- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 1834/7374] mm/page_cache_limit.c:35:5: sparse: sparse: symbol 'cache_reclaim_enable_handler' was not declared. Should it be static?
by kernel test robot 12 Apr '24

12 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 8f7c77eb69ee331fb66fad8eec5ca81b8843eaf3 commit: 621647ce254f1d347ae9bc3d328c09cbb2732487 [1834/7374] mm: support periodical memory reclaim config: x86_64-randconfig-123-20240412 (https://download.01.org/0day-ci/archive/20240412/202404120351.SxZeSfTi-lkp@…) compiler: gcc-9 (Ubuntu 9.5.0-4ubuntu2) 9.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240412/202404120351.SxZeSfTi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404120351.SxZeSfTi-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/page_cache_limit.c:35:5: sparse: sparse: symbol 'cache_reclaim_enable_handler' was not declared. Should it be static? >> mm/page_cache_limit.c:51:5: sparse: sparse: symbol 'cache_reclaim_sysctl_handler' was not declared. Should it be static? vim +/cache_reclaim_enable_handler +35 mm/page_cache_limit.c 34 > 35 int cache_reclaim_enable_handler(struct ctl_table *table, int write, 36 void *buffer, size_t *length, loff_t *ppos) 37 { 38 int ret; 39 40 ret = proc_dointvec_minmax(table, write, buffer, length, ppos); 41 if (ret || !write) 42 return ret; 43 44 if (should_periodical_reclaim()) 45 schedule_delayed_work(&shepherd, round_jiffies_relative( 46 (unsigned long)vm_cache_reclaim_s * HZ)); 47 48 return 0; 49 } 50 > 51 int cache_reclaim_sysctl_handler(struct ctl_table *table, int write, 52 void *buffer, size_t *length, loff_t *ppos) 53 { 54 int ret; 55 56 ret = proc_dointvec_minmax(table, write, buffer, length, ppos); 57 if (ret || !write) 58 return ret; 59 60 if (should_periodical_reclaim()) 61 mod_delayed_work(system_unbound_wq, &shepherd, 62 round_jiffies_relative( 63 (unsigned long)vm_cache_reclaim_s * HZ)); 64 65 return ret; 66 } 67 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1657/7374] kernel/sched/fair.c:8325:9: error: implicit declaration of function 'sched_idle_cpu'; did you mean 'sched_idle_rq'?
by kernel test robot 12 Apr '24

12 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 8f7c77eb69ee331fb66fad8eec5ca81b8843eaf3 commit: 926b9b0cd97e640ee680347cf449c3dc152dddd2 [1657/7374] sched: Throttle qos cfs_rq when current cpu is running online task config: x86_64-randconfig-123-20240412 (https://download.01.org/0day-ci/archive/20240412/202404120103.YG6kXg4w-lkp@…) compiler: gcc-9 (Ubuntu 9.5.0-4ubuntu2) 9.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240412/202404120103.YG6kXg4w-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404120103.YG6kXg4w-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from include/linux/export.h:5, from include/linux/linkage.h:7, from include/linux/kernel.h:17, from include/linux/cpumask.h:10, from include/linux/energy_model.h:4, from kernel/sched/fair.c:23: kernel/sched/fair.c: In function 'check_qos_cfs_rq': >> kernel/sched/fair.c:8325:9: error: implicit declaration of function 'sched_idle_cpu'; did you mean 'sched_idle_rq'? [-Werror=implicit-function-declaration] 8325 | !sched_idle_cpu(smp_processor_id()) && | ^~~~~~~~~~~~~~ include/linux/compiler.h:77:42: note: in definition of macro 'unlikely' 77 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ >> kernel/sched/fair.c:8328:21: error: 'struct rq' has no member named 'online' 8328 | if (!rq_of(cfs_rq)->online) | ^~ kernel/sched/fair.c: In function 'pick_next_task_fair': >> kernel/sched/fair.c:8531:7: error: 'struct rq' has no member named 'idle_stamp'; did you mean 'idle_state'? 8531 | rq->idle_stamp = 0; | ^~~~~~~~~~ | idle_state kernel/sched/fair.c: At top level: kernel/sched/fair.c:8166:13: warning: 'start_qos_hrtimer' used but never defined 8166 | static void start_qos_hrtimer(int cpu); | ^~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +8325 kernel/sched/fair.c 8321 8322 static bool check_qos_cfs_rq(struct cfs_rq *cfs_rq) 8323 { 8324 if (unlikely(cfs_rq && cfs_rq->tg->qos_level < 0 && > 8325 !sched_idle_cpu(smp_processor_id()) && 8326 cfs_rq->h_nr_running == cfs_rq->idle_h_nr_running)) { 8327 > 8328 if (!rq_of(cfs_rq)->online) 8329 return false; 8330 8331 throttle_qos_cfs_rq(cfs_rq); 8332 return true; 8333 } 8334 8335 return false; 8336 } 8337 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] nilfs2: fix potential bug in end_buffer_async_write
by Zizhi Wo 11 Apr '24

11 Apr '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.210 commit f3e4963566f58726d3265a727116a42b591f6596 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2FP CVE: CVE-2024-26685 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5bc09b397cbf1221f8a8aacb1152650c9195b02b upstream. According to a syzbot report, end_buffer_async_write(), which handles the completion of block device writes, may detect abnormal condition of the buffer async_write flag and cause a BUG_ON failure when using nilfs2. Nilfs2 itself does not use end_buffer_async_write(). But, the async_write flag is now used as a marker by commit 7f42ec394156 ("nilfs2: fix issue with race condition of competition between segments for dirty blocks") as a means of resolving double list insertion of dirty blocks in nilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the resulting crash. This modification is safe as long as it is used for file data and b-tree node blocks where the page caches are independent. However, it was irrelevant and redundant to also introduce async_write for segment summary and super root blocks that share buffers with the backing device. This led to the possibility that the BUG_ON check in end_buffer_async_write would fail as described above, if independent writebacks of the backing device occurred in parallel. The use of async_write for segment summary buffers has already been removed in a previous change. Fix this issue by removing the manipulation of the async_write flag for the remaining super root block buffer. Link: https://lkml.kernel.org/r/20240203161645.4992-1-konishi.ryusuke@gmail.com Fixes: 7f42ec394156 ("nilfs2: fix issue with race condition of competition between segments for dirty blocks") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+5c04210f7c7f897c1e7f(a)syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/00000000000019a97c05fd42f8c8@google.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nilfs2/segment.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 418055ac910b..be0ca35b8aa4 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -1707,7 +1707,6 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) list_for_each_entry(bh, &segbuf->sb_payload_buffers, b_assoc_buffers) { - set_buffer_async_write(bh); if (bh == segbuf->sb_super_root) { if (bh->b_page != bd_page) { lock_page(bd_page); @@ -1718,6 +1717,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) } break; } + set_buffer_async_write(bh); if (bh->b_page != fs_page) { nilfs_begin_page_io(fs_page); fs_page = bh->b_page; @@ -1803,7 +1803,6 @@ static void nilfs_abort_logs(struct list_head *logs, int err) list_for_each_entry(bh, &segbuf->sb_payload_buffers, b_assoc_buffers) { - clear_buffer_async_write(bh); if (bh == segbuf->sb_super_root) { clear_buffer_uptodate(bh); if (bh->b_page != bd_page) { @@ -1812,6 +1811,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err) } break; } + clear_buffer_async_write(bh); if (bh->b_page != fs_page) { nilfs_end_page_io(fs_page, err); fs_page = bh->b_page; @@ -1899,8 +1899,9 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci) BIT(BH_Delay) | BIT(BH_NILFS_Volatile) | BIT(BH_NILFS_Redirected)); - set_mask_bits(&bh->b_state, clear_bits, set_bits); if (bh == segbuf->sb_super_root) { + set_buffer_uptodate(bh); + clear_buffer_dirty(bh); if (bh->b_page != bd_page) { end_page_writeback(bd_page); bd_page = bh->b_page; @@ -1908,6 +1909,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci) update_sr = true; break; } + set_mask_bits(&bh->b_state, clear_bits, set_bits); if (bh->b_page != fs_page) { nilfs_end_page_io(fs_page, 0); fs_page = bh->b_page; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2024-26685
by Zizhi Wo 11 Apr '24

11 Apr '24

Fixup the CVE-2024-26685 Ryusuke Konishi (2): nilfs2: fix buffer corruption due to concurrent device reads nilfs2: fix potential bug in end_buffer_async_write fs/nilfs2/segbuf.c | 6 ++++++ fs/nilfs2/segment.c | 15 ++++++++++++--- fs/nilfs2/super.c | 23 ++++++++++++++++++++++- 3 files changed, 40 insertions(+), 4 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10 0/2] Fix CVE-2024-26685
by Zizhi Wo 11 Apr '24

11 Apr '24

Fix up the CVE-2024-26685 Ryusuke Konishi (2): nilfs2: fix buffer corruption due to concurrent device reads nilfs2: fix potential bug in end_buffer_async_write fs/nilfs2/segbuf.c | 6 ++++++ fs/nilfs2/segment.c | 15 ++++++++++++--- fs/nilfs2/super.c | 23 ++++++++++++++++++++++- 3 files changed, 40 insertions(+), 4 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] ceph: prevent use-after-free in encode_cap_msg()
by Long Li 11 Apr '24

11 Apr '24

From: Rishabh Dave <ridave(a)redhat.com> stable inclusion from stable-v5.10.167 commit 8180d0c27b93a6eb60da1b08ea079e3926328214 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GN CVE: CVE-2024-26689 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit cda4672da1c26835dcbd7aec2bfed954eda9b5ef upstream. In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This implies before the refcount could be increment here, it was freed. In same file, in "handle_cap_grant()" refcount is decremented by this line - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race occurred and resource was freed by the latter line before the former line could increment it. encode_cap_msg() is called by __send_cap() and __send_cap() is called by ceph_check_caps() after calling __prep_cap(). __prep_cap() is where arg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot where the refcount must be increased to prevent "use after free" error. Cc: stable(a)vger.kernel.org Link: https://tracker.ceph.com/issues/59259 Signed-off-by: Rishabh Dave <ridave(a)redhat.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Reviewed-by: Xiubo Li <xiubli(a)redhat.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ceph/caps.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index b0cf79b0dc49..8e43d07ffa8b 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -1402,7 +1402,7 @@ static void __prep_cap(struct cap_msg_args *arg, struct ceph_cap *cap, if (flushing & CEPH_CAP_XATTR_EXCL) { arg->old_xattr_buf = __ceph_build_xattrs_blob(ci); arg->xattr_version = ci->i_xattrs.version; - arg->xattr_buf = ci->i_xattrs.blob; + arg->xattr_buf = ceph_buffer_get(ci->i_xattrs.blob); } else { arg->xattr_buf = NULL; arg->old_xattr_buf = NULL; @@ -1468,6 +1468,7 @@ static void __send_cap(struct cap_msg_args *arg, struct ceph_inode_info *ci) encode_cap_msg(msg, arg); ceph_con_send(&arg->session->s_con, msg); ceph_buffer_put(arg->old_xattr_buf); + ceph_buffer_put(arg->xattr_buf); if (arg->wake) wake_up_all(&ci->i_cap_wq); } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] [Backport] rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks
by Liu Chuang 11 Apr '24

11 Apr '24

From: "Paul E. McKenney" <paulmck(a)kernel.org> maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9FXM5 Reference: https://lore.kernel.org/all/20240207110846.25168-1-qiang.zhang1211@gmail.co… -------------------------------- commit bc31e6cb27a9334140ff2f0a209d59b08bc0bc8c upstream. Holding a mutex across synchronize_rcu_tasks() and acquiring that same mutex in code called from do_exit() after its call to exit_tasks_rcu_start() but before its call to exit_tasks_rcu_stop() results in deadlock. This is by design, because tasks that are far enough into do_exit() are no longer present on the tasks list, making it a bit difficult for RCU Tasks to find them, let alone wait on them to do a voluntary context switch. However, such deadlocks are becoming more frequent. In addition, lockdep currently does not detect such deadlocks and they can be difficult to reproduce. In addition, if a task voluntarily context switches during that time (for example, if it blocks acquiring a mutex), then this task is in an RCU Tasks quiescent state. And with some adjustments, RCU Tasks could just as well take advantage of that fact. This commit therefore eliminates these deadlock by replacing the SRCU-based wait for do_exit() completion with per-CPU lists of tasks currently exiting. A given task will be on one of these per-CPU lists for the same period of time that this task would previously have been in the previous SRCU read-side critical section. These lists enable RCU Tasks to find the tasks that have already been removed from the tasks list, but that must nevertheless be waited upon. The RCU Tasks grace period gathers any of these do_exit() tasks that it must wait on, and adds them to the list of holdouts. Per-CPU locking and get_task_struct() are used to synchronize addition to and removal from these lists. Link: https://lore.kernel.org/all/20240118021842.290665-1-chenzhongjin@huawei.com/ Reported-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Signed-off-by: Paul E. McKenney <paulmck(a)kernel.org> Signed-off-by: Zqiang <qiang.zhang1211(a)gmail.com> --- include/linux/sched.h | 1 + init/init_task.c | 1 + kernel/fork.c | 1 + kernel/rcu/update.c | 65 ++++++++++++++++++++++++++++++------------- 4 files changed, 49 insertions(+), 19 deletions(-) diff --git a/include/linux/sched.h b/include/linux/sched.h index 8fd8c5b7cdc6..2dff665cc33a 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -705,6 +705,7 @@ struct task_struct { u8 rcu_tasks_idx; int rcu_tasks_idle_cpu; struct list_head rcu_tasks_holdout_list; + struct list_head rcu_tasks_exit_list; #endif /* #ifdef CONFIG_TASKS_RCU */ struct sched_info sched_info; diff --git a/init/init_task.c b/init/init_task.c index b312a045f4b9..4bc8502d33d3 100644 --- a/init/init_task.c +++ b/init/init_task.c @@ -139,6 +139,7 @@ struct task_struct init_task .rcu_tasks_holdout = false, .rcu_tasks_holdout_list = LIST_HEAD_INIT(init_task.rcu_tasks_holdout_list), .rcu_tasks_idle_cpu = -1, + .rcu_tasks_exit_list = LIST_HEAD_INIT(init_task.rcu_tasks_exit_list), #endif #ifdef CONFIG_CPUSETS .mems_allowed_seq = SEQCNT_ZERO(init_task.mems_allowed_seq), diff --git a/kernel/fork.c b/kernel/fork.c index bfc4534ff116..8c96c517e09e 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1711,6 +1711,7 @@ static inline void rcu_copy_process(struct task_struct *p) p->rcu_tasks_holdout = false; INIT_LIST_HEAD(&p->rcu_tasks_holdout_list); p->rcu_tasks_idle_cpu = -1; + INIT_LIST_HEAD(&p->rcu_tasks_exit_list); #endif /* #ifdef CONFIG_TASKS_RCU */ } diff --git a/kernel/rcu/update.c b/kernel/rcu/update.c index 759ea6881a58..af9a43172d0e 100644 --- a/kernel/rcu/update.c +++ b/kernel/rcu/update.c @@ -527,7 +527,8 @@ static DECLARE_WAIT_QUEUE_HEAD(rcu_tasks_cbs_wq); static DEFINE_RAW_SPINLOCK(rcu_tasks_cbs_lock); /* Track exiting tasks in order to allow them to be waited for. */ -DEFINE_STATIC_SRCU(tasks_rcu_exit_srcu); +static LIST_HEAD(rtp_exit_list); +static DEFINE_RAW_SPINLOCK(rtp_exit_list_lock); /* Control stall timeouts. Disable with <= 0, otherwise jiffies till stall. */ #define RCU_TASK_STALL_TIMEOUT (HZ * 60 * 10) @@ -661,6 +662,17 @@ static void check_holdout_task(struct task_struct *t, sched_show_task(t); } +static void rcu_tasks_pertask(struct task_struct *t, struct list_head *hop) +{ + if (t != current && READ_ONCE(t->on_rq) && + !is_idle_task(t)) { + get_task_struct(t); + t->rcu_tasks_nvcsw = READ_ONCE(t->nvcsw); + WRITE_ONCE(t->rcu_tasks_holdout, true); + list_add(&t->rcu_tasks_holdout_list, hop); + } +} + /* RCU-tasks kthread that detects grace periods and invokes callbacks. */ static int __noreturn rcu_tasks_kthread(void *arg) { @@ -726,14 +738,7 @@ static int __noreturn rcu_tasks_kthread(void *arg) */ rcu_read_lock(); for_each_process_thread(g, t) { - if (t != current && READ_ONCE(t->on_rq) && - !is_idle_task(t)) { - get_task_struct(t); - t->rcu_tasks_nvcsw = READ_ONCE(t->nvcsw); - WRITE_ONCE(t->rcu_tasks_holdout, true); - list_add(&t->rcu_tasks_holdout_list, - &rcu_tasks_holdouts); - } + rcu_tasks_pertask(t, &rcu_tasks_holdouts); } rcu_read_unlock(); @@ -744,8 +749,12 @@ static int __noreturn rcu_tasks_kthread(void *arg) * where they have disabled preemption, allowing the * later synchronize_sched() to finish the job. */ - synchronize_srcu(&tasks_rcu_exit_srcu); - + raw_spin_lock_irqsave(&rtp_exit_list_lock, flags); + list_for_each_entry(t, &rtp_exit_list, rcu_tasks_exit_list) { + if (list_empty(&t->rcu_tasks_holdout_list)) + rcu_tasks_pertask(t, &rcu_tasks_holdouts); + } + raw_spin_unlock_irqrestore(&rtp_exit_list_lock, flags); /* * Each pass through the following loop scans the list * of holdout tasks, removing any that are no longer @@ -802,8 +811,7 @@ static int __noreturn rcu_tasks_kthread(void *arg) * * In addition, this synchronize_sched() waits for exiting * tasks to complete their final preempt_disable() region - * of execution, cleaning up after the synchronize_srcu() - * above. + * of execution. */ synchronize_sched(); @@ -835,20 +843,39 @@ static int __init rcu_spawn_tasks_kthread(void) } core_initcall(rcu_spawn_tasks_kthread); -/* Do the srcu_read_lock() for the above synchronize_srcu(). */ +/* + * Protect against tasklist scan blind spot while the task is exiting and + * may be removed from the tasklist. Do this by adding the task to yet + * another list. + */ void exit_tasks_rcu_start(void) { + unsigned long flags; + struct task_struct *t = current; + + WARN_ON_ONCE(!list_empty(&t->rcu_tasks_exit_list)); + get_task_struct(t); preempt_disable(); - current->rcu_tasks_idx = __srcu_read_lock(&tasks_rcu_exit_srcu); + raw_spin_lock_irqsave(&rtp_exit_list_lock, flags); + list_add(&t->rcu_tasks_exit_list, &rtp_exit_list); + raw_spin_unlock_irqrestore(&rtp_exit_list_lock, flags); preempt_enable(); } -/* Do the srcu_read_unlock() for the above synchronize_srcu(). */ +/* + * Remove the task from the "yet another list" because do_exit() is now + * non-preemptible, allowing synchronize_rcu() to wait beyond this point. + */ void exit_tasks_rcu_finish(void) { - preempt_disable(); - __srcu_read_unlock(&tasks_rcu_exit_srcu, current->rcu_tasks_idx); - preempt_enable(); + unsigned long flags; + struct task_struct *t = current; + + WARN_ON_ONCE(list_empty(&t->rcu_tasks_exit_list)); + raw_spin_lock_irqsave(&rtp_exit_list_lock, flags); + list_del_init(&t->rcu_tasks_exit_list); + raw_spin_unlock_irqrestore(&rtp_exit_list_lock, flags); + put_task_struct(t); } #endif /* #ifdef CONFIG_TASKS_RCU */ -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] [Backport] rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks
by Liu Chuang 11 Apr '24

11 Apr '24

From: "Paul E. McKenney" <paulmck(a)kernel.org> maillist inclusion category: bugfix bugzilla: 189584 Reference: https://lore.kernel.org/all/20240207110846.25168-1-qiang.zhang1211@gmail.co… -------------------------------- commit bc31e6cb27a9334140ff2f0a209d59b08bc0bc8c upstream. Holding a mutex across synchronize_rcu_tasks() and acquiring that same mutex in code called from do_exit() after its call to exit_tasks_rcu_start() but before its call to exit_tasks_rcu_stop() results in deadlock. This is by design, because tasks that are far enough into do_exit() are no longer present on the tasks list, making it a bit difficult for RCU Tasks to find them, let alone wait on them to do a voluntary context switch. However, such deadlocks are becoming more frequent. In addition, lockdep currently does not detect such deadlocks and they can be difficult to reproduce. In addition, if a task voluntarily context switches during that time (for example, if it blocks acquiring a mutex), then this task is in an RCU Tasks quiescent state. And with some adjustments, RCU Tasks could just as well take advantage of that fact. This commit therefore eliminates these deadlock by replacing the SRCU-based wait for do_exit() completion with per-CPU lists of tasks currently exiting. A given task will be on one of these per-CPU lists for the same period of time that this task would previously have been in the previous SRCU read-side critical section. These lists enable RCU Tasks to find the tasks that have already been removed from the tasks list, but that must nevertheless be waited upon. The RCU Tasks grace period gathers any of these do_exit() tasks that it must wait on, and adds them to the list of holdouts. Per-CPU locking and get_task_struct() are used to synchronize addition to and removal from these lists. Link: https://lore.kernel.org/all/20240118021842.290665-1-chenzhongjin@huawei.com/ Reported-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Signed-off-by: Paul E. McKenney <paulmck(a)kernel.org> Signed-off-by: Zqiang <qiang.zhang1211(a)gmail.com> --- include/linux/sched.h | 1 + init/init_task.c | 1 + kernel/fork.c | 1 + kernel/rcu/update.c | 65 ++++++++++++++++++++++++++++++------------- 4 files changed, 49 insertions(+), 19 deletions(-) diff --git a/include/linux/sched.h b/include/linux/sched.h index 8fd8c5b7cdc6..2dff665cc33a 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -705,6 +705,7 @@ struct task_struct { u8 rcu_tasks_idx; int rcu_tasks_idle_cpu; struct list_head rcu_tasks_holdout_list; + struct list_head rcu_tasks_exit_list; #endif /* #ifdef CONFIG_TASKS_RCU */ struct sched_info sched_info; diff --git a/init/init_task.c b/init/init_task.c index b312a045f4b9..4bc8502d33d3 100644 --- a/init/init_task.c +++ b/init/init_task.c @@ -139,6 +139,7 @@ struct task_struct init_task .rcu_tasks_holdout = false, .rcu_tasks_holdout_list = LIST_HEAD_INIT(init_task.rcu_tasks_holdout_list), .rcu_tasks_idle_cpu = -1, + .rcu_tasks_exit_list = LIST_HEAD_INIT(init_task.rcu_tasks_exit_list), #endif #ifdef CONFIG_CPUSETS .mems_allowed_seq = SEQCNT_ZERO(init_task.mems_allowed_seq), diff --git a/kernel/fork.c b/kernel/fork.c index bfc4534ff116..8c96c517e09e 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1711,6 +1711,7 @@ static inline void rcu_copy_process(struct task_struct *p) p->rcu_tasks_holdout = false; INIT_LIST_HEAD(&p->rcu_tasks_holdout_list); p->rcu_tasks_idle_cpu = -1; + INIT_LIST_HEAD(&p->rcu_tasks_exit_list); #endif /* #ifdef CONFIG_TASKS_RCU */ } diff --git a/kernel/rcu/update.c b/kernel/rcu/update.c index 759ea6881a58..af9a43172d0e 100644 --- a/kernel/rcu/update.c +++ b/kernel/rcu/update.c @@ -527,7 +527,8 @@ static DECLARE_WAIT_QUEUE_HEAD(rcu_tasks_cbs_wq); static DEFINE_RAW_SPINLOCK(rcu_tasks_cbs_lock); /* Track exiting tasks in order to allow them to be waited for. */ -DEFINE_STATIC_SRCU(tasks_rcu_exit_srcu); +static LIST_HEAD(rtp_exit_list); +static DEFINE_RAW_SPINLOCK(rtp_exit_list_lock); /* Control stall timeouts. Disable with <= 0, otherwise jiffies till stall. */ #define RCU_TASK_STALL_TIMEOUT (HZ * 60 * 10) @@ -661,6 +662,17 @@ static void check_holdout_task(struct task_struct *t, sched_show_task(t); } +static void rcu_tasks_pertask(struct task_struct *t, struct list_head *hop) +{ + if (t != current && READ_ONCE(t->on_rq) && + !is_idle_task(t)) { + get_task_struct(t); + t->rcu_tasks_nvcsw = READ_ONCE(t->nvcsw); + WRITE_ONCE(t->rcu_tasks_holdout, true); + list_add(&t->rcu_tasks_holdout_list, hop); + } +} + /* RCU-tasks kthread that detects grace periods and invokes callbacks. */ static int __noreturn rcu_tasks_kthread(void *arg) { @@ -726,14 +738,7 @@ static int __noreturn rcu_tasks_kthread(void *arg) */ rcu_read_lock(); for_each_process_thread(g, t) { - if (t != current && READ_ONCE(t->on_rq) && - !is_idle_task(t)) { - get_task_struct(t); - t->rcu_tasks_nvcsw = READ_ONCE(t->nvcsw); - WRITE_ONCE(t->rcu_tasks_holdout, true); - list_add(&t->rcu_tasks_holdout_list, - &rcu_tasks_holdouts); - } + rcu_tasks_pertask(t, &rcu_tasks_holdouts); } rcu_read_unlock(); @@ -744,8 +749,12 @@ static int __noreturn rcu_tasks_kthread(void *arg) * where they have disabled preemption, allowing the * later synchronize_sched() to finish the job. */ - synchronize_srcu(&tasks_rcu_exit_srcu); - + raw_spin_lock_irqsave(&rtp_exit_list_lock, flags); + list_for_each_entry(t, &rtp_exit_list, rcu_tasks_exit_list) { + if (list_empty(&t->rcu_tasks_holdout_list)) + rcu_tasks_pertask(t, &rcu_tasks_holdouts); + } + raw_spin_unlock_irqrestore(&rtp_exit_list_lock, flags); /* * Each pass through the following loop scans the list * of holdout tasks, removing any that are no longer @@ -802,8 +811,7 @@ static int __noreturn rcu_tasks_kthread(void *arg) * * In addition, this synchronize_sched() waits for exiting * tasks to complete their final preempt_disable() region - * of execution, cleaning up after the synchronize_srcu() - * above. + * of execution. */ synchronize_sched(); @@ -835,20 +843,39 @@ static int __init rcu_spawn_tasks_kthread(void) } core_initcall(rcu_spawn_tasks_kthread); -/* Do the srcu_read_lock() for the above synchronize_srcu(). */ +/* + * Protect against tasklist scan blind spot while the task is exiting and + * may be removed from the tasklist. Do this by adding the task to yet + * another list. + */ void exit_tasks_rcu_start(void) { + unsigned long flags; + struct task_struct *t = current; + + WARN_ON_ONCE(!list_empty(&t->rcu_tasks_exit_list)); + get_task_struct(t); preempt_disable(); - current->rcu_tasks_idx = __srcu_read_lock(&tasks_rcu_exit_srcu); + raw_spin_lock_irqsave(&rtp_exit_list_lock, flags); + list_add(&t->rcu_tasks_exit_list, &rtp_exit_list); + raw_spin_unlock_irqrestore(&rtp_exit_list_lock, flags); preempt_enable(); } -/* Do the srcu_read_unlock() for the above synchronize_srcu(). */ +/* + * Remove the task from the "yet another list" because do_exit() is now + * non-preemptible, allowing synchronize_rcu() to wait beyond this point. + */ void exit_tasks_rcu_finish(void) { - preempt_disable(); - __srcu_read_unlock(&tasks_rcu_exit_srcu, current->rcu_tasks_idx); - preempt_enable(); + unsigned long flags; + struct task_struct *t = current; + + WARN_ON_ONCE(list_empty(&t->rcu_tasks_exit_list)); + raw_spin_lock_irqsave(&rtp_exit_list_lock, flags); + list_del_init(&t->rcu_tasks_exit_list); + raw_spin_unlock_irqrestore(&rtp_exit_list_lock, flags); + put_task_struct(t); } #endif /* #ifdef CONFIG_TASKS_RCU */ -- 2.34.1

