f9925a906d81f328c808ba25f7800888dce [2545/3426] sched: Introduce smart grid scheduling strategy for cfs config: arm64-randconfig-001-20240227 (https://download.01.org/0day-ci/archive/20240228/202402282256.hBTLFUwO-lkp@…) compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project.git f28c006a5895fc0e329fe15fead81e37457cb1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240228/202402282256.hBTLFUwO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402282256.hBTLFUwO-lkp@intel.com/ All errors (new ones prefixed by >>): >> kernel/sched/core.c:9719:2: error: implicit declaration of function 'tg_update_affinity_domains' is invalid in C99 [-Werror,-Wimplicit-function-declaration] tg_update_affinity_domains(cpu, 1); ^ kernel/sched/core.c:9719:2: note: did you mean 'irq_update_affinity_hint'? include/linux/interrupt.h:325:1: note: 'irq_update_affinity_hint' declared here irq_update_affinity_hint(unsigned int irq, const struct cpumask *m) ^ kernel/sched/core.c:9809:2: error: implicit declaration of function 'tg_update_affinity_domains' is invalid in C99 [-Werror,-Wimplicit-function-declaration] tg_update_affinity_domains(cpu, 0); ^ >> kernel/sched/core.c:9931:2: error: implicit declaration of function 'init_auto_affinity' is invalid in C99 [-Werror,-Wimplicit-function-declaration] init_auto_affinity(&root_task_group); ^ kernel/sched/core.c:9931:2: note: did you mean 'irq_set_affinity'? include/linux/interrupt.h:308:12: note: 'irq_set_affinity' declared here extern int irq_set_affinity(unsigned int irq, const struct cpumask *cpumask); ^ kernel/sched/core.c:9931:22: error: use of undeclared identifier 'root_task_group' init_auto_affinity(&root_task_group); ^ 4 errors generated. vim +/tg_update_affinity_domains +9719 kernel/sched/core.c 9699 9700 int sched_cpu_activate(unsigned int cpu) 9701 { 9702 struct rq *rq = cpu_rq(cpu); 9703 struct rq_flags rf; 9704 9705 /* 9706 * Clear the balance_push callback and prepare to schedule 9707 * regular tasks. 9708 */ 9709 balance_push_set(cpu, false); 9710 9711 #ifdef CONFIG_SCHED_SMT 9712 /* 9713 * When going up, increment the number of cores with SMT present. 9714 */ 9715 if (cpumask_weight(cpu_smt_mask(cpu)) == 2) 9716 static_branch_inc_cpuslocked(&sched_smt_present); 9717 #endif 9718 set_cpu_active(cpu, true); > 9719 tg_update_affinity_domains(cpu, 1); 9720 9721 if (sched_smp_initialized) { 9722 sched_update_numa(cpu, true); 9723 sched_domains_numa_masks_set(cpu); 9724 cpuset_cpu_active(); 9725 } 9726 9727 /* 9728 * Put the rq online, if not already. This happens: 9729 * 9730 * 1) In the early boot process, because we build the real domains 9731 * after all CPUs have been brought up. 9732 * 9733 * 2) At runtime, if cpuset_cpu_active() fails to rebuild the 9734 * domains. 9735 */ 9736 rq_lock_irqsave(rq, &rf); 9737 if (rq->rd) { 9738 BUG_ON(!cpumask_test_cpu(cpu, rq->rd->span)); 9739 set_rq_online(rq); 9740 } 9741 rq_unlock_irqrestore(rq, &rf); 9742 9743 return 0; 9744 } 9745 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP2 v2] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
by Baokun Li 28 Feb '24

28 Feb '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.209 commit 5c28478af371a1c3fdb570ca67f110e1ae60fc37 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932W3 CVE: CVE-2023-52448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ] Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that. Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found") Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index c5bde789a16d..4e760a3fb661 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -2231,7 +2231,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, (unsigned long long)rgd->rd_addr, rgd->rd_flags, rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, rgd->rd_reserved, rgd->rd_extfail_pt); - if (rgd->rd_sbd->sd_args.ar_rgrplvb) { + if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) { struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf, -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v2] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
by Baokun Li 28 Feb '24