2 1

[PATCH OLK-5.10] net/sched: act_mirred: use the backlog for mirred ingress
by Zhengchao Shao 11 Apr '24

11 Apr '24

From: Jakub Kicinski <kuba(a)kernel.org> mainline inclusion from mainline-v6.8-rc6 commit 52f671db18823089a02f07efc04efdb2272ddc17 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LT CVE: CVE-2024-26740 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The test Davide added in commit ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress") hangs our testing VMs every 10 or so runs, with the familiar tcp_v4_rcv -> tcp_v4_rcv deadlock reported by lockdep. The problem as previously described by Davide (see Link) is that if we reverse flow of traffic with the redirect (egress -> ingress) we may reach the same socket which generated the packet. And we may still be holding its socket lock. The common solution to such deadlocks is to put the packet in the Rx backlog, rather than run the Rx path inline. Do that for all egress -> ingress reversals, not just once we started to nest mirred calls. In the past there was a concern that the backlog indirection will lead to loss of error reporting / less accurate stats. But the current workaround does not seem to address the issue. Fixes: 53592b364001 ("net/sched: act_mirred: Implement ingress actions") Cc: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Suggested-by: Davide Caratti <dcaratti(a)redhat.com> Link: https://lore.kernel.org/netdev/33dc43f587ec1388ba456b4915c75f02a8aae226.166… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/sched/act_mirred.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/act_mirred.c | 14 +++++--------- .../testing/selftests/net/forwarding/tc_actions.sh | 3 --- 2 files changed, 5 insertions(+), 12 deletions(-) diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c index 91a19460cb57..66c9f356a876 100644 --- a/net/sched/act_mirred.c +++ b/net/sched/act_mirred.c @@ -206,18 +206,14 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla, return err; } -static bool is_mirred_nested(void) -{ - return unlikely(__this_cpu_read(mirred_nest_level) > 1); -} - -static int tcf_mirred_forward(bool want_ingress, struct sk_buff *skb) +static int +tcf_mirred_forward(bool at_ingress, bool want_ingress, struct sk_buff *skb) { int err; if (!want_ingress) err = dev_queue_xmit(skb); - else if (is_mirred_nested()) + else if (!at_ingress) err = netif_rx(skb); else err = netif_receive_skb(skb); @@ -314,7 +310,7 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, /* let's the caller reinsert the packet, if possible */ if (use_reinsert) { res->ingress = want_ingress; - err = tcf_mirred_forward(res->ingress, skb); + err = tcf_mirred_forward(at_ingress, res->ingress, skb); if (err) tcf_action_inc_overlimit_qstats(&m->common); __this_cpu_dec(mirred_nest_level); @@ -322,7 +318,7 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, } } - err = tcf_mirred_forward(want_ingress, skb2); + err = tcf_mirred_forward(at_ingress, want_ingress, skb2); if (err) { out: tcf_action_inc_overlimit_qstats(&m->common); diff --git a/tools/testing/selftests/net/forwarding/tc_actions.sh b/tools/testing/selftests/net/forwarding/tc_actions.sh index e396e24d30e0..d6614faf9fe3 100755 --- a/tools/testing/selftests/net/forwarding/tc_actions.sh +++ b/tools/testing/selftests/net/forwarding/tc_actions.sh @@ -188,9 +188,6 @@ mirred_egress_to_ingress_tcp_test() check_err $? "didn't mirred redirect ICMP" tc_check_packets "dev $h1 ingress" 102 10 check_err $? "didn't drop mirred ICMP" - local overlimits=$(tc_rule_stats_get ${h1} 101 egress .overlimits) - test ${overlimits} = 10 - check_err $? "wrong overlimits, expected 10 got ${overlimits}" tc filter del dev $h1 egress protocol ip pref 100 handle 100 flower tc filter del dev $h1 egress protocol ip pref 101 handle 101 flower -- 2.34.1

2 1

[PATCH] net/sched: act_mirred: use the backlog for mirred ingress
by Zhengchao Shao 11 Apr '24

11 Apr '24

From: Jakub Kicinski <kuba(a)kernel.org> mainline inclusion from mainline-v6.8-rc6 commit 52f671db18823089a02f07efc04efdb2272ddc17 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LT CVE: CVE-2024-26740 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The test Davide added in commit ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress") hangs our testing VMs every 10 or so runs, with the familiar tcp_v4_rcv -> tcp_v4_rcv deadlock reported by lockdep. The problem as previously described by Davide (see Link) is that if we reverse flow of traffic with the redirect (egress -> ingress) we may reach the same socket which generated the packet. And we may still be holding its socket lock. The common solution to such deadlocks is to put the packet in the Rx backlog, rather than run the Rx path inline. Do that for all egress -> ingress reversals, not just once we started to nest mirred calls. In the past there was a concern that the backlog indirection will lead to loss of error reporting / less accurate stats. But the current workaround does not seem to address the issue. Fixes: 53592b364001 ("net/sched: act_mirred: Implement ingress actions") Cc: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Suggested-by: Davide Caratti <dcaratti(a)redhat.com> Link: https://lore.kernel.org/netdev/33dc43f587ec1388ba456b4915c75f02a8aae226.166… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/sched/act_mirred.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/act_mirred.c | 15 ++++++--------- .../selftests/net/forwarding/tc_actions.sh | 3 --- 2 files changed, 6 insertions(+), 12 deletions(-) diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c index febf06b8bbdf..336db2c938b5 100644 --- a/net/sched/act_mirred.c +++ b/net/sched/act_mirred.c @@ -197,18 +197,14 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla, return ret; } -static bool is_mirred_nested(void) -{ - return unlikely(__this_cpu_read(mirred_rec_level) > 1); -} - -static int tcf_mirred_forward(bool want_ingress, struct sk_buff *skb) +static int +tcf_mirred_forward(bool at_ingress, bool want_ingress, struct sk_buff *skb) { int err; if (!want_ingress) err = dev_queue_xmit(skb); - else if (is_mirred_nested()) + else if (!at_ingress) err = netif_rx(skb); else err = netif_receive_skb(skb); @@ -300,14 +296,15 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, if (use_reinsert) { res->ingress = want_ingress; res->qstats = this_cpu_ptr(m->common.cpu_qstats); - if (tcf_mirred_forward(want_ingress, skb) && res->qstats) + if (tcf_mirred_forward(skb_at_tc_ingress(skb), want_ingress, skb) + && res->qstats) qstats_overlimit_inc(res->qstats); __this_cpu_dec(mirred_rec_level); return TC_ACT_CONSUMED; } } - err = tcf_mirred_forward(want_ingress, skb2); + err = tcf_mirred_forward(skb_at_tc_ingress(skb), want_ingress, skb2); if (err) { out: qstats_overlimit_inc(this_cpu_ptr(m->common.cpu_qstats)); diff --git a/tools/testing/selftests/net/forwarding/tc_actions.sh b/tools/testing/selftests/net/forwarding/tc_actions.sh index aaa1ea10ac83..221a023ee5d6 100755 --- a/tools/testing/selftests/net/forwarding/tc_actions.sh +++ b/tools/testing/selftests/net/forwarding/tc_actions.sh @@ -183,9 +183,6 @@ mirred_egress_to_ingress_tcp_test() check_err $? "didn't mirred redirect ICMP" tc_check_packets "dev $h1 ingress" 102 10 check_err $? "didn't drop mirred ICMP" - local overlimits=$(tc_rule_stats_get ${h1} 101 egress .overlimits) - test ${overlimits} = 10 - check_err $? "wrong overlimits, expected 10 got ${overlimits}" tc filter del dev $h1 egress protocol ip pref 100 handle 100 flower tc filter del dev $h1 egress protocol ip pref 101 handle 101 flower -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] net/sched: act_mirred: use the backlog for mirred ingress
by Zhengchao Shao 11 Apr '24

11 Apr '24

From: Jakub Kicinski <kuba(a)kernel.org> mainline inclusion from mainline-v6.8-rc6 commit 52f671db18823089a02f07efc04efdb2272ddc17 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LT CVE: CVE-2024-26740 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The test Davide added in commit ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress") hangs our testing VMs every 10 or so runs, with the familiar tcp_v4_rcv -> tcp_v4_rcv deadlock reported by lockdep. The problem as previously described by Davide (see Link) is that if we reverse flow of traffic with the redirect (egress -> ingress) we may reach the same socket which generated the packet. And we may still be holding its socket lock. The common solution to such deadlocks is to put the packet in the Rx backlog, rather than run the Rx path inline. Do that for all egress -> ingress reversals, not just once we started to nest mirred calls. In the past there was a concern that the backlog indirection will lead to loss of error reporting / less accurate stats. But the current workaround does not seem to address the issue. Fixes: 53592b364001 ("net/sched: act_mirred: Implement ingress actions") Cc: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Suggested-by: Davide Caratti <dcaratti(a)redhat.com> Link: https://lore.kernel.org/netdev/33dc43f587ec1388ba456b4915c75f02a8aae226.166… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/sched/act_mirred.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/act_mirred.c | 15 ++++++--------- .../selftests/net/forwarding/tc_actions.sh | 3 --- 2 files changed, 6 insertions(+), 12 deletions(-) diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c index febf06b8bbdf..336db2c938b5 100644 --- a/net/sched/act_mirred.c +++ b/net/sched/act_mirred.c @@ -197,18 +197,14 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla, return ret; } -static bool is_mirred_nested(void) -{ - return unlikely(__this_cpu_read(mirred_rec_level) > 1); -} - -static int tcf_mirred_forward(bool want_ingress, struct sk_buff *skb) +static int +tcf_mirred_forward(bool at_ingress, bool want_ingress, struct sk_buff *skb) { int err; if (!want_ingress) err = dev_queue_xmit(skb); - else if (is_mirred_nested()) + else if (!at_ingress) err = netif_rx(skb); else err = netif_receive_skb(skb); @@ -300,14 +296,15 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, if (use_reinsert) { res->ingress = want_ingress; res->qstats = this_cpu_ptr(m->common.cpu_qstats); - if (tcf_mirred_forward(want_ingress, skb) && res->qstats) + if (tcf_mirred_forward(skb_at_tc_ingress(skb), want_ingress, skb) + && res->qstats) qstats_overlimit_inc(res->qstats); __this_cpu_dec(mirred_rec_level); return TC_ACT_CONSUMED; } } - err = tcf_mirred_forward(want_ingress, skb2); + err = tcf_mirred_forward(skb_at_tc_ingress(skb), want_ingress, skb2); if (err) { out: qstats_overlimit_inc(this_cpu_ptr(m->common.cpu_qstats)); diff --git a/tools/testing/selftests/net/forwarding/tc_actions.sh b/tools/testing/selftests/net/forwarding/tc_actions.sh index aaa1ea10ac83..221a023ee5d6 100755 --- a/tools/testing/selftests/net/forwarding/tc_actions.sh +++ b/tools/testing/selftests/net/forwarding/tc_actions.sh @@ -183,9 +183,6 @@ mirred_egress_to_ingress_tcp_test() check_err $? "didn't mirred redirect ICMP" tc_check_packets "dev $h1 ingress" 102 10 check_err $? "didn't drop mirred ICMP" - local overlimits=$(tc_rule_stats_get ${h1} 101 egress .overlimits) - test ${overlimits} = 10 - check_err $? "wrong overlimits, expected 10 got ${overlimits}" tc filter del dev $h1 egress protocol ip pref 100 handle 100 flower tc filter del dev $h1 egress protocol ip pref 101 handle 101 flower -- 2.34.1

2 1

[PATCH OLK-5.10 v2] IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
by Liu Jian 11 Apr '24

11 Apr '24

From: Daniel Vacek <neelx(a)redhat.com> stable inclusion from stable-v5.10.211 commit 3f38d22e645e2e994979426ea5a35186102ff3c2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2Y3 CVE: CVE-2024-26766 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- commit e6f57c6881916df39db7d95981a8ad2b9c3458d6 upstream. Unfortunately the commit `fd8958efe877` introduced another error causing the `descs` array to overflow. This reults in further crashes easily reproducible by `sendmsg` system call. [ 1080.836473] general protection fault, probably for non-canonical address 0x400300015528b00a: 0000 [#1] PREEMPT SMP PTI [ 1080.869326] RIP: 0010:hfi1_ipoib_build_ib_tx_headers.constprop.0+0xe1/0x2b0 [hfi1] ... [ 1080.974535] Call Trace: [ 1080.976990] <TASK> [ 1081.021929] hfi1_ipoib_send_dma_common+0x7a/0x2e0 [hfi1] [ 1081.027364] hfi1_ipoib_send_dma_list+0x62/0x270 [hfi1] [ 1081.032633] hfi1_ipoib_send+0x112/0x300 [hfi1] [ 1081.042001] ipoib_start_xmit+0x2a9/0x2d0 [ib_ipoib] [ 1081.046978] dev_hard_start_xmit+0xc4/0x210 ... [ 1081.148347] __sys_sendmsg+0x59/0xa0 crash> ipoib_txreq 0xffff9cfeba229f00 struct ipoib_txreq { txreq = { list = { next = 0xffff9cfeba229f00, prev = 0xffff9cfeba229f00 }, descp = 0xffff9cfeba229f40, coalesce_buf = 0x0, wait = 0xffff9cfea4e69a48, complete = 0xffffffffc0fe0760 <hfi1_ipoib_sdma_complete>, packet_len = 0x46d, tlen = 0x0, num_desc = 0x0, desc_limit = 0x6, next_descq_idx = 0x45c, coalesce_idx = 0x0, flags = 0x0, descs = {{ qw = {0x8024000120dffb00, 0x4} # SDMA_DESC0_FIRST_DESC_FLAG (bit 63) }, { qw = { 0x3800014231b108, 0x4} }, { qw = { 0x310000e4ee0fcf0, 0x8} }, { qw = { 0x3000012e9f8000, 0x8} }, { qw = { 0x59000dfb9d0000, 0x8} }, { qw = { 0x78000e02e40000, 0x8} }} }, sdma_hdr = 0x400300015528b000, <<< invalid pointer in the tx request structure sdma_status = 0x0, SDMA_DESC0_LAST_DESC_FLAG (bit 62) complete = 0x0, priv = 0x0, txq = 0xffff9cfea4e69880, skb = 0xffff9d099809f400 } If an SDMA send consists of exactly 6 descriptors and requires dword padding (in the 7th descriptor), the sdma_txreq descriptor array is not properly expanded and the packet will overflow into the container structure. This results in a panic when the send completion runs. The exact panic varies depending on what elements of the container structure get corrupted. The fix is to use the correct expression in _pad_sdma_tx_descs() to test the need to expand the descriptor array. With this patch the crashes are no longer reproducible and the machine is stable. Fixes: fd8958efe877 ("IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors") Cc: stable(a)vger.kernel.org Reported-by: Mats Kronberg <kronberg(a)nsc.liu.se> Tested-by: Mats Kronberg <kronberg(a)nsc.liu.se> Signed-off-by: Daniel Vacek <neelx(a)redhat.com> Link: https://lore.kernel.org/r/20240201081009.1109442-1-neelx@redhat.com Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [Change commit log: "--" to "...". Otherwise openuler mail2pr ci-robot won't work.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- v1->v2: change commit log. drivers/infiniband/hw/hfi1/sdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c index 2dc97de434a5..68a8557e9a7c 100644 --- a/drivers/infiniband/hw/hfi1/sdma.c +++ b/drivers/infiniband/hw/hfi1/sdma.c @@ -3200,7 +3200,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) { int rval = 0; - if ((unlikely(tx->num_desc + 1 == tx->desc_limit))) { + if ((unlikely(tx->num_desc == tx->desc_limit))) { rval = _extend_sdma_tx_descs(dd, tx); if (rval) { __sdma_txclean(dd, tx); -- 2.34.1

2 1

[PATCH OLK-5.10] [Backport] drm/amdgpu: fix use-after-free bug
by Zhenzeng Su 11 Apr '24

11 Apr '24

From: Vitaly Prosyak <vitaly.prosyak(a)amd.com> mainline inclusion from mainline-v6.9-rc1 commit 22207fd5c80177b860279653d017474b2812af5e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DO1Z CVE: CVE-2024-26656 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an invalid address and size. The bug was reported by Joonkyo Jung <joonkyoj(a)yonsei.ac.kr>. For example the following code: static void Syzkaller1(int fd) { struct drm_amdgpu_gem_userptr arg; int ret; arg.addr = 0xffffffffffff0000; arg.size = 0x80000000; /*2 Gb*/ arg.flags = 0x7; ret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, &arg); } Due to the address and size are not valid there is a failure in amdgpu_mn_register->mmu_interval_notifier_insert->__mmu_interval_notifier_insert-> check_shl_overflow, but we even the amdgpu_mn_register failure we still call amdgpu_mn_unregister into amdgpu_gem_object_free which causes access to a bad address. The following stack is below when the issue is reproduced when Kazan is enabled: [ +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340 [ +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff <0f> 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80 [ +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246 [ +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b [ +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260 [ +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25 [ +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00 [ +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260 [ +0.000011] FS: 00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000 [ +0.000012] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0 [ +0.000010] Call Trace: [ +0.000006] <TASK> [ +0.000007] ? show_regs+0x6a/0x80 [ +0.000018] ? __warn+0xa5/0x1b0 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000018] ? report_bug+0x24a/0x290 [ +0.000022] ? handle_bug+0x46/0x90 [ +0.000015] ? exc_invalid_op+0x19/0x50 [ +0.000016] ? asm_exc_invalid_op+0x1b/0x20 [ +0.000017] ? kasan_save_stack+0x26/0x50 [ +0.000017] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000020] ? __pfx_mmu_interval_notifier_remove+0x10/0x10 [ +0.000017] ? kasan_save_alloc_info+0x1e/0x30 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __kasan_kmalloc+0xb1/0xc0 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_read+0x11/0x20 [ +0.000020] amdgpu_mn_unregister+0x34/0x50 [amdgpu] [ +0.004695] amdgpu_gem_object_free+0x66/0xa0 [amdgpu] [ +0.004534] ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu] [ +0.004291] ? do_syscall_64+0x5f/0xe0 [ +0.000023] ? srso_return_thunk+0x5/0x5f [ +0.000017] drm_gem_object_free+0x3b/0x50 [drm] [ +0.000489] amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu] [ +0.004295] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004270] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __this_cpu_preempt_check+0x13/0x20 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? sysvec_apic_timer_interrupt+0x57/0xc0 [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ +0.000022] ? drm_ioctl_kernel+0x17b/0x1f0 [drm] [ +0.000496] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004272] ? drm_ioctl_kernel+0x190/0x1f0 [drm] [ +0.000492] drm_ioctl_kernel+0x140/0x1f0 [drm] [ +0.000497] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004297] ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm] [ +0.000489] ? srso_return_thunk+0x5/0x5f [ +0.000011] ? __kasan_check_write+0x14/0x20 [ +0.000016] drm_ioctl+0x3da/0x730 [drm] [ +0.000475] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004293] ? __pfx_drm_ioctl+0x10/0x10 [drm] [ +0.000506] ? __pfx_rpm_resume+0x10/0x10 [ +0.000016] ? srso_return_thunk+0x5/0x5f [ +0.000011] ? __kasan_check_write+0x14/0x20 [ +0.000010] ? srso_return_thunk+0x5/0x5f [ +0.000011] ? _raw_spin_lock_irqsave+0x99/0x100 [ +0.000015] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ +0.000014] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? srso_return_thunk+0x5/0x5f [ +0.000011] ? srso_return_thunk+0x5/0x5f [ +0.000011] ? preempt_count_sub+0x18/0xc0 [ +0.000013] ? srso_return_thunk+0x5/0x5f [ +0.000010] ? _raw_spin_unlock_irqrestore+0x27/0x50 [ +0.000019] amdgpu_drm_ioctl+0x7e/0xe0 [amdgpu] [ +0.004272] __x64_sys_ioctl+0xcd/0x110 [ +0.000020] do_syscall_64+0x5f/0xe0 [ +0.000021] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ +0.000015] RIP: 0033:0x7ff9ed31a94f [ +0.000012] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 77 1f 48 8b 44 24 18 64 48 2b 04 25 28 00 [ +0.000013] RSP: 002b:00007fff25f66790 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ +0.000016] RAX: ffffffffffffffda RBX: 000055b3f7e133e0 RCX: 00007ff9ed31a94f [ +0.000012] RDX: 000055b3f7e133e0 RSI: 00000000c1186451 RDI: 0000000000000003 [ +0.000010] RBP: 00000000c1186451 R08: 0000000000000000 R09: 0000000000000000 [ +0.000009] R10: 0000000000000008 R11: 0000000000000246 R12: 00007fff25f66ca8 [ +0.000009] R13: 0000000000000003 R14: 000055b3f7021ba8 R15: 00007ff9ed7af040 [ +0.000024] </TASK> [ +0.000007] ---[ end trace 0000000000000000 ]--- v2: Consolidate any error handling into amdgpu_mn_register which applied to kfd_bo also. (Christian) v3: Improve syntax and comment (Christian) Cc: Christian Koenig <christian.koenig(a)amd.com> Cc: Alex Deucher <alexander.deucher(a)amd.com> Cc: Felix Kuehling <felix.kuehling(a)amd.com> Cc: Joonkyo Jung <joonkyoj(a)yonsei.ac.kr> Cc: Dokyung Song <dokyungs(a)yonsei.ac.kr> Cc: <jisoo.jang(a)yonsei.ac.kr> Cc: <yw9865(a)yonsei.ac.kr> Signed-off-by: Vitaly Prosyak <vitaly.prosyak(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c index 828b5167ff12..57ee0b7af9d2 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c @@ -132,13 +132,25 @@ static const struct mmu_interval_notifier_ops amdgpu_mn_hsa_ops = { */ int amdgpu_mn_register(struct amdgpu_bo *bo, unsigned long addr) { + int r; + if (bo->kfd_bo) - return mmu_interval_notifier_insert(&bo->notifier, current->mm, + r = mmu_interval_notifier_insert(&bo->notifier, current->mm, addr, amdgpu_bo_size(bo), &amdgpu_mn_hsa_ops); - return mmu_interval_notifier_insert(&bo->notifier, current->mm, addr, - amdgpu_bo_size(bo), - &amdgpu_mn_gfx_ops); + else + r = mmu_interval_notifier_insert(&bo->notifier, current->mm, addr, + amdgpu_bo_size(bo), + &amdgpu_mn_gfx_ops); + if (r) + /* + * Make sure amdgpu_mn_unregister() doesn't call + * mmu_interval_notifier_remove() when the notifier isn't properly + * initialized. + */ + bo->notifier.mm = NULL; + + return r; } /** -- 2.25.1

2 1

[PATCH OLK-5.10] btrfs: don't drop extent_map for free space inode on write error
by Zizhi Wo 11 Apr '24

11 Apr '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v6.1.79 commit 02f2b95b00bf57d20320ee168b30fb7f3db8e555 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2F7 CVE: CVE-2024-26726 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5571e41ec6e56e35f34ae9f5b3a335ef510e0ade upstream. While running the CI for an unrelated change I hit the following panic with generic/648 on btrfs_holes_spacecache. assertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385 ------------[ cut here ]------------ kernel BUG at fs/btrfs/extent_io.c:1385! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G W 6.8.0-rc2+ #1 RIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0 Call Trace: <TASK> extent_write_cache_pages+0x2ac/0x8f0 extent_writepages+0x87/0x110 do_writepages+0xd5/0x1f0 filemap_fdatawrite_wbc+0x63/0x90 __filemap_fdatawrite_range+0x5c/0x80 btrfs_fdatawrite_range+0x1f/0x50 btrfs_write_out_cache+0x507/0x560 btrfs_write_dirty_block_groups+0x32a/0x420 commit_cowonly_roots+0x21b/0x290 btrfs_commit_transaction+0x813/0x1360 btrfs_sync_file+0x51a/0x640 __x64_sys_fdatasync+0x52/0x90 do_syscall_64+0x9c/0x190 entry_SYSCALL_64_after_hwframe+0x6e/0x76 This happens because we fail to write out the free space cache in one instance, come back around and attempt to write it again. However on the second pass through we go to call btrfs_get_extent() on the inode to get the extent mapping. Because this is a new block group, and with the free space inode we always search the commit root to avoid deadlocking with the tree, we find nothing and return a EXTENT_MAP_HOLE for the requested range. This happens because the first time we try to write the space cache out we hit an error, and on an error we drop the extent mapping. This is normal for normal files, but the free space cache inode is special. We always expect the extent map to be correct. Thus the second time through we end up with a bogus extent map. Since we're deprecating this feature, the most straightforward way to fix this is to simply skip dropping the extent map range for this failed range. I shortened the test by using error injection to stress the area to make it easier to reproduce. With this patch in place we no longer panic with my error injection test. CC: stable(a)vger.kernel.org # 4.14+ Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/btrfs/inode.c Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/btrfs/inode.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index b12fc82e34ba..03670d4cd6ed 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -2775,8 +2775,22 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent) unwritten_start += logical_len; clear_extent_uptodate(io_tree, unwritten_start, end, NULL); - /* Drop the cache for the part of the extent we didn't write. */ - btrfs_drop_extent_cache(BTRFS_I(inode), unwritten_start, end, 0); + /* + * Drop extent maps for the part of the extent we didn't write. + * + * We have an exception here for the free_space_inode, this is + * because when we do btrfs_get_extent() on the free space inode + * we will search the commit root. If this is a new block group + * we won't find anything, and we will trip over the assert in + * writepage where we do ASSERT(em->block_start != + * EXTENT_MAP_HOLE). + * + * Theoretically we could also skip this for any NOCOW extent as + * we don't mess with the extent map tree in the NOCOW case, but + * for now simply skip this if we are the free space inode. + */ + if (!btrfs_is_free_space_inode(BTRFS_I(inode))) + btrfs_drop_extent_cache(BTRFS_I(inode), unwritten_start, end, 0); /* * If the ordered extent had an IOERR or something else went -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] btrfs: don't drop extent_map for free space inode on write error
by Zizhi Wo 11 Apr '24

11 Apr '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v6.1.79 commit 02f2b95b00bf57d20320ee168b30fb7f3db8e555 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2F7 CVE: CVE-2024-26726 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5571e41ec6e56e35f34ae9f5b3a335ef510e0ade upstream. While running the CI for an unrelated change I hit the following panic with generic/648 on btrfs_holes_spacecache. assertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385 ------------[ cut here ]------------ kernel BUG at fs/btrfs/extent_io.c:1385! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G W 6.8.0-rc2+ #1 RIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0 Call Trace: <TASK> extent_write_cache_pages+0x2ac/0x8f0 extent_writepages+0x87/0x110 do_writepages+0xd5/0x1f0 filemap_fdatawrite_wbc+0x63/0x90 __filemap_fdatawrite_range+0x5c/0x80 btrfs_fdatawrite_range+0x1f/0x50 btrfs_write_out_cache+0x507/0x560 btrfs_write_dirty_block_groups+0x32a/0x420 commit_cowonly_roots+0x21b/0x290 btrfs_commit_transaction+0x813/0x1360 btrfs_sync_file+0x51a/0x640 __x64_sys_fdatasync+0x52/0x90 do_syscall_64+0x9c/0x190 entry_SYSCALL_64_after_hwframe+0x6e/0x76 This happens because we fail to write out the free space cache in one instance, come back around and attempt to write it again. However on the second pass through we go to call btrfs_get_extent() on the inode to get the extent mapping. Because this is a new block group, and with the free space inode we always search the commit root to avoid deadlocking with the tree, we find nothing and return a EXTENT_MAP_HOLE for the requested range. This happens because the first time we try to write the space cache out we hit an error, and on an error we drop the extent mapping. This is normal for normal files, but the free space cache inode is special. We always expect the extent map to be correct. Thus the second time through we end up with a bogus extent map. Since we're deprecating this feature, the most straightforward way to fix this is to simply skip dropping the extent map range for this failed range. I shortened the test by using error injection to stress the area to make it easier to reproduce. With this patch in place we no longer panic with my error injection test. CC: stable(a)vger.kernel.org # 4.14+ Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/btrfs/inode.c Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/btrfs/inode.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 51a119ac91cd..676cce61cad9 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -3145,8 +3145,22 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent) end = ordered_extent->file_offset + ordered_extent->len - 1; clear_extent_uptodate(io_tree, start, end, NULL); - /* Drop the cache for the part of the extent we didn't write. */ - btrfs_drop_extent_cache(BTRFS_I(inode), start, end, 0); + /* + * Drop extent maps for the part of the extent we didn't write. + * + * We have an exception here for the free_space_inode, this is + * because when we do btrfs_get_extent() on the free space inode + * we will search the commit root. If this is a new block group + * we won't find anything, and we will trip over the assert in + * writepage where we do ASSERT(em->block_start != + * EXTENT_MAP_HOLE). + * + * Theoretically we could also skip this for any NOCOW extent as + * we don't mess with the extent map tree in the NOCOW case, but + * for now simply skip this if we are the free space inode. + */ + if (!btrfs_is_free_space_inode(BTRFS_I(inode))) + btrfs_drop_extent_cache(BTRFS_I(inode), start, end, 0); /* * If the ordered extent had an IOERR or something else went -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] PM / devfreq: Synchronize devfreq_monitor_[start/stop]
by Yi Yang 11 Apr '24

11 Apr '24

From: Mukesh Ojha <quic_mojha(a)quicinc.com> mainline inclusion from mainline-v6.8-rc1 commit aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNGK CVE: CVE-2023-52635 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a chance if a frequent switch of the governor done in a loop result in timer list corruption where timer cancel being done from two place one from cancel_delayed_work_sync() and followed by expire_timers() can be seen from the traces[1]. while true do echo "simple_ondemand" > /sys/class/devfreq/1d84000.ufshc/governor echo "performance" > /sys/class/devfreq/1d84000.ufshc/governor done It looks to be issue with devfreq driver where device_monitor_[start/stop] need to synchronized so that delayed work should get corrupted while it is either being queued or running or being cancelled. Let's use polling flag and devfreq lock to synchronize the queueing the timer instance twice and work data being corrupted. [1] ... .. <idle>-0 [003] 9436.209662: timer_cancel timer=0xffffff80444f0428 <idle>-0 [003] 9436.209664: timer_expire_entry timer=0xffffff80444f0428 now=0x10022da1c function=__typeid__ZTSFvP10timer_listE_global_addr baseclk=0x10022da1c <idle>-0 [003] 9436.209718: timer_expire_exit timer=0xffffff80444f0428 kworker/u16:6-14217 [003] 9436.209863: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2b now=0x10022da1c flags=182452227 vendor.xxxyyy.ha-1593 [004] 9436.209888: timer_cancel timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216390: timer_init timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216392: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2c now=0x10022da1d flags=186646532 vendor.xxxyyy.ha-1593 [005] 9436.220992: timer_cancel timer=0xffffff80444f0428 xxxyyyTraceManag-7795 [004] 9436.261641: timer_cancel timer=0xffffff80444f0428 [2] 9436.261653][ C4] Unable to handle kernel paging request at virtual address dead00000000012a [ 9436.261664][ C4] Mem abort info: [ 9436.261666][ C4] ESR = 0x96000044 [ 9436.261669][ C4] EC = 0x25: DABT (current EL), IL = 32 bits [ 9436.261671][ C4] SET = 0, FnV = 0 [ 9436.261673][ C4] EA = 0, S1PTW = 0 [ 9436.261675][ C4] Data abort info: [ 9436.261677][ C4] ISV = 0, ISS = 0x00000044 [ 9436.261680][ C4] CM = 0, WnR = 1 [ 9436.261682][ C4] [dead00000000012a] address between user and kernel address ranges [ 9436.261685][ C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP [ 9436.261701][ C4] Skip md ftrace buffer dump for: 0x3a982d0 ... [ 9436.262138][ C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S W O 5.10.149-android12-9-o-g17f915d29d0c #1 [ 9436.262141][ C4] Hardware name: Qualcomm Technologies, Inc. (DT) [ 9436.262144][ C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--) [ 9436.262161][ C4] pc : expire_timers+0x9c/0x438 [ 9436.262164][ C4] lr : expire_timers+0x2a4/0x438 [ 9436.262168][ C4] sp : ffffffc010023dd0 [ 9436.262171][ C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18 [ 9436.262178][ C4] x27: ffffffd063569dd0 x26: ffffffd063536008 [ 9436.262182][ C4] x25: 0000000000000001 x24: ffffff88f7c69280 [ 9436.262185][ C4] x23: 00000000000000e0 x22: dead000000000122 [ 9436.262188][ C4] x21: 000000010022da29 x20: ffffff8af72b4e80 [ 9436.262191][ C4] x19: ffffffc010023e50 x18: ffffffc010025038 [ 9436.262195][ C4] x17: 0000000000000240 x16: 0000000000000201 [ 9436.262199][ C4] x15: ffffffffffffffff x14: ffffff889f3c3100 [ 9436.262203][ C4] x13: ffffff889f3c3100 x12: 00000000049f56b8 [ 9436.262207][ C4] x11: 00000000049f56b8 x10: 00000000ffffffff [ 9436.262212][ C4] x9 : ffffffc010023e50 x8 : dead000000000122 [ 9436.262216][ C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8 [ 9436.262220][ C4] x5 : 0000000000000000 x4 : 0000000000000101 [ 9436.262223][ C4] x3 : 0000000000000080 x2 : ffffff889edc155c [ 9436.262227][ C4] x1 : ffffff8001005200 x0 : ffffff80444f0428 [ 9436.262232][ C4] Call trace: [ 9436.262236][ C4] expire_timers+0x9c/0x438 [ 9436.262240][ C4] __run_timers+0x1f0/0x330 [ 9436.262245][ C4] run_timer_softirq+0x28/0x58 [ 9436.262255][ C4] efi_header_end+0x168/0x5ec [ 9436.262265][ C4] __irq_exit_rcu+0x108/0x124 [ 9436.262274][ C4] __handle_domain_irq+0x118/0x1e4 [ 9436.262282][ C4] gic_handle_irq.30369+0x6c/0x2bc [ 9436.262286][ C4] el0_irq_naked+0x60/0x6c Link: https://lore.kernel.org/all/1700860318-4025-1-git-send-email-quic_mojha@qui… Reported-by: Joyyoung Huang <huangzaiyang(a)oppo.com> Acked-by: MyungJoo Ham <myungjoo.ham(a)samsung.com> Signed-off-by: Mukesh Ojha <quic_mojha(a)quicinc.com> Signed-off-by: Chanwoo Choi <cw00.choi(a)samsung.com> conflicts: drivers/devfreq/devfreq.c Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/devfreq/devfreq.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c index 1229bfb3180e..57589022d45e 100644 --- a/drivers/devfreq/devfreq.c +++ b/drivers/devfreq/devfreq.c @@ -381,8 +381,13 @@ static void devfreq_monitor(struct work_struct *work) if (err) dev_err(&devfreq->dev, "dvfs failed with (%d) error\n", err); + if (devfreq->stop_polling) + goto out; + queue_delayed_work(devfreq_wq, &devfreq->work, msecs_to_jiffies(devfreq->profile->polling_ms)); + +out: mutex_unlock(&devfreq->lock); } @@ -397,10 +402,18 @@ static void devfreq_monitor(struct work_struct *work) */ void devfreq_monitor_start(struct devfreq *devfreq) { + mutex_lock(&devfreq->lock); + if (delayed_work_pending(&devfreq->work)) + goto out; + INIT_DEFERRABLE_WORK(&devfreq->work, devfreq_monitor); if (devfreq->profile->polling_ms) queue_delayed_work(devfreq_wq, &devfreq->work, msecs_to_jiffies(devfreq->profile->polling_ms)); + +out: + devfreq->stop_polling = false; + mutex_unlock(&devfreq->lock); } EXPORT_SYMBOL(devfreq_monitor_start); @@ -414,6 +427,14 @@ EXPORT_SYMBOL(devfreq_monitor_start); */ void devfreq_monitor_stop(struct devfreq *devfreq) { + mutex_lock(&devfreq->lock); + if (devfreq->stop_polling) { + mutex_unlock(&devfreq->lock); + return; + } + + devfreq->stop_polling = true; + mutex_unlock(&devfreq->lock); cancel_delayed_work_sync(&devfreq->work); } EXPORT_SYMBOL(devfreq_monitor_stop); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net/sched: act_mirred: use the backlog for mirred ingress
by Zhengchao Shao 11 Apr '24

11 Apr '24

From: Jakub Kicinski <kuba(a)kernel.org> mainline inclusion from mainline-v6.8-rc6 commit 52f671db18823089a02f07efc04efdb2272ddc17 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LT CVE: CVE-2024-26740 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The test Davide added in commit ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress") hangs our testing VMs every 10 or so runs, with the familiar tcp_v4_rcv -> tcp_v4_rcv deadlock reported by lockdep. The problem as previously described by Davide (see Link) is that if we reverse flow of traffic with the redirect (egress -> ingress) we may reach the same socket which generated the packet. And we may still be holding its socket lock. The common solution to such deadlocks is to put the packet in the Rx backlog, rather than run the Rx path inline. Do that for all egress -> ingress reversals, not just once we started to nest mirred calls. In the past there was a concern that the backlog indirection will lead to loss of error reporting / less accurate stats. But the current workaround does not seem to address the issue. Fixes: 53592b364001 ("net/sched: act_mirred: Implement ingress actions") Cc: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Suggested-by: Davide Caratti <dcaratti(a)redhat.com> Link: https://lore.kernel.org/netdev/33dc43f587ec1388ba456b4915c75f02a8aae226.166… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/sched/act_mirred.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/act_mirred.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c index febf06b8bbdf..336db2c938b5 100644 --- a/net/sched/act_mirred.c +++ b/net/sched/act_mirred.c @@ -197,18 +197,14 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla, return ret; } -static bool is_mirred_nested(void) -{ - return unlikely(__this_cpu_read(mirred_rec_level) > 1); -} - -static int tcf_mirred_forward(bool want_ingress, struct sk_buff *skb) +static int +tcf_mirred_forward(bool at_ingress, bool want_ingress, struct sk_buff *skb) { int err; if (!want_ingress) err = dev_queue_xmit(skb); - else if (is_mirred_nested()) + else if (!at_ingress) err = netif_rx(skb); else err = netif_receive_skb(skb); @@ -300,14 +296,15 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, if (use_reinsert) { res->ingress = want_ingress; res->qstats = this_cpu_ptr(m->common.cpu_qstats); - if (tcf_mirred_forward(want_ingress, skb) && res->qstats) + if (tcf_mirred_forward(skb_at_tc_ingress(skb), want_ingress, skb) + && res->qstats) qstats_overlimit_inc(res->qstats); __this_cpu_dec(mirred_rec_level); return TC_ACT_CONSUMED; } } - err = tcf_mirred_forward(want_ingress, skb2); + err = tcf_mirred_forward(skb_at_tc_ingress(skb), want_ingress, skb2); if (err) { out: qstats_overlimit_inc(this_cpu_ptr(m->common.cpu_qstats)); -- 2.34.1

2 1

[PATCH OLK-6.6] locking/osq_lock: Avoid false sharing in optimistic_spin_node
by liwei 11 Apr '24

11 Apr '24

From: Zeng Heng <zengheng4(a)huawei.com> hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/I8MV01 -------------------------------- Using the UnixBench test suite, we clearly find that osq_lock() cause extremely high overheads with perf tool in the File Copy items: Overhead Shared Object Symbol 94.25% [kernel] [k] osq_lock 0.74% [kernel] [k] rwsem_spin_on_owner 0.32% [kernel] [k] filemap_get_read_batch In response to this, we conducted an analysis and made some gains: In the prologue of osq_lock(), it set `cpu` member of percpu struct optimistic_spin_node with the local cpu id, after that the value of the percpu struct would never change in fact. Based on that, we can regard the `cpu` member as a constant variable. In the meanwhile, other members of the percpu struct like next, prev and locked are frequently modified by osq_lock() and osq_unlock() which are called by rwsem, mutex and so on. However, that would invalidate the cache of the cpu member on other CPUs. Therefore, we can place padding here and split them into different cache lines to avoid cache misses when the next CPU is spinning to check other node's cpu member by vcpu_is_preempted(). Here provide the UnixBench full-core test result as below: Machine Intel(R) Xeon(R) Gold 6248 CPU, 40 cores, 80 threads Run the command of "./Run -c 80 -i 3" 10 times and take the average. System Benchmarks Index Values Without Patch With Patch Diff Dhrystone 2 using register variables 185876.43 185945.41 0.04% Double-Precision Whetstone 79637.27 79659.29 0.03% Execl Throughput 9909.61 10576.06 6.73% File Copy 1024 bufsize 2000 maxblocks 1723.01 2086.08 21.07% File Copy 256 bufsize 500 maxblocks 1150.24 1338.21 16.34% File Copy 4096 bufsize 8000 maxblocks 3719.19 4011.99 7.87% Pipe Throughput 66184.84 66025.25 -0.24% Pipe-based Context Switching 30606.18 31074.21 1.53% Process Creation 9442.48 9450.77 0.09% Shell Scripts (1 concurrent) 44526.52 46548.54 4.54% Shell Scripts (8 concurrent) 42903.96 45718.56 6.56% System Call Overhead 3645.20 3717.42 1.98% ======== System Benchmarks Index Score 15126.87 15931.29 5.32% Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- include/linux/osq_lock.h | 2 +- kernel/locking/osq_lock.c | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/include/linux/osq_lock.h b/include/linux/osq_lock.h index 5581dbd3bd34..deb90ad5f560 100644 --- a/include/linux/osq_lock.h +++ b/include/linux/osq_lock.h @@ -9,7 +9,7 @@ struct optimistic_spin_node { struct optimistic_spin_node *next, *prev; int locked; /* 1 if lock acquired */ - int cpu; /* encoded CPU # + 1 value */ + int cpu ____cacheline_aligned; /* encoded CPU # + 1 value */ }; struct optimistic_spin_queue { diff --git a/kernel/locking/osq_lock.c b/kernel/locking/osq_lock.c index d5610ad52b92..17618d62343f 100644 --- a/kernel/locking/osq_lock.c +++ b/kernel/locking/osq_lock.c @@ -96,7 +96,13 @@ bool osq_lock(struct optimistic_spin_queue *lock) node->locked = 0; node->next = NULL; - node->cpu = curr; + /* + * After this cpu member is initialized for the first time, it + * would no longer change in fact. That could avoid cache misses + * when spin and access the cpu member by other CPUs. + */ + if (node->cpu != curr) + node->cpu = curr; /* * We need both ACQUIRE (pairs with corresponding RELEASE in -- 2.25.1

2 1

[PATCH OLK-5.10] IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
by Liu Jian 11 Apr '24

11 Apr '24

From: Daniel Vacek <neelx(a)redhat.com> stable inclusion from stable-v5.10.211 commit 3f38d22e645e2e994979426ea5a35186102ff3c2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2Y3 CVE: CVE-2024-26766 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- commit e6f57c6881916df39db7d95981a8ad2b9c3458d6 upstream. Unfortunately the commit `fd8958efe877` introduced another error causing the `descs` array to overflow. This reults in further crashes easily reproducible by `sendmsg` system call. [ 1080.836473] general protection fault, probably for non-canonical address 0x400300015528b00a: 0000 [#1] PREEMPT SMP PTI [ 1080.869326] RIP: 0010:hfi1_ipoib_build_ib_tx_headers.constprop.0+0xe1/0x2b0 [hfi1] -- [ 1080.974535] Call Trace: [ 1080.976990] <TASK> [ 1081.021929] hfi1_ipoib_send_dma_common+0x7a/0x2e0 [hfi1] [ 1081.027364] hfi1_ipoib_send_dma_list+0x62/0x270 [hfi1] [ 1081.032633] hfi1_ipoib_send+0x112/0x300 [hfi1] [ 1081.042001] ipoib_start_xmit+0x2a9/0x2d0 [ib_ipoib] [ 1081.046978] dev_hard_start_xmit+0xc4/0x210 -- [ 1081.148347] __sys_sendmsg+0x59/0xa0 crash> ipoib_txreq 0xffff9cfeba229f00 struct ipoib_txreq { txreq = { list = { next = 0xffff9cfeba229f00, prev = 0xffff9cfeba229f00 }, descp = 0xffff9cfeba229f40, coalesce_buf = 0x0, wait = 0xffff9cfea4e69a48, complete = 0xffffffffc0fe0760 <hfi1_ipoib_sdma_complete>, packet_len = 0x46d, tlen = 0x0, num_desc = 0x0, desc_limit = 0x6, next_descq_idx = 0x45c, coalesce_idx = 0x0, flags = 0x0, descs = {{ qw = {0x8024000120dffb00, 0x4} # SDMA_DESC0_FIRST_DESC_FLAG (bit 63) }, { qw = { 0x3800014231b108, 0x4} }, { qw = { 0x310000e4ee0fcf0, 0x8} }, { qw = { 0x3000012e9f8000, 0x8} }, { qw = { 0x59000dfb9d0000, 0x8} }, { qw = { 0x78000e02e40000, 0x8} }} }, sdma_hdr = 0x400300015528b000, <<< invalid pointer in the tx request structure sdma_status = 0x0, SDMA_DESC0_LAST_DESC_FLAG (bit 62) complete = 0x0, priv = 0x0, txq = 0xffff9cfea4e69880, skb = 0xffff9d099809f400 } If an SDMA send consists of exactly 6 descriptors and requires dword padding (in the 7th descriptor), the sdma_txreq descriptor array is not properly expanded and the packet will overflow into the container structure. This results in a panic when the send completion runs. The exact panic varies depending on what elements of the container structure get corrupted. The fix is to use the correct expression in _pad_sdma_tx_descs() to test the need to expand the descriptor array. With this patch the crashes are no longer reproducible and the machine is stable. Fixes: fd8958efe877 ("IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors") Cc: stable(a)vger.kernel.org Reported-by: Mats Kronberg <kronberg(a)nsc.liu.se> Tested-by: Mats Kronberg <kronberg(a)nsc.liu.se> Signed-off-by: Daniel Vacek <neelx(a)redhat.com> Link: https://lore.kernel.org/r/20240201081009.1109442-1-neelx@redhat.com Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/hw/hfi1/sdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c index 2dc97de434a5..68a8557e9a7c 100644 --- a/drivers/infiniband/hw/hfi1/sdma.c +++ b/drivers/infiniband/hw/hfi1/sdma.c @@ -3200,7 +3200,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) { int rval = 0; - if ((unlikely(tx->num_desc + 1 == tx->desc_limit))) { + if ((unlikely(tx->num_desc == tx->desc_limit))) { rval = _extend_sdma_tx_descs(dd, tx); if (rval) { __sdma_txclean(dd, tx); -- 2.34.1

2 1

[OLK-6.6] locking/osq_lock: Avoid false sharing in optimistic_spin_node
by liwei 11 Apr '24