28 Feb '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.209 commit 5c28478af371a1c3fdb570ca67f110e1ae60fc37 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932W3 CVE: CVE-2023-52448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ] Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that. Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found") Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index c5bde789a16d..4e760a3fb661 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -2231,7 +2231,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, (unsigned long long)rgd->rd_addr, rgd->rd_flags, rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, rgd->rd_reserved, rgd->rd_extfail_pt); - if (rgd->rd_sbd->sd_args.ar_rgrplvb) { + if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) { struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf, -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS v2] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
by Baokun Li 28 Feb '24

28 Feb '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.209 commit 5c28478af371a1c3fdb570ca67f110e1ae60fc37 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932W3 CVE: CVE-2023-52448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ] Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that. Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found") Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index c5bde789a16d..4e760a3fb661 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -2231,7 +2231,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, (unsigned long long)rgd->rd_addr, rgd->rd_flags, rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, rgd->rd_reserved, rgd->rd_extfail_pt); - if (rgd->rd_sbd->sd_args.ar_rgrplvb) { + if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) { struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf, -- 2.31.1

2 1

[PATCH OLK-5.10 v2] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
by Baokun Li 28 Feb '24

28 Feb '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.209 commit 5c28478af371a1c3fdb570ca67f110e1ae60fc37 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932W3 CVE: CVE-2023-52448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ] Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that. Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found") Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index c5bde789a16d..4e760a3fb661 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -2231,7 +2231,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, (unsigned long long)rgd->rd_addr, rgd->rd_flags, rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, rgd->rd_reserved, rgd->rd_extfail_pt); - if (rgd->rd_sbd->sd_args.ar_rgrplvb) { + if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) { struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf, -- 2.31.1

2 1

[PATCH OLK-6.6 v2 0/2] fix CVE-2024-26590
by Baokun Li 28 Feb '24

28 Feb '24

Gao Xiang (2): erofs: simplify compression configuration parser erofs: fix inconsistent per-file compression format fs/erofs/compress.h | 6 +++ fs/erofs/decompressor.c | 62 ++++++++++++++++++++++++++-- fs/erofs/decompressor_deflate.c | 5 ++- fs/erofs/decompressor_lzma.c | 4 +- fs/erofs/internal.h | 38 +---------------- fs/erofs/super.c | 72 ++++----------------------------- fs/erofs/zmap.c | 23 ++++++----- 7 files changed, 92 insertions(+), 118 deletions(-) -- 2.31.1

2 3

[PATCH v1 OLK-6.6 0/3] kworker: Fix the problem of ipsan performance degradation on ARM architecture
by jiangdongxu 28 Feb '24

28 Feb '24

From: shaodenghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. shaodenghui (3): iscsi: add member for NUMA aware order workqueue workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance drivers/scsi/iscsi_tcp.c | 9 +++++++++ drivers/scsi/libiscsi.c | 17 ++++++++++++----- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 15 ++++++++++----- 5 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 4

[PATCH OLK-6.6 v2] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
by Baokun Li 28 Feb '24

28 Feb '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v6.6.14 commit 067a7c48c2c70f05f9460d6f0e8423e234729f05 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932W3 CVE: CVE-2023-52448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ] Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that. Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found") Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index 9308190895c8..307b952a41f8 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -2306,7 +2306,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, (unsigned long long)rgd->rd_addr, rgd->rd_flags, rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, rgd->rd_requested, rgd->rd_reserved, rgd->rd_extfail_pt); - if (rgd->rd_sbd->sd_args.ar_rgrplvb) { + if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) { struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf, -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS V1] media: pvrusb2: fix use after free on context disconnection
by Guan Jing 28 Feb '24

28 Feb '24

From: "Ricardo B. Marliere" <ricardo(a)marliere.net> stable inclusion from stable-v5.10.209 commit 3233d8bf7893550045682192cb227af7fa3defeb category: bugfix bugzilla: 189571 CVE: CVE-2023-52445 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ded85b0c0edd8f45fec88783d7555a5b982449c1 ] Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack. Reported-and-tested-by: syzbot+621409285c4156a009b3(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a02a4205fff8eb92@google.com/ Fixes: e5be15c63804 ("V4L/DVB (7711): pvrusb2: Fix race on module unload") Signed-off-by: Ricardo B. Marliere <ricardo(a)marliere.net> Acked-by: Mike Isely <isely(a)pobox.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guan Jing <guanjing6(a)huawei.com> --- drivers/media/usb/pvrusb2/pvrusb2-context.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/usb/pvrusb2/pvrusb2-context.c index d9e8481e9e28..9236463ba269 100644 --- a/drivers/media/usb/pvrusb2/pvrusb2-context.c +++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c @@ -277,7 +277,8 @@ void pvr2_context_disconnect(struct pvr2_context *mp) { pvr2_hdw_disconnect(mp->hdw); mp->disconnect_flag = !0; - pvr2_context_notify(mp); + if (!pvr2_context_shutok()) + pvr2_context_notify(mp); } -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] Support PV-sched feature
by lishusen 28 Feb '24

28 Feb '24

PV sched supports the vCPU preemption check to enhance lock performance on overcommitted hosts Zengruan Ye (5): KVM: arm64: Document PV-sched interface KVM: arm64: Implement PV_SCHED_FEATURES call KVM: arm64: Support pvsched preempted via shared structure KVM: arm64: Add interface to support vCPU preempted check KVM: arm64: Support the vCPU preemption check Documentation/virt/kvm/arm/pvsched.rst | 58 +++++++++++++ arch/arm64/Kconfig | 11 +++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/kvm_host.h | 34 ++++++++ arch/arm64/include/asm/paravirt.h | 13 +++ arch/arm64/include/asm/pvsched-abi.h | 18 +++++ arch/arm64/include/asm/spinlock.h | 8 ++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/paravirt-spinlocks.c | 18 +++++ arch/arm64/kernel/paravirt.c | 108 +++++++++++++++++++++++++ arch/arm64/kvm/Makefile | 2 +- arch/arm64/kvm/arm.c | 10 +++ arch/arm64/kvm/hypercalls.c | 21 +++++ arch/arm64/kvm/pvsched.c | 54 +++++++++++++ include/linux/arm-smccc.h | 21 +++++ include/linux/cpuhotplug.h | 1 + 16 files changed, 378 insertions(+), 2 deletions(-) create mode 100644 Documentation/virt/kvm/arm/pvsched.rst create mode 100644 arch/arm64/include/asm/pvsched-abi.h create mode 100644 arch/arm64/kernel/paravirt-spinlocks.c create mode 100644 arch/arm64/kvm/pvsched.c -- 2.33.0

2 6

[PATCH OLK-6.6 00/14] LoongArch: fix some known bug and update defconfig
by Hongchen Zhang 28 Feb '24

28 Feb '24

Bibo Mao (1): LoongArch: Implement constant timer shutdown interface Chong Qiao (1): irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. Hongchen Zhang (3): LoongArch: fix compile error caused by arch_trigger_cpumask_backtrace usb: xhci: add XHCI_NO_SOFT_RETRY quirk for EJ188 net: stmmac: fix potential double free of dma descriptor resources Huacai Chen (1): drm/radeon: Workaround radeon driver bug for Loongson Jianmin Lv (1): LoongArch: Remove generic irq migration Tianli Xiong (1): irqchip/loongson-liointc: Set different isr for differnt core Yingkun Meng (1): LoongArch: defconfig: Enable a large number of configurations Youling Tang (4): LoongArch: kdump: Add memory reservation for old kernel LoongArch: kexec: Add compatibility with old interfaces LoongArch: Fix kdump failure on v40 interface specification LoongArch: kdump: Add high memory reservation zhangtianyang (1): LoongArch: Adapted SECTION_SIZE_BITS with page size arch/loongarch/Kconfig | 1 - arch/loongarch/configs/loongson3_defconfig | 1576 +++++++++++++++-- arch/loongarch/include/asm/irq.h | 3 +- arch/loongarch/include/asm/sparsemem.h | 2 +- arch/loongarch/kernel/irq.c | 36 + arch/loongarch/kernel/machine_kexec.c | 45 +- arch/loongarch/kernel/process.c | 3 +- arch/loongarch/kernel/setup.c | 94 +- arch/loongarch/kernel/smp.c | 3 +- arch/loongarch/kernel/time.c | 23 +- drivers/gpu/drm/radeon/cik.c | 3 + drivers/gpu/drm/radeon/evergreen.c | 3 + drivers/gpu/drm/radeon/r600.c | 3 + drivers/gpu/drm/radeon/si.c | 3 + drivers/irqchip/irq-loongson-liointc.c | 4 +- drivers/irqchip/irq-loongson-pch-pic.c | 16 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 + drivers/usb/host/xhci-pci.c | 6 + kernel/irq/Kconfig | 4 +- 19 files changed, 1639 insertions(+), 200 deletions(-) -- 2.33.0