11 Apr '24

From: Zeng Heng <zengheng4(a)huawei.com> hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/I8MV01 -------------------------------- Using the UnixBench test suite, we clearly find that osq_lock() cause extremely high overheads with perf tool in the File Copy items: Overhead Shared Object Symbol 94.25% [kernel] [k] osq_lock 0.74% [kernel] [k] rwsem_spin_on_owner 0.32% [kernel] [k] filemap_get_read_batch In response to this, we conducted an analysis and made some gains: In the prologue of osq_lock(), it set `cpu` member of percpu struct optimistic_spin_node with the local cpu id, after that the value of the percpu struct would never change in fact. Based on that, we can regard the `cpu` member as a constant variable. In the meanwhile, other members of the percpu struct like next, prev and locked are frequently modified by osq_lock() and osq_unlock() which are called by rwsem, mutex and so on. However, that would invalidate the cache of the cpu member on other CPUs. Therefore, we can place padding here and split them into different cache lines to avoid cache misses when the next CPU is spinning to check other node's cpu member by vcpu_is_preempted(). Here provide the UnixBench full-core test result as below: Machine Intel(R) Xeon(R) Gold 6248 CPU, 40 cores, 80 threads Run the command of "./Run -c 80 -i 3" 10 times and take the average. System Benchmarks Index Values Without Patch With Patch Diff Dhrystone 2 using register variables 185876.43 185945.41 0.04% Double-Precision Whetstone 79637.27 79659.29 0.03% Execl Throughput 9909.61 10576.06 6.73% File Copy 1024 bufsize 2000 maxblocks 1723.01 2086.08 21.07% File Copy 256 bufsize 500 maxblocks 1150.24 1338.21 16.34% File Copy 4096 bufsize 8000 maxblocks 3719.19 4011.99 7.87% Pipe Throughput 66184.84 66025.25 -0.24% Pipe-based Context Switching 30606.18 31074.21 1.53% Process Creation 9442.48 9450.77 0.09% Shell Scripts (1 concurrent) 44526.52 46548.54 4.54% Shell Scripts (8 concurrent) 42903.96 45718.56 6.56% System Call Overhead 3645.20 3717.42 1.98% ======== System Benchmarks Index Score 15126.87 15931.29 5.32% Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- include/linux/osq_lock.h | 2 +- kernel/locking/osq_lock.c | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/include/linux/osq_lock.h b/include/linux/osq_lock.h index 5581dbd3bd34..deb90ad5f560 100644 --- a/include/linux/osq_lock.h +++ b/include/linux/osq_lock.h @@ -9,7 +9,7 @@ struct optimistic_spin_node { struct optimistic_spin_node *next, *prev; int locked; /* 1 if lock acquired */ - int cpu; /* encoded CPU # + 1 value */ + int cpu ____cacheline_aligned; /* encoded CPU # + 1 value */ }; struct optimistic_spin_queue { diff --git a/kernel/locking/osq_lock.c b/kernel/locking/osq_lock.c index d5610ad52b92..17618d62343f 100644 --- a/kernel/locking/osq_lock.c +++ b/kernel/locking/osq_lock.c @@ -96,7 +96,13 @@ bool osq_lock(struct optimistic_spin_queue *lock) node->locked = 0; node->next = NULL; - node->cpu = curr; + /* + * After this cpu member is initialized for the first time, it + * would no longer change in fact. That could avoid cache misses + * when spin and access the cpu member by other CPUs. + */ + if (node->cpu != curr) + node->cpu = curr; /* * We need both ACQUIRE (pairs with corresponding RELEASE in -- 2.25.1

1 0

[PATCH OLK-5.10 0/2] fix CVE-2024-26669
by Zhengchao Shao 11 Apr '24

11 Apr '24

fix CVE-2024-26669. Ido Schimmel (1): net/sched: flower: Fix chain template offload Zhengchao Shao (1): net/sched: flower: Fix kabi change net/sched/cls_api.c | 20 ++++++++++++++++++++ net/sched/cls_flower.c | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10] KVM: s390: vsie: fix race during shadow creation
by Cui GaoSheng 11 Apr '24

11 Apr '24

From: Christian Borntraeger <borntraeger(a)linux.ibm.com> stable inclusion from stable-v6.1.82 commit 5df3b81a567eb565029563f26f374ae3803a1dfc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GQ CVE: CVE-2023-52639 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fe752331d4b361d43cfd0b89534b4b2176057c32 ] Right now it is possible to see gmap->private being zero in kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the fact that we add gmap->private == kvm after creation: static int acquire_gmap_shadow(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) { [...] gmap = gmap_shadow(vcpu->arch.gmap, asce, edat); if (IS_ERR(gmap)) return PTR_ERR(gmap); gmap->private = vcpu->kvm; Let children inherit the private field of the parent. Reported-by: Marc Hartmayer <mhartmay(a)linux.ibm.com> Fixes: a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization") Cc: <stable(a)vger.kernel.org> Cc: David Hildenbrand <david(a)redhat.com> Reviewed-by: Janosch Frank <frankja(a)linux.ibm.com> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger(a)linux.ibm.com> Link: https://lore.kernel.org/r/20231220125317.4258-1-borntraeger@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> conflicts: arch/s390/kvm/vsie.c Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- arch/s390/kvm/vsie.c | 1 - arch/s390/mm/gmap.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c index 192eacc8fbb7..ae6b05c53b4a 100644 --- a/arch/s390/kvm/vsie.c +++ b/arch/s390/kvm/vsie.c @@ -1201,7 +1201,6 @@ static int acquire_gmap_shadow(struct kvm_vcpu *vcpu, gmap = gmap_shadow(vcpu->arch.gmap, asce, edat); if (IS_ERR(gmap)) return PTR_ERR(gmap); - gmap->private = vcpu->kvm; WRITE_ONCE(vsie_page->gmap, gmap); return 0; } diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c index 8ad5b0d541a7..9b345680f9fb 100644 --- a/arch/s390/mm/gmap.c +++ b/arch/s390/mm/gmap.c @@ -1663,6 +1663,7 @@ struct gmap *gmap_shadow(struct gmap *parent, unsigned long asce, return ERR_PTR(-ENOMEM); new->mm = parent->mm; new->parent = gmap_get(parent); + new->private = parent->private; new->orig_asce = asce; new->edat_level = edat_level; new->initialized = false; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] KVM: s390: vsie: fix race during shadow creation
by Cui GaoSheng 11 Apr '24

11 Apr '24

From: Christian Borntraeger <borntraeger(a)linux.ibm.com> stable inclusion from stable-v6.1.82 commit 5df3b81a567eb565029563f26f374ae3803a1dfc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GQ CVE: CVE-2023-52639 -------------------------------- [ Upstream commit fe752331d4b361d43cfd0b89534b4b2176057c32 ] Right now it is possible to see gmap->private being zero in kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the fact that we add gmap->private == kvm after creation: static int acquire_gmap_shadow(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) { [...] gmap = gmap_shadow(vcpu->arch.gmap, asce, edat); if (IS_ERR(gmap)) return PTR_ERR(gmap); gmap->private = vcpu->kvm; Let children inherit the private field of the parent. Reported-by: Marc Hartmayer <mhartmay(a)linux.ibm.com> Fixes: a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization") Cc: <stable(a)vger.kernel.org> Cc: David Hildenbrand <david(a)redhat.com> Reviewed-by: Janosch Frank <frankja(a)linux.ibm.com> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger(a)linux.ibm.com> Link: https://lore.kernel.org/r/20231220125317.4258-1-borntraeger@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> conflicts: arch/s390/kvm/vsie.c Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- arch/s390/kvm/vsie.c | 1 - arch/s390/mm/gmap.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c index a2b28cd1e3fe..93de43a32cfb 100644 --- a/arch/s390/kvm/vsie.c +++ b/arch/s390/kvm/vsie.c @@ -933,7 +933,6 @@ static int acquire_gmap_shadow(struct kvm_vcpu *vcpu, gmap = gmap_shadow(vcpu->arch.gmap, asce, edat); if (IS_ERR(gmap)) return PTR_ERR(gmap); - gmap->private = vcpu->kvm; WRITE_ONCE(vsie_page->gmap, gmap); return 0; } diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c index 911c7ded35f1..df2de0b9822b 100644 --- a/arch/s390/mm/gmap.c +++ b/arch/s390/mm/gmap.c @@ -1652,6 +1652,7 @@ struct gmap *gmap_shadow(struct gmap *parent, unsigned long asce, return ERR_PTR(-ENOMEM); new->mm = parent->mm; new->parent = gmap_get(parent); + new->private = parent->private; new->orig_asce = asce; new->edat_level = edat_level; new->initialized = false; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] KVM: s390: vsie: fix race during shadow creation
by Cui GaoSheng 11 Apr '24

11 Apr '24

From: Christian Borntraeger <borntraeger(a)linux.ibm.com> stable inclusion from stable-v6.1.82~24 commit 5df3b81a567eb565029563f26f374ae3803a1dfc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GQ CVE: CVE-2023-52639 -------------------------------- [ Upstream commit fe752331d4b361d43cfd0b89534b4b2176057c32 ] Right now it is possible to see gmap->private being zero in kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the fact that we add gmap->private == kvm after creation: static int acquire_gmap_shadow(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) { [...] gmap = gmap_shadow(vcpu->arch.gmap, asce, edat); if (IS_ERR(gmap)) return PTR_ERR(gmap); gmap->private = vcpu->kvm; Let children inherit the private field of the parent. Reported-by: Marc Hartmayer <mhartmay(a)linux.ibm.com> Fixes: a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization") Cc: <stable(a)vger.kernel.org> Cc: David Hildenbrand <david(a)redhat.com> Reviewed-by: Janosch Frank <frankja(a)linux.ibm.com> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger(a)linux.ibm.com> Link: https://lore.kernel.org/r/20231220125317.4258-1-borntraeger@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> conflicts: arch/s390/kvm/vsie.c Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- arch/s390/kvm/vsie.c | 1 - arch/s390/mm/gmap.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c index a2b28cd1e3fe..93de43a32cfb 100644 --- a/arch/s390/kvm/vsie.c +++ b/arch/s390/kvm/vsie.c @@ -933,7 +933,6 @@ static int acquire_gmap_shadow(struct kvm_vcpu *vcpu, gmap = gmap_shadow(vcpu->arch.gmap, asce, edat); if (IS_ERR(gmap)) return PTR_ERR(gmap); - gmap->private = vcpu->kvm; WRITE_ONCE(vsie_page->gmap, gmap); return 0; } diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c index 911c7ded35f1..df2de0b9822b 100644 --- a/arch/s390/mm/gmap.c +++ b/arch/s390/mm/gmap.c @@ -1652,6 +1652,7 @@ struct gmap *gmap_shadow(struct gmap *parent, unsigned long asce, return ERR_PTR(-ENOMEM); new->mm = parent->mm; new->parent = gmap_get(parent); + new->private = parent->private; new->orig_asce = asce; new->edat_level = edat_level; new->initialized = false; -- 2.34.1

2 1

[PATCH OLK-5.10] KVM: s390: vsie: fix race during shadow creation
by Cui GaoSheng 11 Apr '24

11 Apr '24

From: Christian Borntraeger <borntraeger(a)linux.ibm.com> stable inclusion from stable-v6.1.82~24 commit 5df3b81a567eb565029563f26f374ae3803a1dfc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GQ CVE: CVE-2023-52639 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fe752331d4b361d43cfd0b89534b4b2176057c32 ] Right now it is possible to see gmap->private being zero in kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the fact that we add gmap->private == kvm after creation: static int acquire_gmap_shadow(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) { [...] gmap = gmap_shadow(vcpu->arch.gmap, asce, edat); if (IS_ERR(gmap)) return PTR_ERR(gmap); gmap->private = vcpu->kvm; Let children inherit the private field of the parent. Reported-by: Marc Hartmayer <mhartmay(a)linux.ibm.com> Fixes: a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization") Cc: <stable(a)vger.kernel.org> Cc: David Hildenbrand <david(a)redhat.com> Reviewed-by: Janosch Frank <frankja(a)linux.ibm.com> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger(a)linux.ibm.com> Link: https://lore.kernel.org/r/20231220125317.4258-1-borntraeger@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> conflicts: arch/s390/kvm/vsie.c Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- arch/s390/kvm/vsie.c | 1 - arch/s390/mm/gmap.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c index 192eacc8fbb7..ae6b05c53b4a 100644 --- a/arch/s390/kvm/vsie.c +++ b/arch/s390/kvm/vsie.c @@ -1201,7 +1201,6 @@ static int acquire_gmap_shadow(struct kvm_vcpu *vcpu, gmap = gmap_shadow(vcpu->arch.gmap, asce, edat); if (IS_ERR(gmap)) return PTR_ERR(gmap); - gmap->private = vcpu->kvm; WRITE_ONCE(vsie_page->gmap, gmap); return 0; } diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c index 8ad5b0d541a7..9b345680f9fb 100644 --- a/arch/s390/mm/gmap.c +++ b/arch/s390/mm/gmap.c @@ -1663,6 +1663,7 @@ struct gmap *gmap_shadow(struct gmap *parent, unsigned long asce, return ERR_PTR(-ENOMEM); new->mm = parent->mm; new->parent = gmap_get(parent); + new->private = parent->private; new->orig_asce = asce; new->edat_level = edat_level; new->initialized = false; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mm/swap: fix race when skipping swapcache
by Jinjiang Tu 11 Apr '24

11 Apr '24

From: Kairui Song <kasong(a)tencent.com> mainline inclusion from mainline-v6.8-rc6 commit 13ddaf26be324a7f951891ecd9ccd04466d27458 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2M2 CVE: CVE-2024-26759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- When skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads swapin the same entry at the same time, they get different pages (A, B). Before one thread (T0) finishes the swapin and installs page (A) to the PTE, another thread (T1) could finish swapin of page (B), swap_free the entry, then swap out the possibly modified page reusing the same entry. It breaks the pte_same check in (T0) because PTE value is unchanged, causing ABA problem. Thread (T0) will install a stalled page (A) into the PTE and cause data corruption. One possible callstack is like this: CPU0 CPU1 ---- ---- do_swap_page() do_swap_page() with same entry <direct swapin path> <direct swapin path> <alloc page A> <alloc page B> swap_read_folio() <- read to page A swap_read_folio() <- read to page B <slow on later locks or interrupt> <finished swapin first> ... set_pte_at() swap_free() <- entry is free <write to page B, now page A stalled> <swap out page B to same swap entry> pte_same() <- Check pass, PTE seems unchanged, but page A is stalled! swap_free() <- page B content lost! set_pte_at() <- staled page A installed! And besides, for ZRAM, swap_free() allows the swap device to discard the entry content, so even if page (B) is not modified, if swap_read_folio() on CPU0 happens later than swap_free() on CPU1, it may also cause data loss. To fix this, reuse swapcache_prepare which will pin the swap entry using the cache flag, and allow only one thread to swap it in, also prevent any parallel code from putting the entry in the cache. Release the pin after PT unlocked. Racers just loop and wait since it's a rare and very short event. A schedule_timeout_uninterruptible(1) call is added to avoid repeated page faults wasting too much CPU, causing livelock or adding too much noise to perf statistics. A similar livelock issue was described in commit 029c4628b2eb ("mm: swap: get rid of livelock in swapin readahead") Reproducer: This race issue can be triggered easily using a well constructed reproducer and patched brd (with a delay in read path) [1]: With latest 6.8 mainline, race caused data loss can be observed easily: $ gcc -g -lpthread test-thread-swap-race.c && ./a.out Polulating 32MB of memory region... Keep swapping out... Starting round 0... Spawning 65536 workers... 32746 workers spawned, wait for done... Round 0: Error on 0x5aa00, expected 32746, got 32743, 3 data loss! Round 0: Error on 0x395200, expected 32746, got 32743, 3 data loss! Round 0: Error on 0x3fd000, expected 32746, got 32737, 9 data loss! Round 0 Failed, 15 data loss! This reproducer spawns multiple threads sharing the same memory region using a small swap device. Every two threads updates mapped pages one by one in opposite direction trying to create a race, with one dedicated thread keep swapping out the data out using madvise. The reproducer created a reproduce rate of about once every 5 minutes, so the race should be totally possible in production. After this patch, I ran the reproducer for over a few hundred rounds and no data loss observed. Performance overhead is minimal, microbenchmark swapin 10G from 32G zram: Before: 10934698 us After: 11157121 us Cached: 13155355 us (Dropping SWP_SYNCHRONOUS_IO flag) [kasong(a)tencent.com: v4] Link: https://lkml.kernel.org/r/20240219082040.7495-1-ryncsn@gmail.com Link: https://lkml.kernel.org/r/20240206182559.32264-1-ryncsn@gmail.com Fixes: 0bcac06f27d7 ("mm, swap: skip swapcache for swapin of synchronous device") Reported-by: "Huang, Ying" <ying.huang(a)intel.com> Closes: https://lore.kernel.org/lkml/87bk92gqpx.fsf_-_@yhuang6-desk2.ccr.corp.intel… Link: https://github.com/ryncsn/emm-test-project/tree/master/swap-stress-race [1] Signed-off-by: Kairui Song <kasong(a)tencent.com> Reviewed-by: "Huang, Ying" <ying.huang(a)intel.com> Acked-by: Yu Zhao <yuzhao(a)google.com> Acked-by: David Hildenbrand <david(a)redhat.com> Acked-by: Chris Li <chrisl(a)kernel.org> Cc: Hugh Dickins <hughd(a)google.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Minchan Kim <minchan(a)kernel.org> Cc: Yosry Ahmed <yosryahmed(a)google.com> Cc: Yu Zhao <yuzhao(a)google.com> Cc: Barry Song <21cnbao(a)gmail.com> Cc: SeongJae Park <sj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/memory.c include/linux/swap.h Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- include/linux/swap.h | 5 +++++ mm/memory.c | 23 ++++++++++++++++++++++- mm/swapfile.c | 13 +++++++++++++ 3 files changed, 40 insertions(+), 1 deletion(-) diff --git a/include/linux/swap.h b/include/linux/swap.h index 959a2e3811f2..5f5ed7f5175b 100644 --- a/include/linux/swap.h +++ b/include/linux/swap.h @@ -468,6 +468,7 @@ extern int add_to_swap_cache(struct page *, swp_entry_t, gfp_t); extern int __add_to_swap_cache(struct page *page, swp_entry_t entry); extern void __delete_from_swap_cache(struct page *); extern void delete_from_swap_cache(struct page *); +void swapcache_clear(struct swap_info_struct *si, swp_entry_t entry); extern void free_page_and_swap_cache(struct page *); extern void free_pages_and_swap_cache(struct page **, int); extern struct page *lookup_swap_cache(swp_entry_t entry, @@ -609,6 +610,10 @@ static inline int swap_writepage(struct page *p, struct writeback_control *wbc) return 0; } +static inline void swapcache_clear(struct swap_info_struct *si, swp_entry_t entry) +{ +} + static inline struct page *lookup_swap_cache(swp_entry_t swp, struct vm_area_struct *vma, unsigned long addr) diff --git a/mm/memory.c b/mm/memory.c index 5816149c4339..592fc72e47fd 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -2919,6 +2919,8 @@ vm_fault_t do_swap_page(struct vm_fault *vmf) struct vm_area_struct *vma = vmf->vma; struct page *page = NULL, *swapcache; struct mem_cgroup *memcg; + struct swap_info_struct *si = NULL; + bool need_clear_cache = false; swp_entry_t entry; pte_t pte; int locked; @@ -2974,10 +2976,24 @@ vm_fault_t do_swap_page(struct vm_fault *vmf) swapcache = page; if (!page) { - struct swap_info_struct *si = swp_swap_info(entry); + si = swp_swap_info(entry); if (si->flags & SWP_SYNCHRONOUS_IO && __swap_count(entry) == 1) { + /* + * Prevent parallel swapin from proceeding with + * the cache flag. Otherwise, another thread may + * finish swapin first, free the entry, and swapout + * reusing the same entry. It's undetectable as + * pte_same() returns true due to entry reuse. + */ + if (swapcache_prepare(entry)) { + /* Relax a bit to prevent rapid repeated page faults */ + schedule_timeout_uninterruptible(1); + goto out; + } + need_clear_cache = true; + /* skip swapcache */ page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, vmf->address); @@ -3133,6 +3149,9 @@ vm_fault_t do_swap_page(struct vm_fault *vmf) unlock: pte_unmap_unlock(vmf->pte, vmf->ptl); out: + /* Clear the swap cache pin for direct swapin after PTL unlock */ + if (need_clear_cache) + swapcache_clear(si, entry); return ret; out_nomap: mem_cgroup_cancel_charge(page, memcg, false); @@ -3145,6 +3164,8 @@ vm_fault_t do_swap_page(struct vm_fault *vmf) unlock_page(swapcache); put_page(swapcache); } + if (need_clear_cache) + swapcache_clear(si, entry); return ret; } diff --git a/mm/swapfile.c b/mm/swapfile.c index 45b86574541f..9e0e519254b4 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -3590,6 +3590,19 @@ int swapcache_prepare(swp_entry_t entry) return __swap_duplicate(entry, SWAP_HAS_CACHE); } +void swapcache_clear(struct swap_info_struct *si, swp_entry_t entry) +{ + struct swap_cluster_info *ci; + unsigned long offset = swp_offset(entry); + unsigned char usage; + + ci = lock_cluster_or_swap_info(si, offset); + usage = __swap_entry_free_locked(si, offset, SWAP_HAS_CACHE); + unlock_cluster_or_swap_info(si, ci); + if (!usage) + free_swap_slot(entry); +} + struct swap_info_struct *swp_swap_info(swp_entry_t entry) { return swap_type_to_swap_info(swp_type(entry)); -- 2.25.1

2 1

[PATCH OLK-5.10] net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
by Liu Jian 11 Apr '24

11 Apr '24

From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> stable inclusion from stable-v5.10.210 commit 0d8011a878fdf96123bc0d6a12e2fe7ced5fddfb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2FK CVE: CVE-2024-26707 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 37e8c97e539015637cb920d3e6f1e404f707a06e upstream. Syzkaller reported [1] hitting a warning after failing to allocate resources for skb in hsr_init_skb(). Since a WARN_ONCE() call will not help much in this case, it might be prudent to switch to netdev_warn_once(). At the very least it will suppress syzkaller reports such as [1]. Just in case, use netdev_warn_once() in send_prp_supervision_frame() for similar reasons. [1] HSR: Could not send supervision frame WARNING: CPU: 1 PID: 85 at net/hsr/hsr_device.c:294 send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294 RIP: 0010:send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294 ... Call Trace: <IRQ> hsr_announce+0x114/0x370 net/hsr/hsr_device.c:382 call_timer_fn+0x193/0x590 kernel/time/timer.c:1700 expire_timers kernel/time/timer.c:1751 [inline] __run_timers+0x764/0xb20 kernel/time/timer.c:2022 run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035 __do_softirq+0x21a/0x8de kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu kernel/softirq.c:632 [inline] irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649 ... This issue is also found in older kernels (at least up to 5.10). Cc: stable(a)vger.kernel.org Reported-by: syzbot+3ae0a3f42c84074b7c8e(a)syzkaller.appspotmail.com Fixes: 121c33b07b31 ("net: hsr: introduce common code for skb initialization") Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/hsr/hsr_device.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c index 84e6ef4f3525..c5a4c5fb7293 100644 --- a/net/hsr/hsr_device.c +++ b/net/hsr/hsr_device.c @@ -291,7 +291,7 @@ static void send_hsr_supervision_frame(struct hsr_port *master, skb = hsr_init_skb(master); if (!skb) { - WARN_ONCE(1, "HSR: Could not send supervision frame\n"); + netdev_warn_once(master->dev, "HSR: Could not send supervision frame\n"); return; } @@ -338,7 +338,7 @@ static void send_prp_supervision_frame(struct hsr_port *master, skb = hsr_init_skb(master); if (!skb) { - WARN_ONCE(1, "PRP: Could not send supervision frame\n"); + netdev_warn_once(master->dev, "PRP: Could not send supervision frame\n"); return; } -- 2.34.1

2 1

[PATCH OLK-5.10 0/5] cvm feature patches
by hejingxian 11 Apr '24

11 Apr '24

From: Jingxian He <hejingxian(a)huawei.com> Add cvm feature patches: 1. add cvm host feature 2. enable pmu phys irq inject for cvm 3. add bounce buffer feature for cvm guest 4. add lpi support for cvm guest 5. fix kabi for cvm host arch/arm64/configs/defconfig | 2 + arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/include/asm/cvm_guest.h | 21 + arch/arm64/include/asm/kvm_emulate.h | 18 + arch/arm64/include/asm/kvm_host.h | 28 +- arch/arm64/include/asm/kvm_tmi.h | 377 +++++++++++ arch/arm64/include/asm/kvm_tmm.h | 73 ++ arch/arm64/kvm/Kconfig | 16 + arch/arm64/kvm/Makefile | 5 + arch/arm64/kvm/arch_timer.c | 104 ++- arch/arm64/kvm/arm.c | 157 ++++- arch/arm64/kvm/cvm.c | 891 +++++++++++++++++++++++++ arch/arm64/kvm/cvm_exit.c | 240 +++++++ arch/arm64/kvm/cvm_guest.c | 91 +++ arch/arm64/kvm/guest.c | 8 + arch/arm64/kvm/hisilicon/hisi_virt.c | 7 + arch/arm64/kvm/hyp/vgic-v3-sr.c | 19 + arch/arm64/kvm/mmio.c | 19 + arch/arm64/kvm/mmu.c | 7 + arch/arm64/kvm/pmu-emul.c | 12 + arch/arm64/kvm/psci.c | 12 +- arch/arm64/kvm/reset.c | 10 + arch/arm64/kvm/tmi.c | 168 +++++ arch/arm64/kvm/vgic/vgic-v3.c | 18 +- arch/arm64/kvm/vgic/vgic.c | 59 +- arch/arm64/mm/mmu.c | 11 + arch/arm64/mm/pageattr.c | 9 +- drivers/irqchip/irq-gic-v3-its.c | 229 ++++++- drivers/perf/arm_pmu.c | 17 + include/kvm/arm_arch_timer.h | 4 + include/linux/kvm_host.h | 23 + include/linux/perf/arm_pmu.h | 3 + include/linux/swiotlb.h | 13 + include/uapi/linux/kvm.h | 27 + kernel/dma/direct.c | 39 ++ kernel/dma/swiotlb.c | 86 ++- virt/kvm/kvm_main.c | 7 +- 37 files changed, 2789 insertions(+), 43 deletions(-) create mode 100644 arch/arm64/include/asm/cvm_guest.h create mode 100644 arch/arm64/include/asm/kvm_tmi.h create mode 100644 arch/arm64/include/asm/kvm_tmm.h create mode 100644 arch/arm64/kvm/cvm.c create mode 100644 arch/arm64/kvm/cvm_exit.c create mode 100644 arch/arm64/kvm/cvm_guest.c create mode 100644 arch/arm64/kvm/tmi.c -- 2.33.0