2 15

[PATCH OLK-6.6 0/6] Export vcpu stat via debugfs
by liangtian 28 Feb '24

28 Feb '24

Create debugfs entry for vcpu stat. chenjiajun (6): kvm: debugfs: Export vcpu stat via debugfs kvm: debugfs: export remaining aarch64 kvm exit reasons to debugfs kvm: debugfs: aarch64 export cpu time related items to debugfs kvm: debugfs: Export x86 kvm exits to vcpu_stat kvm: debugfs: add fastpath msr_wr exits to debugfs statistics kvm: debugfs: add EXIT_REASON_PREEMPTION_TIMER to vcpu_stat arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/kvm_host.h | 21 ++++ arch/arm64/kvm/Kconfig | 9 ++ arch/arm64/kvm/arm.c | 31 ++++++ arch/arm64/kvm/guest.c | 40 +++++++- arch/arm64/kvm/handle_exit.c | 8 ++ arch/arm64/kvm/hyp/include/hyp/switch.h | 2 + arch/arm64/kvm/mmu.c | 1 + arch/arm64/kvm/sys_regs.c | 9 ++ arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/kvm_host.h | 17 ++++ arch/x86/kvm/Kconfig | 9 ++ arch/x86/kvm/vmx/vmx.c | 8 ++ arch/x86/kvm/x86.c | 87 ++++++++++++++++ include/linux/kvm_host.h | 44 ++++++++ include/uapi/linux/kvm.h | 1 + virt/kvm/kvm_main.c | 130 ++++++++++++++++++++++++ 17 files changed, 418 insertions(+), 1 deletion(-) -- 2.33.0

2 7

[PATCH OLK-6.6] x86/fpu: Stop relying on userspace for info to fault in xsave buffer
by liwei 28 Feb '24

28 Feb '24

From: Andrei Vagin <avagin(a)google.com> mainline inclusion from mainline-v6.8-rc4 commit d877550eaf2dc9090d782864c96939397a3c6835 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93HD8 CVE: CVE-2024-26603 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Before this change, the expected size of the user space buffer was taken from fx_sw->xstate_size. fx_sw->xstate_size can be changed from user-space, so it is possible construct a sigreturn frame where: * fx_sw->xstate_size is smaller than the size required by valid bits in fx_sw->xfeatures. * user-space unmaps parts of the sigrame fpu buffer so that not all of the buffer required by xrstor is accessible. In this case, xrstor tries to restore and accesses the unmapped area which results in a fault. But fault_in_readable succeeds because buf + fx_sw->xstate_size is within the still mapped area, so it goes back and tries xrstor again. It will spin in this loop forever. Instead, fault in the maximum size which can be touched by XRSTOR (taken from fpstate->user_size). [ dhansen: tweak subject / changelog ] Fixes: fcb3635f5018 ("x86/fpu/signal: Handle #PF in the direct restore path") Reported-by: Konstantin Bogomolov <bogomolov(a)google.com> Suggested-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Andrei Vagin <avagin(a)google.com> Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com> Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20240130063603.3392627-1-avagin%40google.com Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/kernel/fpu/signal.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c index 558076dbde5b..247f2225aa9f 100644 --- a/arch/x86/kernel/fpu/signal.c +++ b/arch/x86/kernel/fpu/signal.c @@ -274,12 +274,13 @@ static int __restore_fpregs_from_user(void __user *buf, u64 ufeatures, * Attempt to restore the FPU registers directly from user memory. * Pagefaults are handled and any errors returned are fatal. */ -static bool restore_fpregs_from_user(void __user *buf, u64 xrestore, - bool fx_only, unsigned int size) +static bool restore_fpregs_from_user(void __user *buf, u64 xrestore, bool fx_only) { struct fpu *fpu = &current->thread.fpu; int ret; + /* Restore enabled features only. */ + xrestore &= fpu->fpstate->user_xfeatures; retry: fpregs_lock(); /* Ensure that XFD is up to date */ @@ -309,7 +310,7 @@ static bool restore_fpregs_from_user(void __user *buf, u64 xrestore, if (ret != X86_TRAP_PF) return false; - if (!fault_in_readable(buf, size)) + if (!fault_in_readable(buf, fpu->fpstate->user_size)) goto retry; return false; } @@ -339,7 +340,6 @@ static bool __fpu_restore_sig(void __user *buf, void __user *buf_fx, struct user_i387_ia32_struct env; bool success, fx_only = false; union fpregs_state *fpregs; - unsigned int state_size; u64 user_xfeatures = 0; if (use_xsave()) { @@ -349,17 +349,14 @@ static bool __fpu_restore_sig(void __user *buf, void __user *buf_fx, return false; fx_only = !fx_sw_user.magic1; - state_size = fx_sw_user.xstate_size; user_xfeatures = fx_sw_user.xfeatures; } else { user_xfeatures = XFEATURE_MASK_FPSSE; - state_size = fpu->fpstate->user_size; } if (likely(!ia32_fxstate)) { /* Restore the FPU registers directly from user memory. */ - return restore_fpregs_from_user(buf_fx, user_xfeatures, fx_only, - state_size); + return restore_fpregs_from_user(buf_fx, user_xfeatures, fx_only); } /* -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v3] Revert "memcg: fix a UAF problem in drain_all_stock()"
by GONG, Ruiqi 28 Feb '24

28 Feb '24

hulk inclusion category: bugfix bugzilla: 189183, https://gitee.com/openeuler/kernel/issues/I7Z1ZU CVE: NA -------------------------------- This reverts commit 616e708277a2 ("memcg: fix a UAF problem in drain_all_stock()"), which was produced based on in-house 3.10 and later was found to be not suitable for in-house 4.18/4.19, as both of them use async version of drain_all_stock() whose actual draining could be delayed, and some of them even removed drain_all_stock() from memcg's offline process. In these cases the commit doesn't fix the original problem. Fixes: 616e708277a2 ("memcg: fix a UAF problem in drain_all_stock()") Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> --- mm/memcontrol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 29d430885b1a..7dc68b1792ef 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -2232,7 +2232,8 @@ static void drain_all_stock(struct mem_cgroup *root_memcg) rcu_read_lock(); memcg = stock->cached; - if (memcg && mem_cgroup_is_descendant(memcg, root_memcg)) + if (memcg && stock->nr_pages && + mem_cgroup_is_descendant(memcg, root_memcg)) flush = true; rcu_read_unlock(); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] drivers/amd/pm: fix a use-after-free in kv_parse_power_table
by Hui Tang 28 Feb '24

28 Feb '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> stable inclusion from stable-v4.19.305 commit 8a27d9d9fc9b5564b8904c3a77a7dea482bfa34e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I94FUJ CVE: CVE-2023-52469 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 28dd788382c43b330480f57cd34cde0840896743 ] When ps allocated by kzalloc equals to NULL, kv_parse_power_table frees adev->pm.dpm.ps that allocated before. However, after the control flow goes through the following call chains: kv_parse_power_table |-> kv_dpm_init |-> kv_dpm_sw_init |-> kv_dpm_fini The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its first free in kv_parse_power_table and causes a use-after-free bug. Fixes: a2e73f56fa62 ("drm/amdgpu: Add support for CIK parts") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/kv_dpm.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c index cb79a93c2eb7..f046348362e3 100644 --- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c +++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c @@ -2746,10 +2746,8 @@ static int kv_parse_power_table(struct amdgpu_device *adev) non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) &non_clock_info_array->nonClockInfo[non_clock_array_index]; ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL); - if (ps == NULL) { - kfree(adev->pm.dpm.ps); + if (ps == NULL) return -ENOMEM; - } adev->pm.dpm.ps[i].ps_priv = ps; k = 0; idx = (u8 *)&power_state->v2.clockInfoIndex[0]; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-52451 backport to 4.19
by Lin Yujun 28 Feb '24

28 Feb '24

*** BLURB HERE *** Laurent Dufour (1): powerpc/pseries/memhotplug: Quieten some DLPAR operations Nathan Lynch (1): powerpc/pseries/memhp: Fix access beyond end of drmem array .../platforms/pseries/hotplug-memory.c | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS v2] Revert "memcg: fix a UAF problem in drain_all_stock()"
by GONG, Ruiqi 28 Feb '24

28 Feb '24

hulk inclusion category: bugfix bugzilla: 189183, https://gitee.com/openeuler/kernel/issues/I7Z1ZU CVE: NA -------------------------------- This reverts commit 616e708277a2 ("memcg: fix a UAF problem in drain_all_stock()"), which was produced based on HULK-7.5 and later was found to be not suitable for HULK-8.1/4.19. Fixes: 616e708277a2 ("memcg: fix a UAF problem in drain_all_stock()") Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> --- mm/memcontrol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 29d430885b1a..7dc68b1792ef 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -2232,7 +2232,8 @@ static void drain_all_stock(struct mem_cgroup *root_memcg) rcu_read_lock(); memcg = stock->cached; - if (memcg && mem_cgroup_is_descendant(memcg, root_memcg)) + if (memcg && stock->nr_pages && + mem_cgroup_is_descendant(memcg, root_memcg)) flush = true; rcu_read_unlock(); -- 2.25.1