2 6

[PATCH OLK-5.10] mptcp: fix double-free on socket dismantle
by Liu Jian 11 Apr '24

11 Apr '24

From: Davide Caratti <dcaratti(a)redhat.com> stable inclusion from stable-v5.10.212 commit f74362a004225df935863dea6eb7d82daaa5b16e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E442 CVE: CVE-2024-26782 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 10048689def7e40a4405acda16fdc6477d4ecc5c upstream. when MPTCP server accepts an incoming connection, it clones its listener socket. However, the pointer to 'inet_opt' for the new socket has the same value as the original one: as a consequence, on program exit it's possible to observe the following splat: BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0 Free of addr ffff888485950880 by task swapper/25/0 CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609 Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0 07/26/2013 Call Trace: <IRQ> dump_stack_lvl+0x32/0x50 print_report+0xca/0x620 kasan_report_invalid_free+0x64/0x90 __kasan_slab_free+0x1aa/0x1f0 kfree+0xed/0x2e0 inet_sock_destruct+0x54f/0x8b0 __sk_destruct+0x48/0x5b0 rcu_do_batch+0x34e/0xd90 rcu_core+0x559/0xac0 __do_softirq+0x183/0x5a4 irq_exit_rcu+0x12d/0x170 sysvec_apic_timer_interrupt+0x6b/0x80 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x16/0x20 RIP: 0010:cpuidle_enter_state+0x175/0x300 Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed <0f> 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000 RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588 RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080 R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0 R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80 cpuidle_enter+0x4a/0xa0 do_idle+0x310/0x410 cpu_startup_entry+0x51/0x60 start_secondary+0x211/0x270 secondary_startup_64_no_verify+0x184/0x18b </TASK> Allocated by task 6853: kasan_save_stack+0x1c/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0xa6/0xb0 __kmalloc+0x1eb/0x450 cipso_v4_sock_setattr+0x96/0x360 netlbl_sock_setattr+0x132/0x1f0 selinux_netlbl_socket_post_create+0x6c/0x110 selinux_socket_post_create+0x37b/0x7f0 security_socket_post_create+0x63/0xb0 __sock_create+0x305/0x450 __sys_socket_create.part.23+0xbd/0x130 __sys_socket+0x37/0xb0 __x64_sys_socket+0x6f/0xb0 do_syscall_64+0x83/0x160 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Freed by task 6858: kasan_save_stack+0x1c/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x12c/0x1f0 kfree+0xed/0x2e0 inet_sock_destruct+0x54f/0x8b0 __sk_destruct+0x48/0x5b0 subflow_ulp_release+0x1f0/0x250 tcp_cleanup_ulp+0x6e/0x110 tcp_v4_destroy_sock+0x5a/0x3a0 inet_csk_destroy_sock+0x135/0x390 tcp_fin+0x416/0x5c0 tcp_data_queue+0x1bc8/0x4310 tcp_rcv_state_process+0x15a3/0x47b0 tcp_v4_do_rcv+0x2c1/0x990 tcp_v4_rcv+0x41fb/0x5ed0 ip_protocol_deliver_rcu+0x6d/0x9f0 ip_local_deliver_finish+0x278/0x360 ip_local_deliver+0x182/0x2c0 ip_rcv+0xb5/0x1c0 __netif_receive_skb_one_core+0x16e/0x1b0 process_backlog+0x1e3/0x650 __napi_poll+0xa6/0x500 net_rx_action+0x740/0xbb0 __do_softirq+0x183/0x5a4 The buggy address belongs to the object at ffff888485950880 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 0 bytes inside of 64-byte region [ffff888485950880, ffff8884859508c0) The buggy address belongs to the physical page: page:0000000056d1e95e refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888485950700 pfn:0x485950 flags: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006 raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888485950780: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff888485950800: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff888485950880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff888485950900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff888485950980: 00 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc Something similar (a refcount underflow) happens with CALIPSO/IPv6. Fix this by duplicating IP / IPv6 options after clone, so that ip{,6}_sock_destruct() doesn't end up freeing the same memory area twice. Fixes: cf7da0d66cc1 ("mptcp: Create SUBFLOW socket for incoming connections") Cc: stable(a)vger.kernel.org Signed-off-by: Davide Caratti <dcaratti(a)redhat.com> Reviewed-by: Mat Martineau <martineau(a)kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-8-16… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/mptcp/protocol.c | 49 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 402b3da730d4..09d0510eaaa6 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -2052,8 +2052,50 @@ static struct ipv6_pinfo *mptcp_inet6_sk(const struct sock *sk) return (struct ipv6_pinfo *)(((u8 *)sk) + offset); } + +static void mptcp_copy_ip6_options(struct sock *newsk, const struct sock *sk) +{ + const struct ipv6_pinfo *np = inet6_sk(sk); + struct ipv6_txoptions *opt; + struct ipv6_pinfo *newnp; + + newnp = inet6_sk(newsk); + + rcu_read_lock(); + opt = rcu_dereference(np->opt); + if (opt) { + opt = ipv6_dup_options(newsk, opt); + if (!opt) + net_warn_ratelimited("%s: Failed to copy ip6 options\n", __func__); + } + RCU_INIT_POINTER(newnp->opt, opt); + rcu_read_unlock(); +} #endif +static void mptcp_copy_ip_options(struct sock *newsk, const struct sock *sk) +{ + struct ip_options_rcu *inet_opt, *newopt = NULL; + const struct inet_sock *inet = inet_sk(sk); + struct inet_sock *newinet; + + newinet = inet_sk(newsk); + + rcu_read_lock(); + inet_opt = rcu_dereference(inet->inet_opt); + if (inet_opt) { + newopt = sock_kmalloc(newsk, sizeof(*inet_opt) + + inet_opt->opt.optlen, GFP_ATOMIC); + if (newopt) + memcpy(newopt, inet_opt, sizeof(*inet_opt) + + inet_opt->opt.optlen); + else + net_warn_ratelimited("%s: Failed to copy ip options\n", __func__); + } + RCU_INIT_POINTER(newinet->inet_opt, newopt); + rcu_read_unlock(); +} + struct sock *mptcp_sk_clone(const struct sock *sk, const struct mptcp_options_received *mp_opt, struct request_sock *req) @@ -2073,6 +2115,13 @@ struct sock *mptcp_sk_clone(const struct sock *sk, __mptcp_init_sock(nsk); +#if IS_ENABLED(CONFIG_MPTCP_IPV6) + if (nsk->sk_family == AF_INET6) + mptcp_copy_ip6_options(nsk, sk); + else +#endif + mptcp_copy_ip_options(nsk, sk); + msk = mptcp_sk(nsk); msk->local_key = subflow_req->local_key; msk->token = subflow_req->token; -- 2.34.1

2 1

[PATCH OLK-5.10] mm/swap: fix race when skipping swapcache
by Jinjiang Tu 11 Apr '24

11 Apr '24

From: Kairui Song <kasong(a)tencent.com> mainline inclusion from mainline-v6.8-rc6 commit 13ddaf26be324a7f951891ecd9ccd04466d27458 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2M2 CVE: CVE-2024-26759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- When skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads swapin the same entry at the same time, they get different pages (A, B). Before one thread (T0) finishes the swapin and installs page (A) to the PTE, another thread (T1) could finish swapin of page (B), swap_free the entry, then swap out the possibly modified page reusing the same entry. It breaks the pte_same check in (T0) because PTE value is unchanged, causing ABA problem. Thread (T0) will install a stalled page (A) into the PTE and cause data corruption. One possible callstack is like this: CPU0 CPU1 ---- ---- do_swap_page() do_swap_page() with same entry <direct swapin path> <direct swapin path> <alloc page A> <alloc page B> swap_read_folio() <- read to page A swap_read_folio() <- read to page B <slow on later locks or interrupt> <finished swapin first> ... set_pte_at() swap_free() <- entry is free <write to page B, now page A stalled> <swap out page B to same swap entry> pte_same() <- Check pass, PTE seems unchanged, but page A is stalled! swap_free() <- page B content lost! set_pte_at() <- staled page A installed! And besides, for ZRAM, swap_free() allows the swap device to discard the entry content, so even if page (B) is not modified, if swap_read_folio() on CPU0 happens later than swap_free() on CPU1, it may also cause data loss. To fix this, reuse swapcache_prepare which will pin the swap entry using the cache flag, and allow only one thread to swap it in, also prevent any parallel code from putting the entry in the cache. Release the pin after PT unlocked. Racers just loop and wait since it's a rare and very short event. A schedule_timeout_uninterruptible(1) call is added to avoid repeated page faults wasting too much CPU, causing livelock or adding too much noise to perf statistics. A similar livelock issue was described in commit 029c4628b2eb ("mm: swap: get rid of livelock in swapin readahead") Reproducer: This race issue can be triggered easily using a well constructed reproducer and patched brd (with a delay in read path) [1]: With latest 6.8 mainline, race caused data loss can be observed easily: $ gcc -g -lpthread test-thread-swap-race.c && ./a.out Polulating 32MB of memory region... Keep swapping out... Starting round 0... Spawning 65536 workers... 32746 workers spawned, wait for done... Round 0: Error on 0x5aa00, expected 32746, got 32743, 3 data loss! Round 0: Error on 0x395200, expected 32746, got 32743, 3 data loss! Round 0: Error on 0x3fd000, expected 32746, got 32737, 9 data loss! Round 0 Failed, 15 data loss! This reproducer spawns multiple threads sharing the same memory region using a small swap device. Every two threads updates mapped pages one by one in opposite direction trying to create a race, with one dedicated thread keep swapping out the data out using madvise. The reproducer created a reproduce rate of about once every 5 minutes, so the race should be totally possible in production. After this patch, I ran the reproducer for over a few hundred rounds and no data loss observed. Performance overhead is minimal, microbenchmark swapin 10G from 32G zram: Before: 10934698 us After: 11157121 us Cached: 13155355 us (Dropping SWP_SYNCHRONOUS_IO flag) [kasong(a)tencent.com: v4] Link: https://lkml.kernel.org/r/20240219082040.7495-1-ryncsn@gmail.com Link: https://lkml.kernel.org/r/20240206182559.32264-1-ryncsn@gmail.com Fixes: 0bcac06f27d7 ("mm, swap: skip swapcache for swapin of synchronous device") Reported-by: "Huang, Ying" <ying.huang(a)intel.com> Closes: https://lore.kernel.org/lkml/87bk92gqpx.fsf_-_@yhuang6-desk2.ccr.corp.intel… Link: https://github.com/ryncsn/emm-test-project/tree/master/swap-stress-race [1] Signed-off-by: Kairui Song <kasong(a)tencent.com> Reviewed-by: "Huang, Ying" <ying.huang(a)intel.com> Acked-by: Yu Zhao <yuzhao(a)google.com> Acked-by: David Hildenbrand <david(a)redhat.com> Acked-by: Chris Li <chrisl(a)kernel.org> Cc: Hugh Dickins <hughd(a)google.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Minchan Kim <minchan(a)kernel.org> Cc: Yosry Ahmed <yosryahmed(a)google.com> Cc: Yu Zhao <yuzhao(a)google.com> Cc: Barry Song <21cnbao(a)gmail.com> Cc: SeongJae Park <sj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/memory.c include/linux/swap.h Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- include/linux/swap.h | 5 +++++ mm/memory.c | 20 ++++++++++++++++++++ mm/swapfile.c | 13 +++++++++++++ 3 files changed, 38 insertions(+) diff --git a/include/linux/swap.h b/include/linux/swap.h index 524e3ca9d0f5..8e62c870517c 100644 --- a/include/linux/swap.h +++ b/include/linux/swap.h @@ -478,6 +478,7 @@ extern void __delete_from_swap_cache(struct page *page, extern void delete_from_swap_cache(struct page *); extern void clear_shadow_from_swap_cache(int type, unsigned long begin, unsigned long end); +void swapcache_clear(struct swap_info_struct *si, swp_entry_t entry); extern void free_page_and_swap_cache(struct page *); extern void free_pages_and_swap_cache(struct page **, int); extern struct page *lookup_swap_cache(swp_entry_t entry, @@ -638,6 +639,10 @@ static inline int swap_writepage(struct page *p, struct writeback_control *wbc) return 0; } +static inline void swapcache_clear(struct swap_info_struct *si, swp_entry_t entry) +{ +} + static inline struct page *lookup_swap_cache(swp_entry_t swp, struct vm_area_struct *vma, unsigned long addr) diff --git a/mm/memory.c b/mm/memory.c index 55d4375d4b27..aa780ac0e114 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -3387,6 +3387,7 @@ vm_fault_t do_swap_page(struct vm_fault *vmf) struct vm_area_struct *vma = vmf->vma; struct page *page = NULL, *swapcache; struct swap_info_struct *si = NULL; + bool need_clear_cache = false; swp_entry_t entry; pte_t pte; int locked; @@ -3444,6 +3445,20 @@ vm_fault_t do_swap_page(struct vm_fault *vmf) if (!page) { if (data_race(si->flags & SWP_SYNCHRONOUS_IO) && __swap_count(entry) == 1) { + /* + * Prevent parallel swapin from proceeding with + * the cache flag. Otherwise, another thread may + * finish swapin first, free the entry, and swapout + * reusing the same entry. It's undetectable as + * pte_same() returns true due to entry reuse. + */ + if (swapcache_prepare(entry)) { + /* Relax a bit to prevent rapid repeated page faults */ + schedule_timeout_uninterruptible(1); + goto out; + } + need_clear_cache = true; + /* skip swapcache */ page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, vmf->address); @@ -3613,6 +3628,9 @@ vm_fault_t do_swap_page(struct vm_fault *vmf) unlock: pte_unmap_unlock(vmf->pte, vmf->ptl); out: + /* Clear the swap cache pin for direct swapin after PTL unlock */ + if (need_clear_cache) + swapcache_clear(si, entry); if (si) put_swap_device(si); return ret; @@ -3626,6 +3644,8 @@ vm_fault_t do_swap_page(struct vm_fault *vmf) unlock_page(swapcache); put_page(swapcache); } + if (need_clear_cache) + swapcache_clear(si, entry); if (si) put_swap_device(si); return ret; diff --git a/mm/swapfile.c b/mm/swapfile.c index 97813b3a15dd..4aa7339bb365 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -3688,6 +3688,19 @@ int swapcache_prepare(swp_entry_t entry) return __swap_duplicate(entry, SWAP_HAS_CACHE); } +void swapcache_clear(struct swap_info_struct *si, swp_entry_t entry) +{ + struct swap_cluster_info *ci; + unsigned long offset = swp_offset(entry); + unsigned char usage; + + ci = lock_cluster_or_swap_info(si, offset); + usage = __swap_entry_free_locked(si, offset, SWAP_HAS_CACHE); + unlock_cluster_or_swap_info(si, ci); + if (!usage) + free_swap_slot(entry); +} + struct swap_info_struct *swp_swap_info(swp_entry_t entry) { return swap_type_to_swap_info(swp_type(entry)); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ipv6: sr: fix possible use-after-free and null-ptr-deref
by Liu Jian 11 Apr '24

11 Apr '24

From: Vasiliy Kovalev <kovalev(a)altlinux.org> stable inclusion from stable-v4.19.308 commit 953f42934533c151f440cd32390044d2396b87aa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E3E4 CVE: CVE-2024-26735 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 5559cea2d5aa3018a5f00dd2aca3427ba09b386b ] The pernet operations structure for the subsystem must be registered before registering the generic netlink family. Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6") Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Link: https://lore.kernel.org/r/20240215202717.29815-1-kovalev@altlinux.org Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv6/seg6.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c index 89d55770ac74..4bd601c96434 100644 --- a/net/ipv6/seg6.c +++ b/net/ipv6/seg6.c @@ -445,22 +445,24 @@ int __init seg6_init(void) { int err = -ENOMEM; - err = genl_register_family(&seg6_genl_family); + err = register_pernet_subsys(&ip6_segments_ops); if (err) goto out; - err = register_pernet_subsys(&ip6_segments_ops); + err = genl_register_family(&seg6_genl_family); if (err) - goto out_unregister_genl; + goto out_unregister_pernet; #ifdef CONFIG_IPV6_SEG6_LWTUNNEL err = seg6_iptunnel_init(); if (err) - goto out_unregister_pernet; + goto out_unregister_genl; err = seg6_local_init(); - if (err) - goto out_unregister_pernet; + if (err) { + seg6_iptunnel_exit(); + goto out_unregister_genl; + } #endif #ifdef CONFIG_IPV6_SEG6_HMAC @@ -481,11 +483,11 @@ int __init seg6_init(void) #endif #endif #ifdef CONFIG_IPV6_SEG6_LWTUNNEL -out_unregister_pernet: - unregister_pernet_subsys(&ip6_segments_ops); -#endif out_unregister_genl: genl_unregister_family(&seg6_genl_family); +#endif +out_unregister_pernet: + unregister_pernet_subsys(&ip6_segments_ops); goto out; } -- 2.34.1

2 1

[PATCH OLK-5.10] ipv6: sr: fix possible use-after-free and null-ptr-deref
by Liu Jian 11 Apr '24

11 Apr '24

From: Vasiliy Kovalev <kovalev(a)altlinux.org> stable inclusion from stable-v5.10.211 commit 65c38f23d10ff79feea1e5d50b76dc7af383c1e6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E3E4 CVE: CVE-2024-26735 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 5559cea2d5aa3018a5f00dd2aca3427ba09b386b ] The pernet operations structure for the subsystem must be registered before registering the generic netlink family. Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6") Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Link: https://lore.kernel.org/r/20240215202717.29815-1-kovalev@altlinux.org Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv6/seg6.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c index 45e3f1b552e0..d59eef2f41c6 100644 --- a/net/ipv6/seg6.c +++ b/net/ipv6/seg6.c @@ -455,22 +455,24 @@ int __init seg6_init(void) { int err; - err = genl_register_family(&seg6_genl_family); + err = register_pernet_subsys(&ip6_segments_ops); if (err) goto out; - err = register_pernet_subsys(&ip6_segments_ops); + err = genl_register_family(&seg6_genl_family); if (err) - goto out_unregister_genl; + goto out_unregister_pernet; #ifdef CONFIG_IPV6_SEG6_LWTUNNEL err = seg6_iptunnel_init(); if (err) - goto out_unregister_pernet; + goto out_unregister_genl; err = seg6_local_init(); - if (err) - goto out_unregister_pernet; + if (err) { + seg6_iptunnel_exit(); + goto out_unregister_genl; + } #endif #ifdef CONFIG_IPV6_SEG6_HMAC @@ -491,11 +493,11 @@ int __init seg6_init(void) #endif #endif #ifdef CONFIG_IPV6_SEG6_LWTUNNEL -out_unregister_pernet: - unregister_pernet_subsys(&ip6_segments_ops); -#endif out_unregister_genl: genl_unregister_family(&seg6_genl_family); +#endif +out_unregister_pernet: + unregister_pernet_subsys(&ip6_segments_ops); goto out; } -- 2.34.1

2 1

[PATCH OLK-6.6 v2] rootfs: Fix support for rootfstype= when root= is given
by GUO Zihua 11 Apr '24

11 Apr '24

From: Stefan Berger <stefanb(a)linux.ibm.com> stable inclusion from stable-v5.10.209 commit 3b8d7a1b851918cc3529a38a271c7a0ea8ad1217 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9FP1N CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 21528c69a0d8483f7c6345b1a0bc8d8975e9a172 upstream. Documentation/filesystems/ramfs-rootfs-initramfs.rst states: If CONFIG_TMPFS is enabled, rootfs will use tmpfs instead of ramfs by default. To force ramfs, add "rootfstype=ramfs" to the kernel command line. This currently does not work when root= is provided since then saved_root_name contains a string and rootfstype= is ignored. Therefore, ramfs is currently always chosen when root= is provided. The current behavior for rootfs's filesystem is: root= | rootfstype= | chosen rootfs filesystem ------------+-------------+-------------------------- unspecified | unspecified | tmpfs unspecified | tmpfs | tmpfs unspecified | ramfs | ramfs provided | ignored | ramfs rootfstype= should be respected regardless whether root= is given, as shown below: root= | rootfstype= | chosen rootfs filesystem ------------+-------------+-------------------------- unspecified | unspecified | tmpfs (as before) unspecified | tmpfs | tmpfs (as before) unspecified | ramfs | ramfs (as before) provided | unspecified | ramfs (compatibility with before) provided | tmpfs | tmpfs (new) provided | ramfs | ramfs (new) This table represents the new behavior. Fixes: 6e19eded3684 ("initmpfs: use initramfs if rootfstype= or root= specified") Cc: <stable(a)vger.kernel.org> Signed-off-by: Rob Landley <rob(a)landley.net> Link: https://lore.kernel.org/lkml/8244c75f-445e-b15b-9dbf-266e7ca666e2@landley.n… Reviewed-and-Tested-by: Mimi Zohar <zohar(a)linux.ibm.com> Signed-off-by: Stefan Berger <stefanb(a)linux.ibm.com> Link: https://lore.kernel.org/r/20231120011248.396012-1-stefanb@linux.ibm.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: init/do_mounts.c Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- v2: Fixed build error caused by remaining - mark. --- init/do_mounts.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/init/do_mounts.c b/init/do_mounts.c index 69bdd953ba87..2dd67d8a69a3 100644 --- a/init/do_mounts.c +++ b/init/do_mounts.c @@ -527,9 +527,14 @@ void __init init_rootfs(void) #ifdef CONFIG_IMA_DIGEST_LIST if (IS_ENABLED(CONFIG_TMPFS) && (!saved_root_name[0] || initramtmpfs) && -#else - if (IS_ENABLED(CONFIG_TMPFS) && !saved_root_name[0] && -#endif (!root_fs_names || strstr(root_fs_names, "tmpfs"))) is_tmpfs = true; +#else + if (IS_ENABLED(CONFIG_TMPFS)) { + if (!saved_root_name[0] && !root_fs_names) + is_tmpfs = true; + else if (root_fs_names && !!strstr(root_fs_names, "tmpfs")) + is_tmpfs = true; + } +#endif } -- 2.34.1

2 1

[PATCH OLK-5.10] IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
by Liu Jian 11 Apr '24

11 Apr '24

From: Daniel Vacek <neelx(a)redhat.com> stable inclusion from stable-v5.10.211 commit 3f38d22e645e2e994979426ea5a35186102ff3c2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2Y3 CVE: CVE-2024-26766 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- commit e6f57c6881916df39db7d95981a8ad2b9c3458d6 upstream. Unfortunately the commit `fd8958efe877` introduced another error causing the `descs` array to overflow. This reults in further crashes easily reproducible by `sendmsg` system call. [ 1080.836473] general protection fault, probably for non-canonical address 0x400300015528b00a: 0000 [#1] PREEMPT SMP PTI [ 1080.869326] RIP: 0010:hfi1_ipoib_build_ib_tx_headers.constprop.0+0xe1/0x2b0 [hfi1] -- [ 1080.974535] Call Trace: [ 1080.976990] <TASK> [ 1081.021929] hfi1_ipoib_send_dma_common+0x7a/0x2e0 [hfi1] [ 1081.027364] hfi1_ipoib_send_dma_list+0x62/0x270 [hfi1] [ 1081.032633] hfi1_ipoib_send+0x112/0x300 [hfi1] [ 1081.042001] ipoib_start_xmit+0x2a9/0x2d0 [ib_ipoib] [ 1081.046978] dev_hard_start_xmit+0xc4/0x210 -- [ 1081.148347] __sys_sendmsg+0x59/0xa0 crash> ipoib_txreq 0xffff9cfeba229f00 struct ipoib_txreq { txreq = { list = { next = 0xffff9cfeba229f00, prev = 0xffff9cfeba229f00 }, descp = 0xffff9cfeba229f40, coalesce_buf = 0x0, wait = 0xffff9cfea4e69a48, complete = 0xffffffffc0fe0760 <hfi1_ipoib_sdma_complete>, packet_len = 0x46d, tlen = 0x0, num_desc = 0x0, desc_limit = 0x6, next_descq_idx = 0x45c, coalesce_idx = 0x0, flags = 0x0, descs = {{ qw = {0x8024000120dffb00, 0x4} # SDMA_DESC0_FIRST_DESC_FLAG (bit 63) }, { qw = { 0x3800014231b108, 0x4} }, { qw = { 0x310000e4ee0fcf0, 0x8} }, { qw = { 0x3000012e9f8000, 0x8} }, { qw = { 0x59000dfb9d0000, 0x8} }, { qw = { 0x78000e02e40000, 0x8} }} }, sdma_hdr = 0x400300015528b000, <<< invalid pointer in the tx request structure sdma_status = 0x0, SDMA_DESC0_LAST_DESC_FLAG (bit 62) complete = 0x0, priv = 0x0, txq = 0xffff9cfea4e69880, skb = 0xffff9d099809f400 } If an SDMA send consists of exactly 6 descriptors and requires dword padding (in the 7th descriptor), the sdma_txreq descriptor array is not properly expanded and the packet will overflow into the container structure. This results in a panic when the send completion runs. The exact panic varies depending on what elements of the container structure get corrupted. The fix is to use the correct expression in _pad_sdma_tx_descs() to test the need to expand the descriptor array. With this patch the crashes are no longer reproducible and the machine is stable. Fixes: fd8958efe877 ("IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors") Cc: stable(a)vger.kernel.org Reported-by: Mats Kronberg <kronberg(a)nsc.liu.se> Tested-by: Mats Kronberg <kronberg(a)nsc.liu.se> Signed-off-by: Daniel Vacek <neelx(a)redhat.com> Link: https://lore.kernel.org/r/20240201081009.1109442-1-neelx@redhat.com Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/hw/hfi1/sdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c index 2dc97de434a5..68a8557e9a7c 100644 --- a/drivers/infiniband/hw/hfi1/sdma.c +++ b/drivers/infiniband/hw/hfi1/sdma.c @@ -3200,7 +3200,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) { int rval = 0; - if ((unlikely(tx->num_desc + 1 == tx->desc_limit))) { + if ((unlikely(tx->num_desc == tx->desc_limit))) { rval = _extend_sdma_tx_descs(dd, tx); if (rval) { __sdma_txclean(dd, tx); -- 2.34.1

2 1

[PATCH OLK-6.6] rootfs: Fix support for rootfstype= when root= is given
by GUO Zihua 11 Apr '24

11 Apr '24

From: Stefan Berger <stefanb(a)linux.ibm.com> stable inclusion from stable-v5.10.209 commit 3b8d7a1b851918cc3529a38a271c7a0ea8ad1217 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9FP1N CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 21528c69a0d8483f7c6345b1a0bc8d8975e9a172 upstream. Documentation/filesystems/ramfs-rootfs-initramfs.rst states: If CONFIG_TMPFS is enabled, rootfs will use tmpfs instead of ramfs by default. To force ramfs, add "rootfstype=ramfs" to the kernel command line. This currently does not work when root= is provided since then saved_root_name contains a string and rootfstype= is ignored. Therefore, ramfs is currently always chosen when root= is provided. The current behavior for rootfs's filesystem is: root= | rootfstype= | chosen rootfs filesystem ------------+-------------+-------------------------- unspecified | unspecified | tmpfs unspecified | tmpfs | tmpfs unspecified | ramfs | ramfs provided | ignored | ramfs rootfstype= should be respected regardless whether root= is given, as shown below: root= | rootfstype= | chosen rootfs filesystem ------------+-------------+-------------------------- unspecified | unspecified | tmpfs (as before) unspecified | tmpfs | tmpfs (as before) unspecified | ramfs | ramfs (as before) provided | unspecified | ramfs (compatibility with before) provided | tmpfs | tmpfs (new) provided | ramfs | ramfs (new) This table represents the new behavior. Fixes: 6e19eded3684 ("initmpfs: use initramfs if rootfstype= or root= specified") Cc: <stable(a)vger.kernel.org> Signed-off-by: Rob Landley <rob(a)landley.net> Link: https://lore.kernel.org/lkml/8244c75f-445e-b15b-9dbf-266e7ca666e2@landley.n… Reviewed-and-Tested-by: Mimi Zohar <zohar(a)linux.ibm.com> Signed-off-by: Stefan Berger <stefanb(a)linux.ibm.com> Link: https://lore.kernel.org/r/20231120011248.396012-1-stefanb@linux.ibm.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: init/do_mounts.c Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- init/do_mounts.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/init/do_mounts.c b/init/do_mounts.c index 69bdd953ba87..178e37340a23 100644 --- a/init/do_mounts.c +++ b/init/do_mounts.c @@ -527,9 +527,14 @@ void __init init_rootfs(void) #ifdef CONFIG_IMA_DIGEST_LIST if (IS_ENABLED(CONFIG_TMPFS) && (!saved_root_name[0] || initramtmpfs) && +- (!root_fs_names || strstr(root_fs_names, "tmpfs"))) +- is_tmpfs = true; #else - if (IS_ENABLED(CONFIG_TMPFS) && !saved_root_name[0] && + if (IS_ENABLED(CONFIG_TMPFS)) { + if (!saved_root_name[0] && !root_fs_names) + is_tmpfs = true; + else if (root_fs_names && !!strstr(root_fs_names, "tmpfs")) + is_tmpfs = true; + } #endif - (!root_fs_names || strstr(root_fs_names, "tmpfs"))) - is_tmpfs = true; } -- 2.34.1

2 1

[PATCH OLK-5.10 0/5] cvm feature patches
by hejingxian 11 Apr '24

11 Apr '24

From: Jingxian He <hejingxian(a)huawei.com> Add cvm feature patches: 1. add cvm host feature 2. enable pmu phys irq inject for cvm 3. add bounce buffer feature for cvm guest 4. add lpi support for cvm guest 5. fix kabi for cvm host arch/arm64/configs/defconfig | 2 + arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/include/asm/cvm_guest.h | 21 + arch/arm64/include/asm/kvm_emulate.h | 18 + arch/arm64/include/asm/kvm_host.h | 28 +- arch/arm64/include/asm/kvm_tmi.h | 377 +++++++++++ arch/arm64/include/asm/kvm_tmm.h | 73 +++ arch/arm64/kvm/Kconfig | 16 + arch/arm64/kvm/Makefile | 5 + arch/arm64/kvm/arch_timer.c | 104 ++- arch/arm64/kvm/arm.c | 157 ++++- arch/arm64/kvm/cvm.c | 869 +++++++++++++++++++++++++ arch/arm64/kvm/cvm_exit.c | 240 +++++++ arch/arm64/kvm/cvm_guest.c | 91 +++ arch/arm64/kvm/guest.c | 8 + arch/arm64/kvm/hisilicon/hisi_virt.c | 7 + arch/arm64/kvm/hyp/vgic-v3-sr.c | 19 + arch/arm64/kvm/mmio.c | 19 + arch/arm64/kvm/mmu.c | 7 + arch/arm64/kvm/pmu-emul.c | 10 + arch/arm64/kvm/psci.c | 12 +- arch/arm64/kvm/reset.c | 10 + arch/arm64/kvm/tmi.c | 168 +++++ arch/arm64/kvm/vgic/vgic-v3.c | 18 +- arch/arm64/kvm/vgic/vgic.c | 59 +- arch/arm64/mm/mmu.c | 11 + arch/arm64/mm/pageattr.c | 9 +- drivers/irqchip/irq-gic-v3-its.c | 229 ++++++- drivers/perf/arm_pmu.c | 17 + include/kvm/arm_arch_timer.h | 4 + include/linux/kvm_host.h | 23 + include/linux/perf/arm_pmu.h | 3 + include/linux/swiotlb.h | 13 + include/uapi/linux/kvm.h | 27 + kernel/dma/direct.c | 39 ++ kernel/dma/swiotlb.c | 86 ++- virt/kvm/kvm_main.c | 7 +- 37 files changed, 2765 insertions(+), 43 deletions(-) create mode 100644 arch/arm64/include/asm/cvm_guest.h create mode 100644 arch/arm64/include/asm/kvm_tmi.h create mode 100644 arch/arm64/include/asm/kvm_tmm.h create mode 100644 arch/arm64/kvm/cvm.c create mode 100644 arch/arm64/kvm/cvm_exit.c create mode 100644 arch/arm64/kvm/cvm_guest.c create mode 100644 arch/arm64/kvm/tmi.c -- 2.33.0

2 6

[openeuler:OLK-5.10] BUILD SUCCESS f1776d0ca22cf72bfcdc93dced47d9dde9934d97
by kernel test robot 11 Apr '24

11 Apr '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: f1776d0ca22cf72bfcdc93dced47d9dde9934d97 !5943 CVE-2021-46926 Warning reports: https://lore.kernel.org/oe-kbuild-all/202404102205.GZY9jAYq-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202404110414.lls2ROdf-lkp@intel.com Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-randconfig-003-20240411 `-- arch-arm64-kernel-smp.c:warning:no-previous-prototype-for-hw_nmi_get_sample_period clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-infiniband-hw-xsc-mem.c:warning:no-previous-prototype-for-function-xsc_find_chunk_cont_0 | |-- drivers-infiniband-hw-xsc-mr.c:warning:variable-using_peer_mem-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-eecd-description-in-rnpm_lower_eeprom_clk | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-hash_value-description-in-rnpm_set_mta | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-hw-description-in-rnpm_mta_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-pf-description-in-rnpm_set_vlan_anti_spoofing | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-count-not-described-in-rnpm_shift_in_eeprom_bits | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-eec-not-described-in-rnpm_lower_eeprom_clk | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-mc_addr-not-described-in-rnpm_set_mta | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-mode-not-described-in-rnpm_mta_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-vf-not-described-in-rnpm_set_vlan_anti_spoofing | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnpm_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-dev-description-in-rnpm_get_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-dev-description-in-rnpm_set_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnpm_get_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-ee-description-in-rnpm_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-flags-description-in-rnpm_set_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-kec-description-in-rnpm_get_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-kec-description-in-rnpm_set_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_module_info | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_rxnfc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-pf-description-in-rnpm_get_rss_hash_opts | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_get_rss_hash_opts | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnpm_get_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_module_info | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_rxnfc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-eeprom-not-described-in-rnpm_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnpm_get_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnpm_set_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-netdev-not-described-in-rnpm_get_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-netdev-not-described-in-rnpm_set_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-priv_flags-not-described-in-rnpm_set_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-autoneg_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-dma_ch-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-duplex_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-v_count-description-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_layer2_remapping | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_tuple5_remapping | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_tuple5_remapping_tcam | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-data-description-in-rnpm_pf_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-data-description-in-rnpm_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-ent-description-in-rnpm_probe | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-hw-description-in-rnpm_wol_supported | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-link_speed-description-in-rnpm_watchdog_update_link | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-maxrate-description-in-rnpm_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpm_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-netdev-description-in-rnpm_setup_tc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-netdev-description-in-rnpm_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-pb-description-in-rnpm_lpbthresh | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-queue-description-in-rnpm_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-skb-description-in-rnpm_is_non_eop | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnpm_wol_supported | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_setup_rx_resources | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_setup_tx_resources | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_wol_supported | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_setup_tc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-id-not-described-in-rnpm_probe | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-is_rxframe-not-described-in-rnpm_write_eitr | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnpm_clean_tx_irq | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-rnpm_msix_vector-not-described-in-rnpm_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-rnpm_queue-not-described-in-rnpm_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnpm_wol_supported | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpm_pf_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpm_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnpm_tx_timeout | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-clean_all_port_resetting | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-control_mac_rx | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_can_rpu_start | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_check_mc_addr | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_clear_udp_tunnel_port | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_fix_queue_number | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_event_schedule | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_task | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_write_eitr | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_xmit_nop_frame_ring_temp | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-update_pf_vlan | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-wait_all_port_resetting | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-hw-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-packets-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-mbx_cookie_zalloc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_get_capablity | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_reg_read | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_send_cmd_wait | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_get_port_stats2 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_link_stat_mark_disable | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_fw_post_req | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_pluginout_evt_en | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_write_posted_locked | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-err-is-uninitialized-when-used-here | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-hw-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-value-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Excess-function-parameter-atr_input-description-in-rnpm_atr_compute_perfect_hash_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Excess-function-parameter-stream-description-in-rnpm_atr_compute_sig_hash_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-common-not-described-in-rnpm_atr_compute_sig_hash_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-input-not-described-in-rnpm_atr_compute_perfect_hash_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-input-not-described-in-rnpm_atr_compute_sig_hash_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:no-previous-prototype-for-function-rnpm_reset_pipeline_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:variable-status-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-eeprom_data-description-in-rnpm_read_i2c_sff8472_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-hw-description-in-rnpm_get_i2c_data | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-hw-description-in-rnpm_get_phy_type_from_id | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-autoneg_wait_to_complete-not-described-in-rnpm_setup_phy_link_speed_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-dev_addr-not-described-in-rnpm_read_i2c_byte_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-dev_addr-not-described-in-rnpm_write_i2c_byte_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-device_type-not-described-in-rnpm_read_phy_reg_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-link_up-not-described-in-rnpm_check_phy_link_tnx | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-phy_id-not-described-in-rnpm_get_phy_type_from_id | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-sff8472_data-not-described-in-rnpm_read_i2c_sff8472_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-speed-not-described-in-rnpm_check_phy_link_tnx | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:no-previous-prototype-for-function-rnpm_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:variable-target-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sysfs.c:warning:no-previous-prototype-for-function-rnpm_mbx_get_pn_sn | |-- drivers-net-ethernet-yunsilicon-xsc-common-xsc_core.h:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_eth_change_link_status | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_get_vf_config | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_rx_get_linear_frag_sz | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_rx_is_linear_skb | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_select_queue | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:variable-txq_ix-is-uninitialized-when-used-here | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-buffer_size-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-curr_pfc_en-is-uninitialized-when-used-here | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-prio2buffer-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-pci-main.c:warning:no-previous-prototype-for-function-xsc_devid_to_pcie_no | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_pci_ctrl.c:warning:no-previous-prototype-for-function-find_kallsyms_lookup_name | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_pci_ctrl.c:warning:no-previous-prototype-for-function-noop_pre | |-- drivers-net-ethernet-yusur-k2-..-platform-ys_intr.c:warning:overlapping-comparisons-always-evaluate-to-false | `-- drivers-net-ethernet-yusur-k2-ys_k2_tx.c:warning:variable-clean_tail_ptr-set-but-not-used `-- x86_64-randconfig-r122-20240410 |-- drivers-gpu-drm-inspur-inspur_cursor.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression |-- drivers-gpu-drm-inspur-inspur_drm_drv.c:sparse:sparse:symbol-inspur_drm_interrupt-was-not-declared.-Should-it-be-static |-- drivers-video-fbdev-ls2k500sfb.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-char-preg |-- drivers-video-fbdev-ls2k500sfb.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-void |-- drivers-video-fbdev-ls2k500sfb.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-void-static-p |-- drivers-video-fbdev-ls2k500sfb.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-addr-got-char-preg |-- drivers-video-fbdev-ls2k500sfb.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-addr-got-void-static-p |-- drivers-video-fbdev-ls2k500sfb.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-char-penv-got-void-noderef-__iomem |-- drivers-video-fbdev-ls2k500sfb.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-char-preg-got-void-noderef-__iomem |-- drivers-video-fbdev-ls2k500sfb.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-static-p-got-void-noderef-__iomem `-- drivers-video-fbdev-ls2k500sfb.c:sparse:sparse:symbol-ls2k500sfb_interrupt-was-not-declared.-Should-it-be-static elapsed time: 742m configs tested: 26 configs skipped: 148 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240411 clang arm64 randconfig-002-20240411 gcc arm64 randconfig-003-20240411 gcc arm64 randconfig-004-20240411 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240411 gcc x86_64 buildonly-randconfig-002-20240411 clang x86_64 buildonly-randconfig-003-20240411 clang x86_64 buildonly-randconfig-004-20240411 gcc x86_64 buildonly-randconfig-005-20240411 clang x86_64 buildonly-randconfig-006-20240411 clang x86_64 defconfig gcc x86_64 randconfig-001-20240411 clang x86_64 randconfig-002-20240411 clang x86_64 randconfig-003-20240411 gcc x86_64 randconfig-004-20240411 clang x86_64 randconfig-005-20240411 gcc x86_64 randconfig-006-20240411 clang x86_64 randconfig-011-20240411 clang x86_64 randconfig-012-20240411 gcc x86_64 randconfig-014-20240411 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 9b7534a0d66b224a89df1826d1494d121b15ada5
by kernel test robot 11 Apr '24

11 Apr '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 9b7534a0d66b224a89df1826d1494d121b15ada5 !5926 RDMA/srpt: Support specifying the srpt_service_guid parameter Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202404110253.L2D6kNbe-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/mmc/host/phytium-mci-pci.c:171:26: warning: 'phytium_mci_pci_driver' defined but not used [-Wunused-variable] drivers/mmc/host/phytium-mci-pci.c:180:1: error: type defaults to 'int' in declaration of 'module_pci_driver' [-Werror=implicit-int] drivers/mmc/host/phytium-mci-pci.c:180:1: warning: data definition has no type or storage class drivers/mmc/host/phytium-mci-pci.c:180:1: warning: parameter names (without types) in function declaration drivers/mmc/host/phytium-mci-pci.c:48:15: error: implicit declaration of function 'pcim_enable_device'; did you mean 'pci_enable_device'? [-Werror=implicit-function-declaration] drivers/mmc/host/phytium-mci-pci.c:61:9: error: implicit declaration of function 'pci_enable_msi'; did you mean 'pci_enable_sriov'? [-Werror=implicit-function-declaration] Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- arm64-defconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- arm64-randconfig-001-20240411 | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- arm64-randconfig-002-20240411 | |-- arch-arm64-kernel-cpufeature.c:error:a32_elf_hwcap2-undeclared-(first-use-in-this-function) | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | |-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized | |-- drivers-mmc-host-phytium-mci-pci.c:error:implicit-declaration-of-function-pci_enable_msi | |-- drivers-mmc-host-phytium-mci-pci.c:error:implicit-declaration-of-function-pcim_enable_device | |-- drivers-mmc-host-phytium-mci-pci.c:error:type-defaults-to-int-in-declaration-of-module_pci_driver | |-- drivers-mmc-host-phytium-mci-pci.c:warning:data-definition-has-no-type-or-storage-class | |-- drivers-mmc-host-phytium-mci-pci.c:warning:parameter-names-(without-types)-in-function-declaration | `-- drivers-mmc-host-phytium-mci-pci.c:warning:phytium_mci_pci_driver-defined-but-not-used `-- arm64-randconfig-004-20240411 |-- arch-arm64-kernel-watchdog_sdei.c:error:watchdog_thresh-undeclared-(first-use-in-this-function) |-- kernel-watchdog_hld.c:error:implicit-declaration-of-function-is_hardlockup `-- kernel-watchdog_hld.c:error:sysctl_hardlockup_all_cpu_backtrace-undeclared-(first-use-in-this-function) clang_recent_errors `-- x86_64-randconfig-r113-20240411 |-- drivers-pci-controller-hisi-pcie-customer-hisi_pcie_cae.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-to-got-void |-- drivers-pci-rom.c:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-void-noderef-asn-got-void |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-long-long-noderef-usertype-asn-off_in-got-long-long-usertype-assigned-poff_in |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-long-long-noderef-usertype-asn-off_out-got-long-long-usertype-assigned-poff_out |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-file-assigned-file-got-struct-file-noderef-asn |-- fs-io_uring.c:sparse:sparse:incorrect-type-in-return-expression-(different-address-spaces)-expected-void-noderef-asn-got-struct-io_buffer-assigned-kbuf |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-int-noderef-pmu_disable_count |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-got-struct-perf_cpu_context-noderef-pmu_cpu_context |-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-int `-- kernel-events-core.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-asn-got-struct-perf_cpu_context elapsed time: 738m configs tested: 11 configs skipped: 148 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240411 gcc arm64 randconfig-002-20240411 gcc arm64 randconfig-003-20240411 gcc arm64 randconfig-004-20240411 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION b4a3ad1c3275f9d45e0877a85dd1408701227279
by kernel test robot 11 Apr '24

11 Apr '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: b4a3ad1c3275f9d45e0877a85dd1408701227279 !5877 optimize eevdf scheduler Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202404110502.krefKWQW-lkp@intel.com Unverified Error/Warning (likely false positive, please contact us if interested): mm/share_pool.c:1226:14: error: call to undeclared function 'huge_ptep_get'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] mm/share_pool.c:1226:8: error: initializing 'pte_t' with an expression of incompatible type 'int' Error/Warning ids grouped by kconfigs: gcc_recent_errors `-- loongarch-allmodconfig |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-netdev-not-described-in-rnp_netpoll |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-Polling-interrupt-().-Prototype-was-for-rnp_netpoll()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_ethtool.c:warning:no-previous-prototype-for-rnpgbevf_get_ringparam |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_ethtool.c:warning:no-previous-prototype-for-rnpgbevf_set_ringparam |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_ethtool.c:warning:rnp_gstrings_test-defined-but-not-used |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_alloc_rx_buffers |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_assign_netdev_ops |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_configure_rx_ring |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_configure_tx_ring |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_disable_rx_queue |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_enable_rx_queue |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_maybe_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_unmap_and_free_tx_resource |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_write_eitr_rx |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_xmit_frame_ring |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_addr_list_itr |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_get_queues |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_negotiate_api_version |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_set_veb_mac_n500 |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_set_vlan_n500 |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-rnpm_get_phy_statistics |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_layer2_remapping |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_tuple5_remapping |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_tuple5_remapping_tcam |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-clean_all_port_resetting |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-control_mac_rx |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_assign_netdev_ops |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_can_rpu_start |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_check_mc_addr |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_clear_udp_tunnel_port |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_fix_queue_number |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_event_schedule |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_task |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_rx_ring_reinit |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_vlan_stags_flag |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_write_eitr |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_xmit_nop_frame_ring |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_xmit_nop_frame_ring_temp |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-update_pf_vlan |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-wait_all_port_resetting |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:build_writereg_req-accessing-bytes-in-a-region-of-size |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-mbx_cookie_zalloc |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_get_capablity |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_reg_read |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_send_cmd_wait |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_get_port_stats2 |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_link_stat_mark_disable |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_fw_post_req |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_pluginout_evt_en |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_write_posted_locked |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:no-previous-prototype-for-rnpm_reset_pipeline_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:no-previous-prototype-for-rnpm_ptp_setup_ptp |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:suggest-braces-around-empty-body-in-an-if-statement |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-rnpm_get_vf_ringnum |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-rnpm_setup_ring_maxrate |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_sysfs.c:warning:no-previous-prototype-for-rnpm_mbx_get_pn_sn |-- drivers-net-ethernet-mucse-rnpm-rnpm_tc_u32_parse.h:warning:rnpm_ipv4_parser-defined-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:no-previous-prototype-for-rnpvf_get_ringparam |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:rnp_gstrings_test-defined-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-queue_idx-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_ack_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_msg_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_rst_msg_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_obtain_mbx_lock_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_ack |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_msg |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_mbx_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_posted_mbx |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_mbx_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_posted_mbx |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-data-description-in-rnpvf_watchdog |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-rx_ring-description-in-rnpvf_pull_tail |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-skb-description-in-rnpvf_is_non_eop |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_msix_vector-not-described-in-rnpvf_set_ring_vector |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_queue-not-described-in-rnpvf_set_ring_vector |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpvf_watchdog |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-type-not-described-in-rnpvf_update_itr |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_irq().-Prototype-was-for-rnpvf_clean_rx_irq()-instead |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_ring().-Prototype-was-for-rnpvf_clean_rx_ring()-instead |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_set_ivar().-Prototype-was-for-rnpvf_set_ring_vector()-instead |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_write_eitr().-Prototype-was-for-rnpvf_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_alloc_rx_buffers |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_assign_netdev_ops |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_configure_rx_ring |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_configure_tx_ring |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_disable_rx_queue |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_enable_rx_queue |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_maybe_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_unmap_and_free_tx_resource |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_write_eitr_rx |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_xmit_frame_ring |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-update_rx_count |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-err-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-hw-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-vector_threshold-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:Excess-function-parameter-mac_addr-description-in-rnpvf_get_queues_vf |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_addr_list_itr |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_get_queues |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_negotiate_api_version |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_set_veb_mac_n10 |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_set_vlan_n10 `-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:variable-number_of_queues-set-but-not-used clang_recent_errors |-- arm64-allmodconfig | |-- drivers-net-ethernet-huawei-hinic-hinic_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_cfg.c:warning:arithmetic-between-different-enumeration-types-(-enum-hinic_node_id-and-enum-hinic_fault_err_level-) | |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_register_sw_cb().-Prototype-was-for-hinic_aeq_register_swe_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_unregister_sw_cb().-Prototype-was-for-hinic_aeq_unregister_swe_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_ceq_register_sw_cb().-Prototype-was-for-hinic_ceq_register_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_hwdev.c:warning:arithmetic-between-different-enumeration-types-(-enum-hinic_node_id-and-enum-hinic_fault_err_level-) | |-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_ppf_to_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic-hinic_nic_dbg.c:warning:arithmetic-between-different-enumeration-types-(-enum-hinic_node_id-and-enum-hinic_fault_err_level-) | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-alloc_cmd_buf().-Prototype-was-for-alloc_resp_buf()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_devlink.c:warning:variable-pdev-set-but-not-used | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_ppf_to_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_free().-Prototype-was-for-hinic3_pf_to_mgmt_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_init().-Prototype-was-for-hinic3_pf_to_mgmt_init()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-netdev-not-described-in-rnp_netpoll | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-Polling-interrupt-().-Prototype-was-for-rnp_netpoll()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-function-rnpm_get_phy_statistics | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_get_vf_ringnum | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_setup_ring_maxrate | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:no-previous-prototype-for-function-rnpvf_get_ringparam | |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:unused-variable-rnp_gstrings_test | |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-advertising-is-uninitialized-when-used-here | |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-advertising-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-queue_idx-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_ack_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_msg_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_rst_msg_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_obtain_mbx_lock_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_ack | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_msg | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_mbx_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_posted_mbx | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_mbx_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_posted_mbx | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-data-description-in-rnpvf_watchdog | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-rx_ring-description-in-rnpvf_pull_tail | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-skb-description-in-rnpvf_is_non_eop | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_msix_vector-not-described-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_queue-not-described-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpvf_watchdog | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-type-not-described-in-rnpvf_update_itr | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_irq().-Prototype-was-for-rnpvf_clean_rx_irq()-instead | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_ring().-Prototype-was-for-rnpvf_clean_rx_ring()-instead | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_set_ivar().-Prototype-was-for-rnpvf_set_ring_vector()-instead | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_write_eitr().-Prototype-was-for-rnpvf_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_alloc_rx_buffers | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_configure_rx_ring | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_configure_tx_ring | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_disable_rx_queue | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_enable_rx_queue | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_maybe_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_unmap_and_free_tx_resource | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_write_eitr_rx | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_xmit_frame_ring | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-update_rx_count | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-hw-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-ring_csum_err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-ring_csum_good-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-vector_threshold-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:Excess-function-parameter-mac_addr-description-in-rnpvf_get_queues_vf | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_addr_list_itr | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_get_queues | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_negotiate_api_version | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_set_veb_mac_n10 | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_set_vlan_n10 | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:variable-number_of_queues-set-but-not-used | |-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_cq().-Prototype-was-for-hiraid_create_complete_queue()-instead | |-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_sq().-Prototype-was-for-hiraid_create_send_queue()-instead | |-- include-linux-vmstat.h:error:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-)-Werror-Wenum-enum-conversion | `-- include-linux-vmstat.h:error:arithmetic-between-different-enumeration-types-(-enum-zone_stat_item-and-enum-numa_stat_item-)-Werror-Wenum-enum-conversion |-- arm64-randconfig-001-20240411 | |-- mm-share_pool.c:error:call-to-undeclared-function-huge_ptep_get-ISO-C99-and-later-do-not-support-implicit-function-declarations | `-- mm-share_pool.c:error:initializing-pte_t-with-an-expression-of-incompatible-type-int |-- x86_64-allyesconfig | |-- drivers-net-ethernet-huawei-hinic-hinic_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_register_sw_cb().-Prototype-was-for-hinic_aeq_register_swe_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_unregister_sw_cb().-Prototype-was-for-hinic_aeq_unregister_swe_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_ceq_register_sw_cb().-Prototype-was-for-hinic_ceq_register_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_ppf_to_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-alloc_cmd_buf().-Prototype-was-for-alloc_resp_buf()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_devlink.c:warning:variable-pdev-set-but-not-used | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_ppf_to_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_free().-Prototype-was-for-hinic3_pf_to_mgmt_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_init().-Prototype-was-for-hinic3_pf_to_mgmt_init()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-netdev-not-described-in-rnp_netpoll | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-Polling-interrupt-().-Prototype-was-for-rnp_netpoll()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-function-rnpm_get_phy_statistics | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_get_vf_ringnum | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_setup_ring_maxrate | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:no-previous-prototype-for-function-rnpvf_get_ringparam | |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:unused-variable-rnp_gstrings_test | |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-advertising-is-uninitialized-when-used-here | |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-advertising-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-queue_idx-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_ack_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_msg_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_rst_msg_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_obtain_mbx_lock_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_ack | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_msg | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_mbx_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_posted_mbx | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_mbx_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_posted_mbx | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-data-description-in-rnpvf_watchdog | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-rx_ring-description-in-rnpvf_pull_tail | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-skb-description-in-rnpvf_is_non_eop | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_msix_vector-not-described-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_queue-not-described-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpvf_watchdog | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-type-not-described-in-rnpvf_update_itr | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_irq().-Prototype-was-for-rnpvf_clean_rx_irq()-instead | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_ring().-Prototype-was-for-rnpvf_clean_rx_ring()-instead | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_set_ivar().-Prototype-was-for-rnpvf_set_ring_vector()-instead | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_write_eitr().-Prototype-was-for-rnpvf_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_alloc_rx_buffers | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_configure_rx_ring | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_configure_tx_ring | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_disable_rx_queue | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_enable_rx_queue | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_maybe_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_unmap_and_free_tx_resource | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_write_eitr_rx | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_xmit_frame_ring | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-update_rx_count | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-hw-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-ring_csum_err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-ring_csum_good-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-vector_threshold-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:Excess-function-parameter-mac_addr-description-in-rnpvf_get_queues_vf | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_addr_list_itr | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_get_queues | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_negotiate_api_version | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_set_veb_mac_n10 | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_set_vlan_n10 | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:variable-number_of_queues-set-but-not-used | |-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_cq().-Prototype-was-for-hiraid_create_complete_queue()-instead | `-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_sq().-Prototype-was-for-hiraid_create_send_queue()-instead `-- x86_64-randconfig-001-20240411 |-- drivers-net-ethernet-huawei-hinic-hinic_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:incomplete-definition-of-type-struct-ieee_ets |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:incomplete-definition-of-type-struct-ieee_pfc |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-application-of-sizeof-to-an-incomplete-type-struct-ieee_ets |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-application-of-sizeof-to-an-incomplete-type-struct-ieee_pfc |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:use-of-undeclared-identifier-DCB_ATTR_VALUE_UNDEFINED |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:use-of-undeclared-identifier-DCB_CAP_DCBX_HOST |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:use-of-undeclared-identifier-DCB_CAP_DCBX_VER_CEE |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_register_sw_cb().-Prototype-was-for-hinic_aeq_register_swe_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_unregister_sw_cb().-Prototype-was-for-hinic_aeq_unregister_swe_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_ceq_register_sw_cb().-Prototype-was-for-hinic_ceq_register_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- drivers-net-ethernet-huawei-hinic-hinic_main.c:error:no-member-named-dcbnl_ops-in-struct-net_device |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_pf_mbox_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_ppf_to_pf_mbox_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- drivers-net-ethernet-huawei-hinic-hinic_nic_dev.h:error:field-has-incomplete-type-struct-ieee_ets `-- drivers-net-ethernet-huawei-hinic-hinic_nic_dev.h:error:field-has-incomplete-type-struct-ieee_pfc elapsed time: 737m configs tested: 34 configs skipped: 143 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240411 clang arm64 randconfig-002-20240411 gcc arm64 randconfig-003-20240411 gcc arm64 randconfig-004-20240411 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240411 gcc loongarch randconfig-002-20240411 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240411 gcc x86_64 buildonly-randconfig-002-20240411 clang x86_64 buildonly-randconfig-003-20240411 clang x86_64 buildonly-randconfig-004-20240411 gcc x86_64 buildonly-randconfig-005-20240411 clang x86_64 buildonly-randconfig-006-20240411 clang x86_64 defconfig gcc x86_64 randconfig-001-20240411 clang x86_64 randconfig-002-20240411 clang x86_64 randconfig-003-20240411 gcc x86_64 randconfig-004-20240411 clang x86_64 randconfig-005-20240411 gcc x86_64 randconfig-006-20240411 clang x86_64 randconfig-011-20240411 clang x86_64 randconfig-012-20240411 gcc x86_64 randconfig-013-20240411 clang x86_64 randconfig-014-20240411 gcc x86_64 randconfig-015-20240411 gcc x86_64 randconfig-016-20240411 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7335/7359] include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item')
by kernel test robot 11 Apr '24