2 1

[PATCH OLK-5.10] x86/fpu: Stop relying on userspace for info to fault in xsave buffer
by liwei 28 Feb '24

28 Feb '24

From: Andrei Vagin <avagin(a)google.com> mainline inclusion from mainline-v6.8-rc4 commit d877550eaf2dc9090d782864c96939397a3c6835 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93HD8 CVE: CVE-2024-26603 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Before this change, the expected size of the user space buffer was taken from fx_sw->xstate_size. fx_sw->xstate_size can be changed from user-space, so it is possible construct a sigreturn frame where: * fx_sw->xstate_size is smaller than the size required by valid bits in fx_sw->xfeatures. * user-space unmaps parts of the sigrame fpu buffer so that not all of the buffer required by xrstor is accessible. In this case, xrstor tries to restore and accesses the unmapped area which results in a fault. But fault_in_readable succeeds because buf + fx_sw->xstate_size is within the still mapped area, so it goes back and tries xrstor again. It will spin in this loop forever. Instead, fault in the maximum size which can be touched by XRSTOR (taken from fpstate->user_size). [ dhansen: tweak subject / changelog ] Fixes: fcb3635f5018 ("x86/fpu/signal: Handle #PF in the direct restore path") Reported-by: Konstantin Bogomolov <bogomolov(a)google.com> Suggested-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Andrei Vagin <avagin(a)google.com> Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com> Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20240130063603.3392627-1-avagin%40google.com Conflicts: arch/x86/kernel/fpu/signal.c Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/kernel/fpu/signal.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c index b35643ad17f5..e32d461b7d2f 100644 --- a/arch/x86/kernel/fpu/signal.c +++ b/arch/x86/kernel/fpu/signal.c @@ -274,12 +274,13 @@ static int __restore_fpregs_from_user(void __user *buf, u64 ufeatures, * Attempt to restore the FPU registers directly from user memory. * Pagefaults are handled and any errors returned are fatal. */ -static bool restore_fpregs_from_user(void __user *buf, u64 xrestore, - bool fx_only, unsigned int size) +static bool restore_fpregs_from_user(void __user *buf, u64 xrestore, bool fx_only) { struct fpu *fpu = &current->thread.fpu; int ret; + /* Restore enabled features only. */ + xrestore &= fpu->fpstate->user_xfeatures; retry: fpregs_lock(); /* Ensure that XFD is up to date */ @@ -309,7 +310,7 @@ static bool restore_fpregs_from_user(void __user *buf, u64 xrestore, if (ret != X86_TRAP_PF) return false; - if (!fault_in_pages_readable(buf, size)) + if (!fault_in_pages_readable(buf, fpu->fpstate->user_size)) goto retry; return false; } @@ -339,7 +340,6 @@ static bool __fpu_restore_sig(void __user *buf, void __user *buf_fx, struct user_i387_ia32_struct env; bool success, fx_only = false; union fpregs_state *fpregs; - unsigned int state_size; u64 user_xfeatures = 0; if (use_xsave()) { @@ -349,17 +349,14 @@ static bool __fpu_restore_sig(void __user *buf, void __user *buf_fx, return false; fx_only = !fx_sw_user.magic1; - state_size = fx_sw_user.xstate_size; user_xfeatures = fx_sw_user.xfeatures; } else { user_xfeatures = XFEATURE_MASK_FPSSE; - state_size = fpu->fpstate->user_size; } if (likely(!ia32_fxstate)) { /* Restore the FPU registers directly from user memory. */ - return restore_fpregs_from_user(buf_fx, user_xfeatures, fx_only, - state_size); + return restore_fpregs_from_user(buf_fx, user_xfeatures, fx_only); } /* -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] CVE-2023-52451 backport to OLK-5.10
by Lin Yujun 28 Feb '24

28 Feb '24

*** BLURB HERE *** Laurent Dufour (1): powerpc/pseries/memhotplug: Quieten some DLPAR operations Nathan Lynch (1): powerpc/pseries/memhp: Fix access beyond end of drmem array .../platforms/pseries/hotplug-memory.c | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) -- 2.34.1

2 3