11 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b4a3ad1c3275f9d45e0877a85dd1408701227279 commit: 6864d14bb90f03a1e5b7fbcc04fc2ba4d692bd3e [7335/7359] support 3SNIC 910/920/930 NIC config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240411/202404110502.krefKWQW-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project 8b3b4a92adee40483c27f26c478a384cd69c6f05) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240411/202404110502.krefKWQW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404110502.krefKWQW-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:6: In file included from include/linux/pci.h:1663: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2204: >> include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> include/linux/vmstat.h:522:36: error: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Werror,-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:883:6: error: no previous prototype for function 'sss_nic_port_module_cable_plug' [-Werror,-Wmissing-prototypes] 883 | void sss_nic_port_module_cable_plug(struct sss_nic_dev *nic_dev, void *event_data) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:883:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 883 | void sss_nic_port_module_cable_plug(struct sss_nic_dev *nic_dev, void *event_data) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:889:6: error: no previous prototype for function 'sss_nic_port_module_cable_unplug' [-Werror,-Wmissing-prototypes] 889 | void sss_nic_port_module_cable_unplug(struct sss_nic_dev *nic_dev, void *event_data) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:889:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 889 | void sss_nic_port_module_cable_unplug(struct sss_nic_dev *nic_dev, void *event_data) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:895:6: error: no previous prototype for function 'sss_nic_port_module_link_err' [-Werror,-Wmissing-prototypes] 895 | void sss_nic_port_module_link_err(struct sss_nic_dev *nic_dev, void *event_data) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:895:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 895 | void sss_nic_port_module_link_err(struct sss_nic_dev *nic_dev, void *event_data) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1034:22: error: no previous prototype for function 'get_nic_uld_info' [-Werror,-Wmissing-prototypes] 1034 | struct sss_uld_info *get_nic_uld_info(void) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1034:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1034 | struct sss_uld_info *get_nic_uld_info(void) | ^ | static 9 errors generated. -- In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx.c:6: In file included from include/net/xfrm.h:9: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/arm64/include/asm/cacheflush.h:11: In file included from include/linux/kgdb.h:19: In file included from include/linux/kprobes.h:28: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2204: >> include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> include/linux/vmstat.h:522:36: error: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Werror,-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ 5 errors generated. -- In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:6: In file included from include/net/xfrm.h:9: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/arm64/include/asm/cacheflush.h:11: In file included from include/linux/kgdb.h:19: In file included from include/linux/kprobes.h:28: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2204: >> include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> include/linux/vmstat.h:522:36: error: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Werror,-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:42:5: error: no previous prototype for function 'sss_nic_alloc_sq_resource' [-Werror,-Wmissing-prototypes] 42 | int sss_nic_alloc_sq_resource(struct sss_nic_dev *nic_dev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:42:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 42 | int sss_nic_alloc_sq_resource(struct sss_nic_dev *nic_dev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:87:6: error: no previous prototype for function 'sss_nic_free_sq_resource' [-Werror,-Wmissing-prototypes] 87 | void sss_nic_free_sq_resource(struct sss_nic_dev *nic_dev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:87:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 87 | void sss_nic_free_sq_resource(struct sss_nic_dev *nic_dev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:104:6: error: no previous prototype for function 'sss_nic_init_all_sq' [-Werror,-Wmissing-prototypes] 104 | void sss_nic_init_all_sq(struct sss_nic_dev *nic_dev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:104:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 104 | void sss_nic_init_all_sq(struct sss_nic_dev *nic_dev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:128:5: error: no previous prototype for function 'sss_nic_alloc_sq_desc_group' [-Werror,-Wmissing-prototypes] 128 | int sss_nic_alloc_sq_desc_group(struct sss_nic_dev *nic_dev) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:128:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 128 | int sss_nic_alloc_sq_desc_group(struct sss_nic_dev *nic_dev) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:153:6: error: no previous prototype for function 'sss_nic_free_sq_desc_group' [-Werror,-Wmissing-prototypes] 153 | void sss_nic_free_sq_desc_group(struct sss_nic_dev *nic_dev) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:153:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 153 | void sss_nic_free_sq_desc_group(struct sss_nic_dev *nic_dev) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:200:6: error: no previous prototype for function 'sss_nic_flush_all_sq' [-Werror,-Wmissing-prototypes] 200 | void sss_nic_flush_all_sq(struct sss_nic_dev *nic_dev) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:200:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 200 | void sss_nic_flush_all_sq(struct sss_nic_dev *nic_dev) | ^ | static 11 errors generated. -- In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:8: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/arm64/include/asm/cacheflush.h:11: In file included from include/linux/kgdb.h:19: In file included from include/linux/kprobes.h:28: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2204: >> include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> include/linux/vmstat.h:522:36: error: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Werror,-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:80:5: error: no previous prototype for function 'sss_nic_alloc_rq_res_group' [-Werror,-Wmissing-prototypes] 80 | int sss_nic_alloc_rq_res_group(struct sss_nic_dev *nic_dev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:80:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 80 | int sss_nic_alloc_rq_res_group(struct sss_nic_dev *nic_dev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:136:6: error: no previous prototype for function 'sss_nic_free_rq_res_group' [-Werror,-Wmissing-prototypes] 136 | void sss_nic_free_rq_res_group(struct sss_nic_dev *nic_dev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:136:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 136 | void sss_nic_free_rq_res_group(struct sss_nic_dev *nic_dev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:208:5: error: no previous prototype for function 'sss_nic_init_rq_desc_group' [-Werror,-Wmissing-prototypes] 208 | int sss_nic_init_rq_desc_group(struct sss_nic_dev *nic_dev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:208:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 208 | int sss_nic_init_rq_desc_group(struct sss_nic_dev *nic_dev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:235:6: error: no previous prototype for function 'sss_nic_free_rq_desc_group' [-Werror,-Wmissing-prototypes] 235 | void sss_nic_free_rq_desc_group(struct sss_nic_dev *nic_dev) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:235:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 235 | void sss_nic_free_rq_desc_group(struct sss_nic_dev *nic_dev) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:241:5: error: no previous prototype for function 'sss_nic_alloc_rq_desc_group' [-Werror,-Wmissing-prototypes] 241 | int sss_nic_alloc_rq_desc_group(struct sss_nic_dev *nic_dev) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:241:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 241 | int sss_nic_alloc_rq_desc_group(struct sss_nic_dev *nic_dev) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:267:5: error: no previous prototype for function 'sss_nic_update_rx_rss' [-Werror,-Wmissing-prototypes] 267 | int sss_nic_update_rx_rss(struct sss_nic_dev *nic_dev) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:267:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 267 | int sss_nic_update_rx_rss(struct sss_nic_dev *nic_dev) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:282:6: error: no previous prototype for function 'sss_nic_reset_rx_rss' [-Werror,-Wmissing-prototypes] 282 | void sss_nic_reset_rx_rss(struct net_device *netdev) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:282:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 282 | void sss_nic_reset_rx_rss(struct net_device *netdev) | ^ | static 12 errors generated. -- In file included from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_reset.c:8: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/arm64/include/asm/cacheflush.h:11: In file included from include/linux/kgdb.h:19: In file included from include/linux/kprobes.h:28: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2204: >> include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> include/linux/vmstat.h:522:36: error: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Werror,-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_reset.c:179:6: error: no previous prototype for function 'sss_nic_rq_watchdog_handler' [-Werror,-Wmissing-prototypes] 179 | void sss_nic_rq_watchdog_handler(struct work_struct *work) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_reset.c:179:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 179 | void sss_nic_rq_watchdog_handler(struct work_struct *work) | ^ | static 6 errors generated. .. vim +508 include/linux/vmstat.h 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 504 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 505 #ifdef CONFIG_NUMA 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 506 static inline const char *numa_stat_name(enum numa_stat_item item) 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 507 { 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 @508 return vmstat_text[NR_VM_ZONE_STAT_ITEMS + 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 509 item]; 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 510 } 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 511 #endif /* CONFIG_NUMA */ 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 512 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 513 static inline const char *node_stat_name(enum node_stat_item item) 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 514 { 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 @515 return vmstat_text[NR_VM_ZONE_STAT_ITEMS + f19298b9516c1a Mel Gorman 2021-06-28 516 NR_VM_NUMA_EVENT_ITEMS + 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 517 item]; 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 518 } 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 519 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 520 static inline const char *lru_list_name(enum lru_list lru) 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 521 { 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 @522 return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 523 } 9d7ea9a297e644 Konstantin Khlebnikov 2019-12-04 524 :::::: The code at line 508 was first introduced by commit :::::: 9d7ea9a297e6445d567056f15b469dde13ca4134 mm/vmstat: add helpers to get vmstat item names for each enum type :::::: TO: Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 23822/30000] drivers/gpu/drm/inspur/inspur_cursor.c:54:32: sparse: sparse: cast removes address space '__iomem' of expression
by kernel test robot 11 Apr '24

11 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: f1776d0ca22cf72bfcdc93dced47d9dde9934d97 commit: b9d65551a3adfa87a7c5d33391187ee60a1b501d [23822/30000] drm: add inspur drm driver support config: x86_64-randconfig-r122-20240410 (https://download.01.org/0day-ci/archive/20240411/202404110414.lls2ROdf-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240411/202404110414.lls2ROdf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404110414.lls2ROdf-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/gpu/drm/inspur/inspur_cursor.c:54:32: sparse: sparse: cast removes address space '__iomem' of expression -- >> drivers/gpu/drm/inspur/inspur_drm_drv.c:30:13: sparse: sparse: symbol 'inspur_drm_interrupt' was not declared. Should it be static? vim +/__iomem +54 drivers/gpu/drm/inspur/inspur_cursor.c 49 50 #define HW_FLAG_OFFSET 0x01ffff00 51 #define HW_FLAG_ENABLE 0x1bd40750 52 unsigned char getKVMHWCursorSetting(struct inspur_drm_private *priv) 53 { > 54 unsigned int value = *(unsigned int *)(priv->fb_map + HW_FLAG_OFFSET); -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21349/22070] drivers/mmc/host/phytium-mci-pci.c:48:15: error: implicit declaration of function 'pcim_enable_device'; did you mean 'pci_enable_device'?
by kernel test robot 11 Apr '24

11 Apr '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b7534a0d66b224a89df1826d1494d121b15ada5 commit: d65622e6edee11f7fcbd295bdb5aef86e12dfef3 [21349/22070] mmc: add support for Phytium MMC config: arm64-randconfig-002-20240411 (https://download.01.org/0day-ci/archive/20240411/202404110253.L2D6kNbe-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240411/202404110253.L2D6kNbe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404110253.L2D6kNbe-lkp@intel.com/ All error/warnings (new ones prefixed by >>): drivers/mmc/host/phytium-mci-pci.c: In function 'phytium_mci_pci_probe': >> drivers/mmc/host/phytium-mci-pci.c:48:15: error: implicit declaration of function 'pcim_enable_device'; did you mean 'pci_enable_device'? [-Werror=implicit-function-declaration] 48 | ret = pcim_enable_device(pdev); | ^~~~~~~~~~~~~~~~~~ | pci_enable_device >> drivers/mmc/host/phytium-mci-pci.c:61:9: error: implicit declaration of function 'pci_enable_msi'; did you mean 'pci_enable_sriov'? [-Werror=implicit-function-declaration] 61 | pci_enable_msi(pdev); | ^~~~~~~~~~~~~~ | pci_enable_sriov drivers/mmc/host/phytium-mci-pci.c: At top level: >> drivers/mmc/host/phytium-mci-pci.c:180:1: warning: data definition has no type or storage class 180 | module_pci_driver(phytium_mci_pci_driver); | ^~~~~~~~~~~~~~~~~ >> drivers/mmc/host/phytium-mci-pci.c:180:1: error: type defaults to 'int' in declaration of 'module_pci_driver' [-Werror=implicit-int] >> drivers/mmc/host/phytium-mci-pci.c:180:1: warning: parameter names (without types) in function declaration >> drivers/mmc/host/phytium-mci-pci.c:171:26: warning: 'phytium_mci_pci_driver' defined but not used [-Wunused-variable] 171 | static struct pci_driver phytium_mci_pci_driver = { | ^~~~~~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +48 drivers/mmc/host/phytium-mci-pci.c 40 41 static int 42 phytium_mci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *pid) 43 { 44 struct phytium_mci_host *host; 45 struct mmc_host *mmc; 46 int ret; 47 > 48 ret = pcim_enable_device(pdev); 49 50 if (ret) 51 return ret; 52 pci_set_master(pdev); 53 54 mmc = mmc_alloc_host(sizeof(struct phytium_mci_host), &pdev->dev); 55 56 if (!mmc) 57 return -ENOMEM; 58 59 host = mmc_priv(mmc); 60 > 61 pci_enable_msi(pdev); 62 63 host->irq = pdev->irq; 64 host->irq_flags = IRQF_SHARED; 65 host->dev = &pdev->dev; 66 ret = pcim_iomap_regions(pdev, 1 << PCI_BAR_NO, pci_name(pdev)); 67 68 if (ret) { 69 dev_err(&pdev->dev, "I/O memory remapping failed\n"); 70 goto host_free; 71 } 72 73 host->base = pcim_iomap_table(pdev)[PCI_BAR_NO]; 74 host->is_use_dma = 1; 75 host->is_device_x100 = 1; 76 77 if (pdev->devfn == 2) { 78 host->caps = emmc_caps; 79 host->caps2 = emmc_caps2; 80 } else { 81 host->caps = sd_caps; 82 host->caps2 = sd_caps2; 83 mmc->f_max = 25000000; /* stable frequency */ 84 } 85 86 host->mmc = mmc; 87 host->clk_rate = MCI_CLK; 88 89 dev_info(&pdev->dev, 90 "%s %d:[bar %d] addr:0x%llx size:0x%llx km:0x%llx devfn:%d\n", 91 __func__, __LINE__, PCI_BAR_NO, pci_resource_start(pdev, 0), 92 pci_resource_len(pdev, 0), (uint64_t)host->base, pdev->devfn); 93 94 dev_dbg(&pdev->dev, "%s %d:irq:0x%x\n", __func__, __LINE__, host->irq); 95 96 ret = phytium_mci_common_probe(host); 97 98 if (ret == MCI_REALEASE_MEM) { 99 ret = -ENOMEM; 100 goto release_mem; 101 } else if (ret) { 102 goto release; 103 } 104 pci_set_drvdata(pdev, mmc); 105 dev_info(&pdev->dev, 106 "%s %d: probe phytium mci successful.\n", __func__, __LINE__); 107 return 0; 108 109 release: 110 phytium_mci_deinit_hw(host); 111 release_mem: 112 113 if (host->dma.adma_table) { 114 dma_free_coherent(&pdev->dev, 115 MAX_BD_NUM * sizeof(struct phytium_adma2_64_desc), 116 host->dma.adma_table, host->dma.adma_addr); 117 } 118 host_free: 119 mmc_free_host(mmc); 120 pci_disable_device(pdev); 121 return ret; 122 } 123 124 static void phytium_mci_pci_remove(struct pci_dev *pdev) 125 { 126 struct phytium_mci_host *host; 127 struct mmc_host *mmc; 128 129 mmc = pci_get_drvdata(pdev); 130 if (!mmc) { 131 dev_info(&pdev->dev, 132 "%s %d: mmc is null.\n", __func__, __LINE__); 133 return; 134 } 135 host = mmc_priv(mmc); 136 if (!host) { 137 dev_info(&pdev->dev, 138 "%s %d: host is null.\n", __func__, __LINE__); 139 mmc_remove_host(mmc); 140 mmc_free_host(mmc); 141 return; 142 } 143 144 del_timer(&host->hotplug_timer); 145 146 mmc_remove_host(host->mmc); 147 148 if (host->dma.adma_table) { 149 dma_free_coherent(&pdev->dev, 150 MAX_BD_NUM * sizeof(struct phytium_adma2_64_desc), 151 host->dma.adma_table, host->dma.adma_addr); 152 } 153 phytium_mci_deinit_hw(host); 154 mmc_free_host(mmc); 155 pci_set_drvdata(pdev, NULL); 156 } 157 158 static const struct pci_device_id phytium_mci_pci_tbl[] = { 159 { 160 .vendor = 0x1DB7, 161 .device = 0xDC28, 162 .subvendor = PCI_ANY_ID, 163 .subdevice = PCI_ANY_ID, 164 .class = 0x5, 165 .class_mask = 0, 166 }, 167 {} 168 }; 169 MODULE_DEVICE_TABLE(pci, phytium_mci_pci_tbl); 170 > 171 static struct pci_driver phytium_mci_pci_driver = { 172 .name = "phytium-mci-pci", 173 .id_table = phytium_mci_pci_tbl, 174 .probe = phytium_mci_pci_probe, 175 .remove = phytium_mci_pci_remove, 176 .driver = { 177 .pm = &phytium_mci_dev_pm_ops, 178 } 179 }; > 180 module_pci_driver(phytium_mci_pci_driver); 181 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
by Ze Zuo 10 Apr '24

10 Apr '24

From: Zach O'Keefe <zokeefe(a)google.com> stable inclusion from stable-v5.10.210 commit 81e7d2530d458548b90a5c5e76b77ad5e5d1c0df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2EC CVE: CVE-2024-26720 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9319b647902cbd5cc884ac08a8a6d54ce111fc78 upstream. (struct dirty_throttle_control *)->thresh is an unsigned long, but is passed as the u32 divisor argument to div_u64(). On architectures where unsigned long is 64 bytes, the argument will be implicitly truncated. Use div64_u64() instead of div_u64() so that the value used in the "is this a safe division" check is the same as the divisor. Also, remove redundant cast of the numerator to u64, as that should happen implicitly. This would be difficult to exploit in memcg domain, given the ratio-based arithmetic domain_drity_limits() uses, but is much easier in global writeback domain with a BDI_CAP_STRICTLIMIT-backing device, using e.g. vm.dirty_bytes=(1<<32)*PAGE_SIZE so that dtc->thresh == (1<<32) Link: https://lkml.kernel.org/r/20240118181954.1415197-1-zokeefe@google.com Fixes: f6789593d5ce ("mm/page-writeback.c: fix divide by zero in bdi_dirty_limits()") Signed-off-by: Zach O'Keefe <zokeefe(a)google.com> Cc: Maxim Patlasov <MPatlasov(a)parallels.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/page-writeback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/page-writeback.c b/mm/page-writeback.c index b72da123f242..e969667e8d62 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -1519,7 +1519,7 @@ static inline void wb_dirty_limits(struct dirty_throttle_control *dtc) */ dtc->wb_thresh = __wb_calc_thresh(dtc); dtc->wb_bg_thresh = dtc->thresh ? - div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; + div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; /* * In order to avoid the stacked BDI deadlock we need -- 2.25.1

2 1

[openeuler:OLK-5.10 20978/30000] drivers/video/fbdev/ls2k500sfb.c:140:27: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 10 Apr '24

10 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: f1776d0ca22cf72bfcdc93dced47d9dde9934d97 commit: d74f3b70d73220d919db010ec1c81aa1d89082b6 [20978/30000] fbdev: add ls2k500sfb driver for ls2k500 bmc. config: x86_64-randconfig-r122-20240410 (https://download.01.org/0day-ci/archive/20240410/202404102205.GZY9jAYq-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240410/202404102205.GZY9jAYq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404102205.GZY9jAYq-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/video/fbdev/ls2k500sfb.c:140:27: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *static p @@ got void [noderef] __iomem * @@ drivers/video/fbdev/ls2k500sfb.c:140:27: sparse: expected void *static p drivers/video/fbdev/ls2k500sfb.c:140:27: sparse: got void [noderef] __iomem * >> drivers/video/fbdev/ls2k500sfb.c:142:30: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void *static p @@ drivers/video/fbdev/ls2k500sfb.c:142:30: sparse: expected void const volatile [noderef] __iomem *addr drivers/video/fbdev/ls2k500sfb.c:142:30: sparse: got void *static p >> drivers/video/fbdev/ls2k500sfb.c:196:36: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void *static p @@ drivers/video/fbdev/ls2k500sfb.c:196:36: sparse: expected void volatile [noderef] __iomem *addr drivers/video/fbdev/ls2k500sfb.c:196:36: sparse: got void *static p >> drivers/video/fbdev/ls2k500sfb.c:198:37: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/video/fbdev/ls2k500sfb.c:198:37: sparse: expected void const volatile [noderef] __iomem *addr drivers/video/fbdev/ls2k500sfb.c:198:37: sparse: got void * >> drivers/video/fbdev/ls2k500sfb.c:251:13: sparse: sparse: symbol 'ls2k500sfb_interrupt' was not declared. Should it be static? >> drivers/video/fbdev/ls2k500sfb.c:453:28: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got char *preg @@ drivers/video/fbdev/ls2k500sfb.c:453:28: sparse: expected void const volatile [noderef] __iomem *addr drivers/video/fbdev/ls2k500sfb.c:453:28: sparse: got char *preg >> drivers/video/fbdev/ls2k500sfb.c:454:32: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got char *preg @@ drivers/video/fbdev/ls2k500sfb.c:454:32: sparse: expected void volatile [noderef] __iomem *addr drivers/video/fbdev/ls2k500sfb.c:454:32: sparse: got char *preg >> drivers/video/fbdev/ls2k500sfb.c:566:19: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected char *penv @@ got void [noderef] __iomem * @@ drivers/video/fbdev/ls2k500sfb.c:566:19: sparse: expected char *penv drivers/video/fbdev/ls2k500sfb.c:566:19: sparse: got void [noderef] __iomem * >> drivers/video/fbdev/ls2k500sfb.c:567:19: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected char *preg @@ got void [noderef] __iomem * @@ drivers/video/fbdev/ls2k500sfb.c:567:19: sparse: expected char *preg drivers/video/fbdev/ls2k500sfb.c:567:19: sparse: got void [noderef] __iomem * drivers/video/fbdev/ls2k500sfb.c:668:14: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected char *penv @@ got void [noderef] __iomem * @@ drivers/video/fbdev/ls2k500sfb.c:668:14: sparse: expected char *penv drivers/video/fbdev/ls2k500sfb.c:668:14: sparse: got void [noderef] __iomem * vim +140 drivers/video/fbdev/ls2k500sfb.c 110 111 static void ls2k500sfb_events_fn(struct work_struct *work) 112 { 113 struct ls2k500sfb_struct *priv = container_of(work, struct ls2k500sfb_struct, work); 114 struct pci_dev *pdev = priv->dev; 115 struct pci_dev *ppdev = pdev->bus->self; 116 uint32_t i, d, timeout, retry = 0; 117 static const uint32_t index[] = { 118 0x10, 0x14, 0x18, 0x1c, 0x20, 0x24, 0x30, 0x3c, 0x54, 0x58, 0x78, 0x7c, 0x80, 4 119 }; 120 121 static uint32_t data[sizeof(index) / 4]; 122 static const uint32_t cindex[] = { 0x10, 0x3c, 4 }; 123 124 static uint32_t cdata[sizeof(cindex) / 4]; 125 static uint32_t d80c, d71c, ctrl; 126 static void *p; 127 128 if (!priv->running) { 129 for (i = 0; i < ARRAY_SIZE(index); i++) 130 pci_read_config_dword(ppdev, index[i], &data[i]); 131 for (i = 0; i < ARRAY_SIZE(cindex); i++) 132 pci_read_config_dword(pdev, cindex[i], &cdata[i]); 133 if (ppdev->vendor == 0x14) { 134 pci_read_config_dword(ppdev, 0x80c, &d80c); 135 d80c = (d80c & ~(3 << 17)) | (1 << 17); 136 137 pci_read_config_dword(ppdev, 0x71c, &d71c); 138 d71c |= 1 << 26; 139 > 140 p = pci_iomap(ppdev, 0, 0x100); 141 } > 142 ctrl = readl(p); 143 return; 144 } 145 local_bh_disable(); 146 pciebreak_smp_send_stop(100); 147 wmb(); /* flush all write before we disable pcie window */ 148 pci_write_config_dword(ppdev, 0x18, 0); 149 pci_write_config_dword(ppdev, 0x1c, 0); 150 pci_write_config_dword(ppdev, 0x20, 0); 151 atomic_set(&waiting_for_pciebreak_ipi, 0); 152 wmb(); /* flush all write after change pcie window */ 153 local_bh_enable(); 154 if (ppdev->vendor == 0x14) { 155 timeout = 10000; 156 while (timeout) { 157 pci_read_config_dword(ppdev, 0x10, &d); 158 d &= ~0xf; 159 if (!d) 160 break; 161 mdelay(1); 162 timeout--; 163 }; 164 if (!timeout) 165 pr_info("bar not clear 0\n"); 166 167 pci_read_config_dword(ppdev, 0x0, &d); 168 pr_info("pcie port deviceid=0x%x recover begin\n", d); 169 retrain: 170 while (1) { 171 pci_write_config_dword(ppdev, index[0], data[0]); 172 pci_read_config_dword(ppdev, index[0], &d); 173 d &= ~0xf; 174 if (d) 175 break; 176 mdelay(1); 177 } 178 179 while (1) { 180 for (i = 0; i < ARRAY_SIZE(index); i++) { 181 if (index[i] != 0x18 && index[i] != 0x1c && index[i] != 0x20) 182 pci_write_config_dword(ppdev, index[i], data[i]); 183 } 184 pci_write_config_dword(ppdev, 0x80c, d80c); 185 pci_write_config_dword(ppdev, 0x71c, d71c); 186 187 pci_read_config_dword(ppdev, 0x10, &d); 188 d &= ~0xf; 189 if (d) 190 break; 191 mdelay(1); 192 } 193 194 timeout = 10000; 195 > 196 writel(ctrl | 0x8, p); 197 while (1) { > 198 d = readl(p + 0xc); 199 if ((d & 0x11) == 0x11) { 200 break; 201 } else if (!timeout) { 202 pr_info("pcie train failed status=0x%x\n", d); 203 goto out; 204 } 205 mdelay(1); 206 timeout--; 207 } 208 209 210 pr_info("pcie recovered done\n"); 211 212 if (!retry) { 213 /*wait u-boot ddr config */ 214 set_current_state(TASK_UNINTERRUPTIBLE); 215 schedule_timeout(HZ*resetbootwait); 216 set_current_state(TASK_RUNNING); 217 pci_read_config_dword(ppdev, 0x10, &d); 218 d &= ~0xf; 219 if (!d) { 220 retry = 1; 221 goto retrain; 222 } 223 } 224 } else { 225 set_current_state(TASK_UNINTERRUPTIBLE); 226 schedule_timeout(HZ*resetbootwait); 227 set_current_state(TASK_RUNNING); 228 } 229 local_bh_disable(); 230 pciebreak_smp_send_stop(10000); 231 wmb(); /* flush all write before we update pcie window */ 232 for (i = 0; i < ARRAY_SIZE(index); i++) 233 pci_write_config_dword(ppdev, index[i], data[i]); 234 235 for (i = 0; i < ARRAY_SIZE(cindex); i++) 236 pci_write_config_dword(pdev, cindex[i], cdata[i]); 237 atomic_set(&waiting_for_pciebreak_ipi, 0); 238 wmb(); /* flush all write after we update pcie window */ 239 local_bh_enable(); 240 241 242 pr_info("redraw console\n"); 243 244 saved_console = fg_console; 245 switch_console(fg_console > 0?fg_console - 1 : fg_console + 1); 246 queue_delayed_work(priv->wq, &priv->redraw_work, HZ); 247 out: 248 priv->running = 0; 249 } 250 > 251 irqreturn_t ls2k500sfb_interrupt(int irq, void *arg) 252 { 253 struct ls2k500sfb_struct *priv = arg; 254 struct pci_dev *pdev = priv->dev; 255 256 if (irq == pdev->irq) 257 pr_info("ls2k500sfb pcie interrupt\n"); 258 else 259 pr_info("ls2k500sfb gpio interrupt\n"); 260 if (system_state != SYSTEM_RUNNING) 261 return IRQ_HANDLED; 262 263 if (!priv->running) { 264 if (!resetdelay || time_after(jiffies, priv->reset_time + resetdelay * HZ)) { 265 priv->running = 1; 266 queue_work(priv->wq, &priv->work); 267 } 268 priv->reset_time = jiffies; 269 } 270 return IRQ_HANDLED; 271 } 272 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 00/23] arm64 bpf trampoline for olk-5.10
by Pu Lehui 10 Apr '24

10 Apr '24

Alexander Duyck (1): bpf, arm64: Fix BTI type used for freplace attached functions Dmitrii Banshchikov (1): bpf: Use MAX_BPF_FUNC_REG_ARGS macro Florent Revest (1): bpf, arm64: Support struct arguments in the BPF trampoline Nathan Chancellor (1): bpf, arm64: Mark dummy_tramp as global Peter Zijlstra (1): x86/ibt,ftrace: Search for __fentry__ location Xu Kuohai (12): arm64, insn: Add ldr/str with immediate offset bpf, arm64: Optimize BPF store/load using arm64 str/ldr(immediate offset) bpf, arm64: Adjust the offset of str/ldr(immediate) to positive number arm64: Add LDR (literal) instruction bpf, arm64: Implement bpf_arch_text_poke() for arm64 bpf, arm64: Add bpf trampoline for arm64 bpf, arm64: Fix compile error in dummy_tramp() bpf, arm64: Fix bpf trampoline instruction endianness ftrace: Allow users to disable ftrace direct call arm64: ftrace: Support long jump for ftrace direct call arm64: ftrace: Add ftrace direct call support arm64: ftrace: Support direct call for no literal module functions Yonghong Song (6): bpf: Always return corresponding btf_type in __get_type_size() bpf: Allow struct argument in trampoline based programs bpf: x86: Support in-register struct arguments in trampoline programs bpf: arm64: No support of struct argument in trampoline programs libbpf: Add new BPF_PROG2 macro selftests/bpf: Add struct argument tests with fentry/fexit programs. arch/arm64/Kconfig | 2 + arch/arm64/Makefile | 4 + arch/arm64/include/asm/ftrace.h | 31 +- arch/arm64/include/asm/insn.h | 14 + arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kernel/entry-ftrace.S | 39 +- arch/arm64/kernel/ftrace.c | 248 ++++- arch/arm64/kernel/insn.c | 111 ++- arch/arm64/net/bpf_jit.h | 21 + arch/arm64/net/bpf_jit_comp.c | 881 +++++++++++++++++- arch/x86/kernel/kprobes/core.c | 11 +- arch/x86/net/bpf_jit_comp.c | 60 +- include/linux/bpf.h | 9 + include/linux/ftrace.h | 3 + kernel/bpf/btf.c | 77 +- kernel/bpf/trampoline.c | 20 +- kernel/bpf/verifier.c | 2 +- kernel/kprobes.c | 8 +- kernel/trace/Kconfig | 7 +- kernel/trace/ftrace.c | 65 +- net/bpf/test_run.c | 57 +- tools/lib/bpf/bpf_tracing.h | 79 ++ .../selftests/bpf/prog_tests/tracing_struct.c | 71 ++ .../selftests/bpf/progs/tracing_struct.c | 127 +++ 24 files changed, 1796 insertions(+), 152 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/tracing_struct.c create mode 100644 tools/testing/selftests/bpf/progs/tracing_struct.c -- 2.34.1

2 24

[PATCH OLK-5.10] btrfs: dev-replace: properly validate device names
by Long Li 10 Apr '24

10 Apr '24

From: David Sterba <dsterba(a)suse.com> stable inclusion from stable-v5.10.167 commit 2886fe308a83968dde252302884a1e63351cf16d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E469 CVE: CVE-2024-26791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9845664b9ee47ce7ee7ea93caf47d39a9d4552c4 upstream. There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getname_kernel(). Add a helper that validates both source and target device name buffers. For devid as the source initialize the buffer to empty string in case something tries to read it later. This was originally analyzed and fixed in a different way by Edward Adam Davis (see links). Link: https://lore.kernel.org/linux-btrfs/000000000000d1a1d1060cc9c5e7@google.com/ Link: https://lore.kernel.org/linux-btrfs/tencent_44CA0665C9836EF9EEC80CB9E7E206D… CC: stable(a)vger.kernel.org # 4.19+ CC: Edward Adam Davis <eadavis(a)qq.com> Reported-and-tested-by: syzbot+33f23b49ac24f986c9e8(a)syzkaller.appspotmail.com Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/dev-replace.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c index be6935d19197..9a6055659c1a 100644 --- a/fs/btrfs/dev-replace.c +++ b/fs/btrfs/dev-replace.c @@ -566,6 +566,23 @@ static int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info, return ret; } +static int btrfs_check_replace_dev_names(struct btrfs_ioctl_dev_replace_args *args) +{ + if (args->start.srcdevid == 0) { + if (memchr(args->start.srcdev_name, 0, + sizeof(args->start.srcdev_name)) == NULL) + return -ENAMETOOLONG; + } else { + args->start.srcdev_name[0] = 0; + } + + if (memchr(args->start.tgtdev_name, 0, + sizeof(args->start.tgtdev_name)) == NULL) + return -ENAMETOOLONG; + + return 0; +} + int btrfs_dev_replace_by_ioctl(struct btrfs_fs_info *fs_info, struct btrfs_ioctl_dev_replace_args *args) { @@ -578,10 +595,9 @@ int btrfs_dev_replace_by_ioctl(struct btrfs_fs_info *fs_info, default: return -EINVAL; } - - if ((args->start.srcdevid == 0 && args->start.srcdev_name[0] == '\0') || - args->start.tgtdev_name[0] == '\0') - return -EINVAL; + ret = btrfs_check_replace_dev_names(args); + if (ret < 0) + return ret; ret = btrfs_dev_replace_start(fs_info, args->start.tgtdev_name, args->start.srcdevid, -- 2.31.1

2 1

[PATCH OLK-5.10] dm-crypt: don't modify the data when using authenticated encryption
by Li Lingfeng 10 Apr '24

10 Apr '24

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v5.10.211 commit 3c652f6fa1e1f9f02c3fbf359d260ad153ec5f90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LW CVE: CVE-2024-26763 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 50c70240097ce41fe6bce6478b80478281e4d0f7 upstream. It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified [1]. So, fix this problem by copying the data into the clone bio first and then encrypt them inside the clone bio. This may reduce performance, but it is needed to prevent the user from corrupting the device by writing data with O_DIRECT and modifying them at the same time. [1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/ Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-crypt.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index 5d772f322a24..5edcdcee91c2 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -2064,6 +2064,12 @@ static void kcryptd_crypt_write_convert(struct dm_crypt_io *io) io->ctx.bio_out = clone; io->ctx.iter_out = clone->bi_iter; + if (crypt_integrity_aead(cc)) { + bio_copy_data(clone, io->base_bio); + io->ctx.bio_in = clone; + io->ctx.iter_in = clone->bi_iter; + } + sector += bio_sectors(clone); crypt_inc_pending(io); -- 2.31.1

2 1

[PATCH OLK-5.10] EDAC/thunderx: Fix possible out-of-bounds string access
by Lu Jialin 10 Apr '24

10 Apr '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v5.10.209 commit 6aa7865ba7ff7f0ede0035180fb3b9400ceb405a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EBW CVE: CVE-2023-52464 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ] Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ] Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- drivers/edac/thunderx_edac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c index 0eb5eb97fd74..3b0e1fe27d93 100644 --- a/drivers/edac/thunderx_edac.c +++ b/drivers/edac/thunderx_edac.c @@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_errors, ctx->reg_com_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); for (lane = 0; lane < OCX_RX_LANES; lane++) if (ctx->reg_com_int & BIT(lane)) { @@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) lane, ctx->reg_lane_int[lane], lane, ctx->reg_lane_stat11[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); decode_register(other, OCX_OTHER_SIZE, ocx_lane_errors, ctx->reg_lane_int[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); } if (ctx->reg_com_int & OCX_COM_INT_CE) @@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_link_errors, ctx->reg_com_link_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); @@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); - strncat(msg, other, L2C_MESSAGE_SIZE); + strlcat(msg, other, L2C_MESSAGE_SIZE); if (ctx->reg_int & mask_ue) edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); -- 2.34.1

2 1

[PATCH 1/7] Update kernel headers
by Chengchang Tang 10 Apr '24

10 Apr '24

driver inclusion category: feature bugzilla: https://gitee.com/src-openeuler/rdma-core/issues/I9C2AQ ------------------------------------------------------------------ To commit ?? ("RDMA/hns: Fixes concurrent ressetting and post_recv in DCA mode"). Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Reviewed-by: Yangyang Li <liyangyang20(a)huawei.com> --- kernel-headers/rdma/hns-abi.h | 73 ++++++++++++++++++++++++++++++++++- 1 file changed, 72 insertions(+), 1 deletion(-) diff --git a/kernel-headers/rdma/hns-abi.h b/kernel-headers/rdma/hns-abi.h index 1d51612..8a8f2e4 100644 --- a/kernel-headers/rdma/hns-abi.h +++ b/kernel-headers/rdma/hns-abi.h @@ -102,7 +102,9 @@ enum hns_roce_qp_cap_flags { HNS_ROCE_QP_CAP_RQ_RECORD_DB = 1 << 0, HNS_ROCE_QP_CAP_SQ_RECORD_DB = 1 << 1, HNS_ROCE_QP_CAP_OWNER_DB = 1 << 2, + HNS_ROCE_QP_CAP_DYNAMIC_CTX_ATTACH = 1 << 4, HNS_ROCE_QP_CAP_DIRECT_WQE = 1 << 5, + HNS_ROCE_QP_CAP_DYNAMIC_CTX_DETACH = 1 << 6, }; struct hns_roce_ib_create_qp_resp { @@ -114,12 +116,15 @@ struct hns_roce_ib_modify_qp_resp { __u8 tc_mode; __u8 priority; __u8 reserved[6]; + __u32 dcan; + __u32 rsv2; }; enum { HNS_ROCE_EXSGE_FLAGS = 1 << 0, HNS_ROCE_RQ_INLINE_FLAGS = 1 << 1, HNS_ROCE_CQE_INLINE_FLAGS = 1 << 2, + HNS_ROCE_UCTX_CONFIG_DCA = 1 << 3, HNS_ROCE_UCTX_DYN_QP_PGSZ = 1 << 4, }; @@ -127,6 +132,7 @@ enum { HNS_ROCE_RSP_EXSGE_FLAGS = 1 << 0, HNS_ROCE_RSP_RQ_INLINE_FLAGS = 1 << 1, HNS_ROCE_RSP_CQE_INLINE_FLAGS = 1 << 2, + HNS_ROCE_UCTX_RSP_DCA_FLAGS = HNS_ROCE_UCTX_CONFIG_DCA, HNS_ROCE_UCTX_RSP_DYN_QP_PGSZ = HNS_ROCE_UCTX_DYN_QP_PGSZ, }; @@ -139,12 +145,20 @@ struct hns_roce_ib_alloc_ucontext_resp { __u32 max_inline_data; __u8 congest_type; __u8 reserved0[7]; - __aligned_u64 rsv_for_dca[2]; + __u32 dca_qps; + __u32 dca_mmap_size; + __aligned_u64 dca_mmap_key; __aligned_u64 reset_mmap_key; }; +enum hns_roce_uctx_comp_mask { + HNS_ROCE_ALLOC_UCTX_COMP_DCA_MAX_QPS = 1 << 0, +}; + struct hns_roce_ib_alloc_ucontext { __u32 config; + __u32 comp; /* use hns_roce_uctx_comp_mask */ + __u32 dca_max_qps; __u32 reserved; }; @@ -158,4 +172,61 @@ struct hns_roce_ib_create_ah_resp { __u8 tc_mode; }; +#define UVERBS_ID_NS_MASK 0xF000 +#define UVERBS_ID_NS_SHIFT 12 + +enum hns_ib_objects { + HNS_IB_OBJECT_DCA_MEM = (1U << UVERBS_ID_NS_SHIFT), +}; + +enum hns_ib_dca_mem_methods { + HNS_IB_METHOD_DCA_MEM_REG = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_METHOD_DCA_MEM_DEREG, + HNS_IB_METHOD_DCA_MEM_SHRINK, + HNS_IB_METHOD_DCA_MEM_ATTACH, + HNS_IB_METHOD_DCA_MEM_DETACH, + HNS_IB_METHOD_DCA_MEM_QUERY, +}; + +enum hns_ib_dca_mem_reg_attrs { + HNS_IB_ATTR_DCA_MEM_REG_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_ATTR_DCA_MEM_REG_FLAGS, + HNS_IB_ATTR_DCA_MEM_REG_LEN, + HNS_IB_ATTR_DCA_MEM_REG_ADDR, + HNS_IB_ATTR_DCA_MEM_REG_KEY, +}; + +enum hns_ib_dca_mem_dereg_attrs { + HNS_IB_ATTR_DCA_MEM_DEREG_HANDLE = (1U << UVERBS_ID_NS_SHIFT), +}; + +enum hns_ib_dca_mem_shrink_attrs { + HNS_IB_ATTR_DCA_MEM_SHRINK_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_ATTR_DCA_MEM_SHRINK_RESERVED_SIZE, + HNS_IB_ATTR_DCA_MEM_SHRINK_OUT_FREE_KEY, + HNS_IB_ATTR_DCA_MEM_SHRINK_OUT_FREE_MEMS, +}; + +enum hns_ib_dca_mem_attach_attrs { + HNS_IB_ATTR_DCA_MEM_ATTACH_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_ATTR_DCA_MEM_ATTACH_SQ_OFFSET, + HNS_IB_ATTR_DCA_MEM_ATTACH_SGE_OFFSET, + HNS_IB_ATTR_DCA_MEM_ATTACH_RQ_OFFSET, + HNS_IB_ATTR_DCA_MEM_ATTACH_OUT_ALLOC_FLAGS, + HNS_IB_ATTR_DCA_MEM_ATTACH_OUT_ALLOC_PAGES, +}; + +enum hns_ib_dca_mem_detach_attrs { + HNS_IB_ATTR_DCA_MEM_DETACH_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_ATTR_DCA_MEM_DETACH_SQ_INDEX, +}; + +enum hns_ib_dca_mem_query_attrs { + HNS_IB_ATTR_DCA_MEM_QUERY_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_ATTR_DCA_MEM_QUERY_PAGE_INDEX, + HNS_IB_ATTR_DCA_MEM_QUERY_OUT_KEY, + HNS_IB_ATTR_DCA_MEM_QUERY_OUT_OFFSET, + HNS_IB_ATTR_DCA_MEM_QUERY_OUT_PAGE_COUNT, +}; + #endif /* HNS_ABI_USER_H */ -- 2.33.0

1 6

[OLK-6.6 00/12] Support hns roce DCA mode
by Chengchang Tang 10 Apr '24

10 Apr '24

From: Juan Zhou <zhoujuan51(a)h-partners.com> Support hns roce DCA mode. Chengchang Tang (12): RDMA/hns: Introduce DCA for RC QP RDMA/hns: Add method for shrinking DCA memory pool RDMA/hns: Configure DCA mode for the userspace QP RDMA/hns: Add method for attaching WQE buffer RDMA/hns: Setup the configuration of WQE addressing to QPC RDMA/hns: Add method to detach WQE buffer RDMA/hns: Add method to query WQE buffer's address RDMA/hns: Add DCA support for kernel space RDMA/hns: Add debugfs support for DCA RDMA/hns: Optimize user DCA perfermance by sharing DCA status RDMA/hns: Fixes concurrent ressetting and post_recv in DCA mode RDMA/hns: Fix DCA's dependence on ib_uverbs drivers/infiniband/hw/hns/Makefile | 2 +- drivers/infiniband/hw/hns/hns_roce_dca.c | 1875 ++++++++++++++++++ drivers/infiniband/hw/hns/hns_roce_dca.h | 78 + drivers/infiniband/hw/hns/hns_roce_debugfs.c | 406 ++++ drivers/infiniband/hw/hns/hns_roce_debugfs.h | 19 + drivers/infiniband/hw/hns/hns_roce_device.h | 69 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 304 ++- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 5 + drivers/infiniband/hw/hns/hns_roce_main.c | 196 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 12 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 197 +- include/uapi/rdma/hns-abi.h | 73 +- 12 files changed, 3099 insertions(+), 137 deletions(-) create mode 100644 drivers/infiniband/hw/hns/hns_roce_dca.c create mode 100644 drivers/infiniband/hw/hns/hns_roce_dca.h -- 2.30.0

1 12